@thebackstoryis/engineering-with-ai 0.2.9

package/config/project.schema.json

@@ -0,0 +1,313 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwith.ai/schemas/project-v1.json",
+  "type": "object",
+  "required": ["schema", "project", "specs", "repositories", "approvals", "validation"],
+  "properties": {
+    "schema": { "const": "ewai.project/v1" },
+    "dashboard": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "sidebar_collapsed": { "type": "boolean", "default": false },
+        "optional_views": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "portfolio": { "type": "boolean", "default": false },
+            "team-hub": { "type": "boolean", "default": false },
+            "rollout": { "type": "boolean", "default": false },
+            "starters": { "type": "boolean", "default": false },
+            "policies": { "type": "boolean", "default": false },
+            "security": { "type": "boolean", "default": false },
+            "hooks": { "type": "boolean", "default": false },
+            "context-inspector": { "type": "boolean", "default": false },
+            "phase-studio": { "type": "boolean", "default": false }
+          }
+        }
+      }
+    },
+    "project": {
+      "type": "object",
+      "required": ["name"],
+      "properties": { "name": { "type": "string", "minLength": 1 } }
+    },
+    "specs": {
+      "type": "object",
+      "required": ["root"],
+      "properties": { "root": { "type": "string", "minLength": 1 } }
+    },
+    "repositories": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["name", "path", "role"],
+        "properties": {
+          "name": { "type": "string", "minLength": 1 },
+          "path": { "type": "string", "minLength": 1 },
+          "role": { "type": "string", "minLength": 1 }
+        }
+      }
+    },
+    "personas": {
+      "type": "object",
+      "properties": {
+        "premium": {
+          "type": "object",
+          "properties": {
+            "provider": { "const": "wordpress-edd" },
+            "server": { "type": "string", "pattern": "^https://" }
+          },
+          "additionalProperties": false
+        }
+      }
+    },
+    "blueprints": {
+      "type": "object",
+      "properties": {
+        "organisation": {
+          "type": "object",
+          "required": ["root", "packs", "selection_digest", "enabled_modules", "applied_modules", "approved_by", "approved_at", "evidence"],
+          "properties": {
+            "root": { "$ref": "#/$defs/blueprintPin" },
+            "packs": {
+              "type": "array",
+              "minItems": 1,
+              "items": { "$ref": "#/$defs/blueprintPin" }
+            },
+            "selection_digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+            "enabled_modules": {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" }
+            },
+            "applied_modules": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": { "type": "string", "minLength": 1 }
+            },
+            "approved_by": { "type": "string", "minLength": 1 },
+            "approved_at": { "type": "string", "format": "date-time" },
+            "evidence": { "const": "SPECS/5.Strategy/organisation-blueprint.md" }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    "design_system": { "$ref": "#/$defs/designSystemSelection" },
+    "organisation_policy": { "$ref": "#/$defs/organisationPolicySelection" },
+    "starter_materialisation": {
+      "type": "object",
+      "required": ["targets"],
+      "properties": {
+        "targets": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["role", "repository", "path"],
+            "properties": {
+              "role": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+              "repository": { "type": "string", "minLength": 1 },
+              "path": { "type": "string", "minLength": 1 }
+            },
+            "additionalProperties": false
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "source_map": {
+      "type": "object",
+      "required": ["profiles"],
+      "properties": {
+        "profiles": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/sourceMapProfile" }
+        }
+      },
+      "additionalProperties": false
+    },
+    "approvals": {
+      "type": "object",
+      "required": ["build", "destructive_operations"],
+      "properties": {
+        "build": { "enum": ["required", "optional"] },
+        "destructive_operations": { "const": "required" }
+      }
+    },
+    "validation": {
+      "type": "object",
+      "required": ["standards", "external"],
+      "properties": {
+        "standards": {
+          "type": "object",
+          "required": ["required", "allow_waiver"],
+          "properties": {
+            "required": { "const": true },
+            "allow_waiver": { "const": false }
+          },
+          "additionalProperties": false
+        },
+        "external": {
+          "type": "object",
+          "required": ["policy", "independent_only", "providers", "checkpoints"],
+          "properties": {
+            "policy": { "const": "configured" },
+            "independent_only": { "const": true },
+            "providers": {
+              "type": "object",
+              "required": ["claude", "codex", "antigravity"],
+              "properties": {
+                "claude": { "$ref": "#/$defs/provider" },
+                "codex": { "$ref": "#/$defs/provider" },
+                "antigravity": { "$ref": "#/$defs/provider" }
+              },
+              "additionalProperties": false
+            },
+            "checkpoints": {
+              "type": "object",
+              "required": ["implementation-plan", "test-plan", "code"],
+              "properties": {
+                "implementation-plan": { "$ref": "#/$defs/checkpoint" },
+                "test-plan": { "$ref": "#/$defs/checkpoint" },
+                "code": { "$ref": "#/$defs/checkpoint" }
+              },
+              "additionalProperties": false
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "$defs": {
+    "sourceMapProfile": {
+      "type": "object",
+      "required": ["id", "patterns", "analyser", "classification"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9]+(?:[.-][a-z0-9]+)*$" },
+        "patterns": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 240,
+            "not": { "pattern": "(^/|^!|[\\\\{}()\\[\\]]|(^|/)\\.\\.(/|$))" }
+          }
+        },
+        "analyser": { "enum": ["inventory-only", "text-summary", "structured-keys", "tree-sitter", "power-platform-metadata", "salesforce-metadata"] },
+        "classification": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+        "priority": { "type": "integer", "minimum": -10000, "maximum": 10000 },
+        "repositories": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "max_bytes": { "type": "integer", "minimum": 1, "maximum": 900000 }
+      },
+      "additionalProperties": false
+    },
+    "blueprintPin": {
+      "type": "object",
+      "required": ["id", "version", "digest"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^org\\.[a-z0-9-]+\\.[a-z0-9.-]+$" },
+        "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+        "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+      },
+      "additionalProperties": false
+    },
+    "designSystemPin": {
+      "type": "object",
+      "required": ["id", "version", "digest", "source_class"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^(?:ewai\\.[a-z0-9.-]+|org\\.[a-z0-9-]+\\.[a-z0-9.-]+)$" },
+        "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+        "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "source_class": { "enum": ["bundled", "personal", "project", "installed"] }
+      },
+      "additionalProperties": false
+    },
+    "designSystemSelection": {
+      "type": "object",
+      "required": ["root", "packs", "effective_digest", "approved_by", "approved_at", "evidence"],
+      "properties": {
+        "root": { "$ref": "#/$defs/designSystemPin" },
+        "packs": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/designSystemPin" } },
+        "effective_digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "approved_by": { "type": "string", "minLength": 1 },
+        "approved_at": { "type": "string", "format": "date-time" },
+        "evidence": { "const": "SPECS/5.Strategy/design-system.md" }
+      },
+      "additionalProperties": false
+    },
+    "organisationPolicySelection": {
+      "type": "object",
+      "required": ["status", "packs", "blueprint_digest", "effective_digest", "approved_by", "approved_at", "evidence"],
+      "properties": {
+        "status": { "const": "enabled" },
+        "packs": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/designSystemPin" } },
+        "blueprint_digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "effective_digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "approved_by": { "type": "string", "minLength": 1 },
+        "approved_at": { "type": "string", "format": "date-time" },
+        "evidence": { "const": "SPECS/4.Constraints/organisation-policy/baseline.json" }
+      },
+      "additionalProperties": false
+    },
+    "provider": {
+      "type": "object",
+      "required": ["state", "enabled"],
+      "properties": {
+        "state": { "enum": ["available", "unavailable"] },
+        "enabled": { "type": "boolean" }
+      },
+      "additionalProperties": false
+    },
+    "checkpoint": {
+      "type": "object",
+      "required": ["enabled", "max_cycles", "validators", "review"],
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "max_cycles": { "type": "integer", "minimum": 1, "maximum": 3 },
+        "validators": {
+          "oneOf": [
+            { "const": "auto" },
+            {
+              "type": "array",
+              "uniqueItems": true,
+              "items": { "enum": ["claude", "codex", "antigravity"] }
+            }
+          ]
+        },
+        "review": {
+          "type": "object",
+          "required": ["breadth", "depth", "output"],
+          "properties": {
+            "breadth": {
+              "enum": ["targeted", "change-set", "capability", "system"]
+            },
+            "depth": {
+              "enum": [
+                "issues-only",
+                "issues-and-fixes",
+                "analysis-and-recommendations"
+              ]
+            },
+            "output": { "enum": ["small", "medium", "large"] }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/config/prototype-iteration.schema.json

@@ -0,0 +1,128 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwith.ai/schemas/prototype-iteration-v1.json",
+  "title": "EWAI persona-guided prototype iteration",
+  "oneOf": [
+    { "$ref": "#/$defs/planInput" },
+    { "$ref": "#/$defs/planPreparation" },
+    { "$ref": "#/$defs/planSubmission" },
+    { "$ref": "#/$defs/planReview" },
+    { "$ref": "#/$defs/cycleInput" },
+    { "$ref": "#/$defs/cyclePreparation" },
+    { "$ref": "#/$defs/cycleSubmission" },
+    { "$ref": "#/$defs/cycleReview" }
+  ],
+  "$defs": {
+    "safeId": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,199}$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "persona": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name", "tier", "category", "matchedSignals", "engagementReason"],
+      "properties": {
+        "id": { "$ref": "#/$defs/safeId" },
+        "name": { "type": "string", "minLength": 1, "maxLength": 160 },
+        "tier": { "enum": ["core", "project", "personal", "premium"] },
+        "category": { "type": "string", "maxLength": 120 },
+        "matchedSignals": { "type": "array", "maxItems": 20, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 120 } },
+        "engagementReason": { "type": "string", "minLength": 1, "maxLength": 500 }
+      }
+    },
+    "engagement": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "stage", "activePersonas", "availability", "baseline", "authority"],
+      "properties": {
+        "schema": { "const": "ewai.prototype-persona-engagement/v1" },
+        "stage": { "enum": ["plan", "design"] },
+        "selectionFingerprint": { "$ref": "#/$defs/digest" },
+        "activePersonas": { "type": "array", "maxItems": 8, "items": { "$ref": "#/$defs/persona" } },
+        "availability": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["standardModel", "core", "project", "personal", "premium"],
+          "properties": {
+            "standardModel": { "$ref": "#/$defs/availabilityEntry" },
+            "core": { "$ref": "#/$defs/availabilityEntry" },
+            "project": { "$ref": "#/$defs/availabilityEntry" },
+            "personal": { "$ref": "#/$defs/availabilityEntry" },
+            "premium": { "$ref": "#/$defs/availabilityEntry" }
+          }
+        },
+        "baseline": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["completeWithoutOptionalPersonas"],
+          "properties": { "completeWithoutOptionalPersonas": { "const": true } }
+        },
+        "notices": { "type": "array", "maxItems": 10, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 500 } },
+        "authority": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["advisory", "maySelectPrototype", "mayApproveManualQa"],
+          "properties": {
+            "advisory": { "const": true },
+            "maySelectPrototype": { "const": false },
+            "mayApproveManualQa": { "const": false }
+          }
+        }
+      }
+    },
+    "availabilityEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["available"],
+      "properties": {
+        "available": { "type": "boolean" },
+        "count": { "type": "integer", "minimum": 0, "maximum": 10000 }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["personaId", "concernCode", "severity", "observation", "recommendation", "evidenceRefs"],
+      "properties": {
+        "id": { "$ref": "#/$defs/safeId" },
+        "personaId": { "$ref": "#/$defs/safeId" },
+        "concernCode": { "$ref": "#/$defs/safeId" },
+        "severity": { "enum": ["advisory", "material", "critical"] },
+        "observation": { "type": "string", "minLength": 1, "maxLength": 2000 },
+        "recommendation": { "type": "string", "minLength": 1, "maxLength": 2000 },
+        "evidenceRefs": { "type": "array", "minItems": 1, "maxItems": 50, "uniqueItems": true, "items": { "$ref": "#/$defs/safeId" } }
+      }
+    },
+    "assessment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["findingId", "disposition", "rationale"],
+      "properties": {
+        "findingId": { "$ref": "#/$defs/safeId" },
+        "disposition": { "enum": ["incorporate", "incorporate-with-modification", "defer", "reject", "escalate"] },
+        "rationale": { "type": "string", "minLength": 12, "maxLength": 2000 },
+        "modification": { "type": "string", "maxLength": 2000 },
+        "owner": { "type": "string", "maxLength": 160 }
+      }
+    },
+    "planInput": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "deliverySlug", "intentDigest", "designSystem", "plan", "engagement"],
+      "properties": {
+        "schema": { "const": "ewai.prototype-plan-input/v1" },
+        "deliverySlug": { "$ref": "#/$defs/safeId" },
+        "intentDigest": { "$ref": "#/$defs/digest" },
+        "designSystem": { "type": "object" },
+        "plan": { "type": "object" },
+        "engagement": { "$ref": "#/$defs/engagement" },
+        "predecessorDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "const": "" }] }
+      }
+    },
+    "planPreparation": { "type": "object", "required": ["schema", "preparationDigest"], "properties": { "schema": { "const": "ewai.prototype-plan-preparation/v1" }, "preparationDigest": { "$ref": "#/$defs/digest" } } },
+    "planSubmission": { "type": "object", "required": ["schema", "expectedPreparationDigest", "reviewedBy", "findings", "assessments"], "properties": { "schema": { "const": "ewai.prototype-plan-review-submission/v1" }, "expectedPreparationDigest": { "$ref": "#/$defs/digest" }, "reviewedBy": { "type": "string" }, "findings": { "type": "array", "items": { "$ref": "#/$defs/finding" } }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/assessment" } } } },
+    "planReview": { "type": "object", "required": ["schema", "contentDigest"], "properties": { "schema": { "const": "ewai.prototype-plan-review/v1" }, "contentDigest": { "$ref": "#/$defs/digest" } } },
+    "cycleInput": { "type": "object", "required": ["schema"], "properties": { "schema": { "const": "ewai.prototype-cycle-input/v1" } } },
+    "cyclePreparation": { "type": "object", "required": ["schema", "preparationDigest"], "properties": { "schema": { "const": "ewai.prototype-cycle-preparation/v1" }, "preparationDigest": { "$ref": "#/$defs/digest" } } },
+    "cycleSubmission": { "type": "object", "required": ["schema"], "properties": { "schema": { "const": "ewai.prototype-cycle-review-submission/v1" } } },
+    "cycleReview": { "type": "object", "required": ["schema", "contentDigest"], "properties": { "schema": { "const": "ewai.prototype-cycle-review/v1" }, "contentDigest": { "$ref": "#/$defs/digest" } } }
+  }
+}

package/config/rollout.schema.json

@@ -0,0 +1,87 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwith.ai/schemas/rollout-v1.json",
+  "type": "object",
+  "required": ["schema", "id", "name", "owner", "stale_after_days", "baselines", "cohorts"],
+  "properties": {
+    "schema": { "const": "ewai.rollout/v1" },
+    "id": { "$ref": "#/$defs/slug" },
+    "name": { "$ref": "#/$defs/name" },
+    "owner": { "$ref": "#/$defs/owner" },
+    "stale_after_days": { "type": "integer", "minimum": 1, "maximum": 3650 },
+    "baselines": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 25,
+      "items": { "$ref": "#/$defs/baseline" }
+    },
+    "cohorts": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 50,
+      "items": { "$ref": "#/$defs/cohort" }
+    }
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "slug": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$", "maxLength": 100 },
+    "name": { "type": "string", "minLength": 1, "maxLength": 160 },
+    "owner": { "type": "string", "minLength": 1, "maxLength": 160 },
+    "pack": {
+      "type": "object",
+      "required": ["id", "version"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^org\\.[a-z0-9-]+\\.[a-z0-9.-]+$" },
+        "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" },
+        "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+      },
+      "additionalProperties": false
+    },
+    "baseline": {
+      "type": "object",
+      "required": ["id", "name", "owner", "pack"],
+      "properties": {
+        "id": { "$ref": "#/$defs/slug" },
+        "name": { "$ref": "#/$defs/name" },
+        "owner": { "$ref": "#/$defs/owner" },
+        "pack": { "$ref": "#/$defs/pack" }
+      },
+      "additionalProperties": false
+    },
+    "assignment": {
+      "type": "object",
+      "required": ["id", "owner"],
+      "properties": {
+        "id": { "$ref": "#/$defs/slug" },
+        "owner": { "$ref": "#/$defs/owner" },
+        "review_owner": { "$ref": "#/$defs/owner" }
+      },
+      "additionalProperties": false
+    },
+    "cohort": {
+      "type": "object",
+      "required": ["id", "name", "baseline", "owner", "review_by", "required_evidence", "projects"],
+      "properties": {
+        "id": { "$ref": "#/$defs/slug" },
+        "name": { "$ref": "#/$defs/name" },
+        "baseline": { "$ref": "#/$defs/slug" },
+        "owner": { "$ref": "#/$defs/owner" },
+        "review_by": { "type": "string", "format": "date" },
+        "required_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 5,
+          "uniqueItems": true,
+          "items": { "enum": ["blueprint", "delivery", "standards", "manual-qa", "security"] }
+        },
+        "projects": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 100,
+          "items": { "$ref": "#/$defs/assignment" }
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/config/security-adapter.schema.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwithai.dev/schemas/security-adapter.schema.json",
+  "title": "EWAI security adapter manifest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "id", "name", "publisher", "version", "protocolVersion", "capabilities", "entrypoint"],
+  "properties": {
+    "schema": { "const": "ewai.security-adapter/v1" },
+    "id": { "type": "string", "pattern": "^[a-z][a-z0-9.-]{1,79}$" },
+    "name": { "type": "string", "minLength": 1, "maxLength": 120 },
+    "publisher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9.-]{1,79}$" },
+        "name": { "type": "string", "minLength": 1, "maxLength": 120 }
+      }
+    },
+    "version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" },
+    "protocolVersion": { "const": "1" },
+    "capabilities": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["source-static", "dependency-sbom", "secret-detection", "infrastructure-configuration", "llm-runtime-red-team"] } },
+    "entrypoint": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 240,
+      "not": { "pattern": "^(?:/|\\\\|[A-Za-z]:|\\.\\.(?:/|\\\\|$)|.*(?:/|\\\\)\\.\\.(?:/|\\\\|$))" }
+    }
+  }
+}

package/config/security-scan-request.schema.json

@@ -0,0 +1,64 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://engineeringwithai.dev/schemas/security-scan-request.schema.json",
+  "title": "EWAI security scan request",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "runId", "profile", "project", "scope"],
+  "properties": {
+    "schema": { "const": "ewai.security-scan-request/v1" },
+    "runId": { "type": "string", "minLength": 1, "maxLength": 80 },
+    "profile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "capability"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{1,63}$" },
+        "capability": { "$ref": "#/$defs/capability" }
+      }
+    },
+    "project": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["revision"],
+      "properties": { "revision": { "type": "string", "minLength": 1, "maxLength": 240 } }
+    },
+    "scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["include", "exclude"],
+      "properties": {
+        "include": { "$ref": "#/$defs/projectPaths" },
+        "exclude": { "$ref": "#/$defs/projectPaths" }
+      }
+    },
+    "target": {
+      "oneOf": [
+        { "type": "null" },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["class", "ref"],
+          "properties": {
+            "class": { "enum": ["local", "development", "test", "staging"] },
+            "ref": { "type": "string", "minLength": 1, "maxLength": 160 }
+          }
+        }
+      ]
+    }
+  },
+  "$defs": {
+    "capability": { "enum": ["source-static", "dependency-sbom", "secret-detection", "infrastructure-configuration", "llm-runtime-red-team"] },
+    "projectPaths": {
+      "type": "array",
+      "maxItems": 100,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 240,
+        "not": { "pattern": "^(?:/|\\\\|[A-Za-z]:|\\.\\.(?:/|\\\\|$)|.*(?:/|\\\\)\\.\\.(?:/|\\\\|$))" }
+      }
+    }
+  }
+}