@xoxoai/checkmate 0.4.28 → 0.5.1

package/docs/CONFIGURATION.md

@@ -0,0 +1,91 @@
+# Configuration Reference
+
+`checkmate.config.json` is the sole operator-controlled configuration source. It separates approved package registration and logical secret bindings from policy-owned execution behavior.
+
+## Lookup
+
+- Default: `$PWD/checkmate.config.json`
+- Explicit: `--config <path>`, resolved from `$PWD`
+- Invocation root: always `$PWD`, even when the config file is elsewhere
+- No ancestor search, package metadata fallback, TypeScript config, or low-level environment override layer
+
+Relative output paths and driver package resolution remain anchored to the invocation root.
+
+## Manifest Sections
+
+| Field             | Purpose                                                        |
+| ----------------- | -------------------------------------------------------------- |
+| `schemaVersion`   | Must be `1`                                                    |
+| `outputDirectory` | Relative run root; defaults to `.checkmate/runs`               |
+| `defaultPolicy`   | Policy selected when a request omits `scenario.policy`         |
+| `secretBindings`  | Logical names mapped to environment variable names             |
+| `policies`        | Model egress, bounds, evidence, and enabled-driver settings    |
+| `drivers`         | Stable driver IDs mapped to approved packages and secret slots |
+
+Unknown fields are rejected. Validation does not coerce, strip, default inside input documents, or clamp values.
+
+## Model Egress
+
+Each policy owns:
+
+| Field                      | Meaning                                                 |
+| -------------------------- | ------------------------------------------------------- |
+| `provider.id`              | `openai` in v1                                          |
+| `provider.model`           | Provider model identifier                               |
+| `provider.baseUrl`         | Optional OpenAI-compatible endpoint                     |
+| `provider.apiKeyBinding`   | Logical binding, never a secret value                   |
+| `provider.temperature`     | Optional non-negative number                            |
+| `provider.reasoningEffort` | Optional `low`, `medium`, or `high`                     |
+| `textRedaction`            | `on` or `off` for provider-bound text                   |
+| `allowOpaque`              | Whether provider-bound opaque/image context is allowed  |
+| `maxStepBytes`             | Maximum complete provider request bytes for a step      |
+| `maxMessageBytes`          | Maximum serialized bytes for one provider-bound message |
+
+The complete-request limit covers messages, tools, and JSON framing, not HTTP headers. Requests cannot override any model-egress field.
+
+## Bounds
+
+| Field                |           Valid value | Scope                                                |
+| -------------------- | --------------------: | ---------------------------------------------------- |
+| `scenarioTimeoutMs`  |          Integer >= 1 | Entire worker scenario, including import and startup |
+| `stepTimeoutMs`      |          Integer >= 1 | One model/tool step                                  |
+| `turnsPerStep`       |          Integer >= 1 | Model turns per step                                 |
+| `requestTimeoutMs`   |          Integer >= 1 | One provider request                                 |
+| `maxRetries`         |          Integer >= 0 | Provider-level retries                               |
+| `loopMaxRepetitions` |          Integer >= 1 | Repeated tool-call pattern bound                     |
+| `cleanupTimeoutMs`   |          Integer >= 1 | Shared runner/session cleanup deadline               |
+| `budgetTokens`       | Optional integer >= 1 | Cumulative scenario token ceiling                    |
+
+A request may only tighten `scenarioTimeoutMs` through `limits.timeoutMs`, and may tighten or introduce `limits.budgetTokens`. Attempts to raise a policy ceiling are invalid. V1 has no USD budget, cost calculation, or pricing table.
+
+## Evidence Policy
+
+- `retention`: `on`, `retain-on-failure`, or `off`
+- `redaction`: `on` or `off`
+- `allowOpaque`: explicit permission for binary evidence that cannot be text-redacted
+
+Requests cannot weaken these settings.
+
+## Driver Policy
+
+The root `drivers` entry approves a package and maps its descriptor-declared secret slots to logical bindings. `policies.<id>.drivers.<driverId>` enables that registered driver, supplies settings validated against its static descriptor, and provides `tools.allowed`.
+
+`["*"]` exposes every descriptor-declared tool. An explicit list exposes only those names. Unknown names, undeclared secret slots, missing slot bindings, unknown drivers, and drivers not enabled by the selected policy are invalid before executable import.
+
+## Secret Handling
+
+Preflight reads a binding only long enough to verify that its environment value is a non-empty string. It does not return, retain, serialize, log, persist, derive from, or send that value over IPC. The worker resolves values independently for execution. Secret values never enter the prepared plan, request, result, checkpoint, evidence reference, or `describe` output.
+
+JavaScript heap erasure is not guaranteed. Registered executable code remains trusted and can access the host environment outside Checkmate's reader.
+
+## Fixed Ingestion Limits
+
+Checkmate applies fixed parent-side limits before expensive validation, executable import, identity allocation, secret resolution, or worker creation:
+
+- 256 KiB each for request, manifest, and descriptor documents
+- Parsed depth 64 and 10,000 aggregate values
+- 100 scenario steps
+- 128 characters for IDs, 256 for scenario names
+- 16 KiB UTF-8 each for action and expectation text
+- 100 diagnostics and 64 KiB of serialized diagnostics
+- 1 MiB serialized worker start frame

package/docs/DRIVERS.md

@@ -0,0 +1,75 @@
+# Driver Authoring
+
+A driver gives the harness a model-visible interaction surface while Checkmate retains scenario sequencing, limits, verdict tools, result categories, evidence policy, and stdout behavior.
+
+## Registration And Static Discovery
+
+An installed driver package exports both its executable module and `./checkmate-driver.json`. The manifest maps a trusted stable ID to the package. `describe` and `validate` resolve only the descriptor export as data; executable code is imported only after a validated `run` allocates identity and latches `targetMutation` to `possibly-mutated`.
+
+The descriptor declares:
+
+- `id` and `driverContractVersion: 1`
+- Strict JSON Schemas for request-owned target and policy-owned settings
+- Required local secret slot names
+- The exact runtime tool-name set
+- Permitted evidence kinds, media types, and text/opaque classification
+
+At startup, the executable ID and contract version must match the descriptor. Runtime tools must have exact set equality with descriptor tools and may not be duplicated or collide with the harness-owned `pass_test_step` and `fail_test_step` tools.
+
+## Executable Contract
+
+```typescript
+import type { CheckmateDriverV1 } from '@xoxoai/checkmate/driver'
+
+export const checkmateDriver: CheckmateDriverV1 = {
+	id: 'database',
+	driverContractVersion: 1,
+	async start(input) {
+		const connection = await connect(input.secrets.read('connection'))
+		return {
+			tools: databaseTools(connection),
+			instructions: ['Use read-only queries to inspect application state.'],
+			buildInitialContext: async ({ signal }) => currentSchema(connection, signal),
+			handleToolResponses: async ({ signal }) => currentSchema(connection, signal),
+			close: async () => connection.close(),
+		}
+	},
+}
+```
+
+`DriverStartInput` supplies validated `target` and `settings`, a slot-limited secret reader, a descriptor-limited evidence sink, an invocation logger, and an abort signal. The session supplies tools, instructions, initial context, post-tool context, and one idempotent close operation.
+
+## Tools
+
+Use `defineDriverTool()` for Zod-backed tool arguments. Tool wire names remain local names such as `database_query`; they are not prefixed with the driver ID because one scenario has one driver session.
+
+A returned `{ status: 'error', response }` is a recoverable target observation. It is sent to the model and the step continues. A thrown or rejected tool operation means the driver boundary is unsafe and terminates the step as `infra / tool-error`. Drivers cannot return assertions; only harness-owned result tools decide whether an expectation passed or failed.
+
+## Context
+
+Driver context is provider-neutral text or image data. `ephemeral: true` marks current target state that should replace prior ephemeral state after actions. Explicit summaries may be durable. Checkmate applies policy-owned model-egress redaction, opaque-content permission, and byte limits before provider adaptation.
+
+Every awaited executable boundary is wrapped by a harness-owned absolute deadline:
+
+- Driver module import and `start`: remaining scenario deadline
+- Initial context, tools, and post-tool context: current step deadline
+- Runner teardown and session close: one shared cleanup deadline
+
+Abort signals are cooperative. The CLI parent terminates a worker that does not settle within its containment bound.
+
+## Secrets, Logs, And Evidence
+
+Drivers read only descriptor-declared secret slots. Logger messages are exact-secret and pattern sanitized before leaving the worker. Direct writes to stdout or stderr are discarded.
+
+Drivers submit evidence by declared kind and media type, never by path. The sink validates attribution and lifecycle, enforces 10 MiB candidate and 64 MiB per-invocation accepted-buffer limits, applies redaction and retention, writes atomically, and publishes a reference only after durability confirmation.
+
+## Built-In Web Driver
+
+`@xoxoai/checkmate/driver-web` owns Playwright browser, context, pages, snapshots, screenshots, tab/popup state, dialogs, transient DOM state, network recording, and fourteen browser tools. It accepts target `{ "baseUrl": "https://..." }` and these optional policy settings:
+
+- `headless`
+- `snapshotFilter`
+- `snapshotTopPercent` in `(0, 100]`
+- `screenshotsInModelContext`
+
+Importing the root contract or driver-authoring entry does not load Playwright. Only selecting and executing the web driver imports the browser runtime.

package/docs/EVIDENCE.md

@@ -0,0 +1,62 @@
+# Evidence And Durability
+
+Every valid run owns one invocation directory beneath the manifest's `outputDirectory`.
+
+```text
+.checkmate/runs/<utc>-<scenario-slug>-<run-id>/
+|-- invocation.json
+|-- checkpoint.json
+|-- evidence/
+|   |-- harness/steps/001-<step-slug>/transcript.md
+|   `-- driver/<driver-id>/...
+`-- result.json
+```
+
+The 16-character lowercase hexadecimal `runId` is generated from eight random bytes. It identifies one attempt and is not a request hash. Concurrent runs, including runs with the same scenario ID, receive separate directories and mutable state.
+
+## Compact Result
+
+The final envelope always carries compact routing and diagnosis data: top-level status/category/reason, target mutation state, timing, driver and policy identity, effective limits, aggregate tokens, every step state, compact tool-call summaries, evidence completeness, references, and diagnostics.
+
+Transcripts, snapshots, screenshots, and driver-specific artifacts remain outside the envelope. Follow only `evidence.references`; never infer filenames or promote `checkpoint.json` to a result.
+
+## Retention
+
+| Policy              | Passed step                    | Failed step                    |
+| ------------------- | ------------------------------ | ------------------------------ |
+| `on`                | Retain selected heavy evidence | Retain selected heavy evidence |
+| `retain-on-failure` | Discard heavy evidence         | Retain selected heavy evidence |
+| `off`               | Discard heavy evidence         | Discard heavy evidence         |
+
+Compact result data is retained independently of this table. Opaque evidence is discarded unless the operator also sets `allowOpaque: true`.
+
+`evidence.state: "complete"` means the selected policy was fulfilled, including when it required no heavy artifacts. `partial` means an optional capture or persistence operation failed. A driver is not required to produce every declared evidence kind on every run.
+
+## Redaction
+
+With `redaction: "on"`, Checkmate applies exact resolved-secret replacement, credential-pattern recognition, and field-aware content redaction before data becomes durable or enters terminal IPC. JSON and YAML evidence is parsed, redacted structurally, and deterministically reserialized. Malformed structured evidence is rejected.
+
+Structural metadata is copied exactly and must not contain confidential values: IDs, status/category/reason values, diagnostic codes and paths, timestamps, effective limits, usage, evidence kinds/media types/producers/paths, and driver/tool identities.
+
+With `redaction: "off"`, raw harness-owned content and accepted evidence bytes are preserved by explicit operator choice. The API result, `result.json`, terminal IPC, and CLI stdout may therefore contain raw values. Out-of-band diagnostics remain sanitized and raw worker streams remain discarded under both settings.
+
+## Capture Limits
+
+- One candidate: at most 10 MiB before and after transformation
+- Accepted pending buffers: at most 64 MiB per invocation
+- Counters are released when candidates are committed or discarded
+- Concurrent in-process invocations do not share a global allowance
+
+An embedding host running `N` concurrent calls may retain approximately `N * 64 MiB` plus driver and model overhead. The caller owns admission control.
+
+## Atomic Commitment
+
+Files are written to a restrictive same-directory temporary file, flushed, renamed, and followed by directory synchronization where supported. Evidence references become visible only after this sequence succeeds. A post-rename synchronization failure is durability-uncertain and publishes no reference even if the destination is observable.
+
+`invocation.json` is mandatory before executable driver startup. `checkpoint.json` is an atomically replaced partial diagnostic snapshot, not proof of process liveness, a resume point, or a terminal result. `result.json` is the only durable terminal marker. Parent pre-execution operational errors and containment results do not claim a durable terminal file.
+
+Optional evidence failure preserves the established verdict, marks evidence partial, and appends a diagnostic. Checkpoint failure appends a diagnostic without changing verdict or evidence completeness. Failure to commit final `result.json` changes the top-level route to `infra / result-write-failed`, preserves completed semantic state, and returns an explicitly uncommitted envelope through the API or CLI when it fits the IPC bound.
+
+## Byte Identity
+
+Committed `result.json` uses deterministic two-space JSON with recursively sorted object keys, preserved array order, UTF-8 without a BOM, and one trailing line feed. The in-process finalized object is parsed from those bytes. The CLI verifies and writes the same bytes unchanged. Parent-authored containment has stdout bytes only and claims no durable result.

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@xoxoai/checkmate",
-	"version": "0.4.28",
-	"description": "AI‑driven e2e test automation framework built on Playwright Test and OpenAI API",
+	"version": "0.5.1",
+	"description": "Agent-first test automation harness with versioned requests, bounded execution, and durable evidence",
 	"homepage": "https://github.com/dawiddiwad/checkmate",
 	"repository": {
 		"type": "git",
@@ -10,24 +10,21 @@
 	"keywords": [
 		"test-automation",
 		"e2e-testing",
-		"playwright",
-		"openai",
 		"ai-testing",
-		"low-code",
-		"salesforce",
-		"gemini",
-		"claude",
-		"groq"
+		"agents",
+		"test-harness",
+		"cli",
+		"playwright"
 	],
 	"files": [
 		"bin",
 		"dist",
-		"docs/EXTENSIONS.md",
-		"docs/GUIDE.md",
-		"docs/ROADMAP.md",
-		"playwright.config.ts",
+		"schemas",
+		"docs/CLI.md",
+		"docs/CONFIGURATION.md",
+		"docs/DRIVERS.md",
+		"docs/EVIDENCE.md",
 		"README.md",
-		"test/examples",
 		"LICENSE"
 	],
 	"bin": {
@@ -36,34 +33,37 @@
 	"publishConfig": {
 		"access": "public"
 	},
-	"main": "dist/core.js",
-	"types": "dist/core.d.ts",
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
 	"type": "module",
 	"exports": {
 		".": {
-			"types": "./dist/core.d.ts",
-			"default": "./dist/core.js"
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
 		},
-		"./core": {
-			"types": "./dist/core.d.ts",
-			"default": "./dist/core.js"
+		"./driver": {
+			"types": "./dist/driver.d.ts",
+			"default": "./dist/driver.js"
 		},
-		"./playwright": {
-			"types": "./dist/playwright.d.ts",
-			"default": "./dist/playwright.js"
+		"./driver-web": {
+			"types": "./dist/drivers/web/index.d.ts",
+			"default": "./dist/drivers/web/index.js"
 		},
-		"./salesforce": {
-			"types": "./dist/salesforce.d.ts",
-			"default": "./dist/salesforce.js"
-		}
+		"./driver-web/checkmate-driver.json": "./dist/drivers/web/checkmate-driver.json",
+		"./schemas/*": "./schemas/*"
 	},
 	"scripts": {
 		"checkmate:install": "npm install && npx playwright install",
-		"build": "npm run validation:check && npm run build:dist",
+		"build": "npm run validation:check && npm run build:package",
 		"build:dist": "tsc -p tsconfig.build.json",
-		"clean": "rm -rf dist",
-		"prepack": "npm run clean && npm run build",
-		"validation:check": "npm run compile:check && npm run lint:check && npm run format:fix && npm run test:unit:run",
+		"build:package": "npm run clean && npm run build:dist && node scripts/copy-package-assets.mjs",
+		"clean": "rm -rf dist schemas",
+		"prepack": "npm run build:package",
+		"phase:verify": "node test/package/lifecycle.mjs",
+		"test:package:active": "node test/package/active-exports.mjs",
+		"test:acceptance:agent": "node test/acceptance/agent-workflow.mjs",
+		"test:e2e:ollama": "node test/acceptance/ollama-cli.mjs",
+		"validation:check": "npm run compile:check && npm run lint:check && npm run format:check && npm run test:unit:run",
 		"compile:check": "npx tsc --noEmit",
 		"lint:check": "eslint .",
 		"lint:fix": "eslint . --fix",
@@ -73,41 +73,33 @@
 		"test:unit:ui": "vitest --ui --config src/test/vitest.config.ts",
 		"test:unit:coverage": "vitest --coverage --config src/test/vitest.config.ts",
 		"test:unit:run": "vitest run --config src/test/vitest.config.ts",
-		"test:web": "npm run build:dist && npx playwright test --project=web",
-		"test:salesforce": "npm run build:dist && npx playwright test --project=salesforce",
-		"test:web:example": "npm run build:dist && npx playwright test --project=web --grep=ollama",
-		"show:report": "npx playwright show-report test-reports/html"
+		"test:package:final": "node test/package/final-surface.mjs"
 	},
 	"author": "Dawid Dobrowolski SoftQA",
 	"license": "MIT",
 	"dependencies": {
-		"@huggingface/transformers": "^4.0.1",
-		"openai": "^6.34.0",
-		"sharp": "^0.35.2",
-		"string-similarity": "^4.0.4",
-		"strip-ansi": "^7.2.0",
-		"winston": "^3.19.0",
-		"yaml": "^2.8.3",
-		"zod": "^4.3.6"
-	},
-	"peerDependencies": {
-		"@playwright/test": "^1.59.1"
+		"@huggingface/transformers": "^4.2.0",
+		"ajv": "^8.20.0",
+		"ajv-formats": "^3.0.1",
+		"openai": "^7.10.0",
+		"playwright": "^1.63.0",
+		"sharp": "^0.35.4",
+		"yaml": "^2.9.0",
+		"zod": "^4.5.4"
 	},
 	"devDependencies": {
 		"@eslint/js": "^10.0.1",
-		"@playwright/test": "^1.59.1",
-		"@types/node": "^26.0.0",
-		"@types/string-similarity": "^4.0.2",
-		"@vitest/coverage-v8": "^4.1.4",
-		"@vitest/ui": "^4.1.2",
-		"dotenv": "^17.4.1",
-		"eslint": "^10.2.0",
+		"@types/node": "^26.5.0",
+		"@vitest/coverage-v8": "^5.0.0",
+		"@vitest/ui": "^5.0.0",
+		"dotenv": "^17.4.2",
+		"eslint": "^10.10.0",
 		"eslint-config-prettier": "^10.1.8",
-		"prettier": "^3.8.3",
-		"tsx": "^4.21.0",
-		"typescript": "^5.9.3",
-		"typescript-eslint": "^8.58.2",
-		"vitest": "^4.1.2"
+		"prettier": "^3.9.6",
+		"tsx": "^4.23.13",
+		"typescript": "^6.0.3",
+		"typescript-eslint": "^8.70.0",
+		"vitest": "^5.0.0"
 	},
 	"directories": {
 		"doc": "docs",

package/schemas/checkmate-config.v1.json

@@ -0,0 +1,176 @@
+{
+	"$schema": "https://json-schema.org/draft/2020-12/schema",
+	"$id": "https://checkmate.dev/schemas/checkmate-config.v1.json",
+	"title": "Checkmate configuration version 1",
+	"type": "object",
+	"additionalProperties": false,
+	"required": ["schemaVersion", "defaultPolicy", "secretBindings", "policies", "drivers"],
+	"properties": {
+		"schemaVersion": { "const": 1 },
+		"outputDirectory": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 1024,
+			"pattern": "^(?!/)(?!.*(?:^|/)\\.\\.?(?:/|$))[^\\u0000-\\u001f/]+(?:/[^\\u0000-\\u001f/]+)*$"
+		},
+		"defaultPolicy": { "$ref": "#/$defs/id" },
+		"secretBindings": {
+			"type": "object",
+			"propertyNames": { "$ref": "#/$defs/id" },
+			"additionalProperties": { "$ref": "#/$defs/secretBinding" }
+		},
+		"policies": {
+			"type": "object",
+			"minProperties": 1,
+			"propertyNames": { "$ref": "#/$defs/id" },
+			"additionalProperties": { "$ref": "#/$defs/policy" }
+		},
+		"drivers": {
+			"type": "object",
+			"minProperties": 1,
+			"propertyNames": { "$ref": "#/$defs/id" },
+			"additionalProperties": { "$ref": "#/$defs/driverRegistration" }
+		}
+	},
+	"$defs": {
+		"id": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 128,
+			"pattern": "^(?!.*[\\u0000-\\u001f]).*$"
+		},
+		"secretBinding": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["source", "name"],
+			"properties": {
+				"source": { "const": "environment" },
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256,
+					"pattern": "^(?!.*[\\u0000-\\u001f]).*$"
+				}
+			}
+		},
+		"provider": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["id", "model", "apiKeyBinding"],
+			"properties": {
+				"id": { "const": "openai" },
+				"model": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256,
+					"pattern": "^(?!.*[\\u0000-\\u001f]).*$"
+				},
+				"baseUrl": { "type": "string", "format": "uri" },
+				"apiKeyBinding": { "$ref": "#/$defs/id" },
+				"temperature": { "type": "number", "minimum": 0 },
+				"reasoningEffort": { "enum": ["low", "medium", "high"] }
+			}
+		},
+		"modelEgress": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["provider", "textRedaction", "allowOpaque", "maxStepBytes", "maxMessageBytes"],
+			"properties": {
+				"provider": { "$ref": "#/$defs/provider" },
+				"textRedaction": { "enum": ["on", "off"] },
+				"allowOpaque": { "type": "boolean" },
+				"maxStepBytes": { "type": "integer", "minimum": 1 },
+				"maxMessageBytes": { "type": "integer", "minimum": 1 }
+			}
+		},
+		"bounds": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": [
+				"scenarioTimeoutMs",
+				"stepTimeoutMs",
+				"turnsPerStep",
+				"requestTimeoutMs",
+				"maxRetries",
+				"loopMaxRepetitions",
+				"cleanupTimeoutMs"
+			],
+			"properties": {
+				"scenarioTimeoutMs": { "type": "integer", "minimum": 1 },
+				"stepTimeoutMs": { "type": "integer", "minimum": 1 },
+				"turnsPerStep": { "type": "integer", "minimum": 1 },
+				"requestTimeoutMs": { "type": "integer", "minimum": 1 },
+				"maxRetries": { "type": "integer", "minimum": 0 },
+				"loopMaxRepetitions": { "type": "integer", "minimum": 1 },
+				"cleanupTimeoutMs": { "type": "integer", "minimum": 1 },
+				"budgetTokens": { "type": "integer", "minimum": 1 }
+			}
+		},
+		"evidence": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["retention", "redaction", "allowOpaque"],
+			"properties": {
+				"retention": { "enum": ["on", "retain-on-failure", "off"] },
+				"redaction": { "enum": ["on", "off"] },
+				"allowOpaque": { "type": "boolean" }
+			}
+		},
+		"toolPolicy": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["allowed"],
+			"properties": {
+				"allowed": {
+					"type": "array",
+					"minItems": 1,
+					"uniqueItems": true,
+					"items": { "$ref": "#/$defs/id" }
+				}
+			}
+		},
+		"policyDriver": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["settings", "tools"],
+			"properties": {
+				"settings": { "type": "object" },
+				"tools": { "$ref": "#/$defs/toolPolicy" }
+			}
+		},
+		"policy": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["modelEgress", "bounds", "evidence", "drivers"],
+			"properties": {
+				"modelEgress": { "$ref": "#/$defs/modelEgress" },
+				"bounds": { "$ref": "#/$defs/bounds" },
+				"evidence": { "$ref": "#/$defs/evidence" },
+				"drivers": {
+					"type": "object",
+					"minProperties": 1,
+					"propertyNames": { "$ref": "#/$defs/id" },
+					"additionalProperties": { "$ref": "#/$defs/policyDriver" }
+				}
+			}
+		},
+		"driverRegistration": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["package", "secrets"],
+			"properties": {
+				"package": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256,
+					"pattern": "^(?!.*[\\u0000-\\u001f]).*$"
+				},
+				"secrets": {
+					"type": "object",
+					"propertyNames": { "$ref": "#/$defs/id" },
+					"additionalProperties": { "$ref": "#/$defs/id" }
+				}
+			}
+		}
+	}
+}