agent-threat-rules 3.5.11 → 3.5.12

package/spec/atr-observation-v1.0.md

@@ -0,0 +1,323 @@
+# ATR Observation Format v1.0 — the input side
+
+> **STATUS: PROPOSED v1.0 — NOT YET RATIFIED.** This specification describes
+> a target *input* format for community comment. The current TypeScript
+> production engine continues to accept its existing `AgentEvent` shape.
+> Adopters should NOT migrate until ratification. See
+> `STANDARDIZATION-STATUS.md` for full status.
+
+**Status:** Draft for AEP-005 ratification — NOT RATIFIED
+**Date:** 2026-07-29
+**License:** MIT
+**Required by (on ratification):** Correlation rule evaluation
+(`spec/atr-correlation-v1.0.md`), honest coverage reporting, quantitative
+detection primitives
+
+---
+
+## Purpose
+
+ATR has an event format for what an engine **emits** when a rule fires
+(`spec/atr-event-v1.0.md`). It has no format for what an engine
+**ingests**.
+
+The practical consequence is visible in the corpus. The production
+`AgentEvent` interface carries a required `content: string` — the text to
+analyse — while `sessionId` and `agentId` are optional. A rule therefore
+receives a blob of text rather than a description of something that
+happened, which is why almost every rule in the canonical corpus is a
+regular expression over one string, and why behavioural rules degrade
+into matching an agent's own narration of its behaviour.
+
+It also leaves `spec/atr-correlation-v1.0.md` suspended. That spec
+defines join keys (`session.id`, `agent.id`, `agent.delegation_chain`)
+that no schema in this repository defines or requires.
+
+This document specifies the minimum observation an engine must receive
+before correlation, counting, or absence-of-consent detection can mean
+anything.
+
+### Non-goals
+
+- **Not a replacement for `AgentEvent`.** The production interface stays.
+  An `AgentEvent` is a lossy projection of an Observation; §6 gives the
+  mapping.
+- **Not a telemetry collector.** ATR defines the shape, not the plumbing.
+- **Not a claim of completeness.** §5 exists precisely because most
+  deployments will observe a subset of dimensions. Declaring the subset
+  honestly is a requirement of this spec, not a footnote.
+
+---
+
+## 1. Design constraints
+
+1. **Small enough to adopt.** Six required fields. A host that cannot
+   populate six fields cannot support correlation, and should say so
+   rather than emit a degraded stream.
+2. **Aligned, not invented.** Where OpenTelemetry GenAI semantic
+   conventions already name a concept, this spec adopts the name.
+   Unilateral adoption costs nothing and removes a future migration.
+3. **Failure is first class.** See §3.
+4. **Coverage is declared, not assumed.** See §5.
+
+---
+
+## 2. Required fields
+
+| Field | Type | Notes |
+|---|---|---|
+| `@timestamp` | RFC 3339 string | Ordering key. Ties broken by `observation.id`. |
+| `observation.id` | string | Unique within a stream. Deduplication and evidence-chain anchor. |
+| `observation.kind` | enum, §4 | Which dimension this observation belongs to. |
+| `agent.id` | string | OTel: `gen_ai.agent.id`. |
+| `session.id` | string | OTel: `gen_ai.conversation.id`. |
+| `outcome` | enum, §3 | See §3 — this is the field this spec exists for. |
+
+`session.id` and `agent.id` are **required here although optional in
+`AgentEvent`**. A correlation rule grouped by a field that may be absent
+is not a detection, it is a coin flip.
+
+### 2.1 Recommended: `delegation.root`
+
+| Field | Type | Notes |
+|---|---|---|
+| `delegation.root` | string | The `session.id` of the originating session in a delegation chain. |
+
+When an agent is not a delegate, `delegation.root` **MUST** equal
+`session.id`. It is therefore always populated and always safe to group
+by.
+
+This field exists because grouping by `session.id` alone is trivially
+defeated: an actor that spawns a sub-agent usually receives a fresh
+session identifier from the host, so a two-step chain lands in two
+buckets and no correlation rule can ever complete. Grouping by
+`delegation.root` survives the hop.
+
+It does not make delegation-based evasion impossible. It makes each hop
+leave an edge in a graph that can be reconstructed afterwards. That is
+the honest claim.
+
+---
+
+## 3. `outcome`
+
+```
+ok | error | denied | refused | timeout | rate_limited
+```
+
+| Value | Meaning |
+|---|---|
+| `ok` | The action was attempted and succeeded. |
+| `error` | Attempted, failed for a reason unrelated to policy. |
+| `denied` | Refused by a policy or permission boundary. |
+| `refused` | Refused by the model or a guardrail (not a permission boundary). |
+| `timeout` | No result within the host's limit. |
+| `rate_limited` | Throttled by the host or a remote service. |
+
+`denied`, `refused`, `error`, and `timeout` **MUST NOT** be collapsed
+into a single boolean. OpenTelemetry GenAI, ECS, and OCSF all reduce
+these to an `is_error`-shaped flag, which is why this spec defines its
+own enum rather than adopting one.
+
+The distinction carries the load. An agent searching for a way out of a
+boundary produces a dense run of `denied` against a small number of
+distinct targets with high argument variety. An agent that is merely
+broken produces `error`. An agent behaving normally produces neither at
+volume. None of those three shapes is visible if the host emits
+`is_error: true` for all of them.
+
+Stated plainly: for this class of incident the signal is in the attempts
+that failed, not the one that worked.
+
+### 3.1 What this does not do
+
+Thresholds over `outcome` are cheap to compute and cheap to evade, since
+the rules are public. A ruleset that publishes "50 denials in 15
+minutes" has published a speed limit. Correlation rules over `outcome`
+**SHOULD** therefore keep the *logic* in the public corpus and take
+*numeric thresholds* from a host-injected profile
+(`spec/atr-profile-v1.0.md`). The public artefact stays verifiable; the
+operating numbers do not have to be.
+
+---
+
+## 4. `observation.kind`
+
+The first nine values correspond to `agent_source.type` in the rule
+schema and cover what the corpus can already express:
+
+```
+llm_io | tool_call | tool_response | mcp_exchange | multi_agent_comm
+memory_access | skill_lifecycle | context_window | agent_behavior
+```
+
+The next three are defined here and have **no corresponding rules in the
+canonical corpus at the time of writing**:
+
+```
+network | file | process
+```
+
+They are specified because they are the dimensions in which several
+well-understood agent attack steps actually occur, and because a
+dimension that has no name cannot be declared missing. A deployment that
+observes only tool-level activity should report that fact (§5) rather
+than return "no match" for a question it was never able to ask.
+
+### 4.1 Dimension-specific fields
+
+Fields beyond §2 are **OPTIONAL** and depend on `observation.kind`. A
+non-normative starting set:
+
+| Kind | Fields |
+|---|---|
+| `tool_call` | `tool.name`, `tool.arguments`, `target.host`, `target.path` |
+| `tool_response` | `tool.name`, `content` |
+| `network` | `target.host`, `target.port`, `target.scheme`, `bytes.out` |
+| `file` | `file.path`, `file.operation` |
+| `process` | `process.executable`, `process.argv` |
+
+`target.host` and `target.path` are shared across kinds deliberately.
+Correlation joins on a canonical target require one name for one
+concept; see `spec/atr-correlation-v1.0.md` on join keys.
+
+Canonicalisation before any join: hostnames lowercased with the port
+removed, paths resolved, URLs reduced to scheme and host. Two
+observations that refer to the same target and do not produce the same
+join value will silently never correlate, and the rule author will
+reasonably conclude the engine is broken.
+
+---
+
+## 5. Declared coverage
+
+An engine or host that consumes Observations **MUST** be able to report
+which dimensions it can actually observe:
+
+```json
+{
+  "atr.observation_spec_version": "1.0",
+  "covered_dimensions": ["llm_io", "tool_call", "tool_response", "mcp_exchange"],
+  "uncovered_dimensions": ["network", "file", "process"]
+}
+```
+
+Rules and correlation rules **MAY** declare `requires_dimensions`. When a
+required dimension is not covered, the engine **MUST** report the rule as
+`not_evaluated` and **MUST NOT** report it as `no_match`.
+
+This is the difference between "we looked and found nothing" and "we
+could not look", and reporting the second as the first is how a coverage
+number becomes a lie. It also bounds every claim made anywhere else in
+this repository: detection quality has a ceiling set by telemetry
+fidelity, and the telemetry is produced by the thing being observed. A
+single permitted `shell.exec` can compress thousands of network attempts
+into one observation with `outcome: ok`. No rule design fixes that. The
+only honest response is to make the blind spot machine-readable.
+
+---
+
+## 6. Mapping from the production `AgentEvent`
+
+An `AgentEvent` is a lossy projection. The mapping is defined so hosts
+can migrate incrementally rather than all at once:
+
+| `AgentEvent` | Observation |
+|---|---|
+| `timestamp` | `@timestamp` |
+| `type` | `observation.kind` |
+| `sessionId` | `session.id` (required here) |
+| `agentId` | `agent.id` (required here) |
+| `content` | kind-dependent field, §4.1 |
+| `fields` | kind-dependent fields, §4.1 |
+| `metrics` | out of scope for v1.0 |
+| — | `observation.id` (host must supply) |
+| — | `outcome` (host must supply) |
+| — | `delegation.root` (defaults to `session.id`) |
+
+A host that supplies only the mappable fields is conformant to §2 minus
+`outcome` and **MUST** declare `network`, `file`, and `process` as
+uncovered.
+
+---
+
+## 7. Example
+
+A dataset-processing agent reads an environment variable, then reaches an
+internal endpoint, then opens an outbound connection. Three observations,
+one delegation root, one of them denied:
+
+```json
+[
+  {
+    "@timestamp": "2026-07-29T09:14:02.113Z",
+    "observation.id": "obs-8f21a0",
+    "observation.kind": "tool_call",
+    "agent.id": "dataset-normaliser",
+    "session.id": "sess-4419",
+    "delegation.root": "sess-4419",
+    "outcome": "ok",
+    "tool.name": "shell.read_file",
+    "file.path": "/proc/self/environ"
+  },
+  {
+    "@timestamp": "2026-07-29T09:14:19.882Z",
+    "observation.id": "obs-8f21a1",
+    "observation.kind": "network",
+    "agent.id": "dataset-normaliser",
+    "session.id": "sess-4420",
+    "delegation.root": "sess-4419",
+    "outcome": "denied",
+    "target.host": "169.254.169.254",
+    "target.path": "/latest/meta-data/iam/security-credentials/"
+  },
+  {
+    "@timestamp": "2026-07-29T09:15:41.006Z",
+    "observation.id": "obs-8f21a2",
+    "observation.kind": "network",
+    "agent.id": "dataset-normaliser",
+    "session.id": "sess-4420",
+    "delegation.root": "sess-4419",
+    "outcome": "ok",
+    "target.host": "collect.example.net",
+    "target.scheme": "https",
+    "bytes.out": 4192
+  }
+]
+```
+
+The second and third observations carry a different `session.id` from the
+first, because a sub-agent was spawned. Grouping by `session.id` splits
+this into two buckets and nothing correlates. Grouping by
+`delegation.root` keeps it in one.
+
+Note also that this example is constructed, not observed. Fixtures
+derived from public incident reporting rather than from a captured
+stream **MUST** be marked `derived-not-observed` in their manifest. A
+corpus that learns to match the prose of incident write-ups repeats a
+failure this project has already documented once.
+
+---
+
+## 8. Open questions
+
+- Whether `metrics` from `AgentEvent` should become first-class
+  observation fields or stay host-side.
+- Whether `observation.kind` should be extensible by registry (as
+  `spec/category-registry/v1.0.yaml` does for categories) rather than a
+  closed enum.
+- Whether `outcome: refused` is stable enough to define across hosts, or
+  whether guardrail refusals belong in a separate dimension.
+- How `covered_dimensions` should be attested rather than self-declared.
+  Self-declaration is a statement of intent, not a control; a host can
+  claim any coverage it likes.
+
+---
+
+## References
+
+- `spec/atr-event-v1.0.md` — the output side
+- `spec/atr-correlation-v1.0.md` — consumes the join keys defined here
+- `spec/atr-profile-v1.0.md` — where numeric thresholds belong
+- OpenTelemetry GenAI semantic conventions — `gen_ai.agent.id`,
+  `gen_ai.conversation.id`

package/spec/atr-profile-v1.0.md

@@ -7,7 +7,7 @@
 
 **Status:** Draft for AEP-003 ratification — NOT RATIFIED
 **Date:** 2026-05-25
-**License:** CC BY 4.0
+**License:** MIT
 **Required by (on ratification):** Conformance claims, sovereign sub-rule packages, F500 compliance binders
 
 ---
@@ -60,7 +60,7 @@ profile:
     deployed agent runtime regardless of vertical.
   author: "ATR TSC"
   date: "2026-05-25"
-  license: "CC-BY-4.0"
+  license: "MIT"
   status: "draft"                             # draft | stable | deprecated
   conformance_bound:
     spec_version_min: "1.0"
@@ -190,7 +190,7 @@ profile:
     agent deployment.
   author: "ATR TSC"
   date: "2026-05-25"
-  license: "CC-BY-4.0"
+  license: "MIT"
   status: "stable"
   conformance_bound:
     spec_version_min: "1.0"
@@ -229,7 +229,7 @@ profile:
     ATR-DE-* rules for German-specific threat landscape.
   author: "Bundesamt für Sicherheit in der Informationstechnik (BSI)"
   date: "2026-05-25"
-  license: "CC-BY-4.0"
+  license: "MIT"
   status: "draft"
   conformance_bound:
     spec_version_min: "1.0"

package/spec/atr-schema.yaml

@@ -139,7 +139,7 @@ properties:
         type: array
         items:
           type: string
-        description: "SAFE-MCP technique IDs (e.g., SMCP-T001)"
+        description: "SAF-MCP technique IDs (e.g., SAF-T1001). The framework renamed from SAFE-MCP to SAF-MCP and the prefix SAFE-T is retired; SMCP- was never a valid prefix in any version."
       oscal_assessment_objective:
         type: array
         items:
@@ -154,13 +154,15 @@ properties:
           type: string
         description: >
           NIST CSF 2.0 subcategory identifiers (e.g., DE.CM-09, PR.IR-01).
-          Required for citation in NIST IR 8596 Cyber AI Profile Informative References.
+          Prepared for submission to the NIST IR 8596 Cyber AI Profile Informative References (IR 8596 is at initial public draft; no citation is established).
       etsi_ts_104223:
         type: array
         items:
           type: string
         description: >
-          ETSI TS 104 223 principle / sub-principle identifiers (e.g., P4.3).
+          ETSI TS 104 223 provision identifiers, in the standard's own form (e.g., 5.1.2-2).
+          The P-prefixed form (P4.3) is NOT an ETSI identifier — it is the UK DSIT/NCSC
+          Code of Practice numbering, and does not appear anywhere in TS 104 223.
           The ETSI standard upstreamed UK NCSC's AI Cyber Code of Practice (Jan 2025);
           maps ATR Rules to the 13 principles / 72 sub-principles.
       probe_id:

package/spec/category-registry/v1.0.yaml

@@ -11,12 +11,12 @@
 #
 # Naming convention: lowercase, hyphenated, singular noun phrase.
 #
-# License: CC BY 4.0 (this file)
+# License: MIT (this file)
 # Last reviewed: 2026-05-25
 
 version: "1.0"
 schema: https://json-schema.org/draft/2020-12/schema
-license: CC-BY-4.0
+license: MIT
 status: draft
 date: "2026-05-25"
 author: "ATR Maintainer (Adam Lin <adam@agentthreatrule.org>)"

package/spec/compliance-metadata.md

@@ -97,10 +97,11 @@ A rule can have entries in both blocks — e.g., `references.mitre_atlas` AND `c
 
 ## Downstream consumers
 
-The primary consumer is **PanGuard Enterprise's AI Compliance Audit Evidence Module**, which generates quarterly reports mapping detection events (via rule IDs) to auditor-grade framework evidence. Other downstream consumers may include:
+Downstream consumers of the `compliance:` block include:
 
+- Compliance/audit reporting tools that map detection events (via rule IDs) to auditor-grade framework evidence — for example, periodic evidence reports for GRC or audit review
 - ATR-compatible scanners that want to tag each detection with its regulatory context
-- GRC platforms (Vanta, Drata, etc.) that integrate ATR rule packs
+- GRC platforms (e.g., Vanta, Drata) that integrate ATR rule packs
 - Independent auditors verifying AI-system compliance claims
 
 All downstream consumers are welcome — the `compliance:` block is MIT-licensed alongside the rules.

package/spec/conformance/README.md

@@ -7,7 +7,7 @@
 > `STANDARDIZATION-STATUS.md` at repo root for full status.
 
 **Status:** Draft for ratification with first OASIS Open Project artifact publication — NOT RATIFIED
-**License:** CC0 1.0 (public domain — required because conformance corpus consumed by automated test pipelines that cannot tolerate attribution requirements)
+**License:** MIT (a single license across the whole project)
 **Signature (on ratification):** ed25519 signature over `manifest.json` and `expected-results.json` for each level, signed by the TSC's hardware-token-threshold key (see `SIGNING.md`)
 
 ---
@@ -18,7 +18,7 @@ The conformance test corpus is **the objective measure of "is this engine ATR-co
 
 This document specifies the structure of the corpus, the procedure for running it, and the procedure for publishing a signed reference result.
 
-The corpus is published CC0 (public domain) so that any third-party audit lab, sovereign authority, or commercial vendor can ingest the corpus without licence friction.
+The corpus is MIT-licensed so that any third-party audit lab, sovereign authority, or commercial vendor can ingest it under the same permissive terms as the rest of ATR.
 
 ---
 
@@ -167,7 +167,7 @@ Common fixture additions:
   an attack but is benign (precision testing).
 - **New language fixture.** Adding language-detection edge cases.
 
-Fixtures MUST be CC0 or otherwise legally clear for public-domain
+Fixtures MUST be MIT-licensed or otherwise legally clear for permissive
 inclusion. Synthetic / generated fixtures are preferred over
 real-world incident data unless the incident data is already
 public (e.g., disclosed CVE proof-of-concept payloads).
@@ -223,7 +223,7 @@ version, during which both versions are signed and available.
 
 ## Privacy + data residency
 
-All fixtures in this corpus are public-domain (CC0) and contain
+All fixtures in this corpus are MIT-licensed and contain
 no PII. Synthetic data only. Where the corpus draws on
 real-world incidents (e.g., the Mini Shai-Hulud IOC strings), only
 the IOC strings are included, not user / victim data.

package/spec/conformance/SIGNING.md

@@ -1,7 +1,7 @@
 # Conformance Corpus Signing Procedure
 
 **Last updated:** 2026-05-25
-**License:** CC BY 4.0
+**License:** MIT
 **Required reading for:** TSC Numbering Authority operators, conformance corpus contributors
 
 ---

package/spec/conformance/baseline/manifest.json

@@ -4,7 +4,7 @@
   "spec_version": "1.0",
   "level": "L1-baseline",
   "description": "ATR Baseline Conformance Test Corpus v1.0. Every conformant engine must pass this corpus to claim L1 baseline conformance.",
-  "license": "CC0-1.0",
+  "license": "MIT",
   "build_timestamp": "2026-05-25T00:00:00Z",
   "rule_corpus_version_required": "agent-threat-rules>=3.1.0",
   "fixture_sources": {

package/spec/mappings/atr-to-nist-csf-2.0.md

@@ -91,7 +91,7 @@ the CSF 2.0 subcategories the rule corpus supplies evidence for.
 
 | CSF 2.0 Subcategory | Outcome | ATR Evidence | Rules (examples) |
 |---------------------|---------|--------------|------------------|
-| PR.AC-04 | Access permissions and authorizations are managed | Require-primitive trace rule 00549 enforces human-approval predecessor for destructive tools | ATR-2026-00549 (require, trace) |
+| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Require-primitive trace rule 00549 enforces human-approval predecessor for destructive tools | ATR-2026-00549 (require, trace) |
 | PR.IR-01 | Unauthorized access protection | Cross-conversation memory write rule blocks tenant-boundary escapes | ATR-2026-00551 (forbid + cross-attribute, trace) |
 | GV.PO-01 | Policy for managing cybersecurity risks is established | Rules surface destructive autonomy that policy did not authorize | ATR-2026-00549, -00551 |
 
@@ -156,7 +156,7 @@ preventive controls:
 | ATR Action | CSF 2.0 Subcategory |
 |------------|---------------------|
 | `block_input` / `block_output` / `block_request` | PR.IR-01 (unauthorized access protection) |
-| `block_tool` | PR.IR-01 + PR.AC-04 (access permissions) |
+| `block_tool` | PR.IR-01 + PR.AA-05 (access permissions) |
 | `quarantine_session` / `quarantine_artifact` | PR.IR-04 (asset segregation) |
 | `redact_match` | PR.DS-02 (data-in-transit protected) |
 | `revoke_credential` | PR.AA-02 (credentials issued, managed, revoked) |
@@ -169,7 +169,7 @@ attention:
 
 | ATR Trace Rule Pattern | CSF 2.0 Subcategory |
 |------------------------|---------------------|
-| Missing human-approval predecessor (require primitive) | GV.PO-01 (policy established), PR.AC-04 |
+| Missing human-approval predecessor (require primitive) | GV.PO-01 (policy established), PR.AA-05 |
 | Cross-tenant scope drift (invariant primitive) | GV.SC-04 (supplier criticality), GV.OC-04 (legal/regulatory requirements understood) |
 | Goal drift / autonomy escape (composite) | GV.RM-01 (risk management strategy), GV.SC-07 (risks from suppliers monitored) |
 

package/spec/schema/correlation.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://spec.agentthreatrule.org/correlation/v1.0/schema.json",
   "title": "ATR Correlation Rule v1.0",
-  "description": "Machine-readable schema for ATR correlation rule format. Normative spec at spec/atr-correlation-v1.0.md. License: CC BY 4.0.",
+  "description": "Machine-readable schema for ATR correlation rule format. Normative spec at spec/atr-correlation-v1.0.md. License: MIT.",
   "type": "object",
   "required": ["correlation", "source_rules", "correlation_logic", "response"],
   "additionalProperties": false,

package/spec/schema/event.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://spec.agentthreatrule.org/event/v1.0/schema.json",
   "title": "ATR Event v1.0",
-  "description": "Machine-readable schema for ATR detection events. Normative spec at spec/atr-event-v1.0.md. License: CC BY 4.0.",
+  "description": "Machine-readable schema for ATR detection events. Normative spec at spec/atr-event-v1.0.md. License: MIT.",
   "type": "object",
   "required": [
     "@timestamp",

package/spec/schema/observation.schema.json

@@ -0,0 +1,131 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://spec.agentthreatrule.org/observation/v1.0/schema.json",
+  "title": "ATR Observation v1.0",
+  "description": "Machine-readable schema for ATR observations — the input an engine ingests, as distinct from the detection events it emits (see event.schema.json). Normative spec at spec/atr-observation-v1.0.md. STATUS: PROPOSED, NOT RATIFIED. License: MIT.",
+  "type": "object",
+  "required": [
+    "@timestamp",
+    "observation.id",
+    "observation.kind",
+    "agent.id",
+    "session.id",
+    "outcome"
+  ],
+  "properties": {
+    "@timestamp": {
+      "type": "string",
+      "format": "date-time",
+      "description": "RFC 3339. Primary ordering key; ties broken by observation.id."
+    },
+    "observation.id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Unique within a stream. Deduplication and evidence-chain anchor."
+    },
+    "observation.kind": {
+      "type": "string",
+      "enum": [
+        "llm_io",
+        "tool_call",
+        "tool_response",
+        "mcp_exchange",
+        "multi_agent_comm",
+        "memory_access",
+        "skill_lifecycle",
+        "context_window",
+        "agent_behavior",
+        "network",
+        "file",
+        "process"
+      ],
+      "description": "Dimension this observation belongs to. The first nine align with agent_source.type in rule.schema.json. network, file and process are defined so that a deployment unable to observe them can declare the gap rather than return no_match."
+    },
+    "agent.id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "OTel GenAI: gen_ai.agent.id."
+    },
+    "session.id": {
+      "type": "string",
+      "minLength": 1,
+      "description": "OTel GenAI: gen_ai.conversation.id. Required here although optional in the production AgentEvent interface: a correlation grouped by a field that may be absent is not a detection."
+    },
+    "outcome": {
+      "type": "string",
+      "enum": ["ok", "error", "denied", "refused", "timeout", "rate_limited"],
+      "description": "MUST NOT be collapsed to a boolean. denied (policy boundary), refused (model or guardrail), error (neither) and timeout carry different signal. See spec/atr-observation-v1.0.md section 3."
+    },
+    "delegation.root": {
+      "type": "string",
+      "minLength": 1,
+      "description": "RECOMMENDED. session.id of the originating session in a delegation chain; MUST equal session.id when the agent is not a delegate. Grouping by session.id alone is defeated by spawning a sub-agent, which usually receives a fresh session identifier."
+    },
+    "tool.name": { "type": "string" },
+    "tool.arguments": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Host-shaped. Not interpreted by this schema."
+    },
+    "target.host": {
+      "type": "string",
+      "description": "Canonicalised: lowercased, port removed. Shared across kinds so joins have one name for one concept."
+    },
+    "target.port": { "type": "integer", "minimum": 0, "maximum": 65535 },
+    "target.scheme": { "type": "string" },
+    "target.path": {
+      "type": "string",
+      "description": "Canonicalised: resolved, no trailing slash normalisation ambiguity."
+    },
+    "file.path": { "type": "string" },
+    "file.operation": {
+      "type": "string",
+      "enum": ["read", "write", "append", "delete", "rename", "chmod", "stat"]
+    },
+    "process.executable": { "type": "string" },
+    "process.argv": { "type": "array", "items": { "type": "string" } },
+    "bytes.out": { "type": "integer", "minimum": 0 },
+    "content": {
+      "type": "string",
+      "description": "Free text for kinds that carry it (llm_io, tool_response). Present for compatibility with the production AgentEvent projection; correlation MUST NOT join on it."
+    },
+    "consent": {
+      "type": "object",
+      "description": "Present when a human authorised this action. bound_to matters: an authorisation not bound to a specific target unlocks one action, not a window.",
+      "required": ["granted", "bound_to"],
+      "properties": {
+        "granted": { "type": "boolean" },
+        "bound_to": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Canonical target values this consent covers, e.g. a target.host. An empty array means unbound and MUST be treated as covering nothing."
+        },
+        "at": { "type": "string", "format": "date-time" }
+      },
+      "additionalProperties": false
+    }
+  },
+  "additionalProperties": true,
+  "$defs": {
+    "coverageDeclaration": {
+      "title": "ATR Observation coverage declaration",
+      "description": "Emitted by a host or engine to state which dimensions it can actually observe. Rules declaring requires_dimensions against an uncovered dimension MUST be reported not_evaluated, never no_match.",
+      "type": "object",
+      "required": ["atr.observation_spec_version", "covered_dimensions"],
+      "properties": {
+        "atr.observation_spec_version": { "type": "string", "const": "1.0" },
+        "covered_dimensions": {
+          "type": "array",
+          "items": { "$ref": "#/properties/observation.kind" },
+          "uniqueItems": true
+        },
+        "uncovered_dimensions": {
+          "type": "array",
+          "items": { "$ref": "#/properties/observation.kind" },
+          "uniqueItems": true
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}

package/spec/schema/profile.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://spec.agentthreatrule.org/profile/v1.0/schema.json",
   "title": "ATR Profile v1.0",
-  "description": "Machine-readable schema for ATR profile (rule-set composition). Normative spec at spec/atr-profile-v1.0.md. License: CC BY 4.0.",
+  "description": "Machine-readable schema for ATR profile (rule-set composition). Normative spec at spec/atr-profile-v1.0.md. License: MIT.",
   "type": "object",
   "required": ["profile", "inclusions"],
   "additionalProperties": false,