approval-md 0.0.1 → 0.2.0

package/schema/event.schema.json

@@ -0,0 +1,1811 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://approval.md/schema/event.schema.json",
+  "$comment": "CC0 1.0. See schema/LICENSE.",
+  "title": "Event log record",
+  "description": "One line of `.approval/log/events.jsonl` (SPEC.md §8). The log is append-only and is the truth; projections are caches. Every record MUST validate against this schema before append (SPEC.md §8: validation at the write boundary is itself a control). Structural shape only: hash-chain linkage, first-record semantics, and monotonic `seq` are verified by the chain verifier (M1), not expressible here.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "seq",
+    "ts",
+    "event",
+    "actor",
+    "alg",
+    "hash",
+    "prev"
+  ],
+  "properties": {
+    "seq": {
+      "type": "integer",
+      "minimum": 1,
+      "description": "SPEC.md §8: 1-based position of this record in the append-only log. Strict monotonic succession across records is enforced by the chain verifier (M1); this schema constrains a single record only."
+    },
+    "ts": {
+      "type": "string",
+      "format": "date-time",
+      "description": "SPEC.md §8: RFC 3339 timestamp at which the event was appended (the example record uses `2026-08-04T09:14:02Z`)."
+    },
+    "event": {
+      "type": "string",
+      "enum": [
+        "task.registered",
+        "route.proposed",
+        "route.accepted",
+        "approval.requested",
+        "approval.granted",
+        "approval.rejected",
+        "approval.expired",
+        "approval.revoked",
+        "approval.withdrawn",
+        "execution.started",
+        "execution.completed",
+        "execution.failed",
+        "execution.indeterminate",
+        "execution.reconciled",
+        "budget.exceeded",
+        "policy.updated",
+        "policy.proposed",
+        "policy.declined",
+        "envelope.drift",
+        "audit.sampled",
+        "audit.reviewed",
+        "audit.dark_session",
+        "audit.decision_refused",
+        "reconciliation.required",
+        "reconciliation.satisfied",
+        "payload.pruned",
+        "gate.opened",
+        "gate.closed",
+        "gate.bypassed",
+        "gate.organ.attested",
+        "log.checkpoint"
+      ],
+      "description": "SPEC.md §8 'Event types (v0.1)': the closed set of thirty-one event types. Closed by design — an unrecognized type fails closed at the write boundary rather than entering the log unvalidated. `payload.pruned` (APRV-38) is the first addition after the v0.1 draft set of sixteen, `approval.withdrawn` (APRV-106) the second, `execution.indeterminate` with `execution.reconciled` (APRV-120) the third and fourth, `reconciliation.required` / `reconciliation.satisfied` (APRV-127) the fifth and sixth, `policy.proposed` / `policy.declined` (APRV-109) the seventh and eighth, `audit.dark_session` (APRV-192) the ninth, `gate.opened` / `gate.closed` / `gate.bypassed` (APRV-214) the tenth, eleventh and twelfth, `log.checkpoint` (APRV-220) the thirteenth, `audit.decision_refused` (APRV-235) the fourteenth, and `gate.organ.attested` (APRV-272) the fifteenth: a reader of a v0.1 log may encounter any of them, and a verifier written against the draft enum must be updated to accept them all."
+    },
+    "actor": {
+      "type": "string",
+      "pattern": "^(human|agent|system):.+",
+      "description": "SPEC.md §8: who caused the event, as `<kind>:<id>` (the example record uses `human:carter`). Three kinds: `human:` for a person acting through a channel or the CLI, `agent:` for an agent-originated event, and `system:` for events the daemon originates with no external prompt (for example `approval.expired`, which fires on TTL lapse rather than on any actor's action). Approval decisions are restricted to `human:` — see the per-type rules below."
+    },
+    "alg": {
+      "const": "sha256/jcs",
+      "description": "SPEC.md §8 (hash-scheme amendment): explicit hash-scheme identifier. Version 0.1 defines exactly one value, `sha256/jcs` — SHA-256 over the RFC 8785 (JCS) canonical serialization of the record with `prev` included. Missing or unrecognized `alg` MUST be rejected; differing `alg` values MAY coexist in one log so a scheme change is a migration, never a schism."
+    },
+    "hash": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$",
+      "description": "SPEC.md §8: this record's hash under `alg` — SHA-256 over the record's JCS canonical serialization with `prev` included, lowercase hex. That the digest actually matches the record contents is checked by `approval log verify` (M1); this schema constrains only its form."
+    },
+    "prev": {
+      "description": "SPEC.md §8: the previous record's `hash`, chaining the log so that `approval log verify` detects any mutation or truncation. `null` is legal only for the first record in a log; a schema can express the type union but not the position, so first-record semantics are enforced by the chain verifier (M1).",
+      "oneOf": [
+        {
+          "type": "string",
+          "pattern": "^[a-f0-9]{64}$"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "task": {
+      "type": "string",
+      "minLength": 1,
+      "description": "SPEC.md §8: the Backlog.md task id the event concerns (the example record uses `task-042`). Optional in the base shape and required per event type below."
+    },
+    "action_key": {
+      "type": "string",
+      "minLength": 1,
+      "description": "SPEC.md §8: the action's idempotency key (the example record uses `task-042:chaser:2026-08-04`), identifying the specific side effect being approved or executed. Optional in the base shape and required per event type below."
+    },
+    "channel": {
+      "type": "string",
+      "minLength": 1,
+      "description": "SPEC.md §8: the channel through which the event reached the runtime (the example record uses `telegram`). Optional: CLI- and daemon-originated events need not name one."
+    },
+    "payload": {
+      "type": "object",
+      "description": "SPEC.md §8: event-type-specific detail (the example record carries an approver's note). Shape is deliberately open at v0.1; per-type payload schemas are a later, separate task. Four names are constrained regardless of event type. Two are monetary (APRV-121), because they are the fields the budgets contract reads and the whole payload is hashed material: `est_cost_usd`, and `budget.max_cost_usd` as copied onto `task.registered`. Two are harness provenance (APRV-227): `harness` and `harness_version`, which the hook copies onto the `task.registered` and `gate.bypassed` records it writes. The rest of the payload stays open.",
+      "properties": {
+        "harness": {
+          "type": "string",
+          "enum": [
+            "claude-code",
+            "cursor",
+            "codex"
+          ],
+          "description": "SPEC.md §10.1 (amended, APRV-227): which harness hook wrote this record. A closed set, extended only by a task that adds the case, because it is the discriminator a reader scopes `harness_version` by: one log holds the records of every harness that ever wrote to it, and a version with no binary named beside it is a string nobody can compare against anything. OPTIONAL and additive — every record written before the field existed still validates and still verifies, and the two fields travel together or not at all."
+        },
+        "harness_version": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[\\u0020-\\u007e]+$",
+          "description": "SPEC.md §10.1 (amended, APRV-227): the version of the harness binary that issued this record, taken from the hook event where the harness supplies one and otherwise from `<binary> --version`, normalized to its first line. SELF-REPORTED, and informational only: nothing in the runtime reads it back as an input to a verdict, a floor, a budget, a streak or a sampling draw, so it satisfies SPEC.md §11.1 invariant 4 by having no path along which it could reduce scrutiny — its single reader is a doctor row that can only ADD a red line. Its SHAPE is constrained here because the value is the output of a third-party process being written to an append-only log: one line, printable ASCII, capped at 64 characters, so a banner or a stack trace (and whatever a stack trace quotes) cannot arrive through it. §11.1 invariant 3 has no exception for provenance. OPTIONAL and additive."
+        },
+        "est_cost_usd": {
+          "$ref": "#/$defs/usd_amount",
+          "description": "SPEC.md §5.2 budgets contract (amended, APRV-121): the authorization's declared cost in USD as a decimal string. Recorded on `approval.requested`, `approval.granted`, `execution.started` and `budget.exceeded`; a JSON number is the pre-APRV-121 form and is accepted on read, never on write."
+        },
+        "live_draw": {
+          "type": "object",
+          "description": "SPEC.md §6 (amended, APRV-208): how a `supervised-live` action's draw was made, present on `approval.requested` ONLY when the draw was delegated to the daemon over the local draw socket because the deciding process held no sampling secret. Absent for an in-process draw, which is why a sampled request made where the secret resolves stays byte-for-byte identical to a manual one (APRV-127). A delegated verdict is an assertion by another process, so it is recorded with the MAC that makes it checkable — HMAC-SHA-256 over a domain separator, the canonical question and the verdict, keyed by the sampling secret, reconstructible from the record's own `action_key`, `payload_hash` and `policy_sha256` plus this object's `live_rate` — or, when no usable answer came back, with the distinct machine-readable reason the action gated instead. It never carries the secret, the selection value, or any clock: a self-reported field that reduces scrutiny must arrive with a proof its author could not forge (§11).",
+          "required": ["v", "source", "reason", "live_rate"],
+          "properties": {
+            "v": {
+              "type": "integer",
+              "const": 1,
+              "description": "The draw protocol version the answer was made under. A reader that does not know this version must not treat the record as an evidenced draw."
+            },
+            "source": {
+              "type": "string",
+              "enum": ["daemon", "unavailable"],
+              "description": "`daemon`: a MAC'd answer from the daemon holding the secret. `unavailable`: no usable answer, so the action gated; `reason` says which refusal."
+            },
+            "reason": {
+              "type": "string",
+              "enum": ["selected", "draw-daemon-absent", "draw-daemon-stale", "draw-answer-invalid"],
+              "description": "`selected`: the daemon's draw put this action in the live fraction. The three refusals are distinct because an operator's action differs — no socket at all (start the daemon), a socket that will not answer or whose daemon is gone (it is wedged or was killed), and an answer that could not be matched to the question asked (something answered and it was not this operator's daemon)."
+            },
+            "live_rate": {
+              "type": "number",
+              "exclusiveMinimum": 0,
+              "maximum": 1,
+              "description": "The rate the draw was made at, as the DAEMON resolved it from its own policy. Recorded so a verifier can reconstruct the question without re-resolving a policy that may have been amended since."
+            },
+            "selected": {
+              "type": "boolean",
+              "description": "The daemon's verdict, present only with a `mac` to check it against. Always `true` on a recorded request: an unselected action appends no `approval.requested` at all (§6.3)."
+            },
+            "mac": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$",
+              "description": "The MAC over the question and the verdict. A digest under a key no party to this record holds, which is what makes it evidence rather than a claim."
+            },
+            "daemon_pid": {
+              "type": "integer",
+              "minimum": 1,
+              "description": "The process that answered, for an operator correlating a draw with a daemon's own logs. Carries no authority: a pid is not a proof, and the MAC is."
+            }
+          }
+        },
+        "budget": {
+          "type": "object",
+          "description": "SPEC.md §6.2 `budget`, copied onto `task.registered` at registration so the task's own cap is read from the log rather than from a file that may have been edited since.",
+          "properties": {
+            "max_cost_usd": {
+              "$ref": "#/$defs/usd_amount",
+              "description": "SPEC.md §6.2 (amended, APRV-121): the task's lifetime cap in USD as a decimal string."
+            }
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "usd_amount_string": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]*)(\\.[0-9]{0,5}[1-9])?$",
+      "description": "SPEC.md §8 (amended, APRV-121): a USD amount as a canonical decimal string. No sign, no exponent, no leading zeros, at most six fractional digits, and no trailing zeros beyond the last significant digit — one value has exactly one spelling, so two records carrying the same amount always hash the same way, in any language."
+    },
+    "usd_amount": {
+      "$ref": "#/$defs/usd_amount_string",
+      "description": "The write-boundary form of a USD amount: the decimal string, and nothing else. `validate(..., { mode: \"historical\" })` replaces this definition with `usd_amount_historical` so that records written before APRV-121 keep validating and verifying; nothing else in the runtime relaxes it."
+    },
+    "usd_amount_historical": {
+      "anyOf": [
+        { "$ref": "#/$defs/usd_amount_string" },
+        { "type": "number", "minimum": 0 }
+      ],
+      "description": "The read form: the decimal string, or the pre-APRV-121 JSON number. The log is append-only, so a verifier must accept every shape the write boundary ever admitted. Used only in historical validation mode."
+    }
+  },
+  "allOf": [
+    {
+      "$comment": "SPEC.md §8: approval lifecycle events name both the task and the specific action being decided.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "approval.requested",
+              "approval.granted",
+              "approval.rejected",
+              "approval.expired",
+              "approval.revoked",
+              "approval.withdrawn"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "task",
+          "action_key"
+        ],
+        "properties": {
+          "task": {
+            "$ref": "#/properties/task"
+          },
+          "action_key": {
+            "$ref": "#/properties/action_key"
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.1: granting and rejecting are human decisions made through the CLI or a channel. An agent- or system-originated grant would be the gate approving itself, so the actor MUST carry the `human:` prefix.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "approval.granted",
+              "approval.rejected"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          }
+        },
+        "required": [
+          "actor"
+        ]
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (APRV-56): reviewing a sampled action is a human decision, made through the CLI, and the runtime already refuses any other reviewer. A `system:` or `agent:` reviewer would be the party under oversight signing off on its own sample, which is the one reading of the record that must never be possible, so the actor MUST carry the `human:` prefix.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "audit.reviewed"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "properties": {
+              "verdict": {
+                "type": "string",
+                "enum": [
+                  "ok",
+                  "denied"
+                ],
+                "description": "SPEC.md §5.2 (amended, APRV-127): what the reviewer concluded. `ok`: the action should have happened — the spelling the v0.1 fixtures already used, kept rather than renamed, because a second word for a verdict already in logs is the drift this vocabulary exists to avoid. `denied`: it should not have, and the runtime appends a `reconciliation.required` naming the obligation the denial creates. Optional and additive — a review written before the split carries none and reads as the observation it was, which is why the ABSENCE of this field is never read as a denial."
+              },
+              "reaction": {
+                "type": "string",
+                "enum": [
+                  "disliked",
+                  "indifferent",
+                  "liked",
+                  "loved"
+                ],
+                "description": "SPEC.md §5.2 (amended, APRV-237): what the human thought of the action, graded. `verdict` remains the ENFORCEMENT field and is the only one any enforcement path reads; `reaction` is guidance travelling the human-to-agent direction and no routing, matching, sampling, budgeting or token decision consults it (SPEC.md §11.1 invariant 10). Optional and additive: a review written before the field existed still validates and still verifies, and the ABSENCE of the field is absence — it is never read as `indifferent`, which is a thing a person had to actually say. The four words are the whole vocabulary; a fifth is refused here rather than left to accumulate synonyms across surfaces."
+              }
+            }
+          }
+        },
+        "required": [
+          "actor"
+        ]
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2 (amended, APRV-237): a grant may carry the same graded `reaction` a review may, because a human answering the gate is already saying what they think of the action and this is where they can say it in one word rather than in prose nothing can read back. The constraint is the same four-word enum as on `audit.reviewed`, written here rather than shared by a `$ref` so the two events' descriptions can each say what the field means where it appears. Optional and additive, and never enforcement: `verdict` on a review and the grant record itself are what any enforcement path reads; nothing reads this (SPEC.md §11.1 invariant 10).",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "approval.granted"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "reaction": {
+                "type": "string",
+                "enum": [
+                  "disliked",
+                  "indifferent",
+                  "liked",
+                  "loved"
+                ],
+                "description": "SPEC.md §5.2 (amended, APRV-237): what the human thought of the action they were approving, graded. The grant is the enforcement fact; this is the human-to-agent signal riding alongside it, and no enforcement path reads it (SPEC.md §11.1 invariant 10). Optional and additive, and its ABSENCE is absence rather than `indifferent`. The four words are the whole vocabulary here and on `audit.reviewed`; one field name, one enum, two surfaces."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2 (amended, APRV-237): the two extreme grades require a note. `loved` and `disliked` are the reactions an agent is most likely to act on and least able to interpret alone — \"disliked\" with no words says something went wrong and nothing about what — so the grade that carries the most weight must carry a sentence with it. This is expressible in a schema (one record, two of its own fields) and so it is expressed HERE, at the write boundary SPEC.md §8 requires every event to pass, rather than left to the verbs alone. The verbs refuse it too, as `note-required`, because a refusal a person sees on their phone must name itself; the schema is what makes the rule true of every record regardless of which surface wrote it. `liked` and `indifferent` need no note: they are the ordinary readings, and demanding prose for them would turn a one-tap signal into a form and get the signal switched off.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "audit.reviewed",
+              "approval.granted"
+            ]
+          },
+          "payload": {
+            "type": "object",
+            "properties": {
+              "reaction": {
+                "enum": [
+                  "disliked",
+                  "loved"
+                ]
+              }
+            },
+            "required": [
+              "reaction"
+            ]
+          }
+        },
+        "required": [
+          "event",
+          "payload"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "required": [
+              "note"
+            ],
+            "properties": {
+              "note": {
+                "type": "string",
+                "minLength": 1,
+                "description": "SPEC.md §5.2 (amended, APRV-237): the human's own words, REQUIRED when `reaction` is `loved` or `disliked`. Blank is not a note: an empty string would satisfy a presence check while telling an auditor and an agent exactly as much as the absent field would, so the minimum length is part of the rule."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §6.3/§8 (APRV-106): a withdrawal is the requester retracting their own pending request, so the actor is the party that opened it — `agent:` for an agent-originated request, `human:` for a person's. Never `system:`: the runtime already has a way to end a request it was not asked to end, and that is `approval.expired` on TTL lapse. A `system:` withdrawal would let the runtime cancel a question a human was about to answer, with no clock to justify it. That the actor is the SAME party that appended the matching `approval.requested` is not expressible here (a schema sees one record), and is enforced by the gate as `not-requester`; what the schema can rule out is the actor kind that must never appear. `reason` is required and closed: a withdrawal that does not say why is a decision nobody can audit, and the three values are the three things that actually happen — the requester's wait elapsed, the requester changed its mind, or a newer request replaced this one.",
+      "$comment": "SPEC.md §6.3/§8 (APRV-106, amended APRV-235): a withdrawal is normally the requester retracting their own pending request, so the actor is the party that opened it — `agent:` for an agent-originated request, `human:` for a person's. That the actor is the SAME party that appended the matching `approval.requested` is not expressible here (a schema sees one record), and is enforced by the gate as `not-requester`. `reason` is required and closed: a withdrawal that does not say why is a decision nobody can audit, and the first three values are the three things that happen to a requester — its wait elapsed, it changed its mind, or a newer request replaced this one.\n\nAPRV-235 admits the runtime as a fourth author, on ONE reason and no other, and the cross-rule below is bidirectional: `system:` requires `policy-drift`, and `policy-drift` requires `system:`. The original ban existed because a `system:` withdrawal on the requester's reasons would let the runtime cancel a question a human was about to answer with no clock to justify it. `policy-drift` is the case where the justification is not a clock but is every bit as objective, and it is IN THE RECORD: the policy hash the `approval.requested` pinned differs from the hash attested now, so the rules that routed the question are gone and the gate already refuses every decision on it (`policy-drift` in `core/gate.ts`). The request is void by the gate's own verdict; leaving it pending offers a human a tap that cannot be honoured. A reader checks the justification the same way the runtime derived it, from two hashes the log carries. The requester's three reasons stay closed to the runtime, and the runtime's one reason stays closed to the requester — an agent cannot spell `policy-drift`, so it cannot dress a cancellation as the gate's verdict.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "approval.withdrawn"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^(human|agent|system):",
+            "description": "SPEC.md §6.3: the requester, or (APRV-235) `system:` on the one runtime reason `policy-drift`. The bidirectional cross-rule under `allOf` is what keeps those two sets from mixing."
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "action_key",
+              "reason"
+            ],
+            "properties": {
+              "action_key": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The withdrawn request's idempotency key, restated in the payload so the reason and the key it applies to travel together for a reader who has only the payload."
+              },
+              "reason": {
+                "type": "string",
+                "enum": [
+                  "timeout",
+                  "cancelled",
+                  "superseded",
+                  "policy-drift"
+                ],
+                "description": "Why the request ended without a decision. The first three are the REQUESTER's: `timeout`, the requester stopped waiting and can no longer consume a decision; `cancelled`, the requester no longer wants the action; `superseded`, a newer request covers the same effect. `policy-drift` (APRV-235) is the RUNTIME's and is `system:`-only: the policy attested now is not the policy this request pinned, so the gate refuses every decision on it and the request is void. The two hashes belong in `note`, where a reader can check the verdict against the log rather than take it."
+              },
+              "note": {
+                "type": "string",
+                "description": "The requester's free-text elaboration. Claimed, never a control. On a `policy-drift` withdrawal it is the runtime's own, and names both policy hashes."
+              },
+              "refused_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "APRV-235, `policy-drift` only: the `seq` of the `audit.decision_refused` record that voided this request. The audit record is appended FIRST and this names it, so the pair is readable in one direction and an interrupted write leaves the explanation without the withdrawal rather than the withdrawal without the explanation."
+              }
+            }
+          }
+        },
+        "allOf": [
+          {
+            "$comment": "`policy-drift` is the runtime's reason and only the runtime's: a requester that could spell it would be dressing its own cancellation as the gate's verdict about the policy.",
+            "if": {
+              "type": "object",
+              "required": [
+                "payload"
+              ],
+              "properties": {
+                "payload": {
+                  "type": "object",
+                  "required": [
+                    "reason"
+                  ],
+                  "properties": {
+                    "reason": {
+                      "const": "policy-drift"
+                    }
+                  }
+                }
+              }
+            },
+            "then": {
+              "type": "object",
+              "properties": {
+                "actor": {
+                  "type": "string",
+                  "pattern": "^system:"
+                }
+              }
+            }
+          },
+          {
+            "$comment": "And the converse: the runtime withdraws for drift or not at all. `approval.expired` remains its only other way to end a request nobody answered, and the pre-APRV-235 ban on a `system:` withdrawal for a requester's reason is unchanged.",
+            "if": {
+              "type": "object",
+              "required": [
+                "actor"
+              ],
+              "properties": {
+                "actor": {
+                  "type": "string",
+                  "pattern": "^system:"
+                }
+              }
+            },
+            "then": {
+              "type": "object",
+              "properties": {
+                "payload": {
+                  "type": "object",
+                  "properties": {
+                    "reason": {
+                      "const": "policy-drift"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.1/§10.3/§11 (amended, APRV-109): an attestation prompt. An agent that has prepared a policy edit appends this to ask a human to attest the bytes; a channel renders it like a manual action prompt and the tap appends `policy.updated`. The actor is the party that prepared the edit, so `agent:` is expected and `human:` is allowed (a person can propose too); `system:` is refused, because the runtime has no policy edit of its own to ask about and a runtime-originated proposal would be the gate writing its own rules. Every payload field the schema requires is COMPUTED by the runtime from the policy bytes — the SHA-256, the semantic diff summary and the load advisory — and the proposing caller has no parameter for any of them, so a proposal cannot show an approver one story and attest a different file. `note` and `wait_until` are the proposer's own and are rendered claimed. A diff too large for a channel to show whole is refused (`diff-too-large`) before this record is written, so `diff.lines` is what a channel prints and never a truncation of it.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "policy.proposed"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^(human|agent):",
+            "description": "The party that prepared the policy edit. `system:` is refused: the runtime proposes no policy of its own."
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "policy_path",
+              "sha256",
+              "diff",
+              "load"
+            ],
+            "properties": {
+              "policy_path": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The policy file's BASENAME, as `policy.updated` records it: the log is meant to be copied and read on other machines, and an absolute path would leak the writer's home directory while saying nothing a reader can use."
+              },
+              "sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SHA-256 (lowercase hex) of the proposed policy file's exact bytes, computed by the runtime. The hash a channel displays, and the only hash a tap can attest."
+              },
+              "payload_hash": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SPEC.md §10.4: the binding for the full policy text stored beside the log, so an approver can read the whole file and not only the summary."
+              },
+              "diff": {
+                "type": "object",
+                "required": [
+                  "available",
+                  "lines",
+                  "headline"
+                ],
+                "description": "The semantic diff summary, computed from the proposed bytes against a baseline whose own SHA-256 equals the latest attestation. `available: false` is hash-only mode and carries the reason; it is never a truncated diff.",
+                "properties": {
+                  "available": {
+                    "type": "boolean"
+                  },
+                  "reason": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "lines": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "headline": {
+                    "type": "string"
+                  },
+                  "baseline_sha256": {
+                    "oneOf": [
+                      {
+                        "type": "string",
+                        "pattern": "^[a-f0-9]{64}$"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  }
+                }
+              },
+              "load": {
+                "type": "object",
+                "required": [
+                  "ok"
+                ],
+                "description": "The load advisory for the proposed bytes. A policy that does not load fails closed to all-manual for every class; the prompt says so before the tap rather than after it.",
+                "properties": {
+                  "ok": {
+                    "type": "boolean"
+                  },
+                  "code": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "message": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  }
+                }
+              },
+              "note": {
+                "type": "string",
+                "description": "The proposer's own words. Claimed, never a control."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.1/§11 (amended, APRV-109): a human refused to attest the proposed policy bytes. Human-only for the same reason `approval.rejected` is: the answer to an attestation prompt is the human act the whole ceremony exists to collect, and an agent-authored refusal would be the party under oversight closing its own question. `proposed_seq` names the prompt this answers, so a reader of the decline alone can find the hash, the diff and the advisory the approver was shown. Nothing about a decline attests anything: the policy stays exactly as unattested as it was.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "policy.declined"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:",
+            "description": "The approver. Answering an attestation prompt is human-only, in the schema as well as in the code."
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "sha256",
+              "proposed_seq"
+            ],
+            "properties": {
+              "sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "The proposed policy hash that was refused."
+              },
+              "proposed_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `policy.proposed` record this answers."
+              },
+              "note": {
+                "type": "string",
+                "description": "The approver's free-text reason."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§10.1 (amended, APRV-109): an attestation that answers a channel prompt names the prompt it answers. Optional and additive — `approval policy attest` at a terminal answers no prompt and carries none — and only its SHAPE is constrained here: that the seq names a `policy.proposed` record the log actually carries is not expressible in a schema that sees one record, and is the runtime's check.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "policy.updated"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "proposed_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `policy.proposed` record this attestation answers."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §8: execution events report on one keyed action of one task.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "execution.started",
+              "execution.completed",
+              "execution.failed",
+              "execution.indeterminate",
+              "execution.reconciled"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "task",
+          "action_key"
+        ],
+        "properties": {
+          "task": {
+            "$ref": "#/properties/task"
+          },
+          "action_key": {
+            "$ref": "#/properties/action_key"
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.4 (amended, APRV-205): an executor that spawns a child builds that child's environment rather than inheriting one, withholding every variable under the credential-bearing prefixes (less the runtime's non-secret allowlist) and the variable the policy's `vault.passphrase_env` names. `env_stripped` records HOW MANY were withheld and nothing else: a variable's name is half of a credential, and §11.1's raw-secrets invariant is not satisfied by leaking the other half slowly. The field is informational — nothing in the gate reads it back and no decision turns on it, which is why it does not collide with §11.1's rule that self-reported fields never reduce scrutiny. OPTIONAL and additive: an execution with no child (an adapter's `act`, which runs in the runtime's own process) records no count, every record written before the field existed still validates and still verifies, and only the SHAPE is constrained here.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "execution.started"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "env_stripped": {
+                "type": "integer",
+                "minimum": 0,
+                "description": "SPEC.md §10.4: the COUNT of credential-bearing environment variables withheld from the spawned child. Never a name and never a value.",
+                "examples": [3]
+              },
+              "grant_origin": {
+                "enum": ["direct", "carried"],
+                "description": "SPEC.md §10.4 (amended, APRV-200): how the authorization reached the process that spent it, on a harness `execution.started` that names a `grant_seq`. `direct` means the tool call that spent the grant is the tool call that asked for it, so one process observed the whole ordering and nothing this runtime authorized ran before the human answered. `carried` means a LATER tool call spent it under the carryover of §10.2's harness path: the asking invocation had already returned its verdict, and whether the harness honoured that verdict is a fact this runtime never observes, because it decides and the harness executes. The ordering the record implies is therefore guaranteed only for `direct`, and this field is what lets an auditor tell the two apart from the log alone. Derived at the write boundary from the task the request record carries, never from a caller's assertion of it: the value that adds scrutiny is the default and the one that removes it is reachable only by naming a fact already in the verified log, which is §11.1 invariant 4 applied to a marker. OPTIONAL and additive — an execution with no grant reports no origin, and every record written before the field existed still validates and still verifies.",
+                "examples": ["direct"]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.3 (amended, APRV-38): a decision collected as part of a batch gesture carries the batch's channel delivery id as a first-class payload field. Optional — a unit decision has no batch — and constrained only when present, so the field can never arrive as an empty string or a number that audit would have to guess at.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "approval.granted",
+              "approval.rejected"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "batch_delivery_id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "SPEC.md §10.3: the channel delivery id of the batch this decision answered. The log never batches — each member gets its own event — so this field is what ties the separate events back to the one human gesture. Earlier v0.1 builds encoded the same id in the first line of `note` (`batch_delivery_id=<id>`); readers accept both encodings through v0.1 and prefer this one.",
+                "examples": ["tg-batch-7"]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (amended, APRV-118): a request and the grant that answers it each pin the SHA-256 of the attested policy the runtime evaluated them under, so a reader can see whether the approver decided by the rules the requester was routed by. The runtime assigns the value at the write boundary from its own attestation check, exactly as it assigns `ts` to a gate-typed event; a grant whose hash differs from its request's is refused `policy-drift` and never reaches this schema. Optional, and deliberately: the field is additive, so records written before it existed still validate and still verify, and only its SHAPE is constrained here — a 64-character lowercase hex digest, never an empty string or a truncated one that audit would have to guess at. Whether the hash names an attestation the log actually carries is not expressible in a schema that sees one record, and is the gate's check.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "approval.requested",
+              "approval.granted"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "policy_sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SPEC.md §5.2: SHA-256 (lowercase hex) of the attested policy file's exact bytes, as recorded by the `policy.updated` attestation the live file matched when this event was written."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §6.3/§10.4 (amended, APRV-105): sealed token delivery. `token_recipient_key` on `approval.requested` is the PUBLIC half of an ephemeral X25519 keypair the requester minted for this one request; the private half never leaves the requesting machine. `token_sealed` on `approval.granted` is the raw execution token encrypted to that key. Both are optional and additive: under the default `token_delivery: manual` neither appears and a record is byte-identical to one written before the field existed. Note what `token_sealed` does NOT weaken. §11.1 invariant 3 is reworded rather than relaxed: what appears in the log is a hash, or ciphertext sealed to a recipient key the log does not hold. The log carries no private key and no plaintext, so an attacker with a copy of the log — the one artifact this system deliberately makes durable, copyable and auditable — gains nothing, exactly as before. `token_sha256` remains present and remains what possession is proven against; the seal is a delivery mechanism, never an authorization.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "approval.requested",
+              "approval.granted"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "token_recipient_key": {
+                "type": "string",
+                "minLength": 20,
+                "maxLength": 600,
+                "pattern": "^[A-Za-z0-9+/]+={0,2}$",
+                "description": "The requester's ephemeral X25519 PUBLIC key, base64 DER SPKI. An ADDRESS, not a credential: it can receive a token and cannot mint, forge, rebind or respend one. Channels render it as a COMPUTED field so an approver can see that a delivery address was published and by whom."
+              },
+              "token_sealed": {
+                "type": "object",
+                "required": [
+                  "alg",
+                  "epk",
+                  "nonce",
+                  "ct",
+                  "tag"
+                ],
+                "description": "The raw token sealed to `token_recipient_key`: X25519 ECDH to a fresh ephemeral sender key, HKDF-SHA-256 to a 32-byte key, AES-256-GCM with a fresh nonce. The HKDF info binds the ciphertext to the scheme and to the action key, so a seal cannot be replayed as another action's.",
+                "properties": {
+                  "alg": {
+                    "const": "x25519-hkdf-sha256/aes-256-gcm",
+                    "description": "The scheme identifier. One value in v0.1, present so no reader has to guess; a differing value MUST be refused rather than attempted."
+                  },
+                  "epk": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The sender's ephemeral X25519 public key, base64 DER SPKI."
+                  },
+                  "nonce": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The AES-GCM nonce, base64. Fresh for every seal."
+                  },
+                  "ct": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Ciphertext, base64."
+                  },
+                  "tag": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "The GCM authentication tag, base64."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §9/§10.3 (amended, APRV-119, WYSIWYS): `display_hash` is the SHA-256 of the canonical rendering every channel MUST present for this request's payload — the digest of what the approver READ, beside `payload_hash`, the digest of what the approval BINDS to. The runtime assigns it at the write boundary from the deterministic renderer (`core/wysiwys.ts`), exactly as it assigns `ts` and `policy_sha256`; a requester cannot supply it, so it can never name a rendering that was not produced from the bound bytes. Optional, and deliberately: the field is additive, so records written before it existed still validate and still verify, and a request whose bytes this runtime does not hold records none rather than inventing one. Only its SHAPE is constrained here — a 64-character lowercase hex digest. Whether it equals a re-render of the stored payload is not expressible in a schema that sees one record, and is a check any reader with the payload store can make for itself.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "approval.requested"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "display_hash": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SPEC.md §9/§10.3 (APRV-119): SHA-256 (lowercase hex) over the UTF-8 text of the canonical rendering of this request's payload, as produced by the versioned deterministic renderer named inside that text."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (amended, APRV-127): `reconciliation.required` records the obligation a RETROSPECTIVE DENIAL creates. The runtime cannot undo anything — the action already executed — so what it can do is oblige and record, and this is that record. The actor is `system:` because the obligation is mechanical: it follows from a human's denial by a rule, and an obligation an agent or a human could author by hand is an obligation the party under oversight could word into something it prefers. Every field named here is REQUIRED, because an obligation that does not say which action, under which class, denied by which review, and in which shape is an obligation nobody can discharge or audit.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "reconciliation.required"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "action_key",
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "action_key": {
+            "$ref": "#/properties/action_key"
+          },
+          "actor": {
+            "type": "string",
+            "pattern": "^system:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "action_key",
+              "class",
+              "review_seq",
+              "obligation"
+            ],
+            "properties": {
+              "action_key": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The denied action's idempotency key, restated in the payload so the obligation and the action it concerns travel together for a reader who has only the payload."
+              },
+              "class": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The side-effect class the action was declared under. The class, not the action, is what a policy-was-wrong finding tightens."
+              },
+              "review_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The seq of the `audit.reviewed` record that denied. The denial is the fact; this obligation is its consequence, and the two are joined here rather than by proximity in the chain."
+              },
+              "obligation": {
+                "type": "string",
+                "enum": [
+                  "gated-revert",
+                  "policy-finding"
+                ],
+                "description": "The shape the declared reversibility selects. `gated-revert`: the action can be undone, so the obligation is to undo it THROUGH THE GATE — the revert is itself a side-effecting action, and routing it through the gate is what closes the loop in the log. `policy-finding`: the action cannot be undone (or nobody declared that it could), so there is nothing to revert and the obligation is the review of the class that permitted it. Which one applies is decided by the runtime from the declaration the log already holds; see the reversibility floor note in `core/audit.ts` on why a self-reported `reversible: true` may select the SHAPE of an obligation and may never remove one."
+              },
+              "reversible": {
+                "description": "The action's declared reversibility, as the `task.registered` record carried it, or `null` when the declaration named none. Recorded so a reader can see which claim selected the obligation shape. SELF-REPORTED: it is evidence about the claim, never a permission.",
+                "oneOf": [
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (amended, APRV-127): `reconciliation.satisfied` closes one obligation, and it is HUMAN-ONLY by the same rule that governs grant, reject, revoke and `audit.reviewed`. The whole content of the record is that a person judged the obligation discharged; a runtime that could satisfy its own obligations would be a reconciliation backlog that empties itself, which is exactly the failure an unreconciled denial exists to make visible. `note` is required and not optional: `audit.reviewed` may record only \"seen\", but this record asserts that something was DONE, and an assertion with no statement of what was done is one no auditor can check.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "reconciliation.satisfied"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "obligation_seq",
+              "note"
+            ],
+            "properties": {
+              "obligation_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The seq of the `reconciliation.required` record being closed. Named by seq rather than by action key because one action may accumulate more than one obligation, and a satisfaction that could mean either would close the wrong one."
+              },
+              "note": {
+                "type": "string",
+                "minLength": 1,
+                "description": "What the human did. Required: this record asserts a discharge, and a discharge nobody described is one nobody can check."
+              },
+              "revert_action_key": {
+                "type": "string",
+                "minLength": 1,
+                "description": "For a `gated-revert` obligation, the idempotency key of the action that performed the revert. The runtime refuses the satisfaction unless the log carries an `execution.completed` for that key, so the loop closes in the chain rather than in a sentence."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §8/§9 (amended, APRV-38): `payload.pruned` records that the daemon removed a payload file from `.approval/payloads/` under `payload_retention`. Two constraints, both about who and what: the actor is `system:` because pruning is a retention rule executing on a schedule rather than anyone's decision (a `human:` or `agent:` pruner would be a party under oversight deleting the evidence its approval bound to), and the payload names the removed bytes by their SHA-256, which is the store's own key and the same value a grant binds to. The log therefore states exactly what the store no longer holds.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "payload.pruned"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^system:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "payload_hash"
+            ],
+            "properties": {
+              "payload_hash": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SPEC.md §6.2/§9: SHA-256 (lowercase hex) of the pruned payload's bytes — the content address `.approval/payloads/` filed them under, and the value the action's grant bound to."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.2 (amended, APRV-145): the completion counterpart. A harness adapter answers before the tool runs and never observes an exit status, so the `execution.started` it writes is terminal by design; an implementation MAY close it from a post-execution harness event, and the record it appends is an ordinary `execution.completed` or `execution.failed` carrying two additive markers. `reported_by` names which untrusted reporter ASSERTED the outcome and is drawn from a closed set, extended only by a task that adds the case: it is a claimed field in the computed-versus-claimed vocabulary of §9 and reduces nothing, and a free-text value is where a tool's output (and the credential quoted inside it) would arrive. `execution` repeats the harness marker the start carries, so a reader can tell an asserted outcome from an observed one without walking back to the start record. Both are OPTIONAL and only their SHAPE is constrained: the field is additive, so every outcome written before it existed still validates and still verifies, and a record's payload is otherwise unchanged. `exit_code` is constrained to an integer or null — a harness that states no code records null rather than a number nobody measured, exactly as `execution.indeterminate` does. Whether the named start actually carries the marker is the gate's check (`not-delegated`); a schema sees one record.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "execution.completed",
+              "execution.failed"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "reported_by": {
+                "type": "string",
+                "enum": [
+                  "post-tool-use"
+                ],
+                "description": "Which untrusted reporter asserted this outcome. `post-tool-use`: a harness adapter's post-execution hook event. Closed, and extended only by a task that adds the case. Its presence marks the record as a REPORT rather than an observation; its absence means this runtime watched the process to its exit itself."
+              },
+              "execution": {
+                "const": "harness",
+                "description": "The same marker the `execution.started` carries: the harness ran the command and this runtime never observed the exit status. Present only on a counterpart appended from a harness report."
+              },
+              "exit_code": {
+                "type": [
+                  "integer",
+                  "null"
+                ],
+                "description": "The process exit code where one was observed or stated, and `null` where none was. A harness event exposes no exit code, so a counterpart records `null`: an invented number would be indistinguishable from a measured one."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §8 (amended, APRV-251): an `execution.completed` MAY carry `provider_ref`, the identifier the provider's own record files this effect under, so that `approval coverage` (§10.1) can join a witness outside this runtime to the log by id instead of by class and time window. Exactly two members and no others: `adapter`, the name of the adapter that executed the action, and `id`, the provider's identifier. `additionalProperties: false` is the whole point of the shape — a reference that could carry a third member is a place to put a message body, and the length and character bounds close the same door on the two members it does have. Both are written by the runtime: `adapter` from the registered adapter, `id` lifted from what the adapter returned, through the same redaction sweep as every other string it returned (§11.1 invariant 3). An id whose bytes that sweep touched is OMITTED by the write path rather than recorded, since a redacted identifier matches nothing and would read like one that does. The field authorizes nothing and no verdict reads it back, so §11.1 invariant 4 is untouched by a value that came in part from the far side. OPTIONAL and additive: an execution whose adapter names no reference records none, and every record written before the field existed still validates and still verifies. Constrained on `execution.completed` alone, because that is the only event a completed side effect's identifier belongs on; a failed execution produced no effect for a provider to file.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "execution.completed"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "payload": {
+            "type": "object",
+            "properties": {
+              "provider_ref": {
+                "type": "object",
+                "required": [
+                  "adapter",
+                  "id"
+                ],
+                "additionalProperties": false,
+                "properties": {
+                  "adapter": {
+                    "type": "string",
+                    "pattern": "^[\\x21-\\x7e]{1,64}$",
+                    "description": "The name of the adapter that executed the action, as the runtime holds it. Printable ASCII with no spaces, at most 64 characters."
+                  },
+                  "id": {
+                    "type": "string",
+                    "pattern": "^[\\x21-\\x7e]{1,256}$",
+                    "description": "The provider's own identifier for the effect (an AgentMail `message_id`). Printable ASCII with no spaces, at most 256 characters: an identifier is short, and the bound is what keeps this field from becoming somewhere to put a message."
+                  }
+                },
+                "examples": [{ "adapter": "agentmail", "id": "msg_01JQ2" }]
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §6.3/§10.4 (amended, APRV-120): `execution.indeterminate` records that a side effect was ATTEMPTED and that its outcome is unknown. It is not a failure — a failure is a fact — and the difference is what stops a blind retry against an action that may already have happened. Two constraints, both about what may be written down. `reason` is required and closed: an unknown outcome that does not say where the unknowing began is not machine-readable, and a free-text reason is where an exception message (and the credential quoted inside it) would arrive. `exit_code` is `null` when present, never a number: nobody observed one, and a fabricated code would read exactly like a measured one. The bytes of the exception are deliberately absent from this record; the executing caller receives them, redacted, and the log holds the closed code.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "execution.indeterminate"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "payload"
+        ],
+        "properties": {
+          "payload": {
+            "type": "object",
+            "required": [
+              "reason"
+            ],
+            "properties": {
+              "reason": {
+                "type": "string",
+                "enum": [
+                  "act-threw"
+                ],
+                "description": "Where the unknowing began. `act-threw`: the adapter's `act` was entered and raised, so the provider call may or may not have committed. Closed, and extended only by a task that adds the case."
+              },
+              "exit_code": {
+                "type": "null",
+                "description": "Always `null`. No process was watched to an exit, and an invented number would be indistinguishable from an observed one."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §6.3/§10.4 (amended, APRV-120): `execution.reconciled` records what a person established about an indeterminate execution. It never rewrites the indeterminate record — the original observation survives its resolution, which is the point of an append-only log — and it names that record by seq so a reader can walk from one to the other. Human-only, for the reason `execution resolve` is: an agent reconciling its own indeterminate outcome is the executing party reporting on itself. The note is the evidence and is required non-empty, because an unexplained resolution cannot be told apart from a guess, and `resolution` is closed to two values so that \"it did happen\" and \"it did not\" are distinct in the log rather than a matter of reading prose.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "execution.reconciled"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "indeterminate_seq",
+              "resolution",
+              "note",
+              "attested_by_human"
+            ],
+            "properties": {
+              "indeterminate_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `seq` of the `execution.indeterminate` record this resolves. That the named record exists, concerns this action key, and is not already reconciled is the gate's check; a schema sees one record and can only constrain the shape."
+              },
+              "resolution": {
+                "type": "string",
+                "enum": [
+                  "executed",
+                  "not-executed"
+                ],
+                "description": "What the evidence established. `executed`: the side effect did happen. `not-executed`: it did not, which is what re-opens the possibility of a fresh request for the same effect under a new idempotency key. The key itself stays burned either way."
+              },
+              "note": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The evidence, in the reconciler's own words: which log, which provider console, which message id. The whole value of the record is this."
+              },
+              "attested_by_human": {
+                "const": true,
+                "description": "Marks the record as an observation rather than a machine's report, exactly as `execution resolve` marks its own."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §8: task-scoped events that precede or accompany a specific action key. Budget accounting is per task (SPEC.md §5), so `budget.exceeded` names the task but need not name an action.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "enum": [
+              "task.registered",
+              "route.proposed",
+              "route.accepted",
+              "envelope.drift",
+              "budget.exceeded"
+            ]
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "task"
+        ],
+        "properties": {
+          "task": {
+            "$ref": "#/properties/task"
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §10.2 (amended, APRV-192): the dark-session observation. The daemon correlates the git activity it can see against the records the log carries, and appends this when a checkout produced gated-class git activity for which no hook record exists. It is a statement by the RUNTIME about what it observed, never a record written on a session's behalf, so the actor MUST be `system:`-prefixed: an agent- or human-authored dark-session record would be the party under oversight (or the party it reports to) authoring the detector's findings, and §11.1 invariant 4 forbids a self-reported value from lowering scrutiny. The payload names the subject checkout, the verdict's stable code, the observation key that makes the append idempotent across ticks, and the counts. No commit message, no diff, no command text: §11.1 invariant 3 has no exception for diagnostics, and what this record establishes is an ABSENCE, which needs no content to state.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "audit.dark_session"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^system:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "subject",
+              "code",
+              "observation_key"
+            ],
+            "properties": {
+              "subject": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The checkout the observation is about, named as the worktree directory's base name."
+              },
+              "code": {
+                "type": "string",
+                "enum": [
+                  "no-records",
+                  "no-evidence"
+                ],
+                "description": "Which arm found it: `no-records` is git activity with no attributable hook record at all, `no-evidence` is a guarded path changed with no evidence a human decided it (the spelling APRV-151's CI guard already uses)."
+              },
+              "observation_key": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Subject plus the state of the world it was observed in. The sweep re-derives it every tick and appends nothing for a key the verified log already carries, so a standing dark worktree produces one record rather than one per tick."
+              },
+              "commits": {
+                "type": "integer",
+                "minimum": 0
+              },
+              "guarded_paths": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "window": {
+                "type": "object",
+                "properties": {
+                  "from": {
+                    "type": "string",
+                    "format": "date-time"
+                  },
+                  "to": {
+                    "type": "string",
+                    "format": "date-time"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (amended, APRV-235): a human decided, through a channel or the CLI, and the gate refused to record the decision. Seen live on 2026-09-02: an approve tap on a request asked under the previous policy was refused `policy-drift`, correctly, and nothing was appended at all — the log, which is the truth, held no trace that a person had answered, and a later reader could not explain why a request sat unanswered.\n\nThis is an AUDIT-TIER record and grants nothing. No verdict, no budget, no streak and no sampling path reads it: `core/state.ts` does not settle on it, `core/budgets.ts` charges nothing for it, and it mints no token. What it establishes is that a human's attention was spent and the answer could not be taken — which is a fact about the gate, not an authorization by it.\n\nThe actor MUST be `^system:` for the same reason `audit.dark_session`'s is: this is the RUNTIME's statement about a refusal the runtime made, and a record of a refusal authored by either party to it is a record neither party can be held to. The human who decided is named in the payload, from the decision surface's configured identity — the same source the `actor` of a grant comes from — so nothing here is a self-report that lowers scrutiny (§11.1 invariant 4); an audit record can only ADD to what a reviewer sees.\n\nGate-side refusals to AGENTS stay unlogged, deliberately. An agent that is refused is told, retries or stops, and can be asked again; a human who is refused has already spent the thing SPEC.md §11 calls the audit budget, and cannot be asked to spend it again without a record saying the first spend happened.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "audit.decision_refused"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "action_key",
+          "channel",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^system:",
+            "description": "The runtime. A `human:` or `agent:` actor is refused: the record states that the gate refused a decision, and the parties to that refusal do not author it."
+          },
+          "action_key": {
+            "$ref": "#/properties/action_key"
+          },
+          "channel": {
+            "$ref": "#/properties/channel",
+            "description": "Which surface collected the gesture — `telegram`, `web`, `cli`. Required here and optional in the base shape: a refused decision a reader cannot attribute to a surface is one they cannot go and reproduce, and every decision surface knows its own name."
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "actor",
+              "decision",
+              "code"
+            ],
+            "properties": {
+              "actor": {
+                "type": "string",
+                "pattern": "^human:",
+                "description": "The person whose decision was refused, `human:<id>`. Distinct from the record's own `actor`, which is the runtime: this field is the SUBJECT of the observation, and the record's actor is its author. `^human:` because this event exists only for a human decision; a refusal handed to an agent is not recorded at all."
+              },
+              "decision": {
+                "type": "string",
+                "enum": [
+                  "grant",
+                  "reject",
+                  "revoke"
+                ],
+                "description": "Which of `core/gate.ts`'s three human-only decisions was attempted. Recorded so a reader can tell an unrecordable YES from an unrecordable NO, which are very different facts about an unanswered request."
+              },
+              "code": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The gate's machine-readable refusal code, verbatim (§11.1 invariant 6: refusals are machine-readable and distinct). Not pinned to an enum here on purpose. The closed union is `GATE_REFUSAL_CODES` in `core/gate.ts`, pinned for conformance in `conformance/vectors/refusal-unions.v1.json`, and a log is append-only: a code retired from the union must still READ, so the schema constrains the shape and the union constrains what may be written."
+              },
+              "policy_sha256_requested": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "The policy hash the `approval.requested` pinned, on a `policy-drift` refusal. Copied from the request record, never recomputed."
+              },
+              "policy_sha256_attested": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "The policy hash in force at the moment of the refusal, as the runtime attested it. Assigned at the write boundary like `ts`; there is no parameter through which a caller could supply either hash."
+              },
+              "message": {
+                "type": "string",
+                "description": "The gate's own refusal message, as the approver was shown it. A convenience for a reader; `code` is what anything machine-readable branches on."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2 (amended, APRV-214), 'The open window': a person opening the harness gate on themselves so the gate can be debugged from inside. The actor MUST be `^human:`, in the schema as well as in `core/gate-window.ts`, for the reason attestation refuses an agent: this is the one act that suspends the policy, and an agent able to author it could authorize its own next command. The window's state lives here and in no file, so what a reader derives is derived from a verified chain and nothing else. Expiry is `ts` plus `duration`, and a record claiming an `expires_at` beyond that reads as the shorter of the two: the field is a convenience for a human reading the log, never the authority.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "gate.opened"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "expires_at",
+              "duration",
+              "reason",
+              "scope"
+            ],
+            "properties": {
+              "expires_at": {
+                "type": "string",
+                "format": "date-time",
+                "description": "When the window lapses, as the opener's runtime computed it from the record's own `ts`. Nothing is appended at lapse, so a reader derives closure from this and from the absence of a `gate.closed` naming this record's seq."
+              },
+              "duration": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The duration as it was asked for (`30m`, `2h`). The authority, alongside `ts`: a duration over the 24h cap is clamped at read time, so a hand-written record cannot buy a longer window than the runtime would have granted."
+              },
+              "reason": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Why the window was opened, in the opener's words. Required: a bypass nobody stated a reason for is a bypass nobody can review."
+              },
+              "scope": {
+                "type": "string",
+                "enum": [
+                  "hook"
+                ],
+                "description": "What the window suspends. One value at v0.1: the harness hook's policy resolution. It is an enum rather than a free string so that a later scope is an explicit schema change and never a value an opener invents."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2 (amended, APRV-214): the human closing an open window early. Human-actor for the same reason `gate.opened` is, though this one only ever TIGHTENS: an agent able to close a window could not thereby authorize anything, and the rule is kept uniform so the pair reads as one ceremony.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "gate.closed"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "opened_seq"
+            ],
+            "properties": {
+              "opened_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `seq` of the `gate.opened` this closes. That the named record exists and is the latest open one is the runtime's check; a schema sees one record and can only constrain the shape."
+              },
+              "note": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Optional: what was learned while the window was open."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2 (amended, APRV-214): one gated tool call the hook allowed because a window was open. Appended BEFORE the allow is printed, so a bypassed command that ran and was not recorded is not a state this runtime can reach (§11.1 invariant 8). Either actor kind: the record says who the harness ran as, and it is a statement about the call rather than an authorization by the caller, so nothing here is a self-report that lowers scrutiny — the authority is the human's `gate.opened`, and this record can only ADD to what a reviewer sees. Summary and payload hash, never the raw command: §11.1 invariant 3 has no exception for a bypass, and the payload store already holds the bytes for every record that binds to them.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "gate.bypassed"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^(human|agent):"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "opened_seq",
+              "tool",
+              "summary",
+              "classes",
+              "payload_hash"
+            ],
+            "properties": {
+              "opened_seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `seq` of the `gate.opened` under which this call was allowed, so every bypassed call is attributable to one human's ceremony."
+              },
+              "tool": {
+                "type": "string",
+                "minLength": 1,
+                "description": "The harness tool the call came through (`Bash`, `Edit`, `Write`)."
+              },
+              "summary": {
+                "type": "string",
+                "maxLength": 160,
+                "description": "The one-line headline, capped at the hook's own `SUMMARY_LIMIT`. A headline and only that: what the bytes were is `payload_hash`."
+              },
+              "classes": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "description": "The classes the command resolved to. The window suspends the POLICY, so the classification still happens and is still recorded: a reviewer reads what would have needed approval."
+              },
+              "payload_hash": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$",
+                "description": "The `payload_hash` of the binding bytes, computed exactly as the gated path computes it."
+              },
+              "session_id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "tool_use_id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "cwd": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §9 (amended, APRV-220): a human's signature over the chain head at a moment. The chain is unkeyed, so a party with write access to `events.jsonl` can truncate it and recompute a chain that walks clean from genesis (the boundary the conformance suite states as `chain-verification/truncation-unanchored`); what that party cannot do is reproduce a signature over the hashes they replaced. The actor MUST be `^human:`, in the schema as well as in `core/checkpoint.ts`, for the reason `gate.opened` carries the same rule: an agent able to author a checkpoint could vouch for a chain it had just written. `key_sha256` is a HINT and never the authority — a verifier looks the public key up in the policy's `audit.checkpoint_keys`, so a record naming a key nobody lists is a refusal and not a self-signed pass (§11.1: self-reported fields never reduce scrutiny). Gate-typed, so `ts` is stamped at the write boundary and never accepted from the caller: the whole content of this record is a claim about a moment.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "log.checkpoint"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "seq",
+              "hash",
+              "alg",
+              "key_sha256",
+              "signature"
+            ],
+            "properties": {
+              "seq": {
+                "type": "integer",
+                "minimum": 1,
+                "description": "The `seq` of the record whose hash was signed. That it is below this record's own seq, and that the log carries this hash there, are the runtime's checks; a schema sees one record and can only constrain the shape."
+              },
+              "hash": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$",
+                "description": "The chain hash at that seq, as the signer read it. A chain recomputed after this record was written cannot produce a signature over this value, which is the whole of what a checkpoint proves."
+              },
+              "alg": {
+                "type": "string",
+                "enum": [
+                  "ed25519"
+                ],
+                "description": "The signature scheme. One value at v0.1, and an enum rather than a free string so that a second scheme is an explicit schema change and never a value a signer invents."
+              },
+              "key_sha256": {
+                "type": "string",
+                "pattern": "^[0-9a-f]{64}$",
+                "description": "SHA-256 of the signing key's DER SPKI bytes, hex. A pointer, not a credential and not an authority: the verifier resolves it against `audit.checkpoint_keys` in the attested policy, and a fingerprint naming a key the policy does not list is refused. Recording the fingerprint rather than the key itself is deliberate — a record carrying its own public key invites a reader to verify the signature against it, which any forger could satisfy."
+              },
+              "signature": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^[A-Za-z0-9+/]+={0,2}$",
+                "description": "Base64 Ed25519 signature over `\"approval.md/log-checkpoint/v1\\n\"` followed by the RFC 8785 canonicalization of `{alg, hash, seq}`. Domain-separated, so a signature made here cannot be lifted into another use of the same key and one made elsewhere cannot be presented as a checkpoint."
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "$comment": "SPEC.md §5.2/§8 (amended, APRV-272): a human's sign-off on the exact bytes of one of the gate's ORGANS — the harness files that install the hook (`.claude/settings*`, `.cursor/hooks.json`, `.cursor/hooks/`, `.cursor/agents/`). Those paths classify `policy.core`, which is human-only, so the gate mints no grant for them and no grant-shaped evidence for a hand edit to one can exist; content attestation is the only evidence there is. The actor MUST be `^human:`, in the schema as well as in `core/attest.ts`, for the reason `gate.opened` carries the same rule: an agent able to attest an organ could vouch for its own way out of the gate. This is NOT a policy attestation and no reader of one sees it: the policy attestation is `policy.updated`, every reader selects on that type, and the two must never be confused. Both payload fields are computed by the runtime — the digest from the file's bytes, the path normalized — and the caller supplies neither. Gate-typed (`gate.` prefix), so `ts` is stamped at the write boundary.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "event": {
+            "const": "gate.organ.attested"
+          }
+        },
+        "required": [
+          "event"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "required": [
+          "actor",
+          "payload"
+        ],
+        "properties": {
+          "actor": {
+            "type": "string",
+            "pattern": "^human:"
+          },
+          "payload": {
+            "type": "object",
+            "required": [
+              "organ_path",
+              "sha256"
+            ],
+            "properties": {
+              "organ_path": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 512,
+                "pattern": "^[^/\\\\][^\\\\]*$",
+                "description": "The organ's REPOSITORY-RELATIVE, `/`-separated path, for example `.claude/settings.json`. Relative and never absolute, because a permanent record must not leak the writer's home directory and must name the same file on the machine that later reads it. The whole path and not a basename, unlike `policy.updated`'s `policy_path`: there are several organs in several directories, and the guard's rule is that a digest attested for one path is not evidence for another. That the path actually classifies `policy.core` is the runtime's check (`core/attest.ts`), as is the refusal of `..`; a schema sees one record and constrains the shape."
+              },
+              "sha256": {
+                "type": "string",
+                "pattern": "^[a-f0-9]{64}$",
+                "description": "SHA-256 (lowercase hex) of the organ file's exact bytes, computed by the runtime. Bytes, not text: no encoding round-trip and no normalization, so a file differing by trailing whitespace is a different file. The caller has no parameter for this value — one who could supply it could attest bytes nobody read."
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}