codex-workflow-v2 2.0.0-alpha.3 → 2.0.0-alpha.6

package/references/validation-and-review.md

@@ -1,18 +1,45 @@
 # Validation and Review
 
-Configured Step checks must pass before the Step commit is recorded. Submission produces
+The Worker leaves Step changes uncommitted. `task step-complete` runs the configured checks,
+creates the atomic Step commit, and records its evidence. Manual Worker commits are rejected
+as unrecorded history. Submission produces
 evidence for the exact task-branch head. Independent review is read-only and produces a
 version-bound result. Any later commit or change to Brief, Plan, or evidence makes that
 review stale. The user grants final acceptance only after a passing fresh review and a
 human-readable Result.
 
+High-risk evidence is failure-oriented. Migration acceptance includes a populated forward
+upgrade, concurrent state includes deterministic races, restart/replay claims include crash
+windows, and provider integrations include failure injection plus hidden-default checks.
+Happy-path green tests do not replace this evidence.
+
+After two failed independent reviews, another corrective Plan requires a distinct Auditor.
+The Auditor covers every latest finding and records `continue-fix`, `replan-required`,
+`split-required`, or `stop-escalate`. Only `continue-fix` may be passed to `task plan-set`
+through `--corrective-audit-file`; the other decisions stop implementation.
+
 The strict path is `task review-launch`. It starts an ephemeral Codex process with user
 configuration and rules ignored, a read-only sandbox, structured output, and an attempted
 write probe. The core seals repository HEAD, status, and content before/after the process.
 Any process error, malformed output, successful write, or changed seal records an
 `unverified` review and blocks Result creation and final acceptance.
 
+Alpha.6 adds a Step-level strict path for high-risk work. If the current Plan Risk Audit marks
+the completed Step for strict review, `next` routes to `task step-review` instead of
+advancing ordinary execution. The workflow validates:
+
+- the exact completion commit
+- the current Plan hash
+- the Step definition hash
+- the review sidecar chain in `step-review-events.jsonl`
+- the reviewer attestation chain in `reviewer-attestations.jsonl`
+
+Any stale, malformed, unverified, or wrong-commit evidence fails closed and keeps the Step out
+of canonical `completed` status.
+
 Milestone validation similarly binds Result and evidence to the clean base HEAD. Its final
 acceptance is a separate turn: `next` emits a confirmation code bound to the current
 revision, Plan, Result, evidence, and HEAD; the coordinator shows it and stops. A later user
 response must explicitly approve that exact code before the CLI transition is invoked.
+With a matching delegated option, the exact delegate may use the current code in the same
+turn, but the authorization event must keep the delegate actor and principal/grant evidence.

package/roles/delivery-coordinator.md

@@ -14,4 +14,15 @@ Own state transitions, dispatch envelopes, evidence collection, and recovery gui
 - Accept a Milestone only after a later user message explicitly approves that exact
   confirmation code. Do not infer approval from a request to validate, finish, or continue.
 - Dispatch one Worker at a time for a concrete Step.
+- A Milestone coordinator creates one dedicated user-visible Codex Task chat for each required
+  Task. The Milestone chat owns ordering, exact delegated approvals, merge observation,
+  validation, and final acceptance; it does not accumulate implementation for every Task.
+- Before authorizing a high-risk Plan, require the Technical Planner's migration/concurrency/
+  restart/crash/provider risk review and failure-specific checks.
+- After a second failed independent Task review, require a separate corrective Plan Auditor
+  and pass its evidence through `--corrective-audit-file`. Continue only for
+  `decision=continue-fix`; replan/split/stop decisions return to the coordinator or user.
+- Use `task context-refresh` only when `next.contextRefresh` offers the exact delegated,
+  content-only option. Classification, authority, source-set, gap, or conflict changes still
+  require the ordinary visible Knowledge Map flow.
 - Do not make product-scope decisions or implement production changes.

package/roles/independent-reviewer.md

@@ -7,4 +7,7 @@ Compare requirements, acceptance, Plan, task-branch diff, checks, and generated
 - Operate read-only and do not fix findings.
 - Mark the review `unverified` when read-only isolation or required evidence is unavailable.
 - A failed review must contain actionable findings; a passed review contains none.
+- For migrations, concurrency, restart/replay, crash recovery, and external providers, reject
+  green happy-path evidence that omits populated upgrades, deterministic races, restart/crash
+  windows, or provider failure/default behavior required by the approved Plan.
 - Do not grant final acceptance on behalf of the user.

package/roles/technical-planner.md

@@ -6,5 +6,12 @@ Translate an approved Brief into an execution-ready Plan.
 - Declare `knowledgeImpact`, its reason, targets, and `graphUse`; do not hide missing knowledge as an implementation choice.
 - Every requirement must be covered by at least one `STEP-*`.
 - Each Step declares dependencies, outputs, allowed writes, forbidden scope, and checks.
+- Perform a risk review before `plan-set`. A Plan that touches migrations, concurrent state,
+  restart/replay, crash recovery, or an external provider must include failure-specific checks
+  in the original Steps: populated forward upgrades, deterministic races, restart/crash
+  windows, and provider failure/default behavior as applicable.
+- Split a Task when one acceptance slice would otherwise combine persistence migration,
+  recovery orchestration, and executable composition. Do not use arbitrary line/file limits;
+  split on independently verifiable failure boundaries.
 - Do not edit production files or silently expand the Brief.
 - Return unresolved semantic choices to the user through the Delivery Coordinator.

package/roles/worker.md

@@ -7,4 +7,8 @@ Implement exactly one dispatched Step under its context envelope.
 - Read only declared inputs and repository context needed for the Step.
 - Write only `allowedWrites`; stop on required scope expansion.
 - Run the declared checks and report limitations honestly.
+- Leave all Step changes uncommitted. Do not run `git add`, `git commit`, `git amend`,
+  reset, rebase, or another Git-history mutation. The coordinator invokes
+  `task step-complete`; Workflow core then runs the configured checks, creates the atomic
+  Step commit, and records its evidence.
 - Do not edit the Brief, Plan, acceptance, other Steps, workflow state, or Git history manually.

package/schemas/adoption-posture-event.schema.json

@@ -0,0 +1,129 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/adoption-posture-event.schema.json",
+  "title": "Codex Workflow V2 Alpha.6 Adoption Posture Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId",
+    "projectId",
+    "eventType",
+    "actor",
+    "packageVersion",
+    "protocolVersion",
+    "stateSchemaVersion",
+    "adoptionBoundaryAt",
+    "baselineDigestHash",
+    "sidecarBaselineHash",
+    "confirmationCodeBindingHash",
+    "repositoryIdentity",
+    "terminalMilestones",
+    "terminalTasks",
+    "activeTasks",
+    "previousEventHash",
+    "recordedAt",
+    "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "minLength": 1 },
+    "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
+    "eventType": { "enum": ["project-registration", "adoption-apply"] },
+    "actor": { "type": ["string", "null"], "minLength": 1 },
+    "packageVersion": { "type": "string", "minLength": 1 },
+    "protocolVersion": { "const": 1 },
+    "stateSchemaVersion": { "const": 2 },
+    "adoptionBoundaryAt": { "type": "string", "format": "date-time" },
+    "baselineDigestHash": { "$ref": "#/$defs/hash64" },
+    "sidecarBaselineHash": { "$ref": "#/$defs/hash64" },
+    "confirmationCodeBindingHash": { "$ref": "#/$defs/nullableHash64" },
+    "repositoryIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repositoryRoot", "gitCommonDir"],
+      "properties": {
+        "repositoryRoot": { "type": "string", "minLength": 1 },
+        "gitCommonDir": { "type": "string", "minLength": 1 }
+      }
+    },
+    "terminalMilestones": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["milestoneId", "revision", "status"],
+        "properties": {
+          "milestoneId": { "$ref": "#/$defs/milestoneId" },
+          "revision": { "type": "integer", "minimum": 1 },
+          "status": { "enum": ["accepted", "cancelled"] }
+        }
+      }
+    },
+    "terminalTasks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["taskId", "revision", "status"],
+        "properties": {
+          "taskId": { "$ref": "#/$defs/taskId" },
+          "revision": { "type": "integer", "minimum": 1 },
+          "status": { "enum": ["merged", "cancelled"] }
+        }
+      }
+    },
+    "activeTasks": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["taskId", "taskRevision", "status", "completedSteps", "remainingStepIds"],
+        "properties": {
+          "taskId": { "$ref": "#/$defs/taskId" },
+          "taskRevision": { "type": "integer", "minimum": 1 },
+          "status": {
+            "enum": [
+              "planning",
+              "awaiting_execution_authorization",
+              "ready",
+              "in_progress",
+              "validating",
+              "needs_fix",
+              "awaiting_final_acceptance",
+              "merging",
+              "ready_to_merge",
+              "blocked"
+            ]
+          },
+          "completedSteps": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["stepId", "status", "evidenceHash"],
+              "properties": {
+                "stepId": { "$ref": "#/$defs/stepId" },
+                "status": { "enum": ["completed", "skipped"] },
+                "evidenceHash": { "$ref": "#/$defs/nullableHash64" }
+              }
+            }
+          },
+          "remainingStepIds": {
+            "type": "array",
+            "uniqueItems": true,
+            "items": { "$ref": "#/$defs/stepId" }
+          }
+        }
+      }
+    },
+    "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "milestoneId": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nullableHash64": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/schemas/authorization-event.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/authorization-event.schema.json",
+  "title": "Codex Workflow V2 Authorization Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind", "decision", "actor", "recordedAt", "briefHash", "planHash", "resultHash",
+    "evidenceHash", "headCommit", "reason"
+  ],
+  "properties": {
+    "kind": { "enum": ["execution", "final_acceptance", "exception"] },
+    "decision": { "enum": ["approved", "rejected", "waived", "superseded"] },
+    "actor": { "type": "string", "minLength": 1 },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "briefHash": { "$ref": "#/$defs/nullableHash" },
+    "planHash": { "$ref": "#/$defs/nullableHash" },
+    "resultHash": { "$ref": "#/$defs/nullableHash" },
+    "evidenceHash": { "$ref": "#/$defs/nullableHash" },
+    "headCommit": { "$ref": "#/$defs/nullableHash" },
+    "reason": { "type": "string" },
+    "authorizationMode": { "enum": ["human", "delegated"] },
+    "delegation": { "$ref": "#/$defs/delegation" }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": { "authorizationMode": { "const": "delegated" } },
+        "required": ["authorizationMode"]
+      },
+      "then": { "required": ["delegation"] }
+    }
+  ],
+  "$defs": {
+    "nullableHash": { "type": ["string", "null"], "pattern": "^[a-f0-9]{40,64}$" },
+    "delegation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["grantId", "policyHash", "principal", "delegate", "transition"],
+      "properties": {
+        "grantId": { "type": "string", "pattern": "^DGR-[0-9A-HJKMNP-TV-Z]{26}$" },
+        "policyHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "principal": { "type": "string", "minLength": 1 },
+        "delegate": { "type": "string", "minLength": 1 },
+        "transition": {
+          "enum": [
+            "project_memory.approve",
+            "task.execution_authorize", "task.final_accept",
+            "milestone.execution_authorize", "milestone.final_accept"
+          ]
+        }
+      }
+    }
+  }
+}

package/schemas/corrective-decision-event.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/corrective-decision-event.schema.json",
+  "title": "Codex Workflow V2 Alpha.6 Corrective Decision Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId",
+    "taskId",
+    "stepId",
+    "triggeringAttemptCount",
+    "decision",
+    "auditor",
+    "coveredFindingIds",
+    "coveredEventIds",
+    "planHash",
+    "previousEventHash",
+    "recordedAt",
+    "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "minLength": 1 },
+    "taskId": { "$ref": "#/$defs/taskId" },
+    "stepId": { "$ref": "#/$defs/stepId" },
+    "triggeringAttemptCount": { "type": "integer", "minimum": 3 },
+    "decision": {
+      "enum": ["continue-fix", "replan-required", "split-required", "stop-escalate"]
+    },
+    "auditor": { "type": "string", "minLength": 1 },
+    "coveredFindingIds": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "coveredEventIds": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "planHash": { "$ref": "#/$defs/hash64" },
+    "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "anyOf": [
+    { "properties": { "coveredFindingIds": { "minItems": 1 } } },
+    { "properties": { "coveredEventIds": { "minItems": 1 } } }
+  ],
+  "$defs": {
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "stepId": { "type": "string", "pattern": "^STEP-[0-9]{3}(?:-[A-Z0-9-]+)?$" },
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nullableHash64": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" }
+  }
+}

package/schemas/corrective-plan-audit.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/corrective-plan-audit.schema.json",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["auditor", "summary", "decision", "reviewedFindingIds"],
+  "properties": {
+    "auditor": { "type": "string", "minLength": 1 },
+    "summary": { "type": "string", "minLength": 1 },
+    "decision": {
+      "enum": ["continue-fix", "replan-required", "split-required", "stop-escalate"]
+    },
+    "reviewedFindingIds": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    }
+  }
+}

package/schemas/delegation-grant.schema.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/delegation-grant.schema.json",
+  "title": "Codex Workflow V2 Delegation Grant",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion", "revision", "id", "projectId", "createdAt", "updatedAt", "kind",
+    "status", "principal", "delegate", "scope", "transitions", "expiresAt", "policyHash",
+    "revokedAt", "revokedBy", "revokeReason"
+  ],
+  "properties": {
+    "schemaVersion": { "const": 2 },
+    "revision": { "type": "integer", "minimum": 1 },
+    "id": { "type": "string", "pattern": "^DGR-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "projectId": { "type": "string", "pattern": "^[a-f0-9]{24}$" },
+    "createdAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" },
+    "kind": { "const": "delegation-grant" },
+    "status": { "enum": ["active", "revoked"] },
+    "principal": { "type": "string", "minLength": 1 },
+    "delegate": { "type": "string", "minLength": 1 },
+    "scope": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind"],
+          "properties": { "kind": { "const": "project" } }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "id"],
+          "properties": {
+            "kind": { "const": "milestone" },
+            "id": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "id"],
+          "properties": {
+            "kind": { "const": "task" },
+            "id": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" }
+          }
+        }
+      ]
+    },
+    "transitions": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "enum": [
+          "project_memory.approve",
+          "task.execution_authorize", "task.final_accept",
+          "milestone.execution_authorize", "milestone.final_accept"
+        ]
+      }
+    },
+    "expiresAt": { "type": "string", "format": "date-time" },
+    "policyHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "revokedAt": { "type": ["string", "null"], "format": "date-time" },
+    "revokedBy": { "type": ["string", "null"] },
+    "revokeReason": { "type": ["string", "null"] }
+  }
+}

package/schemas/milestone-scope-change-event.schema.json

@@ -0,0 +1,68 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/milestone-scope-change-event.schema.json",
+  "title": "Codex Workflow V2 Alpha.6 Milestone Scope Change Event",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "eventId",
+    "milestoneId",
+    "previousMilestoneRevision",
+    "previousPlanHash",
+    "previousMembershipRevision",
+    "candidatePlanHash",
+    "candidateMembershipRevision",
+    "before",
+    "after",
+    "actor",
+    "confirmationCodeBindingHash",
+    "previousEventHash",
+    "recordedAt",
+    "eventHash"
+  ],
+  "properties": {
+    "eventId": { "type": "string", "minLength": 1 },
+    "milestoneId": { "$ref": "#/$defs/milestoneId" },
+    "previousMilestoneRevision": { "type": "integer", "minimum": 1 },
+    "previousPlanHash": { "$ref": "#/$defs/nullableHash64" },
+    "previousMembershipRevision": { "type": "integer", "minimum": 0 },
+    "candidatePlanHash": { "$ref": "#/$defs/hash64" },
+    "candidateMembershipRevision": { "type": "integer", "minimum": 0 },
+    "before": { "$ref": "#/$defs/scopeSnapshot" },
+    "after": { "$ref": "#/$defs/scopeSnapshot" },
+    "actor": { "type": "string", "minLength": 1 },
+    "confirmationCodeBindingHash": { "$ref": "#/$defs/hash64" },
+    "previousEventHash": { "$ref": "#/$defs/nullableHash64" },
+    "recordedAt": { "type": "string", "format": "date-time" },
+    "eventHash": { "$ref": "#/$defs/hash64" }
+  },
+  "$defs": {
+    "milestoneId": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "taskId": { "type": "string", "pattern": "^TASK-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nullableHash64": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" },
+    "membership": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["taskId", "disposition", "reason"],
+      "properties": {
+        "taskId": { "$ref": "#/$defs/taskId" },
+        "disposition": { "enum": ["required", "waived", "cancelled"] },
+        "reason": { "type": "string" }
+      }
+    },
+    "scopeSnapshot": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["outcome", "successSignal", "acceptance", "checks", "taskIds", "memberships"],
+      "properties": {
+        "outcome": { "type": "string" },
+        "successSignal": { "type": "string" },
+        "acceptance": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "checks": { "type": "array", "items": { "type": "string", "minLength": 1 } },
+        "taskIds": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/taskId" } },
+        "memberships": { "type": "array", "items": { "$ref": "#/$defs/membership" } }
+      }
+    }
+  }
+}

package/schemas/milestone-transaction-journal.schema.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://codex-workflow.local/schemas/milestone-transaction-journal.schema.json",
+  "title": "Codex Workflow V2 Alpha.6 Milestone Transaction Journal",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "transactionId",
+    "milestoneId",
+    "expectedMilestoneRevision",
+    "actor",
+    "confirmationCodeBindingHash",
+    "phase",
+    "targetFiles",
+    "preparedAt",
+    "updatedAt"
+  ],
+  "properties": {
+    "transactionId": { "type": "string", "minLength": 1 },
+    "milestoneId": { "$ref": "#/$defs/milestoneId" },
+    "expectedMilestoneRevision": { "type": "integer", "minimum": 1 },
+    "actor": { "type": "string", "minLength": 1 },
+    "confirmationCodeBindingHash": { "$ref": "#/$defs/hash64" },
+    "phase": { "enum": ["prepared", "applying", "applied", "rolled_back"] },
+    "targetFiles": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "preimage", "staged"],
+        "properties": {
+          "path": { "type": "string", "minLength": 1 },
+          "preimage": { "$ref": "#/$defs/fileSnapshot" },
+          "staged": { "$ref": "#/$defs/fileSnapshot" }
+        }
+      }
+    },
+    "preparedAt": { "type": "string", "format": "date-time" },
+    "updatedAt": { "type": "string", "format": "date-time" }
+  },
+  "$defs": {
+    "milestoneId": { "type": "string", "pattern": "^MS-[0-9A-HJKMNP-TV-Z]{26}$" },
+    "hash64": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "fileSnapshot": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["exists", "contentHash", "contentBase64", "contentPath"],
+      "properties": {
+        "exists": { "type": "boolean" },
+        "contentHash": { "type": ["string", "null"], "pattern": "^[a-f0-9]{64}$" },
+        "contentBase64": { "type": ["string", "null"], "minLength": 1 },
+        "contentPath": { "type": ["string", "null"], "minLength": 1 }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "exists": { "const": true } },
+            "required": ["exists"]
+          },
+          "then": {
+            "properties": {
+              "contentHash": { "$ref": "#/$defs/hash64" }
+            },
+            "anyOf": [
+              {
+                "properties": {
+                  "contentBase64": { "type": "string", "minLength": 1 }
+                }
+              },
+              {
+                "properties": {
+                  "contentPath": { "type": "string", "minLength": 1 }
+                }
+              }
+            ]
+          }
+        },
+        {
+          "if": {
+            "properties": { "exists": { "const": false } },
+            "required": ["exists"]
+          },
+          "then": {
+            "properties": {
+              "contentHash": { "const": null },
+              "contentBase64": { "const": null },
+              "contentPath": { "const": null }
+            }
+          }
+        }
+      ]
+    }
+  }
+}