full-reverse 0.0.0-stage → 1.0.0

package/skills/full-reverse/schemas/claims.schema.json

@@ -0,0 +1,123 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://full-reverse.local/schemas/claims.schema.json",
+  "title": "Full Reverse claims (claims.json)",
+  "description": "Written only by the model specialist. Each claim links statements to immutable evidence by file digest, evidence ID and RFC 6901 selectors. The validator checks state/basis/coverage consistency and resolves selectors against saved evidence; it does not judge whether evidence supports the statement.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "investigation_id", "created_at", "inputs", "claims"],
+  "properties": {
+    "schema_version": { "const": "full-reverse.claims/1" },
+    "investigation_id": { "$ref": "common.schema.json#/$defs/investigationId" },
+    "created_at": { "$ref": "common.schema.json#/$defs/timestamp" },
+    "inputs": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["inventory", "evidence_index"],
+      "properties": {
+        "inventory": { "oneOf": [{ "$ref": "common.schema.json#/$defs/fileDigest" }, { "type": "null" }] },
+        "evidence_index": { "$ref": "common.schema.json#/$defs/fileDigest" }
+      }
+    },
+    "claims": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "claim_id", "statement", "state", "basis", "polarity", "question_ids", "build_id",
+          "comparison_build_ids", "context", "evidence", "locations", "coverage", "limitations",
+          "contradicts", "derivation", "inference", "unavailable_reason", "user_statement"
+        ],
+        "properties": {
+          "claim_id": { "$ref": "common.schema.json#/$defs/claimId" },
+          "statement": { "$ref": "common.schema.json#/$defs/nonEmptyString" },
+          "state": { "enum": ["observed", "derived", "inferred", "unknown", "unavailable"] },
+          "basis": { "enum": ["static", "runtime", "recorded", "external", "user-statement"] },
+          "polarity": { "enum": ["presence", "absence"] },
+          "question_ids": { "type": "array", "minItems": 1, "items": { "$ref": "common.schema.json#/$defs/questionId" } },
+          "build_id": { "$ref": "common.schema.json#/$defs/buildId" },
+          "comparison_build_ids": {
+            "type": "array",
+            "items": { "$ref": "common.schema.json#/$defs/buildId" },
+            "description": "Additional builds this claim compares. Empty for single-build claims; evidence from any other build is a cross-target citation and fails."
+          },
+          "context": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["question", "bounds"],
+            "properties": {
+              "question": { "$ref": "common.schema.json#/$defs/nonEmptyString" },
+              "bounds": { "$ref": "common.schema.json#/$defs/nonEmptyString", "description": "The explicit scope the statement addresses (build, component, scenario, collection)." }
+            }
+          },
+          "evidence": { "type": "array", "items": { "$ref": "common.schema.json#/$defs/evidenceRef" } },
+          "locations": { "type": "array", "items": { "$ref": "common.schema.json#/$defs/location" } },
+          "coverage": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["status", "scope", "evidence"],
+            "properties": {
+              "status": { "enum": ["complete", "partial", "unknown", "unavailable"] },
+              "scope": { "type": "string", "description": "Exact scope the coverage status applies to. Page exhaustion is not source completeness." },
+              "evidence": {
+                "type": "array",
+                "items": { "$ref": "common.schema.json#/$defs/evidenceRef" },
+                "description": "Evidence refs with selectors (role coverage) that expose the completeness fields of the saved record."
+              }
+            }
+          },
+          "limitations": { "type": "array", "items": { "type": "string" } },
+          "contradicts": {
+            "type": "array",
+            "items": { "$ref": "common.schema.json#/$defs/claimId" }
+          },
+          "derivation": {
+            "oneOf": [
+              { "type": "null" },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["input_claim_ids", "input_evidence", "procedure"],
+                "properties": {
+                  "input_claim_ids": { "type": "array", "items": { "$ref": "common.schema.json#/$defs/claimId" } },
+                  "input_evidence": { "type": "array", "items": { "$ref": "common.schema.json#/$defs/evidenceRef" } },
+                  "procedure": { "$ref": "common.schema.json#/$defs/nonEmptyString", "description": "Reproducible derivation steps." }
+                }
+              }
+            ]
+          },
+          "inference": {
+            "oneOf": [
+              { "type": "null" },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["rationale", "uncertainty"],
+                "properties": {
+                  "rationale": { "$ref": "common.schema.json#/$defs/nonEmptyString" },
+                  "uncertainty": { "$ref": "common.schema.json#/$defs/nonEmptyString" }
+                }
+              }
+            ]
+          },
+          "unavailable_reason": { "type": ["string", "null"] },
+          "user_statement": {
+            "oneOf": [
+              { "type": "null" },
+              {
+                "type": "object",
+                "additionalProperties": false,
+                "required": ["conversation_ref", "recorded_at"],
+                "properties": {
+                  "conversation_ref": { "type": ["string", "null"] },
+                  "recorded_at": { "$ref": "common.schema.json#/$defs/timestamp" }
+                }
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}

package/skills/full-reverse/schemas/common.schema.json

@@ -0,0 +1,305 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://full-reverse.local/schemas/common.schema.json",
+  "title": "Full Reverse shared definitions",
+  "description": "Identifiers, digests, evidence references, selectors, locations and build identities shared by every Full Reverse schema.",
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "timestamp": {
+      "type": "string",
+      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$"
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^(?!/)(?![A-Za-z]:)[^\\\\\\u0000]+$"
+    },
+    "nonEmptyString": { "type": "string", "minLength": 1 },
+    "investigationId": { "type": "string", "pattern": "^inv_[a-z0-9][a-z0-9_-]{2,62}$" },
+    "buildId": { "type": "string", "pattern": "^bld_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "questionId": { "type": "string", "pattern": "^q_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "claimId": { "type": "string", "pattern": "^clm_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "stepId": { "type": "string", "pattern": "^step_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "grantId": { "type": "string", "pattern": "^auth_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "findingId": { "type": "string", "pattern": "^fnd_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "scenarioId": { "type": "string", "pattern": "^scn_[a-z0-9][a-z0-9_-]{0,62}$" },
+    "entryId": { "type": "string", "pattern": "^ei_[0-9a-f]{16}$" },
+    "evidenceId": { "type": "string", "pattern": "^ev_[0-9a-f]{64}$" },
+    "externalId": { "type": "string", "pattern": "^ext_[0-9a-f]{64}$" },
+    "jsonPointer": {
+      "type": "string",
+      "pattern": "^(/([^~/]|~[01])*)*$"
+    },
+    "fileDigest": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": { "$ref": "#/$defs/relativePath" },
+        "sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "jsonPointerSelector": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["type", "pointer", "role"],
+      "properties": {
+        "type": { "const": "json-pointer" },
+        "pointer": {
+          "$ref": "#/$defs/jsonPointer",
+          "description": "RFC 6901 pointer relative to the cited evidence record root (not the bundle root)."
+        },
+        "role": {
+          "enum": ["identity", "address", "path", "collection", "value", "count", "line-count", "event", "coverage", "other"]
+        },
+        "expect": {
+          "description": "Assertion about the value at pointer. equals: exact JSON value; exists: pointer must resolve; sha256: SHA-256 hex of REA canonical JSON of the value (keys sorted by UTF-16 code unit, ECMAScript JSON.stringify scalars, no whitespace; values must be finite and safe).",
+          "oneOf": [
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["equals"],
+              "properties": { "equals": {} }
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["exists"],
+              "properties": { "exists": { "const": true } }
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["sha256"],
+              "properties": { "sha256": { "$ref": "#/$defs/sha256" } }
+            }
+          ]
+        },
+        "note": { "type": "string" }
+      }
+    },
+    "externalSelector": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "start", "end"],
+          "properties": {
+            "type": { "const": "line-range" },
+            "start": { "type": "integer", "minimum": 1 },
+            "end": { "type": "integer", "minimum": 1 },
+            "note": { "type": "string" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "start", "end"],
+          "properties": {
+            "type": { "const": "byte-range" },
+            "start": { "type": "integer", "minimum": 0 },
+            "end": { "type": "integer", "minimum": 0, "description": "Exclusive end offset." },
+            "note": { "type": "string" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "x", "y", "width", "height"],
+          "properties": {
+            "type": { "const": "image-region" },
+            "x": { "type": "integer", "minimum": 0 },
+            "y": { "type": "integer", "minimum": 0 },
+            "width": { "type": "integer", "minimum": 1 },
+            "height": { "type": "integer", "minimum": 1 },
+            "note": { "type": "string" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "ordinal"],
+          "properties": {
+            "type": { "const": "event-ordinal" },
+            "ordinal": { "type": "integer", "minimum": 0, "description": "Zero-based event index in a JSONL/NDJSON file or top-level JSON array." },
+            "note": { "type": "string" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type", "start_ms", "end_ms"],
+          "properties": {
+            "type": { "const": "time-range" },
+            "start_ms": { "type": "number", "minimum": 0 },
+            "end_ms": { "type": "number", "minimum": 0 },
+            "note": { "type": "string" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["type"],
+          "properties": {
+            "type": { "const": "whole-file" },
+            "note": { "type": "string" }
+          }
+        }
+      ]
+    },
+    "canonicalRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "file", "sha256", "evidence_id"],
+      "properties": {
+        "kind": { "const": "canonical" },
+        "file": { "$ref": "#/$defs/relativePath" },
+        "sha256": { "$ref": "#/$defs/sha256", "description": "SHA-256 of the immutable evidence file." },
+        "evidence_id": { "$ref": "#/$defs/evidenceId" },
+        "selectors": { "type": "array", "items": { "$ref": "#/$defs/jsonPointerSelector" } }
+      }
+    },
+    "externalRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "file", "sha256", "ext_id"],
+      "properties": {
+        "kind": { "const": "external" },
+        "file": { "$ref": "#/$defs/relativePath" },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "ext_id": { "$ref": "#/$defs/externalId" },
+        "selectors": { "type": "array", "items": { "$ref": "#/$defs/externalSelector" } }
+      }
+    },
+    "evidenceRef": {
+      "oneOf": [{ "$ref": "#/$defs/canonicalRef" }, { "$ref": "#/$defs/externalRef" }]
+    },
+    "buildIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["method", "sha256", "bytes", "coverage", "rea_format", "note"],
+      "properties": {
+        "method": {
+          "enum": ["file-sha256", "rea-subject-digest", "archive-member"],
+          "description": "file-sha256: full streamed SHA-256 of one file. rea-subject-digest: the subject.digest.sha256 REA reported for a directory/bundle/app (with declared coverage). archive-member: SHA-256 of a member extracted from the parent build."
+        },
+        "sha256": { "$ref": "#/$defs/sha256" },
+        "bytes": { "type": ["integer", "null"], "minimum": 0 },
+        "coverage": {
+          "enum": ["complete", "partial", "unknown"],
+          "description": "Coverage of the identity. A partial or unknown manifest is never a whole-directory fingerprint."
+        },
+        "rea_format": { "type": ["string", "null"] },
+        "note": { "type": "string" }
+      }
+    },
+    "build": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["build_id", "kind", "name", "identity", "parent_build_id"],
+      "properties": {
+        "build_id": { "$ref": "#/$defs/buildId" },
+        "kind": { "enum": ["file", "directory", "bundle", "archive", "member"] },
+        "name": { "$ref": "#/$defs/nonEmptyString" },
+        "version_label": { "type": "string" },
+        "identity": { "$ref": "#/$defs/buildIdentity" },
+        "local_path": {
+          "type": ["string", "null"],
+          "description": "Absolute path of the target at identification time, used only to re-check identity on resume. Not proof of identity."
+        },
+        "parent_build_id": { "oneOf": [{ "$ref": "#/$defs/buildId" }, { "type": "null" }] }
+      }
+    },
+    "location": {
+      "type": "object",
+      "required": ["kind", "evidence"],
+      "properties": {
+        "kind": { "enum": ["artifact-member", "source-range", "native-procedure", "resource-node", "runtime-event"] },
+        "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+      },
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "member_path", "evidence"],
+          "properties": {
+            "kind": { "const": "artifact-member" },
+            "member_path": { "$ref": "#/$defs/nonEmptyString" },
+            "container_sha256": { "$ref": "#/$defs/sha256" },
+            "member_sha256": { "$ref": "#/$defs/sha256" },
+            "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "path", "start_line", "end_line", "origin", "evidence"],
+          "properties": {
+            "kind": { "const": "source-range" },
+            "path": { "$ref": "#/$defs/nonEmptyString" },
+            "start_line": { "type": "integer", "minimum": 1 },
+            "end_line": { "type": "integer", "minimum": 1 },
+            "origin": { "const": "recovered", "description": "Lines of recovered/decompiled/unpacked text, never original-source lines." },
+            "member_sha256": { "$ref": "#/$defs/sha256" },
+            "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "target_sha256", "provider", "address_space", "address", "evidence"],
+          "properties": {
+            "kind": { "const": "native-procedure" },
+            "target_sha256": { "$ref": "#/$defs/sha256" },
+            "provider": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["id", "version"],
+              "properties": {
+                "id": { "$ref": "#/$defs/nonEmptyString" },
+                "version": { "type": ["string", "null"] }
+              }
+            },
+            "address_space": {
+              "$ref": "#/$defs/nonEmptyString",
+              "description": "Use provider-reported when the address is exactly what the provider reported and no mapping is claimed. Any other value (for example image or file) must be asserted by a verified role=identity selector, otherwise the validator reports it unverified."
+            },
+            "address": { "$ref": "#/$defs/nonEmptyString" },
+            "procedure": { "type": "string" },
+            "file_offset": { "type": "integer", "minimum": 0 },
+            "mapping": {
+              "type": "string",
+              "description": "Required with file_offset: how the offset maps to the address (observed mapping reported by evidence)."
+            },
+            "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+          },
+          "dependentRequired": { "file_offset": ["mapping"] }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "node_id", "evidence"],
+          "properties": {
+            "kind": { "const": "resource-node" },
+            "node_id": { "$ref": "#/$defs/nonEmptyString" },
+            "member_path": { "type": "string" },
+            "member_sha256": { "$ref": "#/$defs/sha256" },
+            "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "scenario_id", "event_id", "evidence"],
+          "properties": {
+            "kind": { "const": "runtime-event" },
+            "scenario_id": { "$ref": "#/$defs/scenarioId" },
+            "event_id": { "type": ["string", "integer"] },
+            "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidenceRef" } }
+          }
+        }
+      ]
+    }
+  }
+}

package/skills/full-reverse/schemas/evidence-index.schema.json

@@ -0,0 +1,135 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://full-reverse.local/schemas/evidence-index.schema.json",
+  "title": "Full Reverse evidence index (evidence/index.json)",
+  "description": "Sidecar index of immutable evidence files. Written only by the helper (init-workspace, publish-evidence, register-external). Canonical REA records are never modified; custom metadata lives only here. Intrinsic fields are recomputed from the saved file during validation, so labels here are never proof of identity.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "investigation_id", "updated_at", "entries"],
+  "properties": {
+    "schema_version": { "const": "full-reverse.evidence-index/1" },
+    "investigation_id": { "$ref": "common.schema.json#/$defs/investigationId" },
+    "updated_at": { "$ref": "common.schema.json#/$defs/timestamp" },
+    "entries": { "type": "array", "items": { "$ref": "#/$defs/entry" } }
+  },
+  "$defs": {
+    "recordSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["evidence_id", "pointer", "operation", "predicate_type", "confidence", "authority", "binding_digests", "parent_evidence_id"],
+      "properties": {
+        "evidence_id": { "$ref": "common.schema.json#/$defs/evidenceId" },
+        "pointer": { "$ref": "common.schema.json#/$defs/jsonPointer", "description": "Location of the record in the file: empty for a single-record file, /records/N in a bundle." },
+        "operation": { "type": "string" },
+        "predicate_type": { "type": "string" },
+        "confidence": { "enum": ["observed", "derived", "inferred"] },
+        "authority": { "type": "string" },
+        "binding_digests": { "type": "array", "items": { "$ref": "common.schema.json#/$defs/sha256" } },
+        "parent_evidence_id": { "oneOf": [{ "$ref": "common.schema.json#/$defs/evidenceId" }, { "type": "null" }] }
+      }
+    },
+    "entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "entry_id", "kind", "file", "sha256", "bytes", "status", "content_type", "producer", "operation",
+        "predicate_type", "records", "records_truncated", "id_authentication", "invocation", "target",
+        "external", "published_at", "note"
+      ],
+      "properties": {
+        "entry_id": { "$ref": "common.schema.json#/$defs/entryId" },
+        "kind": { "enum": ["canonical-record", "canonical-bundle", "derived-view", "external", "diagnostic", "interrupted-output"] },
+        "file": { "$ref": "common.schema.json#/$defs/relativePath" },
+        "sha256": { "$ref": "common.schema.json#/$defs/sha256" },
+        "bytes": { "type": "integer", "minimum": 0 },
+        "status": { "enum": ["complete", "error", "interrupted"] },
+        "content_type": { "enum": ["rea-record", "rea-bundle", "rea-error", "jsonl", "json", "text", "binary", "empty"] },
+        "producer": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["name", "version", "provider"],
+          "properties": {
+            "name": { "type": ["string", "null"] },
+            "version": { "type": ["string", "null"] },
+            "provider": {
+              "oneOf": [
+                { "type": "null" },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["id", "name", "version"],
+                  "properties": {
+                    "id": { "type": "string" },
+                    "name": { "type": "string" },
+                    "version": { "type": ["string", "null"] }
+                  }
+                }
+              ]
+            }
+          }
+        },
+        "operation": { "type": ["string", "null"] },
+        "predicate_type": { "type": ["string", "null"] },
+        "records": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/recordSummary" },
+          "description": "Records in a canonical file/bundle/view. Empty for external, diagnostic and interrupted entries."
+        },
+        "records_truncated": { "type": "boolean" },
+        "id_authentication": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["status", "reason"],
+          "properties": {
+            "status": { "enum": ["verified", "unverified", "failed", "not-applicable"] },
+            "reason": { "type": ["string", "null"] }
+          },
+          "description": "Result when the helper recomputed every record's semantic evidence_id at publication."
+        },
+        "invocation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["source", "command", "exit_code", "stderr_file", "stderr_sha256", "step_id"],
+          "properties": {
+            "source": { "enum": ["cli", "session", "export", "external", "unknown"] },
+            "command": { "oneOf": [{ "type": "array", "items": { "type": "string" } }, { "type": "null" }] },
+            "exit_code": { "type": ["integer", "null"] },
+            "stderr_file": { "oneOf": [{ "$ref": "common.schema.json#/$defs/relativePath" }, { "type": "null" }] },
+            "stderr_sha256": { "oneOf": [{ "$ref": "common.schema.json#/$defs/sha256" }, { "type": "null" }] },
+            "step_id": { "oneOf": [{ "$ref": "common.schema.json#/$defs/stepId" }, { "type": "null" }] }
+          }
+        },
+        "target": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["association", "build_id", "binding_source", "binding_digests", "identity_state"],
+          "properties": {
+            "association": {
+              "enum": ["intrinsic", "declared", "unbound"],
+              "description": "intrinsic: the saved record itself carries a digest (REA subject, or a process-capture manifest executable digest) and it equals the build identity. declared: build_id was supplied by the analyst because the record carries no digest; corroborated only procedurally. unbound: none."
+            },
+            "build_id": { "oneOf": [{ "$ref": "common.schema.json#/$defs/buildId" }, { "type": "null" }] },
+            "binding_source": {
+              "enum": ["subject", "process-capture-manifest", "none"],
+              "description": "Where the binding digests were read from in the saved record."
+            },
+            "binding_digests": {
+              "type": "array",
+              "items": { "$ref": "common.schema.json#/$defs/sha256" },
+              "description": "Digests extracted intrinsically from every record in the file."
+            },
+            "identity_state": {
+              "type": ["string", "null"],
+              "description": "Executable identity state reported by the producer (for example path_metadata_unchanged); preserved, never strengthened."
+            }
+          }
+        },
+        "external": {
+          "oneOf": [{ "type": "null" }, { "$ref": "external-evidence.schema.json" }]
+        },
+        "published_at": { "$ref": "common.schema.json#/$defs/timestamp" },
+        "note": { "type": "string" }
+      }
+    }
+  }
+}