owlrunkit 0.13.0

package/packages/attest/fixtures/bad/multiple-active-leaves.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [
+    {"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-a", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false},
+    {"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-b", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+  ],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-b", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/orphan-replacement.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-orphan", "status": "passed", "replacesReceiptId": "receipt-missing", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-orphan", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/bad/root-shape-extra-property.json

@@ -0,0 +1,8 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false},
+  "unexpected": true
+}

package/packages/attest/fixtures/bad/source-fingerprint-mismatch.json

@@ -0,0 +1,7 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [{"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-001", "status": "passed", "replacesReceiptId": null, "sourceFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "accepted", "activeReceiptId": "receipt-001", "sourceFingerprint": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/good/accepted-replacement-chain.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {
+    "fingerprintAlgorithm": "sha256-canonical-json-v1",
+    "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac",
+    "payload": {
+      "manifestVersion": 1,
+      "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]
+    }
+  },
+  "verificationContext": {
+    "fingerprintAlgorithm": "sha256-canonical-json-v1",
+    "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4",
+    "payload": {
+      "platform": "darwin-arm64",
+      "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]
+    }
+  },
+  "receipts": [
+    {
+      "schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1",
+      "receiptId": "receipt-001",
+      "status": "failed",
+      "replacesReceiptId": null,
+      "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac",
+      "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4",
+      "authorizationGranted": false,
+      "gitAuthorization": false,
+      "releaseAuthorization": false,
+      "artifactMutationAuthorization": false,
+      "businessActionAuthorization": false
+    },
+    {
+      "schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1",
+      "receiptId": "receipt-002",
+      "status": "passed",
+      "replacesReceiptId": "receipt-001",
+      "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac",
+      "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4",
+      "authorizationGranted": false,
+      "gitAuthorization": false,
+      "releaseAuthorization": false,
+      "artifactMutationAuthorization": false,
+      "businessActionAuthorization": false
+    }
+  ],
+  "closeout": {
+    "schemaVersion": "OwlCodaRunKitPublicCloseoutV1",
+    "decision": "accepted",
+    "activeReceiptId": "receipt-002",
+    "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac",
+    "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4",
+    "authorizationGranted": false,
+    "gitAuthorization": false,
+    "releaseAuthorization": false,
+    "artifactMutationAuthorization": false,
+    "businessActionAuthorization": false
+  }
+}

package/packages/attest/fixtures/good/blocked-single-leaf.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerificationBundleV1",
+  "source": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "payload": {"manifestVersion": 1, "files": [{"path": "src/order.json", "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}]}},
+  "verificationContext": {"fingerprintAlgorithm": "sha256-canonical-json-v1", "fingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "payload": {"platform": "darwin-arm64", "commands": [{"executable": "/usr/bin/node", "argv": ["--test", "fixtures"], "cwd": "."}]}},
+  "receipts": [
+    {"schemaVersion": "OwlCodaRunKitPublicVerificationReceiptV1", "receiptId": "receipt-blocked", "status": "blocked", "replacesReceiptId": null, "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+  ],
+  "closeout": {"schemaVersion": "OwlCodaRunKitPublicCloseoutV1", "decision": "blocked", "activeReceiptId": "receipt-blocked", "sourceFingerprint": "sha256:6cbc7b5570b8ae2cf63857ade8fc9362bf78603488c594b6b3db9b647b6d1fac", "verificationContextFingerprint": "sha256:a617e3a705a0e45c4205b63635acff13a97d91707e63165fe9ac416e253befc4", "authorizationGranted": false, "gitAuthorization": false, "releaseAuthorization": false, "artifactMutationAuthorization": false, "businessActionAuthorization": false}
+}

package/packages/attest/fixtures/index.json

@@ -0,0 +1,90 @@
+{
+  "schemaVersion": "OwlCodaRunKitPublicVerifierFixtureIndexV1",
+  "fixtures": [
+    {
+      "id": "good-accepted-replacement-chain",
+      "file": "good/accepted-replacement-chain.json",
+      "expectedValid": true,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": []
+    },
+    {
+      "id": "good-blocked-single-leaf",
+      "file": "good/blocked-single-leaf.json",
+      "expectedValid": true,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": []
+    },
+    {
+      "id": "bad-root-shape",
+      "file": "bad/root-shape-extra-property.json",
+      "expectedValid": false,
+      "expectedSchemaValid": false,
+      "expectedIssueCodes": ["PUBLIC_BUNDLE_SHAPE_INVALID"]
+    },
+    {
+      "id": "bad-source-fingerprint",
+      "file": "bad/source-fingerprint-mismatch.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["SOURCE_FINGERPRINT_MISMATCH"]
+    },
+    {
+      "id": "bad-context-fingerprint",
+      "file": "bad/context-fingerprint-mismatch.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["VERIFICATION_CONTEXT_FINGERPRINT_MISMATCH"]
+    },
+    {
+      "id": "bad-two-active-leaves",
+      "file": "bad/multiple-active-leaves.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["RECEIPT_LINEAGE_MULTIPLE_ACTIVE_LEAVES"]
+    },
+    {
+      "id": "bad-orphan-lineage",
+      "file": "bad/orphan-replacement.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["RECEIPT_LINEAGE_ORPHAN"]
+    },
+    {
+      "id": "bad-active-source-binding",
+      "file": "bad/active-source-binding-mismatch.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["ACTIVE_RECEIPT_SOURCE_BINDING_MISMATCH"]
+    },
+    {
+      "id": "bad-active-context-binding",
+      "file": "bad/active-context-binding-mismatch.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["ACTIVE_RECEIPT_CONTEXT_BINDING_MISMATCH"]
+    },
+    {
+      "id": "bad-accepted-failed-receipt",
+      "file": "bad/accepted-failed-receipt.json",
+      "expectedValid": false,
+      "expectedSchemaValid": true,
+      "expectedIssueCodes": ["ACCEPTED_RECEIPT_NOT_PASSED"]
+    },
+    {
+      "id": "bad-accepted-authority-leak",
+      "file": "bad/accepted-authority-leak.json",
+      "expectedValid": false,
+      "expectedSchemaValid": false,
+      "expectedIssueCodes": ["ACCEPTED_AUTHORITY_GRANTED"]
+    },
+    {
+      "id": "bad-duplicate-object-key",
+      "file": "bad/duplicate-object-key.json",
+      "inputMode": "raw_cli",
+      "expectedValid": false,
+      "expectedSchemaValid": false,
+      "expectedIssueCodes": ["DUPLICATE_OBJECT_KEY"]
+    }
+  ]
+}

package/packages/attest/sbom.spdx.json

@@ -0,0 +1,33 @@
+{
+  "spdxVersion": "SPDX-2.3",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "owlcoda-attest-0.2.0",
+  "documentNamespace": "https://owlcoda.com/spdx/owlcoda-attest/0.2.0/unsigned-v1-wave5",
+  "creationInfo": {
+    "created": "2026-07-29T00:00:00Z",
+    "creators": [
+      "Tool: OwlCoda RunKit Wave 5"
+    ]
+  },
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-Package-owlcoda-attest",
+      "name": "@owlcoda/attest",
+      "versionInfo": "0.2.0",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-3.0-or-later",
+      "copyrightText": "NOASSERTION",
+      "supplier": "Organization: OwlCoda"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relationshipType": "DESCRIBES",
+      "relatedSpdxElement": "SPDXRef-Package-owlcoda-attest"
+    }
+  ]
+}

package/packages/attest/schemas/attestation-ref-v1.schema.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/attestation-ref-v1.schema.json",
+  "title": "OwlCoda Attestation Reference V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "receiptId",
+    "receiptSha256",
+    "coreIdentity"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaAttestationRefV1"
+    },
+    "receiptId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "receiptSha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "coreIdentity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "contractVersion",
+        "coreManifestSha256"
+      ],
+      "properties": {
+        "contractVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "coreManifestSha256": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    }
+  }
+}

package/packages/attest/schemas/attestation-result-v1.schema.json

@@ -0,0 +1,163 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/attestation-result-v1.schema.json",
+  "title": "OwlCoda Attestation Result V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "decision",
+    "subjectRef",
+    "verifiedAt",
+    "policy",
+    "checks",
+    "authorizationBoundary",
+    "issueCodes",
+    "verifiedMaterials"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaAttestationResultV1"
+    },
+    "decision": {
+      "enum": [
+        "GO",
+        "NO_GO",
+        "INDETERMINATE"
+      ]
+    },
+    "subjectRef": {
+      "$ref": "attestation-ref-v1.schema.json"
+    },
+    "verifiedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "version"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "checks": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "schema",
+        "canonicalization",
+        "lineage",
+        "source",
+        "context",
+        "signature",
+        "key",
+        "anchor"
+      ],
+      "properties": {
+        "schema": {
+          "$ref": "#/$defs/check"
+        },
+        "canonicalization": {
+          "$ref": "#/$defs/check"
+        },
+        "lineage": {
+          "$ref": "#/$defs/check"
+        },
+        "source": {
+          "$ref": "#/$defs/check"
+        },
+        "context": {
+          "$ref": "#/$defs/check"
+        },
+        "signature": {
+          "$ref": "#/$defs/check"
+        },
+        "key": {
+          "$ref": "#/$defs/check"
+        },
+        "anchor": {
+          "$ref": "#/$defs/check"
+        }
+      }
+    },
+    "authorizationBoundary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "authorizationGranted",
+        "statement"
+      ],
+      "properties": {
+        "authorizationGranted": {
+          "const": false
+        },
+        "statement": {
+          "const": "attestation_never_grants_repository_or_business_authority"
+        }
+      }
+    },
+    "issueCodes": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "verifiedMaterials": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "path",
+          "sha256"
+        ],
+        "properties": {
+          "path": {
+            "type": "string",
+            "minLength": 1
+          },
+          "sha256": {
+            "type": "string",
+            "pattern": "^sha256:[0-9a-f]{64}$"
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "check": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "status"
+      ],
+      "properties": {
+        "status": {
+          "enum": [
+            "passed",
+            "failed",
+            "not_checked",
+            "material_missing"
+          ]
+        },
+        "issueCode": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    }
+  }
+}

package/packages/attest/schemas/offline-attestation-bundle-v1.schema.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://owlcoda.dev/schemas/runkit/trust/offline-attestation-bundle-v1.schema.json",
+  "title": "OwlCoda Offline Attestation Bundle V1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "reference",
+    "receiptByteLength",
+    "receiptBytesBase64"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "const": "OwlCodaOfflineAttestationBundleV1"
+    },
+    "reference": {
+      "$ref": "attestation-ref-v1.schema.json"
+    },
+    "receiptByteLength": {
+      "type": "integer",
+      "minimum": 1
+    },
+    "receiptBytesBase64": {
+      "type": "string",
+      "minLength": 4,
+      "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$"
+    }
+  }
+}

package/packages/attest/schemas/public-verification-bundle-v1.schema.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:owlcoda:runkit:public-verification-bundle:v1",
+  "title": "OwlCoda RunKit Public Verification Bundle V1",
+  "type": "object",
+  "required": ["schemaVersion", "source", "verificationContext", "receipts", "closeout"],
+  "properties": {
+    "schemaVersion": {"const": "OwlCodaRunKitPublicVerificationBundleV1"},
+    "source": {"$ref": "#/$defs/source"},
+    "verificationContext": {"$ref": "#/$defs/verificationContext"},
+    "receipts": {"type": "array", "minItems": 1, "maxItems": 1024, "items": {"$ref": "#/$defs/receipt"}},
+    "closeout": {"$ref": "#/$defs/closeout"}
+  },
+  "additionalProperties": false,
+  "$defs": {
+    "fingerprint": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+    "authorityFalse": {"const": false},
+    "source": {
+      "type": "object",
+      "required": ["fingerprintAlgorithm", "fingerprint", "payload"],
+      "properties": {
+        "fingerprintAlgorithm": {"const": "sha256-canonical-json-v1"},
+        "fingerprint": {"$ref": "#/$defs/fingerprint"},
+        "payload": {"type": "object"}
+      },
+      "additionalProperties": false
+    },
+    "verificationContext": {
+      "type": "object",
+      "required": ["fingerprintAlgorithm", "fingerprint", "payload"],
+      "properties": {
+        "fingerprintAlgorithm": {"const": "sha256-canonical-json-v1"},
+        "fingerprint": {"$ref": "#/$defs/fingerprint"},
+        "payload": {"type": "object"}
+      },
+      "additionalProperties": false
+    },
+    "receipt": {
+      "type": "object",
+      "required": ["schemaVersion", "receiptId", "status", "replacesReceiptId", "sourceFingerprint", "verificationContextFingerprint", "authorizationGranted", "gitAuthorization", "releaseAuthorization", "artifactMutationAuthorization", "businessActionAuthorization"],
+      "properties": {
+        "schemaVersion": {"const": "OwlCodaRunKitPublicVerificationReceiptV1"},
+        "receiptId": {"type": "string", "minLength": 1},
+        "status": {"enum": ["passed", "failed", "blocked"]},
+        "replacesReceiptId": {"oneOf": [{"type": "null"}, {"type": "string", "minLength": 1}]},
+        "sourceFingerprint": {"$ref": "#/$defs/fingerprint"},
+        "verificationContextFingerprint": {"$ref": "#/$defs/fingerprint"},
+        "authorizationGranted": {"$ref": "#/$defs/authorityFalse"},
+        "gitAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "releaseAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "artifactMutationAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "businessActionAuthorization": {"$ref": "#/$defs/authorityFalse"}
+      },
+      "additionalProperties": false
+    },
+    "closeout": {
+      "type": "object",
+      "required": ["schemaVersion", "decision", "activeReceiptId", "sourceFingerprint", "verificationContextFingerprint", "authorizationGranted", "gitAuthorization", "releaseAuthorization", "artifactMutationAuthorization", "businessActionAuthorization"],
+      "properties": {
+        "schemaVersion": {"const": "OwlCodaRunKitPublicCloseoutV1"},
+        "decision": {"enum": ["accepted", "blocked", "rejected"]},
+        "activeReceiptId": {"type": "string", "minLength": 1},
+        "sourceFingerprint": {"$ref": "#/$defs/fingerprint"},
+        "verificationContextFingerprint": {"$ref": "#/$defs/fingerprint"},
+        "authorizationGranted": {"$ref": "#/$defs/authorityFalse"},
+        "gitAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "releaseAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "artifactMutationAuthorization": {"$ref": "#/$defs/authorityFalse"},
+        "businessActionAuthorization": {"$ref": "#/$defs/authorityFalse"}
+      },
+      "additionalProperties": false
+    }
+  }
+}