agent-lifecycle-kit 2.3.0__tar.gz → 2.4.1__tar.gz

{agent_lifecycle_kit-2.3.0/src/agent_lifecycle_kit.egg-info → agent_lifecycle_kit-2.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-lifecycle-kit
-Version: 2.3.0
+Version: 2.4.1
 Summary: Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion.
 Author: Agent Lifecycle Kit contributors
 License: Apache-2.0
@@ -43,7 +43,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.3.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.4.1`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -68,7 +68,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), or coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md), or use the optional [security analysis profile](docs/reference/security-analysis-profile.md) for untrusted findings and independently verified remediation.
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/README.md

@@ -21,7 +21,7 @@ ALK provides a verifiable finish for external-agent work with proportionate cont
 ## Quick start
 Start with [install ALK and make the first run](docs/guides/install-and-first-run.md).
 
-It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.3.0`, and common `agent-lifecycle version` errors.
+It includes macOS, Linux and Windows instructions, Python 3.11-3.14, [PyPI](https://pypi.org/project/agent-lifecycle-kit/) installation with `python -m pip install agent-lifecycle-kit==2.4.1`, and common `agent-lifecycle version` errors.
 
 For a quick start, run:
 
@@ -46,7 +46,7 @@ agent-lifecycle start --adapter <adapter-id> --file task.md
 - The boundaries of [planning-only launch](docs/reference/planning-only-launch.md) and [frozen-task launch through a verified profile](docs/reference/qualified-host-launch.md) are documented in the reference. Shipped planning profiles remain candidates with safe failure until the corresponding profile is verified.
 - The [system architecture](docs/architecture/system-architecture.md) page explains how the project is organized, and [project comparison](docs/reference/project-comparison.md) shows how it differs from similar tools.
 - Multiple-agent boundaries, workflow configuration, model choice, prompts, timeouts and retries are described in [workflow customization and execution controls](docs/reference/workflow-customization.md).
-- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), or coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md).
+- Create a local project profile with `agent-lifecycle project profile init`; see [project workflow profile](docs/reference/project-workflow-profile.md). Explain the selected profile, plan constraints and adapter capability lineage with [effective configuration](docs/reference/effective-configuration.md), [structured result qualification](docs/reference/structured-result-qualification.md) and [adapter action evidence](docs/reference/adapter-action-evidence.md). Add optional project-owned architecture and dependency evidence with [external verification checks](docs/reference/external-verification-checks.md), track bounded terminology with [project domain language](docs/reference/project-domain-language.md), coordinate several runs with the read-only [multi-run attention view](docs/reference/multi-run-attention-view.md), or use the optional [security analysis profile](docs/reference/security-analysis-profile.md) for untrusted findings and independently verified remediation.
 - For long sessions, use [context checkpoints and compaction recovery](docs/reference/context-checkpoints.md). They preserve a bounded local continuation package without changing plan authority.
 ## What it gives you
 - A finish-oriented lifecycle: plan, execute, review, and prove the result.

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "agent-lifecycle-kit"
-version = "2.3.0"
+version = "2.4.1"
 description = "Provider-neutral lifecycle control layer that helps coding agents plan, execute, validate, and prove software tasks to completion."
 readme = "README.md"
 requires-python = ">=3.11,<3.15"

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/_version.py

@@ -1,3 +1,3 @@
 """Package version."""
 
-__version__ = "2.3.0"
+__version__ = "2.4.1"

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/audit/__init__.py

@@ -44,6 +44,12 @@ from agent_lifecycle.audit.review_verdict import (
     require_review_verdict_pass,
     validate_review_verdict,
 )
+from agent_lifecycle.audit.security_analysis import (
+    build_security_analysis_audit,
+    build_security_verification_assignment,
+    validate_security_analysis_audit,
+    validate_security_verification_assignment,
+)
 
 __all__ = [
     "build_bug_forensics_audit",
@@ -58,6 +64,8 @@ __all__ = [
     "build_proof_integrity_receipt",
     "build_receipt_hash_chain",
     "build_root_cause_evidence",
+    "build_security_analysis_audit",
+    "build_security_verification_assignment",
     "compact_review_routing",
     "finding_identity_fields",
     "require_bug_forensics_audit_pass",
@@ -78,4 +86,6 @@ __all__ = [
     "validate_receipt_hash_chain",
     "validate_review_verdict",
     "validate_root_cause_evidence",
+    "validate_security_analysis_audit",
+    "validate_security_verification_assignment",
 ]

agent_lifecycle_kit-2.4.1/src/agent_lifecycle/audit/security_analysis.py

@@ -0,0 +1,15 @@
+"""Compatibility exports for security-analysis verification evidence."""
+
+from agent_lifecycle.quality.security_analysis import (
+    build_security_analysis_audit,
+    build_security_verification_assignment,
+    validate_security_analysis_audit,
+    validate_security_verification_assignment,
+)
+
+__all__ = [
+    "build_security_analysis_audit",
+    "build_security_verification_assignment",
+    "validate_security_analysis_audit",
+    "validate_security_verification_assignment",
+]

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/cli/dispatch_contracts.py

@@ -37,6 +37,7 @@ from agent_lifecycle.imports import (
     validate_import_result,
     validate_skill_improvement_proposal,
 )
+from agent_lifecycle.imports.security_findings import import_security_findings, validate_security_finding_import
 from agent_lifecycle.planning import (
     build_task_template_library,
     require_task_template_validation_pass,
@@ -52,6 +53,10 @@ from agent_lifecycle.quality import (
     validate_bug_forensics_recipe_library,
     validate_quality_pack,
 )
+from agent_lifecycle.quality.security_analysis import (
+    build_security_analysis_profile,
+    validate_security_finding,
+)
 from agent_lifecycle.review_mesh import (
     build_quorum_from_synthesis,
     build_review_mesh_assignment_packet,
@@ -142,6 +147,17 @@ def _dispatch_evidence(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _dispatch_import(args: argparse.Namespace) -> dict[str, Any]:
+    if args.import_command in {"security-findings", "security"}:
+        payload = import_security_findings(
+            Path(args.source),
+            source_revision=args.source_revision,
+            expected_source_revision=args.expected_source_revision,
+            source_lineage_digest=args.source_lineage_digest,
+            max_input_bytes=args.max_input_bytes,
+        )
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.import_command == "profile-list":
         payload = external_dialect_registry()
         if args.out:
@@ -222,6 +238,24 @@ def _planning_import_profile(
 
 
 def _dispatch_quality(args: argparse.Namespace) -> dict[str, Any]:
+    if args.quality_command in {"security-profile", "security-analysis-profile"}:
+        payload = build_security_analysis_profile()
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
+    if args.quality_command in {"security-finding-check", "security-analysis-check"}:
+        candidate = read_json_object(Path(args.candidate), label="security finding import")
+        if candidate.get("schemaVersion") == "agent-security-finding-import.v1":
+            payload = validate_security_finding_import(
+                candidate, expected_source_revision=args.expected_source_revision
+            )
+        else:
+            payload = validate_security_finding(
+                candidate, expected_source_revision=args.expected_source_revision
+            )
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.quality_command == "pack-check":
         manifest = (
             read_json_object(Path(args.manifest), label="quality pack")

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/cli/dispatch_observability.py

@@ -35,6 +35,7 @@ from agent_lifecycle.host_protocol.thread_bridge import (
     prepare_thread_request,
     validate_thread_exchange,
 )
+from agent_lifecycle.imports.security_findings import import_security_findings
 from agent_lifecycle.metrics import (
     build_lifecycle_cost_summary,
     build_lifecycle_recommendation_summary,
@@ -67,6 +68,7 @@ from agent_lifecycle.policy.proposals import (
     build_optimization_proposal,
     require_optimization_proposal_pass,
 )
+from agent_lifecycle.quality.security_analysis import build_security_analysis_profile
 from agent_lifecycle.reporting import (
     build_change_summary_receipt,
     build_lifecycle_progress_view,
@@ -151,6 +153,31 @@ def _dispatch_thread(args: argparse.Namespace) -> dict[str, Any]:
 
 
 def _dispatch_report(args: argparse.Namespace) -> dict[str, Any] | str:
+    if args.report_command == "security-analysis":
+        findings = []
+        imports = []
+        for item in args.finding:
+            imported = import_security_findings(
+                Path(item),
+                source_revision=args.source_revision,
+                expected_source_revision=args.expected_source_revision,
+            )
+            imports.append(imported)
+            findings.extend(imported.get("findings", []))
+        payload = {
+            "schemaVersion": "agent-security-analysis-report.v1",
+            "status": "PASS" if all(item.get("status") == "PASS" for item in imports) else "FAIL",
+            "profile": build_security_analysis_profile() if args.profile else None,
+            "imports": imports,
+            "findings": findings,
+            "trusted": False,
+            "authorityClaimed": False,
+            "productionPromotionClaimed": False,
+        }
+        payload["reportDigest"] = canonical_digest(payload)
+        if args.out:
+            write_json_create(Path(args.out), payload)
+        return payload
     if args.report_command == "status-view":
         payload = build_status_view(
             project_root=Path(args.project_root),

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/cli/observability_parsers.py

@@ -65,3 +65,9 @@ def _add_report_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentP
     change_summary.add_argument("--staged", action="store_true")
     change_summary.add_argument("--path", action="append", default=[])
     change_summary.add_argument("--out")
+    security = report_sub.add_parser("security-analysis")
+    security.add_argument("--finding", action="append", default=[])
+    security.add_argument("--source-revision")
+    security.add_argument("--expected-source-revision")
+    security.add_argument("--profile", action="store_true")
+    security.add_argument("--out")

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/cli/parsers.py

@@ -235,6 +235,13 @@ def _add_import_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentP
     external_check.add_argument("--candidate", required=True)
     proposal_check = import_sub.add_parser("proposal-check")
     proposal_check.add_argument("--proposal", required=True)
+    security_import = import_sub.add_parser("security-findings", aliases=["security"])
+    security_import.add_argument("--source", required=True)
+    security_import.add_argument("--source-revision")
+    security_import.add_argument("--expected-source-revision")
+    security_import.add_argument("--source-lineage-digest")
+    security_import.add_argument("--max-input-bytes", type=int, default=4 * 1024 * 1024)
+    security_import.add_argument("--out")
 
 
 def _add_quality_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:
@@ -271,6 +278,12 @@ def _add_quality_parser(subparsers: argparse._SubParsersAction[argparse.Argument
     external_check.add_argument("--operation-id", required=True)
     external_check.add_argument("--blocking-required", action="store_true")
     external_check.add_argument("--out")
+    security_profile = quality_sub.add_parser("security-profile", aliases=["security-analysis-profile"])
+    security_profile.add_argument("--out")
+    security_check = quality_sub.add_parser("security-finding-check", aliases=["security-analysis-check"])
+    security_check.add_argument("--candidate", required=True)
+    security_check.add_argument("--expected-source-revision")
+    security_check.add_argument("--out")
 
 
 def _add_review_mesh_parser(subparsers: argparse._SubParsersAction[argparse.ArgumentParser]) -> None:

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/contracts/plan_manifest_schemas.py

@@ -35,7 +35,7 @@ _OBJECT = {"type": "object"}
 PLAN_MANIFEST_SCHEMAS: dict[str, dict[str, Any]] = {
     MANIFEST_SCHEMA: _closed_object_schema(
         MANIFEST_SCHEMA,
-        required=["schemaVersion", "status", "planRevision", "package"],
+        required=["status", "planRevision", "package"],
         properties={
             "status": {"enum": ["DRAFT", "REOPENED", "FROZEN"]},
             "planRevision": {"type": "integer", "minimum": 1},
@@ -75,12 +75,12 @@ PLAN_MANIFEST_SCHEMAS: dict[str, dict[str, Any]] = {
             "tierResolution": _OBJECT,
             "taskTemplates": _OBJECT,
             "compatibility": _OBJECT,
-            "extensions": _OBJECT,
+            "extensions": {"$ref": "#/$defs/extensions"},
         },
     ),
     MANIFEST_VALIDATION_SCHEMA: _closed_object_schema(
         MANIFEST_VALIDATION_SCHEMA,
-        required=["schemaVersion", "status", "packageId", "planRevision", "blockers", "validationDigest"],
+        required=["status", "packageId", "planRevision", "blockers", "validationDigest"],
         properties={
             "status": {"enum": ["PASS", "FAIL"]},
             "packageId": {"type": ["string", "null"]},
@@ -134,6 +134,25 @@ PLAN_MANIFEST_SCHEMAS[MANIFEST_SCHEMA]["$defs"] = {
             "allowedUnlistedFiles": _STRING_LIST,
         },
     ),
+    "extensions": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "$id": "agent-plan-extensions.v1",
+        "type": "object",
+        "additionalProperties": True,
+        "properties": {
+            "securityAnalysis": {
+                "type": "object",
+                "required": ["profileId", "activation", "implementationAudit"],
+                "additionalProperties": True,
+                "properties": {
+                    "profileId": {"const": "security-analysis.v1"},
+                    "activation": {"enum": ["read-only-by-default", "explicit-plan-opt-in"]},
+                    "implementationAudit": {"type": "object"},
+                    "verificationEvidence": {"type": "object"},
+                },
+            }
+        },
+    },
 }
 
 __all__ = ["MANIFEST_SCHEMA", "MANIFEST_VALIDATION_SCHEMA", "PLAN_MANIFEST_SCHEMAS"]

{agent_lifecycle_kit-2.3.0 → agent_lifecycle_kit-2.4.1}/src/agent_lifecycle/contracts/schemas.py

@@ -75,6 +75,7 @@ from agent_lifecycle.contracts.review_quality_schemas import REVIEW_QUALITY_SCHE
 from agent_lifecycle.contracts.runner_worktree_schemas import WORKTREE_SUPPORT_SCHEMAS
 from agent_lifecycle.contracts.sandbox_schemas import SANDBOX_SCHEMAS
 from agent_lifecycle.contracts.schema_builders import open_object_schema
+from agent_lifecycle.contracts.security_analysis_schemas import SECURITY_ANALYSIS_SCHEMAS
 from agent_lifecycle.contracts.status_goal_schemas import STATUS_GOAL_SCHEMAS
 from agent_lifecycle.contracts.structured_result_schemas import STRUCTURED_RESULT_SCHEMAS
 from agent_lifecycle.contracts.task_template_schemas import TASK_TEMPLATE_SCHEMAS
@@ -729,6 +730,7 @@ _SCHEMA_GROUPS = (
     WORKFLOW_AUTHORIZATION_SCHEMAS,
     WORKFLOW_STATE_SCHEMAS,
     BUG_FORENSICS_SCHEMAS,
+    SECURITY_ANALYSIS_SCHEMAS,
     CROSS_CHECK_SCHEMAS,
     DOMAIN_LANGUAGE_SCHEMAS,
     REVIEW_MESH_SCHEMAS,

agent_lifecycle_kit-2.4.1/src/agent_lifecycle/contracts/security_analysis_schemas.py

@@ -0,0 +1,306 @@
+"""Portable contracts for the optional security-analysis profile."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from agent_lifecycle.contracts.schema_builders import open_object_schema
+
+SECURITY_ANALYSIS_PROFILE_SCHEMA = "agent-security-analysis-profile.v1"
+SECURITY_ANALYSIS_PROFILE_VALIDATION_SCHEMA = "agent-security-analysis-profile-validation.v1"
+SECURITY_FINDING_SCHEMA = "agent-security-finding.v1"
+SECURITY_FINDING_VALIDATION_SCHEMA = "agent-security-finding-validation.v1"
+SECURITY_FINDING_IMPORT_SCHEMA = "agent-security-finding-import.v1"
+SECURITY_FINDING_IMPORT_VALIDATION_SCHEMA = "agent-security-finding-import-validation.v1"
+SECURITY_EXECUTION_GATE_SCHEMA = "agent-security-execution-gate.v1"
+SECURITY_EXECUTION_GATE_VALIDATION_SCHEMA = "agent-security-execution-gate-validation.v1"
+SECURITY_VERIFICATION_ASSIGNMENT_SCHEMA = "agent-security-verification-assignment.v1"
+SECURITY_VERIFICATION_ASSIGNMENT_VALIDATION_SCHEMA = "agent-security-verification-assignment-validation.v1"
+SECURITY_ANALYSIS_AUDIT_SCHEMA = "agent-security-analysis-audit.v1"
+SECURITY_ANALYSIS_AUDIT_VALIDATION_SCHEMA = "agent-security-analysis-audit-validation.v1"
+
+SECURITY_SEVERITIES = ("BLOCKER", "CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO")
+SECURITY_CONFIDENCES = ("UNKNOWN", "LOW", "MEDIUM", "HIGH")
+SECURITY_FINDING_STATUSES = ("UNTRUSTED", "VALIDATED", "REJECTED", "DISPUTED")
+
+_DIGEST = {"type": "string", "minLength": 64, "maxLength": 64}
+_BLOCKERS = {"type": "array", "items": {"type": "object"}}
+
+SECURITY_ANALYSIS_SCHEMAS: dict[str, dict[str, Any]] = {
+    SECURITY_ANALYSIS_PROFILE_SCHEMA: open_object_schema(
+        SECURITY_ANALYSIS_PROFILE_SCHEMA,
+        required=[
+            "schemaVersion",
+            "profileId",
+            "status",
+            "enabledByDefault",
+            "activationMode",
+            "stages",
+            "findingsPolicy",
+            "executionPolicy",
+            "implementationAudit",
+            "productionPromotionClaimed",
+            "profileDigest",
+        ],
+        properties={
+            "profileId": {"const": "security-analysis"},
+            "status": {"const": "OPTIONAL"},
+            "enabledByDefault": {"const": False},
+            "activationMode": {"const": "explicit-task-trigger"},
+            "stages": {"type": "array", "items": {"type": "string", "minLength": 1}},
+            "findingsPolicy": {"type": "object"},
+            "executionPolicy": {"type": "object"},
+            "implementationAudit": {"type": "object"},
+            "productionPromotionClaimed": {"const": False},
+            "profileDigest": _DIGEST,
+        },
+    ),
+    SECURITY_ANALYSIS_PROFILE_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_ANALYSIS_PROFILE_VALIDATION_SCHEMA,
+        required=["schemaVersion", "status", "profileId", "blockers", "profileDigest", "validationDigest"],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "profileId": {"type": ["string", "null"]},
+            "blockers": _BLOCKERS,
+            "profileDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+    SECURITY_FINDING_SCHEMA: open_object_schema(
+        SECURITY_FINDING_SCHEMA,
+        required=[
+            "schemaVersion",
+            "findingId",
+            "title",
+            "severity",
+            "confidence",
+            "status",
+            "sourceRevision",
+            "sourceLineageDigest",
+            "locations",
+            "trusted",
+            "authorityClaimed",
+            "productionPromotionClaimed",
+            "findingDigest",
+        ],
+        properties={
+            "findingId": {"type": "string", "minLength": 1, "maxLength": 256},
+            "title": {"type": "string", "minLength": 1, "maxLength": 4096},
+            "description": {"type": "string", "maxLength": 16384},
+            "severity": {"enum": list(SECURITY_SEVERITIES)},
+            "confidence": {"enum": list(SECURITY_CONFIDENCES)},
+            "status": {"enum": list(SECURITY_FINDING_STATUSES)},
+            "source": {"type": "object"},
+            "sourceRevision": {"type": "string", "minLength": 1},
+            "sourceLineageDigest": _DIGEST,
+            "locations": {"type": "array", "items": {"type": "object"}, "maxItems": 64},
+            "remediation": {"type": ["object", "null"]},
+            "trusted": {"const": False},
+            "authorityClaimed": {"const": False},
+            "evidenceIds": {"type": "array", "items": {"type": "string", "minLength": 1}},
+            "productionPromotionClaimed": {"const": False},
+            "findingDigest": _DIGEST,
+        },
+    ),
+    SECURITY_FINDING_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_FINDING_VALIDATION_SCHEMA,
+        required=[
+            "schemaVersion",
+            "status",
+            "findingId",
+            "findingStatus",
+            "blockers",
+            "findingDigest",
+            "validationDigest",
+        ],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "findingId": {"type": ["string", "null"]},
+            "findingStatus": {"type": ["string", "null"]},
+            "blockers": _BLOCKERS,
+            "findingDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+    SECURITY_FINDING_IMPORT_SCHEMA: open_object_schema(
+        SECURITY_FINDING_IMPORT_SCHEMA,
+        required=[
+            "schemaVersion",
+            "status",
+            "sourceFormat",
+            "sourceRevision",
+            "findings",
+            "trusted",
+            "authorityClaimed",
+            "blockers",
+            "productionPromotionClaimed",
+            "importDigest",
+        ],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "sourceFormat": {"enum": ["SARIF", "NORMALIZED"]},
+            "sourceRevision": {"type": "string", "minLength": 1},
+            "sourceLineageDigest": {"type": ["string", "null"]},
+            "findings": {"type": "array", "items": {"type": "object"}, "maxItems": 4096},
+            "trusted": {"const": False},
+            "authorityClaimed": {"const": False},
+            "blockers": _BLOCKERS,
+            "productionPromotionClaimed": {"const": False},
+            "importDigest": _DIGEST,
+        },
+    ),
+    SECURITY_FINDING_IMPORT_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_FINDING_IMPORT_VALIDATION_SCHEMA,
+        required=["schemaVersion", "status", "findingCount", "blockers", "importDigest", "validationDigest"],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "findingCount": {"type": "integer", "minimum": 0},
+            "blockers": _BLOCKERS,
+            "importDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+    SECURITY_EXECUTION_GATE_SCHEMA: open_object_schema(
+        SECURITY_EXECUTION_GATE_SCHEMA,
+        required=[
+            "schemaVersion",
+            "status",
+            "taskId",
+            "activated",
+            "explicitOptIn",
+            "sandboxReceiptDigest",
+            "authorizationGranted",
+            "limits",
+            "liveCallsStarted",
+            "blockers",
+            "productionPromotionClaimed",
+            "receiptDigest",
+        ],
+        properties={
+            "status": {"enum": ["PASS", "FAIL", "SKIPPED"]},
+            "taskId": {"type": ["string", "null"]},
+            "activated": {"type": "boolean"},
+            "explicitOptIn": {"type": "boolean"},
+            "sandboxReceiptDigest": {"type": ["string", "null"]},
+            "authorizationGranted": {"type": "boolean"},
+            "limits": {"type": "object"},
+            "liveCallsStarted": {"const": False},
+            "blockers": _BLOCKERS,
+            "productionPromotionClaimed": {"const": False},
+            "receiptDigest": _DIGEST,
+        },
+    ),
+    SECURITY_EXECUTION_GATE_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_EXECUTION_GATE_VALIDATION_SCHEMA,
+        required=["schemaVersion", "status", "gateStatus", "blockers", "receiptDigest", "validationDigest"],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "gateStatus": {"enum": ["PASS", "FAIL", "SKIPPED"]},
+            "blockers": _BLOCKERS,
+            "receiptDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+    SECURITY_VERIFICATION_ASSIGNMENT_SCHEMA: open_object_schema(
+        SECURITY_VERIFICATION_ASSIGNMENT_SCHEMA,
+        required=[
+            "schemaVersion",
+            "status",
+            "assignmentId",
+            "runId",
+            "taskId",
+            "attempt",
+            "planDigest",
+            "sourceRevision",
+            "reviewer",
+            "independentEvidenceIds",
+            "productionPromotionClaimed",
+            "assignmentDigest",
+        ],
+        properties={
+            "status": {"enum": ["READY", "PASS", "FAIL", "DISPUTED"]},
+            "assignmentId": {"type": "string", "minLength": 1},
+            "runId": {"type": "string", "minLength": 1},
+            "taskId": {"type": "string", "minLength": 1},
+            "attempt": {"type": "integer", "minimum": 1},
+            "planDigest": _DIGEST,
+            "sourceRevision": {"type": "string", "minLength": 1},
+            "reviewer": {"type": "object"},
+            "independentEvidenceIds": {"type": "array", "items": {"type": "string", "minLength": 1}},
+            "productionPromotionClaimed": {"const": False},
+            "assignmentDigest": _DIGEST,
+        },
+    ),
+    SECURITY_VERIFICATION_ASSIGNMENT_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_VERIFICATION_ASSIGNMENT_VALIDATION_SCHEMA,
+        required=["schemaVersion", "status", "blockers", "assignmentDigest", "validationDigest"],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "blockers": _BLOCKERS,
+            "assignmentDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+    SECURITY_ANALYSIS_AUDIT_SCHEMA: open_object_schema(
+        SECURITY_ANALYSIS_AUDIT_SCHEMA,
+        required=[
+            "schemaVersion",
+            "status",
+            "verdict",
+            "runId",
+            "taskId",
+            "attempt",
+            "planDigest",
+            "sourceRevision",
+            "auditor",
+            "findings",
+            "independentEvidenceIds",
+            "productionPromotionClaimed",
+            "auditDigest",
+        ],
+        properties={
+            "status": {"enum": ["PASS", "FAIL", "DISPUTED"]},
+            "verdict": {"enum": ["ACCEPTED", "REWORK", "CONTRACT_CHANGE", "BLOCKED"]},
+            "runId": {"type": "string", "minLength": 1},
+            "taskId": {"type": "string", "minLength": 1},
+            "attempt": {"type": "integer", "minimum": 1},
+            "planDigest": _DIGEST,
+            "sourceRevision": {"type": "string", "minLength": 1},
+            "auditor": {"type": "object"},
+            "findings": {"type": "array", "items": {"type": "object"}},
+            "independentEvidenceIds": {"type": "array", "items": {"type": "string", "minLength": 1}},
+            "productionPromotionClaimed": {"const": False},
+            "auditDigest": _DIGEST,
+        },
+    ),
+    SECURITY_ANALYSIS_AUDIT_VALIDATION_SCHEMA: open_object_schema(
+        SECURITY_ANALYSIS_AUDIT_VALIDATION_SCHEMA,
+        required=["schemaVersion", "status", "verdict", "blockers", "auditDigest", "validationDigest"],
+        properties={
+            "status": {"enum": ["PASS", "FAIL"]},
+            "verdict": {"type": ["string", "null"]},
+            "blockers": _BLOCKERS,
+            "auditDigest": {"type": ["string", "null"]},
+            "validationDigest": _DIGEST,
+        },
+    ),
+}
+
+__all__ = [
+    "SECURITY_ANALYSIS_AUDIT_SCHEMA",
+    "SECURITY_ANALYSIS_AUDIT_VALIDATION_SCHEMA",
+    "SECURITY_ANALYSIS_PROFILE_SCHEMA",
+    "SECURITY_ANALYSIS_PROFILE_VALIDATION_SCHEMA",
+    "SECURITY_ANALYSIS_SCHEMAS",
+    "SECURITY_CONFIDENCES",
+    "SECURITY_EXECUTION_GATE_SCHEMA",
+    "SECURITY_EXECUTION_GATE_VALIDATION_SCHEMA",
+    "SECURITY_FINDING_IMPORT_SCHEMA",
+    "SECURITY_FINDING_IMPORT_VALIDATION_SCHEMA",
+    "SECURITY_FINDING_SCHEMA",
+    "SECURITY_FINDING_STATUSES",
+    "SECURITY_FINDING_VALIDATION_SCHEMA",
+    "SECURITY_SEVERITIES",
+    "SECURITY_VERIFICATION_ASSIGNMENT_SCHEMA",
+    "SECURITY_VERIFICATION_ASSIGNMENT_VALIDATION_SCHEMA",
+]