{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/authority-carriage-v1.json",
  "title": "Authority Carriage Receipt, v1",
  "description": "Canonical schema for the Hive authority carriage receipt, canonical type authority.carriage. The instrument closes the gap between the gate and the ledger: authority is checked at admission, the effect is written somewhere else, and nothing today proves the scope in the record is the scope that was actually enforced. This receipt binds an admission envelope, the enforcement point that applied it, the record point that wrote the effect, and the scope commitment carried by each, then recomputes whether the two scopes agree, whether the record came after the decision, and whether the two points are distinct.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096
    },
    "key_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 256
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 0
    },
    "nonce_hex": {
      "type": "string",
      "pattern": "^[0-9a-f]{2,64}$"
    },
    "signed_body": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "receipt_type",
        "schema",
        "carriage_id",
        "salt",
        "authority_ref",
        "admission",
        "effect_record",
        "carriage",
        "verdict",
        "boundary"
      ],
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "authority.carriage"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "carriage_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$"
        },
        "salt": {
          "type": "object",
          "required": [
            "salt_commitment"
          ],
          "additionalProperties": false,
          "properties": {
            "salt_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          },
          "description": "Commitment to the disclosed carriage salt. Every party, scope, and point commitment in this receipt is keyed to this salt, so identifiers stay private while a holder of the salt can recompute each commitment."
        },
        "authority_ref": {
          "type": "object",
          "required": [
            "authority_commitment",
            "reference_class"
          ],
          "additionalProperties": false,
          "properties": {
            "authority_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "reference_class": {
              "type": "string",
              "enum": [
                "issuer_resolved",
                "caller_supplied",
                "asserted_without_source"
              ]
            }
          }
        },
        "admission": {
          "type": "object",
          "required": [
            "scope_commitment",
            "enforcement_point_commitment",
            "decided_at",
            "prior_receipt"
          ],
          "additionalProperties": false,
          "properties": {
            "scope_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "enforcement_point_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "decided_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "description": "Instant the admission decision was made, taken from the supplied admission envelope.",
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "prior_receipt": {
              "type": "object",
              "required": [
                "receipt_id",
                "receipt_type",
                "envelope_sha256",
                "issuance_instant"
              ],
              "additionalProperties": false,
              "properties": {
                "receipt_id": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 128
                },
                "receipt_type": {
                  "type": "string",
                  "const": "authority.admission"
                },
                "envelope_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "issuance_instant": {
                  "type": "object",
                  "required": [
                    "utc",
                    "drift_seconds"
                  ],
                  "additionalProperties": false,
                  "description": "Issuance instant of the supplied admission envelope, recomputed from its own signed timestamp.",
                  "properties": {
                    "utc": {
                      "type": "string",
                      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                    },
                    "drift_seconds": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 86400
                    }
                  }
                }
              }
            }
          }
        },
        "effect_record": {
          "type": "object",
          "required": [
            "scope_commitment",
            "record_point_commitment",
            "recorded_at",
            "record_digest"
          ],
          "additionalProperties": false,
          "properties": {
            "scope_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "record_point_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "recorded_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "description": "Instant the record of the effect was written by the record point.",
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "record_digest": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "carriage": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "authority_relation",
            "scope_relation",
            "order_relation",
            "point_relation"
          ],
          "properties": {
            "authority_relation": {
              "type": "string",
              "enum": [
                "admission_authority_matches_receipt",
                "admission_authority_differs_from_receipt"
              ]
            },
            "scope_relation": {
              "type": "string",
              "enum": [
                "record_scope_equals_admitted_scope",
                "record_scope_differs_from_admitted_scope"
              ]
            },
            "order_relation": {
              "type": "string",
              "enum": [
                "record_at_or_after_admission",
                "record_before_admission",
                "indeterminate"
              ]
            },
            "point_relation": {
              "type": "string",
              "enum": [
                "enforcement_and_record_points_distinct",
                "enforcement_and_record_points_identical"
              ]
            }
          }
        },
        "verdict": {
          "type": "string",
          "enum": [
            "carried",
            "authority_diverged",
            "scope_diverged",
            "points_not_distinct",
            "order_unsupported",
            "indeterminate"
          ]
        },
        "boundary": {
          "type": "string",
          "const": "Authority Carriage receipt. Attests that the scope commitment enforced by the named enforcement point at admission equals the scope commitment named in the record of the effect, that the record was written at or after the admission decision, and that the enforcement point and the record point are distinct commitments. It does not attest that the effect itself was correct, that the admitted scope was the right scope to grant, or that any system outside the supplied admission envelope and the supplied record digest was inspected."
        }
      }
    }
  }
}