{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/control-replay-v1.json",
  "title": "Control Replay Receipt, v1",
  "description": "Canonical schema for the Hive control replay receipt, canonical type control.replay. The instrument answers whether a machine was actually being flown or driven by an attested certified control software build across a disputed window of control cycles, or whether a human override or an unattested build held authority. Each control cycle commits to a digest of the cycle inputs before it commits to a digest of the actuator outputs, records which authority held control, chains to the previous cycle hash, and is signed by the device whose secure element attested the build measurement. A verifier holding the certified build replays the disclosed inputs offline and must reproduce the committed output digest; a verifier without the build still checks the chain, the attested build measurement, and the input before output ordering, and reports the replay as not evaluated rather than as reproduced.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_control[.]replay_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "replay_id",
        "build",
        "window",
        "disputed_window",
        "cycles",
        "replay",
        "coverage",
        "verdict",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "control.replay"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "replay_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$"
        },
        "build": {
          "type": "object",
          "required": [
            "build_measurement_commitment",
            "salt_commitment",
            "certified_set_commitment",
            "certified_set_size",
            "device_public_key_hex",
            "prior_receipt"
          ],
          "additionalProperties": false,
          "properties": {
            "build_measurement_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "salt_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "certified_set_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "certified_set_size": {
              "type": "integer",
              "minimum": 1,
              "maximum": 1024
            },
            "device_public_key_hex": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "prior_receipt": {
              "type": "object",
              "required": [
                "receipt_id",
                "receipt_type",
                "envelope_sha256",
                "attestation_instant"
              ],
              "additionalProperties": false,
              "properties": {
                "receipt_id": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 256
                },
                "receipt_type": {
                  "type": "string",
                  "const": "control.attestation"
                },
                "envelope_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "attestation_instant": {
                  "type": "object",
                  "required": [
                    "utc",
                    "drift_seconds"
                  ],
                  "additionalProperties": false,
                  "properties": {
                    "utc": {
                      "type": "string",
                      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                    },
                    "drift_seconds": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 86400
                    }
                  }
                }
              }
            }
          }
        },
        "window": {
          "type": "object",
          "required": [
            "opens",
            "closes",
            "first_cycle_index",
            "last_cycle_index",
            "cycle_count",
            "manual_authority_cycle_count",
            "maximum_cycle_duration_ms",
            "genesis_previous_cycle_hash"
          ],
          "additionalProperties": false,
          "properties": {
            "opens": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "closes": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "first_cycle_index": {
              "type": "integer",
              "minimum": 0,
              "maximum": 999999999999
            },
            "last_cycle_index": {
              "type": "integer",
              "minimum": 0,
              "maximum": 999999999999
            },
            "cycle_count": {
              "type": "integer",
              "minimum": 1,
              "maximum": 512
            },
            "manual_authority_cycle_count": {
              "type": "integer",
              "minimum": 0,
              "maximum": 512
            },
            "maximum_cycle_duration_ms": {
              "type": "integer",
              "minimum": 1,
              "maximum": 60000
            },
            "genesis_previous_cycle_hash": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "disputed_window": {
          "type": "object",
          "required": [
            "opens_cycle_index",
            "closes_cycle_index",
            "opened_cycle_count"
          ],
          "additionalProperties": false,
          "properties": {
            "opens_cycle_index": {
              "type": "integer",
              "minimum": 0,
              "maximum": 999999999999
            },
            "closes_cycle_index": {
              "type": "integer",
              "minimum": 0,
              "maximum": 999999999999
            },
            "opened_cycle_count": {
              "type": "integer",
              "minimum": 1,
              "maximum": 512
            }
          }
        },
        "cycles": {
          "type": "array",
          "minItems": 1,
          "maxItems": 512,
          "items": {
            "type": "object",
            "required": [
              "cycle_index",
              "input_commitment",
              "input_instant",
              "output_commitment",
              "output_instant",
              "control_authority",
              "previous_cycle_hash",
              "cycle_hash",
              "cycle_sig_b64u",
              "disclosure"
            ],
            "additionalProperties": false,
            "properties": {
              "cycle_index": {
                "type": "integer",
                "minimum": 0,
                "maximum": 999999999999
              },
              "input_commitment": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              },
              "input_instant": {
                "type": "object",
                "required": [
                  "utc",
                  "drift_ms"
                ],
                "additionalProperties": false,
                "properties": {
                  "utc": {
                    "type": "string",
                    "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                  },
                  "drift_ms": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 60000
                  }
                }
              },
              "output_commitment": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              },
              "output_instant": {
                "type": "object",
                "required": [
                  "utc",
                  "drift_ms"
                ],
                "additionalProperties": false,
                "properties": {
                  "utc": {
                    "type": "string",
                    "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                  },
                  "drift_ms": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 60000
                  }
                }
              },
              "control_authority": {
                "type": "string",
                "enum": [
                  "certified_build",
                  "manual_override"
                ]
              },
              "previous_cycle_hash": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              },
              "cycle_hash": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              },
              "cycle_sig_b64u": {
                "type": "string",
                "pattern": "^[A-Za-z0-9_-]{86}$"
              },
              "disclosure": {
                "type": "string",
                "enum": [
                  "opened",
                  "closed"
                ]
              }
            }
          }
        },
        "replay": {
          "type": "object",
          "required": [
            "replay_relation",
            "replayed_cycle_count"
          ],
          "additionalProperties": false,
          "properties": {
            "replay_relation": {
              "type": "string",
              "enum": [
                "reproduced_for_every_opened_cycle",
                "diverged_at_least_one_opened_cycle",
                "refused_to_conclude_build_absent"
              ]
            },
            "replayed_cycle_count": {
              "type": "integer",
              "minimum": 0,
              "maximum": 512
            }
          }
        },
        "coverage": {
          "type": "object",
          "required": [
            "window_coverage_relation",
            "authority_relation",
            "disclosure_relation"
          ],
          "additionalProperties": false,
          "properties": {
            "window_coverage_relation": {
              "type": "string",
              "enum": [
                "every_cycle_index_present",
                "at_least_one_cycle_index_missing"
              ]
            },
            "authority_relation": {
              "type": "string",
              "enum": [
                "certified_build_held_authority_every_cycle",
                "manual_authority_present",
                "declared_manual_count_differs_from_signed_cycles"
              ]
            },
            "disclosure_relation": {
              "type": "string",
              "enum": [
                "disclosure_matches_disputed_window",
                "disclosure_wider_than_disputed_window",
                "disclosure_narrower_than_disputed_window"
              ]
            }
          }
        },
        "verdict": {
          "type": "string",
          "enum": [
            "certified_build_in_control",
            "manual_override_in_window",
            "replay_diverged",
            "replay_not_evaluated",
            "coverage_incomplete"
          ]
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests only that a set of signed control cycle records, an attested control software build measurement, and a disclosed set of cycle input and actuator openings satisfy the stated deterministic replay and ordering procedure over the named disputed window. A verdict of certified_build_in_control means only that, for every opened cycle, the certified build supplied to the verifier reproduced the committed actuator output digest from the committed cycle inputs, that each input commitment instant preceded its output commitment instant within the declared drift allowance, and that the cycle chain and index sequence were unbroken across the window. A verdict of replay_not_evaluated means the verifier did not hold the certified build and therefore concluded nothing whatever about whether the certified build produced the disclosed actuator commands. This receipt does not establish that the sensor and command inputs committed at capture time reflected physical reality, so it does not exclude spoofing, jamming, or a faulty sensor upstream of the commitment. It does not establish that the certified build was correct, safe, adequate, or fit for the conditions it encountered, and it does not establish that a certified build that was in control behaved reasonably. It does not establish that the secure element that produced the build measurement and the cycle signatures was uncompromised at or before the first cycle of the window. It does not establish that the disclosed window is the operationally relevant window, that undisclosed cycles are unremarkable, or that any actuator command caused any outcome. This receipt decides no contractual, statutory, regulatory, evidentiary, certification, airworthiness, roadworthiness, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, grounding, or remedy."
        }
      }
    }
  }
}