{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/decision-provenance-v1.json",
  "title": "Decision Provenance Binding v1",
  "description": "Decision Provenance Binding receipt. A value read off a document usually gets normalized, enriched, aggregated, and scored before anything is decided on it, so this receipt binds the value as read to the value the decision actually relied on, with every step in between carrying the digest it consumed, the digest it emitted, the transform that ran, and the key of the actor that ran it. The service confirms the chain links, reports the first place it breaks, and where per step value commitments are supplied it reports the step at which the value first changed. It does not re-execute the pipeline and does not attest that the decision was correct or lawful; steps_reexecuted_by_service is fixed to false.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_decision\\.provenance_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "decision_id",
        "evidence_digest_sha256",
        "recorded_at",
        "verdict",
        "boundary",
        "reading_attestation_ref",
        "field_path",
        "value_as_read_commitment_sha256",
        "steps",
        "value_as_relied_upon_commitment_sha256",
        "decision_record_digest_sha256",
        "decision_adverse",
        "decided_at"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "decision.provenance"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "decision_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9._:-]{1,256}$"
        },
        "evidence_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA-256 of the caller-held evidence bundle this receipt attests was recorded. The service never receives or inspects the underlying evidence, only its digest."
        },
        "recorded_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "verdict": {
          "type": "object",
          "description": "Service-computed honesty boundary fields. Never caller overridable; recomputed and checked at verify time.",
          "required": [
            "steps_reexecuted_by_service",
            "decision_correctness_proven",
            "step_count",
            "step_index_contiguous",
            "step_chain_linked",
            "first_chain_break_step_index",
            "value_changed_between_read_and_reliance",
            "value_first_changed_at_step_index",
            "human_override_step_count"
          ],
          "additionalProperties": false,
          "properties": {
            "steps_reexecuted_by_service": {
              "type": "boolean",
              "const": false
            },
            "decision_correctness_proven": {
              "type": "boolean",
              "const": false
            },
            "step_count": {
              "type": "integer",
              "minimum": 0
            },
            "step_index_contiguous": {
              "type": "boolean"
            },
            "step_chain_linked": {
              "type": "boolean"
            },
            "first_chain_break_step_index": {
              "type": "integer",
              "minimum": -1
            },
            "value_changed_between_read_and_reliance": {
              "type": "boolean"
            },
            "value_first_changed_at_step_index": {
              "type": "integer",
              "minimum": -1
            },
            "human_override_step_count": {
              "type": "integer",
              "minimum": 0
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "Decision Provenance Binding receipt. A value read off a document usually gets normalized, enriched, aggregated, and scored before anything is decided on it, so this receipt binds the value as read to the value the decision actually relied on, with every step in between carrying the digest it consumed, the digest it emitted, the transform that ran, and the key of the actor that ran it. The service confirms the chain links, reports the first place it breaks, and where per step value commitments are supplied it reports the step at which the value first changed. It does not re-execute the pipeline and does not attest that the decision was correct or lawful; steps_reexecuted_by_service is fixed to false."
        },
        "reading_attestation_ref": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Reference to the attestation of the reading this decision started from."
        },
        "field_path": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Path to the field within that attestation."
        },
        "value_as_read_commitment_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Salted commitment to the value as it was read."
        },
        "steps": {
          "type": "array",
          "minItems": 1,
          "maxItems": 128,
          "items": {
            "type": "object",
            "required": [
              "index_value",
              "role",
              "consumed_state_digest_sha256",
              "emitted_state_digest_sha256",
              "transform_ref",
              "transform_version",
              "actor_key_id"
            ],
            "additionalProperties": false,
            "properties": {
              "index_value": {
                "type": "integer",
                "minimum": 0,
                "maximum": 127
              },
              "role": {
                "type": "string",
                "enum": [
                  "normalize",
                  "enrich",
                  "aggregate",
                  "score",
                  "apply_policy",
                  "override",
                  "decide"
                ]
              },
              "consumed_state_digest_sha256": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$",
                "description": "Digest of the state this step consumed."
              },
              "emitted_state_digest_sha256": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$",
                "description": "Digest of the state this step emitted."
              },
              "transform_ref": {
                "type": "string",
                "minLength": 1,
                "maxLength": 256,
                "description": "Named transform that ran."
              },
              "transform_version": {
                "type": "string",
                "minLength": 1,
                "maxLength": 256,
                "description": "Version of that transform."
              },
              "actor_key_id": {
                "type": "string",
                "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
              },
              "value_commitment_sha256": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$",
                "description": "Optional. Commitment to the value of the tracked field as it stood after this step."
              },
              "override_present": {
                "type": "boolean",
                "description": "Optional. Whether a human override was applied at this step."
              },
              "override_reason_code": {
                "type": "string",
                "minLength": 1,
                "maxLength": 256,
                "description": "Optional. Reason code for that override. No operator identity, only an opaque reference."
              },
              "override_operator_ref": {
                "type": "string",
                "minLength": 1,
                "maxLength": 256,
                "description": "Optional. Opaque reference to the operator."
              }
            }
          }
        },
        "value_as_relied_upon_commitment_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Salted commitment to the value the decision actually relied on."
        },
        "decision_record_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Digest of the decision record."
        },
        "decision_adverse": {
          "type": "boolean",
          "description": "Whether the decision went against the subject."
        },
        "decided_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$",
          "description": "Instant of decision."
        }
      }
    }
  }
}