{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/divergence-record-v1.json",
  "title": "Divergence Record v1, Multi Source Divergence Detection",
  "description": "Canonical schema for the Hive Multi Source Divergence Detection receipt, canonical type divergence.record, brand MSDD. Binds a provider assertion and a separately observed value to the same response content, kept apart rather than reconciled into one figure, so a verifier can read agreement or divergence directly from the signed structure. Requires no access to either the asserting provider's execution environment or the observer's collection environment, and requires no trusted execution environment. It attests that assertion and observation, when both present, are each bound to response_sha256 and that their comparison state is computed correctly from the two field values as supplied. It does not attest that either the assertion or the observation is itself true, and it does not identify the cause of a divergence.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_divergence\\.record_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "record_id",
        "tenant_id",
        "response_sha256",
        "field",
        "assertion",
        "comparison_state",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "divergence.record" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "record_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "tenant_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "response_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Digest of the specific response content both the assertion and the observation are about, so the comparison attaches to specific content rather than to a run in general."
        },
        "field": {
          "type": "string",
          "minLength": 1,
          "maxLength": 128,
          "description": "The name of the field being compared, for example model_id, build_id, or region. Opaque to this schema; interpretation is the caller's."
        },
        "assertion": {
          "type": "object",
          "description": "What the provider itself stated. Its evidentiary basis travels with it, so nobody downstream mistakes a relayed value for a witnessed one.",
          "required": ["value_sha256", "source", "basis"],
          "additionalProperties": false,
          "properties": {
            "value_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "Digest of the asserted value, never the value itself, so a comparison is possible without disclosing the underlying value in the receipt."
            },
            "source": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256,
              "description": "Identifies who or what made the assertion, for example the provider's own API response field."
            },
            "basis": {
              "type": "string",
              "const": "relayed",
              "description": "Fixed to relayed. An assertion is, by construction, a statement the provider makes about itself, not an independently witnessed fact. This schema does not let an assertion be relabelled as observed."
            }
          }
        },
        "observation": {
          "type": "object",
          "description": "A value collected from a source other than the provider's own reporting path, which is the entire reason it can corroborate or contradict the assertion. Optional: absence of an observation is itself recorded, honestly, as corroboration being unavailable, not as a failure.",
          "required": ["value_sha256", "source", "basis", "collection_method"],
          "additionalProperties": false,
          "properties": {
            "value_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "Digest of the separately observed value, never the value itself."
            },
            "source": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256,
              "description": "Identifies the independent source of the observation. Must be distinct from assertion.source for this record to carry corroborating value; the DISTINCT_SOURCE gate checks this."
            },
            "basis": {
              "type": "string",
              "const": "observed",
              "description": "Fixed to observed. This schema does not let an observation be relabelled as an assertion."
            },
            "collection_method": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256,
              "description": "How the observation was collected, for example response header inspection, side channel timing, or an independent probe. Recorded so a verifier can judge the strength of the corroboration; this receipt does not grade collection_method itself."
            }
          }
        },
        "comparison_state": {
          "type": "string",
          "enum": ["agreement", "divergence", "single_source_assertion_only"],
          "description": "agreement: assertion.value_sha256 equals observation.value_sha256 for this response. divergence: they differ. single_source_assertion_only: no observation is bound; corroboration is absent, and this states that plainly rather than defaulting to agreement."
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that assertion and observation, when both present, are each bound to response_sha256, that comparison_state correctly reflects whether assertion.value_sha256 equals observation.value_sha256 or that no observation was bound, and that assertion.basis is always relayed while observation.basis, when present, is always observed. It does not attest that the asserted value is true, does not attest that the observed value is true, does not merge or reconcile the two values into one figure, and does not identify the cause of a divergence when one is present. It requires no access to the provider's execution environment, no access to the observer's collection environment, and no trusted execution environment."
        }
      }
    }
  }
}