{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/erasure-receipt-v1.json",
  "title": "Erasure Receipt, v1",
  "description": "Canonical schema for the Hive erasure receipt, canonical type erasure.receipt. The instrument reports that one data object was removed from a published active set rather than marked deleted: the object leaf recomputes to a signed pre deletion active set root, the empty leaf recomputes to a post deletion root over the same witness path, the transition between the two roots is the removal of that single leaf and nothing else, the per object data encryption key carries a signed destruction record bound to the same salted object identifier commitment, and a signed replica manifest carries a destruction attestation for every replica class recorded at ingestion.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_erasure[.]receipt_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "erasure_id",
        "object",
        "ingestion",
        "before_root",
        "after_root",
        "witness_before",
        "witness_after",
        "request",
        "deletion",
        "key_destruction",
        "replica_manifest",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "erasure.receipt"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "erasure_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$"
        },
        "object": {
          "type": "object",
          "required": [
            "salt_commitment",
            "object_commitment",
            "last_access_at"
          ],
          "additionalProperties": false,
          "properties": {
            "salt_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "object_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "last_access_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            }
          }
        },
        "ingestion": {
          "type": "object",
          "required": [
            "ingestion_commitment",
            "replica_class_count",
            "replica_class_commitments"
          ],
          "additionalProperties": false,
          "properties": {
            "ingestion_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "replica_class_count": {
              "type": "integer",
              "minimum": 1,
              "maximum": 64
            },
            "replica_class_commitments": {
              "type": "array",
              "minItems": 1,
              "maxItems": 64,
              "items": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              }
            }
          }
        },
        "before_root": {
          "type": "object",
          "required": [
            "value",
            "tree_depth",
            "prior_receipt"
          ],
          "additionalProperties": false,
          "properties": {
            "value": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "tree_depth": {
              "type": "integer",
              "minimum": 1,
              "maximum": 256
            },
            "prior_receipt": {
              "type": "object",
              "required": [
                "receipt_id",
                "receipt_type",
                "envelope_sha256",
                "issuance_instant"
              ],
              "additionalProperties": false,
              "properties": {
                "receipt_id": {
                  "type": "string",
                  "minLength": 1,
                  "maxLength": 256
                },
                "receipt_type": {
                  "type": "string",
                  "const": "erasure.activeset"
                },
                "envelope_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "issuance_instant": {
                  "type": "object",
                  "required": [
                    "utc",
                    "drift_seconds"
                  ],
                  "additionalProperties": false,
                  "properties": {
                    "utc": {
                      "type": "string",
                      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                    },
                    "drift_seconds": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 86400
                    }
                  }
                }
              }
            }
          }
        },
        "after_root": {
          "type": "object",
          "required": [
            "value",
            "anchored_at"
          ],
          "additionalProperties": false,
          "properties": {
            "value": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "anchored_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            }
          }
        },
        "witness_before": {
          "type": "object",
          "required": [
            "siblings"
          ],
          "additionalProperties": false,
          "properties": {
            "siblings": {
              "type": "array",
              "minItems": 1,
              "maxItems": 256,
              "items": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              }
            }
          }
        },
        "witness_after": {
          "type": "object",
          "required": [
            "siblings"
          ],
          "additionalProperties": false,
          "properties": {
            "siblings": {
              "type": "array",
              "minItems": 1,
              "maxItems": 256,
              "items": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              }
            }
          }
        },
        "request": {
          "type": "object",
          "required": [
            "instant"
          ],
          "additionalProperties": false,
          "properties": {
            "instant": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            }
          }
        },
        "deletion": {
          "type": "object",
          "required": [
            "completed_at",
            "retention_expires_at"
          ],
          "additionalProperties": false,
          "properties": {
            "completed_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "retention_expires_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            }
          }
        },
        "key_destruction": {
          "type": "object",
          "required": [
            "custodian_key_id",
            "object_commitment",
            "dek_commitment",
            "kek_commitment",
            "method_code",
            "destroyed_at",
            "record_digest",
            "sig_b64u"
          ],
          "additionalProperties": false,
          "properties": {
            "custodian_key_id": {
              "type": "string",
              "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
            },
            "object_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "dek_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "kek_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "method_code": {
              "type": "string",
              "enum": [
                "kms_key_destroy",
                "hsm_zeroize",
                "crypto_shred_wrapped_key",
                "key_material_overwrite"
              ]
            },
            "destroyed_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "record_digest": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "sig_b64u": {
              "type": "string",
              "pattern": "^[A-Za-z0-9_-]{86}$"
            }
          }
        },
        "replica_manifest": {
          "type": "object",
          "required": [
            "custodian_key_id",
            "attested_at",
            "manifest_commitment",
            "attestations",
            "sig_b64u"
          ],
          "additionalProperties": false,
          "properties": {
            "custodian_key_id": {
              "type": "string",
              "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
            },
            "attested_at": {
              "type": "object",
              "required": [
                "utc",
                "drift_seconds"
              ],
              "additionalProperties": false,
              "properties": {
                "utc": {
                  "type": "string",
                  "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                },
                "drift_seconds": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 86400
                }
              }
            },
            "manifest_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "attestations": {
              "type": "array",
              "minItems": 1,
              "maxItems": 64,
              "items": {
                "type": "object",
                "required": [
                  "replica_class_commitment",
                  "method_code",
                  "destroyed_at",
                  "attestation_digest"
                ],
                "additionalProperties": false,
                "properties": {
                  "replica_class_commitment": {
                    "type": "string",
                    "pattern": "^[0-9a-f]{64}$"
                  },
                  "method_code": {
                    "type": "string",
                    "enum": [
                      "crypto_shred",
                      "block_erase",
                      "overwrite_in_place",
                      "media_destruction",
                      "index_purge"
                    ]
                  },
                  "destroyed_at": {
                    "type": "object",
                    "required": [
                      "utc",
                      "drift_seconds"
                    ],
                    "additionalProperties": false,
                    "properties": {
                      "utc": {
                        "type": "string",
                        "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
                      },
                      "drift_seconds": {
                        "type": "integer",
                        "minimum": 0,
                        "maximum": 86400
                      }
                    }
                  },
                  "attestation_digest": {
                    "type": "string",
                    "pattern": "^[0-9a-f]{64}$"
                  }
                }
              }
            },
            "sig_b64u": {
              "type": "string",
              "pattern": "^[A-Za-z0-9_-]{86}$"
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests only that one salted object identifier commitment recomputes as a member of a signed pre deletion active set root, recomputes as a non member of a post deletion root over the same disclosed witness path, carries a signed data encryption key destruction record bound to that same commitment, and carries a signed replica manifest whose per replica destruction attestations cover the replica class set recorded at ingestion, all under the stated deterministic procedure and ordering allowances. It does not establish that the active set enumerated every copy of the object that ever existed, that the replica manifest enumerates every replica, backup, snapshot, cache, or export that held it, or that no offline or hidden copy was taken before the deletion. It does not establish that the object was ever admitted to the active set in the first place, that the reported destruction methods rendered any storage medium unrecoverable, or that the key and replica custodians are complete, honest, or diligent. It does not establish erasure of derived data, aggregates, embeddings, logs, or backups outside the manifest, and it decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy."
        }
      }
    }
  }
}