{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/imprimatur-clearance-v1.json",
  "title": "Imprimatur Clearance v1, pre-attestation clearance receipt",
  "description": "Canonical schema for the Hive Imprimatur clearance receipt, canonical type imprimatur.clearance. Binds four named pre-conditions (model_approved, inputs_eligible, context_permitted, boundary_authorized), each a caller supplied pass or fail leaf with its own evidence digest, into one Ed25519 signature over a recomputable payload_sha256 and a recomputable precond_root, together with an expiry. The receipt attests only that, at issuance, the four named pre-conditions were evaluated and combined exactly as recorded, that precond_root recomputes from the four leaves, and that the clearance is not being read past expires_at. It asserts pre_clearance_conditions_met, never legality, never that the inference which may follow actually ran as cleared, and never that any pre-condition's own evidence digest is itself accurate.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_imprimatur\\.clearance_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "clearance_id",
        "tenant_id",
        "request_ref",
        "preconditions",
        "precond_root",
        "assertion",
        "asserts_legal",
        "outcome",
        "issued_at",
        "expires_at",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "imprimatur.clearance"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "clearance_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256
        },
        "tenant_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256
        },
        "request_ref": {
          "type": "object",
          "description": "Digest of the inference request shape this clearance binds to. The signer never receives the raw request, only this commitment.",
          "required": [
            "model_ref",
            "input_commitment_sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "model_ref": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "input_commitment_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "jurisdiction": {
              "type": "string",
              "maxLength": 128
            },
            "data_class": {
              "type": "string",
              "maxLength": 128
            }
          }
        },
        "preconditions": {
          "type": "object",
          "description": "The four named pre-conditions. Each leaf is a caller supplied pass or fail plus an evidence digest for that determination. A clearance issues (outcome cleared) only when all four leaves are pass; the service computes outcome itself, it is never accepted as a caller supplied value.",
          "required": [
            "model_approved",
            "inputs_eligible",
            "context_permitted",
            "boundary_authorized"
          ],
          "additionalProperties": false,
          "properties": {
            "model_approved": {
              "type": "object",
              "required": [
                "status",
                "evidence_sha256"
              ],
              "additionalProperties": false,
              "properties": {
                "status": {
                  "type": "string",
                  "enum": [
                    "pass",
                    "fail"
                  ]
                },
                "evidence_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "note": {
                  "type": "string",
                  "maxLength": 512
                }
              }
            },
            "inputs_eligible": {
              "type": "object",
              "required": [
                "status",
                "evidence_sha256"
              ],
              "additionalProperties": false,
              "properties": {
                "status": {
                  "type": "string",
                  "enum": [
                    "pass",
                    "fail"
                  ]
                },
                "evidence_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "note": {
                  "type": "string",
                  "maxLength": 512
                }
              }
            },
            "context_permitted": {
              "type": "object",
              "required": [
                "status",
                "evidence_sha256"
              ],
              "additionalProperties": false,
              "properties": {
                "status": {
                  "type": "string",
                  "enum": [
                    "pass",
                    "fail"
                  ]
                },
                "evidence_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "note": {
                  "type": "string",
                  "maxLength": 512
                }
              }
            },
            "boundary_authorized": {
              "type": "object",
              "required": [
                "status",
                "evidence_sha256"
              ],
              "additionalProperties": false,
              "properties": {
                "status": {
                  "type": "string",
                  "enum": [
                    "pass",
                    "fail"
                  ]
                },
                "evidence_sha256": {
                  "type": "string",
                  "pattern": "^[0-9a-f]{64}$"
                },
                "note": {
                  "type": "string",
                  "maxLength": 512
                }
              }
            }
          }
        },
        "precond_root": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "sha256 fold of the four preconditions leaves in the fixed order model_approved, inputs_eligible, context_permitted, boundary_authorized. Recomputed by the verifier; a caller supplied precond_root that does not match the recomputation fails PRECOND_ROOT."
        },
        "assertion": {
          "type": "string",
          "const": "pre_clearance_conditions_met"
        },
        "asserts_legal": {
          "type": "boolean",
          "const": false,
          "description": "Always false. This receipt never asserts that the cleared inference is lawful, only that the four named policy pre-conditions were satisfied at issuance."
        },
        "outcome": {
          "type": "string",
          "enum": [
            "cleared",
            "refused"
          ],
          "description": "Computed by the signer from preconditions, never accepted as a caller supplied verdict. cleared requires all four leaves to be pass."
        },
        "issued_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "expires_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$",
          "description": "Must not precede issued_at. A clearance is fail closed past this instant regardless of outcome."
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that the four named pre-conditions in signed_body were evaluated and combined exactly as recorded, that precond_root recomputes from those four leaves, that outcome was computed from the leaves rather than supplied by the caller, and that the clearance was read at or before expires_at. It does not attest that any pre-condition's underlying evidence digest is itself accurate, does not assert that the cleared inference is lawful, and does not attest that any inference which follows actually ran as cleared. A separate Hive receipt for the executed inference is required to check whether the executed model matched request_ref.model_ref."
        }
      }
    }
  }
}