{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/knowledge-timestamp-v1.json",
  "title": "Knowledge Timestamp Receipt, v1",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_knowledge\\.timestamp_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "knowledge_id",
        "tenant_id",
        "event_class",
        "detecting_system",
        "indicator",
        "detected_at_local",
        "anchor",
        "sequence",
        "emitter",
        "forward_links",
        "incident_ref",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "knowledge.timestamp"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "knowledge_id": {
          "type": "string",
          "pattern": "^k_[0-9a-z_.-]{1,120}$"
        },
        "tenant_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256
        },
        "event_class": {
          "type": "string",
          "enum": [
            "systems_issue.indicator",
            "systems_issue.confirmed",
            "security.intrusion.indicator",
            "security.intrusion.confirmed",
            "data.exposure.indicator",
            "availability.degradation.indicator",
            "integrity.deviation.indicator",
            "other.indicator"
          ]
        },
        "event_class_note": {
          "type": "string",
          "minLength": 0,
          "maxLength": 200
        },
        "detecting_system": {
          "type": "object",
          "required": [
            "system_id",
            "system_class",
            "system_key_id",
            "software_digest_sha256",
            "software_version_label",
            "rule_version",
            "rule_digest_sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "system_id": {
              "type": "string",
              "pattern": "^[a-z0-9][a-z0-9-]{2,62}[a-z0-9]$"
            },
            "system_class": {
              "type": "string",
              "enum": [
                "monitoring",
                "intrusion_detection",
                "integrity_check",
                "capacity_monitor",
                "reconciliation",
                "other"
              ]
            },
            "system_key_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "software_digest_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "software_version_label": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128
            },
            "rule_version": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128
            },
            "rule_digest_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "indicator": {
          "type": "object",
          "required": [
            "artifact_class",
            "commitment_scheme",
            "digest_sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "artifact_class": {
              "type": "string",
              "enum": [
                "alert_record",
                "log_line",
                "metric_breach",
                "signature_hit",
                "reconciliation_break",
                "manual_report",
                "other"
              ]
            },
            "commitment_scheme": {
              "type": "string",
              "enum": [
                "sha256",
                "hmac_sha256_epoch_key"
              ]
            },
            "digest_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "salt_epoch": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
            },
            "artifact_byte_length": {
              "type": "integer",
              "minimum": 1,
              "maximum": 4294967296
            }
          }
        },
        "detected_at_local": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "anchor": {
          "type": "object",
          "required": [
            "time_source",
            "anchor_authority_id",
            "anchor_time",
            "drift_bound_ms",
            "local_offset_ms"
          ],
          "additionalProperties": false,
          "properties": {
            "time_source": {
              "type": "string",
              "enum": [
                "gnss_disciplined_ptp",
                "gnss_disciplined_ntp",
                "national_time_service",
                "timestamp_authority_token",
                "public_chain_head_witness",
                "multi_source_quorum"
              ]
            },
            "anchor_authority_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "anchor_time": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            },
            "drift_bound_ms": {
              "type": "integer",
              "minimum": 0,
              "maximum": 86400000
            },
            "local_offset_ms": {
              "type": "integer",
              "minimum": -86400000,
              "maximum": 86400000
            },
            "anchor_evidence_digest_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "sequence": {
          "type": "object",
          "required": [
            "chain_id",
            "ledger_seq",
            "prev_receipt_id",
            "prev_payload_sha256",
            "prev_anchor_time"
          ],
          "additionalProperties": false,
          "properties": {
            "chain_id": {
              "type": "string",
              "pattern": "^[a-z0-9][a-z0-9_.-]{2,126}[a-z0-9]$"
            },
            "ledger_seq": {
              "type": "integer",
              "minimum": 0
            },
            "prev_receipt_id": {
              "type": "string",
              "pattern": "^(genesis|r_[a-z0-9._]+_[0-9]{10,}_[0-9a-f]{12})$"
            },
            "prev_payload_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            },
            "prev_anchor_time": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            }
          }
        },
        "emitter": {
          "type": "object",
          "required": [
            "mode",
            "agent_id",
            "human_approval_present",
            "approval_principal",
            "approval_at",
            "mint_latency_ms",
            "mint_latency_bound_ms",
            "approval_gate_absent_assertion"
          ],
          "additionalProperties": false,
          "properties": {
            "mode": {
              "type": "string",
              "enum": [
                "autonomous",
                "human_approved",
                "human_initiated"
              ]
            },
            "agent_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "human_approval_present": {
              "type": "boolean"
            },
            "approval_principal": {
              "type": [
                "null",
                "string"
              ],
              "minLength": 1,
              "maxLength": 256
            },
            "approval_at": {
              "type": [
                "null",
                "string"
              ],
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            },
            "mint_latency_ms": {
              "type": "integer",
              "minimum": 0,
              "maximum": 604800000
            },
            "mint_latency_bound_ms": {
              "type": "integer",
              "minimum": 1,
              "maximum": 604800000
            },
            "approval_gate_absent_assertion": {
              "type": "boolean"
            }
          }
        },
        "forward_links": {
          "type": "array",
          "minItems": 0,
          "maxItems": 64,
          "items": {
            "type": "object",
            "required": [
              "ledger_seq",
              "receipt_id",
              "payload_sha256",
              "link_role",
              "direction"
            ],
            "additionalProperties": false,
            "properties": {
              "ledger_seq": {
                "type": "integer",
                "minimum": 0
              },
              "receipt_id": {
                "type": "string",
                "pattern": "^r_[a-z0-9._]+_[0-9]{10,}_[0-9a-f]{12}$"
              },
              "payload_sha256": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$"
              },
              "link_role": {
                "type": "string",
                "enum": [
                  "detection",
                  "escalation",
                  "assessment",
                  "materiality_determination",
                  "notification",
                  "remediation",
                  "closure"
                ]
              },
              "direction": {
                "type": "string",
                "enum": [
                  "backward",
                  "forward"
                ]
              }
            }
          }
        },
        "incident_ref": {
          "type": "object",
          "required": [
            "incident_id",
            "opened_seq"
          ],
          "additionalProperties": false,
          "properties": {
            "incident_id": {
              "type": "string",
              "pattern": "^i_[0-9a-f]{32}$"
            },
            "opened_seq": {
              "type": "integer",
              "minimum": 0
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests only that a named detecting system, running a digest pinned software build and a digest pinned rule version, committed the digest of a detection artifact at an instant supplied by a named external time anchor with a declared drift bound, at a stated position in a named append only hash chained sequence, with no human approval in its mint path. It bounds the latest instant at which that system can later be said to have first held the committed artifact, and it does not establish the earliest such instant. It does not attest that the detection was correct, that the committed artifact described a real condition, or that any condition existed at all, and it does not decide whether any response was reasonable, timely, adequate, or complete. It does not decide whether any materiality, significance, or de minimis assessment was right, it makes no such assessment, and it does not determine that any reporting obligation applies, that any deadline was met or missed, or that any rule, regulation, contract, or duty was complied with or breached. It does not identify any affected system, person, account, or asset, it does not disclose the content of the committed artifact, it does not authorise, require, or excuse any notification, escalation, disclosure, remediation, or enforcement action, and it fixes the timeline to which those judgments are applied and nothing more."
        }
      }
    }
  }
}