{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/perf-attestation-v1.json",
  "title": "Bonded Performance Attestation, attestation leg, v1",
  "description": "Canonical schema for the Hive performance attestation receipt, canonical type perf.attestation. This is the second of the two receipts that make up a Bonded Performance Attestation. It links by receipt_id and payload_sha256 to a perf.budget receipt that was declared before the measurement window opened, binds the observed window, the measured distribution, and a signed response binding, and records a per threshold comparison and one overall outcome of pass, fail, or indeterminate. The comparison is recomputable from the two receipts, so a verifier reaches the outcome independently without altering either receipt. The receipt is evidence suitable for a parametric threshold. It does not create or confirm insurance coverage and does not attest that the output was correct.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_perf\\.attestation_[0-9]{10,}_[0-9a-f]{12}$",
      "description": "Receipt identifier, r_perf.attestation_<unix_seconds>_<12 hex chars>."
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$",
      "description": "Lowercase hex SHA-256 over the canonical serialisation of signed_body. Canonical form is JSON with keys sorted and no whitespace, encoded UTF-8."
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$",
      "description": "Base64url Ed25519 signature, no padding, over the ASCII string 'hive-receipt <receipt_id> <payload_sha256> <ts>'."
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$",
      "description": "Decentralised identifier of the signing key."
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519",
      "description": "Signature algorithm. Ed25519 for this schema version."
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000,
      "description": "Unix seconds at issuance. Covered by the signature."
    },
    "signed_body": {
      "type": "object",
      "description": "The signed attestation record. Every field here is covered by payload_sha256.",
      "required": [
        "receipt_type",
        "schema",
        "attestation_id",
        "tenant_id",
        "run_id",
        "budget_ref",
        "subject",
        "dimension",
        "unit",
        "observed_window",
        "distribution",
        "response_binding",
        "comparison",
        "outcome",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "perf.attestation"
        },
        "schema": {
          "type": "string",
          "enum": [
            "r1.0.0",
            "r1.1.0"
          ]
        },
        "attestation_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256
        },
        "tenant_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Must equal the tenant_id of the referenced budget."
        },
        "run_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Must equal the run_id of the referenced budget."
        },
        "budget_ref": {
          "type": "object",
          "description": "Cryptographic link to the exact perf.budget receipt this attestation is measured against. Both fields must match the budget receipt byte for byte. A payload_sha256 that does not match the budget body fails verification.",
          "required": [
            "receipt_id",
            "payload_sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "receipt_id": {
              "type": "string",
              "pattern": "^r_perf\\.budget_[0-9]{10,}_[0-9a-f]{12}$"
            },
            "payload_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$"
            }
          }
        },
        "subject": {
          "type": "object",
          "description": "Must match the subject of the referenced budget on model_id and provider.",
          "required": [
            "model_id",
            "provider"
          ],
          "additionalProperties": false,
          "properties": {
            "model_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "provider": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128
            },
            "endpoint": {
              "type": "string",
              "minLength": 1,
              "maxLength": 512
            },
            "cohort": {
              "type": "string",
              "minLength": 1,
              "maxLength": 128
            }
          }
        },
        "dimension": {
          "type": "string",
          "enum": [
            "latency_ms_total",
            "time_to_first_token_ms",
            "latency_ms_per_output_token",
            "throughput_tokens_per_s",
            "error_rate",
            "false_positive_rate",
            "false_negative_rate",
            "unsupported_claim_rate",
            "refusal_rate",
            "availability"
          ],
          "description": "Must equal the dimension of the referenced budget."
        },
        "unit": {
          "type": "string",
          "enum": [
            "ms",
            "tokens_per_s",
            "ratio"
          ],
          "description": "Must equal the unit of the referenced budget."
        },
        "observed_window": {
          "type": "object",
          "description": "The interval the measurements were drawn from. Must lie entirely inside the measurement_window of the referenced budget. The attestation receipt timestamp must be after ended_at.",
          "required": [
            "started_at",
            "ended_at"
          ],
          "additionalProperties": false,
          "properties": {
            "started_at": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            },
            "ended_at": {
              "type": "string",
              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
            }
          }
        },
        "distribution": {
          "type": "object",
          "description": "Summary statistics of the measured samples, in the declared unit. Percentile fields are required because every threshold metric must be resolvable from this object. The verifier checks the consistency of the signed distribution and the signed response binding. It does not recompute the distribution from raw observations unless that raw observation set is provided and processed by a separate tool.",
          "required": [
            "sample_count",
            "p50",
            "p95",
            "p99",
            "max",
            "mean"
          ],
          "additionalProperties": false,
          "properties": {
            "sample_count": {
              "type": "integer",
              "minimum": 0
            },
            "p50": {
              "type": "number"
            },
            "p95": {
              "type": "number"
            },
            "p99": {
              "type": "number"
            },
            "max": {
              "type": "number"
            },
            "mean": {
              "type": "number"
            },
            "sample_commitment": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "Optional commitment over the per sample measurements, for example a digest of the canonical sample list. Lets a holder of the raw samples prove the distribution was not substituted with a different measurement set."
            }
          }
        },
        "response_binding": {
          "type": "object",
          "description": "Required binding to the measured response set or observation manifest that produced these measurements. The manifest digest is signed here so the attestation cannot be detached from the response set it summarizes.",
          "required": [
            "binding_kind",
            "manifest_sha256"
          ],
          "additionalProperties": false,
          "properties": {
            "binding_kind": {
              "type": "string",
              "enum": [
                "response_set",
                "observation_manifest"
              ],
              "description": "What the manifest digest commits to: a set of measured responses or an observation manifest describing that set."
            },
            "manifest_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "SHA-256 of the canonical response set or observation manifest this attestation summarizes."
            },
            "manifest_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            },
            "receipt_id": {
              "type": "string",
              "minLength": 1,
              "maxLength": 256
            }
          }
        },
        "comparison": {
          "type": "array",
          "minItems": 1,
          "maxItems": 8,
          "description": "One entry per threshold in the referenced budget, in the same order. A verifier recomputes every entry from the budget thresholds and the distribution. Any divergence fails verification.",
          "items": {
            "type": "object",
            "required": [
              "metric",
              "comparator",
              "limit",
              "observed",
              "result"
            ],
            "additionalProperties": false,
            "properties": {
              "metric": {
                "type": "string",
                "enum": [
                  "p50",
                  "p95",
                  "p99",
                  "max",
                  "mean"
                ]
              },
              "comparator": {
                "type": "string",
                "enum": [
                  "lte",
                  "gte"
                ]
              },
              "limit": {
                "type": "number"
              },
              "observed": {
                "type": "number"
              },
              "result": {
                "type": "string",
                "enum": [
                  "pass",
                  "fail",
                  "indeterminate"
                ]
              }
            }
          }
        },
        "outcome": {
          "type": "string",
          "enum": [
            "pass",
            "fail",
            "indeterminate"
          ],
          "description": "Overall result. indeterminate if any clause is indeterminate, which includes the case where sample_count is below the budget min_samples. Otherwise fail if any clause failed, otherwise pass."
        },
        "boundary": {
          "type": "string",
          "const": "Bonded Performance Attestation binds a performance budget declared before the measurement window to a distribution measured inside that window and to a signed response binding for the measured response set or observation manifest. It is evidence suitable for a parametric threshold. It does not create or confirm insurance coverage, does not establish that any claim is payable, and does not attest that the output was correct."
        }
      }
    }
  }
}