{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/proof-demand-v1.json",
  "title": "Proof Demand v1, Stipryn pre-submission proof-level binding",
  "description": "Canonical schema for the Hive pre-submission proof-level binding receipt, canonical type proof.demand, brand Stipryn. Binds a required proof level to anchored regions of a request, fixed before transmission by the party that composed the request and bears the consequence of a weak answer. The receipt covers the request only by a one way digest of its bytes, never the request content itself, and attests that the binding existed at declared_at, before submitted_at. It does not alter, inspect the meaning of, rewrite, or grade the request content, and it does not attest that any response later satisfied the bound requirement.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_proof\\.demand_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "demand_id",
        "tenant_id",
        "requesting_party",
        "request_digest",
        "anchored_regions",
        "declared_at",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "proof.demand" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "demand_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "tenant_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "requesting_party": {
          "type": "object",
          "description": "The party composing the request and bearing the consequence of a weak answer. This is who the binding is attributed to.",
          "required": ["party_id"],
          "additionalProperties": false,
          "properties": {
            "party_id": { "type": "string", "minLength": 1, "maxLength": 256 },
            "role": { "type": "string", "minLength": 1, "maxLength": 128 }
          }
        },
        "request_digest": {
          "type": "object",
          "description": "A one way fingerprint of the request as composed, never the request content. Stipryn analyzes and binds; it does not transmit, store, or expose the words of the request.",
          "required": ["scheme", "full_request_sha256"],
          "additionalProperties": false,
          "properties": {
            "scheme": { "type": "string", "const": "sha256-region-anchored-v1" },
            "full_request_sha256": {
              "type": "string",
              "pattern": "^[0-9a-f]{64}$",
              "description": "Digest over the full request as composed, at the moment the demand was bound, before transmission."
            }
          }
        },
        "anchored_regions": {
          "type": "array",
          "minItems": 1,
          "maxItems": 256,
          "description": "Regions of the request that carry evidentiary weight, each anchored to a byte range of the request and bound to a required proof level. The request itself is never altered by this binding; anchoring identifies which parts of the unmodified request the requirement attaches to.",
          "items": {
            "type": "object",
            "required": ["region_id", "anchor", "region_sha256", "required_proof_level"],
            "additionalProperties": false,
            "properties": {
              "region_id": { "type": "string", "minLength": 1, "maxLength": 256 },
              "anchor": {
                "type": "object",
                "description": "The byte range in the full request this region covers, so the requirement attaches to a specific part rather than the request as an undifferentiated whole.",
                "required": ["start", "end"],
                "additionalProperties": false,
                "properties": {
                  "start": { "type": "integer", "minimum": 0 },
                  "end": { "type": "integer", "minimum": 0 }
                }
              },
              "region_sha256": {
                "type": "string",
                "pattern": "^[0-9a-f]{64}$",
                "description": "Digest of the exact bytes of this anchored region, so a later dispute about which text the requirement covered can be checked without disclosing the region."
              },
              "required_proof_level": {
                "type": "string",
                "enum": ["none", "cited", "sourced", "verified", "attested"],
                "description": "The evidentiary bar fixed for this region. Ordered low to high: none, cited (a source is named), sourced (the source is identifiable and checkable), verified (the source has been independently checked), attested (a signed receipt must back the claim)."
              },
              "reason_code": { "type": "string", "minLength": 1, "maxLength": 128 }
            }
          }
        },
        "declared_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$",
          "description": "When the requirement was bound. Must not follow submitted_at, so the binding predates transmission."
        },
        "submitted_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$",
          "description": "When the request was actually transmitted downstream, if known at mint time. Optional, because a demand can be bound slightly before the caller reports transmission separately; when present it must not precede declared_at."
        },
        "regions_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Digest over the canonical serialisation of anchored_regions, recomputed on every verification rather than trusted as supplied, binding the exact set and order of graded regions to the signature."
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that anchored_regions and its required_proof_level values were bound at declared_at, before the request identified by request_digest was transmitted, and that regions_sha256 recomputes canonically from anchored_regions. It does not attest that the request content is good, true, or complete, it does not alter or transmit the request, it does not attest that any downstream response met the required proof level, and it does not require the receiving party's cooperation to exist. The party bearing the consequence of the request retains full control of the request; this receipt only fixes, in advance, the evidentiary bar that response will later be measured against."
        }
      }
    }
  }
}