{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/retention-purge-v1.json",
  "title": "Retention Purge Receipt, v1",
  "description": "Canonical schema for the Hive retention purge receipt, canonical type retention.purge. The instrument is the policy layer above an erasure receipt: it binds a recorded deletion event, evidenced by a linked prior erasure receipt, to the named retention policy version whose text digest was published by a prior commitment receipt issued at or before the recorded retention start, recomputes the due instant and the grace expiry from the policy numbers, and reports the coverage relation between the deleted count and the scope object count and the timeliness relation between the recorded deletion instant and the window that policy version described, using the latest and earliest possible instants under the declared drift bounds.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^r_retention[.]purge_[0-9]{10,}_[0-9a-f]{12}$" },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "purge_id",
        "policy",
        "scope",
        "trigger",
        "deletion",
        "coverage_relation",
        "timeliness_relation",
        "verdict",
        "salt_commitment",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "retention.purge" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "purge_id": { "type": "string", "pattern": "^rp_[0-9a-f]{16,64}$" },
        "policy": {
          "type": "object",
          "required": [
            "policy_id",
            "policy_version",
            "policy_digest",
            "retention_days",
            "grace_days",
            "committed_receipt"
          ],
          "additionalProperties": false,
          "properties": {
            "policy_id": { "type": "string", "pattern": "^pol_[0-9a-z][0-9a-z._-]{0,47}$" },
            "policy_version": { "type": "string", "pattern": "^[0-9a-zA-Z][0-9a-zA-Z._-]{0,31}$" },
            "policy_digest": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "retention_days": { "type": "integer", "minimum": 0, "maximum": 36500 },
            "grace_days": { "type": "integer", "minimum": 0, "maximum": 3650 },
            "committed_receipt": {
              "type": "object",
              "required": ["receipt_id", "receipt_type", "envelope_sha256", "issuance_instant"],
              "additionalProperties": false,
              "properties": {
                "receipt_id": { "type": "string", "minLength": 1, "maxLength": 256 },
                "receipt_type": { "type": "string", "const": "policy.commitment" },
                "envelope_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "issuance_instant": {
                  "type": "object",
                  "required": ["utc", "drift_seconds"],
                  "additionalProperties": false,
                  "properties": {
                    "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                    "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
                  }
                }
              }
            }
          }
        },
        "scope": {
          "type": "object",
          "required": ["scope_commitment", "object_count", "scope_class"],
          "additionalProperties": false,
          "properties": {
            "scope_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
            "object_count": { "type": "integer", "minimum": 1, "maximum": 1000000000 },
            "scope_class": {
              "type": "string",
              "enum": ["named_object_set", "subject_record_set", "derived_artifact_set"]
            }
          }
        },
        "trigger": {
          "type": "object",
          "required": ["retention_start", "due_at", "grace_expires_at"],
          "additionalProperties": false,
          "properties": {
            "retention_start": {
              "type": "object",
              "required": ["utc", "drift_seconds"],
              "additionalProperties": false,
              "properties": {
                "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
              }
            },
            "due_at": {
              "type": "object",
              "required": ["utc", "drift_seconds"],
              "additionalProperties": false,
              "properties": {
                "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
              }
            },
            "grace_expires_at": {
              "type": "object",
              "required": ["utc", "drift_seconds"],
              "additionalProperties": false,
              "properties": {
                "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
              }
            }
          }
        },
        "deletion": {
          "type": "object",
          "required": ["executed_at", "execution_class", "deleted_count", "erasure_receipt"],
          "additionalProperties": false,
          "properties": {
            "executed_at": {
              "type": "object",
              "required": ["utc", "drift_seconds"],
              "additionalProperties": false,
              "properties": {
                "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
              }
            },
            "execution_class": {
              "type": "string",
              "enum": ["deletion_executed", "deletion_partially_executed", "deletion_not_executed"]
            },
            "deleted_count": { "type": "integer", "minimum": 0, "maximum": 1000000000 },
            "erasure_receipt": {
              "type": "object",
              "required": ["receipt_id", "receipt_type", "envelope_sha256", "issuance_instant"],
              "additionalProperties": false,
              "properties": {
                "receipt_id": { "type": "string", "minLength": 1, "maxLength": 256 },
                "receipt_type": { "type": "string", "const": "erasure.receipt" },
                "envelope_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
                "issuance_instant": {
                  "type": "object",
                  "required": ["utc", "drift_seconds"],
                  "additionalProperties": false,
                  "properties": {
                    "utc": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$" },
                    "drift_seconds": { "type": "integer", "minimum": 0, "maximum": 86400 }
                  }
                }
              }
            }
          }
        },
        "coverage_relation": {
          "type": "string",
          "enum": ["every_object_covered", "some_objects_not_covered", "no_objects_covered"]
        },
        "timeliness_relation": {
          "type": "string",
          "enum": [
            "deleted_within_window",
            "deleted_within_grace",
            "deleted_after_grace",
            "deleted_before_due",
            "timeliness_indeterminate"
          ]
        },
        "verdict": {
          "type": "string",
          "enum": [
            "purge_recorded_consistent_with_policy",
            "purge_recorded_inconsistent_with_policy",
            "purge_not_recorded"
          ]
        },
        "salt_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
        "boundary": {
          "type": "string",
          "minLength": 1,
          "const": "This receipt attests only that a deletion event, evidenced by a linked prior erasure receipt, was recorded against a named retention policy at a named version whose text digest was published by a prior commitment receipt issued at or before the recorded retention start, and how the recorded deletion instant relates, under the declared drift bounds, to the window that policy version described. It does not establish that no copy of the named data exists anywhere, that backups, caches, exports, printouts, downstream recipients, or third party systems were reached, that the policy version was itself adequate for any purpose, that any rule was satisfied, or that anything was removed beyond the scope commitment recorded here. Every party, object set, and scope descriptor is presented as a salted commitment, and the counts and instants are recorded as reported by the executing system."
        }
      }
    }
  }
}