{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/safety-envelope-v1.json",
  "title": "Safety Envelope Attestation Receipt, v1",
  "description": "Canonical schema for the Hive safety envelope attestation receipt, canonical type safety.envelope. The receipt records that a named safety envelope was evaluated before the actuation it names, and whether the evaluated pose and force stayed inside that envelope. It does not prove the envelope was correct, does not prove no person was harmed, and does not prove any sensor reading was truthful.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": { "type": "string", "pattern": "^r_safety\\.envelope_[0-9]{10,}_[0-9a-f]{12}$" },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "envelope_id",
        "machine_commitment",
        "envelope_commitment",
        "envelope_class",
        "evaluated_at",
        "actuation_commanded_at",
        "evaluation_lead_ms",
        "human_proximity_class",
        "limits",
        "observed",
        "envelope_disposition",
        "gate_outcome",
        "verdict",
        "salt_commitment",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "safety.envelope" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "envelope_id": { "type": "string", "pattern": "^se_[0-9a-f]{16,64}$" },
        "machine_commitment": {
          "type": "string",
          "description": "Salted HMAC over the machine serial. The serial itself is never carried.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "envelope_commitment": {
          "type": "string",
          "description": "Salted HMAC over the canonical envelope descriptor, so the envelope that was evaluated is fixed without publishing it.",
          "pattern": "^[0-9a-f]{64}$"
        },
        "envelope_class": {
          "type": "string",
          "description": "The collaborative operation class the envelope implements, as declared by the controller.",
          "enum": [
            "collaborative_speed_and_separation",
            "power_and_force_limited",
            "safety_rated_monitored_stop",
            "hand_guiding",
            "caged"
          ]
        },
        "evaluated_at": {
          "type": "string",
          "description": "The instant the envelope was evaluated.",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$"
        },
        "actuation_commanded_at": {
          "type": "string",
          "description": "The instant the motion command left the controller.",
          "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d{1,9})?Z$"
        },
        "evaluation_lead_ms": {
          "type": "integer",
          "description": "Recomputed by the service as actuation_commanded_at minus evaluated_at, in milliseconds.",
          "minimum": 0,
          "maximum": 86400000
        },
        "human_proximity_class": {
          "type": "string",
          "description": "What the proximity sensing reported at evaluation, as declared by the controller.",
          "enum": [
            "no_human_detected",
            "human_outside_envelope",
            "human_inside_warning_zone",
            "human_inside_protective_zone",
            "proximity_sensing_unavailable"
          ]
        },
        "limits": {
          "type": "object",
          "description": "The declared envelope limits. Speed and force are ceilings. Separation is a floor. At least one limit must be declared, because an envelope that declares nothing constrains nothing.",
          "additionalProperties": false,
          "properties": {
            "max_tcp_speed_mm_s": { "type": "number", "minimum": 0, "maximum": 20000 },
            "max_force_n": { "type": "number", "minimum": 0, "maximum": 20000 },
            "min_separation_mm": { "type": "number", "minimum": 0, "maximum": 100000 }
          }
        },
        "observed": {
          "type": "object",
          "description": "The values observed at evaluation, keyed the same way as limits. A null value records that the quantity was not observed, which makes the envelope unverifiable rather than satisfied.",
          "additionalProperties": false,
          "properties": {
            "max_tcp_speed_mm_s": { "type": ["number", "null"], "minimum": 0, "maximum": 20000 },
            "max_force_n": { "type": ["number", "null"], "minimum": 0, "maximum": 20000 },
            "min_separation_mm": { "type": ["number", "null"], "minimum": 0, "maximum": 100000 }
          }
        },
        "envelope_disposition": {
          "type": "string",
          "description": "Recomputed by the service from limits against observed. A ceiling is exceeded when the observed value is above it. A floor is exceeded when the observed value is below it.",
          "enum": ["inside_envelope", "outside_envelope", "limits_unverifiable"]
        },
        "gate_outcome": {
          "type": "string",
          "description": "What the controller asserts it did with the evaluation. Asserted, never derived.",
          "enum": ["permitted", "refused", "permitted_with_reduced_limits"]
        },
        "verdict": {
          "type": "string",
          "description": "Recomputed by the service from the ordering, the proximity sensing availability, and the envelope disposition. There is no verdict that asserts safety.",
          "enum": [
            "pre_effect_envelope_checked",
            "envelope_checked_but_exceeded",
            "ordering_not_established",
            "proximity_sensing_unavailable"
          ]
        },
        "salt_commitment": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
        "boundary": {
          "type": "string",
          "minLength": 1,
          "const": "This receipt records that a named safety envelope was evaluated before the actuation it names, and whether the evaluated pose and force stayed inside that envelope. It does not prove the envelope was correct, does not prove no person was harmed, and does not prove any sensor reading was truthful."
        }
      }
    }
  }
}