{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/sigr-gitm-v1.json",
  "title": "SiGR GiTM v1, cross-signal anomaly flag receipt",
  "description": "Canonical schema for the Hive GiTM (Grounding-in-the-Middle anomaly) receipt, canonical type sigr.gitm. Binds five named boolean anomaly signals into one Ed25519 signature over a recomputable payload_sha256 and a service computed trigger determination. GiTM asserts only that a provenance anomaly pattern was observed across the named signals; it never asserts that anything is factually wrong, malicious, or true. A caller cannot force triggered to a value the signals do not support.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_sigr\\.gitm_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "subject_id",
        "tenant_id",
        "signals",
        "trigger_bp",
        "triggered",
        "assertion",
        "flagged_at",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "sigr.gitm" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "subject_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "tenant_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "signals": {
          "type": "object",
          "required": ["grounding_anomaly", "identity_flicker", "chain_irregularity", "cross_run_divergence", "under_attested_high_stakes"],
          "additionalProperties": false,
          "properties": {
            "grounding_anomaly": { "type": "boolean" },
            "identity_flicker": { "type": "boolean" },
            "chain_irregularity": { "type": "boolean" },
            "cross_run_divergence": { "type": "boolean" },
            "under_attested_high_stakes": { "type": "boolean" }
          }
        },
        "trigger_bp": {
          "type": "integer",
          "minimum": 0,
          "maximum": 10000,
          "description": "Basis points threshold on the fraction of true signals required for triggered to be true. Default policy is any single true signal triggers (see triggered description); a tenant may declare a stricter threshold here."
        },
        "triggered": {
          "type": "boolean",
          "description": "Recomputed by the verifier: true when the fraction of true signals, in basis points (out of 5 signals, each worth 2000bp), meets or exceeds trigger_bp. Never accepted as a caller supplied verdict."
        },
        "assertion": {
          "type": "string",
          "const": "provenance_anomaly_pattern_observed"
        },
        "flagged_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that triggered recomputes exactly from the five named boolean signals and trigger_bp. It asserts provenance_anomaly_pattern_observed only. It does not assert that anything is factually wrong, does not assert malicious intent, and does not assert that the underlying content is false or true."
        }
      }
    }
  }
}