{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/sigr-manifest-v1.json",
  "title": "SiGR Manifest v1, streaming model manifest attestation receipt",
  "description": "Canonical schema for the Hive SiGR Manifest receipt, canonical type sigr.manifest. Binds a declared model manifest (weights digest, config digest, serving endpoint) into one Ed25519 signature over a recomputable payload_sha256 and a recomputable manifest_sha256. It is a TEE-less attestation: it proves the signer recorded exactly this weights_sha3, config_hash, and endpoint at issuance, and it lets a later receipt (for example sigr.mir) detect a substitution by comparing manifest_sha256 values. It does not attest that the endpoint is actually serving these weights right now, and it does not attest that the weights are free of vulnerabilities or backdoors.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_sigr\\.manifest_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "sig_b64u": { "type": "string", "pattern": "^[A-Za-z0-9_-]{86}$" },
    "key_id": { "type": "string", "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$" },
    "algorithm": { "type": "string", "const": "Ed25519" },
    "ts": { "type": "integer", "minimum": 1000000000 },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "manifest_id",
        "tenant_id",
        "model_id",
        "weights_sha3",
        "config_hash",
        "endpoint",
        "manifest_sha256",
        "issued_at",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": { "type": "string", "const": "sigr.manifest" },
        "schema": { "type": "string", "const": "r1.0.0" },
        "manifest_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "tenant_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "model_id": { "type": "string", "minLength": 1, "maxLength": 256 },
        "weights_sha3": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA3-256 digest of the model weights, hex encoded, same length as SHA-256 for this schema's purposes."
        },
        "config_hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
        "endpoint": {
          "type": "string",
          "minLength": 1,
          "maxLength": 500,
          "description": "The serving endpoint this manifest declares, for example a hostname and path. Recorded as a claim, not independently probed by the signer."
        },
        "manifest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Recomputed by the verifier as sha256 of the canonical concatenation of model_id, weights_sha3, config_hash, and endpoint. A caller supplied manifest_sha256 that does not match fails MANIFEST_DIGEST."
        },
        "issued_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "boundary": {
          "type": "string",
          "const": "This receipt attests that manifest_sha256 recomputes exactly from the recorded model_id, weights_sha3, config_hash, and endpoint, at issued_at. It does not attest that the named endpoint is currently serving these weights, that the weights are free of vulnerabilities or backdoors, or that config_hash describes a safe or correct configuration."
        }
      }
    }
  }
}