{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/tolerance-bond-v1.json",
  "title": "Issue-Time Tolerance Bond v1",
  "description": "Issue-Time Tolerance Bond receipt. The maximum permitted distance, the metric that measures it, and the instant it was fixed are all inside the signed body, so the tolerance that governs a later comparison is settled before that comparison happens and a verifier cannot substitute a bound of its own. When the caller supplies an observed digest and an observed distance, the service recomputes the comparison outcome from the signed tolerance and reports it. It does not render the page, reproduce the committed render profile, or measure the distance itself; profile_reproduced_by_service and distance_measured_by_service are fixed to false because the service never receives the raster, and a party that cannot reproduce the committed profile gets an indeterminate outcome for that scope rather than an adverse one.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_tolerance\\.bond_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "bond_id",
        "evidence_digest_sha256",
        "recorded_at",
        "verdict",
        "boundary",
        "render_profile_digest_sha256",
        "scope_ref",
        "committed_digest_sha256",
        "metric_id",
        "metric_version",
        "metric_units",
        "max_permitted_distance",
        "distance_fixed_at"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "tolerance.bond"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "bond_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9._:-]{1,256}$"
        },
        "evidence_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA-256 of the caller-held evidence bundle this receipt attests was recorded. The service never receives or inspects the underlying evidence, only its digest."
        },
        "recorded_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "verdict": {
          "type": "object",
          "description": "Service-computed honesty boundary fields. Never caller overridable; recomputed and checked at verify time.",
          "required": [
            "verifier_supplied_bound_refused",
            "profile_reproduced_by_service",
            "distance_measured_by_service",
            "comparison_outcome",
            "tolerance_fixed_before_this_receipt",
            "tolerance_denominated_in_declared_units"
          ],
          "additionalProperties": false,
          "properties": {
            "verifier_supplied_bound_refused": {
              "type": "boolean",
              "const": true
            },
            "profile_reproduced_by_service": {
              "type": "boolean",
              "const": false
            },
            "distance_measured_by_service": {
              "type": "boolean",
              "const": false
            },
            "comparison_outcome": {
              "type": "string",
              "enum": [
                "not_yet_compared",
                "equivalent_exact",
                "equivalent_within_signed_tolerance",
                "outside_signed_tolerance",
                "indeterminate_profile_not_reproduced",
                "indeterminate_distance_not_supplied"
              ]
            },
            "tolerance_fixed_before_this_receipt": {
              "type": "boolean"
            },
            "tolerance_denominated_in_declared_units": {
              "type": "boolean"
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "Issue-Time Tolerance Bond receipt. The maximum permitted distance, the metric that measures it, and the instant it was fixed are all inside the signed body, so the tolerance that governs a later comparison is settled before that comparison happens and a verifier cannot substitute a bound of its own. When the caller supplies an observed digest and an observed distance, the service recomputes the comparison outcome from the signed tolerance and reports it. It does not render the page, reproduce the committed render profile, or measure the distance itself; profile_reproduced_by_service and distance_measured_by_service are fixed to false because the service never receives the raster, and a party that cannot reproduce the committed profile gets an indeterminate outcome for that scope rather than an adverse one."
        },
        "render_profile_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Digest of the render profile every raster derived commitment in this body is expressed against."
        },
        "scope_ref": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Reference to the scope of the rendered page this bond governs, expressed in the pixel space of the committed profile."
        },
        "committed_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Exact digest of the pixel block of the committed scope, as computed at issuance."
        },
        "metric_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Identifier of the distance metric the tolerance is denominated in."
        },
        "metric_version": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Version of that metric."
        },
        "metric_units": {
          "type": "string",
          "minLength": 1,
          "maxLength": 64,
          "description": "Declared units of the metric, so a bound is never a bare number."
        },
        "max_permitted_distance": {
          "type": "number",
          "minimum": 0,
          "description": "Maximum distance under the committed metric that still counts as equivalent for this scope."
        },
        "distance_fixed_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$",
          "description": "Instant the maximum permitted distance was fixed. Must not be later than recorded_at."
        },
        "observed_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Optional. Exact digest recomputed by the caller from the scope at comparison time."
        },
        "observed_distance": {
          "type": "number",
          "minimum": 0,
          "description": "Optional. Distance the caller measured under the committed metric."
        },
        "profile_reproduced_by_caller": {
          "type": "boolean",
          "description": "Optional. Whether the comparing party was able to reproduce the committed render profile."
        }
      }
    }
  }
}