{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/usap-pbs-v1.json",
  "title": "Provenance-Bonded Sandbox v1",
  "description": "Provenance-Bonded Sandbox receipt. Attests that a sandbox_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live. It does not attest that any kernel or eBPF hook actually enforced the declared sandbox boundary, or that runtime drift was actually detected; ebpf_integration_status is fixed to not_proven because no such integration exists in this repository.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_usap\\.pbs_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "sandbox_id",
        "evidence_digest_sha256",
        "recorded_at",
        "verdict",
        "boundary"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "usap.pbs"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "sandbox_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9._:-]{1,256}$"
        },
        "evidence_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA-256 of the caller-held evidence bundle this receipt attests was recorded. The service never receives or inspects the underlying evidence, only its digest."
        },
        "recorded_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "verdict": {
          "type": "object",
          "description": "Service-computed honesty boundary fields. Never caller overridable; recomputed and checked at verify time.",
          "required": [
            "crypto_core_status",
            "ebpf_integration_status"
          ],
          "additionalProperties": false,
          "properties": {
            "crypto_core_status": {
              "type": "string",
              "const": "live"
            },
            "ebpf_integration_status": {
              "type": "string",
              "const": "not_proven"
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "Provenance-Bonded Sandbox receipt. Attests that a sandbox_id and a caller held evidence digest were recorded and signed at recorded_at, and that the crypto envelope itself is live. It does not attest that any kernel or eBPF hook actually enforced the declared sandbox boundary, or that runtime drift was actually detected; ebpf_integration_status is fixed to not_proven because no such integration exists in this repository."
        }
      }
    }
  }
}