{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://thehiveryiq.com/.well-known/schemas/verdict-custody-v1.json",
  "title": "Verdict Custody Declaration v1",
  "description": "Verdict Custody Declaration receipt. It names, inside the signed body, which fields of an issued receipt the issuing service computes and which fields the party requesting issuance may set, and the service recomputes whether those two sets overlap. An overlap is reported as a count and a boolean, so a claim that a verdict is service-held is checkable rather than asserted. It does not inspect any other receipt to confirm the declared split was actually enforced there; enforcement_confirmed_on_other_receipts is fixed to false because this receipt only carries the declaration.",
  "type": "object",
  "required": [
    "receipt_id",
    "payload_sha256",
    "sig_b64u",
    "key_id",
    "algorithm",
    "ts",
    "signed_body"
  ],
  "additionalProperties": false,
  "properties": {
    "receipt_id": {
      "type": "string",
      "pattern": "^r_verdict\\.custody_[0-9]{10,}_[0-9a-f]{12}$"
    },
    "payload_sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "sig_b64u": {
      "type": "string",
      "pattern": "^[A-Za-z0-9_-]{86}$"
    },
    "key_id": {
      "type": "string",
      "pattern": "^did:(hive|web|key):[A-Za-z0-9._:%-]+$"
    },
    "algorithm": {
      "type": "string",
      "const": "Ed25519"
    },
    "ts": {
      "type": "integer",
      "minimum": 1000000000
    },
    "signed_body": {
      "type": "object",
      "required": [
        "receipt_type",
        "schema",
        "custody_id",
        "evidence_digest_sha256",
        "recorded_at",
        "verdict",
        "boundary",
        "subject_receipt_type",
        "service_computed_field_names",
        "caller_settable_field_names"
      ],
      "additionalProperties": false,
      "properties": {
        "receipt_type": {
          "type": "string",
          "const": "verdict.custody"
        },
        "schema": {
          "type": "string",
          "const": "r1.0.0"
        },
        "custody_id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "pattern": "^[A-Za-z0-9._:-]{1,256}$"
        },
        "evidence_digest_sha256": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA-256 of the caller-held evidence bundle this receipt attests was recorded. The service never receives or inspects the underlying evidence, only its digest."
        },
        "recorded_at": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"
        },
        "verdict": {
          "type": "object",
          "description": "Service-computed honesty boundary fields. Never caller overridable; recomputed and checked at verify time.",
          "required": [
            "enforcement_confirmed_on_other_receipts",
            "service_computed_field_count",
            "caller_settable_field_count",
            "overlapping_field_count",
            "field_sets_disjoint"
          ],
          "additionalProperties": false,
          "properties": {
            "enforcement_confirmed_on_other_receipts": {
              "type": "boolean",
              "const": false
            },
            "service_computed_field_count": {
              "type": "integer",
              "minimum": 0
            },
            "caller_settable_field_count": {
              "type": "integer",
              "minimum": 0
            },
            "overlapping_field_count": {
              "type": "integer",
              "minimum": 0
            },
            "field_sets_disjoint": {
              "type": "boolean"
            }
          }
        },
        "boundary": {
          "type": "string",
          "const": "Verdict Custody Declaration receipt. It names, inside the signed body, which fields of an issued receipt the issuing service computes and which fields the party requesting issuance may set, and the service recomputes whether those two sets overlap. An overlap is reported as a count and a boolean, so a claim that a verdict is service-held is checkable rather than asserted. It does not inspect any other receipt to confirm the declared split was actually enforced there; enforcement_confirmed_on_other_receipts is fixed to false because this receipt only carries the declaration."
        },
        "subject_receipt_type": {
          "type": "string",
          "minLength": 1,
          "maxLength": 256,
          "description": "Canonical receipt type this custody split describes."
        },
        "service_computed_field_names": {
          "type": "array",
          "minItems": 1,
          "maxItems": 256,
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 128
          },
          "description": "Fields the issuing service derives from its own clock, configuration, probe, or a constant."
        },
        "caller_settable_field_names": {
          "type": "array",
          "minItems": 0,
          "maxItems": 512,
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 128
          },
          "description": "Fields the party requesting issuance may set."
        }
      }
    }
  }
}