{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:cequs:delegation:schema:1.0",
  "title": "CEQUS local accountable delegation v1",
  "$ref": "#/$defs/state",
  "$defs": {
    "agent": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "id",
        "dn",
        "organization",
        "operator",
        "namingAuthority",
        "proofingAuthority",
        "issuer",
        "certificateIssuer",
        "endorsementEvidence",
        "verification",
        "status",
        "endpoint",
        "permittedTools",
        "advertisedCapabilities",
        "revocationContact"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0"
          ]
        },
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "dn": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "organization": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "operator": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "namingAuthority": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "proofingAuthority": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "certificateIssuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "endorsementEvidence": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "verification": {
          "type": "string",
          "enum": [
            "simulated"
          ]
        },
        "status": {
          "type": "string",
          "enum": [
            "pending",
            "active",
            "suspended",
            "revoked"
          ]
        },
        "endpoint": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "permittedTools": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000
          }
        },
        "advertisedCapabilities": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000
          }
        },
        "revocationContact": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "blueprint": {"type":"string","minLength":1,"maxLength":1000},
        "blueprintDigest": {"type":"string","pattern":"^[a-f0-9]{64}$"}
      }
    },
    "blueprint": {
      "type": "object",
      "additionalProperties": false,
      "required": ["schemaVersion","id","dn","owner","capabilities","artifacts","maxInstanceSeconds","status"],
      "properties": {
        "schemaVersion": {"type":"string","enum":["1.0"]},
        "id": {"type":"string","minLength":1,"maxLength":1000},
        "dn": {"type":"string","minLength":1,"maxLength":1000},
        "owner": {"type":"string","minLength":1,"maxLength":1000},
        "capabilities": {"type":"array","items":{"type":"string","minLength":1,"maxLength":300}},
        "artifacts": {"type":"array","items":{"type":"object","additionalProperties":false,"required":["softwareVersion","modelVersion","artifactDigest"],"properties":{"softwareVersion":{"type":"string","minLength":1,"maxLength":1000},"modelVersion":{"type":"string","minLength":1,"maxLength":1000},"artifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}}}},
        "maxInstanceSeconds": {"type":"integer"},
        "status": {"type":"string","enum":["active","suspended","retired"]}
      }
    },
    "deployment": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "id",
        "agent",
        "softwareVersion",
        "modelVersion",
        "artifactDigest",
        "keyId",
        "endpoint",
        "status"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0"
          ]
        },
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "agent": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "softwareVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "modelVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "artifactDigest": {
          "type": "string",
          "pattern": "^sha256:[a-f0-9]{64}$"
        },
        "keyId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "endpoint": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "status": {
          "type": "string",
          "enum": [
            "pending",
            "approved",
            "suspended"
          ]
        }
      }
    },
    "credential": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "agent",
        "deployment",
        "issuer",
        "fingerprint",
        "keyId",
        "status"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "agent": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "deployment": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "fingerprint": {
          "type": "string",
          "pattern": "^[A-F0-9]{64}$"
        },
        "keyId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "suspended",
            "revoked"
          ]
        },
        "instance": {"type":"object","additionalProperties":false,"required":["id","grants"],"properties":{"id":{"type":"string","pattern":"^urn:uuid:[0-9a-f-]{36}$"},"grants":{"type":"array","items":{"type":"string","minLength":1,"maxLength":300}}}}
      }
    },
    "endpoint": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "agent",
        "status",
        "url"
      ],
      "properties": {
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "agent": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "suspended",
            "revoked"
          ]
        },
        "url": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        }
      }
    },
    "grant": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "id",
        "principal",
        "agent",
        "action",
        "resource",
        "audience",
        "issuer",
        "notBefore",
        "notAfter",
        "status",
        "redelegation",
        "parent",
        "delegatedBy"
        ,"signature",
        "signingKeyId"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0",
            "1.1"
          ]
        },
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "principal": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "agent": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "action": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "resource": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "audience": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "issuer": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "notBefore": {
          "type": "string",
          "format": "date-time"
        },
        "notAfter": {
          "type": "string",
          "format": "date-time"
        },
        "status": {
          "type": "string",
          "enum": [
            "active",
            "suspended",
            "revoked"
          ]
        },
        "redelegation": {
          "type": "string",
          "enum": [
            "deny",
            "bounded"
          ]
        },
        "parent": {
          "type": [
            "string",
            "null"
          ]
        },
        "delegatedBy": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "signature": {
          "type": "string",
          "minLength": 1,
          "maxLength": 5000
        },
        "signingKeyId": {
          "type": "string",
          "pattern": "^[a-f0-9]{64}$"
        },
        "tenant": {"type":"string","minLength":1,"maxLength":300},
        "task": {"type":"string","minLength":1,"maxLength":300},
        "purpose": {"type":"string","minLength":1,"maxLength":300},
        "parentDigest": {"type":["string","null"],"pattern":"^[a-f0-9]{64}$"},
        "constraints": {"type":"object","additionalProperties":false,"required":[],"properties":{"maxPerTransaction":{"type":"object","additionalProperties":false,"required":["amountMinor","currency"],"properties":{"amountMinor":{"type":"integer"},"currency":{"type":"string","pattern":"^[A-Z]{3}$"}}},"maxAggregate":{"type":"object","additionalProperties":false,"required":["amountMinor","currency"],"properties":{"amountMinor":{"type":"integer"},"currency":{"type":"string","pattern":"^[A-Z]{3}$"}}},"allowedVendors":{"type":"array","items":{"type":"string","minLength":1,"maxLength":300}},"allowedRegions":{"type":"array","items":{"type":"string","pattern":"^[A-Z]{2}(-[A-Z0-9]{1,3})?$"}}}},
        "maxDepth": {"type":"integer"},
        "signatureAlgorithm": {"type":"string","enum":["Ed25519"]}
      }
    },
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "version",
        "revision",
        "audience",
        "acceptedRegistrationIssuers",
        "acceptedCredentialIssuers",
        "acceptedGrantIds",
        "grantAuthorities"
      ],
      "properties": {
        "version": {
          "type": "string",
          "enum": [
            "cequs-receiver/1.0"
          ]
        },
        "revision": {"type":"integer"},
        "humanApproval": {"type":"object","additionalProperties":false,"required":["rpId","origin","challengeTtlSeconds"],"properties":{"rpId":{"type":"string","minLength":1,"maxLength":300},"origin":{"type":"string","minLength":1,"maxLength":300},"challengeTtlSeconds":{"type":"integer"},"escalateAbove":{"type":"object","additionalProperties":false,"required":["amountMinor","currency"],"properties":{"amountMinor":{"type":"integer"},"currency":{"type":"string","pattern":"^[A-Z]{3}$"}}}}},
        "dynamicRisk": {"type":"object","additionalProperties":false,"required":["enabled","maxAgeMs","exploitThreshold","cyberOffenseThreshold","trustedSources"],"properties":{"enabled":{"type":"boolean"},"maxAgeMs":{"type":"integer"},"exploitThreshold":{"type":"number"},"cyberOffenseThreshold":{"type":"number"},"trustedSources":{"type":"array","items":{"type":"string","minLength":1,"maxLength":300}}}},
        "maxCredentialLifetimeSeconds": {"type":"integer"},
        "possessionProof": {"type":"string","enum":["required"]},
        "requireBlueprint": {"type":"boolean"},
        "audience": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "acceptedRegistrationIssuers": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000
          }
        },
        "acceptedCredentialIssuers": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000
          }
        },
        "acceptedGrantIds": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1,
            "maxLength": 1000
          }
        },
        "grantAuthorities": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
              "required": [
                "issuer",
              "principal",
              "publicKey",
              "keyId"
            ],
            "properties": {
              "issuer": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1000
              },
              "principal": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1000
              },
              "publicKey": {
                "type": "string",
                "minLength": 1,
                "maxLength": 5000
              },
              "keyId": {
                "type": "string",
                "pattern": "^[a-f0-9]{64}$"
              }
            }
          }
        }
      }
    },
    "state": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "agents",
        "deployments",
        "credentials",
        "endpoints",
        "lots",
        "grants",
        "policy"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0"
          ]
        },
        "agents": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/agent"
          }
        },
        "deployments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/deployment"
          }
        },
        "credentials": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/credential"
          }
        },
        "endpoints": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/endpoint"
          }
        },
        "lots": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": [
              "id",
              "producer"
            ],
            "properties": {
              "id": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1000
              },
              "producer": {
                "type": "string",
                "minLength": 1,
                "maxLength": 1000
              }
            }
          }
        },
        "grants": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/grant"
          }
        },
        "registrars": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["id","jurisdiction","status","verification","checks"],
            "properties": {
              "id": {"type":"string","minLength":1,"maxLength":300},
              "jurisdiction": {"type":"string","minLength":1,"maxLength":20},
              "status": {"type":"string","enum":["active","suspended","revoked"]},
              "verification": {"type":"string","enum":["simulated"]},
              "checks": {"type":"array","items":{"type":"string","minLength":1,"maxLength":100}}
            }
          }
        },
        "auditRoles": {
          "type":"array",
          "items": {"type":"object","additionalProperties":false,"required":["id","status","fingerprint"],"properties":{"id":{"type":"string","minLength":1,"maxLength":100},"status":{"type":"string","enum":["active","suspended"]},"fingerprint":{"type":"string","pattern":"^[A-F0-9]{64}$"}}}
        },
        "accounts": {"type":"array","items":{"type":"object","additionalProperties":false,"required":["id","owner"],"properties":{"id":{"type":"string","minLength":1,"maxLength":300},"owner":{"type":"string","minLength":1,"maxLength":1000}}}},
        "approvers": {"type":"array","items":{"type":"object","additionalProperties":false,"required":["id","principal","actions","credentialId","publicKey","authenticator","status"],"properties":{"id":{"type":"string","minLength":1,"maxLength":300},"principal":{"type":"string","minLength":1,"maxLength":1000},"actions":{"type":"array","items":{"type":"string","minLength":1,"maxLength":300}},"credentialId":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"publicKey":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"authenticator":{"type":"string","enum":["software-test","security-key"]},"status":{"type":"string","enum":["active","suspended"]}}}},
        "blueprints": {"type":"array","items":{"$ref":"#/$defs/blueprint"}},
        "vendors": {"type":"array","items":{"type":"object","additionalProperties":false,"required":["id","status"],"properties":{"id":{"type":"string","minLength":1,"maxLength":300},"status":{"type":"string","enum":["approved","escalate","suspended"]}}}},
        "handoffRoutes": {
          "type":"array",
          "items": {"type":"object","additionalProperties":false,"required":["id","sender","receiver","purpose","payloadClass","maxTtlSeconds","status"],"properties":{"id":{"type":"string","minLength":1,"maxLength":300},"sender":{"type":"string","minLength":1,"maxLength":300},"receiver":{"type":"string","minLength":1,"maxLength":300},"purpose":{"type":"string","minLength":1,"maxLength":300},"payloadClass":{"type":"string","minLength":1,"maxLength":100},"maxTtlSeconds":{"type":"integer"},"status":{"type":"string","enum":["active","suspended"]}}}
        },
        "policy": {
          "$ref": "#/$defs/policy"
        }
      }
    },
    "request": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "requestId",
        "agent",
        "deployment",
        "softwareVersion",
        "modelVersion",
        "endpoint",
        "principal",
        "grant",
        "action",
        "resource",
        "audience",
        "artifactDigest"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0",
            "1.1"
          ]
        },
        "requestId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "agent": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "deployment": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "softwareVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "modelVersion": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "artifactDigest": {
          "type": "string",
          "pattern": "^sha256:[a-f0-9]{64}$"
        },
        "endpoint": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "principal": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "grant": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "action": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "resource": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "audience": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "sample": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "proposalRequestId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 300
        },
        "tenant": {"type":"string","minLength":1,"maxLength":300},
        "task": {"type":"string","minLength":1,"maxLength":300},
        "purpose": {"type":"string","minLength":1,"maxLength":300},
        "vendor": {"type":"string","minLength":1,"maxLength":300},
        "amountMinor": {"type":"string","pattern":"^[1-9][0-9]{0,14}$"},
        "currency": {"type":"string","pattern":"^[A-Z]{3}$"},
        "deliveryRegion": {"type":"string","pattern":"^[A-Z]{2}(-[A-Z0-9]{1,3})?$"},
        "humanApproval": {"type":"object","additionalProperties":false,"required":["challengeId","approver","response"],"properties":{"challengeId":{"type":"string","minLength":1,"maxLength":100},"approver":{"type":"string","minLength":1,"maxLength":300},"response":{"type":"object","additionalProperties":false,"required":["id","rawId","type","response","clientExtensionResults"],"properties":{"id":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"rawId":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"type":{"type":"string","enum":["public-key"]},"authenticatorAttachment":{"type":"string","minLength":1,"maxLength":40},"response":{"type":"object","additionalProperties":false,"required":["clientDataJSON","authenticatorData","signature"],"properties":{"clientDataJSON":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"authenticatorData":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"signature":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"userHandle":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"}}},"clientExtensionResults":{"type":"object","additionalProperties":false,"required":[],"properties":{}}}}}}
      }
    },
    "decision": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schemaVersion",
        "id",
        "identity",
        "deployment",
        "grant",
        "action",
        "resource",
        "audience",
        "requestId",
        "operation",
        "policyVersion",
        "time",
        "outcome",
        "reason",
        "resultHash"
      ],
      "properties": {
        "schemaVersion": {
          "type": "string",
          "enum": [
            "1.0"
          ]
        },
        "id": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "identity": {
          "type": [
            "string",
            "null"
          ]
        },
        "previousDecisionHash": {
          "type": [
            "string",
            "null"
          ]
        },
        "deployment": {
          "type": [
            "string",
            "null"
          ]
        },
        "grant": {
          "type": [
            "string",
            "null"
          ]
        },
        "action": {
          "type": [
            "string",
            "null"
          ]
        },
        "resource": {
          "type": [
            "string",
            "null"
          ]
        },
        "audience": {
          "type": [
            "string",
            "null"
          ]
        },
        "requestId": {
          "type": [
            "string",
            "null"
          ]
        },
        "operation": {
          "type": "string",
          "enum": [
            "execute",
            "pause",
            "resume",
            "handoff.issue",
            "handoff.deposit",
            "handoff.collect",
            "handoff.expire"
          ]
        },
        "policyVersion": {
          "type": "string",
          "enum": [
            "cequs-receiver/1.0"
          ]
        },
        "time": {
          "type": "string",
          "format": "date-time"
        },
        "outcome": {
          "type": "string",
          "enum": [
            "allow",
            "deny"
          ,
            "require_human"
          ]
        },
        "reason": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "resultHash": {
          "type": [
            "string",
            "null"
          ]
        },
        "actionDigest": {"type":["string","null"],"pattern":"^[a-f0-9]{64}$"},
        "grantChain": {"type":["array","null"],"items":{"type":"string","pattern":"^[a-f0-9]{64}$"}},
        "policyInputsDigest": {"type":["string","null"],"pattern":"^[a-f0-9]{64}$"},
        "escalation": {"type":["array","null"],"items":{"type":"string","enum":["vendor_requires_human_approval","amount_requires_human_approval"]}},
        "approvalChallengeId": {"type":["string","null"],"minLength":1,"maxLength":100},
        "approval": {"type":["object","null"],"additionalProperties":false,"required":["approver","credentialId","challengeId","authenticator","simulated","userVerified","counter","assertion"],"properties":{"approver":{"type":"string","minLength":1,"maxLength":300},"credentialId":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"challengeId":{"type":"string","minLength":1,"maxLength":100},"authenticator":{"type":"string","enum":["software-test","security-key"]},"simulated":{"type":"boolean"},"userVerified":{"type":"boolean"},"counter":{"type":"integer"},"assertion":{"type":"object","additionalProperties":false,"required":["clientDataJSON","authenticatorData","signature"],"properties":{"clientDataJSON":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"authenticatorData":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"},"signature":{"type":"string","minLength":1,"maxLength":4000,"pattern":"^[A-Za-z0-9_-]+$"}}}}}
      }
    },
    "evidence": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "algorithm",
        "keyId",
        "record",
        "signature"
      ],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "Ed25519"
          ]
        },
        "keyId": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        },
        "record": {
          "$ref": "#/$defs/decision"
        },
        "signature": {
          "type": "string",
          "minLength": 1,
          "maxLength": 1000
        }
      }
    }
  }
}