diff --git a/contracts/fixtures/sdl/participant-episode-policy-v1/README.md b/contracts/fixtures/sdl/participant-episode-policy-v1/README.md new file mode 100644 index 000000000..c5056b8d7 --- /dev/null +++ b/contracts/fixtures/sdl/participant-episode-policy-v1/README.md @@ -0,0 +1,28 @@ +# Participant episode policy fixtures + +These fixtures exercise the DSL-120 authored participant episode surface, +`behavior_specifications.*.episode_policy`. + +- `valid/analyst-shift-episode.yaml` declares initialization, decision-epoch + turn structure, a completion and a timeout terminal condition, a truncation + condition, and a reset policy for a non-autonomous participant. It must pass + strict source decoding and semantic validation, and it compiles to the + `participant.episode-policy.analyst-triage` record keyed to the participant's + `participant.behavior.analyst` episode address. +- `invalid/realized-episode-state.yaml` is the same document with a policy that + asserts realized episode state (lifecycle status, initialization time, + decision epoch, and terminal reason). Decoding must reject it, because the + authored policy declares intent only and realized episode state belongs to + the ADR-013 participant episode contracts. + +- `valid/standalone-episode-structure.yaml` (ACT-623) gives a participant a + behavior specification whose only behavior surface is its episode policy. + It must pass strict decoding and semantic validation, and the compiled + aggregate names `participant.episode-policy.replay-episodes`. +- `invalid/autonomous-profile-episode-structure.yaml` (ACT-623) nests the same + policy inside the autonomous execution profile. Decoding must reject it, + because episode structure belongs to the behavior specification for every + participant kind and is not an autonomous-profile option. + +None of these fixtures represents an executed episode, a reset, or an observed +terminal condition. diff --git a/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/autonomous-profile-episode-structure.yaml b/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/autonomous-profile-episode-structure.yaml new file mode 100644 index 000000000..d8a61ea61 --- /dev/null +++ b/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/autonomous-profile-episode-structure.yaml @@ -0,0 +1,104 @@ +name: act-623 +nodes: + siem: + type: compute + resources: {ram: 1 gib, cpu: 1} + services: [{port: 443, name: console}] +entities: + blue-team: + role: blue +propositions: + console-ready: + description: The SIEM console is reachable before a replay episode starts. + subjects: [nodes.siem.services.console] + basis: declared_state + predicate: + kind: boolean + property: console-reachable + semantic_ref: urn:raes:observable:console-reachable + expected: true +assertions: + console-ready: + proposition: console-ready + role: precondition +time_domains: + replay-time: + kind: logical + tick_period_seconds: {numerator: 1, denominator: 1} + epoch: scenario_start + visibility: participant_visible + description: replay logical time +clocks: + replay-clock: + time_domain_ref: replay-time + authority_kind: runtime + authority_ref: runtime.scheduler + monotonicity: non_decreasing + description: replay scheduler clock +temporal_constraints: + replay-deadline: + constraint_kind: deadline + clock_ref: replay-clock + subject_refs: [agents.replayer] + end: {tick: 900} + description: each replay episode closes within fifteen minutes +evidence_requirements: + replay-clock-evidence: + description: capture the replay clock reading at episode close + source_refs: [agents.replayer] + scope_refs: [siem] + window: replay episode close + channel: log + artifact_role: episode_timeout_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + replay-reset-evidence: + description: capture the replay reset record + source_refs: [agents.replayer] + scope_refs: [siem] + window: replay episode reset + channel: log + artifact_role: episode_reset_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required +agents: + replayer: + affiliations: [blue-team] +behavior_specifications: + replay-episodes: + semantic_version: 1.0.0 + participant_refs: [replayer] + behavior_mode: autonomous + autonomous_execution: + participant_implementation_ref: participant-implementation-manifests.replayer.v1 + clock_ref: replay-clock + progression_policy_ref: replay-progression + temporal_constraint_refs: [replay-deadline] + action_order: [replay-step] + observation_boundary_ref: replay-view + selection_strategy: ordered_cycle + max_action_attempts: 3 + max_in_flight: 1 + failure_policy: stop + evaluation_authority: + mode: none + episode_policy: + profile: participant-episode-policy/v1 + initialization: + assertion_refs: [console-ready] + terminal_conditions: + replay-window-closed: + terminal_reason: timed_out + temporal_constraint_ref: replay-deadline + evidence_requirement_refs: [replay-clock-evidence] + reset_policy: + control_actions: [reset] + participant_memory_scope: episode_local_reset + memory_reset_authority_ref: agents.replayer + evidence_requirement_refs: [replay-reset-evidence] diff --git a/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/realized-episode-state.yaml b/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/realized-episode-state.yaml new file mode 100644 index 000000000..ad59a034c --- /dev/null +++ b/contracts/fixtures/sdl/participant-episode-policy-v1/invalid/realized-episode-state.yaml @@ -0,0 +1,175 @@ +name: dsl-120 +nodes: + siem: + type: compute + resources: {ram: 1 gib, cpu: 1} + services: [{port: 443, name: console}] +entities: + blue-team: + role: blue +propositions: + console-ready: + description: The SIEM console is reachable before the analyst episode starts. + subjects: [nodes.siem.services.console] + basis: declared_state + predicate: + kind: boolean + property: console-reachable + semantic_ref: urn:raes:observable:console-reachable + expected: true + ticket-closed: + description: The analyst closed the escalated incident ticket. + subjects: [nodes.siem.services.console] + basis: observed_state + predicate: + kind: boolean + property: incident-ticket-closed + semantic_ref: urn:raes:observable:incident-ticket-closed + expected: true + evidence_requirements: [ticket-evidence] + queue-stalled: + description: The alert queue stopped producing new work for the analyst. + subjects: [nodes.siem.services.console] + basis: observed_state + predicate: + kind: boolean + property: alert-queue-stalled + semantic_ref: urn:raes:observable:alert-queue-stalled + expected: true + evidence_requirements: [queue-evidence] +assertions: + console-ready: + proposition: console-ready + role: precondition + ticket-closed: + proposition: ticket-closed + role: postcondition + queue-stalled: + proposition: queue-stalled + role: postcondition +time_domains: + shift-time: + kind: logical + tick_period_seconds: {numerator: 60, denominator: 1} + epoch: scenario_start + visibility: participant_visible + description: analyst shift logical time +clocks: + shift-clock: + time_domain_ref: shift-time + authority_kind: runtime + authority_ref: runtime.scheduler + monotonicity: non_decreasing + description: analyst shift clock +temporal_constraints: + shift-deadline: + constraint_kind: deadline + clock_ref: shift-clock + subject_refs: [behavior_specifications.analyst-triage] + end: {tick: 480} + description: the analyst episode must close within one shift +evidence_requirements: + ticket-evidence: + description: capture the ticket closure record + source_refs: [nodes.siem.services.console] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_terminal_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + queue-evidence: + description: capture the alert queue telemetry + source_refs: [nodes.siem.services.console] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_truncation_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + shift-clock-evidence: + description: capture the shift clock reading at episode close + source_refs: [behavior_specifications.analyst-triage] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_timeout_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + reset-evidence: + description: capture the episode reset or restart record + source_refs: [behavior_specifications.analyst-triage] + scope_refs: [siem] + window: analyst episode reset + channel: log + artifact_role: episode_reset_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required +action_contracts: + triage-alert: + semantic_version: 1.0.0 + behavioral_granularity: atomic + procedure_basis: analyst reviews one SIEM alert and records a disposition + realization_profile: backend-declared + fidelity_claim: records the analyst disposition and the terminal console observation + preconditions: + - precondition_id: console-in-scope + precondition_class: target + description: the SIEM console is in the analyst's action scope + support_refs: [nodes.siem.services.console] + effects: + - effect_id: alert-disposition-recorded + effect_class: intended_effect + description: the analyst records a disposition for the alert + target_refs: [nodes.siem.services.console] + failure_classes: [target_unavailable, unknown] +agents: + analyst: + affiliations: [blue-team] + actions: [triage-alert] +behavior_specifications: + analyst-triage: + semantic_version: 1.0.0 + participant_refs: [analyst] + action_contract_refs: [triage-alert] + behavior_mode: human-supervised + episode_policy: + profile: participant-episode-policy/v1 + status: terminated + initialized_at: '2026-10-09T00:00:00Z' + decision_epoch: 3 + terminal_reason: completed + initialization: + assertion_refs: [console-ready] + interaction_structure: + order_basis: decision-epoch + action_contract_refs: [triage-alert] + terminal_conditions: + ticket-closed: + terminal_reason: completed + assertion_refs: [ticket-closed] + evidence_requirement_refs: [ticket-evidence] + shift-ended: + terminal_reason: timed_out + temporal_constraint_ref: shift-deadline + evidence_requirement_refs: [shift-clock-evidence] + truncation_conditions: + queue-stalled: + assertion_refs: [queue-stalled] + evidence_requirement_refs: [queue-evidence] + reset_policy: + control_actions: [reset, restart] + participant_memory_scope: persistent_across_episodes + evidence_requirement_refs: [reset-evidence] diff --git a/contracts/fixtures/sdl/participant-episode-policy-v1/valid/analyst-shift-episode.yaml b/contracts/fixtures/sdl/participant-episode-policy-v1/valid/analyst-shift-episode.yaml new file mode 100644 index 000000000..c98cc517f --- /dev/null +++ b/contracts/fixtures/sdl/participant-episode-policy-v1/valid/analyst-shift-episode.yaml @@ -0,0 +1,171 @@ +name: dsl-120 +nodes: + siem: + type: compute + resources: {ram: 1 gib, cpu: 1} + services: [{port: 443, name: console}] +entities: + blue-team: + role: blue +propositions: + console-ready: + description: The SIEM console is reachable before the analyst episode starts. + subjects: [nodes.siem.services.console] + basis: declared_state + predicate: + kind: boolean + property: console-reachable + semantic_ref: urn:raes:observable:console-reachable + expected: true + ticket-closed: + description: The analyst closed the escalated incident ticket. + subjects: [nodes.siem.services.console] + basis: observed_state + predicate: + kind: boolean + property: incident-ticket-closed + semantic_ref: urn:raes:observable:incident-ticket-closed + expected: true + evidence_requirements: [ticket-evidence] + queue-stalled: + description: The alert queue stopped producing new work for the analyst. + subjects: [nodes.siem.services.console] + basis: observed_state + predicate: + kind: boolean + property: alert-queue-stalled + semantic_ref: urn:raes:observable:alert-queue-stalled + expected: true + evidence_requirements: [queue-evidence] +assertions: + console-ready: + proposition: console-ready + role: precondition + ticket-closed: + proposition: ticket-closed + role: postcondition + queue-stalled: + proposition: queue-stalled + role: postcondition +time_domains: + shift-time: + kind: logical + tick_period_seconds: {numerator: 60, denominator: 1} + epoch: scenario_start + visibility: participant_visible + description: analyst shift logical time +clocks: + shift-clock: + time_domain_ref: shift-time + authority_kind: runtime + authority_ref: runtime.scheduler + monotonicity: non_decreasing + description: analyst shift clock +temporal_constraints: + shift-deadline: + constraint_kind: deadline + clock_ref: shift-clock + subject_refs: [behavior_specifications.analyst-triage] + end: {tick: 480} + description: the analyst episode must close within one shift +evidence_requirements: + ticket-evidence: + description: capture the ticket closure record + source_refs: [nodes.siem.services.console] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_terminal_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + queue-evidence: + description: capture the alert queue telemetry + source_refs: [nodes.siem.services.console] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_truncation_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + shift-clock-evidence: + description: capture the shift clock reading at episode close + source_refs: [behavior_specifications.analyst-triage] + scope_refs: [siem] + window: analyst episode close + channel: log + artifact_role: episode_timeout_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + reset-evidence: + description: capture the episode reset or restart record + source_refs: [behavior_specifications.analyst-triage] + scope_refs: [siem] + window: analyst episode reset + channel: log + artifact_role: episode_reset_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required +action_contracts: + triage-alert: + semantic_version: 1.0.0 + behavioral_granularity: atomic + procedure_basis: analyst reviews one SIEM alert and records a disposition + realization_profile: backend-declared + fidelity_claim: records the analyst disposition and the terminal console observation + preconditions: + - precondition_id: console-in-scope + precondition_class: target + description: the SIEM console is in the analyst's action scope + support_refs: [nodes.siem.services.console] + effects: + - effect_id: alert-disposition-recorded + effect_class: intended_effect + description: the analyst records a disposition for the alert + target_refs: [nodes.siem.services.console] + failure_classes: [target_unavailable, unknown] +agents: + analyst: + affiliations: [blue-team] + actions: [triage-alert] +behavior_specifications: + analyst-triage: + semantic_version: 1.0.0 + participant_refs: [analyst] + action_contract_refs: [triage-alert] + behavior_mode: human-supervised + episode_policy: + profile: participant-episode-policy/v1 + initialization: + assertion_refs: [console-ready] + interaction_structure: + order_basis: decision-epoch + action_contract_refs: [triage-alert] + terminal_conditions: + ticket-closed: + terminal_reason: completed + assertion_refs: [ticket-closed] + evidence_requirement_refs: [ticket-evidence] + shift-ended: + terminal_reason: timed_out + temporal_constraint_ref: shift-deadline + evidence_requirement_refs: [shift-clock-evidence] + truncation_conditions: + queue-stalled: + assertion_refs: [queue-stalled] + evidence_requirement_refs: [queue-evidence] + reset_policy: + control_actions: [reset, restart] + participant_memory_scope: persistent_across_episodes + evidence_requirement_refs: [reset-evidence] diff --git a/contracts/fixtures/sdl/participant-episode-policy-v1/valid/standalone-episode-structure.yaml b/contracts/fixtures/sdl/participant-episode-policy-v1/valid/standalone-episode-structure.yaml new file mode 100644 index 000000000..ad12a4d17 --- /dev/null +++ b/contracts/fixtures/sdl/participant-episode-policy-v1/valid/standalone-episode-structure.yaml @@ -0,0 +1,90 @@ +name: act-623 +nodes: + siem: + type: compute + resources: {ram: 1 gib, cpu: 1} + services: [{port: 443, name: console}] +entities: + blue-team: + role: blue +propositions: + console-ready: + description: The SIEM console is reachable before a replay episode starts. + subjects: [nodes.siem.services.console] + basis: declared_state + predicate: + kind: boolean + property: console-reachable + semantic_ref: urn:raes:observable:console-reachable + expected: true +assertions: + console-ready: + proposition: console-ready + role: precondition +time_domains: + replay-time: + kind: logical + tick_period_seconds: {numerator: 1, denominator: 1} + epoch: scenario_start + visibility: participant_visible + description: replay logical time +clocks: + replay-clock: + time_domain_ref: replay-time + authority_kind: runtime + authority_ref: runtime.scheduler + monotonicity: non_decreasing + description: replay scheduler clock +temporal_constraints: + replay-deadline: + constraint_kind: deadline + clock_ref: replay-clock + subject_refs: [agents.replayer] + end: {tick: 900} + description: each replay episode closes within fifteen minutes +evidence_requirements: + replay-clock-evidence: + description: capture the replay clock reading at episode close + source_refs: [agents.replayer] + scope_refs: [siem] + window: replay episode close + channel: log + artifact_role: episode_timeout_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required + replay-reset-evidence: + description: capture the replay reset record + source_refs: [agents.replayer] + scope_refs: [siem] + window: replay episode reset + channel: log + artifact_role: episode_reset_evidence + sensitivity: plain + redaction: none + integrity: checksum + retention: study_lifetime + loss_disclosure: required +agents: + replayer: + affiliations: [blue-team] +behavior_specifications: + replay-episodes: + semantic_version: 1.0.0 + participant_refs: [replayer] + episode_policy: + profile: participant-episode-policy/v1 + initialization: + assertion_refs: [console-ready] + terminal_conditions: + replay-window-closed: + terminal_reason: timed_out + temporal_constraint_ref: replay-deadline + evidence_requirement_refs: [replay-clock-evidence] + reset_policy: + control_actions: [reset] + participant_memory_scope: episode_local_reset + memory_reset_authority_ref: agents.replayer + evidence_requirement_refs: [replay-reset-evidence] diff --git a/contracts/schema-publication/entries/instantiated-scenario-snapshot-v1.json b/contracts/schema-publication/entries/instantiated-scenario-snapshot-v1.json index 426921292..b9372053a 100644 --- a/contracts/schema-publication/entries/instantiated-scenario-snapshot-v1.json +++ b/contracts/schema-publication/entries/instantiated-scenario-snapshot-v1.json @@ -1,9 +1,9 @@ { - "content_hash": "2dd378f6b80b78ade6bcb48f2ed201c1d83e1b821a2c04dd8cb342661e45b1ce", + "content_hash": "6c8f11d67129ac2c77e69951c754b7c4c8b0405de5fabc975b97a2a0e16a7a73", "contract_id": "instantiated-scenario-snapshot-v1", "last_change": { - "content_hash": "2dd378f6b80b78ade6bcb48f2ed201c1d83e1b821a2c04dd8cb342661e45b1ce", - "summary": "Carry optional complete execution/recovery requirements and resolved evidence through SDL/native plans; declare installed support and fail closed on incompatible requests (#1361)." + "content_hash": "6c8f11d67129ac2c77e69951c754b7c4c8b0405de5fabc975b97a2a0e16a7a73", + "summary": "Add the optional authored participant episode policy to behavior specifications: initialization, turn structure, terminal and truncation conditions, and reset policy as declared intent only (#307)." }, "schema_path": "contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json", "stability": "draft" diff --git a/contracts/schema-publication/entries/instantiated-scenario-v1.json b/contracts/schema-publication/entries/instantiated-scenario-v1.json index c03565757..af4039988 100644 --- a/contracts/schema-publication/entries/instantiated-scenario-v1.json +++ b/contracts/schema-publication/entries/instantiated-scenario-v1.json @@ -1,9 +1,9 @@ { - "content_hash": "79146c00cd63509c6ed5a570ad525bd456a3a8c1b976d29bdce58229795a8007", + "content_hash": "063800a7f932af27c2dda37ed8915994c72f379dec9bfa9c4ad858e0dea8f210", "contract_id": "instantiated-scenario-v1", "last_change": { - "content_hash": "79146c00cd63509c6ed5a570ad525bd456a3a8c1b976d29bdce58229795a8007", - "summary": "Carry optional complete execution/recovery requirements and resolved evidence through SDL/native plans; declare installed support and fail closed on incompatible requests (#1361)." + "content_hash": "063800a7f932af27c2dda37ed8915994c72f379dec9bfa9c4ad858e0dea8f210", + "summary": "Add the optional authored participant episode policy to behavior specifications: initialization, turn structure, terminal and truncation conditions, and reset policy as declared intent only (#307)." }, "schema_path": "contracts/schemas/sdl/instantiated-scenario-v1.json", "stability": "draft" diff --git a/contracts/schema-publication/entries/materialized-scenario-v1.json b/contracts/schema-publication/entries/materialized-scenario-v1.json index f6b437406..156d7c6a2 100644 --- a/contracts/schema-publication/entries/materialized-scenario-v1.json +++ b/contracts/schema-publication/entries/materialized-scenario-v1.json @@ -1,9 +1,9 @@ { - "content_hash": "88badd3549d88383d2486b06ed1885397dc290665e1a072009caadf9bdd83549", + "content_hash": "141cb9ccd1c637eb578784fb7ec7d7097fd27317d2a7ecbc8c24eceea37ac5b0", "contract_id": "materialized-scenario-v1", "last_change": { - "content_hash": "88badd3549d88383d2486b06ed1885397dc290665e1a072009caadf9bdd83549", - "summary": "Carry optional complete execution/recovery requirements and resolved evidence through SDL/native plans; declare installed support and fail closed on incompatible requests (#1361)." + "content_hash": "141cb9ccd1c637eb578784fb7ec7d7097fd27317d2a7ecbc8c24eceea37ac5b0", + "summary": "Add the optional authored participant episode policy to behavior specifications: initialization, turn structure, terminal and truncation conditions, and reset policy as declared intent only (#307)." }, "schema_path": "contracts/schemas/sdl/materialized-scenario-v1.json", "stability": "draft" diff --git a/contracts/schema-publication/entries/scenario-satisfiability-evidence-v1.json b/contracts/schema-publication/entries/scenario-satisfiability-evidence-v1.json index 0f947ce7e..206e66397 100644 --- a/contracts/schema-publication/entries/scenario-satisfiability-evidence-v1.json +++ b/contracts/schema-publication/entries/scenario-satisfiability-evidence-v1.json @@ -1,9 +1,9 @@ { - "content_hash": "0a5b2ee3ad31c589f30def040783a934fb8855614c9030525f1a648ac27e3ce5", + "content_hash": "8e1adf3e7b8831103d26adc044dce3593bcc74a9b803aff88d1b302fa81f7183", "contract_id": "scenario-satisfiability-evidence-v1", "last_change": { - "content_hash": "0a5b2ee3ad31c589f30def040783a934fb8855614c9030525f1a648ac27e3ce5", - "summary": "Carry optional complete execution/recovery requirements and resolved evidence through SDL/native plans; declare installed support and fail closed on incompatible requests (#1361)." + "content_hash": "8e1adf3e7b8831103d26adc044dce3593bcc74a9b803aff88d1b302fa81f7183", + "summary": "Add the optional authored participant episode policy to behavior specifications: initialization, turn structure, terminal and truncation conditions, and reset policy as declared intent only (#307)." }, "schema_path": "contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json", "stability": "draft" diff --git a/contracts/schema-publication/entries/sdl-authoring-input-v1.json b/contracts/schema-publication/entries/sdl-authoring-input-v1.json index 4ed8c90a5..ddb2917f8 100644 --- a/contracts/schema-publication/entries/sdl-authoring-input-v1.json +++ b/contracts/schema-publication/entries/sdl-authoring-input-v1.json @@ -1,9 +1,9 @@ { - "content_hash": "6db2c5bb46445d0ed8eb140e1f7f8cacb562edfe8b44f139bb0b10c86f89a596", + "content_hash": "8b812a0c92c5e9817cf7327e121e9859926bdcbab4007dd4fdf997b7993b5716", "contract_id": "sdl-authoring-input-v1", "last_change": { - "content_hash": "6db2c5bb46445d0ed8eb140e1f7f8cacb562edfe8b44f139bb0b10c86f89a596", - "summary": "Carry optional complete execution/recovery requirements and resolved evidence through SDL/native plans; declare installed support and fail closed on incompatible requests (#1361)." + "content_hash": "8b812a0c92c5e9817cf7327e121e9859926bdcbab4007dd4fdf997b7993b5716", + "summary": "Add the optional authored participant episode policy to behavior specifications: initialization, turn structure, terminal and truncation conditions, and reset policy as declared intent only (#307)." }, "schema_path": "contracts/schemas/sdl/sdl-authoring-input-v1.json", "stability": "draft" diff --git a/contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json b/contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json index a40485f88..487b71e42 100644 --- a/contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json +++ b/contracts/schemas/satisfiability/scenario-satisfiability-evidence-v1.json @@ -10757,6 +10757,17 @@ "default": null, "title": "Behavior Mode" }, + "episode_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodePolicy" + }, + { + "type": "null" + } + ], + "default": null + }, "evidence_contract_refs": { "items": { "not": { @@ -10925,6 +10936,394 @@ "title": "ParticipantEffectClass", "type": "string" }, + "ParticipantEpisodeCompletionCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as completed.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "terminal_reason": { + "const": "completed", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeCompletionCondition", + "type": "object" + }, + "ParticipantEpisodeInitialization": { + "additionalProperties": false, + "description": "Preconditions of every new episode generation.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs" + ], + "title": "ParticipantEpisodeInitialization", + "type": "object" + }, + "ParticipantEpisodeInteractionStructure": { + "additionalProperties": false, + "description": "Turn order authority and the actions a turn offers.", + "properties": { + "action_contract_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Action Contract Refs", + "type": "array", + "uniqueItems": true + }, + "order_basis": { + "$ref": "#/$defs/ParticipantEpisodeTurnOrderBasis" + } + }, + "required": [ + "order_basis", + "action_contract_refs" + ], + "title": "ParticipantEpisodeInteractionStructure", + "type": "object" + }, + "ParticipantEpisodeMemoryScope": { + "description": "ADR-095 participant-memory scope across a reset.", + "enum": [ + "episode_local_reset", + "persistent_across_episodes" + ], + "title": "ParticipantEpisodeMemoryScope", + "type": "string" + }, + "ParticipantEpisodePolicy": { + "additionalProperties": false, + "description": "Versioned episode structure intent of a behavior specification.", + "properties": { + "initialization": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInitialization" + }, + { + "type": "null" + } + ], + "default": null + }, + "interaction_structure": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInteractionStructure" + }, + { + "type": "null" + } + ], + "default": null + }, + "profile": { + "const": "participant-episode-policy/v1", + "title": "Profile", + "type": "string" + }, + "reset_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeResetPolicy" + }, + { + "type": "null" + } + ], + "default": null + }, + "terminal_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "discriminator": { + "mapping": { + "completed": "#/$defs/ParticipantEpisodeCompletionCondition", + "timed_out": "#/$defs/ParticipantEpisodeTimeoutCondition" + }, + "propertyName": "terminal_reason" + }, + "oneOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeCompletionCondition" + }, + { + "$ref": "#/$defs/ParticipantEpisodeTimeoutCondition" + } + ] + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Terminal Conditions", + "type": "object" + }, + "truncation_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "$ref": "#/$defs/ParticipantEpisodeTruncationCondition" + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Truncation Conditions", + "type": "object" + } + }, + "required": [ + "profile" + ], + "title": "ParticipantEpisodePolicy", + "type": "object" + }, + "ParticipantEpisodeResetAction": { + "description": "ADR-013 control actions that start a later episode.", + "enum": [ + "reset", + "restart" + ], + "title": "ParticipantEpisodeResetAction", + "type": "string" + }, + "ParticipantEpisodeResetPolicy": { + "additionalProperties": false, + "allOf": [ + { + "else": { + "properties": { + "memory_reset_authority_ref": { + "type": "null" + } + } + }, + "if": { + "properties": { + "participant_memory_scope": { + "const": "episode_local_reset" + } + } + }, + "then": { + "properties": { + "memory_reset_authority_ref": { + "type": "string" + } + }, + "required": [ + "memory_reset_authority_ref" + ] + } + } + ], + "description": "Admitted reset actions, memory scope, reset authority, and evidence.", + "properties": { + "control_actions": { + "items": { + "$ref": "#/$defs/ParticipantEpisodeResetAction" + }, + "minItems": 1, + "title": "Control Actions", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "memory_reset_authority_ref": { + "anyOf": [ + { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Memory Reset Authority Ref" + }, + "participant_memory_scope": { + "$ref": "#/$defs/ParticipantEpisodeMemoryScope" + } + }, + "required": [ + "control_actions", + "participant_memory_scope", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeResetPolicy", + "type": "object" + }, + "ParticipantEpisodeTimeoutCondition": { + "additionalProperties": false, + "description": "Evidenced clock limit that ends the episode as timed out.", + "properties": { + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "temporal_constraint_ref": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "title": "Temporal Constraint Ref", + "type": "string" + }, + "terminal_reason": { + "const": "timed_out", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "temporal_constraint_ref", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTimeoutCondition", + "type": "object" + }, + "ParticipantEpisodeTruncationCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as truncated.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTruncationCondition", + "type": "object" + }, + "ParticipantEpisodeTurnOrderBasis": { + "description": "Authority that orders a participant's turns.", + "enum": [ + "decision-epoch" + ], + "title": "ParticipantEpisodeTurnOrderBasis", + "type": "string" + }, "ParticipantEvaluationAuthority": { "additionalProperties": false, "description": "Explicit evaluator-plane authority kept separate from participant actions.", diff --git a/contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json b/contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json index 3bd42ed10..3ac000533 100644 --- a/contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json +++ b/contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json @@ -10838,6 +10838,17 @@ "default": null, "title": "Behavior Mode" }, + "episode_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodePolicy" + }, + { + "type": "null" + } + ], + "default": null + }, "evidence_contract_refs": { "items": { "not": { @@ -11006,6 +11017,394 @@ "title": "ParticipantEffectClass", "type": "string" }, + "ParticipantEpisodeCompletionCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as completed.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "terminal_reason": { + "const": "completed", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeCompletionCondition", + "type": "object" + }, + "ParticipantEpisodeInitialization": { + "additionalProperties": false, + "description": "Preconditions of every new episode generation.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs" + ], + "title": "ParticipantEpisodeInitialization", + "type": "object" + }, + "ParticipantEpisodeInteractionStructure": { + "additionalProperties": false, + "description": "Turn order authority and the actions a turn offers.", + "properties": { + "action_contract_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Action Contract Refs", + "type": "array", + "uniqueItems": true + }, + "order_basis": { + "$ref": "#/$defs/ParticipantEpisodeTurnOrderBasis" + } + }, + "required": [ + "order_basis", + "action_contract_refs" + ], + "title": "ParticipantEpisodeInteractionStructure", + "type": "object" + }, + "ParticipantEpisodeMemoryScope": { + "description": "ADR-095 participant-memory scope across a reset.", + "enum": [ + "episode_local_reset", + "persistent_across_episodes" + ], + "title": "ParticipantEpisodeMemoryScope", + "type": "string" + }, + "ParticipantEpisodePolicy": { + "additionalProperties": false, + "description": "Versioned episode structure intent of a behavior specification.", + "properties": { + "initialization": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInitialization" + }, + { + "type": "null" + } + ], + "default": null + }, + "interaction_structure": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInteractionStructure" + }, + { + "type": "null" + } + ], + "default": null + }, + "profile": { + "const": "participant-episode-policy/v1", + "title": "Profile", + "type": "string" + }, + "reset_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeResetPolicy" + }, + { + "type": "null" + } + ], + "default": null + }, + "terminal_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "discriminator": { + "mapping": { + "completed": "#/$defs/ParticipantEpisodeCompletionCondition", + "timed_out": "#/$defs/ParticipantEpisodeTimeoutCondition" + }, + "propertyName": "terminal_reason" + }, + "oneOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeCompletionCondition" + }, + { + "$ref": "#/$defs/ParticipantEpisodeTimeoutCondition" + } + ] + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Terminal Conditions", + "type": "object" + }, + "truncation_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "$ref": "#/$defs/ParticipantEpisodeTruncationCondition" + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Truncation Conditions", + "type": "object" + } + }, + "required": [ + "profile" + ], + "title": "ParticipantEpisodePolicy", + "type": "object" + }, + "ParticipantEpisodeResetAction": { + "description": "ADR-013 control actions that start a later episode.", + "enum": [ + "reset", + "restart" + ], + "title": "ParticipantEpisodeResetAction", + "type": "string" + }, + "ParticipantEpisodeResetPolicy": { + "additionalProperties": false, + "allOf": [ + { + "else": { + "properties": { + "memory_reset_authority_ref": { + "type": "null" + } + } + }, + "if": { + "properties": { + "participant_memory_scope": { + "const": "episode_local_reset" + } + } + }, + "then": { + "properties": { + "memory_reset_authority_ref": { + "type": "string" + } + }, + "required": [ + "memory_reset_authority_ref" + ] + } + } + ], + "description": "Admitted reset actions, memory scope, reset authority, and evidence.", + "properties": { + "control_actions": { + "items": { + "$ref": "#/$defs/ParticipantEpisodeResetAction" + }, + "minItems": 1, + "title": "Control Actions", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "memory_reset_authority_ref": { + "anyOf": [ + { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Memory Reset Authority Ref" + }, + "participant_memory_scope": { + "$ref": "#/$defs/ParticipantEpisodeMemoryScope" + } + }, + "required": [ + "control_actions", + "participant_memory_scope", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeResetPolicy", + "type": "object" + }, + "ParticipantEpisodeTimeoutCondition": { + "additionalProperties": false, + "description": "Evidenced clock limit that ends the episode as timed out.", + "properties": { + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "temporal_constraint_ref": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "title": "Temporal Constraint Ref", + "type": "string" + }, + "terminal_reason": { + "const": "timed_out", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "temporal_constraint_ref", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTimeoutCondition", + "type": "object" + }, + "ParticipantEpisodeTruncationCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as truncated.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTruncationCondition", + "type": "object" + }, + "ParticipantEpisodeTurnOrderBasis": { + "description": "Authority that orders a participant's turns.", + "enum": [ + "decision-epoch" + ], + "title": "ParticipantEpisodeTurnOrderBasis", + "type": "string" + }, "ParticipantEvaluationAuthority": { "additionalProperties": false, "description": "Explicit evaluator-plane authority kept separate from participant actions.", diff --git a/contracts/schemas/sdl/instantiated-scenario-v1.json b/contracts/schemas/sdl/instantiated-scenario-v1.json index d0b8c642d..90b5eedb3 100644 --- a/contracts/schemas/sdl/instantiated-scenario-v1.json +++ b/contracts/schemas/sdl/instantiated-scenario-v1.json @@ -10173,6 +10173,17 @@ "default": null, "title": "Behavior Mode" }, + "episode_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodePolicy" + }, + { + "type": "null" + } + ], + "default": null + }, "evidence_contract_refs": { "items": { "not": { @@ -10341,6 +10352,394 @@ "title": "ParticipantEffectClass", "type": "string" }, + "ParticipantEpisodeCompletionCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as completed.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "terminal_reason": { + "const": "completed", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeCompletionCondition", + "type": "object" + }, + "ParticipantEpisodeInitialization": { + "additionalProperties": false, + "description": "Preconditions of every new episode generation.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs" + ], + "title": "ParticipantEpisodeInitialization", + "type": "object" + }, + "ParticipantEpisodeInteractionStructure": { + "additionalProperties": false, + "description": "Turn order authority and the actions a turn offers.", + "properties": { + "action_contract_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Action Contract Refs", + "type": "array", + "uniqueItems": true + }, + "order_basis": { + "$ref": "#/$defs/ParticipantEpisodeTurnOrderBasis" + } + }, + "required": [ + "order_basis", + "action_contract_refs" + ], + "title": "ParticipantEpisodeInteractionStructure", + "type": "object" + }, + "ParticipantEpisodeMemoryScope": { + "description": "ADR-095 participant-memory scope across a reset.", + "enum": [ + "episode_local_reset", + "persistent_across_episodes" + ], + "title": "ParticipantEpisodeMemoryScope", + "type": "string" + }, + "ParticipantEpisodePolicy": { + "additionalProperties": false, + "description": "Versioned episode structure intent of a behavior specification.", + "properties": { + "initialization": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInitialization" + }, + { + "type": "null" + } + ], + "default": null + }, + "interaction_structure": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInteractionStructure" + }, + { + "type": "null" + } + ], + "default": null + }, + "profile": { + "const": "participant-episode-policy/v1", + "title": "Profile", + "type": "string" + }, + "reset_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeResetPolicy" + }, + { + "type": "null" + } + ], + "default": null + }, + "terminal_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "discriminator": { + "mapping": { + "completed": "#/$defs/ParticipantEpisodeCompletionCondition", + "timed_out": "#/$defs/ParticipantEpisodeTimeoutCondition" + }, + "propertyName": "terminal_reason" + }, + "oneOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeCompletionCondition" + }, + { + "$ref": "#/$defs/ParticipantEpisodeTimeoutCondition" + } + ] + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Terminal Conditions", + "type": "object" + }, + "truncation_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "$ref": "#/$defs/ParticipantEpisodeTruncationCondition" + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Truncation Conditions", + "type": "object" + } + }, + "required": [ + "profile" + ], + "title": "ParticipantEpisodePolicy", + "type": "object" + }, + "ParticipantEpisodeResetAction": { + "description": "ADR-013 control actions that start a later episode.", + "enum": [ + "reset", + "restart" + ], + "title": "ParticipantEpisodeResetAction", + "type": "string" + }, + "ParticipantEpisodeResetPolicy": { + "additionalProperties": false, + "allOf": [ + { + "else": { + "properties": { + "memory_reset_authority_ref": { + "type": "null" + } + } + }, + "if": { + "properties": { + "participant_memory_scope": { + "const": "episode_local_reset" + } + } + }, + "then": { + "properties": { + "memory_reset_authority_ref": { + "type": "string" + } + }, + "required": [ + "memory_reset_authority_ref" + ] + } + } + ], + "description": "Admitted reset actions, memory scope, reset authority, and evidence.", + "properties": { + "control_actions": { + "items": { + "$ref": "#/$defs/ParticipantEpisodeResetAction" + }, + "minItems": 1, + "title": "Control Actions", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "memory_reset_authority_ref": { + "anyOf": [ + { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Memory Reset Authority Ref" + }, + "participant_memory_scope": { + "$ref": "#/$defs/ParticipantEpisodeMemoryScope" + } + }, + "required": [ + "control_actions", + "participant_memory_scope", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeResetPolicy", + "type": "object" + }, + "ParticipantEpisodeTimeoutCondition": { + "additionalProperties": false, + "description": "Evidenced clock limit that ends the episode as timed out.", + "properties": { + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "temporal_constraint_ref": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "title": "Temporal Constraint Ref", + "type": "string" + }, + "terminal_reason": { + "const": "timed_out", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "temporal_constraint_ref", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTimeoutCondition", + "type": "object" + }, + "ParticipantEpisodeTruncationCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as truncated.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "not": { + "pattern": "\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}" + }, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTruncationCondition", + "type": "object" + }, + "ParticipantEpisodeTurnOrderBasis": { + "description": "Authority that orders a participant's turns.", + "enum": [ + "decision-epoch" + ], + "title": "ParticipantEpisodeTurnOrderBasis", + "type": "string" + }, "ParticipantEvaluationAuthority": { "additionalProperties": false, "description": "Explicit evaluator-plane authority kept separate from participant actions.", diff --git a/contracts/schemas/sdl/materialized-scenario-v1.json b/contracts/schemas/sdl/materialized-scenario-v1.json index 58bcc31cc..6f0440806 100644 --- a/contracts/schemas/sdl/materialized-scenario-v1.json +++ b/contracts/schemas/sdl/materialized-scenario-v1.json @@ -1,345 +1,355 @@ { "$defs": { "ACLAction": {"description":"Firewall rule action.","enum":["allow","deny"],"title":"ACLAction","type":"string"}, - "ACLRule": {"additionalProperties":false,"description":"A network access control rule on an infrastructure node.\n\nAdapted from CybORG's subnet NACL model. Specifies directional\ntraffic rules between network segments.","properties":{"action":{"anyOf":[{"$ref":"#/$defs/ACLAction"},{"$ref":"#/$defs/_r187"}],"default":"allow","title":"Action"},"description":{"$ref":"#/$defs/_r53"},"direction":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Direction","type":"string"},"from_net":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"From Net","type":"string"},"name":{"$ref":"#/$defs/_r21"},"ports":{"items":{"$ref":"#/$defs/_r44"},"title":"Ports","type":"array"},"protocol":{"default":"any","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Protocol","type":"string"},"to_net":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"To Net","type":"string"}},"title":"ACLRule","type":"object"}, - "Account": {"additionalProperties":false,"description":"A user account on a scenario node.\n\nDistinct from OCR's ``Role`` model: roles map exercise participants\nto compute-node logins for exercise access. Accounts describe the environment\nstate \u2014 what accounts attackers will encounter or exploit.","properties":{"auth_method":{"anyOf":[{"$ref":"#/$defs/AccountAuthenticationMethod"},{"$ref":"#/$defs/_r167"}],"default":"password","title":"Auth Method"},"credential_bindings":{"items":{"$ref":"#/$defs/AccountCredentialBinding"},"title":"Credential Bindings","type":"array"},"description":{"$ref":"#/$defs/_r53"},"disabled":{"$ref":"#/$defs/_r33"},"domain_ref":{"$ref":"#/$defs/_r57"},"groups":{"$ref":"#/$defs/_r121"},"home":{"$ref":"#/$defs/_r60"},"mail":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mail","type":"string"},"materialization_profile":{"anyOf":[{"$ref":"#/$defs/DomainProfileBindingModel"},{"type":"null"}],"default":null},"node":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node","type":"string"},"password_strength":{"anyOf":[{"$ref":"#/$defs/PasswordStrength"},{"$ref":"#/$defs/_r187"}],"default":"medium","title":"Password Strength"},"shell":{"$ref":"#/$defs/_r72"},"spn":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Spn","type":"string"},"username":{"$ref":"#/$defs/_r185"}},"required":["username"],"title":"Account","type":"object"}, + "ACLRule": {"additionalProperties":false,"description":"A network access control rule on an infrastructure node.\n\nAdapted from CybORG's subnet NACL model. Specifies directional\ntraffic rules between network segments.","properties":{"action":{"anyOf":[{"$ref":"#/$defs/ACLAction"},{"$ref":"#/$defs/_r190"}],"default":"allow","title":"Action"},"description":{"$ref":"#/$defs/_r53"},"direction":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Direction","type":"string"},"from_net":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"From Net","type":"string"},"name":{"$ref":"#/$defs/_r21"},"ports":{"items":{"$ref":"#/$defs/_r44"},"title":"Ports","type":"array"},"protocol":{"default":"any","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Protocol","type":"string"},"to_net":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"To Net","type":"string"}},"title":"ACLRule","type":"object"}, + "Account": {"additionalProperties":false,"description":"A user account on a scenario node.\n\nDistinct from OCR's ``Role`` model: roles map exercise participants\nto compute-node logins for exercise access. Accounts describe the environment\nstate \u2014 what accounts attackers will encounter or exploit.","properties":{"auth_method":{"anyOf":[{"$ref":"#/$defs/AccountAuthenticationMethod"},{"$ref":"#/$defs/_r170"}],"default":"password","title":"Auth Method"},"credential_bindings":{"items":{"$ref":"#/$defs/AccountCredentialBinding"},"title":"Credential Bindings","type":"array"},"description":{"$ref":"#/$defs/_r53"},"disabled":{"$ref":"#/$defs/_r33"},"domain_ref":{"$ref":"#/$defs/_r57"},"groups":{"$ref":"#/$defs/_r124"},"home":{"$ref":"#/$defs/_r60"},"mail":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mail","type":"string"},"materialization_profile":{"anyOf":[{"$ref":"#/$defs/DomainProfileBindingModel"},{"type":"null"}],"default":null},"node":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node","type":"string"},"password_strength":{"anyOf":[{"$ref":"#/$defs/PasswordStrength"},{"$ref":"#/$defs/_r190"}],"default":"medium","title":"Password Strength"},"shell":{"$ref":"#/$defs/_r72"},"spn":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Spn","type":"string"},"username":{"$ref":"#/$defs/_r188"}},"required":["username"],"title":"Account","type":"object"}, "AccountAuthenticationMethod": {"description":"Portable authentication methods shared by account posture and bindings.","enum":["password","key","certificate"],"title":"AccountAuthenticationMethod","type":"string"}, - "AccountCredentialBinding": {"additionalProperties":false,"description":"One credential bound unambiguously to its owning account by nesting.","properties":{"auth_method":{"anyOf":[{"$ref":"#/$defs/AccountAuthenticationMethod"},{"$ref":"#/$defs/_r167"}],"title":"Auth Method"},"credential_id":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Credential Id","type":"string"},"material":{"discriminator":{"mapping":{"operator_secret":"#/$defs/OperatorSecretCredentialMaterial","secret_fixture":"#/$defs/SecretFixtureCredentialMaterial"},"propertyName":"classification"},"oneOf":[{"$ref":"#/$defs/SecretFixtureCredentialMaterial"},{"$ref":"#/$defs/OperatorSecretCredentialMaterial"}],"title":"Material"},"purpose":{"anyOf":[{"$ref":"#/$defs/AccountCredentialPurpose"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:primary_authentication|administrative_authentication|primary-authentication|administrative-authentication|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"}],"title":"Purpose"}},"required":["credential_id","purpose","auth_method","material"],"title":"AccountCredentialBinding","type":"object"}, + "AccountCredentialBinding": {"additionalProperties":false,"description":"One credential bound unambiguously to its owning account by nesting.","properties":{"auth_method":{"anyOf":[{"$ref":"#/$defs/AccountAuthenticationMethod"},{"$ref":"#/$defs/_r170"}],"title":"Auth Method"},"credential_id":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Credential Id","type":"string"},"material":{"discriminator":{"mapping":{"operator_secret":"#/$defs/OperatorSecretCredentialMaterial","secret_fixture":"#/$defs/SecretFixtureCredentialMaterial"},"propertyName":"classification"},"oneOf":[{"$ref":"#/$defs/SecretFixtureCredentialMaterial"},{"$ref":"#/$defs/OperatorSecretCredentialMaterial"}],"title":"Material"},"purpose":{"anyOf":[{"$ref":"#/$defs/AccountCredentialPurpose"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:primary_authentication|administrative_authentication|primary-authentication|administrative-authentication|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"}],"title":"Purpose"}},"required":["credential_id","purpose","auth_method","material"],"title":"AccountCredentialBinding","type":"object"}, "AccountCredentialPurpose": {"description":"Governed purposes for portable account credential bindings.","enum":["primary_authentication","administrative_authentication"],"title":"AccountCredentialPurpose","type":"string"}, - "Agent": {"additionalProperties":false,"description":"A role-neutral participant in the scenario.\n\nAgents reference existing scenario elements:\n\n- ``affiliations`` links to entities without conferring identity or authority\n- ``role`` explicitly selects an exercise role, overriding inherited role\n- ``starting_accounts`` links to the accounts section\n- ``allowed_subnets`` links to infrastructure entries\n- ``initial_knowledge`` references nodes and infrastructure\n- ``starting_assertions`` links to precondition assertions, giving the\n authoring surface a declarative hook for participant-relevant starting\n state without equating a probe implementation with truth (ACT-601)\n- ``authority_anchors`` links to declared SDL elements (entities,\n relationships, content, etc.) that anchor what the participant is\n allowed or expected to do in scenario meaning (ACT-601, ADR-020)\n- ``operating_scope`` links to targetable named scenario elements\n (subnets, hosts, services, content) defining where the participant\n may act or observe (ACT-601, ADR-020)\n- ``observation_boundaries`` links to declared participant observation\n boundaries that define participant-specific projections of world and\n evidence state (SEM-208)\n- ``interactive_access`` declares the compute-node/channel pairs that may be offered\n to this participant, without inferring a listener, locator, credential,\n operating scope, action authority, or successful realization (DSL-117)\n\nPer ADR-073 the CybORG-inherited ``reward_calculator`` label was removed;\nit was an unbound, unvalidated string and graded reward lives in the\nexperiment/evaluator plane (ADR-055/064/069).","properties":{"actions":{"$ref":"#/$defs/_r99"},"affiliations":{"items":{"$ref":"#/$defs/_r187"},"title":"Affiliations","type":"array"},"allowed_subnets":{"items":{"$ref":"#/$defs/_r187"},"title":"Allowed Subnets","type":"array"},"authority_anchors":{"items":{"$ref":"#/$defs/_r187"},"title":"Authority Anchors","type":"array"},"description":{"$ref":"#/$defs/_r53"},"initial_knowledge":{"anyOf":[{"$ref":"#/$defs/InitialKnowledge"},{"type":"null"}],"default":null},"interactive_access":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantInteractiveAccess"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Interactive Access","type":"object"},"observation_boundaries":{"items":{"$ref":"#/$defs/_r187"},"title":"Observation Boundaries","type":"array"},"operating_scope":{"items":{"$ref":"#/$defs/_r187"},"title":"Operating Scope","type":"array"},"role":{"anyOf":[{"$ref":"#/$defs/ExerciseRole"},{"type":"null"}],"default":null,"title":"Role"},"starting_accounts":{"items":{"$ref":"#/$defs/_r187"},"title":"Starting Accounts","type":"array"},"starting_assertions":{"items":{"$ref":"#/$defs/_r187"},"title":"Starting Assertions","type":"array"}},"title":"Agent","type":"object"}, + "Agent": {"additionalProperties":false,"description":"A role-neutral participant in the scenario.\n\nAgents reference existing scenario elements:\n\n- ``affiliations`` links to entities without conferring identity or authority\n- ``role`` explicitly selects an exercise role, overriding inherited role\n- ``starting_accounts`` links to the accounts section\n- ``allowed_subnets`` links to infrastructure entries\n- ``initial_knowledge`` references nodes and infrastructure\n- ``starting_assertions`` links to precondition assertions, giving the\n authoring surface a declarative hook for participant-relevant starting\n state without equating a probe implementation with truth (ACT-601)\n- ``authority_anchors`` links to declared SDL elements (entities,\n relationships, content, etc.) that anchor what the participant is\n allowed or expected to do in scenario meaning (ACT-601, ADR-020)\n- ``operating_scope`` links to targetable named scenario elements\n (subnets, hosts, services, content) defining where the participant\n may act or observe (ACT-601, ADR-020)\n- ``observation_boundaries`` links to declared participant observation\n boundaries that define participant-specific projections of world and\n evidence state (SEM-208)\n- ``interactive_access`` declares the compute-node/channel pairs that may be offered\n to this participant, without inferring a listener, locator, credential,\n operating scope, action authority, or successful realization (DSL-117)\n\nPer ADR-073 the CybORG-inherited ``reward_calculator`` label was removed;\nit was an unbound, unvalidated string and graded reward lives in the\nexperiment/evaluator plane (ADR-055/064/069).","properties":{"actions":{"$ref":"#/$defs/_r102"},"affiliations":{"items":{"$ref":"#/$defs/_r190"},"title":"Affiliations","type":"array"},"allowed_subnets":{"items":{"$ref":"#/$defs/_r190"},"title":"Allowed Subnets","type":"array"},"authority_anchors":{"items":{"$ref":"#/$defs/_r190"},"title":"Authority Anchors","type":"array"},"description":{"$ref":"#/$defs/_r53"},"initial_knowledge":{"anyOf":[{"$ref":"#/$defs/InitialKnowledge"},{"type":"null"}],"default":null},"interactive_access":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantInteractiveAccess"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Interactive Access","type":"object"},"observation_boundaries":{"items":{"$ref":"#/$defs/_r190"},"title":"Observation Boundaries","type":"array"},"operating_scope":{"items":{"$ref":"#/$defs/_r190"},"title":"Operating Scope","type":"array"},"role":{"anyOf":[{"$ref":"#/$defs/ExerciseRole"},{"type":"null"}],"default":null,"title":"Role"},"starting_accounts":{"items":{"$ref":"#/$defs/_r190"},"title":"Starting Accounts","type":"array"},"starting_assertions":{"items":{"$ref":"#/$defs/_r190"},"title":"Starting Assertions","type":"array"}},"title":"Agent","type":"object"}, "ArtifactCandidate": {"additionalProperties":false,"description":"One immutable candidate explicitly admitted by the author.","properties":{"artifact":{"$ref":"#/$defs/ArtifactIdentity"},"candidate_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Candidate Id","type":"string"}},"required":["candidate_id","artifact"],"title":"ArtifactCandidate","type":"object"}, - "ArtifactConstraint": {"additionalProperties":false,"description":"One typed, named bound on a constrained artifact selection.","properties":{"allowed_values":{"items":{"$ref":"#/$defs/_r131"},"minItems":1,"title":"Allowed Values","type":"array"},"constraint_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Constraint Id","type":"string"},"kind":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Kind","type":"string"}},"required":["constraint_id","kind","allowed_values"],"title":"ArtifactConstraint","type":"object"}, - "ArtifactIdentity": {"additionalProperties":false,"description":"Immutable provider-neutral identity for one artifact payload.","properties":{"artifact_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Artifact Id","type":"string"},"digest":{"$ref":"#/$defs/_r168"},"media_type":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Media Type","type":"string"},"version":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Version","type":"string"}},"required":["artifact_id","version","digest","media_type"],"title":"ArtifactIdentity","type":"object"}, + "ArtifactConstraint": {"additionalProperties":false,"description":"One typed, named bound on a constrained artifact selection.","properties":{"allowed_values":{"items":{"$ref":"#/$defs/_r134"},"minItems":1,"title":"Allowed Values","type":"array"},"constraint_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Constraint Id","type":"string"},"kind":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Kind","type":"string"}},"required":["constraint_id","kind","allowed_values"],"title":"ArtifactConstraint","type":"object"}, + "ArtifactIdentity": {"additionalProperties":false,"description":"Immutable provider-neutral identity for one artifact payload.","properties":{"artifact_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Artifact Id","type":"string"},"digest":{"$ref":"#/$defs/_r171"},"media_type":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Media Type","type":"string"},"version":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Version","type":"string"}},"required":["artifact_id","version","digest","media_type"],"title":"ArtifactIdentity","type":"object"}, "ArtifactLockedInput": {"additionalProperties":false,"description":"One immutable materialization input joined to existing trust contracts.","properties":{"artifact":{"$ref":"#/$defs/ArtifactIdentity"},"associated_artifact_manifest_ref":{"maxLength":1024,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Associated Artifact Manifest Ref","type":"string"},"input_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Input Id","type":"string"},"trust_policy_ref":{"maxLength":1024,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trust Policy Ref","type":"string"}},"required":["input_id","artifact","associated_artifact_manifest_ref","trust_policy_ref"],"title":"ArtifactLockedInput","type":"object"}, - "ArtifactMaterializationSpecification": {"additionalProperties":false,"allOf":[{"properties":{"profile":{"allOf":[{"properties":{"mechanism":{"anyOf":[{"const":"materialization-specification"},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}]}},"required":["mechanism"]}]}}}],"description":"Reference to a closed executable materialization profile.\n\nThis is a digest-bound specification reference, not shell text, a\nDockerfile, an environment map, or a reinterpretation of ``Source.build``.","properties":{"digest":{"$ref":"#/$defs/_r168"},"locked_input_ids":{"items":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","type":"string"},"title":"Locked Input Ids","type":"array","uniqueItems":true},"profile":{"$ref":"#/$defs/ArtifactMechanismProfile"},"specification_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Specification Id","type":"string"}},"required":["specification_id","profile","digest"],"title":"ArtifactMaterializationSpecification","type":"object"}, - "ArtifactMechanismProfile": {"additionalProperties":false,"description":"Versioned portable mechanism profile.\n\nPortable mechanisms use the governed base names above or a namespaced\n``x-:`` extension. The profile digest binds the exact\nmechanism contract without making the mechanism set a closed union.","properties":{"digest":{"$ref":"#/$defs/_r168"},"mechanism":{"anyOf":[{"enum":["backend-owned-artifact","dynamic-composition","exact-artifact","materialization-specification","published-candidate"]},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}],"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mechanism","type":"string"},"profile":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Profile","type":"string"},"version":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Version","type":"string"}},"required":["mechanism","profile","version","digest"],"title":"ArtifactMechanismProfile","type":"object"}, - "ArtifactRequirement": {"additionalProperties":false,"allOf":[{"if":{"properties":{"explicitness":{"const":"exact"}},"required":["explicitness"]},"then":{"properties":{"candidates":{"maxItems":0},"constraints":{"maxItems":0},"exact_artifact":{"not":{"type":"null"}},"locked_inputs":{"maxItems":0},"materialization_specifications":{"maxItems":0},"permitted_routes":{"items":{"properties":{"mechanism":{"properties":{"mechanism":{"const":"exact-artifact"}}}}}}},"required":["exact_artifact"]}},{"if":{"properties":{"explicitness":{"const":"constrained"}},"required":["explicitness"]},"then":{"anyOf":[{"properties":{"constraints":{"minItems":1}},"required":["constraints"]},{"properties":{"candidates":{"minItems":1}},"required":["candidates"]},{"properties":{"locked_inputs":{"minItems":1}},"required":["locked_inputs"]},{"properties":{"materialization_specifications":{"minItems":1}},"required":["materialization_specifications"]}],"properties":{"exact_artifact":{"type":"null"}}}},{"if":{"properties":{"explicitness":{"const":"open"}},"required":["explicitness"]},"then":{"properties":{"candidates":{"maxItems":0},"constraints":{"maxItems":0},"exact_artifact":{"type":"null"},"materialization_specifications":{"maxItems":0}}}}],"description":"Author-owned artifact requirement attached to a ``Source`` selector.","properties":{"associated_artifact_manifest_refs":{"items":{"$ref":"#/$defs/_r131"},"title":"Associated Artifact Manifest Refs","type":"array","uniqueItems":true},"candidates":{"items":{"$ref":"#/$defs/ArtifactCandidate"},"title":"Candidates","type":"array","uniqueItems":true},"constraints":{"items":{"$ref":"#/$defs/ArtifactConstraint"},"title":"Constraints","type":"array","uniqueItems":true},"exact_artifact":{"anyOf":[{"$ref":"#/$defs/ArtifactIdentity"},{"type":"null"}],"default":null},"explicitness":{"$ref":"#/$defs/ExplicitnessClass"},"locked_inputs":{"items":{"$ref":"#/$defs/ArtifactLockedInput"},"title":"Locked Inputs","type":"array","uniqueItems":true},"materialization_specifications":{"items":{"$ref":"#/$defs/ArtifactMaterializationSpecification"},"title":"Materialization Specifications","type":"array","uniqueItems":true},"permitted_routes":{"items":{"$ref":"#/$defs/ArtifactSatisfactionRoute"},"minItems":1,"title":"Permitted Routes","type":"array","uniqueItems":true},"requirement_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Requirement Id","type":"string"},"trust_policy_refs":{"items":{"$ref":"#/$defs/_r131"},"title":"Trust Policy Refs","type":"array","uniqueItems":true}},"required":["requirement_id","explicitness","permitted_routes"],"title":"ArtifactRequirement","type":"object"}, + "ArtifactMaterializationSpecification": {"additionalProperties":false,"allOf":[{"properties":{"profile":{"allOf":[{"properties":{"mechanism":{"anyOf":[{"const":"materialization-specification"},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}]}},"required":["mechanism"]}]}}}],"description":"Reference to a closed executable materialization profile.\n\nThis is a digest-bound specification reference, not shell text, a\nDockerfile, an environment map, or a reinterpretation of ``Source.build``.","properties":{"digest":{"$ref":"#/$defs/_r171"},"locked_input_ids":{"items":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","type":"string"},"title":"Locked Input Ids","type":"array","uniqueItems":true},"profile":{"$ref":"#/$defs/ArtifactMechanismProfile"},"specification_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Specification Id","type":"string"}},"required":["specification_id","profile","digest"],"title":"ArtifactMaterializationSpecification","type":"object"}, + "ArtifactMechanismProfile": {"additionalProperties":false,"description":"Versioned portable mechanism profile.\n\nPortable mechanisms use the governed base names above or a namespaced\n``x-:`` extension. The profile digest binds the exact\nmechanism contract without making the mechanism set a closed union.","properties":{"digest":{"$ref":"#/$defs/_r171"},"mechanism":{"anyOf":[{"enum":["backend-owned-artifact","dynamic-composition","exact-artifact","materialization-specification","published-candidate"]},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}],"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mechanism","type":"string"},"profile":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Profile","type":"string"},"version":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Version","type":"string"}},"required":["mechanism","profile","version","digest"],"title":"ArtifactMechanismProfile","type":"object"}, + "ArtifactRequirement": {"additionalProperties":false,"allOf":[{"if":{"properties":{"explicitness":{"const":"exact"}},"required":["explicitness"]},"then":{"properties":{"candidates":{"maxItems":0},"constraints":{"maxItems":0},"exact_artifact":{"not":{"type":"null"}},"locked_inputs":{"maxItems":0},"materialization_specifications":{"maxItems":0},"permitted_routes":{"items":{"properties":{"mechanism":{"properties":{"mechanism":{"const":"exact-artifact"}}}}}}},"required":["exact_artifact"]}},{"if":{"properties":{"explicitness":{"const":"constrained"}},"required":["explicitness"]},"then":{"anyOf":[{"properties":{"constraints":{"minItems":1}},"required":["constraints"]},{"properties":{"candidates":{"minItems":1}},"required":["candidates"]},{"properties":{"locked_inputs":{"minItems":1}},"required":["locked_inputs"]},{"properties":{"materialization_specifications":{"minItems":1}},"required":["materialization_specifications"]}],"properties":{"exact_artifact":{"type":"null"}}}},{"if":{"properties":{"explicitness":{"const":"open"}},"required":["explicitness"]},"then":{"properties":{"candidates":{"maxItems":0},"constraints":{"maxItems":0},"exact_artifact":{"type":"null"},"materialization_specifications":{"maxItems":0}}}}],"description":"Author-owned artifact requirement attached to a ``Source`` selector.","properties":{"associated_artifact_manifest_refs":{"items":{"$ref":"#/$defs/_r134"},"title":"Associated Artifact Manifest Refs","type":"array","uniqueItems":true},"candidates":{"items":{"$ref":"#/$defs/ArtifactCandidate"},"title":"Candidates","type":"array","uniqueItems":true},"constraints":{"items":{"$ref":"#/$defs/ArtifactConstraint"},"title":"Constraints","type":"array","uniqueItems":true},"exact_artifact":{"anyOf":[{"$ref":"#/$defs/ArtifactIdentity"},{"type":"null"}],"default":null},"explicitness":{"$ref":"#/$defs/ExplicitnessClass"},"locked_inputs":{"items":{"$ref":"#/$defs/ArtifactLockedInput"},"title":"Locked Inputs","type":"array","uniqueItems":true},"materialization_specifications":{"items":{"$ref":"#/$defs/ArtifactMaterializationSpecification"},"title":"Materialization Specifications","type":"array","uniqueItems":true},"permitted_routes":{"items":{"$ref":"#/$defs/ArtifactSatisfactionRoute"},"minItems":1,"title":"Permitted Routes","type":"array","uniqueItems":true},"requirement_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-zA-Z0-9][a-zA-Z0-9._:/@+-]*$","title":"Requirement Id","type":"string"},"trust_policy_refs":{"items":{"$ref":"#/$defs/_r134"},"title":"Trust Policy Refs","type":"array","uniqueItems":true}},"required":["requirement_id","explicitness","permitted_routes"],"title":"ArtifactRequirement","type":"object"}, "ArtifactSatisfactionRoute": {"additionalProperties":false,"description":"One permitted mechanism/acquisition/timing combination.","properties":{"acquisition":{"enum":["pull","copy","import","local-lookup","none"],"title":"Acquisition","type":"string"},"mechanism":{"$ref":"#/$defs/ArtifactMechanismProfile"},"timing":{"enum":["publication","pack-ingestion","backend-preparation","realization"],"title":"Timing","type":"string"}},"required":["mechanism","acquisition","timing"],"title":"ArtifactSatisfactionRoute","type":"object"}, "Assertion": {"additionalProperties":false,"description":"A typed use of one proposition at a governed semantic boundary.","properties":{"description":{"$ref":"#/$defs/_r53"},"polarity":{"$ref":"#/$defs/AssertionPolarity","default":"positive"},"proposition":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Proposition","type":"string"},"role":{"$ref":"#/$defs/AssertionRole"}},"required":["proposition","role"],"title":"Assertion","type":"object"}, "AssertionPolarity": {"description":"Expected polarity of the referenced proposition.","enum":["positive","negative"],"title":"AssertionPolarity","type":"string"}, "AssertionRole": {"description":"Boundary at which an assertion constrains its owning construct.","enum":["precondition","invariant","postcondition"],"title":"AssertionRole","type":"string"}, - "AssetValue": {"additionalProperties":false,"description":"CIA triad asset valuation for scoring and risk assessment.","properties":{"availability":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r187"}],"default":"medium","title":"Availability"},"confidentiality":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r187"}],"default":"medium","title":"Confidentiality"},"integrity":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r187"}],"default":"medium","title":"Integrity"}},"title":"AssetValue","type":"object"}, + "AssetValue": {"additionalProperties":false,"description":"CIA triad asset valuation for scoring and risk assessment.","properties":{"availability":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r190"}],"default":"medium","title":"Availability"},"confidentiality":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r190"}],"default":"medium","title":"Confidentiality"},"integrity":{"anyOf":[{"$ref":"#/$defs/AssetValueLevel"},{"$ref":"#/$defs/_r190"}],"default":"medium","title":"Integrity"}},"title":"AssetValue","type":"object"}, "AssetValueLevel": {"description":"CIA triad value level. Adapted from CybORG ConfidentialityValue.","enum":["none","low","medium","high","critical"],"title":"AssetValueLevel","type":"string"}, "AugmentationScopePolicy": {"additionalProperties":false,"description":"Authors opt into restrictions; omission imposes no new authoring burden.","properties":{"default":{"default":"open","enum":["open","closed"],"title":"Default","type":"string"},"scopes":{"default":[],"items":{"$ref":"#/$defs/AugmentationScopeRule"},"maxItems":256,"title":"Scopes","type":"array"}},"title":"AugmentationScopePolicy","type":"object"}, - "AugmentationScopeRule": {"additionalProperties":false,"description":"One explicit node or concern permission, using a semantic address.","properties":{"namespace":{"$ref":"#/$defs/_r87"},"permission":{"enum":["open","closed"],"title":"Permission","type":"string"},"scope":{"$ref":"#/$defs/_r135"}},"required":["scope","permission"],"title":"AugmentationScopeRule","type":"object"}, - "BehaviorSpecificationExtensionValue": {"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"integer"},{"type":"number"},{"type":"boolean"},{"items":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"type":"array"},{"additionalProperties":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"type":"object"},{"type":"null"}]}, - "BooleanPredicate": {"additionalProperties":false,"description":"Compare a governed Boolean property with an expected Boolean.","properties":{"expected":{"title":"Expected","type":"boolean"},"kind":{"const":"boolean","default":"boolean","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r137"},"semantic_ref":{"$ref":"#/$defs/_r133"}},"required":["property","semantic_ref","expected"],"title":"BooleanPredicate","type":"object"}, - "Clock": {"additionalProperties":false,"description":"Authored clock authority over one time domain.","properties":{"authority_kind":{"$ref":"#/$defs/ClockAuthorityKind"},"authority_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority Ref","type":"string"},"description":{"$ref":"#/$defs/_r172"},"monotonicity":{"$ref":"#/$defs/ClockMonotonicity"},"supports_jump":{"default":false,"title":"Supports Jump","type":"boolean"},"supports_pause":{"default":false,"title":"Supports Pause","type":"boolean"},"supports_reset":{"default":false,"title":"Supports Reset","type":"boolean"},"time_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Time Domain Ref","type":"string"}},"required":["time_domain_ref","authority_kind","authority_ref","monotonicity","description"],"title":"Clock","type":"object"}, + "AugmentationScopeRule": {"additionalProperties":false,"description":"One explicit node or concern permission, using a semantic address.","properties":{"namespace":{"$ref":"#/$defs/_r87"},"permission":{"enum":["open","closed"],"title":"Permission","type":"string"},"scope":{"$ref":"#/$defs/_r138"}},"required":["scope","permission"],"title":"AugmentationScopeRule","type":"object"}, + "BehaviorSpecificationExtensionValue": {"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"integer"},{"type":"number"},{"type":"boolean"},{"items":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"type":"array"},{"additionalProperties":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"type":"object"},{"type":"null"}]}, + "BooleanPredicate": {"additionalProperties":false,"description":"Compare a governed Boolean property with an expected Boolean.","properties":{"expected":{"title":"Expected","type":"boolean"},"kind":{"const":"boolean","default":"boolean","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r140"},"semantic_ref":{"$ref":"#/$defs/_r136"}},"required":["property","semantic_ref","expected"],"title":"BooleanPredicate","type":"object"}, + "Clock": {"additionalProperties":false,"description":"Authored clock authority over one time domain.","properties":{"authority_kind":{"$ref":"#/$defs/ClockAuthorityKind"},"authority_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority Ref","type":"string"},"description":{"$ref":"#/$defs/_r175"},"monotonicity":{"$ref":"#/$defs/ClockMonotonicity"},"supports_jump":{"default":false,"title":"Supports Jump","type":"boolean"},"supports_pause":{"default":false,"title":"Supports Pause","type":"boolean"},"supports_reset":{"default":false,"title":"Supports Reset","type":"boolean"},"time_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Time Domain Ref","type":"string"}},"required":["time_domain_ref","authority_kind","authority_ref","monotonicity","description"],"title":"Clock","type":"object"}, "ClockAuthorityKind": {"description":"Plane that owns authoritative clock values.","enum":["runtime","backend","system","external"],"title":"ClockAuthorityKind","type":"string"}, "ClockMonotonicity": {"description":"Allowed direction of authoritative clock movement.","enum":["strict","non_decreasing","may_jump"],"title":"ClockMonotonicity","type":"string"}, - "Condition": {"additionalProperties":false,"description":"A probe implementation deployed to a compute node.\n\nEither ``command`` + ``interval`` or ``source`` must be set, not both.","properties":{"command":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Command"},"description":{"$ref":"#/$defs/_r53"},"environment":{"$ref":"#/$defs/_r117"},"interval":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Interval"},"name":{"$ref":"#/$defs/_r64"},"proposition":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Proposition","type":"string"},"retries":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Retries"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"start_period":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Start Period"},"timeout":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Timeout"}},"title":"Condition","type":"object"}, + "Condition": {"additionalProperties":false,"description":"A probe implementation deployed to a compute node.\n\nEither ``command`` + ``interval`` or ``source`` must be set, not both.","properties":{"command":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Command"},"description":{"$ref":"#/$defs/_r53"},"environment":{"$ref":"#/$defs/_r120"},"interval":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Interval"},"name":{"$ref":"#/$defs/_r64"},"proposition":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Proposition","type":"string"},"retries":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Retries"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"start_period":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Start Period"},"timeout":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Timeout"}},"title":"Condition","type":"object"}, "ConsumerAccessMode": {"enum":["read_only","read_write"],"title":"ConsumerAccessMode","type":"string"}, "ContainerImageBuildProvenance": {"additionalProperties":false,"description":"Observed build/provenance facts for a custom container image artifact.","properties":{"attestation":{"anyOf":[{"$ref":"#/$defs/ImageAttestation"},{"type":"null"}],"default":null},"base_image":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Base Image","type":"string"},"base_image_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Base Image Digest","type":"string"},"build_args":{"items":{"$ref":"#/$defs/ImageBuildArg"},"title":"Build Args","type":"array"},"config":{"anyOf":[{"$ref":"#/$defs/ImageConfig"},{"type":"null"}],"default":null},"copied_sources":{"items":{"$ref":"#/$defs/ImageCopiedSource"},"title":"Copied Sources","type":"array"},"description":{"$ref":"#/$defs/_r53"},"dockerfile_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Dockerfile Path","type":"string"},"instructions":{"items":{"$ref":"#/$defs/DockerfileInstruction"},"title":"Instructions","type":"array"},"layers":{"items":{"$ref":"#/$defs/ImageLayer"},"title":"Layers","type":"array"},"source_inputs":{"items":{"$ref":"#/$defs/ImageSourceInput"},"title":"Source Inputs","type":"array"}},"title":"ContainerImageBuildProvenance","type":"object"}, - "Content": {"additionalProperties":false,"description":"Data or files placed into a scenario node.\n\nSupports three forms:\n\n- ``file``: A single file at a specific path, optionally with inline text.\n- ``dataset``: A collection of related items (emails, records, pcaps)\n delivered via a source package or listed as items.\n- ``directory``: A directory structure placed at a destination path.","properties":{"description":{"$ref":"#/$defs/_r53"},"destination":{"$ref":"#/$defs/_r54"},"format":{"$ref":"#/$defs/_r58"},"items":{"items":{"$ref":"#/$defs/ContentItem"},"title":"Items","type":"array"},"path":{"$ref":"#/$defs/_r65"},"sensitive":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Sensitive"},"service_materialization":{"anyOf":[{"discriminator":{"mapping":{"service-content":"#/$defs/ServiceMaterialization","service-search-index-schema":"#/$defs/ServiceSearchIndexSchemaMaterialization"},"propertyName":"interface_profile"},"oneOf":[{"$ref":"#/$defs/ServiceMaterialization"},{"$ref":"#/$defs/ServiceSearchIndexSchemaMaterialization"}]},{"$ref":"#/$defs/DomainProfileBindingModel"},{"type":"null"}],"default":null,"title":"Service Materialization"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"tags":{"$ref":"#/$defs/_r129"},"target":{"$ref":"#/$defs/_r78"},"text":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Text"},"text_from":{"$ref":"#/$defs/_r7"},"type":{"$ref":"#/$defs/ContentType"}},"required":["type"],"title":"Content","type":"object"}, - "ContentItem": {"additionalProperties":false,"description":"A single item within a dataset (e.g., one email, one record).","properties":{"description":{"$ref":"#/$defs/_r53"},"display_name":{"$ref":"#/$defs/_r56"},"name":{"$ref":"#/$defs/_r1"},"tags":{"$ref":"#/$defs/_r129"}},"required":["name"],"title":"ContentItem","type":"object"}, + "Content": {"additionalProperties":false,"description":"Data or files placed into a scenario node.\n\nSupports three forms:\n\n- ``file``: A single file at a specific path, optionally with inline text.\n- ``dataset``: A collection of related items (emails, records, pcaps)\n delivered via a source package or listed as items.\n- ``directory``: A directory structure placed at a destination path.","properties":{"description":{"$ref":"#/$defs/_r53"},"destination":{"$ref":"#/$defs/_r54"},"format":{"$ref":"#/$defs/_r58"},"items":{"items":{"$ref":"#/$defs/ContentItem"},"title":"Items","type":"array"},"path":{"$ref":"#/$defs/_r65"},"sensitive":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Sensitive"},"service_materialization":{"anyOf":[{"discriminator":{"mapping":{"service-content":"#/$defs/ServiceMaterialization","service-search-index-schema":"#/$defs/ServiceSearchIndexSchemaMaterialization"},"propertyName":"interface_profile"},"oneOf":[{"$ref":"#/$defs/ServiceMaterialization"},{"$ref":"#/$defs/ServiceSearchIndexSchemaMaterialization"}]},{"$ref":"#/$defs/DomainProfileBindingModel"},{"type":"null"}],"default":null,"title":"Service Materialization"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"tags":{"$ref":"#/$defs/_r132"},"target":{"$ref":"#/$defs/_r78"},"text":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Text"},"text_from":{"$ref":"#/$defs/_r7"},"type":{"$ref":"#/$defs/ContentType"}},"required":["type"],"title":"Content","type":"object"}, + "ContentItem": {"additionalProperties":false,"description":"A single item within a dataset (e.g., one email, one record).","properties":{"description":{"$ref":"#/$defs/_r53"},"display_name":{"$ref":"#/$defs/_r56"},"name":{"$ref":"#/$defs/_r1"},"tags":{"$ref":"#/$defs/_r132"}},"required":["name"],"title":"ContentItem","type":"object"}, "ContentType": {"description":"Kind of content placed into a system.","enum":["file","dataset","directory"],"title":"ContentType","type":"string"}, "CrossTenantIsolation": {"description":"Default cell posture for access from another tenant.","enum":["default_deny"],"title":"CrossTenantIsolation","type":"string"}, - "Database": {"additionalProperties":false,"description":"An observed logical database within a database service.","properties":{"database_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"origin":{"$ref":"#/$defs/_r4"},"schemas":{"items":{"$ref":"#/$defs/DatabaseSchema"},"title":"Schemas","type":"array"}},"required":["database_id","name"],"title":"Database","type":"object"}, + "Database": {"additionalProperties":false,"description":"An observed logical database within a database service.","properties":{"database_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"origin":{"$ref":"#/$defs/_r4"},"schemas":{"items":{"$ref":"#/$defs/DatabaseSchema"},"title":"Schemas","type":"array"}},"required":["database_id","name"],"title":"Database","type":"object"}, "DatabaseAuthMethod": {"description":"How a client authenticates to a database on an access relationship.","enum":["password","md5","scram_sha_256","cert","trust","peer","ident","gssapi","sspi","ldap","radius","other","unknown"],"title":"DatabaseAuthMethod","type":"string"}, "DatabaseEngine": {"description":"The database engine of an observed database service.","enum":["postgresql","mysql","mariadb","sqlite","mongodb","mssql","oracle","redis","other","unknown"],"title":"DatabaseEngine","type":"string"}, - "DatabaseGrant": {"additionalProperties":false,"description":"An observed privilege grant to a database role.\n\nThe grant is structured by grantee, target object, and privileges; raw\n``GRANT`` statements are not the portable model (ADR-029 \u00a74). ``object_ref``\nis the stable ``*_id`` of a database/schema/table in the same service.","properties":{"description":{"$ref":"#/$defs/_r53"},"grantee_role_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Grantee Role Ref","type":"string"},"object_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Object Ref","type":"string"},"object_type":{"anyOf":[{"$ref":"#/$defs/DatabaseObjectType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][aA][tT][aA][bB][aA][sS][eE]|[sS][cC][hH][eE][mM][aA]|[tT][aA][bB][lL][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Object Type"},"privileges":{"items":{"$ref":"#/$defs/_r187"},"title":"Privileges","type":"array"},"with_grant_option":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"With Grant Option"}},"required":["grantee_role_ref","object_type","object_ref"],"title":"DatabaseGrant","type":"object"}, - "DatabaseListener": {"additionalProperties":false,"description":"An observed listener of a database service.\n\nThis records what the database process itself listens on. It is not host\npublication \u2014 ``runtime.network.published_ports`` remains the host-exposure\nfact (ADR-029 \u00a73).","properties":{"address":{"$ref":"#/$defs/_r170"},"description":{"$ref":"#/$defs/_r53"},"port":{"$ref":"#/$defs/_r37"}},"required":["address"],"title":"DatabaseListener","type":"object"}, + "DatabaseGrant": {"additionalProperties":false,"description":"An observed privilege grant to a database role.\n\nThe grant is structured by grantee, target object, and privileges; raw\n``GRANT`` statements are not the portable model (ADR-029 \u00a74). ``object_ref``\nis the stable ``*_id`` of a database/schema/table in the same service.","properties":{"description":{"$ref":"#/$defs/_r53"},"grantee_role_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Grantee Role Ref","type":"string"},"object_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Object Ref","type":"string"},"object_type":{"anyOf":[{"$ref":"#/$defs/DatabaseObjectType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][aA][tT][aA][bB][aA][sS][eE]|[sS][cC][hH][eE][mM][aA]|[tT][aA][bB][lL][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Object Type"},"privileges":{"items":{"$ref":"#/$defs/_r190"},"title":"Privileges","type":"array"},"with_grant_option":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"With Grant Option"}},"required":["grantee_role_ref","object_type","object_ref"],"title":"DatabaseGrant","type":"object"}, + "DatabaseListener": {"additionalProperties":false,"description":"An observed listener of a database service.\n\nThis records what the database process itself listens on. It is not host\npublication \u2014 ``runtime.network.published_ports`` remains the host-exposure\nfact (ADR-029 \u00a73).","properties":{"address":{"$ref":"#/$defs/_r173"},"description":{"$ref":"#/$defs/_r53"},"port":{"$ref":"#/$defs/_r37"}},"required":["address"],"title":"DatabaseListener","type":"object"}, "DatabaseObjectOrigin": {"description":"Whether a database object was scenario-authored or engine-supplied.\n\nKeeps engine built-ins (``postgres``, ``template0``, ``template1``,\n``information_schema``) and system roles from looking scenario-authored.","enum":["scenario","built_in","system","unknown","other"],"title":"DatabaseObjectOrigin","type":"string"}, "DatabaseObjectType": {"description":"The kind of database object a grant applies to.","enum":["database","schema","table"],"title":"DatabaseObjectType","type":"string"}, "DatabaseProtocol": {"description":"The wire protocol an observed database service speaks.\n\nKept distinct from :class:`DatabaseEngine`: a MariaDB engine speaks the\n``mysql`` protocol, and PostgreSQL must never be ``other`` (ADR-029 \u00a73).","enum":["postgresql","mysql","tds","mongodb","redis","other","unknown"],"title":"DatabaseProtocol","type":"string"}, - "DatabaseRole": {"additionalProperties":false,"description":"An observed database-local role \u2014 an authorization principal.\n\nDatabase roles are not OS accounts, ``runtime.local_identity`` users, or\ntop-level scenario ``accounts`` (ADR-029 \u00a74).","properties":{"can_login":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Can Login"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"origin":{"$ref":"#/$defs/_r4"},"role_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Role Id","type":"string"},"role_type":{"anyOf":[{"$ref":"#/$defs/DatabaseRoleType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][gG][iI][nN]|[gG][rR][oO][uU][pP]|[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[sS][eE][rR][vV][iI][cC][eE]|[aA][dD][mM][iI][nN]|[sS][yY][sS][tT][eE][mM]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role Type"}},"required":["role_id","name"],"title":"DatabaseRole","type":"object"}, + "DatabaseRole": {"additionalProperties":false,"description":"An observed database-local role \u2014 an authorization principal.\n\nDatabase roles are not OS accounts, ``runtime.local_identity`` users, or\ntop-level scenario ``accounts`` (ADR-029 \u00a74).","properties":{"can_login":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Can Login"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"origin":{"$ref":"#/$defs/_r4"},"role_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Role Id","type":"string"},"role_type":{"anyOf":[{"$ref":"#/$defs/DatabaseRoleType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][gG][iI][nN]|[gG][rR][oO][uU][pP]|[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[sS][eE][rR][vV][iI][cC][eE]|[aA][dD][mM][iI][nN]|[sS][yY][sS][tT][eE][mM]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role Type"}},"required":["role_id","name"],"title":"DatabaseRole","type":"object"}, "DatabaseRoleType": {"description":"Portable classification of a database-local role.","enum":["login","group","application","service","admin","system","other","unknown"],"title":"DatabaseRoleType","type":"string"}, - "DatabaseSchema": {"additionalProperties":false,"description":"An observed schema (namespace) within a database.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"origin":{"$ref":"#/$defs/_r4"},"schema_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Id","type":"string"},"tables":{"items":{"$ref":"#/$defs/DatabaseTable"},"title":"Tables","type":"array"}},"required":["schema_id","name"],"title":"DatabaseSchema","type":"object"}, - "DatabaseSetting": {"additionalProperties":false,"description":"An observed database runtime setting with provenance and sensitivity.\n\nExplicit ``redacted``/``operator_secret`` classifications omit raw values;\ncredential-shaped names remain scenario content unless the author marks the\nvalue withheld.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"anyOf":[{"$ref":"#/$defs/DatabaseSettingProvenance"},{"$ref":"#/$defs/_r155"}],"default":"unknown","title":"Provenance"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"DatabaseSetting","type":"object"}, + "DatabaseSchema": {"additionalProperties":false,"description":"An observed schema (namespace) within a database.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"origin":{"$ref":"#/$defs/_r4"},"schema_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Id","type":"string"},"tables":{"items":{"$ref":"#/$defs/DatabaseTable"},"title":"Tables","type":"array"}},"required":["schema_id","name"],"title":"DatabaseSchema","type":"object"}, + "DatabaseSetting": {"additionalProperties":false,"description":"An observed database runtime setting with provenance and sensitivity.\n\nExplicit ``redacted``/``operator_secret`` classifications omit raw values;\ncredential-shaped names remain scenario content unless the author marks the\nvalue withheld.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"anyOf":[{"$ref":"#/$defs/DatabaseSettingProvenance"},{"$ref":"#/$defs/_r158"}],"default":"unknown","title":"Provenance"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"DatabaseSetting","type":"object"}, "DatabaseSettingProvenance": {"description":"Where an observed database runtime setting value came from.","enum":["introspection","configuration_file","image_default","operator_override","runtime_default","unknown","other"],"title":"DatabaseSettingProvenance","type":"string"}, - "DatabaseTable": {"additionalProperties":false,"description":"An observed table in a database schema.\n\n``table_id`` is the stable identity; ``name`` is the observed table name\nand is data, never a mapping key or reference segment.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"table_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Table Id","type":"string"}},"required":["table_id","name"],"title":"DatabaseTable","type":"object"}, - "DeploymentCell": {"additionalProperties":false,"description":"One tenant-owned failure/isolation cell with explicit node membership.","properties":{"cross_tenant_isolation":{"$ref":"#/$defs/CrossTenantIsolation","title":"Cross Tenant Isolation"},"node_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Node Refs","type":"array"},"tenant_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tenant Ref","type":"string"}},"required":["tenant_ref","node_refs","cross_tenant_isolation"],"title":"DeploymentCell","type":"object"}, + "DatabaseTable": {"additionalProperties":false,"description":"An observed table in a database schema.\n\n``table_id`` is the stable identity; ``name`` is the observed table name\nand is data, never a mapping key or reference segment.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"table_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Table Id","type":"string"}},"required":["table_id","name"],"title":"DatabaseTable","type":"object"}, + "DeploymentCell": {"additionalProperties":false,"description":"One tenant-owned failure/isolation cell with explicit node membership.","properties":{"cross_tenant_isolation":{"$ref":"#/$defs/CrossTenantIsolation","title":"Cross Tenant Isolation"},"node_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Node Refs","type":"array"},"tenant_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tenant Ref","type":"string"}},"required":["tenant_ref","node_refs","cross_tenant_isolation"],"title":"DeploymentCell","type":"object"}, "DeploymentTenant": {"additionalProperties":false,"description":"Stable portable deployment-tenant identity.","properties":{"description":{"$ref":"#/$defs/_r53"}},"title":"DeploymentTenant","type":"object"}, - "DnsDynamicUpdatePolicy": {"additionalProperties":false,"description":"Observed dynamic-update posture without raw update credentials.","properties":{"allowed_clients":{"$ref":"#/$defs/_r104"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"key_names":{"items":{"$ref":"#/$defs/_r187"},"title":"Key Names","type":"array"},"policy":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy","type":"string"}},"title":"DnsDynamicUpdatePolicy","type":"object"}, - "DnsForwarder": {"additionalProperties":false,"description":"Recursive upstream resolver endpoint.","properties":{"address":{"$ref":"#/$defs/_r170"},"description":{"$ref":"#/$defs/_r53"},"port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"default":53,"title":"Port"},"tls_server_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tls Server Name","type":"string"},"transport":{"anyOf":[{"$ref":"#/$defs/DnsForwarderTransport"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][dD][pP]|[tT][cC][pP]|[tT][lL][sS]|[hH][tT][tT][pP][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"udp","title":"Transport"}},"required":["address"],"title":"DnsForwarder","type":"object"}, + "DnsDynamicUpdatePolicy": {"additionalProperties":false,"description":"Observed dynamic-update posture without raw update credentials.","properties":{"allowed_clients":{"$ref":"#/$defs/_r107"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"key_names":{"items":{"$ref":"#/$defs/_r190"},"title":"Key Names","type":"array"},"policy":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy","type":"string"}},"title":"DnsDynamicUpdatePolicy","type":"object"}, + "DnsForwarder": {"additionalProperties":false,"description":"Recursive upstream resolver endpoint.","properties":{"address":{"$ref":"#/$defs/_r173"},"description":{"$ref":"#/$defs/_r53"},"port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"default":53,"title":"Port"},"tls_server_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tls Server Name","type":"string"},"transport":{"anyOf":[{"$ref":"#/$defs/DnsForwarderTransport"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][dD][pP]|[tT][cC][pP]|[tT][lL][sS]|[hH][tT][tT][pP][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"udp","title":"Transport"}},"required":["address"],"title":"DnsForwarder","type":"object"}, "DnsForwarderTransport": {"description":"Transport used to contact a recursive upstream.","enum":["udp","tcp","tls","https","other","unknown"],"title":"DnsForwarderTransport","type":"string"}, "DnsForwardingPolicy": {"description":"How upstream forwarders are used.","enum":["first","only","random","round_robin","sequential","none","other","unknown"],"title":"DnsForwardingPolicy","type":"string"}, - "DnsMxRdata": {"additionalProperties":false,"description":"Typed MX RDATA fields.","properties":{"exchange":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Exchange","type":"string"},"preference":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Preference"}},"required":["preference","exchange"],"title":"DnsMxRdata","type":"object"}, + "DnsMxRdata": {"additionalProperties":false,"description":"Typed MX RDATA fields.","properties":{"exchange":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Exchange","type":"string"},"preference":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Preference"}},"required":["preference","exchange"],"title":"DnsMxRdata","type":"object"}, "DnsRecordClass": {"description":"DNS RR class.","enum":["in","ch","hs","none","any","other","unknown"],"title":"DnsRecordClass","type":"string"}, "DnsRecordProvenance": {"description":"Where an observed DNS record or zone fact came from.","enum":["axfr","ixfr","query","configuration_file","zone_file","provider_api","runtime_default","operator_override","unknown","other"],"title":"DnsRecordProvenance","type":"string"}, "DnsRecordType": {"description":"Common DNS RR types plus an escape hatch for IANA extensions.","enum":["a","aaaa","cname","ns","mx","ptr","soa","srv","txt","caa","ds","dnskey","rrsig","nsec","nsec3","tlsa","svcb","https","other","unknown"],"title":"DnsRecordType","type":"string"}, - "DnsResolverPolicy": {"additionalProperties":false,"description":"Recursive/forwarding resolver policy for a DNS service.","properties":{"allow_recursion":{"items":{"$ref":"#/$defs/_r187"},"title":"Allow Recursion","type":"array"},"default_logging":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Default Logging"},"description":{"$ref":"#/$defs/_r53"},"dnssec_validation":{"anyOf":[{"$ref":"#/$defs/DnssecValidationMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[aA][uU][tT][oO]|[pP][eE][rR][mM][iI][sS][sS][iI][vV][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Dnssec Validation"},"forwarders":{"items":{"$ref":"#/$defs/DnsForwarder"},"title":"Forwarders","type":"array"},"forwarding_policy":{"anyOf":[{"$ref":"#/$defs/DnsForwardingPolicy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][iI][rR][sS][tT]|[oO][nN][lL][yY]|[rR][aA][nN][dD][oO][mM]|[rR][oO][uU][nN][dD][-_][rR][oO][bB][iI][nN]|[sS][eE][qQ][uU][eE][nN][tT][iI][aA][lL]|[nN][oO][nN][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Forwarding Policy"},"query_logging":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Query Logging"},"recursion_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Recursion Enabled"}},"title":"DnsResolverPolicy","type":"object"}, - "DnsResourceRecord": {"additionalProperties":false,"description":"One observed record within an RRset.","properties":{"address":{"$ref":"#/$defs/_r47"},"description":{"$ref":"#/$defs/_r53"},"mx":{"anyOf":[{"$ref":"#/$defs/DnsMxRdata"},{"type":"null"}],"default":null},"rdata":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rdata","type":"string"},"soa":{"anyOf":[{"$ref":"#/$defs/DnsSoaRdata"},{"type":"null"}],"default":null},"srv":{"anyOf":[{"$ref":"#/$defs/DnsSrvRdata"},{"type":"null"}],"default":null},"target":{"$ref":"#/$defs/_r78"},"text":{"items":{"$ref":"#/$defs/_r187"},"title":"Text","type":"array"}},"title":"DnsResourceRecord","type":"object"}, - "DnsResourceRecordSet": {"additionalProperties":false,"description":"Records grouped by owner name, class, type, and TTL.","properties":{"description":{"$ref":"#/$defs/_r53"},"owner":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner","type":"string"},"provenance":{"$ref":"#/$defs/_r6"},"record_type":{"anyOf":[{"$ref":"#/$defs/DnsRecordType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA]|[aA][aA][aA][aA]|[cC][nN][aA][mM][eE]|[nN][sS]|[mM][xX]|[pP][tT][rR]|[sS][oO][aA]|[sS][rR][vV]|[tT][xX][tT]|[cC][aA][aA]|[dD][sS]|[dD][nN][sS][kK][eE][yY]|[rR][rR][sS][iI][gG]|[nN][sS][eE][cC]|[nN][sS][eE][cC]3|[tT][lL][sS][aA]|[sS][vV][cC][bB]|[hH][tT][tT][pP][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Record Type"},"records":{"items":{"$ref":"#/$defs/DnsResourceRecord"},"title":"Records","type":"array"},"rrset_id":{"$ref":"#/$defs/_r3"},"ttl":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Ttl"},"type_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Type Code"},"zone_class":{"$ref":"#/$defs/_r5"}},"required":["rrset_id","owner","record_type"],"title":"DnsResourceRecordSet","type":"object"}, - "DnsRuntimeSetting": {"additionalProperties":false,"description":"Bounded DNS runtime setting with provenance and redaction.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"anyOf":[{"$ref":"#/$defs/DnsSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"DnsRuntimeSetting","type":"object"}, + "DnsResolverPolicy": {"additionalProperties":false,"description":"Recursive/forwarding resolver policy for a DNS service.","properties":{"allow_recursion":{"items":{"$ref":"#/$defs/_r190"},"title":"Allow Recursion","type":"array"},"default_logging":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Default Logging"},"description":{"$ref":"#/$defs/_r53"},"dnssec_validation":{"anyOf":[{"$ref":"#/$defs/DnssecValidationMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[aA][uU][tT][oO]|[pP][eE][rR][mM][iI][sS][sS][iI][vV][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Dnssec Validation"},"forwarders":{"items":{"$ref":"#/$defs/DnsForwarder"},"title":"Forwarders","type":"array"},"forwarding_policy":{"anyOf":[{"$ref":"#/$defs/DnsForwardingPolicy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][iI][rR][sS][tT]|[oO][nN][lL][yY]|[rR][aA][nN][dD][oO][mM]|[rR][oO][uU][nN][dD][-_][rR][oO][bB][iI][nN]|[sS][eE][qQ][uU][eE][nN][tT][iI][aA][lL]|[nN][oO][nN][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Forwarding Policy"},"query_logging":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Query Logging"},"recursion_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Recursion Enabled"}},"title":"DnsResolverPolicy","type":"object"}, + "DnsResourceRecord": {"additionalProperties":false,"description":"One observed record within an RRset.","properties":{"address":{"$ref":"#/$defs/_r47"},"description":{"$ref":"#/$defs/_r53"},"mx":{"anyOf":[{"$ref":"#/$defs/DnsMxRdata"},{"type":"null"}],"default":null},"rdata":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rdata","type":"string"},"soa":{"anyOf":[{"$ref":"#/$defs/DnsSoaRdata"},{"type":"null"}],"default":null},"srv":{"anyOf":[{"$ref":"#/$defs/DnsSrvRdata"},{"type":"null"}],"default":null},"target":{"$ref":"#/$defs/_r78"},"text":{"items":{"$ref":"#/$defs/_r190"},"title":"Text","type":"array"}},"title":"DnsResourceRecord","type":"object"}, + "DnsResourceRecordSet": {"additionalProperties":false,"description":"Records grouped by owner name, class, type, and TTL.","properties":{"description":{"$ref":"#/$defs/_r53"},"owner":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner","type":"string"},"provenance":{"$ref":"#/$defs/_r6"},"record_type":{"anyOf":[{"$ref":"#/$defs/DnsRecordType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA]|[aA][aA][aA][aA]|[cC][nN][aA][mM][eE]|[nN][sS]|[mM][xX]|[pP][tT][rR]|[sS][oO][aA]|[sS][rR][vV]|[tT][xX][tT]|[cC][aA][aA]|[dD][sS]|[dD][nN][sS][kK][eE][yY]|[rR][rR][sS][iI][gG]|[nN][sS][eE][cC]|[nN][sS][eE][cC]3|[tT][lL][sS][aA]|[sS][vV][cC][bB]|[hH][tT][tT][pP][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Record Type"},"records":{"items":{"$ref":"#/$defs/DnsResourceRecord"},"title":"Records","type":"array"},"rrset_id":{"$ref":"#/$defs/_r3"},"ttl":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Ttl"},"type_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Type Code"},"zone_class":{"$ref":"#/$defs/_r5"}},"required":["rrset_id","owner","record_type"],"title":"DnsResourceRecordSet","type":"object"}, + "DnsRuntimeSetting": {"additionalProperties":false,"description":"Bounded DNS runtime setting with provenance and redaction.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"anyOf":[{"$ref":"#/$defs/DnsSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"DnsRuntimeSetting","type":"object"}, "DnsServerImplementation": {"description":"Portable implementation family for the observed DNS service.","enum":["bind","coredns","powerdns","knot_dns","nsd","windows_dns","dnsmasq","unbound","other","unknown"],"title":"DnsServerImplementation","type":"string"}, "DnsServiceRole": {"description":"Role the DNS service performs for participants or peers.","enum":["authoritative","recursive_resolver","forwarding_resolver","caching_resolver","stub_resolver","other","unknown"],"title":"DnsServiceRole","type":"string"}, "DnsSettingProvenance": {"description":"Where an observed DNS setting value came from.","enum":["configuration_file","introspection","image_default","operator_override","runtime_default","unknown","other"],"title":"DnsSettingProvenance","type":"string"}, - "DnsSoaRdata": {"additionalProperties":false,"description":"Typed SOA RDATA fields.","properties":{"expire":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Expire"},"minimum":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Minimum"},"mname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mname","type":"string"},"refresh":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Refresh"},"retry":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Retry"},"rname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rname","type":"string"},"serial":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Serial"}},"required":["mname","rname","serial","refresh","retry","expire","minimum"],"title":"DnsSoaRdata","type":"object"}, - "DnsSrvRdata": {"additionalProperties":false,"description":"Typed SRV RDATA fields.","properties":{"port":{"$ref":"#/$defs/_r43"},"priority":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Priority"},"target":{"$ref":"#/$defs/_r184"},"weight":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Weight"}},"required":["priority","weight","port","target"],"title":"DnsSrvRdata","type":"object"}, - "DnsZone": {"additionalProperties":false,"description":"An observed authoritative or forwarding DNS zone.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/DnsZoneKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][mM][aA][rR][yY]|[sS][eE][cC][oO][nN][dD][aA][rR][yY]|[sS][tT][uU][bB]|[fF][oO][rR][wW][aA][rR][dD]|[hH][iI][nN][tT]|[cC][aA][tT][aA][lL][oO][gG]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"$ref":"#/$defs/_r6"},"purpose":{"anyOf":[{"$ref":"#/$defs/DnsZonePurpose"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][oO][rR][wW][aA][rR][dD]|[rR][eE][vV][eE][rR][sS][eE]|[sS][eE][rR][vV][iI][cC][eE][-_][dD][iI][sS][cC][oO][vV][eE][rR][yY]|[iI][nN][fF][rR][aA][sS][tT][rR][uU][cC][tT][uU][rR][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Purpose"},"rrsets":{"items":{"$ref":"#/$defs/DnsResourceRecordSet"},"title":"Rrsets","type":"array"},"transfer":{"anyOf":[{"$ref":"#/$defs/DnsZoneTransferPolicy"},{"type":"null"}],"default":null},"zone_class":{"$ref":"#/$defs/_r5"},"zone_file_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Zone File Refs","type":"array"},"zone_id":{"$ref":"#/$defs/_r3"}},"required":["zone_id","name"],"title":"DnsZone","type":"object"}, + "DnsSoaRdata": {"additionalProperties":false,"description":"Typed SOA RDATA fields.","properties":{"expire":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Expire"},"minimum":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Minimum"},"mname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mname","type":"string"},"refresh":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Refresh"},"retry":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Retry"},"rname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rname","type":"string"},"serial":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Serial"}},"required":["mname","rname","serial","refresh","retry","expire","minimum"],"title":"DnsSoaRdata","type":"object"}, + "DnsSrvRdata": {"additionalProperties":false,"description":"Typed SRV RDATA fields.","properties":{"port":{"$ref":"#/$defs/_r43"},"priority":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Priority"},"target":{"$ref":"#/$defs/_r187"},"weight":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Weight"}},"required":["priority","weight","port","target"],"title":"DnsSrvRdata","type":"object"}, + "DnsZone": {"additionalProperties":false,"description":"An observed authoritative or forwarding DNS zone.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/DnsZoneKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][mM][aA][rR][yY]|[sS][eE][cC][oO][nN][dD][aA][rR][yY]|[sS][tT][uU][bB]|[fF][oO][rR][wW][aA][rR][dD]|[hH][iI][nN][tT]|[cC][aA][tT][aA][lL][oO][gG]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"$ref":"#/$defs/_r6"},"purpose":{"anyOf":[{"$ref":"#/$defs/DnsZonePurpose"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][oO][rR][wW][aA][rR][dD]|[rR][eE][vV][eE][rR][sS][eE]|[sS][eE][rR][vV][iI][cC][eE][-_][dD][iI][sS][cC][oO][vV][eE][rR][yY]|[iI][nN][fF][rR][aA][sS][tT][rR][uU][cC][tT][uU][rR][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Purpose"},"rrsets":{"items":{"$ref":"#/$defs/DnsResourceRecordSet"},"title":"Rrsets","type":"array"},"transfer":{"anyOf":[{"$ref":"#/$defs/DnsZoneTransferPolicy"},{"type":"null"}],"default":null},"zone_class":{"$ref":"#/$defs/_r5"},"zone_file_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Zone File Refs","type":"array"},"zone_id":{"$ref":"#/$defs/_r3"}},"required":["zone_id","name"],"title":"DnsZone","type":"object"}, "DnsZoneKind": {"description":"Portable zone role independent of one server's configuration grammar.","enum":["primary","secondary","stub","forward","hint","catalog","other","unknown"],"title":"DnsZoneKind","type":"string"}, "DnsZonePurpose": {"description":"Semantic purpose of a zone name.","enum":["forward","reverse","service_discovery","infrastructure","other","unknown"],"title":"DnsZonePurpose","type":"string"}, - "DnsZoneTransferPolicy": {"additionalProperties":false,"description":"Observed zone-transfer posture for a DNS zone.","properties":{"allowed_clients":{"$ref":"#/$defs/_r104"},"axfr_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Axfr Enabled"},"description":{"$ref":"#/$defs/_r53"},"ixfr_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Ixfr Enabled"},"primary_servers":{"items":{"$ref":"#/$defs/_r187"},"title":"Primary Servers","type":"array"},"secondary_servers":{"items":{"$ref":"#/$defs/_r187"},"title":"Secondary Servers","type":"array"}},"title":"DnsZoneTransferPolicy","type":"object"}, + "DnsZoneTransferPolicy": {"additionalProperties":false,"description":"Observed zone-transfer posture for a DNS zone.","properties":{"allowed_clients":{"$ref":"#/$defs/_r107"},"axfr_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Axfr Enabled"},"description":{"$ref":"#/$defs/_r53"},"ixfr_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Ixfr Enabled"},"primary_servers":{"items":{"$ref":"#/$defs/_r190"},"title":"Primary Servers","type":"array"},"secondary_servers":{"items":{"$ref":"#/$defs/_r190"},"title":"Secondary Servers","type":"array"}},"title":"DnsZoneTransferPolicy","type":"object"}, "DnssecValidationMode": {"description":"Recursive DNSSEC validation posture.","enum":["enabled","disabled","auto","permissive","unknown","other"],"title":"DnssecValidationMode","type":"string"}, - "DockerfileInstruction": {"additionalProperties":false,"description":"A structured record of one container build-recipe instruction.\n\nThe instruction is kept as a typed kind plus tokenized ``arguments``\nrather than raw recipe text: raw Dockerfile/shell syntax can contain\n``${...}`` strings that collide with RAES variable substitution.","properties":{"arguments":{"items":{"$ref":"#/$defs/_r187"},"title":"Arguments","type":"array"},"description":{"$ref":"#/$defs/_r53"},"instruction":{"anyOf":[{"$ref":"#/$defs/DockerfileInstructionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][rR][oO][mM]|[aA][rR][gG]|[eE][nN][vV]|[rR][uU][nN]|[cC][oO][pP][yY]|[aA][dD][dD]|[wW][oO][rR][kK][dD][iI][rR]|[eE][nN][tT][rR][yY][pP][oO][iI][nN][tT]|[cC][mM][dD]|[hH][eE][aA][lL][tT][hH][cC][hH][eE][cC][kK]|[lL][aA][bB][eE][lL]|[eE][xX][pP][oO][sS][eE]|[uU][sS][eE][rR]|[vV][oO][lL][uU][mM][eE]|[sS][hH][eE][lL][lL]|[sS][tT][oO][pP][sS][iI][gG][nN][aA][lL]|[oO][nN][bB][uU][iI][lL][dD]|[mM][aA][iI][nN][tT][aA][iI][nN][eE][rR]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Instruction"}},"required":["instruction"],"title":"DockerfileInstruction","type":"object"}, + "DockerfileInstruction": {"additionalProperties":false,"description":"A structured record of one container build-recipe instruction.\n\nThe instruction is kept as a typed kind plus tokenized ``arguments``\nrather than raw recipe text: raw Dockerfile/shell syntax can contain\n``${...}`` strings that collide with RAES variable substitution.","properties":{"arguments":{"items":{"$ref":"#/$defs/_r190"},"title":"Arguments","type":"array"},"description":{"$ref":"#/$defs/_r53"},"instruction":{"anyOf":[{"$ref":"#/$defs/DockerfileInstructionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][rR][oO][mM]|[aA][rR][gG]|[eE][nN][vV]|[rR][uU][nN]|[cC][oO][pP][yY]|[aA][dD][dD]|[wW][oO][rR][kK][dD][iI][rR]|[eE][nN][tT][rR][yY][pP][oO][iI][nN][tT]|[cC][mM][dD]|[hH][eE][aA][lL][tT][hH][cC][hH][eE][cC][kK]|[lL][aA][bB][eE][lL]|[eE][xX][pP][oO][sS][eE]|[uU][sS][eE][rR]|[vV][oO][lL][uU][mM][eE]|[sS][hH][eE][lL][lL]|[sS][tT][oO][pP][sS][iI][gG][nN][aA][lL]|[oO][nN][bB][uU][iI][lL][dD]|[mM][aA][iI][nN][tT][aA][iI][nN][eE][rR]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Instruction"}},"required":["instruction"],"title":"DockerfileInstruction","type":"object"}, "DockerfileInstructionKind": {"description":"Observed kind of a structured container build-recipe instruction.","enum":["from","arg","env","run","copy","add","workdir","entrypoint","cmd","healthcheck","label","expose","user","volume","shell","stopsignal","onbuild","maintainer","other"],"title":"DockerfileInstructionKind","type":"string"}, "DomainProfileBindingBasis": {"enum":["author-supplied","backend-selected","observed"],"title":"DomainProfileBindingBasis","type":"string"}, "DomainProfileBindingModel": {"additionalProperties":false,"description":"Typed profile data attached to one explicit host owner.","properties":{"binding_id":{"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$","title":"Binding Id","type":"string"},"children":{"default":[],"items":{"$ref":"#/$defs/DomainProfileBindingModel"},"title":"Children","type":"array"},"coordinate":{"$ref":"#/$defs/DomainProfileCoordinateModel"},"owner":{"$ref":"#/$defs/DomainProfileBindingOwnerModel"},"provenance":{"$ref":"#/$defs/DomainProfileBindingProvenanceModel"},"schema_version":{"const":"domain-profile-binding/v1","default":"domain-profile-binding/v1","title":"Schema Version","type":"string"},"value":{"$ref":"#/$defs/JsonValue"}},"required":["binding_id","coordinate","owner","value","provenance"],"title":"DomainProfileBindingModel","type":"object"}, "DomainProfileBindingOwnerModel": {"additionalProperties":false,"description":"Explicit core owner, phase, context, and use for profile data.","properties":{"canonical_address":{"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^#(?:/(?:[^~/]|~[01])*)*$","title":"Canonical Address","type":"string"},"concept_family":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Concept Family","type":"string"},"context":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Context","type":"string"},"lifecycle_phase":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Lifecycle Phase","type":"string"},"owning_contract_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owning Contract Id","type":"string"},"use":{"$ref":"#/$defs/DomainProfileBindingUse"}},"required":["owning_contract_id","canonical_address","concept_family","lifecycle_phase","context","use"],"title":"DomainProfileBindingOwnerModel","type":"object"}, - "DomainProfileBindingProvenanceModel": {"additionalProperties":false,"allOf":[{"if":{"properties":{"basis":{"const":"observed"}},"required":["basis"]},"then":{"properties":{"evidence_refs":{"minItems":1}},"required":["evidence_refs"]}},{"if":{"properties":{"basis":{"enum":["author-supplied","backend-selected"]}},"required":["basis"]},"then":{"properties":{"evidence_refs":{"maxItems":0}}}}],"description":"Basis of a bound value, separate from definition trust provenance.","properties":{"basis":{"$ref":"#/$defs/DomainProfileBindingBasis"},"evidence_refs":{"default":[],"items":{"$ref":"#/$defs/_r148"},"title":"Evidence Refs","type":"array"},"source_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Ref","type":"string"}},"required":["basis","source_ref"],"title":"DomainProfileBindingProvenanceModel","type":"object"}, + "DomainProfileBindingProvenanceModel": {"additionalProperties":false,"allOf":[{"if":{"properties":{"basis":{"const":"observed"}},"required":["basis"]},"then":{"properties":{"evidence_refs":{"minItems":1}},"required":["evidence_refs"]}},{"if":{"properties":{"basis":{"enum":["author-supplied","backend-selected"]}},"required":["basis"]},"then":{"properties":{"evidence_refs":{"maxItems":0}}}}],"description":"Basis of a bound value, separate from definition trust provenance.","properties":{"basis":{"$ref":"#/$defs/DomainProfileBindingBasis"},"evidence_refs":{"default":[],"items":{"$ref":"#/$defs/_r151"},"title":"Evidence Refs","type":"array"},"source_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Ref","type":"string"}},"required":["basis","source_ref"],"title":"DomainProfileBindingProvenanceModel","type":"object"}, "DomainProfileBindingUse": {"enum":["constraint","typed-report","annotation","opaque-exchange"],"title":"DomainProfileBindingUse","type":"string"}, - "DomainProfileCoordinateModel": {"additionalProperties":false,"description":"Exact immutable definition coordinate.","properties":{"authority":{"$ref":"#/$defs/_r141"},"definition_digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Definition Digest","type":"string"},"namespace":{"maxLength":253,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$","title":"Namespace","type":"string"},"profile_id":{"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$","title":"Profile Id","type":"string"},"revision":{"$ref":"#/$defs/_r132"}},"required":["namespace","authority","profile_id","revision","definition_digest"],"title":"DomainProfileCoordinateModel","type":"object"}, - "DomainProfileDefinitionModel": {"additionalProperties":false,"description":"Immutable standard-or-private definition using the shared contract.","properties":{"allowed_contexts":{"items":{"$ref":"#/$defs/_r148"},"minItems":1,"title":"Allowed Contexts","type":"array"},"coordinate":{"$ref":"#/$defs/DomainProfileCoordinateModel"},"profile_schema":{"$ref":"#/$defs/DomainProfileSchemaModel"},"schema_version":{"const":"domain-profile-definition/v1","default":"domain-profile-definition/v1","title":"Schema Version","type":"string"},"semantic_contract":{"$ref":"#/$defs/DomainProfileSemanticContractModel"}},"required":["coordinate","profile_schema","semantic_contract","allowed_contexts"],"title":"DomainProfileDefinitionModel","type":"object"}, - "DomainProfileSchemaModel": {"additionalProperties":false,"description":"Pinned inert JSON Schema carried by a profile definition.","properties":{"dialect":{"const":"https://json-schema.org/draft/2020-12/schema","default":"https://json-schema.org/draft/2020-12/schema","title":"Dialect","type":"string"},"required_vocabularies":{"default":[],"items":{"$ref":"#/$defs/_r148"},"title":"Required Vocabularies","type":"array"},"revision":{"$ref":"#/$defs/_r132"},"schema_digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Schema Digest","type":"string"},"schema_document":{"additionalProperties":{"$ref":"#/$defs/JsonValue"},"title":"Schema Document","type":"object"},"schema_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Id","type":"string"}},"required":["schema_id","revision","schema_digest","schema_document"],"title":"DomainProfileSchemaModel","type":"object"}, - "DomainProfileSemanticContractModel": {"additionalProperties":false,"description":"Exact identity of pre-installed semantic behavior, never executable data.","properties":{"authority":{"$ref":"#/$defs/_r141"},"contract_id":{"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$","title":"Contract Id","type":"string"},"digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Digest","type":"string"},"revision":{"$ref":"#/$defs/_r132"}},"required":["authority","contract_id","revision","digest"],"title":"DomainProfileSemanticContractModel","type":"object"}, + "DomainProfileCoordinateModel": {"additionalProperties":false,"description":"Exact immutable definition coordinate.","properties":{"authority":{"$ref":"#/$defs/_r144"},"definition_digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Definition Digest","type":"string"},"namespace":{"maxLength":253,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$","title":"Namespace","type":"string"},"profile_id":{"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$","title":"Profile Id","type":"string"},"revision":{"$ref":"#/$defs/_r135"}},"required":["namespace","authority","profile_id","revision","definition_digest"],"title":"DomainProfileCoordinateModel","type":"object"}, + "DomainProfileDefinitionModel": {"additionalProperties":false,"description":"Immutable standard-or-private definition using the shared contract.","properties":{"allowed_contexts":{"items":{"$ref":"#/$defs/_r151"},"minItems":1,"title":"Allowed Contexts","type":"array"},"coordinate":{"$ref":"#/$defs/DomainProfileCoordinateModel"},"profile_schema":{"$ref":"#/$defs/DomainProfileSchemaModel"},"schema_version":{"const":"domain-profile-definition/v1","default":"domain-profile-definition/v1","title":"Schema Version","type":"string"},"semantic_contract":{"$ref":"#/$defs/DomainProfileSemanticContractModel"}},"required":["coordinate","profile_schema","semantic_contract","allowed_contexts"],"title":"DomainProfileDefinitionModel","type":"object"}, + "DomainProfileSchemaModel": {"additionalProperties":false,"description":"Pinned inert JSON Schema carried by a profile definition.","properties":{"dialect":{"const":"https://json-schema.org/draft/2020-12/schema","default":"https://json-schema.org/draft/2020-12/schema","title":"Dialect","type":"string"},"required_vocabularies":{"default":[],"items":{"$ref":"#/$defs/_r151"},"title":"Required Vocabularies","type":"array"},"revision":{"$ref":"#/$defs/_r135"},"schema_digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Schema Digest","type":"string"},"schema_document":{"additionalProperties":{"$ref":"#/$defs/JsonValue"},"title":"Schema Document","type":"object"},"schema_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Id","type":"string"}},"required":["schema_id","revision","schema_digest","schema_document"],"title":"DomainProfileSchemaModel","type":"object"}, + "DomainProfileSemanticContractModel": {"additionalProperties":false,"description":"Exact identity of pre-installed semantic behavior, never executable data.","properties":{"authority":{"$ref":"#/$defs/_r144"},"contract_id":{"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[-.][a-z0-9]+)*$","title":"Contract Id","type":"string"},"digest":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[A-Fa-f0-9]{64}|sha384:[A-Fa-f0-9]{96}|sha512:[A-Fa-f0-9]{128}|blake3:[A-Fa-f0-9]{64})$","title":"Digest","type":"string"},"revision":{"$ref":"#/$defs/_r135"}},"required":["authority","contract_id","revision","digest"],"title":"DomainProfileSemanticContractModel","type":"object"}, "EndpointPersona": {"description":"Scenario function of a compute endpoint, separate from login/participant roles.","enum":["workforce","engineering","privileged_admin","participant","service","carrier"],"title":"EndpointPersona","type":"string"}, - "Entity": {"additionalProperties":false,"description":"An organizational unit, team, or person in the exercise.\n\nEntities can nest recursively. Flattened names use dot-notation:\n``blue-team.bob`` refers to the ``bob`` entity nested inside\n``blue-team``.","properties":{"description":{"$ref":"#/$defs/_r53"},"entities":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/Entity"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Entities","type":"object"},"events":{"$ref":"#/$defs/_r118"},"facts":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Facts","type":"object"},"mission":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mission","type":"string"},"name":{"$ref":"#/$defs/_r64"},"role":{"anyOf":[{"$ref":"#/$defs/ExerciseRole"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Role"}},"title":"Entity","type":"object"}, - "Event": {"additionalProperties":false,"description":"A triggered action combining assertion preconditions and injects.","properties":{"assertions":{"$ref":"#/$defs/_r105"},"description":{"$ref":"#/$defs/_r53"},"injects":{"items":{"$ref":"#/$defs/_r187"},"title":"Injects","type":"array"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null}},"title":"Event","type":"object"}, + "Entity": {"additionalProperties":false,"description":"An organizational unit, team, or person in the exercise.\n\nEntities can nest recursively. Flattened names use dot-notation:\n``blue-team.bob`` refers to the ``bob`` entity nested inside\n``blue-team``.","properties":{"description":{"$ref":"#/$defs/_r53"},"entities":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/Entity"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Entities","type":"object"},"events":{"$ref":"#/$defs/_r121"},"facts":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Facts","type":"object"},"mission":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mission","type":"string"},"name":{"$ref":"#/$defs/_r64"},"role":{"anyOf":[{"$ref":"#/$defs/ExerciseRole"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Role"}},"title":"Entity","type":"object"}, + "Event": {"additionalProperties":false,"description":"A triggered action combining assertion preconditions and injects.","properties":{"assertions":{"$ref":"#/$defs/_r108"},"description":{"$ref":"#/$defs/_r53"},"injects":{"items":{"$ref":"#/$defs/_r190"},"title":"Injects","type":"array"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null}},"title":"Event","type":"object"}, "EvidenceIntegrityExpectation": {"description":"Expected integrity or chain-of-custody treatment.","enum":["none","checksum","signature","chain_of_custody","timestamped","other"],"title":"EvidenceIntegrityExpectation","type":"string"}, "EvidenceLossDisclosureExpectation": {"description":"Expected disclosure when capture is incomplete or lossy.","enum":["not_expected","best_effort","required","other"],"title":"EvidenceLossDisclosureExpectation","type":"string"}, "EvidenceRedactionExpectation": {"description":"Expected redaction treatment for captured output.","enum":["none","redact_sensitive","redact_secrets","aggregate_only","derived_only","other"],"title":"EvidenceRedactionExpectation","type":"string"}, - "EvidenceRequirement": {"additionalProperties":false,"description":"One authored data, evidence, or output capture requirement.\n\nThe model records capture intent only. Executable capture contracts may map\nthis to ``experiment-capture-spec-v1`` later, but captured payloads and\nproof of capture belong to experiment evidence records.","properties":{"artifact_role":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Artifact Role","type":"string"},"boundary_kind":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Boundary Kind","type":"string"},"boundary_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Boundary Ref","type":"string"},"capture_requirement_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Capture Requirement Ref","type":"string"},"capture_spec_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Capture Spec Ref","type":"string"},"channel":{"anyOf":[{"$ref":"#/$defs/EvidenceRequirementChannel"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Channel"},"channel_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Channel Refs","type":"array"},"description":{"$ref":"#/$defs/_r53"},"field_selectors":{"items":{"$ref":"#/$defs/_r187"},"title":"Field Selectors","type":"array"},"integrity":{"anyOf":[{"$ref":"#/$defs/EvidenceIntegrityExpectation"},{"$ref":"#/$defs/_r187"}],"title":"Integrity"},"loss_disclosure":{"anyOf":[{"$ref":"#/$defs/EvidenceLossDisclosureExpectation"},{"$ref":"#/$defs/_r187"}],"title":"Loss Disclosure"},"media_types":{"items":{"$ref":"#/$defs/_r187"},"title":"Media Types","type":"array"},"notes":{"items":{"$ref":"#/$defs/_r187"},"title":"Notes","type":"array"},"observation_demand":{"anyOf":[{"$ref":"#/$defs/ObservationDemandRule"},{"type":"null"}],"default":null},"output_contract":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Output Contract","type":"string"},"redaction":{"anyOf":[{"$ref":"#/$defs/EvidenceRedactionExpectation"},{"$ref":"#/$defs/_r187"}],"title":"Redaction"},"retention":{"anyOf":[{"$ref":"#/$defs/EvidenceRetentionExpectation"},{"$ref":"#/$defs/_r187"}],"title":"Retention"},"scope":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Scope","type":"string"},"scope_refs":{"$ref":"#/$defs/_r128"},"sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"title":"Sensitivity"},"source_class":{"anyOf":[{"$ref":"#/$defs/EvidenceRequirementSourceClass"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Source Class"},"source_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Source Refs","type":"array"},"trigger_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trigger Ref","type":"string"},"window":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Window","type":"string"}},"required":["sensitivity","redaction","integrity","retention","loss_disclosure"],"title":"EvidenceRequirement","type":"object"}, + "EvidenceRequirement": {"additionalProperties":false,"description":"One authored data, evidence, or output capture requirement.\n\nThe model records capture intent only. Executable capture contracts may map\nthis to ``experiment-capture-spec-v1`` later, but captured payloads and\nproof of capture belong to experiment evidence records.","properties":{"artifact_role":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Artifact Role","type":"string"},"boundary_kind":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Boundary Kind","type":"string"},"boundary_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Boundary Ref","type":"string"},"capture_requirement_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Capture Requirement Ref","type":"string"},"capture_spec_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Capture Spec Ref","type":"string"},"channel":{"anyOf":[{"$ref":"#/$defs/EvidenceRequirementChannel"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Channel"},"channel_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Channel Refs","type":"array"},"description":{"$ref":"#/$defs/_r53"},"field_selectors":{"items":{"$ref":"#/$defs/_r190"},"title":"Field Selectors","type":"array"},"integrity":{"anyOf":[{"$ref":"#/$defs/EvidenceIntegrityExpectation"},{"$ref":"#/$defs/_r190"}],"title":"Integrity"},"loss_disclosure":{"anyOf":[{"$ref":"#/$defs/EvidenceLossDisclosureExpectation"},{"$ref":"#/$defs/_r190"}],"title":"Loss Disclosure"},"media_types":{"items":{"$ref":"#/$defs/_r190"},"title":"Media Types","type":"array"},"notes":{"items":{"$ref":"#/$defs/_r190"},"title":"Notes","type":"array"},"observation_demand":{"anyOf":[{"$ref":"#/$defs/ObservationDemandRule"},{"type":"null"}],"default":null},"output_contract":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Output Contract","type":"string"},"redaction":{"anyOf":[{"$ref":"#/$defs/EvidenceRedactionExpectation"},{"$ref":"#/$defs/_r190"}],"title":"Redaction"},"retention":{"anyOf":[{"$ref":"#/$defs/EvidenceRetentionExpectation"},{"$ref":"#/$defs/_r190"}],"title":"Retention"},"scope":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Scope","type":"string"},"scope_refs":{"$ref":"#/$defs/_r131"},"sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"title":"Sensitivity"},"source_class":{"anyOf":[{"$ref":"#/$defs/EvidenceRequirementSourceClass"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Source Class"},"source_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Source Refs","type":"array"},"trigger_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trigger Ref","type":"string"},"window":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Window","type":"string"}},"required":["sensitivity","redaction","integrity","retention","loss_disclosure"],"title":"EvidenceRequirement","type":"object"}, "EvidenceRequirementChannel": {"description":"Capture channel or modality for an authored requirement.","enum":["packet_capture","log","trace","metric","file_artifact","screen_capture","api_response","database_record","participant_output","other"],"title":"EvidenceRequirementChannel","type":"string"}, "EvidenceRequirementSourceClass": {"description":"Closed source classes for requirements without a concrete source ref.","enum":["scenario_native_observability","participant_action","participant_observation","scenario_state","processor_backend","apparatus","external","other"],"title":"EvidenceRequirementSourceClass","type":"string"}, "EvidenceRetentionExpectation": {"description":"Expected retention boundary for captured output.","enum":["not_retained","run_lifetime","study_lifetime","archival","policy_defined","other"],"title":"EvidenceRetentionExpectation","type":"string"}, "ExactRatio": {"additionalProperties":false,"description":"Reduced positive rational value.","properties":{"denominator":{"exclusiveMinimum":0,"title":"Denominator","type":"integer"},"numerator":{"exclusiveMinimum":0,"title":"Numerator","type":"integer"}},"required":["numerator","denominator"],"title":"ExactRatio","type":"object"}, - "ExecutionPolicy": {"additionalProperties":false,"description":"A complete local choice; omitted fields never inherit from another policy.","properties":{"budget_ms":{"anyOf":[{"maximum":9007199254740991,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Budget Ms"},"clock_basis":{"default":"apparatus","enum":["apparatus","semantic"],"title":"Clock Basis","type":"string"},"clock_ref":{"anyOf":[{"$ref":"#/$defs/_r134"},{"type":"null"}],"default":null,"title":"Clock Ref"},"delay_ms":{"default":0,"maximum":9007199254740991,"minimum":0,"title":"Delay Ms","type":"integer"},"effect_classes":{"default":[],"items":{"enum":["absent","applied","partial"],"type":"string"},"maxItems":3,"title":"Effect Classes","type":"array"},"evidence_refs":{"default":[],"items":{"$ref":"#/$defs/_r134"},"maxItems":64,"title":"Evidence Refs","type":"array"},"failure_classes":{"default":["operation"],"items":{"enum":["delivery","backend-refusal","operation","intentional-fault","continuity","invalid-evidence"],"type":"string"},"maxItems":6,"minItems":1,"title":"Failure Classes","type":"array"},"fresh_trial_limit":{"anyOf":[{"maximum":9007199254740991,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Fresh Trial Limit"},"on_exhausted":{"default":"terminate","enum":["terminate","new-trial"],"title":"On Exhausted","type":"string"},"policy_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Id","type":"string"},"response":{"enum":["terminate","hold","reconcile","continue","retry","resume","new-trial"],"title":"Response","type":"string"},"retry":{"$ref":"#/$defs/ExecutionRetryPolicyModel"},"revision":{"default":"1","maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Revision","type":"string"},"schema_version":{"const":"execution-policy/v1","default":"execution-policy/v1","title":"Schema Version","type":"string"},"validity":{"default":"preserve","enum":["preserve","qualify","invalidate"],"title":"Validity","type":"string"}},"required":["policy_id","response"],"title":"ExecutionPolicy","type":"object","x-raes-invariants":[{"description":"Execution choices are complete, bounded and consistent; scope identities and references are unique, effective evidence resolves exactly, and unsupported continuation claims fail closed. See specs/sdl/execution-recovery.md for the portable semantic obligations.","id":"execution-policy-executionpolicy","inputs":[{"contract_id":"sdl-authoring-input-v1","instance_path":"#/execution_policy"}],"level":"error","validator":"raes_contracts.execution_policy.ExecutionPolicy.model_validate"}]}, + "ExecutionPolicy": {"additionalProperties":false,"description":"A complete local choice; omitted fields never inherit from another policy.","properties":{"budget_ms":{"anyOf":[{"maximum":9007199254740991,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Budget Ms"},"clock_basis":{"default":"apparatus","enum":["apparatus","semantic"],"title":"Clock Basis","type":"string"},"clock_ref":{"anyOf":[{"$ref":"#/$defs/_r137"},{"type":"null"}],"default":null,"title":"Clock Ref"},"delay_ms":{"default":0,"maximum":9007199254740991,"minimum":0,"title":"Delay Ms","type":"integer"},"effect_classes":{"default":[],"items":{"enum":["absent","applied","partial"],"type":"string"},"maxItems":3,"title":"Effect Classes","type":"array"},"evidence_refs":{"default":[],"items":{"$ref":"#/$defs/_r137"},"maxItems":64,"title":"Evidence Refs","type":"array"},"failure_classes":{"default":["operation"],"items":{"enum":["delivery","backend-refusal","operation","intentional-fault","continuity","invalid-evidence"],"type":"string"},"maxItems":6,"minItems":1,"title":"Failure Classes","type":"array"},"fresh_trial_limit":{"anyOf":[{"maximum":9007199254740991,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Fresh Trial Limit"},"on_exhausted":{"default":"terminate","enum":["terminate","new-trial"],"title":"On Exhausted","type":"string"},"policy_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Id","type":"string"},"response":{"enum":["terminate","hold","reconcile","continue","retry","resume","new-trial"],"title":"Response","type":"string"},"retry":{"$ref":"#/$defs/ExecutionRetryPolicyModel"},"revision":{"default":"1","maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Revision","type":"string"},"schema_version":{"const":"execution-policy/v1","default":"execution-policy/v1","title":"Schema Version","type":"string"},"validity":{"default":"preserve","enum":["preserve","qualify","invalidate"],"title":"Validity","type":"string"}},"required":["policy_id","response"],"title":"ExecutionPolicy","type":"object","x-raes-invariants":[{"description":"Execution choices are complete, bounded and consistent; scope identities and references are unique, effective evidence resolves exactly, and unsupported continuation claims fail closed. See specs/sdl/execution-recovery.md for the portable semantic obligations.","id":"execution-policy-executionpolicy","inputs":[{"contract_id":"sdl-authoring-input-v1","instance_path":"#/execution_policy"}],"level":"error","validator":"raes_contracts.execution_policy.ExecutionPolicy.model_validate"}]}, "ExecutionPolicyDocument": {"additionalProperties":false,"description":"Convenience defaults with complete lexical overrides, independent of realization closure.","properties":{"default":{"anyOf":[{"$ref":"#/$defs/ExecutionPolicy"},{"type":"null"}],"default":null},"scopes":{"default":[],"items":{"$ref":"#/$defs/ExecutionPolicyScope"},"maxItems":256,"title":"Scopes","type":"array"}},"title":"ExecutionPolicyDocument","type":"object","x-raes-invariants":[{"description":"Execution choices are complete, bounded and consistent; scope identities and references are unique, effective evidence resolves exactly, and unsupported continuation claims fail closed. See specs/sdl/execution-recovery.md for the portable semantic obligations.","id":"execution-policy-executionpolicydocument","inputs":[{"contract_id":"sdl-authoring-input-v1","instance_path":"#/execution_policy"}],"level":"error","validator":"raes_contracts.execution_policy.ExecutionPolicyDocument.model_validate"}]}, "ExecutionPolicyScope": {"additionalProperties":false,"properties":{"namespace":{"$ref":"#/$defs/_r87"},"policy":{"$ref":"#/$defs/ExecutionPolicy"},"scope":{"default":"","maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Scope","type":"string"}},"required":["policy"],"title":"ExecutionPolicyScope","type":"object"}, - "ExecutionRetryPolicyModel": {"additionalProperties":false,"description":"Retry posture after an execution attempt may have produced effects.","properties":{"after_effect_policy":{"enum":["disallow","idempotent","reset","compensate"],"title":"After Effect Policy","type":"string"},"compensation_refs":{"items":{"$ref":"#/$defs/_r148"},"title":"Compensation Refs","type":"array","uniqueItems":true},"max_attempts":{"minimum":1,"title":"Max Attempts","type":"integer"},"reset_obligation_refs":{"items":{"$ref":"#/$defs/_r148"},"title":"Reset Obligation Refs","type":"array","uniqueItems":true}},"required":["max_attempts","after_effect_policy"],"title":"ExecutionRetryPolicyModel","type":"object"}, + "ExecutionRetryPolicyModel": {"additionalProperties":false,"description":"Retry posture after an execution attempt may have produced effects.","properties":{"after_effect_policy":{"enum":["disallow","idempotent","reset","compensate"],"title":"After Effect Policy","type":"string"},"compensation_refs":{"items":{"$ref":"#/$defs/_r151"},"title":"Compensation Refs","type":"array","uniqueItems":true},"max_attempts":{"minimum":1,"title":"Max Attempts","type":"integer"},"reset_obligation_refs":{"items":{"$ref":"#/$defs/_r151"},"title":"Reset Obligation Refs","type":"array","uniqueItems":true}},"required":["max_attempts","after_effect_policy"],"title":"ExecutionRetryPolicyModel","type":"object"}, "ExerciseRole": {"description":"Role in the exercise.","enum":["white","green","red","blue"],"title":"ExerciseRole","type":"string"}, "ExplicitnessClass": {"description":"SEM-218 author-intent class for a declaration.","enum":["exact","constrained","open"],"title":"ExplicitnessClass","type":"string"}, "ExplicitnessProvenance": {"description":"Where the classified value came from in the SDL lifecycle.","enum":["author-declared","processor-derived","backend-realized"],"title":"ExplicitnessProvenance","type":"string"}, - "Feature": {"additionalProperties":false,"description":"A software artifact, service, or configuration deployed to a compute node.","properties":{"dependencies":{"$ref":"#/$defs/_r112"},"description":{"$ref":"#/$defs/_r53"},"destination":{"$ref":"#/$defs/_r54"},"environment":{"$ref":"#/$defs/_r117"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"type":{"$ref":"#/$defs/FeatureType"}},"required":["type"],"title":"Feature","type":"object"}, + "Feature": {"additionalProperties":false,"description":"A software artifact, service, or configuration deployed to a compute node.","properties":{"dependencies":{"$ref":"#/$defs/_r115"},"description":{"$ref":"#/$defs/_r53"},"destination":{"$ref":"#/$defs/_r54"},"environment":{"$ref":"#/$defs/_r120"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"type":{"$ref":"#/$defs/FeatureType"}},"required":["type"],"title":"Feature","type":"object"}, "FeatureType": {"description":"Kind of feature deployed to a compute node.","enum":["service","configuration","artifact"],"title":"FeatureType","type":"string"}, "FederationDirection": {"description":"Portable direction for workforce authority federation.","enum":["authority_to_facade"],"title":"FederationDirection","type":"string"}, "FederationMappingIntent": {"description":"Portable outcome of identity mapping without provider mapper syntax.","enum":["groups_to_roles"],"title":"FederationMappingIntent","type":"string"}, "FederationProtocol": {"description":"Portable directory-to-facade synchronization protocols.","enum":["ldap_tls","scim"],"title":"FederationProtocol","type":"string"}, "ForestTrustDirection": {"description":"Authority direction for one forest trust edge.","enum":["one_way_outbound","one_way_inbound","bidirectional"],"title":"ForestTrustDirection","type":"string"}, "ForestTrustType": {"description":"Closed forest-to-forest trust profiles.","enum":["forest"],"title":"ForestTrustType","type":"string"}, - "GeneratedArtifact": {"additionalProperties":false,"description":"Desired generated configuration or certificate/key material.","properties":{"consumers":{"items":{"$ref":"#/$defs/GeneratedArtifactConsumer"},"title":"Consumers","type":"array","uniqueItems":true},"generator":{"anyOf":[{"$ref":"#/$defs/GeneratedArtifactKind"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Generator"},"lifecycle":{"$ref":"#/$defs/GeneratedArtifactLifecycle"},"ordering_dependencies":{"$ref":"#/$defs/_r126"},"outputs":{"items":{"$ref":"#/$defs/GeneratedArtifactOutput"},"minItems":1,"title":"Outputs","type":"array","uniqueItems":true},"provenance":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Provenance","type":"string"},"random_value":{"anyOf":[{"$ref":"#/$defs/RandomValueRecipe"},{"type":"null"}],"default":null},"refresh_dependencies":{"$ref":"#/$defs/_r127"},"regeneration_scope":{"anyOf":[{"$ref":"#/$defs/GeneratedArtifactRegenerationScope"},{"type":"null"}],"default":null}},"required":["generator","lifecycle","provenance","outputs"],"title":"GeneratedArtifact","type":"object"}, - "GeneratedArtifactConsumer": {"additionalProperties":false,"description":"A read-only artifact projection selected by output name.","properties":{"access_mode":{"$ref":"#/$defs/ConsumerAccessMode"},"mount_destination":{"$ref":"#/$defs/_r175"},"node":{"$ref":"#/$defs/_r177"},"selected_outputs":{"items":{"$ref":"#/$defs/_r3"},"minItems":1,"title":"Selected Outputs","type":"array","uniqueItems":true}},"required":["node","mount_destination","access_mode"],"title":"GeneratedArtifactConsumer","type":"object"}, + "GeneratedArtifact": {"additionalProperties":false,"description":"Desired generated configuration or certificate/key material.","properties":{"consumers":{"items":{"$ref":"#/$defs/GeneratedArtifactConsumer"},"title":"Consumers","type":"array","uniqueItems":true},"generator":{"anyOf":[{"$ref":"#/$defs/GeneratedArtifactKind"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Generator"},"lifecycle":{"$ref":"#/$defs/GeneratedArtifactLifecycle"},"ordering_dependencies":{"$ref":"#/$defs/_r129"},"outputs":{"items":{"$ref":"#/$defs/GeneratedArtifactOutput"},"minItems":1,"title":"Outputs","type":"array","uniqueItems":true},"provenance":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Provenance","type":"string"},"random_value":{"anyOf":[{"$ref":"#/$defs/RandomValueRecipe"},{"type":"null"}],"default":null},"refresh_dependencies":{"$ref":"#/$defs/_r130"},"regeneration_scope":{"anyOf":[{"$ref":"#/$defs/GeneratedArtifactRegenerationScope"},{"type":"null"}],"default":null}},"required":["generator","lifecycle","provenance","outputs"],"title":"GeneratedArtifact","type":"object"}, + "GeneratedArtifactConsumer": {"additionalProperties":false,"description":"A read-only artifact projection selected by output name.","properties":{"access_mode":{"$ref":"#/$defs/ConsumerAccessMode"},"mount_destination":{"$ref":"#/$defs/_r178"},"node":{"$ref":"#/$defs/_r180"},"selected_outputs":{"items":{"$ref":"#/$defs/_r3"},"minItems":1,"title":"Selected Outputs","type":"array","uniqueItems":true}},"required":["node","mount_destination","access_mode"],"title":"GeneratedArtifactConsumer","type":"object"}, "GeneratedArtifactKind": {"description":"Portable kinds of material a provisioner may generate.","enum":["certificate_bundle","rendered_config","ssh_key_bundle","random_value"],"title":"GeneratedArtifactKind","type":"string"}, "GeneratedArtifactLifecycle": {"enum":["regenerate_on_change","reuse_valid"],"title":"GeneratedArtifactLifecycle","type":"string"}, - "GeneratedArtifactOutput": {"additionalProperties":false,"description":"One complete output declared by an artifact generator.","properties":{"disposition":{"$ref":"#/$defs/GeneratedArtifactOutputDisposition","default":"consumer_selected"},"name":{"$ref":"#/$defs/_r1"},"path":{"$ref":"#/$defs/_r178"},"sensitivity":{"$ref":"#/$defs/ResourceSensitivity"}},"required":["name","path","sensitivity"],"title":"GeneratedArtifactOutput","type":"object"}, + "GeneratedArtifactOutput": {"additionalProperties":false,"description":"One complete output declared by an artifact generator.","properties":{"disposition":{"$ref":"#/$defs/GeneratedArtifactOutputDisposition","default":"consumer_selected"},"name":{"$ref":"#/$defs/_r1"},"path":{"$ref":"#/$defs/_r181"},"sensitivity":{"$ref":"#/$defs/ResourceSensitivity"}},"required":["name","path","sensitivity"],"title":"GeneratedArtifactOutput","type":"object"}, "GeneratedArtifactOutputDisposition": {"enum":["consumer_selected","producer_private"],"title":"GeneratedArtifactOutputDisposition","type":"string"}, "GeneratedArtifactRegenerationScope": {"description":"When a ``random_value`` generated artifact is regenerated (issue #1276).\n\nDistinct from ``GeneratedArtifactLifecycle`` (change-driven reuse): scope\ngoverns *freshness*. ``per_run`` regenerates for each fresh authoritative run;\n``per_instantiation`` regenerates for each distinct realized scenario instance;\n``once`` binds a single generation to the backend-owned artifact-instance\nlifetime.","enum":["per_run","per_instantiation","once"],"title":"GeneratedArtifactRegenerationScope","type":"string"}, - "GeneratedArtifactValueSource": {"additionalProperties":false,"description":"Value-free reference to a generated-artifact output consumed as a runtime value.\n\nNames the producing ``generated_artifacts.`` (bare id or namespaced\nform) and one of its outputs. It carries no generated bytes: the raw value\nis realized at provisioning time from the referenced output, never authored\ninto the SDL. Cross-resource resolution (artifact exists, output exists and\nis not ``producer_private``) is enforced by semantic admission.","properties":{"generated_artifact":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Generated Artifact","type":"string"},"output":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Output","type":"string"}},"required":["generated_artifact","output"],"title":"GeneratedArtifactValueSource","type":"object"}, + "GeneratedArtifactValueSource": {"additionalProperties":false,"description":"Value-free reference to a generated-artifact output consumed as a runtime value.\n\nNames the producing ``generated_artifacts.`` (bare id or namespaced\nform) and one of its outputs. It carries no generated bytes: the raw value\nis realized at provisioning time from the referenced output, never authored\ninto the SDL. Cross-resource resolution (artifact exists, output exists and\nis not ``producer_private``) is enforced by semantic admission.","properties":{"generated_artifact":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Generated Artifact","type":"string"},"output":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Output","type":"string"}},"required":["generated_artifact","output"],"title":"GeneratedArtifactValueSource","type":"object"}, "IdentityDomain": {"additionalProperties":false,"allOf":[{"if":{"properties":{"profile":{"type":"string"}}},"then":{"properties":{"dns_name":{"minLength":1},"netbios_name":{"minLength":1}},"required":["dns_name","netbios_name"]}}],"description":"Scenario-scoped authored identity domain.","properties":{"authority_account_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority Account Ref","type":"string"},"dns_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Dns Name","type":"string"},"netbios_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Netbios Name","type":"string"},"profile":{"anyOf":[{"$ref":"#/$defs/IdentityDomainProfile"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Profile"}},"required":["profile","authority_account_ref"],"title":"IdentityDomain","type":"object"}, "IdentityDomainProfile": {"description":"Closed profiles whose controller/join semantics are realizable.","enum":["active_directory"],"title":"IdentityDomainProfile","type":"string"}, "IdentityFacade": {"additionalProperties":false,"description":"Authored IdP facade identified through an existing logical service.","properties":{"protocol":{"anyOf":[{"$ref":"#/$defs/IdentityFacadeProtocol"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Protocol"},"service_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Service Ref","type":"string"}},"required":["service_ref","protocol"],"title":"IdentityFacade","type":"object"}, "IdentityFacadeProtocol": {"description":"Challenge-facing identity protocol exposed by an authored facade.","enum":["oidc"],"title":"IdentityFacadeProtocol","type":"string"}, - "IdentityForest": {"additionalProperties":false,"description":"A forest with explicit root and complete authored domain membership.","properties":{"domain_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Domain Refs","type":"array"},"root_domain_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Root Domain Ref","type":"string"}},"required":["root_domain_ref","domain_refs"],"title":"IdentityForest","type":"object"}, + "IdentityForest": {"additionalProperties":false,"description":"A forest with explicit root and complete authored domain membership.","properties":{"domain_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Domain Refs","type":"array"},"root_domain_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Root Domain Ref","type":"string"}},"required":["root_domain_ref","domain_refs"],"title":"IdentityForest","type":"object"}, "ImageAttestation": {"additionalProperties":false,"description":"Observed build-attestation availability and verification result.\n\nAttestation *availability* (``status``) and *verification result*\n(``verification``) are deliberately separate facts: a mutable local image\ntag with no registry-visible OCI/in-toto/SLSA attestation is not the same\nstate as a failed verification (ADR-023 \u00a75).","properties":{"attestation_type":{"anyOf":[{"$ref":"#/$defs/ImageAttestationType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[oO][cC][iI]|[iI][nN][-_][tT][oO][tT][oO]|[sS][lL][sS][aA]|[oO][tT][hH][eE][rR]|[nN][oO][nN][eE]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Attestation Type"},"description":{"$ref":"#/$defs/_r53"},"evidence_reference":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Evidence Reference","type":"string"},"predicate_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Predicate Type","type":"string"},"status":{"anyOf":[{"$ref":"#/$defs/ImageAttestationStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][eE][sS][eE][nN][tT]|[aA][bB][sS][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"},"verification":{"anyOf":[{"$ref":"#/$defs/ImageVerificationStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[vV][eE][rR][iI][fF][iI][eE][dD]|[fF][aA][iI][lL][eE][dD]|[uU][nN][vV][eE][rR][iI][fF][iI][eE][dD]|[nN][oO][tT][-_][aA][pP][pP][lL][iI][cC][aA][bB][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Verification"}},"title":"ImageAttestation","type":"object"}, "ImageAttestationStatus": {"description":"Availability of a registry-visible build attestation for an image.","enum":["present","absent","unknown"],"title":"ImageAttestationStatus","type":"string"}, "ImageAttestationType": {"description":"Format of an observed image build attestation.","enum":["oci","in_toto","slsa","other","none","unknown"],"title":"ImageAttestationType","type":"string"}, - "ImageBuildArg": {"additionalProperties":false,"description":"An observed build argument with value-sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"ImageBuildArg","type":"object"}, - "ImageConfig": {"additionalProperties":false,"description":"Observed image-default configuration baked into the image artifact.\n\nThese are image defaults, distinct from runtime-effective container facts\nrecorded under ``Node.runtime.container``.","properties":{"command":{"$ref":"#/$defs/_r108"},"default_environment":{"items":{"$ref":"#/$defs/ImageEnvironmentDefault"},"title":"Default Environment","type":"array"},"description":{"$ref":"#/$defs/_r53"},"entrypoint":{"$ref":"#/$defs/_r116"},"exposed_ports":{"items":{"$ref":"#/$defs/_r187"},"title":"Exposed Ports","type":"array"},"labels":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Labels","type":"object"},"working_directory":{"$ref":"#/$defs/_r82"}},"title":"ImageConfig","type":"object"}, + "ImageBuildArg": {"additionalProperties":false,"description":"An observed build argument with value-sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"ImageBuildArg","type":"object"}, + "ImageConfig": {"additionalProperties":false,"description":"Observed image-default configuration baked into the image artifact.\n\nThese are image defaults, distinct from runtime-effective container facts\nrecorded under ``Node.runtime.container``.","properties":{"command":{"$ref":"#/$defs/_r111"},"default_environment":{"items":{"$ref":"#/$defs/ImageEnvironmentDefault"},"title":"Default Environment","type":"array"},"description":{"$ref":"#/$defs/_r53"},"entrypoint":{"$ref":"#/$defs/_r119"},"exposed_ports":{"items":{"$ref":"#/$defs/_r190"},"title":"Exposed Ports","type":"array"},"labels":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Labels","type":"object"},"working_directory":{"$ref":"#/$defs/_r82"}},"title":"ImageConfig","type":"object"}, "ImageCopiedSource": {"additionalProperties":false,"description":"A source path copied into the image and its in-image destination.","properties":{"description":{"$ref":"#/$defs/_r53"},"destination_path":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Destination Path","type":"string"},"from_stage":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"From Stage","type":"string"},"source_path":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Path","type":"string"}},"required":["source_path","destination_path"],"title":"ImageCopiedSource","type":"object"}, - "ImageEnvironmentDefault": {"additionalProperties":false,"description":"An image-default environment variable with sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"ImageEnvironmentDefault","type":"object"}, - "ImageLayer": {"additionalProperties":false,"description":"An observed layer in the image layer chain.\n\nEmpty/metadata-only layers (e.g. ``ENV`` instructions) legitimately carry\nno ``digest``; the layer is still recorded for build-history correlation.","properties":{"created_by":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Created By","type":"string"},"description":{"$ref":"#/$defs/_r53"},"digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Digest","type":"string"},"empty":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Empty"},"size":{"$ref":"#/$defs/_r38"}},"title":"ImageLayer","type":"object"}, + "ImageEnvironmentDefault": {"additionalProperties":false,"description":"An image-default environment variable with sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"ImageEnvironmentDefault","type":"object"}, + "ImageLayer": {"additionalProperties":false,"description":"An observed layer in the image layer chain.\n\nEmpty/metadata-only layers (e.g. ``ENV`` instructions) legitimately carry\nno ``digest``; the layer is still recorded for build-history correlation.","properties":{"created_by":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Created By","type":"string"},"description":{"$ref":"#/$defs/_r53"},"digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Digest","type":"string"},"empty":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Empty"},"size":{"$ref":"#/$defs/_r38"}},"title":"ImageLayer","type":"object"}, "ImageSourceInput": {"additionalProperties":false,"description":"A source-package input and its source-to-runtime destination mapping.\n\n``source_path`` uses the same source-path dialect as\n``RuntimeFilesystemEntry.source_path`` so the build-time input and the\nrealized runtime entry can be correlated.","properties":{"checksum":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Checksum","type":"string"},"checksum_algorithm":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Checksum Algorithm","type":"string"},"description":{"$ref":"#/$defs/_r53"},"destination_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Destination Path","type":"string"},"identifier":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Identifier","type":"string"},"source_path":{"$ref":"#/$defs/_r73"}},"required":["identifier"],"title":"ImageSourceInput","type":"object"}, "ImageVerificationStatus": {"description":"Result of verifying an image's build attestation.","enum":["verified","failed","unverified","not_applicable","unknown"],"title":"ImageVerificationStatus","type":"string"}, - "InfraNode": {"additionalProperties":false,"description":"Deployment parameters for a node.\n\nShorthand: ``node-name: 3`` (just the count).\nLonghand: full dict with count, links, dependencies, properties, acls.","properties":{"acls":{"items":{"$ref":"#/$defs/ACLRule"},"title":"Acls","type":"array"},"count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"default":1,"title":"Count"},"dependencies":{"$ref":"#/$defs/_r112"},"description":{"$ref":"#/$defs/_r53"},"links":{"items":{"$ref":"#/$defs/_r187"},"title":"Links","type":"array"},"properties":{"anyOf":[{"$ref":"#/$defs/SimpleProperties"},{"items":{"additionalProperties":{"$ref":"#/$defs/_r187"},"type":"object"},"type":"array"},{"type":"null"}],"default":null,"title":"Properties"}},"title":"InfraNode","type":"object"}, - "InitialKnowledge": {"additionalProperties":false,"description":"What an agent knows about the scenario at start time.\n\nAdapted from CybORG's INT (Initial Network Topology).\nSpecifies which hosts, subnets, services, and accounts\nthe agent has knowledge of before the scenario begins.","properties":{"accounts":{"items":{"$ref":"#/$defs/_r187"},"title":"Accounts","type":"array"},"hosts":{"$ref":"#/$defs/_r122"},"services":{"items":{"$ref":"#/$defs/_r187"},"title":"Services","type":"array"},"subnets":{"items":{"$ref":"#/$defs/_r187"},"title":"Subnets","type":"array"}},"title":"InitialKnowledge","type":"object"}, - "Inject": {"additionalProperties":false,"description":"An action injected between entities during an exercise.","properties":{"description":{"$ref":"#/$defs/_r53"},"environment":{"$ref":"#/$defs/_r117"},"from_entity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"From Entity","type":"string"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"to_entities":{"items":{"$ref":"#/$defs/_r187"},"title":"To Entities","type":"array"}},"title":"Inject","type":"object"}, - "InstantiatedMaterializationDigest": {"additionalProperties":false,"description":"Identity of the original admitted input, not the materialized artifact.","properties":{"algorithm":{"const":"sha256","title":"Algorithm","type":"string"},"profile":{"const":"raes-sdl-instantiated-snapshot/v2","title":"Profile","type":"string"},"value":{"$ref":"#/$defs/_r169"}},"required":["profile","algorithm","value"],"title":"InstantiatedMaterializationDigest","type":"object"}, + "InfraNode": {"additionalProperties":false,"description":"Deployment parameters for a node.\n\nShorthand: ``node-name: 3`` (just the count).\nLonghand: full dict with count, links, dependencies, properties, acls.","properties":{"acls":{"items":{"$ref":"#/$defs/ACLRule"},"title":"Acls","type":"array"},"count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"default":1,"title":"Count"},"dependencies":{"$ref":"#/$defs/_r115"},"description":{"$ref":"#/$defs/_r53"},"links":{"items":{"$ref":"#/$defs/_r190"},"title":"Links","type":"array"},"properties":{"anyOf":[{"$ref":"#/$defs/SimpleProperties"},{"items":{"additionalProperties":{"$ref":"#/$defs/_r190"},"type":"object"},"type":"array"},{"type":"null"}],"default":null,"title":"Properties"}},"title":"InfraNode","type":"object"}, + "InitialKnowledge": {"additionalProperties":false,"description":"What an agent knows about the scenario at start time.\n\nAdapted from CybORG's INT (Initial Network Topology).\nSpecifies which hosts, subnets, services, and accounts\nthe agent has knowledge of before the scenario begins.","properties":{"accounts":{"items":{"$ref":"#/$defs/_r190"},"title":"Accounts","type":"array"},"hosts":{"$ref":"#/$defs/_r125"},"services":{"items":{"$ref":"#/$defs/_r190"},"title":"Services","type":"array"},"subnets":{"items":{"$ref":"#/$defs/_r190"},"title":"Subnets","type":"array"}},"title":"InitialKnowledge","type":"object"}, + "Inject": {"additionalProperties":false,"description":"An action injected between entities during an exercise.","properties":{"description":{"$ref":"#/$defs/_r53"},"environment":{"$ref":"#/$defs/_r120"},"from_entity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"From Entity","type":"string"},"name":{"$ref":"#/$defs/_r64"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"to_entities":{"items":{"$ref":"#/$defs/_r190"},"title":"To Entities","type":"array"}},"title":"Inject","type":"object"}, + "InstantiatedMaterializationDigest": {"additionalProperties":false,"description":"Identity of the original admitted input, not the materialized artifact.","properties":{"algorithm":{"const":"sha256","title":"Algorithm","type":"string"},"profile":{"const":"raes-sdl-instantiated-snapshot/v2","title":"Profile","type":"string"},"value":{"$ref":"#/$defs/_r172"}},"required":["profile","algorithm","value"],"title":"InstantiatedMaterializationDigest","type":"object"}, "JsonValue": {}, "KernelBoundary": {"description":"Kernel/trust boundary requested between logical node and carrier.","enum":["shared_kernel","separate_kernel"],"title":"KernelBoundary","type":"string"}, "LocalOutcomeCriterion": {"additionalProperties":false,"description":"An explicitly declared realized effect, never an action status shortcut.","properties":{"criterion_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","title":"Criterion Id","type":"string"},"effect_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","title":"Effect Id","type":"string"},"source_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","title":"Source Id","type":"string"}},"required":["criterion_id","source_id","effect_id"],"title":"LocalOutcomeCriterion","type":"object"}, "LocalOutcomeDefinition": {"additionalProperties":false,"description":"All criteria must be evidenced; contradictory observations need correction.","properties":{"category":{"enum":["task_completion","effect_realization"],"title":"Category","type":"string"},"conflict_policy":{"const":"retain_until_explicit_correction","title":"Conflict Policy","type":"string"},"criteria":{"items":{"$ref":"#/$defs/LocalOutcomeCriterion"},"minItems":1,"title":"Criteria","type":"array"},"criterion_basis":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","title":"Criterion Basis","type":"string"},"episode_policy":{"const":"reset_without_transfer","title":"Episode Policy","type":"string"},"freshness_policy":{"const":"exact_observation_cut","title":"Freshness Policy","type":"string"},"model_version":{"const":"1.0.0","title":"Model Version","type":"string"}},"required":["model_version","category","criterion_basis","criteria","conflict_policy","freshness_policy","episode_policy"],"title":"LocalOutcomeDefinition","type":"object"}, - "MaterializationOrigin": {"additionalProperties":false,"description":"One disclosed difference; world values stay in their owning SDL fields.","properties":{"change":{"enum":["added","selected","removed"],"title":"Change","type":"string"},"field_pointer":{"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Field Pointer","type":"string"},"origin":{"$ref":"#/$defs/ExplicitnessProvenance"},"source_pointer":{"anyOf":[{"$ref":"#/$defs/_r136"},{"type":"null"}],"default":null,"title":"Source Pointer"}},"required":["field_pointer","change","origin"],"title":"MaterializationOrigin","type":"object"}, + "MaterializationOrigin": {"additionalProperties":false,"description":"One disclosed difference; world values stay in their owning SDL fields.","properties":{"change":{"enum":["added","selected","removed"],"title":"Change","type":"string"},"field_pointer":{"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Field Pointer","type":"string"},"origin":{"$ref":"#/$defs/ExplicitnessProvenance"},"source_pointer":{"anyOf":[{"$ref":"#/$defs/_r139"},{"type":"null"}],"default":null,"title":"Source Pointer"}},"required":["field_pointer","change","origin"],"title":"MaterializationOrigin","type":"object"}, "MaterializationProducer": {"additionalProperties":false,"description":"The selected producer and its exact configured manifest.","properties":{"configuration_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Configuration Digest","type":"string"},"manifest_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Manifest Digest","type":"string"},"name":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Name","type":"string"},"version":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Version","type":"string"}},"required":["name","version","configuration_digest","manifest_digest"],"title":"MaterializationProducer","type":"object"}, - "MaterializationProvenance": {"additionalProperties":false,"description":"Execution-bound producer assertion, separate from authoring authority.","properties":{"attestation_id":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Attestation Id","type":"string"},"authored_digest":{"$ref":"#/$defs/SemanticDigest"},"boundary":{"const":"post-materialization","title":"Boundary","type":"string"},"coverage_profile":{"const":"raes-materialization-effects/v1","title":"Coverage Profile","type":"string"},"instantiated_digest":{"$ref":"#/$defs/InstantiatedMaterializationDigest"},"operation_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Operation Id","type":"string"},"origins":{"items":{"$ref":"#/$defs/MaterializationOrigin"},"maxItems":4096,"title":"Origins","type":"array"},"plan_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Plan Digest","type":"string"},"predecessor_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Predecessor Digest","type":"string"},"producer":{"$ref":"#/$defs/MaterializationProducer"},"profile":{"const":"raes-materialization-attestation/v1","title":"Profile","type":"string"},"recorded_at":{"format":"date-time","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Recorded At","type":"string"},"resource_bindings":{"items":{"$ref":"#/$defs/MaterializedResourceBinding"},"maxItems":4096,"title":"Resource Bindings","type":"array"},"run_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Run Id","type":"string"}},"required":["profile","attestation_id","authored_digest","instantiated_digest","plan_digest","predecessor_digest","operation_id","run_id","recorded_at","boundary","producer","coverage_profile","origins","resource_bindings"],"title":"MaterializationProvenance","type":"object"}, - "MaterializedResourceBinding": {"additionalProperties":false,"description":"Portable resource and source-declaration identity for one realized node.","properties":{"address":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":2048,"minLength":3,"not":{"pattern":"[^a-z0-9_.-]"},"pattern":"^(?:[a-z0-9][a-z0-9_-]{0,63}|__private)(?:\\.(?:[a-z0-9][a-z0-9_-]{0,63}|__private))+$","title":"Address","type":"string"},"instance_index":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Instance Index"},"node_name":{"$ref":"#/$defs/_r0"},"source_node":{"anyOf":[{"$ref":"#/$defs/_r0"},{"type":"null"}],"default":null}},"required":["address","node_name"],"title":"MaterializedResourceBinding","type":"object"}, + "MaterializationProvenance": {"additionalProperties":false,"description":"Execution-bound producer assertion, separate from authoring authority.","properties":{"attestation_id":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Attestation Id","type":"string"},"authored_digest":{"$ref":"#/$defs/SemanticDigest"},"boundary":{"const":"post-materialization","title":"Boundary","type":"string"},"coverage_profile":{"const":"raes-materialization-effects/v1","title":"Coverage Profile","type":"string"},"instantiated_digest":{"$ref":"#/$defs/InstantiatedMaterializationDigest"},"operation_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Operation Id","type":"string"},"origins":{"items":{"$ref":"#/$defs/MaterializationOrigin"},"maxItems":4096,"title":"Origins","type":"array"},"plan_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Plan Digest","type":"string"},"predecessor_digest":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Predecessor Digest","type":"string"},"producer":{"$ref":"#/$defs/MaterializationProducer"},"profile":{"const":"raes-materialization-attestation/v1","title":"Profile","type":"string"},"recorded_at":{"format":"date-time","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Recorded At","type":"string"},"resource_bindings":{"items":{"$ref":"#/$defs/MaterializedResourceBinding"},"maxItems":4096,"title":"Resource Bindings","type":"array"},"run_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[^\\s\\x00-\\x1f]+$","title":"Run Id","type":"string"}},"required":["profile","attestation_id","authored_digest","instantiated_digest","plan_digest","predecessor_digest","operation_id","run_id","recorded_at","boundary","producer","coverage_profile","origins","resource_bindings"],"title":"MaterializationProvenance","type":"object"}, + "MaterializedResourceBinding": {"additionalProperties":false,"description":"Portable resource and source-declaration identity for one realized node.","properties":{"address":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":2048,"minLength":3,"not":{"pattern":"[^a-z0-9_.-]"},"pattern":"^(?:[a-z0-9][a-z0-9_-]{0,63}|__private)(?:\\.(?:[a-z0-9][a-z0-9_-]{0,63}|__private))+$","title":"Address","type":"string"},"instance_index":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Instance Index"},"node_name":{"$ref":"#/$defs/_r0"},"source_node":{"anyOf":[{"$ref":"#/$defs/_r0"},{"type":"null"}],"default":null}},"required":["address","node_name"],"title":"MaterializedResourceBinding","type":"object"}, "MixedControlAuthorityStatus": {"description":"Authored authority state for one controller binding.","enum":["active","revoked"],"title":"MixedControlAuthorityStatus","type":"string"}, "MixedControlConcurrentDisposition": {"description":"Disposition for decisions that share a control-state revision.","enum":["order-then-revalidate"],"title":"MixedControlConcurrentDisposition","type":"string"}, - "MixedControlControllerState": {"additionalProperties":false,"description":"One authored controller, authority, scope, and validity binding.","properties":{"authority_basis_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Authority Basis Refs","type":"array"},"authority_status":{"$ref":"#/$defs/MixedControlAuthorityStatus"},"controller_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Controller Ref","type":"string"},"evidence_refs":{"$ref":"#/$defs/_r119"},"policy_revision":{"$ref":"#/$defs/_r179"},"scope_refs":{"$ref":"#/$defs/_r128"},"valid_from_order":{"minimum":0,"title":"Valid From Order","type":"integer"},"valid_until_order":{"minimum":0,"title":"Valid Until Order","type":"integer"}},"required":["controller_ref","authority_basis_refs","scope_refs","policy_revision","valid_from_order","valid_until_order","authority_status","evidence_refs"],"title":"MixedControlControllerState","type":"object"}, + "MixedControlControllerState": {"additionalProperties":false,"description":"One authored controller, authority, scope, and validity binding.","properties":{"authority_basis_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Authority Basis Refs","type":"array"},"authority_status":{"$ref":"#/$defs/MixedControlAuthorityStatus"},"controller_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Controller Ref","type":"string"},"evidence_refs":{"$ref":"#/$defs/_r122"},"policy_revision":{"$ref":"#/$defs/_r182"},"scope_refs":{"$ref":"#/$defs/_r131"},"valid_from_order":{"minimum":0,"title":"Valid From Order","type":"integer"},"valid_until_order":{"minimum":0,"title":"Valid Until Order","type":"integer"}},"required":["controller_ref","authority_basis_refs","scope_refs","policy_revision","valid_from_order","valid_until_order","authority_status","evidence_refs"],"title":"MixedControlControllerState","type":"object"}, "MixedControlDispositionRules": {"additionalProperties":false,"description":"Explicit deterministic rules for invalid or competing decisions.","properties":{"concurrent":{"$ref":"#/$defs/MixedControlConcurrentDisposition"},"conflict":{"$ref":"#/$defs/MixedControlRejectDisposition"},"duplicate":{"$ref":"#/$defs/MixedControlDuplicateDisposition"},"late":{"$ref":"#/$defs/MixedControlRejectDisposition"},"revoked":{"$ref":"#/$defs/MixedControlRejectDisposition"},"stale":{"$ref":"#/$defs/MixedControlRejectDisposition"}},"required":["duplicate","stale","revoked","late","concurrent","conflict"],"title":"MixedControlDispositionRules","type":"object"}, "MixedControlDuplicateDisposition": {"description":"Disposition for a repeated decision identity.","enum":["idempotent-if-equivalent"],"title":"MixedControlDuplicateDisposition","type":"string"}, "MixedControlOrderStrategy": {"description":"Portable ordering strategies for authored control decisions.","enum":["total-effective-order"],"title":"MixedControlOrderStrategy","type":"string"}, - "MixedControlParticipantOperation": {"additionalProperties":false,"description":"Closed authored mixed-control policy for exactly one participant.","properties":{"controller_states":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/MixedControlControllerState"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Controller States","type":"object"},"dispositions":{"$ref":"#/$defs/MixedControlDispositionRules"},"initial_state_ref":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Initial State Ref","type":"string"},"order_strategy":{"$ref":"#/$defs/MixedControlOrderStrategy"},"participant_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Ref","type":"string"},"policy_revision":{"$ref":"#/$defs/_r179"},"transitions":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/MixedControlTransition"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Transitions","type":"object"}},"required":["participant_ref","policy_revision","order_strategy","initial_state_ref","dispositions","controller_states","transitions"],"title":"MixedControlParticipantOperation","type":"object"}, + "MixedControlParticipantOperation": {"additionalProperties":false,"description":"Closed authored mixed-control policy for exactly one participant.","properties":{"controller_states":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/MixedControlControllerState"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Controller States","type":"object"},"dispositions":{"$ref":"#/$defs/MixedControlDispositionRules"},"initial_state_ref":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Initial State Ref","type":"string"},"order_strategy":{"$ref":"#/$defs/MixedControlOrderStrategy"},"participant_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Ref","type":"string"},"policy_revision":{"$ref":"#/$defs/_r182"},"transitions":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/MixedControlTransition"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Transitions","type":"object"}},"required":["participant_ref","policy_revision","order_strategy","initial_state_ref","dispositions","controller_states","transitions"],"title":"MixedControlParticipantOperation","type":"object"}, "MixedControlRejectDisposition": {"description":"Fail-closed disposition that preserves the current state.","enum":["reject-no-state-change"],"title":"MixedControlRejectDisposition","type":"string"}, - "MixedControlTransition": {"additionalProperties":false,"description":"One authored, revision-checked mixed-control transition declaration.","properties":{"completion_evidence_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Completion Evidence Refs","type":"array"},"effective_order":{"minimum":0,"title":"Effective Order","type":"integer"},"evidence_refs":{"$ref":"#/$defs/_r119"},"expected_state_revision":{"minimum":0,"title":"Expected State Revision","type":"integer"},"from_state_ref":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"From State Ref","type":"string"},"policy_revision":{"$ref":"#/$defs/_r179"},"proposal_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Proposal Ref"},"proposal_revision":{"anyOf":[{"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Proposal Revision"},"resulting_state_revision":{"minimum":1,"title":"Resulting State Revision","type":"integer"},"to_state_ref":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"To State Ref","type":"string"},"transition_kind":{"$ref":"#/$defs/MixedControlTransitionKind"},"valid_from_order":{"minimum":0,"title":"Valid From Order","type":"integer"},"valid_until_order":{"minimum":0,"title":"Valid Until Order","type":"integer"}},"required":["transition_kind","from_state_ref","to_state_ref","policy_revision","expected_state_revision","resulting_state_revision","effective_order","valid_from_order","valid_until_order","evidence_refs"],"title":"MixedControlTransition","type":"object"}, + "MixedControlTransition": {"additionalProperties":false,"description":"One authored, revision-checked mixed-control transition declaration.","properties":{"completion_evidence_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Completion Evidence Refs","type":"array"},"effective_order":{"minimum":0,"title":"Effective Order","type":"integer"},"evidence_refs":{"$ref":"#/$defs/_r122"},"expected_state_revision":{"minimum":0,"title":"Expected State Revision","type":"integer"},"from_state_ref":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"From State Ref","type":"string"},"policy_revision":{"$ref":"#/$defs/_r182"},"proposal_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Proposal Ref"},"proposal_revision":{"anyOf":[{"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Proposal Revision"},"resulting_state_revision":{"minimum":1,"title":"Resulting State Revision","type":"integer"},"to_state_ref":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"To State Ref","type":"string"},"transition_kind":{"$ref":"#/$defs/MixedControlTransitionKind"},"valid_from_order":{"minimum":0,"title":"Valid From Order","type":"integer"},"valid_until_order":{"minimum":0,"title":"Valid Until Order","type":"integer"}},"required":["transition_kind","from_state_ref","to_state_ref","policy_revision","expected_state_revision","resulting_state_revision","effective_order","valid_from_order","valid_until_order","evidence_refs"],"title":"MixedControlTransition","type":"object"}, "MixedControlTransitionKind": {"description":"Control-owned facts kept distinct from admission and execution.","enum":["proposal","approval","denial","external-direction","intervention","handoff","override","cancellation"],"title":"MixedControlTransitionKind","type":"string"}, "NamedAlphabet": {"description":"Closed set of portable alphabets a random value may draw from.\n\nConcrete charsets live in :data:`raes_contracts.random_value_generation.NAMED_ALPHABET_CHARSETS`,\nthe single source of truth shared with backend generation.","enum":["hex_lower","hex_upper","digits","alpha","alphanumeric","base32","base58"],"title":"NamedAlphabet","type":"string"}, - "Node": {"additionalProperties":false,"allOf":[{"if":{"properties":{"os_version":{"minLength":1,"type":"string"}},"required":["os_version"]},"then":{"properties":{"os_distribution":{"not":{"type":"null"}}},"required":["os_distribution"]}},{"if":{"properties":{"os_distribution":{"not":{"type":"null"}}},"required":["os_distribution"]},"then":{"properties":{"os":{"not":{"type":"null"}}},"required":["os"]}}],"description":"A scenario node \u2014 either a compute endpoint or a strict switch.\n\nThe ``type`` field determines which structural variant is active. Compute\nfields are only valid for compute nodes; switches carry no extra data.","properties":{"architecture":{"anyOf":[{"$ref":"#/$defs/NodeArchitecture"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:amd64|x64|x86-64|arm64|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"},{"type":"null"}],"default":null,"title":"Architecture"},"asset_value":{"anyOf":[{"$ref":"#/$defs/AssetValue"},{"type":"null"}],"default":null},"conditions":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Conditions","type":"object"},"description":{"$ref":"#/$defs/_r53"},"endpoint_persona":{"anyOf":[{"$ref":"#/$defs/EndpointPersona"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Endpoint Persona"},"features":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Features","type":"object"},"injects":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Injects","type":"object"},"os":{"anyOf":[{"$ref":"#/$defs/OSFamily"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][iI][nN][dD][oO][wW][sS]|[lL][iI][nN][uU][xX]|[mM][aA][cC][oO][sS]|[fF][rR][eE][eE][bB][sS][dD]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"},{"type":"null"}],"default":null,"title":"Os"},"os_distribution":{"anyOf":[{"$ref":"#/$defs/OSDistribution"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"},{"type":"null"}],"default":null,"title":"Os Distribution"},"os_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[!-~](?:[ -~]{0,126}[!-~])?|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})?$","title":"Os Version","type":"string"},"resources":{"anyOf":[{"$ref":"#/$defs/Resources"},{"type":"null"}],"default":null},"roles":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/Role"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Roles","type":"object"},"runtime":{"anyOf":[{"$ref":"#/$defs/RuntimeConfiguration"},{"type":"null"}],"default":null},"services":{"items":{"$ref":"#/$defs/ServicePort"},"title":"Services","type":"array"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"type":{"$ref":"#/$defs/NodeType"}},"required":["type"],"title":"Node","type":"object"}, + "Node": {"additionalProperties":false,"allOf":[{"if":{"properties":{"os_version":{"minLength":1,"type":"string"}},"required":["os_version"]},"then":{"properties":{"os_distribution":{"not":{"type":"null"}}},"required":["os_distribution"]}},{"if":{"properties":{"os_distribution":{"not":{"type":"null"}}},"required":["os_distribution"]},"then":{"properties":{"os":{"not":{"type":"null"}}},"required":["os"]}}],"description":"A scenario node \u2014 either a compute endpoint or a strict switch.\n\nThe ``type`` field determines which structural variant is active. Compute\nfields are only valid for compute nodes; switches carry no extra data.","properties":{"architecture":{"anyOf":[{"$ref":"#/$defs/NodeArchitecture"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:amd64|x64|x86-64|arm64|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"},{"type":"null"}],"default":null,"title":"Architecture"},"asset_value":{"anyOf":[{"$ref":"#/$defs/AssetValue"},{"type":"null"}],"default":null},"conditions":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Conditions","type":"object"},"description":{"$ref":"#/$defs/_r53"},"endpoint_persona":{"anyOf":[{"$ref":"#/$defs/EndpointPersona"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Endpoint Persona"},"features":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Features","type":"object"},"injects":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Injects","type":"object"},"os":{"anyOf":[{"$ref":"#/$defs/OSFamily"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][iI][nN][dD][oO][wW][sS]|[lL][iI][nN][uU][xX]|[mM][aA][cC][oO][sS]|[fF][rR][eE][eE][bB][sS][dD]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"},{"type":"null"}],"default":null,"title":"Os"},"os_distribution":{"anyOf":[{"$ref":"#/$defs/OSDistribution"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"},{"type":"null"}],"default":null,"title":"Os Distribution"},"os_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[!-~](?:[ -~]{0,126}[!-~])?|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})?$","title":"Os Version","type":"string"},"resources":{"anyOf":[{"$ref":"#/$defs/Resources"},{"type":"null"}],"default":null},"roles":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/Role"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Roles","type":"object"},"runtime":{"anyOf":[{"$ref":"#/$defs/RuntimeConfiguration"},{"type":"null"}],"default":null},"services":{"items":{"$ref":"#/$defs/ServicePort"},"title":"Services","type":"array"},"source":{"anyOf":[{"$ref":"#/$defs/Source"},{"type":"null"}],"default":null},"type":{"$ref":"#/$defs/NodeType"}},"required":["type"],"title":"Node","type":"object"}, "NodeArchitecture": {"description":"Canonical target-node CPU architecture vocabulary.\n\nGoverned-extension vocabulary (DSL-139): the closed canonical set below is\nkept deliberately small; a custom architecture uses the governed\n``x-:`` extension form rather than a catch-all sentinel, so\nneither ``unknown`` nor ``other`` is carried (absence already expresses \"no\ntarget architecture requirement\"). Kept in parity with the\n``provisioner-node-architectures`` controlled vocabulary.","enum":["x86_64","aarch64"],"title":"NodeArchitecture","type":"string"}, "NodeType": {"description":"Structural resource kind, independent of its realization mechanism.","enum":["compute","switch"],"title":"NodeType","type":"string"}, - "NumericPredicate": {"additionalProperties":false,"description":"Compare a governed numeric property using an explicit unit.","properties":{"expected":{"anyOf":[{"type":"integer"},{"type":"number"}],"title":"Expected"},"kind":{"const":"number","default":"number","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals","less_than","less_than_or_equal","greater_than","greater_than_or_equal"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r137"},"semantic_ref":{"$ref":"#/$defs/_r133"},"unit":{"maxLength":512,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z0-9][a-z0-9_-]{0,63}(?:\\.[a-z0-9][a-z0-9_-]{0,63})*$","title":"Unit","type":"string"},"unit_semantic_ref":{"maxLength":2048,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:https://[^\\s]+|urn:[A-Za-z0-9][A-Za-z0-9:._~-]*)$","title":"Unit Semantic Ref","type":"string"}},"required":["property","semantic_ref","expected","unit","unit_semantic_ref"],"title":"NumericPredicate","type":"object"}, + "NumericPredicate": {"additionalProperties":false,"description":"Compare a governed numeric property using an explicit unit.","properties":{"expected":{"anyOf":[{"type":"integer"},{"type":"number"}],"title":"Expected"},"kind":{"const":"number","default":"number","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals","less_than","less_than_or_equal","greater_than","greater_than_or_equal"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r140"},"semantic_ref":{"$ref":"#/$defs/_r136"},"unit":{"maxLength":512,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z0-9][a-z0-9_-]{0,63}(?:\\.[a-z0-9][a-z0-9_-]{0,63})*$","title":"Unit","type":"string"},"unit_semantic_ref":{"maxLength":2048,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:https://[^\\s]+|urn:[A-Za-z0-9][A-Za-z0-9:._~-]*)$","title":"Unit Semantic Ref","type":"string"}},"required":["property","semantic_ref","expected","unit","unit_semantic_ref"],"title":"NumericPredicate","type":"object"}, "OSDistribution": {"description":"Canonical portable distribution or product-line identifiers.","enum":["ubuntu","debian","rocky-linux","red-hat-enterprise-linux","windows-server","windows-client","solaris"],"title":"OSDistribution","type":"string"}, "OSFamily": {"description":"Operating system family. Vocabulary from OCSF Device.os.","enum":["windows","linux","macos","freebsd","other"],"title":"OSFamily","type":"string"}, - "Objective": {"additionalProperties":false,"anyOf":[{"properties":{"owner":{"$ref":"#/$defs/_r148"}},"required":["owner"]},{"properties":{"assigned_participant":{"$ref":"#/$defs/_r148"}},"required":["assigned_participant"]}],"description":"A declarative experiment objective.","properties":{"actions":{"$ref":"#/$defs/_r99"},"assigned_participant":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Assigned Participant"},"depends_on":{"items":{"$ref":"#/$defs/_r187"},"title":"Depends On","type":"array"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"owner":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Owner"},"success":{"$ref":"#/$defs/ObjectiveSuccess"},"targets":{"items":{"$ref":"#/$defs/_r187"},"title":"Targets","type":"array"},"window":{"anyOf":[{"$ref":"#/$defs/ObjectiveWindow"},{"type":"null"}],"default":null}},"required":["success"],"title":"Objective","type":"object"}, - "ObjectiveSuccess": {"additionalProperties":false,"description":"Declarative success criteria for an objective.\n\nSuccess composes backend-neutral invariant or postcondition assertions.\nProbe implementations, graded scoring, and reward remain outside this\nconstruct.","properties":{"assertions":{"$ref":"#/$defs/_r105"},"mode":{"anyOf":[{"$ref":"#/$defs/TruthCompositionMode"},{"$ref":"#/$defs/_r187"}],"default":"all_of","title":"Mode"},"threshold":{"$ref":"#/$defs/_r22"}},"title":"ObjectiveSuccess","type":"object"}, - "ObjectiveWindow": {"additionalProperties":false,"description":"Optional orchestration window constraining when an objective applies.","properties":{"events":{"$ref":"#/$defs/_r118"},"scripts":{"items":{"$ref":"#/$defs/_r187"},"title":"Scripts","type":"array"},"steps":{"items":{"$ref":"#/$defs/_r187"},"title":"Steps","type":"array"},"stories":{"items":{"$ref":"#/$defs/_r187"},"title":"Stories","type":"array"},"workflows":{"items":{"$ref":"#/$defs/_r187"},"title":"Workflows","type":"array"}},"title":"ObjectiveWindow","type":"object"}, + "Objective": {"additionalProperties":false,"anyOf":[{"properties":{"owner":{"$ref":"#/$defs/_r151"}},"required":["owner"]},{"properties":{"assigned_participant":{"$ref":"#/$defs/_r151"}},"required":["assigned_participant"]}],"description":"A declarative experiment objective.","properties":{"actions":{"$ref":"#/$defs/_r102"},"assigned_participant":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Assigned Participant"},"depends_on":{"items":{"$ref":"#/$defs/_r190"},"title":"Depends On","type":"array"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"owner":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Owner"},"success":{"$ref":"#/$defs/ObjectiveSuccess"},"targets":{"items":{"$ref":"#/$defs/_r190"},"title":"Targets","type":"array"},"window":{"anyOf":[{"$ref":"#/$defs/ObjectiveWindow"},{"type":"null"}],"default":null}},"required":["success"],"title":"Objective","type":"object"}, + "ObjectiveSuccess": {"additionalProperties":false,"description":"Declarative success criteria for an objective.\n\nSuccess composes backend-neutral invariant or postcondition assertions.\nProbe implementations, graded scoring, and reward remain outside this\nconstruct.","properties":{"assertions":{"$ref":"#/$defs/_r108"},"mode":{"anyOf":[{"$ref":"#/$defs/TruthCompositionMode"},{"$ref":"#/$defs/_r190"}],"default":"all_of","title":"Mode"},"threshold":{"$ref":"#/$defs/_r22"}},"title":"ObjectiveSuccess","type":"object"}, + "ObjectiveWindow": {"additionalProperties":false,"description":"Optional orchestration window constraining when an objective applies.","properties":{"events":{"$ref":"#/$defs/_r121"},"scripts":{"items":{"$ref":"#/$defs/_r190"},"title":"Scripts","type":"array"},"steps":{"items":{"$ref":"#/$defs/_r190"},"title":"Steps","type":"array"},"stories":{"items":{"$ref":"#/$defs/_r190"},"title":"Stories","type":"array"},"workflows":{"items":{"$ref":"#/$defs/_r190"},"title":"Workflows","type":"array"}},"title":"ObjectiveWindow","type":"object"}, "ObservationBasis": {"description":"Truthful basis requested for a reportable value.","enum":["backend-selected","observed","independently-verified","operational"],"title":"ObservationBasis","type":"string"}, "ObservationDemandMode": {"description":"Selection posture at a named semantic scope.","enum":["inherit","none","operational-only","selected","exhaustive"],"title":"ObservationDemandMode","type":"string"}, - "ObservationDemandRule": {"additionalProperties":false,"allOf":[{"anyOf":[{"properties":{"mode":{"not":{"type":"null"}}},"required":["mode"]},{"properties":{"selector":{"not":{"type":"null"}}},"required":["selector"]},{"properties":{"collection":{"not":{"type":"null"}}},"required":["collection"]},{"properties":{"retention":{"not":{"type":"null"}}},"required":["retention"]},{"properties":{"export":{"not":{"type":"null"}}},"required":["export"]},{"properties":{"basis":{"not":{"type":"null"}}},"required":["basis"]},{"properties":{"redaction":{"not":{"type":"null"}}},"required":["redaction"]},{"properties":{"integrity":{"not":{"type":"null"}}},"required":["integrity"]},{"properties":{"prohibited_stages":{"minItems":1}},"required":["prohibited_stages"]}]},{"if":{"properties":{"mode":{"enum":["selected","exhaustive"]}},"required":["mode"]},"then":{"properties":{"selector":{"not":{"type":"null"}}},"required":["selector"]}},{"if":{"properties":{"mode":{"const":"exhaustive"}},"required":["mode"]},"then":{"properties":{"selector":{"properties":{"coverage_profile":{"minLength":1,"type":"string"},"max_items":{"minimum":1,"type":"integer"}},"required":["coverage_profile","max_items"]}},"required":["selector"]}},{"if":{"properties":{"mode":{"enum":["selected","exhaustive"]},"purpose":{"const":"experimental"}},"required":["purpose","mode"]},"then":{"properties":{"integrity":{"minLength":1,"type":"string"},"redaction":{"minLength":1,"type":"string"}},"required":["redaction","integrity"]}}],"description":"One local scoped preference or independent mandatory requirement.","properties":{"authority_ref":{"default":"author","minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority Ref","type":"string"},"basis":{"anyOf":[{"$ref":"#/$defs/ObservationBasis"},{"type":"null"}],"default":null},"collection":{"$ref":"#/$defs/_r8"},"export":{"$ref":"#/$defs/_r8"},"integrity":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Integrity"},"mode":{"anyOf":[{"$ref":"#/$defs/ObservationDemandMode"},{"type":"null"}],"default":null},"prohibited_stages":{"default":[],"items":{"$ref":"#/$defs/ObservationLifecycleStage"},"maxItems":3,"title":"Prohibited Stages","type":"array"},"purpose":{"$ref":"#/$defs/ObservationPurpose"},"redaction":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Redaction"},"required":{"default":false,"title":"Required","type":"boolean"},"retention":{"$ref":"#/$defs/_r8"},"rule_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rule Id","type":"string"},"scope":{"$ref":"#/$defs/_r135"},"selector":{"anyOf":[{"$ref":"#/$defs/ObservationSelector"},{"type":"null"}],"default":null}},"required":["rule_id","scope","purpose"],"title":"ObservationDemandRule","type":"object"}, + "ObservationDemandRule": {"additionalProperties":false,"allOf":[{"anyOf":[{"properties":{"mode":{"not":{"type":"null"}}},"required":["mode"]},{"properties":{"selector":{"not":{"type":"null"}}},"required":["selector"]},{"properties":{"collection":{"not":{"type":"null"}}},"required":["collection"]},{"properties":{"retention":{"not":{"type":"null"}}},"required":["retention"]},{"properties":{"export":{"not":{"type":"null"}}},"required":["export"]},{"properties":{"basis":{"not":{"type":"null"}}},"required":["basis"]},{"properties":{"redaction":{"not":{"type":"null"}}},"required":["redaction"]},{"properties":{"integrity":{"not":{"type":"null"}}},"required":["integrity"]},{"properties":{"prohibited_stages":{"minItems":1}},"required":["prohibited_stages"]}]},{"if":{"properties":{"mode":{"enum":["selected","exhaustive"]}},"required":["mode"]},"then":{"properties":{"selector":{"not":{"type":"null"}}},"required":["selector"]}},{"if":{"properties":{"mode":{"const":"exhaustive"}},"required":["mode"]},"then":{"properties":{"selector":{"properties":{"coverage_profile":{"minLength":1,"type":"string"},"max_items":{"minimum":1,"type":"integer"}},"required":["coverage_profile","max_items"]}},"required":["selector"]}},{"if":{"properties":{"mode":{"enum":["selected","exhaustive"]},"purpose":{"const":"experimental"}},"required":["purpose","mode"]},"then":{"properties":{"integrity":{"minLength":1,"type":"string"},"redaction":{"minLength":1,"type":"string"}},"required":["redaction","integrity"]}}],"description":"One local scoped preference or independent mandatory requirement.","properties":{"authority_ref":{"default":"author","minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority Ref","type":"string"},"basis":{"anyOf":[{"$ref":"#/$defs/ObservationBasis"},{"type":"null"}],"default":null},"collection":{"$ref":"#/$defs/_r8"},"export":{"$ref":"#/$defs/_r8"},"integrity":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Integrity"},"mode":{"anyOf":[{"$ref":"#/$defs/ObservationDemandMode"},{"type":"null"}],"default":null},"prohibited_stages":{"default":[],"items":{"$ref":"#/$defs/ObservationLifecycleStage"},"maxItems":3,"title":"Prohibited Stages","type":"array"},"purpose":{"$ref":"#/$defs/ObservationPurpose"},"redaction":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Redaction"},"required":{"default":false,"title":"Required","type":"boolean"},"retention":{"$ref":"#/$defs/_r8"},"rule_id":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rule Id","type":"string"},"scope":{"$ref":"#/$defs/_r138"},"selector":{"anyOf":[{"$ref":"#/$defs/ObservationSelector"},{"type":"null"}],"default":null}},"required":["rule_id","scope","purpose"],"title":"ObservationDemandRule","type":"object"}, "ObservationLifecycleDecision": {"description":"One local lifecycle preference or monotone prohibition.","enum":["inherit","forbid","disable","require"],"title":"ObservationLifecycleDecision","type":"string"}, "ObservationLifecycleStage": {"description":"Independently governed data-lifecycle stages.","enum":["collection","retention","export"],"title":"ObservationLifecycleStage","type":"string"}, "ObservationPurpose": {"description":"Authority plane for requested data use.","enum":["experimental","realization-description","operational"],"title":"ObservationPurpose","type":"string"}, - "ObservationSelector": {"additionalProperties":false,"allOf":[{"if":{"properties":{"coverage_profile":{"not":{"type":"null"}}},"required":["coverage_profile"]},"then":{"properties":{"max_items":{"not":{"type":"null"}}},"required":["max_items"]}},{"if":{"properties":{"max_items":{"not":{"type":"null"}}},"required":["max_items"]},"then":{"properties":{"coverage_profile":{"not":{"type":"null"}}},"required":["coverage_profile"]}}],"description":"Bounded selector over a semantic scope and one data surface.","properties":{"component_refs":{"default":[],"items":{"$ref":"#/$defs/_r148"},"maxItems":256,"title":"Component Refs","type":"array"},"coverage_profile":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Coverage Profile"},"data_kind":{"enum":["field","stream","artifact"],"title":"Data Kind","type":"string"},"excluded_scopes":{"default":[],"items":{"$ref":"#/$defs/_r136"},"maxItems":256,"title":"Excluded Scopes","type":"array"},"max_items":{"anyOf":[{"maximum":1000000,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Items"},"names":{"items":{"$ref":"#/$defs/_r148"},"maxItems":256,"minItems":1,"title":"Names","type":"array"},"semantic_scope":{"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Semantic Scope","type":"string"},"window_refs":{"default":[],"items":{"$ref":"#/$defs/_r148"},"maxItems":256,"title":"Window Refs","type":"array"}},"required":["semantic_scope","data_kind","names"],"title":"ObservationSelector","type":"object"}, + "ObservationSelector": {"additionalProperties":false,"allOf":[{"if":{"properties":{"coverage_profile":{"not":{"type":"null"}}},"required":["coverage_profile"]},"then":{"properties":{"max_items":{"not":{"type":"null"}}},"required":["max_items"]}},{"if":{"properties":{"max_items":{"not":{"type":"null"}}},"required":["max_items"]},"then":{"properties":{"coverage_profile":{"not":{"type":"null"}}},"required":["coverage_profile"]}}],"description":"Bounded selector over a semantic scope and one data surface.","properties":{"component_refs":{"default":[],"items":{"$ref":"#/$defs/_r151"},"maxItems":256,"title":"Component Refs","type":"array"},"coverage_profile":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Coverage Profile"},"data_kind":{"enum":["field","stream","artifact"],"title":"Data Kind","type":"string"},"excluded_scopes":{"default":[],"items":{"$ref":"#/$defs/_r139"},"maxItems":256,"title":"Excluded Scopes","type":"array"},"max_items":{"anyOf":[{"maximum":1000000,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Items"},"names":{"items":{"$ref":"#/$defs/_r151"},"maxItems":256,"minItems":1,"title":"Names","type":"array"},"semantic_scope":{"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Semantic Scope","type":"string"},"window_refs":{"default":[],"items":{"$ref":"#/$defs/_r151"},"maxItems":256,"title":"Window Refs","type":"array"}},"required":["semantic_scope","data_kind","names"],"title":"ObservationSelector","type":"object"}, "OperatorSecretCredentialMaterial": {"additionalProperties":false,"description":"Value-free reference to operator-managed credential material.","properties":{"classification":{"const":"operator_secret","title":"Classification","type":"string"},"reference_id":{"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$","title":"Reference Id","type":"string"}},"required":["classification","reference_id"],"title":"OperatorSecretCredentialMaterial","type":"object"}, "OutcomeInterpretationParticipantScope": {"description":"Allowed participant scope for SEM-215 interpretation rules.","enum":["participant_local"],"title":"OutcomeInterpretationParticipantScope","type":"string"}, - "OutcomeInterpretationRule": {"additionalProperties":false,"allOf":[{"else":{"properties":{"target_bindings":{"minItems":1}}},"if":{"properties":{"local_outcome":{"type":"object"}},"required":["local_outcome"]},"then":{"properties":{"semantic_version":{"const":"2.0.0"}}}}],"description":"Explicit SEM-215 rule relating participant-local outcomes to meaning layers.","properties":{"diagnostics":{"$ref":"#/$defs/_r113"},"evidence_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Evidence Refs","type":"array"},"interpretation_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Interpretation Basis","type":"string"},"limitations":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Limitations","type":"array"},"local_outcome":{"anyOf":[{"$ref":"#/$defs/LocalOutcomeDefinition"},{"type":"null"}],"default":null},"observation_point_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Observation Point Basis","type":"string"},"participant_scope":{"$ref":"#/$defs/OutcomeInterpretationParticipantScope"},"semantic_version":{"$ref":"#/$defs/_r182"},"source_bindings":{"items":{"$ref":"#/$defs/OutcomeInterpretationSourceBinding"},"minItems":1,"title":"Source Bindings","type":"array"},"target_bindings":{"items":{"$ref":"#/$defs/OutcomeInterpretationTargetBinding"},"title":"Target Bindings","type":"array"}},"required":["semantic_version","participant_scope","observation_point_basis","interpretation_basis","source_bindings","target_bindings","evidence_refs","limitations"],"title":"OutcomeInterpretationRule","type":"object"}, - "OutcomeInterpretationSourceBinding": {"additionalProperties":false,"description":"Declared input to a participant outcome interpretation rule.","properties":{"diagnostics":{"$ref":"#/$defs/_r113"},"evidence_refs":{"$ref":"#/$defs/_r119"},"interpretation_role":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Interpretation Role","type":"string"},"provenance_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Provenance Refs","type":"array"},"ref":{"$ref":"#/$defs/_r180"},"source_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Id","type":"string"},"source_layer":{"$ref":"#/$defs/OutcomeInterpretationSourceLayer"}},"required":["source_id","source_layer","ref","interpretation_role"],"title":"OutcomeInterpretationSourceBinding","type":"object"}, + "OutcomeInterpretationRule": {"additionalProperties":false,"allOf":[{"else":{"properties":{"target_bindings":{"minItems":1}}},"if":{"properties":{"local_outcome":{"type":"object"}},"required":["local_outcome"]},"then":{"properties":{"semantic_version":{"const":"2.0.0"}}}}],"description":"Explicit SEM-215 rule relating participant-local outcomes to meaning layers.","properties":{"diagnostics":{"$ref":"#/$defs/_r116"},"evidence_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Evidence Refs","type":"array"},"interpretation_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Interpretation Basis","type":"string"},"limitations":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Limitations","type":"array"},"local_outcome":{"anyOf":[{"$ref":"#/$defs/LocalOutcomeDefinition"},{"type":"null"}],"default":null},"observation_point_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Observation Point Basis","type":"string"},"participant_scope":{"$ref":"#/$defs/OutcomeInterpretationParticipantScope"},"semantic_version":{"$ref":"#/$defs/_r185"},"source_bindings":{"items":{"$ref":"#/$defs/OutcomeInterpretationSourceBinding"},"minItems":1,"title":"Source Bindings","type":"array"},"target_bindings":{"items":{"$ref":"#/$defs/OutcomeInterpretationTargetBinding"},"title":"Target Bindings","type":"array"}},"required":["semantic_version","participant_scope","observation_point_basis","interpretation_basis","source_bindings","target_bindings","evidence_refs","limitations"],"title":"OutcomeInterpretationRule","type":"object"}, + "OutcomeInterpretationSourceBinding": {"additionalProperties":false,"description":"Declared input to a participant outcome interpretation rule.","properties":{"diagnostics":{"$ref":"#/$defs/_r116"},"evidence_refs":{"$ref":"#/$defs/_r122"},"interpretation_role":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Interpretation Role","type":"string"},"provenance_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Provenance Refs","type":"array"},"ref":{"$ref":"#/$defs/_r183"},"source_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Id","type":"string"},"source_layer":{"$ref":"#/$defs/OutcomeInterpretationSourceLayer"}},"required":["source_id","source_layer","ref","interpretation_role"],"title":"OutcomeInterpretationSourceBinding","type":"object"}, "OutcomeInterpretationSourceLayer": {"description":"Semantic layers that may feed a SEM-215 interpretation rule.","enum":["participant_action_outcome","participant_episode_status","objective_result","workflow_result","evaluation_result","evidence_claim","reward_signal","benchmark_milestone","subtask","gold_step","human_assistance","scaffold_variant","cost_resource_telemetry","privacy_redaction_result"],"title":"OutcomeInterpretationSourceLayer","type":"string"}, - "OutcomeInterpretationTargetBinding": {"additionalProperties":false,"description":"Declared output relation from a participant outcome interpretation rule.","properties":{"diagnostics":{"$ref":"#/$defs/_r113"},"evidence_refs":{"$ref":"#/$defs/_r119"},"governance_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Governance Ref"},"limitations":{"$ref":"#/$defs/_r123"},"ref":{"$ref":"#/$defs/_r180"},"relation":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Relation","type":"string"},"target_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Id","type":"string"},"target_layer":{"$ref":"#/$defs/OutcomeInterpretationTargetLayer"}},"required":["target_id","target_layer","ref","relation"],"title":"OutcomeInterpretationTargetBinding","type":"object"}, + "OutcomeInterpretationTargetBinding": {"additionalProperties":false,"description":"Declared output relation from a participant outcome interpretation rule.","properties":{"diagnostics":{"$ref":"#/$defs/_r116"},"evidence_refs":{"$ref":"#/$defs/_r122"},"governance_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Governance Ref"},"limitations":{"$ref":"#/$defs/_r126"},"ref":{"$ref":"#/$defs/_r183"},"relation":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Relation","type":"string"},"target_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Id","type":"string"},"target_layer":{"$ref":"#/$defs/OutcomeInterpretationTargetLayer"}},"required":["target_id","target_layer","ref","relation"],"title":"OutcomeInterpretationTargetBinding","type":"object"}, "OutcomeInterpretationTargetLayer": {"description":"Semantic layers a SEM-215 interpretation rule may explicitly produce.","enum":["scenario_meaning","objective_result","workflow_result","evaluation_result","evidence_claim","reward_signal","benchmark_progress","privacy_redaction_result"],"title":"OutcomeInterpretationTargetLayer","type":"string"}, "ParticipantActionArgumentCardinality": {"description":"Whether an action argument carries one value or a bounded collection.","enum":["one","many"],"title":"ParticipantActionArgumentCardinality","type":"string"}, - "ParticipantActionArgumentDefinition": {"additionalProperties":false,"description":"Closed authored domain for one non-secret portable action argument.","properties":{"allowed_values":{"items":{"$ref":"#/$defs/_r23"},"title":"Allowed Values","type":"array"},"cardinality":{"$ref":"#/$defs/ParticipantActionArgumentCardinality","default":"one"},"default":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"integer"},{"type":"number"},{"type":"boolean"},{"items":{"$ref":"#/$defs/_r23"},"type":"array"},{"type":"null"}],"default":null,"title":"Default"},"default_disclosure_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Default Disclosure Ref"},"loss_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Loss Disclosure Ref","type":"string"},"max_items":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Items"},"max_length":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Length"},"maximum":{"anyOf":[{"type":"integer"},{"type":"number"},{"type":"null"}],"default":null,"title":"Maximum"},"min_items":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Items"},"min_length":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Length"},"minimum":{"anyOf":[{"type":"integer"},{"type":"number"},{"type":"null"}],"default":null,"title":"Minimum"},"normalization":{"$ref":"#/$defs/ParticipantActionArgumentNormalization"},"normalization_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Normalization Disclosure Ref","type":"string"},"omission":{"$ref":"#/$defs/ParticipantActionArgumentOmission"},"omission_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Omission Disclosure Ref","type":"string"},"unique_items":{"default":true,"title":"Unique Items","type":"boolean"},"value_type":{"$ref":"#/$defs/ParticipantActionArgumentValueType"}},"required":["value_type","normalization","normalization_disclosure_ref","omission","omission_disclosure_ref","loss_disclosure_ref"],"title":"ParticipantActionArgumentDefinition","type":"object"}, + "ParticipantActionArgumentDefinition": {"additionalProperties":false,"description":"Closed authored domain for one non-secret portable action argument.","properties":{"allowed_values":{"items":{"$ref":"#/$defs/_r23"},"title":"Allowed Values","type":"array"},"cardinality":{"$ref":"#/$defs/ParticipantActionArgumentCardinality","default":"one"},"default":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"integer"},{"type":"number"},{"type":"boolean"},{"items":{"$ref":"#/$defs/_r23"},"type":"array"},{"type":"null"}],"default":null,"title":"Default"},"default_disclosure_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Default Disclosure Ref"},"loss_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Loss Disclosure Ref","type":"string"},"max_items":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Items"},"max_length":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Max Length"},"maximum":{"anyOf":[{"type":"integer"},{"type":"number"},{"type":"null"}],"default":null,"title":"Maximum"},"min_items":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Items"},"min_length":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Length"},"minimum":{"anyOf":[{"type":"integer"},{"type":"number"},{"type":"null"}],"default":null,"title":"Minimum"},"normalization":{"$ref":"#/$defs/ParticipantActionArgumentNormalization"},"normalization_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Normalization Disclosure Ref","type":"string"},"omission":{"$ref":"#/$defs/ParticipantActionArgumentOmission"},"omission_disclosure_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Omission Disclosure Ref","type":"string"},"unique_items":{"default":true,"title":"Unique Items","type":"boolean"},"value_type":{"$ref":"#/$defs/ParticipantActionArgumentValueType"}},"required":["value_type","normalization","normalization_disclosure_ref","omission","omission_disclosure_ref","loss_disclosure_ref"],"title":"ParticipantActionArgumentDefinition","type":"object"}, "ParticipantActionArgumentNormalization": {"description":"Portable normalization operations with explicit disclosure.","enum":["identity","trim"],"title":"ParticipantActionArgumentNormalization","type":"string"}, "ParticipantActionArgumentOmission": {"description":"Portable handling for an omitted action argument.","enum":["reject","use_default","omit"],"title":"ParticipantActionArgumentOmission","type":"string"}, "ParticipantActionArgumentValueType": {"description":"Portable JSON value families admitted by an action argument.","enum":["string","integer","number","boolean","reference"],"title":"ParticipantActionArgumentValueType","type":"string"}, - "ParticipantActionContract": {"additionalProperties":false,"description":"Governed semantic contract for one participant action name.","properties":{"arguments":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantActionArgumentDefinition"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Arguments","type":"object"},"backend_failure_mappings":{"items":{"$ref":"#/$defs/ParticipantBackendFailureMapping"},"title":"Backend Failure Mappings","type":"array"},"backend_timing_disclosures":{"items":{"$ref":"#/$defs/ParticipantBackendTimingDisclosure"},"title":"Backend Timing Disclosures","type":"array"},"behavioral_granularity":{"$ref":"#/$defs/ParticipantActionGranularity"},"effects":{"items":{"$ref":"#/$defs/ParticipantActionEffect"},"title":"Effects","type":"array"},"evidence_expectations":{"items":{"$ref":"#/$defs/_r187"},"title":"Evidence Expectations","type":"array"},"failure_classes":{"items":{"$ref":"#/$defs/ParticipantFailureClass"},"title":"Failure Classes","type":"array"},"fidelity_claim":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Fidelity Claim","type":"string"},"interactions":{"items":{"$ref":"#/$defs/ParticipantInteractionDeclaration"},"title":"Interactions","type":"array"},"lifecycle_state":{"$ref":"#/$defs/ParticipantActionLifecycle","default":"active"},"observation_expectations":{"items":{"$ref":"#/$defs/_r187"},"title":"Observation Expectations","type":"array"},"preconditions":{"items":{"$ref":"#/$defs/ParticipantActionPrecondition"},"title":"Preconditions","type":"array"},"procedure_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Procedure Basis","type":"string"},"realization_profile":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Realization Profile","type":"string"},"semantic_version":{"$ref":"#/$defs/_r182"},"state_transition_effects":{"items":{"$ref":"#/$defs/_r187"},"title":"State Transition Effects","type":"array"},"temporal_contracts":{"items":{"$ref":"#/$defs/ParticipantTemporalContract"},"title":"Temporal Contracts","type":"array"}},"required":["semantic_version","behavioral_granularity","procedure_basis","realization_profile","fidelity_claim"],"title":"ParticipantActionContract","type":"object"}, - "ParticipantActionEffect": {"additionalProperties":false,"description":"Typed SEM-211 effect declaration on an action contract.","properties":{"description":{"$ref":"#/$defs/_r172"},"effect_class":{"$ref":"#/$defs/ParticipantEffectClass"},"effect_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Effect Id","type":"string"},"evidence_refs":{"$ref":"#/$defs/_r119"},"target_refs":{"$ref":"#/$defs/_r130"}},"required":["effect_id","effect_class","description"],"title":"ParticipantActionEffect","type":"object"}, + "ParticipantActionContract": {"additionalProperties":false,"description":"Governed semantic contract for one participant action name.","properties":{"arguments":{"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantActionArgumentDefinition"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Arguments","type":"object"},"backend_failure_mappings":{"items":{"$ref":"#/$defs/ParticipantBackendFailureMapping"},"title":"Backend Failure Mappings","type":"array"},"backend_timing_disclosures":{"items":{"$ref":"#/$defs/ParticipantBackendTimingDisclosure"},"title":"Backend Timing Disclosures","type":"array"},"behavioral_granularity":{"$ref":"#/$defs/ParticipantActionGranularity"},"effects":{"items":{"$ref":"#/$defs/ParticipantActionEffect"},"title":"Effects","type":"array"},"evidence_expectations":{"items":{"$ref":"#/$defs/_r190"},"title":"Evidence Expectations","type":"array"},"failure_classes":{"items":{"$ref":"#/$defs/ParticipantFailureClass"},"title":"Failure Classes","type":"array"},"fidelity_claim":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Fidelity Claim","type":"string"},"interactions":{"items":{"$ref":"#/$defs/ParticipantInteractionDeclaration"},"title":"Interactions","type":"array"},"lifecycle_state":{"$ref":"#/$defs/ParticipantActionLifecycle","default":"active"},"observation_expectations":{"items":{"$ref":"#/$defs/_r190"},"title":"Observation Expectations","type":"array"},"preconditions":{"items":{"$ref":"#/$defs/ParticipantActionPrecondition"},"title":"Preconditions","type":"array"},"procedure_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Procedure Basis","type":"string"},"realization_profile":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Realization Profile","type":"string"},"semantic_version":{"$ref":"#/$defs/_r185"},"state_transition_effects":{"items":{"$ref":"#/$defs/_r190"},"title":"State Transition Effects","type":"array"},"temporal_contracts":{"items":{"$ref":"#/$defs/ParticipantTemporalContract"},"title":"Temporal Contracts","type":"array"}},"required":["semantic_version","behavioral_granularity","procedure_basis","realization_profile","fidelity_claim"],"title":"ParticipantActionContract","type":"object"}, + "ParticipantActionEffect": {"additionalProperties":false,"description":"Typed SEM-211 effect declaration on an action contract.","properties":{"description":{"$ref":"#/$defs/_r175"},"effect_class":{"$ref":"#/$defs/ParticipantEffectClass"},"effect_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Effect Id","type":"string"},"evidence_refs":{"$ref":"#/$defs/_r122"},"target_refs":{"$ref":"#/$defs/_r133"}},"required":["effect_id","effect_class","description"],"title":"ParticipantActionEffect","type":"object"}, "ParticipantActionGranularity": {"description":"Behavioral granularity of a participant action contract.","enum":["atomic","procedure","aggregate"],"title":"ParticipantActionGranularity","type":"string"}, "ParticipantActionLifecycle": {"description":"Governance lifecycle for participant action contracts.","enum":["draft","active","deprecated"],"title":"ParticipantActionLifecycle","type":"string"}, - "ParticipantActionPrecondition": {"additionalProperties":false,"description":"Typed SEM-211 applicability precondition on an action contract.","properties":{"description":{"$ref":"#/$defs/_r172"},"evidence_refs":{"$ref":"#/$defs/_r119"},"precondition_class":{"$ref":"#/$defs/ParticipantPreconditionClass"},"precondition_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Precondition Id","type":"string"},"support_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Support Refs","type":"array"}},"required":["precondition_id","precondition_class","description"],"title":"ParticipantActionPrecondition","type":"object"}, + "ParticipantActionPrecondition": {"additionalProperties":false,"description":"Typed SEM-211 applicability precondition on an action contract.","properties":{"description":{"$ref":"#/$defs/_r175"},"evidence_refs":{"$ref":"#/$defs/_r122"},"precondition_class":{"$ref":"#/$defs/ParticipantPreconditionClass"},"precondition_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Precondition Id","type":"string"},"support_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Support Refs","type":"array"}},"required":["precondition_id","precondition_class","description"],"title":"ParticipantActionPrecondition","type":"object"}, "ParticipantActivityActionCandidate": {"additionalProperties":false,"description":"Stable weighted action candidate and its bounded recovery policy.","properties":{"action_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Action Ref","type":"string"},"cooldown_ticks":{"default":0,"maximum":1000000000,"minimum":0,"title":"Cooldown Ticks","type":"integer"},"depends_on":{"items":{"$ref":"#/$defs/_r3"},"maxItems":1024,"title":"Depends On","type":"array"},"max_retries":{"default":0,"maximum":1024,"minimum":0,"title":"Max Retries","type":"integer"},"retryable_failure_classes":{"items":{"$ref":"#/$defs/ParticipantFailureClass"},"maxItems":32,"title":"Retryable Failure Classes","type":"array"},"weight":{"maximum":1000000000,"minimum":1,"title":"Weight","type":"integer"}},"required":["action_ref","weight"],"title":"ParticipantActivityActionCandidate","type":"object"}, "ParticipantActivityTiming": {"additionalProperties":false,"description":"Inclusive bounded interval for the next occurrence on the shared clock.","properties":{"maximum_ticks":{"maximum":1000000000,"minimum":1,"title":"Maximum Ticks","type":"integer"},"minimum_ticks":{"maximum":1000000000,"minimum":1,"title":"Minimum Ticks","type":"integer"}},"required":["minimum_ticks","maximum_ticks"],"title":"ParticipantActivityTiming","type":"object"}, - "ParticipantAutonomousExecutionPolicyV1": {"additionalProperties":false,"description":"Fixed-cadence deterministic scheduler binding.","properties":{"action_order":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Action Order","type":"array"},"clock_ref":{"$ref":"#/$defs/_r142"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_in_flight":{"$ref":"#/$defs/_r86"},"observation_boundary_ref":{"$ref":"#/$defs/_r143"},"participant_implementation_ref":{"$ref":"#/$defs/_r144"},"profile":{"const":"participant-autonomous-execution/v1","default":"participant-autonomous-execution/v1","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r145"},"selection_strategy":{"const":"ordered_cycle","default":"ordered_cycle","title":"Selection Strategy","type":"string"},"temporal_constraint_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Temporal Constraint Refs","type":"array"}},"required":["participant_implementation_ref","clock_ref","progression_policy_ref","temporal_constraint_refs","action_order","observation_boundary_ref","max_action_attempts","evaluation_authority"],"title":"ParticipantAutonomousExecutionPolicyV1","type":"object"}, - "ParticipantAutonomousExecutionPolicyV2": {"additionalProperties":false,"description":"Governed within-run activity policy for ordinary participants.","properties":{"action_candidates":{"$ref":"#/$defs/_r139"},"clock_ref":{"$ref":"#/$defs/_r142"},"empty_eligible_disposition":{"$ref":"#/$defs/_r88"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_burst_size":{"$ref":"#/$defs/_r85"},"max_in_flight":{"$ref":"#/$defs/_r86"},"max_occurrences":{"maximum":1000000,"minimum":1,"title":"Max Occurrences","type":"integer"},"observation_boundary_ref":{"$ref":"#/$defs/_r143"},"outside_window_disposition":{"$ref":"#/$defs/_r89"},"participant_implementation_ref":{"$ref":"#/$defs/_r144"},"pause_window_refs":{"$ref":"#/$defs/_r94"},"profile":{"const":"participant-autonomous-execution/v2","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r145"},"selection_strategy":{"const":"weighted","title":"Selection Strategy","type":"string"},"stochastic_control_ref":{"$ref":"#/$defs/_r146"},"timing":{"$ref":"#/$defs/ParticipantActivityTiming"},"work_window_refs":{"$ref":"#/$defs/_r93"}},"required":["profile","participant_implementation_ref","clock_ref","progression_policy_ref","work_window_refs","observation_boundary_ref","stochastic_control_ref","selection_strategy","timing","outside_window_disposition","empty_eligible_disposition","action_candidates","max_occurrences","max_action_attempts","evaluation_authority"],"title":"ParticipantAutonomousExecutionPolicyV2","type":"object"}, - "ParticipantAutonomousExecutionPolicyV3": {"additionalProperties":false,"description":"V2 activity plus scoped multi-resource governance.","properties":{"action_candidates":{"$ref":"#/$defs/_r139"},"clock_ref":{"$ref":"#/$defs/_r142"},"empty_eligible_disposition":{"$ref":"#/$defs/_r88"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_burst_size":{"$ref":"#/$defs/_r85"},"max_in_flight":{"$ref":"#/$defs/_r86"},"max_occurrences":{"maximum":1000000,"minimum":1,"title":"Max Occurrences","type":"integer"},"observation_boundary_ref":{"$ref":"#/$defs/_r143"},"outside_window_disposition":{"$ref":"#/$defs/_r89"},"participant_implementation_ref":{"$ref":"#/$defs/_r144"},"pause_window_refs":{"$ref":"#/$defs/_r94"},"profile":{"const":"participant-autonomous-execution/v3","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r145"},"resource_budget":{"$ref":"#/$defs/ParticipantResourceBudgetPolicy"},"selection_strategy":{"const":"weighted","title":"Selection Strategy","type":"string"},"stochastic_control_ref":{"$ref":"#/$defs/_r146"},"timing":{"$ref":"#/$defs/ParticipantActivityTiming"},"work_window_refs":{"$ref":"#/$defs/_r93"}},"required":["profile","participant_implementation_ref","clock_ref","progression_policy_ref","work_window_refs","observation_boundary_ref","stochastic_control_ref","selection_strategy","timing","outside_window_disposition","empty_eligible_disposition","action_candidates","max_occurrences","max_action_attempts","evaluation_authority","resource_budget"],"title":"ParticipantAutonomousExecutionPolicyV3","type":"object"}, + "ParticipantAutonomousExecutionPolicyV1": {"additionalProperties":false,"description":"Fixed-cadence deterministic scheduler binding.","properties":{"action_order":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Action Order","type":"array"},"clock_ref":{"$ref":"#/$defs/_r145"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_in_flight":{"$ref":"#/$defs/_r86"},"observation_boundary_ref":{"$ref":"#/$defs/_r146"},"participant_implementation_ref":{"$ref":"#/$defs/_r147"},"profile":{"const":"participant-autonomous-execution/v1","default":"participant-autonomous-execution/v1","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r148"},"selection_strategy":{"const":"ordered_cycle","default":"ordered_cycle","title":"Selection Strategy","type":"string"},"temporal_constraint_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Temporal Constraint Refs","type":"array"}},"required":["participant_implementation_ref","clock_ref","progression_policy_ref","temporal_constraint_refs","action_order","observation_boundary_ref","max_action_attempts","evaluation_authority"],"title":"ParticipantAutonomousExecutionPolicyV1","type":"object"}, + "ParticipantAutonomousExecutionPolicyV2": {"additionalProperties":false,"description":"Governed within-run activity policy for ordinary participants.","properties":{"action_candidates":{"$ref":"#/$defs/_r142"},"clock_ref":{"$ref":"#/$defs/_r145"},"empty_eligible_disposition":{"$ref":"#/$defs/_r88"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_burst_size":{"$ref":"#/$defs/_r85"},"max_in_flight":{"$ref":"#/$defs/_r86"},"max_occurrences":{"maximum":1000000,"minimum":1,"title":"Max Occurrences","type":"integer"},"observation_boundary_ref":{"$ref":"#/$defs/_r146"},"outside_window_disposition":{"$ref":"#/$defs/_r89"},"participant_implementation_ref":{"$ref":"#/$defs/_r147"},"pause_window_refs":{"$ref":"#/$defs/_r97"},"profile":{"const":"participant-autonomous-execution/v2","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r148"},"selection_strategy":{"const":"weighted","title":"Selection Strategy","type":"string"},"stochastic_control_ref":{"$ref":"#/$defs/_r149"},"timing":{"$ref":"#/$defs/ParticipantActivityTiming"},"work_window_refs":{"$ref":"#/$defs/_r96"}},"required":["profile","participant_implementation_ref","clock_ref","progression_policy_ref","work_window_refs","observation_boundary_ref","stochastic_control_ref","selection_strategy","timing","outside_window_disposition","empty_eligible_disposition","action_candidates","max_occurrences","max_action_attempts","evaluation_authority"],"title":"ParticipantAutonomousExecutionPolicyV2","type":"object"}, + "ParticipantAutonomousExecutionPolicyV3": {"additionalProperties":false,"description":"V2 activity plus scoped multi-resource governance.","properties":{"action_candidates":{"$ref":"#/$defs/_r142"},"clock_ref":{"$ref":"#/$defs/_r145"},"empty_eligible_disposition":{"$ref":"#/$defs/_r88"},"evaluation_authority":{"$ref":"#/$defs/ParticipantEvaluationAuthority"},"failure_policy":{"$ref":"#/$defs/ParticipantExecutionFailurePolicy","default":"stop"},"max_action_attempts":{"maximum":1000000,"minimum":1,"title":"Max Action Attempts","type":"integer"},"max_burst_size":{"$ref":"#/$defs/_r85"},"max_in_flight":{"$ref":"#/$defs/_r86"},"max_occurrences":{"maximum":1000000,"minimum":1,"title":"Max Occurrences","type":"integer"},"observation_boundary_ref":{"$ref":"#/$defs/_r146"},"outside_window_disposition":{"$ref":"#/$defs/_r89"},"participant_implementation_ref":{"$ref":"#/$defs/_r147"},"pause_window_refs":{"$ref":"#/$defs/_r97"},"profile":{"const":"participant-autonomous-execution/v3","title":"Profile","type":"string"},"progression_policy_ref":{"$ref":"#/$defs/_r148"},"resource_budget":{"$ref":"#/$defs/ParticipantResourceBudgetPolicy"},"selection_strategy":{"const":"weighted","title":"Selection Strategy","type":"string"},"stochastic_control_ref":{"$ref":"#/$defs/_r149"},"timing":{"$ref":"#/$defs/ParticipantActivityTiming"},"work_window_refs":{"$ref":"#/$defs/_r96"}},"required":["profile","participant_implementation_ref","clock_ref","progression_policy_ref","work_window_refs","observation_boundary_ref","stochastic_control_ref","selection_strategy","timing","outside_window_disposition","empty_eligible_disposition","action_candidates","max_occurrences","max_action_attempts","evaluation_authority","resource_budget"],"title":"ParticipantAutonomousExecutionPolicyV3","type":"object"}, "ParticipantBackendFailureMapping": {"additionalProperties":false,"description":"Mapping from a backend diagnostic code to a portable SEM-211 failure.","properties":{"backend_error_code":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Backend Error Code","type":"string"},"diagnostic":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Diagnostic","type":"string"},"failure_class":{"$ref":"#/$defs/ParticipantFailureClass"}},"required":["backend_error_code","failure_class","diagnostic"],"title":"ParticipantBackendFailureMapping","type":"object"}, - "ParticipantBackendTimingDisclosure": {"additionalProperties":false,"description":"Backend timing realization disclosure for SEM-213 contracts.","properties":{"affected_temporal_ids":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Affected Temporal Ids","type":"array"},"description":{"$ref":"#/$defs/_r172"},"disclosure_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Disclosure Id","type":"string"},"disclosure_kind":{"$ref":"#/$defs/ParticipantBackendTimingDisclosureKind"},"limitations":{"$ref":"#/$defs/_r123"},"support_mode":{"$ref":"#/$defs/ParticipantTemporalSupportMode"}},"required":["disclosure_id","disclosure_kind","support_mode","description","affected_temporal_ids"],"title":"ParticipantBackendTimingDisclosure","type":"object"}, + "ParticipantBackendTimingDisclosure": {"additionalProperties":false,"description":"Backend timing realization disclosure for SEM-213 contracts.","properties":{"affected_temporal_ids":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Affected Temporal Ids","type":"array"},"description":{"$ref":"#/$defs/_r175"},"disclosure_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Disclosure Id","type":"string"},"disclosure_kind":{"$ref":"#/$defs/ParticipantBackendTimingDisclosureKind"},"limitations":{"$ref":"#/$defs/_r126"},"support_mode":{"$ref":"#/$defs/ParticipantTemporalSupportMode"}},"required":["disclosure_id","disclosure_kind","support_mode","description","affected_temporal_ids"],"title":"ParticipantBackendTimingDisclosure","type":"object"}, "ParticipantBackendTimingDisclosureKind": {"description":"Backend timing realization disclosures.","enum":["pacing","dilation","synchronization","serialization","unsupported_guarantee"],"title":"ParticipantBackendTimingDisclosureKind","type":"string"}, - "ParticipantBehaviorSpecification": {"additionalProperties":false,"description":"First-class authored aggregate over participant behavior surfaces.","properties":{"action_contract_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Action Contract Refs","type":"array"},"authority_scope_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Authority Scope Refs","type":"array"},"autonomous_execution":{"anyOf":[{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV1"},{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV2"},{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV3"},{"type":"null"}],"default":null,"title":"Autonomous Execution"},"backend_feature_support_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Backend Feature Support Refs","type":"array"},"behavior_mode":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Behavior Mode"},"evidence_contract_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Evidence Contract Refs","type":"array"},"extension_policy":{"default":"governed-extension","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Extension Policy","type":"string"},"extensions":{"additionalProperties":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"title":"Extensions","type":"object"},"lifecycle_state":{"$ref":"#/$defs/ParticipantBehaviorSpecificationLifecycle","default":"active"},"mixed_control":{"anyOf":[{"$ref":"#/$defs/MixedControlParticipantOperation"},{"type":"null"}],"default":null},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Observation Boundary Refs","type":"array"},"outcome_interpretation_rule_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Outcome Interpretation Rule Refs","type":"array"},"participant_inject_deliveries":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantInjectDelivery"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Participant Inject Deliveries","type":"object"},"participant_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Participant Refs","type":"array"},"participant_role_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Participant Role Refs","type":"array"},"realization_profile_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Realization Profile Ref"},"semantic_version":{"$ref":"#/$defs/_r182"},"tool_affordances":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantToolAffordance"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Tool Affordances","type":"object"}},"required":["semantic_version"],"title":"ParticipantBehaviorSpecification","type":"object"}, + "ParticipantBehaviorSpecification": {"additionalProperties":false,"description":"First-class authored aggregate over participant behavior surfaces.","properties":{"action_contract_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Action Contract Refs","type":"array"},"authority_scope_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Authority Scope Refs","type":"array"},"autonomous_execution":{"anyOf":[{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV1"},{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV2"},{"$ref":"#/$defs/ParticipantAutonomousExecutionPolicyV3"},{"type":"null"}],"default":null,"title":"Autonomous Execution"},"backend_feature_support_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Backend Feature Support Refs","type":"array"},"behavior_mode":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Behavior Mode"},"episode_policy":{"anyOf":[{"$ref":"#/$defs/ParticipantEpisodePolicy"},{"type":"null"}],"default":null},"evidence_contract_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Evidence Contract Refs","type":"array"},"extension_policy":{"default":"governed-extension","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Extension Policy","type":"string"},"extensions":{"additionalProperties":{"$ref":"#/$defs/BehaviorSpecificationExtensionValue"},"title":"Extensions","type":"object"},"lifecycle_state":{"$ref":"#/$defs/ParticipantBehaviorSpecificationLifecycle","default":"active"},"mixed_control":{"anyOf":[{"$ref":"#/$defs/MixedControlParticipantOperation"},{"type":"null"}],"default":null},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Observation Boundary Refs","type":"array"},"outcome_interpretation_rule_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Outcome Interpretation Rule Refs","type":"array"},"participant_inject_deliveries":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantInjectDelivery"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Participant Inject Deliveries","type":"object"},"participant_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Participant Refs","type":"array"},"participant_role_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Participant Role Refs","type":"array"},"realization_profile_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Realization Profile Ref"},"semantic_version":{"$ref":"#/$defs/_r185"},"tool_affordances":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantToolAffordance"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Tool Affordances","type":"object"}},"required":["semantic_version"],"title":"ParticipantBehaviorSpecification","type":"object"}, "ParticipantBehaviorSpecificationLifecycle": {"description":"Governance lifecycle for participant behavior specifications.","enum":["draft","active","deprecated"],"title":"ParticipantBehaviorSpecificationLifecycle","type":"string"}, "ParticipantEffectClass": {"description":"SEM-211 effect classes for participant action results.","enum":["intended_effect","side_effect","observation_effect","visibility_effect","detection_effect","evidence_effect","no_effect","unknown_effect"],"title":"ParticipantEffectClass","type":"string"}, - "ParticipantEvaluationAuthority": {"additionalProperties":false,"description":"Explicit evaluator-plane authority kept separate from participant actions.","properties":{"mode":{"$ref":"#/$defs/ParticipantEvaluationAuthorityMode"},"objective_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Objective Refs","type":"array"},"proof_producer_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Proof Producer Refs","type":"array"},"receipt_authority_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Receipt Authority Refs","type":"array"},"score_authority_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Score Authority Refs","type":"array"}},"required":["mode"],"title":"ParticipantEvaluationAuthority","type":"object"}, + "ParticipantEpisodeCompletionCondition": {"additionalProperties":false,"description":"Evidenced assertions that end the episode as completed.","properties":{"assertion_refs":{"$ref":"#/$defs/_r94"},"evidence_requirement_refs":{"$ref":"#/$defs/_r95"},"terminal_reason":{"const":"completed","title":"Terminal Reason","type":"string"}},"required":["terminal_reason","assertion_refs","evidence_requirement_refs"],"title":"ParticipantEpisodeCompletionCondition","type":"object"}, + "ParticipantEpisodeInitialization": {"additionalProperties":false,"description":"Preconditions of every new episode generation.","properties":{"assertion_refs":{"$ref":"#/$defs/_r94"}},"required":["assertion_refs"],"title":"ParticipantEpisodeInitialization","type":"object"}, + "ParticipantEpisodeInteractionStructure": {"additionalProperties":false,"description":"Turn order authority and the actions a turn offers.","properties":{"action_contract_refs":{"$ref":"#/$defs/_r93"},"order_basis":{"$ref":"#/$defs/ParticipantEpisodeTurnOrderBasis"}},"required":["order_basis","action_contract_refs"],"title":"ParticipantEpisodeInteractionStructure","type":"object"}, + "ParticipantEpisodeMemoryScope": {"description":"ADR-095 participant-memory scope across a reset.","enum":["episode_local_reset","persistent_across_episodes"],"title":"ParticipantEpisodeMemoryScope","type":"string"}, + "ParticipantEpisodePolicy": {"additionalProperties":false,"description":"Versioned episode structure intent of a behavior specification.","properties":{"initialization":{"anyOf":[{"$ref":"#/$defs/ParticipantEpisodeInitialization"},{"type":"null"}],"default":null},"interaction_structure":{"anyOf":[{"$ref":"#/$defs/ParticipantEpisodeInteractionStructure"},{"type":"null"}],"default":null},"profile":{"const":"participant-episode-policy/v1","title":"Profile","type":"string"},"reset_policy":{"anyOf":[{"$ref":"#/$defs/ParticipantEpisodeResetPolicy"},{"type":"null"}],"default":null},"terminal_conditions":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"discriminator":{"mapping":{"completed":"#/$defs/ParticipantEpisodeCompletionCondition","timed_out":"#/$defs/ParticipantEpisodeTimeoutCondition"},"propertyName":"terminal_reason"},"oneOf":[{"$ref":"#/$defs/ParticipantEpisodeCompletionCondition"},{"$ref":"#/$defs/ParticipantEpisodeTimeoutCondition"}]}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Terminal Conditions","type":"object"},"truncation_conditions":{"additionalProperties":false,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantEpisodeTruncationCondition"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Truncation Conditions","type":"object"}},"required":["profile"],"title":"ParticipantEpisodePolicy","type":"object"}, + "ParticipantEpisodeResetAction": {"description":"ADR-013 control actions that start a later episode.","enum":["reset","restart"],"title":"ParticipantEpisodeResetAction","type":"string"}, + "ParticipantEpisodeResetPolicy": {"additionalProperties":false,"allOf":[{"else":{"properties":{"memory_reset_authority_ref":{"type":"null"}}},"if":{"properties":{"participant_memory_scope":{"const":"episode_local_reset"}}},"then":{"properties":{"memory_reset_authority_ref":{"type":"string"}},"required":["memory_reset_authority_ref"]}}],"description":"Admitted reset actions, memory scope, reset authority, and evidence.","properties":{"control_actions":{"items":{"$ref":"#/$defs/ParticipantEpisodeResetAction"},"minItems":1,"title":"Control Actions","type":"array","uniqueItems":true},"evidence_requirement_refs":{"$ref":"#/$defs/_r95"},"memory_reset_authority_ref":{"anyOf":[{"$ref":"#/$defs/_r143"},{"type":"null"}],"default":null,"title":"Memory Reset Authority Ref"},"participant_memory_scope":{"$ref":"#/$defs/ParticipantEpisodeMemoryScope"}},"required":["control_actions","participant_memory_scope","evidence_requirement_refs"],"title":"ParticipantEpisodeResetPolicy","type":"object"}, + "ParticipantEpisodeTimeoutCondition": {"additionalProperties":false,"description":"Evidenced clock limit that ends the episode as timed out.","properties":{"evidence_requirement_refs":{"$ref":"#/$defs/_r95"},"temporal_constraint_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","title":"Temporal Constraint Ref","type":"string"},"terminal_reason":{"const":"timed_out","title":"Terminal Reason","type":"string"}},"required":["terminal_reason","temporal_constraint_ref","evidence_requirement_refs"],"title":"ParticipantEpisodeTimeoutCondition","type":"object"}, + "ParticipantEpisodeTruncationCondition": {"additionalProperties":false,"description":"Evidenced assertions that end the episode as truncated.","properties":{"assertion_refs":{"$ref":"#/$defs/_r94"},"evidence_requirement_refs":{"$ref":"#/$defs/_r95"}},"required":["assertion_refs","evidence_requirement_refs"],"title":"ParticipantEpisodeTruncationCondition","type":"object"}, + "ParticipantEpisodeTurnOrderBasis": {"description":"Authority that orders a participant's turns.","enum":["decision-epoch"],"title":"ParticipantEpisodeTurnOrderBasis","type":"string"}, + "ParticipantEvaluationAuthority": {"additionalProperties":false,"description":"Explicit evaluator-plane authority kept separate from participant actions.","properties":{"mode":{"$ref":"#/$defs/ParticipantEvaluationAuthorityMode"},"objective_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Objective Refs","type":"array"},"proof_producer_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Proof Producer Refs","type":"array"},"receipt_authority_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Receipt Authority Refs","type":"array"},"score_authority_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Score Authority Refs","type":"array"}},"required":["mode"],"title":"ParticipantEvaluationAuthority","type":"object"}, "ParticipantEvaluationAuthorityMode": {"description":"Whether a participant may contribute to evaluator-plane authority.","enum":["none","declared"],"title":"ParticipantEvaluationAuthorityMode","type":"string"}, "ParticipantExecutionFailurePolicy": {"description":"Disposition after a native participant action fails.","enum":["continue","stop"],"title":"ParticipantExecutionFailurePolicy","type":"string"}, "ParticipantFailureClass": {"description":"SEM-211 portable failure classes for participant action attempts.","enum":["precondition_unsatisfied","unsupported_action","target_unavailable","authority_denied","resource_exhausted","timeout","interrupted","contention_lost","partial_success","unsafe_withheld","backend_error","unknown"],"title":"ParticipantFailureClass","type":"string"}, "ParticipantInformationBoundaryClass": {"description":"SEM-210 classes for participant information-boundary objects.","enum":["observable_resource","telemetry_stream","tool_output","instruction","public_task_statement","starter_file","scaffold_instruction","subtask_guidance","hidden_truth","private_answer_key","canary","holdout_variant","adjudication_material","archival_evidence"],"title":"ParticipantInformationBoundaryClass","type":"string"}, - "ParticipantInjectDelivery": {"additionalProperties":false,"description":"Authored participant-local relation to one orchestration inject occurrence.","properties":{"control_authority_scope_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Control Authority Scope Refs","type":"array","uniqueItems":true},"control_effective_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Effective Order"},"control_evidence_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Control Evidence Refs","type":"array","uniqueItems":true},"control_transition_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Control Transition Ref"},"control_valid_from_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Valid From Order"},"control_valid_until_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Valid Until Order"},"controller_ref":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Controller Ref"},"delivery_kind":{"$ref":"#/$defs/ParticipantInjectDeliveryKind"},"delivery_policy":{"$ref":"#/$defs/ParticipantInjectDeliveryPolicy"},"evidence_requirement_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Evidence Requirement Refs","type":"array","uniqueItems":true},"failure_disposition":{"$ref":"#/$defs/ParticipantInjectDeliveryFailureDisposition"},"inject_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Inject Ref","type":"string"},"observation_boundary_ref":{"$ref":"#/$defs/_r143"},"occurrence":{"$ref":"#/$defs/ParticipantInjectOccurrenceAnchor"},"order_basis":{"$ref":"#/$defs/ParticipantInjectDeliveryOrderBasis"},"participant_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Ref","type":"string"},"result_item_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Result Item Ref","type":"string"},"source_item_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Item Ref","type":"string"},"temporal_constraint_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Temporal Constraint Refs","type":"array","uniqueItems":true}},"required":["participant_ref","inject_ref","occurrence","source_item_ref","result_item_ref","observation_boundary_ref","delivery_kind","delivery_policy","order_basis","temporal_constraint_refs","evidence_requirement_refs","failure_disposition"],"title":"ParticipantInjectDelivery","type":"object"}, + "ParticipantInjectDelivery": {"additionalProperties":false,"description":"Authored participant-local relation to one orchestration inject occurrence.","properties":{"control_authority_scope_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Control Authority Scope Refs","type":"array","uniqueItems":true},"control_effective_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Effective Order"},"control_evidence_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Control Evidence Refs","type":"array","uniqueItems":true},"control_transition_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Control Transition Ref"},"control_valid_from_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Valid From Order"},"control_valid_until_order":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Control Valid Until Order"},"controller_ref":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Controller Ref"},"delivery_kind":{"$ref":"#/$defs/ParticipantInjectDeliveryKind"},"delivery_policy":{"$ref":"#/$defs/ParticipantInjectDeliveryPolicy"},"evidence_requirement_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Evidence Requirement Refs","type":"array","uniqueItems":true},"failure_disposition":{"$ref":"#/$defs/ParticipantInjectDeliveryFailureDisposition"},"inject_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Inject Ref","type":"string"},"observation_boundary_ref":{"$ref":"#/$defs/_r146"},"occurrence":{"$ref":"#/$defs/ParticipantInjectOccurrenceAnchor"},"order_basis":{"$ref":"#/$defs/ParticipantInjectDeliveryOrderBasis"},"participant_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Ref","type":"string"},"result_item_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Result Item Ref","type":"string"},"source_item_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Item Ref","type":"string"},"temporal_constraint_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Temporal Constraint Refs","type":"array","uniqueItems":true}},"required":["participant_ref","inject_ref","occurrence","source_item_ref","result_item_ref","observation_boundary_ref","delivery_kind","delivery_policy","order_basis","temporal_constraint_refs","evidence_requirement_refs","failure_disposition"],"title":"ParticipantInjectDelivery","type":"object"}, "ParticipantInjectDeliveryFailureDisposition": {"description":"Fail-closed behavior when a declared delivery cannot be admitted.","enum":["reject-no-delivery"],"title":"ParticipantInjectDeliveryFailureDisposition","type":"string"}, "ParticipantInjectDeliveryKind": {"description":"Participant-bound meaning kept distinct from orchestration identity.","enum":["disclosure","external-direction","intervention"],"title":"ParticipantInjectDeliveryKind","type":"string"}, "ParticipantInjectDeliveryOrderBasis": {"description":"The only admitted ordering basis for participant inject delivery.","enum":["orchestration-occurrence-and-shared-time"],"title":"ParticipantInjectDeliveryOrderBasis","type":"string"}, "ParticipantInjectDeliveryPolicy": {"additionalProperties":false,"description":"Closed, reference-led participant disclosure policy coordinates.","properties":{"audience_scope_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Audience Scope Ref","type":"string"},"disclosure_basis_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Disclosure Basis Ref","type":"string"},"exposure_policy_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Exposure Policy Ref","type":"string"},"policy_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Ref","type":"string"},"policy_revision":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Revision","type":"string"},"visibility_basis_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Visibility Basis Ref","type":"string"}},"required":["policy_ref","policy_revision","exposure_policy_ref","audience_scope_ref","visibility_basis_ref","disclosure_basis_ref"],"title":"ParticipantInjectDeliveryPolicy","type":"object"}, "ParticipantInjectOccurrenceAnchor": {"additionalProperties":false,"description":"Exact inject occurrence in the existing event/script/story chain.","properties":{"event_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Event Ref","type":"string"},"script_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Script Ref","type":"string"},"story_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Story Ref","type":"string"}},"required":["event_ref","script_ref","story_ref"],"title":"ParticipantInjectOccurrenceAnchor","type":"object"}, "ParticipantInteractionClass": {"description":"SEM-209 interaction classes for multi-participant behavior.","enum":["coordination","contention","interference","shared_state_change"],"title":"ParticipantInteractionClass","type":"string"}, - "ParticipantInteractionDeclaration": {"additionalProperties":false,"description":"Declared interaction semantics for a participant action contract.","properties":{"commutative":{"default":false,"title":"Commutative","type":"boolean"},"interaction_class":{"$ref":"#/$defs/ParticipantInteractionClass"},"merge_rule_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Merge Rule Ref"},"rationale":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rationale","type":"string"},"related_actions":{"items":{"$ref":"#/$defs/_r187"},"title":"Related Actions","type":"array"},"shared_state_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Shared State Refs","type":"array"},"target":{"$ref":"#/$defs/_r184"}},"required":["interaction_class","target","rationale"],"title":"ParticipantInteractionDeclaration","type":"object"}, - "ParticipantInteractiveAccess": {"additionalProperties":false,"description":"One authored participant-to-compute-node interactive-access binding.\n\nThis record carries portable intent only. It is not a host locator, port,\ncredential, portal session, listener observation, or realization claim.","properties":{"account_ref":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Account Ref"},"channel":{"anyOf":[{"$ref":"#/$defs/ParticipantInteractiveAccessChannel"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Channel"},"target_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Ref","type":"string"}},"required":["target_ref","channel"],"title":"ParticipantInteractiveAccess","type":"object"}, + "ParticipantInteractionDeclaration": {"additionalProperties":false,"description":"Declared interaction semantics for a participant action contract.","properties":{"commutative":{"default":false,"title":"Commutative","type":"boolean"},"interaction_class":{"$ref":"#/$defs/ParticipantInteractionClass"},"merge_rule_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Merge Rule Ref"},"rationale":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rationale","type":"string"},"related_actions":{"items":{"$ref":"#/$defs/_r190"},"title":"Related Actions","type":"array"},"shared_state_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Shared State Refs","type":"array"},"target":{"$ref":"#/$defs/_r187"}},"required":["interaction_class","target","rationale"],"title":"ParticipantInteractionDeclaration","type":"object"}, + "ParticipantInteractiveAccess": {"additionalProperties":false,"description":"One authored participant-to-compute-node interactive-access binding.\n\nThis record carries portable intent only. It is not a host locator, port,\ncredential, portal session, listener observation, or realization claim.","properties":{"account_ref":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Account Ref"},"channel":{"anyOf":[{"$ref":"#/$defs/ParticipantInteractiveAccessChannel"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Channel"},"target_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Ref","type":"string"}},"required":["target_ref","channel"],"title":"ParticipantInteractiveAccess","type":"object"}, "ParticipantInteractiveAccessChannel": {"description":"Portable classes of authored participant interactive access.","enum":["ssh","rdp"],"title":"ParticipantInteractiveAccessChannel","type":"string"}, - "ParticipantObservationBoundary": {"additionalProperties":false,"description":"Participant-specific observation projection boundary.","properties":{"evidence_refs":{"$ref":"#/$defs/_r119"},"hidden_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Hidden Refs","type":"array"},"latency_profile":{"$ref":"#/$defs/_r174"},"observable_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Observable Refs","type":"array"},"observer_effects":{"items":{"$ref":"#/$defs/_r187"},"title":"Observer Effects","type":"array"},"projection_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Projection Basis","type":"string"},"realized_view_disclosure":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Realized View Disclosure"},"redaction_policy":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Redaction Policy","type":"string"},"view_rules":{"items":{"$ref":"#/$defs/ParticipantViewRule"},"title":"View Rules","type":"array"},"view_transitions":{"items":{"$ref":"#/$defs/ParticipantViewTransition"},"title":"View Transitions","type":"array"}},"required":["projection_basis","redaction_policy","latency_profile"],"title":"ParticipantObservationBoundary","type":"object"}, + "ParticipantObservationBoundary": {"additionalProperties":false,"description":"Participant-specific observation projection boundary.","properties":{"evidence_refs":{"$ref":"#/$defs/_r122"},"hidden_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Hidden Refs","type":"array"},"latency_profile":{"$ref":"#/$defs/_r177"},"observable_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Observable Refs","type":"array"},"observer_effects":{"items":{"$ref":"#/$defs/_r190"},"title":"Observer Effects","type":"array"},"projection_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Projection Basis","type":"string"},"realized_view_disclosure":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Realized View Disclosure"},"redaction_policy":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Redaction Policy","type":"string"},"view_rules":{"items":{"$ref":"#/$defs/ParticipantViewRule"},"title":"View Rules","type":"array"},"view_transitions":{"items":{"$ref":"#/$defs/ParticipantViewTransition"},"title":"View Transitions","type":"array"}},"required":["projection_basis","redaction_policy","latency_profile"],"title":"ParticipantObservationBoundary","type":"object"}, "ParticipantPreconditionClass": {"description":"SEM-211 precondition classes for participant action applicability.","enum":["authority","capability","target","knowledge","resource","temporal","interaction","realization"],"title":"ParticipantPreconditionClass","type":"string"}, - "ParticipantRelationship": {"additionalProperties":false,"description":"Directed authored intent; a declaration never grants operational rights.","if":{"properties":{"control_specification_ref":{"type":"string"}},"required":["control_specification_ref"]},"properties":{"authority_basis_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Authority Basis Refs","type":"array","uniqueItems":true},"behavior_specification_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Behavior Specification Refs","type":"array","uniqueItems":true},"control_specification_ref":{"anyOf":[{"$ref":"#/$defs/_r140"},{"type":"null"}],"default":null,"title":"Control Specification Ref"},"kind":{"$ref":"#/$defs/ParticipantRelationshipKind"},"objective_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Objective Refs","type":"array","uniqueItems":true},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Observation Boundary Refs","type":"array","uniqueItems":true},"scope_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Scope Refs","type":"array","uniqueItems":true},"source_action_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Source Action Refs","type":"array","uniqueItems":true},"target_action_refs":{"items":{"$ref":"#/$defs/_r140"},"title":"Target Action Refs","type":"array","uniqueItems":true}},"required":["kind"],"then":{"properties":{"kind":{"enum":["delegation","supervision"]}}},"title":"ParticipantRelationship","type":"object"}, + "ParticipantRelationship": {"additionalProperties":false,"description":"Directed authored intent; a declaration never grants operational rights.","if":{"properties":{"control_specification_ref":{"type":"string"}},"required":["control_specification_ref"]},"properties":{"authority_basis_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Authority Basis Refs","type":"array","uniqueItems":true},"behavior_specification_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Behavior Specification Refs","type":"array","uniqueItems":true},"control_specification_ref":{"anyOf":[{"$ref":"#/$defs/_r143"},{"type":"null"}],"default":null,"title":"Control Specification Ref"},"kind":{"$ref":"#/$defs/ParticipantRelationshipKind"},"objective_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Objective Refs","type":"array","uniqueItems":true},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Observation Boundary Refs","type":"array","uniqueItems":true},"scope_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Scope Refs","type":"array","uniqueItems":true},"source_action_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Source Action Refs","type":"array","uniqueItems":true},"target_action_refs":{"items":{"$ref":"#/$defs/_r143"},"title":"Target Action Refs","type":"array","uniqueItems":true}},"required":["kind"],"then":{"properties":{"kind":{"enum":["delegation","supervision"]}}},"title":"ParticipantRelationship","type":"object"}, "ParticipantRelationshipKind": {"description":"Portable relation meanings, independent of backend mechanisms.","enum":["coordination","delegation","cooperation","competition","supervision"],"title":"ParticipantRelationshipKind","type":"string"}, "ParticipantResourceAccountingMode": {"enum":["windowed_counter","cumulative_counter","reservable_gauge","growth_counter","lease"],"title":"ParticipantResourceAccountingMode","type":"string"}, - "ParticipantResourceBudgetDimension": {"additionalProperties":false,"properties":{"accounting_mode":{"$ref":"#/$defs/ParticipantResourceAccountingMode"},"evidence_refs":{"items":{"$ref":"#/$defs/_r187"},"maxItems":1024,"title":"Evidence Refs","type":"array"},"limit":{"maximum":1000000000000000000,"minimum":1,"title":"Limit","type":"integer"},"meter_profile_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Meter Profile Ref","type":"string"},"owner_ref":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Owner Ref","type":"string"},"parent_budget_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Parent Budget Ref"},"pool_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Pool Ref","type":"string"},"reservation":{"maximum":1000000000000000000,"minimum":1,"title":"Reservation","type":"integer"},"reset":{"$ref":"#/$defs/ParticipantResourceResetMode"},"resource_kind":{"anyOf":[{"$ref":"#/$defs/ParticipantResourceKind"},{"$ref":"#/$defs/DomainProfileCoordinateModel"}],"title":"Resource Kind"},"unit":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit","type":"string"},"window_ticks":{"anyOf":[{"maximum":1000000000,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Window Ticks"}},"required":["owner_ref","pool_ref","resource_kind","unit","accounting_mode","meter_profile_ref","limit","reservation","reset"],"title":"ParticipantResourceBudgetDimension","type":"object"}, - "ParticipantResourceBudgetPolicy": {"additionalProperties":false,"properties":{"dimensions":{"maxProperties":4096,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantResourceBudgetDimension"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Dimensions","type":"object"},"fairness":{"$ref":"#/$defs/ParticipantResourceFairness"},"owners":{"maxProperties":1024,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantResourceOwner"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Owners","type":"object"},"policy_id":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Policy Id","type":"string"}},"required":["policy_id","owners","fairness","dimensions"],"title":"ParticipantResourceBudgetPolicy","type":"object"}, + "ParticipantResourceBudgetDimension": {"additionalProperties":false,"properties":{"accounting_mode":{"$ref":"#/$defs/ParticipantResourceAccountingMode"},"evidence_refs":{"items":{"$ref":"#/$defs/_r190"},"maxItems":1024,"title":"Evidence Refs","type":"array"},"limit":{"maximum":1000000000000000000,"minimum":1,"title":"Limit","type":"integer"},"meter_profile_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Meter Profile Ref","type":"string"},"owner_ref":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Owner Ref","type":"string"},"parent_budget_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Parent Budget Ref"},"pool_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Pool Ref","type":"string"},"reservation":{"maximum":1000000000000000000,"minimum":1,"title":"Reservation","type":"integer"},"reset":{"$ref":"#/$defs/ParticipantResourceResetMode"},"resource_kind":{"anyOf":[{"$ref":"#/$defs/ParticipantResourceKind"},{"$ref":"#/$defs/DomainProfileCoordinateModel"}],"title":"Resource Kind"},"unit":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit","type":"string"},"window_ticks":{"anyOf":[{"maximum":1000000000,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Window Ticks"}},"required":["owner_ref","pool_ref","resource_kind","unit","accounting_mode","meter_profile_ref","limit","reservation","reset"],"title":"ParticipantResourceBudgetDimension","type":"object"}, + "ParticipantResourceBudgetPolicy": {"additionalProperties":false,"properties":{"dimensions":{"maxProperties":4096,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantResourceBudgetDimension"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Dimensions","type":"object"},"fairness":{"$ref":"#/$defs/ParticipantResourceFairness"},"owners":{"maxProperties":1024,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantResourceOwner"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Owners","type":"object"},"policy_id":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Policy Id","type":"string"}},"required":["policy_id","owners","fairness","dimensions"],"title":"ParticipantResourceBudgetPolicy","type":"object"}, "ParticipantResourceFairness": {"additionalProperties":false,"properties":{"borrowing":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Borrowing","type":"string"},"max_queue_ticks":{"maximum":1000000000,"minimum":0,"title":"Max Queue Ticks","type":"integer"},"policy":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy","type":"string"},"priority_class":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Priority Class","type":"string"},"protected":{"title":"Protected","type":"boolean"},"reclaim":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Reclaim","type":"string"},"starvation_bound_ticks":{"maximum":1000000000,"minimum":1,"title":"Starvation Bound Ticks","type":"integer"},"weight":{"maximum":1000000,"minimum":1,"title":"Weight","type":"integer"}},"required":["policy","priority_class","weight","protected","borrowing","reclaim","max_queue_ticks","starvation_bound_ticks"],"title":"ParticipantResourceFairness","type":"object"}, "ParticipantResourceKind": {"enum":["action_rate","concurrent_actions","storage_growth","inference_tokens","image_generations","accelerator"],"title":"ParticipantResourceKind","type":"string"}, "ParticipantResourceOwner": {"additionalProperties":false,"properties":{"kind":{"$ref":"#/$defs/ParticipantResourceOwnerKind"},"ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ref","type":"string"}},"required":["kind","ref"],"title":"ParticipantResourceOwner","type":"object"}, "ParticipantResourceOwnerKind": {"enum":["participant","deployment_tenant","shared_service","fleet"],"title":"ParticipantResourceOwnerKind","type":"string"}, "ParticipantResourceResetMode": {"enum":["episode","time_segment","run","reconciled"],"title":"ParticipantResourceResetMode","type":"string"}, - "ParticipantSharedTimeBinding": {"additionalProperties":false,"description":"Explicit shared-time binding; legacy descriptive references stay opaque.","properties":{"clock_ref":{"$ref":"#/$defs/_r142"},"condition_precondition_id":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Condition Precondition Id"},"constraint_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Constraint Ref","type":"string"},"event_point":{"enum":["start","end","observed","effective"],"title":"Event Point","type":"string"},"evidence_mode":{"enum":["event","continuous"],"title":"Evidence Mode","type":"string"},"observation_boundary_ref":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Observation Boundary Ref"},"profile":{"const":"participant-shared-time/v1","title":"Profile","type":"string"}},"required":["profile","clock_ref","constraint_ref","event_point","evidence_mode"],"title":"ParticipantSharedTimeBinding","type":"object"}, - "ParticipantTemporalContract": {"additionalProperties":false,"description":"Typed SEM-213 temporal contract for a participant action.","properties":{"backend_disclosure_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Backend Disclosure Refs","type":"array"},"clock_authority":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Authority","type":"string"},"description":{"$ref":"#/$defs/_r172"},"duration_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Duration Ref"},"event_points":{"items":{"$ref":"#/$defs/ParticipantTemporalEventPoint"},"minItems":1,"title":"Event Points","type":"array"},"ordering_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ordering Basis","type":"string"},"randomization_basis":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Randomization Basis"},"replay_boundary":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Replay Boundary"},"reset_boundary":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Reset Boundary"},"shared_time_binding":{"anyOf":[{"$ref":"#/$defs/ParticipantSharedTimeBinding"},{"type":"null"}],"default":null},"temporal_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Temporal Id","type":"string"},"temporal_kind":{"$ref":"#/$defs/ParticipantTemporalContractKind"},"time_domain":{"$ref":"#/$defs/ParticipantTimeDomain"},"window_ref":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Window Ref"}},"required":["temporal_id","temporal_kind","time_domain","clock_authority","event_points","description","ordering_basis"],"title":"ParticipantTemporalContract","type":"object"}, + "ParticipantSharedTimeBinding": {"additionalProperties":false,"description":"Explicit shared-time binding; legacy descriptive references stay opaque.","properties":{"clock_ref":{"$ref":"#/$defs/_r145"},"condition_precondition_id":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Condition Precondition Id"},"constraint_ref":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Constraint Ref","type":"string"},"event_point":{"enum":["start","end","observed","effective"],"title":"Event Point","type":"string"},"evidence_mode":{"enum":["event","continuous"],"title":"Evidence Mode","type":"string"},"observation_boundary_ref":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Observation Boundary Ref"},"profile":{"const":"participant-shared-time/v1","title":"Profile","type":"string"}},"required":["profile","clock_ref","constraint_ref","event_point","evidence_mode"],"title":"ParticipantSharedTimeBinding","type":"object"}, + "ParticipantTemporalContract": {"additionalProperties":false,"description":"Typed SEM-213 temporal contract for a participant action.","properties":{"backend_disclosure_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Backend Disclosure Refs","type":"array"},"clock_authority":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Authority","type":"string"},"description":{"$ref":"#/$defs/_r175"},"duration_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Duration Ref"},"event_points":{"items":{"$ref":"#/$defs/ParticipantTemporalEventPoint"},"minItems":1,"title":"Event Points","type":"array"},"ordering_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ordering Basis","type":"string"},"randomization_basis":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Randomization Basis"},"replay_boundary":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Replay Boundary"},"reset_boundary":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Reset Boundary"},"shared_time_binding":{"anyOf":[{"$ref":"#/$defs/ParticipantSharedTimeBinding"},{"type":"null"}],"default":null},"temporal_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Temporal Id","type":"string"},"temporal_kind":{"$ref":"#/$defs/ParticipantTemporalContractKind"},"time_domain":{"$ref":"#/$defs/ParticipantTimeDomain"},"window_ref":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Window Ref"}},"required":["temporal_id","temporal_kind","time_domain","clock_authority","event_points","description","ordering_basis"],"title":"ParticipantTemporalContract","type":"object"}, "ParticipantTemporalContractKind": {"description":"SEM-213 temporal contract kinds.","enum":["schedule","cadence","deadline","dwell","latency","time_window","timeout","cooldown"],"title":"ParticipantTemporalContractKind","type":"string"}, "ParticipantTemporalEventPoint": {"description":"Named participant event points used by temporal contracts.","enum":["submit","start","end","observed","effective","deadline","window_open","window_close","reset","replay"],"title":"ParticipantTemporalEventPoint","type":"string"}, "ParticipantTemporalSupportMode": {"description":"How a backend supports a temporal guarantee.","enum":["exact","bounded","disclosed_limitation","unsupported"],"title":"ParticipantTemporalSupportMode","type":"string"}, "ParticipantTimeDomain": {"description":"Distinct SEM-213 time domains.","enum":["episode_step","scenario_time","simulation_time","backend_time","wall_clock_time"],"title":"ParticipantTimeDomain","type":"string"}, - "ParticipantToolAffordance": {"additionalProperties":false,"description":"Authored participant-local binding from tool identity to governed behavior.","properties":{"action_contract_refs":{"items":{"$ref":"#/$defs/_r140"},"minItems":1,"title":"Action Contract Refs","type":"array","uniqueItems":true},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r140"},"minItems":1,"title":"Observation Boundary Refs","type":"array","uniqueItems":true},"tool_ref":{"anyOf":[{"$ref":"#/$defs/_r148"},{"type":"null"}],"default":null,"title":"Tool Ref"}},"required":["action_contract_refs","observation_boundary_refs"],"title":"ParticipantToolAffordance","type":"object"}, + "ParticipantToolAffordance": {"additionalProperties":false,"description":"Authored participant-local binding from tool identity to governed behavior.","properties":{"action_contract_refs":{"$ref":"#/$defs/_r93"},"observation_boundary_refs":{"items":{"$ref":"#/$defs/_r143"},"minItems":1,"title":"Observation Boundary Refs","type":"array","uniqueItems":true},"tool_ref":{"anyOf":[{"$ref":"#/$defs/_r151"},{"type":"null"}],"default":null,"title":"Tool Ref"}},"required":["action_contract_refs","observation_boundary_refs"],"title":"ParticipantToolAffordance","type":"object"}, "ParticipantViewDisposition": {"description":"SEM-210 visibility disposition for one information object.","enum":["observable","hidden","evidence_only","discovered","inferred","disclosed","concealed","deceptive"],"title":"ParticipantViewDisposition","type":"string"}, "ParticipantViewHistoryEventType": {"description":"Behavior-history event that realizes a SEM-210 visibility transition.","enum":["action_attempted","state_transition_recorded","observation_emitted","episode_close"],"title":"ParticipantViewHistoryEventType","type":"string"}, - "ParticipantViewRule": {"additionalProperties":false,"description":"Visibility rule for one participant information-boundary object.","properties":{"boundary_class":{"$ref":"#/$defs/ParticipantInformationBoundaryClass"},"certainty":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Certainty"},"disclosure_rule":{"$ref":"#/$defs/_r24"},"disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"effective_from":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Effective From"},"evidence_refs":{"$ref":"#/$defs/_r119"},"information_ref":{"$ref":"#/$defs/_r173"},"latency_profile":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Latency Profile"},"realized_backend_disclosure":{"$ref":"#/$defs/_r25"},"visibility_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Visibility Basis","type":"string"}},"required":["information_ref","boundary_class","disposition","visibility_basis"],"title":"ParticipantViewRule","type":"object"}, - "ParticipantViewTransition": {"additionalProperties":false,"description":"Time-indexed SEM-210 transition over a participant view relation.","properties":{"action_instance_id":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Action Instance Id"},"certainty":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Certainty","type":"string"},"disclosure_rule":{"$ref":"#/$defs/_r24"},"effective_from":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Effective From","type":"string"},"effective_order":{"title":"Effective Order","type":"integer"},"evidence_refs":{"$ref":"#/$defs/_r119"},"from_disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"history_event_type":{"$ref":"#/$defs/ParticipantViewHistoryEventType"},"information_ref":{"$ref":"#/$defs/_r173"},"latency_profile":{"$ref":"#/$defs/_r174"},"realized_backend_disclosure":{"$ref":"#/$defs/_r25"},"to_disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"transition_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Transition Id","type":"string"},"transition_kind":{"$ref":"#/$defs/ParticipantViewTransitionKind"},"trigger":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trigger","type":"string"}},"required":["transition_id","transition_kind","information_ref","trigger","effective_from","effective_order","history_event_type","from_disposition","to_disposition","certainty","latency_profile"],"title":"ParticipantViewTransition","type":"object"}, + "ParticipantViewRule": {"additionalProperties":false,"description":"Visibility rule for one participant information-boundary object.","properties":{"boundary_class":{"$ref":"#/$defs/ParticipantInformationBoundaryClass"},"certainty":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Certainty"},"disclosure_rule":{"$ref":"#/$defs/_r24"},"disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"effective_from":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Effective From"},"evidence_refs":{"$ref":"#/$defs/_r122"},"information_ref":{"$ref":"#/$defs/_r176"},"latency_profile":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Latency Profile"},"realized_backend_disclosure":{"$ref":"#/$defs/_r25"},"visibility_basis":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Visibility Basis","type":"string"}},"required":["information_ref","boundary_class","disposition","visibility_basis"],"title":"ParticipantViewRule","type":"object"}, + "ParticipantViewTransition": {"additionalProperties":false,"description":"Time-indexed SEM-210 transition over a participant view relation.","properties":{"action_instance_id":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Action Instance Id"},"certainty":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Certainty","type":"string"},"disclosure_rule":{"$ref":"#/$defs/_r24"},"effective_from":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Effective From","type":"string"},"effective_order":{"title":"Effective Order","type":"integer"},"evidence_refs":{"$ref":"#/$defs/_r122"},"from_disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"history_event_type":{"$ref":"#/$defs/ParticipantViewHistoryEventType"},"information_ref":{"$ref":"#/$defs/_r176"},"latency_profile":{"$ref":"#/$defs/_r177"},"realized_backend_disclosure":{"$ref":"#/$defs/_r25"},"to_disposition":{"$ref":"#/$defs/ParticipantViewDisposition"},"transition_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Transition Id","type":"string"},"transition_kind":{"$ref":"#/$defs/ParticipantViewTransitionKind"},"trigger":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trigger","type":"string"}},"required":["transition_id","transition_kind","information_ref","trigger","effective_from","effective_order","history_event_type","from_disposition","to_disposition","certainty","latency_profile"],"title":"ParticipantViewTransition","type":"object"}, "ParticipantViewTransitionKind": {"description":"SEM-210 state transitions that alter participant visibility over time.","enum":["discovery","inference","concealment","disclosure","revocation","deception"],"title":"ParticipantViewTransitionKind","type":"string"}, "PasswordStrength": {"description":"How resistant the account password is to cracking.","enum":["weak","medium","strong","none"],"title":"PasswordStrength","type":"string"}, - "PersistentVolume": {"additionalProperties":false,"description":"Portable desired persistent storage and its mount consumers.","properties":{"access_mode":{"$ref":"#/$defs/VolumeAccessMode"},"consumers":{"items":{"$ref":"#/$defs/StatefulResourceConsumer"},"minItems":1,"title":"Consumers","type":"array","uniqueItems":true},"lifecycle":{"$ref":"#/$defs/VolumeLifecycle"},"ordering_dependencies":{"$ref":"#/$defs/_r126"},"refresh_dependencies":{"$ref":"#/$defs/_r127"}},"required":["lifecycle","access_mode","consumers"],"title":"PersistentVolume","type":"object"}, - "PresencePredicate": {"additionalProperties":false,"description":"Test whether a governed property is present on a subject.","properties":{"kind":{"const":"presence","default":"presence","title":"Kind","type":"string"},"operator":{"const":"exists","default":"exists","title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r137"},"semantic_ref":{"$ref":"#/$defs/_r133"}},"required":["property","semantic_ref"],"title":"PresencePredicate","type":"object"}, + "PersistentVolume": {"additionalProperties":false,"description":"Portable desired persistent storage and its mount consumers.","properties":{"access_mode":{"$ref":"#/$defs/VolumeAccessMode"},"consumers":{"items":{"$ref":"#/$defs/StatefulResourceConsumer"},"minItems":1,"title":"Consumers","type":"array","uniqueItems":true},"lifecycle":{"$ref":"#/$defs/VolumeLifecycle"},"ordering_dependencies":{"$ref":"#/$defs/_r129"},"refresh_dependencies":{"$ref":"#/$defs/_r130"}},"required":["lifecycle","access_mode","consumers"],"title":"PersistentVolume","type":"object"}, + "PresencePredicate": {"additionalProperties":false,"description":"Test whether a governed property is present on a subject.","properties":{"kind":{"const":"presence","default":"presence","title":"Kind","type":"string"},"operator":{"const":"exists","default":"exists","title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r140"},"semantic_ref":{"$ref":"#/$defs/_r136"}},"required":["property","semantic_ref"],"title":"PresencePredicate","type":"object"}, "ProcessResourceLimitKind": {"description":"Portable process-resource terms governed by the runtime contract.","enum":["open_file_descriptors","locked_memory_bytes"],"title":"ProcessResourceLimitKind","type":"string"}, "ProcessResourceLimitScope": {"description":"Process inheritance scope for a portable resource limit.","enum":["process","subtree"],"title":"ProcessResourceLimitScope","type":"string"}, - "Proposition": {"additionalProperties":false,"description":"A side-effect-free claim over a finite set of stable SDL subjects.","properties":{"basis":{"$ref":"#/$defs/PropositionBasis"},"description":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Description","type":"string"},"evidence_requirements":{"items":{"$ref":"#/$defs/_r187"},"title":"Evidence Requirements","type":"array"},"predicate":{"discriminator":{"mapping":{"boolean":"#/$defs/BooleanPredicate","number":"#/$defs/NumericPredicate","presence":"#/$defs/PresencePredicate","string":"#/$defs/StringPredicate"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/PresencePredicate"},{"$ref":"#/$defs/BooleanPredicate"},{"$ref":"#/$defs/StringPredicate"},{"$ref":"#/$defs/NumericPredicate"}],"title":"Predicate"},"quantifier":{"$ref":"#/$defs/SubjectQuantifier","default":"all"},"subjects":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Subjects","type":"array"},"threshold":{"$ref":"#/$defs/_r22"}},"required":["description","subjects","basis","predicate"],"title":"Proposition","type":"object"}, + "Proposition": {"additionalProperties":false,"description":"A side-effect-free claim over a finite set of stable SDL subjects.","properties":{"basis":{"$ref":"#/$defs/PropositionBasis"},"description":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Description","type":"string"},"evidence_requirements":{"items":{"$ref":"#/$defs/_r190"},"title":"Evidence Requirements","type":"array"},"predicate":{"discriminator":{"mapping":{"boolean":"#/$defs/BooleanPredicate","number":"#/$defs/NumericPredicate","presence":"#/$defs/PresencePredicate","string":"#/$defs/StringPredicate"},"propertyName":"kind"},"oneOf":[{"$ref":"#/$defs/PresencePredicate"},{"$ref":"#/$defs/BooleanPredicate"},{"$ref":"#/$defs/StringPredicate"},{"$ref":"#/$defs/NumericPredicate"}],"title":"Predicate"},"quantifier":{"$ref":"#/$defs/SubjectQuantifier","default":"all"},"subjects":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Subjects","type":"array"},"threshold":{"$ref":"#/$defs/_r22"}},"required":["description","subjects","basis","predicate"],"title":"Proposition","type":"object"}, "PropositionBasis": {"description":"Source of facts that may decide a proposition.","enum":["declared_state","observed_state"],"title":"PropositionBasis","type":"string"}, "RandomValueFormat": {"additionalProperties":false,"description":"Bounded literal wrapper placed around the random segment.\n\n``prefix`` and ``suffix`` are literal text (no control characters); the random\nsegment is inserted between them. The wrapper contributes no entropy.","properties":{"prefix":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Prefix","type":"string"},"suffix":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Suffix","type":"string"}},"title":"RandomValueFormat","type":"object"}, - "RandomValueRecipe": {"additionalProperties":false,"description":"Portable, value-free description of how a random value is generated.","properties":{"alphabet":{"anyOf":[{"$ref":"#/$defs/NamedAlphabet"},{"type":"null"}],"default":null},"custom_alphabet":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Custom Alphabet"},"entropy_bits":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Entropy Bits"},"format":{"anyOf":[{"$ref":"#/$defs/RandomValueFormat"},{"type":"null"}],"default":null},"length":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Length"},"min_entropy_bits":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Entropy Bits"}},"title":"RandomValueRecipe","type":"object"}, + "RandomValueRecipe": {"additionalProperties":false,"description":"Portable, value-free description of how a random value is generated.","properties":{"alphabet":{"anyOf":[{"$ref":"#/$defs/NamedAlphabet"},{"type":"null"}],"default":null},"custom_alphabet":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Custom Alphabet"},"entropy_bits":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Entropy Bits"},"format":{"anyOf":[{"$ref":"#/$defs/RandomValueFormat"},{"type":"null"}],"default":null},"length":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Length"},"min_entropy_bits":{"anyOf":[{"maximum":4096,"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Min Entropy Bits"}},"title":"RandomValueRecipe","type":"object"}, "RealizationPresence": {"description":"Whether the addressed member must, may, or must not exist.","enum":["required","optional","forbidden"],"title":"RealizationPresence","type":"string"}, - "Relationship": {"additionalProperties":false,"allOf":[{"else":{"properties":{"participant":{"type":"null"}}},"if":{"properties":{"type":{"const":"participant"}},"required":["type"]},"then":{"properties":{"carrier_placement":{"type":"null"},"database_access":{"type":"null"},"domain_controller":{"type":"null"},"domain_join":{"type":"null"},"forest_trust":{"type":"null"},"forwarding_edge":{"type":"null"},"identity_federation":{"type":"null"},"mail_access":{"type":"null"},"participant":{"type":"object"},"properties":{"maxProperties":0},"proxy_upstream":{"type":"null"},"service_integration":{"type":"null"},"shared_service":{"type":"null"}},"required":["participant"]}}],"description":"A typed directed edge between two named scenario elements.\n\nSource and target can reference any named element in the scenario:\nnodes, features, accounts, entities, or infrastructure entries.\nThe validator checks that both endpoints resolve.\n\nThe ``properties`` dict carries type-specific metadata (e.g.,\n``trust_type: parent-child`` for AD trusts, ``protocol: SAML``\nfor federation). It's a flat dict rather than typed sub-models\nbecause relationship properties vary widely and we don't want\nto gate expressiveness on pre-modeling every variant.\n\n``database_access`` and ``mail_access`` are typed exceptions where\nprotocol/auth details need structural validation rather than prose.\n``forwarding_edge``, ``service_integration``, and ``proxy_upstream`` are\nthe same kind of typed exception for, respectively, a forwarding /\nintel-sync agent's inter-node trust edge (SCN-010 \u00a75.7), a platform\nconsumer-to-engine service integration, and a reverse-proxy/gateway\nroute-to-origin upstream hop. Each keeps protocol/auth/topology facts\nstructurally validated and cross-referable rather than buried in prose.","properties":{"carrier_placement":{"anyOf":[{"$ref":"#/$defs/RelationshipCarrierPlacement"},{"type":"null"}],"default":null},"database_access":{"anyOf":[{"$ref":"#/$defs/RelationshipDatabaseAccess"},{"type":"null"}],"default":null},"description":{"$ref":"#/$defs/_r53"},"domain_controller":{"anyOf":[{"$ref":"#/$defs/RelationshipDomainController"},{"type":"null"}],"default":null},"domain_join":{"anyOf":[{"$ref":"#/$defs/RelationshipDomainJoin"},{"type":"null"}],"default":null},"forest_trust":{"anyOf":[{"$ref":"#/$defs/RelationshipForestTrust"},{"type":"null"}],"default":null},"forwarding_edge":{"anyOf":[{"$ref":"#/$defs/RelationshipForwardingEdge"},{"type":"null"}],"default":null},"identity_federation":{"anyOf":[{"$ref":"#/$defs/RelationshipIdentityFederation"},{"type":"null"}],"default":null},"mail_access":{"anyOf":[{"$ref":"#/$defs/RelationshipMailAccess"},{"type":"null"}],"default":null},"participant":{"anyOf":[{"$ref":"#/$defs/ParticipantRelationship"},{"type":"null"}],"default":null},"properties":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Properties","type":"object"},"proxy_upstream":{"anyOf":[{"$ref":"#/$defs/RelationshipProxyUpstream"},{"type":"null"}],"default":null},"service_integration":{"anyOf":[{"$ref":"#/$defs/RelationshipServiceIntegration"},{"type":"null"}],"default":null},"shared_service":{"anyOf":[{"$ref":"#/$defs/RelationshipSharedService"},{"type":"null"}],"default":null},"source":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source","type":"string"},"target":{"$ref":"#/$defs/_r184"},"type":{"$ref":"#/$defs/RelationshipType"}},"required":["type","source","target"],"title":"Relationship","type":"object"}, + "Relationship": {"additionalProperties":false,"allOf":[{"else":{"properties":{"participant":{"type":"null"}}},"if":{"properties":{"type":{"const":"participant"}},"required":["type"]},"then":{"properties":{"carrier_placement":{"type":"null"},"database_access":{"type":"null"},"domain_controller":{"type":"null"},"domain_join":{"type":"null"},"forest_trust":{"type":"null"},"forwarding_edge":{"type":"null"},"identity_federation":{"type":"null"},"mail_access":{"type":"null"},"participant":{"type":"object"},"properties":{"maxProperties":0},"proxy_upstream":{"type":"null"},"service_integration":{"type":"null"},"shared_service":{"type":"null"}},"required":["participant"]}}],"description":"A typed directed edge between two named scenario elements.\n\nSource and target can reference any named element in the scenario:\nnodes, features, accounts, entities, or infrastructure entries.\nThe validator checks that both endpoints resolve.\n\nThe ``properties`` dict carries type-specific metadata (e.g.,\n``trust_type: parent-child`` for AD trusts, ``protocol: SAML``\nfor federation). It's a flat dict rather than typed sub-models\nbecause relationship properties vary widely and we don't want\nto gate expressiveness on pre-modeling every variant.\n\n``database_access`` and ``mail_access`` are typed exceptions where\nprotocol/auth details need structural validation rather than prose.\n``forwarding_edge``, ``service_integration``, and ``proxy_upstream`` are\nthe same kind of typed exception for, respectively, a forwarding /\nintel-sync agent's inter-node trust edge (SCN-010 \u00a75.7), a platform\nconsumer-to-engine service integration, and a reverse-proxy/gateway\nroute-to-origin upstream hop. Each keeps protocol/auth/topology facts\nstructurally validated and cross-referable rather than buried in prose.","properties":{"carrier_placement":{"anyOf":[{"$ref":"#/$defs/RelationshipCarrierPlacement"},{"type":"null"}],"default":null},"database_access":{"anyOf":[{"$ref":"#/$defs/RelationshipDatabaseAccess"},{"type":"null"}],"default":null},"description":{"$ref":"#/$defs/_r53"},"domain_controller":{"anyOf":[{"$ref":"#/$defs/RelationshipDomainController"},{"type":"null"}],"default":null},"domain_join":{"anyOf":[{"$ref":"#/$defs/RelationshipDomainJoin"},{"type":"null"}],"default":null},"forest_trust":{"anyOf":[{"$ref":"#/$defs/RelationshipForestTrust"},{"type":"null"}],"default":null},"forwarding_edge":{"anyOf":[{"$ref":"#/$defs/RelationshipForwardingEdge"},{"type":"null"}],"default":null},"identity_federation":{"anyOf":[{"$ref":"#/$defs/RelationshipIdentityFederation"},{"type":"null"}],"default":null},"mail_access":{"anyOf":[{"$ref":"#/$defs/RelationshipMailAccess"},{"type":"null"}],"default":null},"participant":{"anyOf":[{"$ref":"#/$defs/ParticipantRelationship"},{"type":"null"}],"default":null},"properties":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Properties","type":"object"},"proxy_upstream":{"anyOf":[{"$ref":"#/$defs/RelationshipProxyUpstream"},{"type":"null"}],"default":null},"service_integration":{"anyOf":[{"$ref":"#/$defs/RelationshipServiceIntegration"},{"type":"null"}],"default":null},"shared_service":{"anyOf":[{"$ref":"#/$defs/RelationshipSharedService"},{"type":"null"}],"default":null},"source":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source","type":"string"},"target":{"$ref":"#/$defs/_r187"},"type":{"$ref":"#/$defs/RelationshipType"}},"required":["type","source","target"],"title":"Relationship","type":"object"}, "RelationshipCarrierPlacement": {"additionalProperties":false,"description":"Typed logical-node-to-carrier placement intent.","properties":{"kernel_boundary":{"$ref":"#/$defs/KernelBoundary","title":"Kernel Boundary"}},"required":["kernel_boundary"],"title":"RelationshipCarrierPlacement","type":"object"}, "RelationshipDatabaseAccess": {"additionalProperties":false,"description":"Typed database-access detail carried by a top-level relationship edge.\n\nWhen an application connects to a database, the relationship's ``target``\nresolves to the database (service or logical database) and this block keeps\nthe ``role_ref`` (a ``role_id`` in that service) and ``auth_method``\nstructurally validated rather than recorded as prose (ADR-029 \u00a74).","properties":{"auth_method":{"anyOf":[{"$ref":"#/$defs/DatabaseAuthMethod"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][wW][oO][rR][dD]|[mM][dD]5|[sS][cC][rR][aA][mM][-_][sS][hH][aA][-_]256|[cC][eE][rR][tT]|[tT][rR][uU][sS][tT]|[pP][eE][eE][rR]|[iI][dD][eE][nN][tT]|[gG][sS][sS][aA][pP][iI]|[sS][sS][pP][iI]|[lL][dD][aA][pP]|[rR][aA][dD][iI][uU][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Auth Method"},"description":{"$ref":"#/$defs/_r53"},"role_ref":{"$ref":"#/$defs/_r69"}},"title":"RelationshipDatabaseAccess","type":"object"}, "RelationshipDomainController": {"additionalProperties":false,"description":"Typed marker for a node-to-domain controller-role edge.","properties":{},"title":"RelationshipDomainController","type":"object"}, - "RelationshipDomainJoin": {"additionalProperties":false,"description":"Typed member join with explicit ordered controller candidates.","properties":{"controller_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Controller Refs","type":"array"}},"required":["controller_refs"],"title":"RelationshipDomainJoin","type":"object"}, + "RelationshipDomainJoin": {"additionalProperties":false,"description":"Typed member join with explicit ordered controller candidates.","properties":{"controller_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Controller Refs","type":"array"}},"required":["controller_refs"],"title":"RelationshipDomainJoin","type":"object"}, "RelationshipForestTrust": {"additionalProperties":false,"description":"Typed forest trust detail; relationship endpoints own forest identity.","properties":{"direction":{"$ref":"#/$defs/ForestTrustDirection","title":"Direction"},"trust_type":{"anyOf":[{"$ref":"#/$defs/ForestTrustType"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Trust Type"}},"required":["trust_type","direction"],"title":"RelationshipForestTrust","type":"object"}, - "RelationshipForwardingEdge": {"additionalProperties":false,"description":"Typed forwarding-trust detail carried by a top-level relationship edge.\n\nThe inter-node trust edge between a forwarding / intel-sync agent\n(``forwarder_ref``, a ``forwarding_agent_id``) and the downstream consumer\nit ships to. The consumer's transport listener is named by\n``target_listener_role`` \u2014 REUSING the manager-side\n``RuntimeSecurityMonitoringListenerRole`` lattice rather than forking a\nparallel enum (SCN-010 \u00a75.7).\n\nThe agent enrollment identity itself is never recorded: only the closed\n``RuntimeForwardingEnrollmentClassification`` lattice (``none`` /\n``redacted`` / ``operator_secret``). A present enrollment-identity ref must\nclassify ``redacted`` / ``operator_secret`` \u2014 a raw identity is never the\nportable model.","properties":{"crypto_method":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Crypto Method","type":"string"},"description":{"$ref":"#/$defs/_r53"},"enrollment_identity_classification":{"$ref":"#/$defs/_r12"},"enrollment_identity_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Enrollment Identity Ref","type":"string"},"forwarder_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Forwarder Ref","type":"string"},"parse_format":{"$ref":"#/$defs/_r13"},"protocol":{"$ref":"#/$defs/_r67"},"target_listener_role":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringListenerRole"},{"$ref":"#/$defs/_r149"}],"default":"other","title":"Target Listener Role"}},"required":["forwarder_ref"],"title":"RelationshipForwardingEdge","type":"object"}, + "RelationshipForwardingEdge": {"additionalProperties":false,"description":"Typed forwarding-trust detail carried by a top-level relationship edge.\n\nThe inter-node trust edge between a forwarding / intel-sync agent\n(``forwarder_ref``, a ``forwarding_agent_id``) and the downstream consumer\nit ships to. The consumer's transport listener is named by\n``target_listener_role`` \u2014 REUSING the manager-side\n``RuntimeSecurityMonitoringListenerRole`` lattice rather than forking a\nparallel enum (SCN-010 \u00a75.7).\n\nThe agent enrollment identity itself is never recorded: only the closed\n``RuntimeForwardingEnrollmentClassification`` lattice (``none`` /\n``redacted`` / ``operator_secret``). A present enrollment-identity ref must\nclassify ``redacted`` / ``operator_secret`` \u2014 a raw identity is never the\nportable model.","properties":{"crypto_method":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Crypto Method","type":"string"},"description":{"$ref":"#/$defs/_r53"},"enrollment_identity_classification":{"$ref":"#/$defs/_r12"},"enrollment_identity_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Enrollment Identity Ref","type":"string"},"forwarder_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Forwarder Ref","type":"string"},"parse_format":{"$ref":"#/$defs/_r13"},"protocol":{"$ref":"#/$defs/_r67"},"target_listener_role":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringListenerRole"},{"$ref":"#/$defs/_r152"}],"default":"other","title":"Target Listener Role"}},"required":["forwarder_ref"],"title":"RelationshipForwardingEdge","type":"object"}, "RelationshipIdentityFederation": {"additionalProperties":false,"description":"Typed human-authority-to-IdP-facade federation intent.","properties":{"direction":{"$ref":"#/$defs/FederationDirection","title":"Direction"},"mapping_intent":{"anyOf":[{"$ref":"#/$defs/FederationMappingIntent"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Mapping Intent"},"protocol":{"anyOf":[{"$ref":"#/$defs/FederationProtocol"},{"$ref":"#/$defs/DomainProfileBindingModel"}],"title":"Protocol"},"tenant_claim_name":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tenant Claim Name","type":"string"},"tenant_claim_owner":{"$ref":"#/$defs/TenantClaimOwner","title":"Tenant Claim Owner"}},"required":["direction","protocol","mapping_intent","tenant_claim_name","tenant_claim_owner"],"title":"RelationshipIdentityFederation","type":"object"}, - "RelationshipMailAccess": {"additionalProperties":false,"description":"Typed mail-access detail carried by a top-level relationship edge.","properties":{"auth_mechanism":{"anyOf":[{"$ref":"#/$defs/RuntimeMailAuthMechanism"},{"$ref":"#/$defs/_r158"}],"default":"other","title":"Auth Mechanism"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"listener_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Listener Ref","type":"string"},"mailbox_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mailbox Ref","type":"string"},"protocol":{"$ref":"#/$defs/_r17"},"tls_mode":{"$ref":"#/$defs/_r18"}},"title":"RelationshipMailAccess","type":"object"}, - "RelationshipProxyUpstream": {"additionalProperties":false,"description":"Typed proxy-upstream detail carried by a top-level relationship edge.\n\nWhen a reverse proxy / gateway forwards a route to an upstream origin, the\nrelationship's ``target`` resolves to that origin and this block keeps the\nforwarding facts structurally validated rather than recorded as prose:\n``route_ref`` (a ``route_id`` on the proxy's application surface), the\nresolved upstream node/service, whether the client-facing TLS is terminated\nat the proxy, whether the proxy-to-origin hop is plaintext, and any request\n``body_limit`` the proxy enforces.","properties":{"body_limit":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Body Limit","type":"string"},"client_tls_terminated":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Client Tls Terminated"},"description":{"$ref":"#/$defs/_r53"},"origin_plaintext":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Origin Plaintext"},"route_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Route Ref","type":"string"},"upstream_node_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Upstream Node Ref","type":"string"},"upstream_service_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Upstream Service Ref","type":"string"}},"required":["route_ref"],"title":"RelationshipProxyUpstream","type":"object"}, + "RelationshipMailAccess": {"additionalProperties":false,"description":"Typed mail-access detail carried by a top-level relationship edge.","properties":{"auth_mechanism":{"anyOf":[{"$ref":"#/$defs/RuntimeMailAuthMechanism"},{"$ref":"#/$defs/_r161"}],"default":"other","title":"Auth Mechanism"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"listener_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Listener Ref","type":"string"},"mailbox_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mailbox Ref","type":"string"},"protocol":{"$ref":"#/$defs/_r17"},"tls_mode":{"$ref":"#/$defs/_r18"}},"title":"RelationshipMailAccess","type":"object"}, + "RelationshipProxyUpstream": {"additionalProperties":false,"description":"Typed proxy-upstream detail carried by a top-level relationship edge.\n\nWhen a reverse proxy / gateway forwards a route to an upstream origin, the\nrelationship's ``target`` resolves to that origin and this block keeps the\nforwarding facts structurally validated rather than recorded as prose:\n``route_ref`` (a ``route_id`` on the proxy's application surface), the\nresolved upstream node/service, whether the client-facing TLS is terminated\nat the proxy, whether the proxy-to-origin hop is plaintext, and any request\n``body_limit`` the proxy enforces.","properties":{"body_limit":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Body Limit","type":"string"},"client_tls_terminated":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Client Tls Terminated"},"description":{"$ref":"#/$defs/_r53"},"origin_plaintext":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Origin Plaintext"},"route_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Route Ref","type":"string"},"upstream_node_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Upstream Node Ref","type":"string"},"upstream_service_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Upstream Service Ref","type":"string"}},"required":["route_ref"],"title":"RelationshipProxyUpstream","type":"object"}, "RelationshipServiceIntegration": {"additionalProperties":false,"description":"Typed service-integration detail carried by a top-level relationship edge.\n\nWhen a consumer application integrates with a platform engine (analyzer,\nresponder, webhook, notification, or enrichment), the relationship's\nendpoints resolve to the two platform applications and this block keeps the\n``integration_kind``, ``auth_principal_ref`` (an ``app_authorization``\n``principal_id`` in the target), and ``direction`` structurally validated\nrather than recorded as prose. ``consumer_ref``/``engine_ref`` are the\n``platform_application_id`` symbols of the two endpoints; a ``${var}``\nplaceholder is permitted in those refs.","properties":{"auth_principal_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Auth Principal Ref","type":"string"},"consumer_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Consumer Ref","type":"string"},"description":{"$ref":"#/$defs/_r53"},"direction":{"anyOf":[{"$ref":"#/$defs/RelationshipServiceIntegrationDirection"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][bB][oO][uU][nN][dD]|[oO][uU][tT][bB][oO][uU][nN][dD]|[bB][iI][dD][iI][rR][eE][cC][tT][iI][oO][nN][aA][lL]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"bidirectional","title":"Direction"},"enabled":{"$ref":"#/$defs/_r27"},"engine_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Engine Ref","type":"string"},"integration_kind":{"anyOf":[{"$ref":"#/$defs/RelationshipServiceIntegrationKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][zZ][eE][rR]|[rR][eE][sS][pP][oO][nN][dD][eE][rR]|[wW][eE][bB][hH][oO][oO][kK]|[nN][oO][tT][iI][fF][iI][cC][aA][tT][iI][oO][nN]|[eE][nN][rR][iI][cC][hH][mM][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Integration Kind"}},"title":"RelationshipServiceIntegration","type":"object"}, "RelationshipServiceIntegrationDirection": {"description":"Closed structural vocabulary for an integration edge's data direction.\n\nClosed structural vocabulary: carries neither ``unknown`` nor ``other``.","enum":["inbound","outbound","bidirectional"],"title":"RelationshipServiceIntegrationDirection","type":"string"}, "RelationshipServiceIntegrationKind": {"description":"Open taxonomy of how a consumer integrates with a platform engine.\n\nOpen taxonomy: carries both ``unknown`` and ``other``.","enum":["analyzer","responder","webhook","notification","enrichment","unknown","other"],"title":"RelationshipServiceIntegrationKind","type":"string"}, - "RelationshipSharedService": {"additionalProperties":false,"description":"Typed tenant-to-existing-service policy binding.","properties":{"mutable_state_owner":{"$ref":"#/$defs/StateOwner","title":"Mutable State Owner"},"mutable_state_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Mutable State Refs","type":"array"},"reset_generation_owner":{"$ref":"#/$defs/StateOwner","title":"Reset Generation Owner"},"tenant_isolation":{"$ref":"#/$defs/TenantIsolationMode","title":"Tenant Isolation"},"workload_authentication":{"$ref":"#/$defs/WorkloadAuthenticationMode","title":"Workload Authentication"}},"required":["tenant_isolation","workload_authentication","mutable_state_owner","reset_generation_owner"],"title":"RelationshipSharedService","type":"object"}, + "RelationshipSharedService": {"additionalProperties":false,"description":"Typed tenant-to-existing-service policy binding.","properties":{"mutable_state_owner":{"$ref":"#/$defs/StateOwner","title":"Mutable State Owner"},"mutable_state_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Mutable State Refs","type":"array"},"reset_generation_owner":{"$ref":"#/$defs/StateOwner","title":"Reset Generation Owner"},"tenant_isolation":{"$ref":"#/$defs/TenantIsolationMode","title":"Tenant Isolation"},"workload_authentication":{"$ref":"#/$defs/WorkloadAuthenticationMode","title":"Workload Authentication"}},"required":["tenant_isolation","workload_authentication","mutable_state_owner","reset_generation_owner"],"title":"RelationshipSharedService","type":"object"}, "RelationshipType": {"description":"How two scenario elements relate to each other.","enum":["authenticates_with","trusts","federates_with","connects_to","depends_on","manages","replicates_to","domain_controller_for","joins_domain","forest_trusts","directory_federates_to","placed_on_carrier","uses_shared_service","participant"],"title":"RelationshipType","type":"string"}, "ResourceSensitivity": {"enum":["public","restricted","secret"],"title":"ResourceSensitivity","type":"string"}, - "Resources": {"additionalProperties":false,"description":"Compute resources for a compute node.","properties":{"cpu":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"description":"Number of CPU cores","title":"Cpu"},"ram":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"description":"RAM in bytes (parsed from human-readable)","title":"Ram"}},"required":["ram","cpu"],"title":"Resources","type":"object"}, - "Role": {"additionalProperties":false,"description":"A named role on a compute node with optional entity assignments.\n\nShorthand: ``admin: \"username\"`` (just the username string).\nLonghand: ``admin: {username: \"admin\", entities: [\"blue-team.bob\"]}``.","properties":{"entities":{"items":{"$ref":"#/$defs/_r187"},"title":"Entities","type":"array"},"username":{"$ref":"#/$defs/_r185"}},"required":["username"],"title":"Role","type":"object"}, - "RuntimeAppAuthorization": {"additionalProperties":false,"description":"Application-internal RBAC store inventory for a single owning spine.","properties":{"app_authorization_id":{"$ref":"#/$defs/_r3"},"auth_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Auth Enabled"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"permission_grants":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationGrant"},"title":"Permission Grants","type":"array"},"principals":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationPrincipal"},"title":"Principals","type":"array"},"resource_vocabulary":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationResourceVocabulary"},{"$ref":"#/$defs/_r154"}],"default":"unknown","title":"Resource Vocabulary"},"role_mappings":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationRoleMapping"},"title":"Role Mappings","type":"array"},"roles":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationRole"},"title":"Roles","type":"array"},"tenants":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationTenant"},"title":"Tenants","type":"array"}},"required":["app_authorization_id"],"title":"RuntimeAppAuthorization","type":"object"}, + "Resources": {"additionalProperties":false,"description":"Compute resources for a compute node.","properties":{"cpu":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"description":"Number of CPU cores","title":"Cpu"},"ram":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"description":"RAM in bytes (parsed from human-readable)","title":"Ram"}},"required":["ram","cpu"],"title":"Resources","type":"object"}, + "Role": {"additionalProperties":false,"description":"A named role on a compute node with optional entity assignments.\n\nShorthand: ``admin: \"username\"`` (just the username string).\nLonghand: ``admin: {username: \"admin\", entities: [\"blue-team.bob\"]}``.","properties":{"entities":{"items":{"$ref":"#/$defs/_r190"},"title":"Entities","type":"array"},"username":{"$ref":"#/$defs/_r188"}},"required":["username"],"title":"Role","type":"object"}, + "RuntimeAppAuthorization": {"additionalProperties":false,"description":"Application-internal RBAC store inventory for a single owning spine.","properties":{"app_authorization_id":{"$ref":"#/$defs/_r3"},"auth_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Auth Enabled"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"permission_grants":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationGrant"},"title":"Permission Grants","type":"array"},"principals":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationPrincipal"},"title":"Principals","type":"array"},"resource_vocabulary":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationResourceVocabulary"},{"$ref":"#/$defs/_r157"}],"default":"unknown","title":"Resource Vocabulary"},"role_mappings":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationRoleMapping"},"title":"Role Mappings","type":"array"},"roles":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationRole"},"title":"Roles","type":"array"},"tenants":{"items":{"$ref":"#/$defs/RuntimeAppAuthorizationTenant"},"title":"Tenants","type":"array"}},"required":["app_authorization_id"],"title":"RuntimeAppAuthorization","type":"object"}, "RuntimeAppAuthorizationCredentialClassification": {"description":"Closed posture vocabulary for a principal credential.\n\nThe raw credential value MUST NOT be recorded; the principal model has no\nfield that can hold one. This vocabulary is the only credential\nrepresentation in the surface. Closed structural vocab: no ``unknown`` /\n``other``.","enum":["none","redacted","operator_secret"],"title":"RuntimeAppAuthorizationCredentialClassification","type":"string"}, - "RuntimeAppAuthorizationGrant": {"additionalProperties":false,"description":"A resource-scoped permission grant (role -> actions -> resource pattern).\n\n``resource_kind`` is the single author-settable source of truth for the\nresource vocabulary; the owning authorization's ``resource_vocabulary`` is\nthe declared set validated against these grants.","properties":{"actions":{"$ref":"#/$defs/_r99"},"description":{"$ref":"#/$defs/_r53"},"effect":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationGrantEffect"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW]|[dD][eE][nN][yY]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"allow","title":"Effect"},"grant_id":{"$ref":"#/$defs/_r3"},"resource_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationResourceVocabulary"},{"$ref":"#/$defs/_r154"}],"default":"unknown","title":"Resource Kind"},"resource_patterns":{"items":{"$ref":"#/$defs/_r187"},"title":"Resource Patterns","type":"array"},"role_ref":{"$ref":"#/$defs/_r69"}},"required":["grant_id"],"title":"RuntimeAppAuthorizationGrant","type":"object"}, + "RuntimeAppAuthorizationGrant": {"additionalProperties":false,"description":"A resource-scoped permission grant (role -> actions -> resource pattern).\n\n``resource_kind`` is the single author-settable source of truth for the\nresource vocabulary; the owning authorization's ``resource_vocabulary`` is\nthe declared set validated against these grants.","properties":{"actions":{"$ref":"#/$defs/_r102"},"description":{"$ref":"#/$defs/_r53"},"effect":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationGrantEffect"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW]|[dD][eE][nN][yY]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"allow","title":"Effect"},"grant_id":{"$ref":"#/$defs/_r3"},"resource_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationResourceVocabulary"},{"$ref":"#/$defs/_r157"}],"default":"unknown","title":"Resource Kind"},"resource_patterns":{"items":{"$ref":"#/$defs/_r190"},"title":"Resource Patterns","type":"array"},"role_ref":{"$ref":"#/$defs/_r69"}},"required":["grant_id"],"title":"RuntimeAppAuthorizationGrant","type":"object"}, "RuntimeAppAuthorizationGrantEffect": {"description":"Closed allow/deny effect for a permission grant.\n\nClosed structural vocab: no ``unknown`` / ``other``.","enum":["allow","deny"],"title":"RuntimeAppAuthorizationGrantEffect","type":"string"}, - "RuntimeAppAuthorizationPrincipal": {"additionalProperties":false,"description":"A user, service account, API key, or backend role known to the store.\n\nNo raw secret is ever carried: the credential posture is recorded purely\nvia :attr:`credential_classification`.","properties":{"backend_roles":{"$ref":"#/$defs/_r107"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationCredentialClassification"},{"$ref":"#/$defs/_r159"}],"default":"none","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"hidden":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Hidden"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationPrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[aA][pP][iI][-_][kK][eE][yY]|[bB][aA][cC][kK][eE][nN][dD][-_][rR][oO][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"principal_id":{"$ref":"#/$defs/_r3"},"reserved":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Reserved"}},"required":["principal_id"],"title":"RuntimeAppAuthorizationPrincipal","type":"object"}, + "RuntimeAppAuthorizationPrincipal": {"additionalProperties":false,"description":"A user, service account, API key, or backend role known to the store.\n\nNo raw secret is ever carried: the credential posture is recorded purely\nvia :attr:`credential_classification`.","properties":{"backend_roles":{"$ref":"#/$defs/_r110"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationCredentialClassification"},{"$ref":"#/$defs/_r162"}],"default":"none","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"hidden":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Hidden"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeAppAuthorizationPrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[aA][pP][iI][-_][kK][eE][yY]|[bB][aA][cC][kK][eE][nN][dD][-_][rR][oO][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"principal_id":{"$ref":"#/$defs/_r3"},"reserved":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Reserved"}},"required":["principal_id"],"title":"RuntimeAppAuthorizationPrincipal","type":"object"}, "RuntimeAppAuthorizationPrincipalKind": {"description":"Open taxonomy of authorization principal kinds.\n\nCarries both ``unknown`` and ``other`` (extensible real-world vocab).","enum":["user","service_account","api_key","backend_role","unknown","other"],"title":"RuntimeAppAuthorizationPrincipalKind","type":"string"}, "RuntimeAppAuthorizationResourceVocabulary": {"description":"Open spine discriminator for the resource space an RBAC store governs.\n\nTier placement (storage RBAC vs presentation RBAC) is derived from which\nspine references the authorization, not declared here. Open taxonomy:\ncarries both ``unknown`` and ``other``.","enum":["index_pattern","cql_resource","redis_acl","app_resource","unknown","other"],"title":"RuntimeAppAuthorizationResourceVocabulary","type":"string"}, "RuntimeAppAuthorizationRole": {"additionalProperties":false,"description":"A named role defined within the application authorization store.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"role_id":{"$ref":"#/$defs/_r3"}},"required":["role_id"],"title":"RuntimeAppAuthorizationRole","type":"object"}, - "RuntimeAppAuthorizationRoleMapping": {"additionalProperties":false,"description":"A mapping that binds backend roles, users, or hosts onto a local role.","properties":{"backend_roles":{"$ref":"#/$defs/_r107"},"description":{"$ref":"#/$defs/_r53"},"hosts":{"$ref":"#/$defs/_r122"},"mapping_id":{"$ref":"#/$defs/_r3"},"role_ref":{"$ref":"#/$defs/_r69"},"users":{"items":{"$ref":"#/$defs/_r187"},"title":"Users","type":"array"}},"required":["mapping_id"],"title":"RuntimeAppAuthorizationRoleMapping","type":"object"}, + "RuntimeAppAuthorizationRoleMapping": {"additionalProperties":false,"description":"A mapping that binds backend roles, users, or hosts onto a local role.","properties":{"backend_roles":{"$ref":"#/$defs/_r110"},"description":{"$ref":"#/$defs/_r53"},"hosts":{"$ref":"#/$defs/_r125"},"mapping_id":{"$ref":"#/$defs/_r3"},"role_ref":{"$ref":"#/$defs/_r69"},"users":{"items":{"$ref":"#/$defs/_r190"},"title":"Users","type":"array"}},"required":["mapping_id"],"title":"RuntimeAppAuthorizationRoleMapping","type":"object"}, "RuntimeAppAuthorizationTenant": {"additionalProperties":false,"description":"A tenant/namespace scope within the application authorization store.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"tenant_id":{"$ref":"#/$defs/_r3"}},"required":["tenant_id"],"title":"RuntimeAppAuthorizationTenant","type":"object"}, "RuntimeApplicationDisclosure": {"additionalProperties":false,"description":"Observable error or information-disclosure behavior of a route.\n\n``disclosure`` is a classified description of what the application exposes\n(a stack trace, an internal path, a backend version), never the raw payload,\ntoken, password, or cookie itself.","properties":{"description":{"$ref":"#/$defs/_r53"},"disclosure":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Disclosure","type":"string"},"sensitivity":{"$ref":"#/$defs/_r19"},"status_code":{"$ref":"#/$defs/_r39"},"trigger":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Trigger","type":"string"}},"title":"RuntimeApplicationDisclosure","type":"object"}, - "RuntimeApplicationExposedField": {"additionalProperties":false,"description":"A route-visible fixture secret or intentionally exposed diagnostic field.\n\nThe sensitivity vocabulary is shared with the rest of the runtime surface.\nA ``redacted`` or ``operator_secret`` field must omit its raw ``value``.\nOther values, including credential-shaped fixture facts, are scenario\ncontent needed for range realization and participant observation.","if":{"properties":{"sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["sensitivity"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"sensitivity":{"$ref":"#/$defs/_r19"},"value":{"$ref":"#/$defs/_r80"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeApplicationExposedField","type":"object"}, - "RuntimeApplicationParameter": {"additionalProperties":false,"description":"A typed request input observed on an application route.\n\n``location`` distinguishes path variables, query string, headers, cookies,\nform fields, JSON body fields, and uploaded-file fields.","properties":{"data_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Data Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"location":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationParameterLocation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][tT][hH]|[qQ][uU][eE][rR][yY]|[hH][eE][aA][dD][eE][rR]|[cC][oO][oO][kK][iI][eE]|[fF][oO][rR][mM]|[jJ][sS][oO][nN][-_][bB][oO][dD][yY]|[uU][pP][lL][oO][aA][dD][eE][dD][-_][fF][iI][lL][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Location"},"name":{"$ref":"#/$defs/_r176"},"required":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Required"}},"required":["name"],"title":"RuntimeApplicationParameter","type":"object"}, + "RuntimeApplicationExposedField": {"additionalProperties":false,"description":"A route-visible fixture secret or intentionally exposed diagnostic field.\n\nThe sensitivity vocabulary is shared with the rest of the runtime surface.\nA ``redacted`` or ``operator_secret`` field must omit its raw ``value``.\nOther values, including credential-shaped fixture facts, are scenario\ncontent needed for range realization and participant observation.","if":{"properties":{"sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["sensitivity"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"sensitivity":{"$ref":"#/$defs/_r19"},"value":{"$ref":"#/$defs/_r80"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeApplicationExposedField","type":"object"}, + "RuntimeApplicationParameter": {"additionalProperties":false,"description":"A typed request input observed on an application route.\n\n``location`` distinguishes path variables, query string, headers, cookies,\nform fields, JSON body fields, and uploaded-file fields.","properties":{"data_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Data Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"location":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationParameterLocation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][tT][hH]|[qQ][uU][eE][rR][yY]|[hH][eE][aA][dD][eE][rR]|[cC][oO][oO][kK][iI][eE]|[fF][oO][rR][mM]|[jJ][sS][oO][nN][-_][bB][oO][dD][yY]|[uU][pP][lL][oO][aA][dD][eE][dD][-_][fF][iI][lL][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Location"},"name":{"$ref":"#/$defs/_r179"},"required":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Required"}},"required":["name"],"title":"RuntimeApplicationParameter","type":"object"}, "RuntimeApplicationParameterLocation": {"description":"Where a request input is carried on an observed route.","enum":["path","query","header","cookie","form","json_body","uploaded_file","other","unknown"],"title":"RuntimeApplicationParameterLocation","type":"string"}, "RuntimeApplicationProtocol": {"description":"Application-layer protocol class for an observed application surface.","enum":["http","https","ws","wss","other","unknown"],"title":"RuntimeApplicationProtocol","type":"string"}, - "RuntimeApplicationRedirect": {"additionalProperties":false,"description":"An observed redirect a route can issue.\n\nTarget path/URL, status code, and the triggering condition are kept\ndistinct; the target is recorded verbatim, never resolved.","properties":{"condition":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Condition","type":"string"},"description":{"$ref":"#/$defs/_r53"},"status_code":{"$ref":"#/$defs/_r39"},"target":{"$ref":"#/$defs/_r184"}},"required":["target"],"title":"RuntimeApplicationRedirect","type":"object"}, - "RuntimeApplicationResponse": {"additionalProperties":false,"description":"An observed response a route can produce.","properties":{"content_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"status_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Status Code"}},"required":["status_code"],"title":"RuntimeApplicationResponse","type":"object"}, - "RuntimeApplicationRoute": {"additionalProperties":false,"description":"An observed application route \u2014 a participant-visible endpoint.\n\n``route_id`` is the stable identity; ``path`` is data and may carry path\nvariables, may be shared across HTTP methods, and is never a mapping key.","properties":{"auth_required":{"$ref":"#/$defs/_r26"},"auth_scheme":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Auth Scheme","type":"string"},"description":{"$ref":"#/$defs/_r53"},"disclosures":{"items":{"$ref":"#/$defs/RuntimeApplicationDisclosure"},"title":"Disclosures","type":"array"},"exposed_fields":{"items":{"$ref":"#/$defs/RuntimeApplicationExposedField"},"title":"Exposed Fields","type":"array"},"methods":{"items":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[!#$%&'*+\\-.^_`|~0-9A-Za-z]{1,128}$(?![\\s\\S])","type":"string"},"minItems":1,"title":"Methods","type":"array","uniqueItems":true},"name":{"$ref":"#/$defs/_r64"},"parameters":{"items":{"$ref":"#/$defs/RuntimeApplicationParameter"},"title":"Parameters","type":"array"},"path":{"$ref":"#/$defs/_r178"},"redirects":{"items":{"$ref":"#/$defs/RuntimeApplicationRedirect"},"title":"Redirects","type":"array"},"responses":{"items":{"$ref":"#/$defs/RuntimeApplicationResponse"},"title":"Responses","type":"array"},"route_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Route Id","type":"string"},"session_required":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Session Required"},"static_assets":{"items":{"$ref":"#/$defs/_r187"},"title":"Static Assets","type":"array"},"templates":{"items":{"$ref":"#/$defs/_r187"},"title":"Templates","type":"array"},"upstream_target":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationRouteUpstreamTarget"},{"type":"null"}],"default":null}},"required":["route_id","path"],"title":"RuntimeApplicationRoute","type":"object"}, + "RuntimeApplicationRedirect": {"additionalProperties":false,"description":"An observed redirect a route can issue.\n\nTarget path/URL, status code, and the triggering condition are kept\ndistinct; the target is recorded verbatim, never resolved.","properties":{"condition":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Condition","type":"string"},"description":{"$ref":"#/$defs/_r53"},"status_code":{"$ref":"#/$defs/_r39"},"target":{"$ref":"#/$defs/_r187"}},"required":["target"],"title":"RuntimeApplicationRedirect","type":"object"}, + "RuntimeApplicationResponse": {"additionalProperties":false,"description":"An observed response a route can produce.","properties":{"content_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"status_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Status Code"}},"required":["status_code"],"title":"RuntimeApplicationResponse","type":"object"}, + "RuntimeApplicationRoute": {"additionalProperties":false,"description":"An observed application route \u2014 a participant-visible endpoint.\n\n``route_id`` is the stable identity; ``path`` is data and may carry path\nvariables, may be shared across HTTP methods, and is never a mapping key.","properties":{"auth_required":{"$ref":"#/$defs/_r26"},"auth_scheme":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Auth Scheme","type":"string"},"description":{"$ref":"#/$defs/_r53"},"disclosures":{"items":{"$ref":"#/$defs/RuntimeApplicationDisclosure"},"title":"Disclosures","type":"array"},"exposed_fields":{"items":{"$ref":"#/$defs/RuntimeApplicationExposedField"},"title":"Exposed Fields","type":"array"},"methods":{"items":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[!#$%&'*+\\-.^_`|~0-9A-Za-z]{1,128}$(?![\\s\\S])","type":"string"},"minItems":1,"title":"Methods","type":"array","uniqueItems":true},"name":{"$ref":"#/$defs/_r64"},"parameters":{"items":{"$ref":"#/$defs/RuntimeApplicationParameter"},"title":"Parameters","type":"array"},"path":{"$ref":"#/$defs/_r181"},"redirects":{"items":{"$ref":"#/$defs/RuntimeApplicationRedirect"},"title":"Redirects","type":"array"},"responses":{"items":{"$ref":"#/$defs/RuntimeApplicationResponse"},"title":"Responses","type":"array"},"route_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Route Id","type":"string"},"session_required":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Session Required"},"static_assets":{"items":{"$ref":"#/$defs/_r190"},"title":"Static Assets","type":"array"},"templates":{"items":{"$ref":"#/$defs/_r190"},"title":"Templates","type":"array"},"upstream_target":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationRouteUpstreamTarget"},{"type":"null"}],"default":null}},"required":["route_id","path"],"title":"RuntimeApplicationRoute","type":"object"}, "RuntimeApplicationRouteUpstreamScheme": {"description":"Wire scheme a reverse proxy uses to reach a route's upstream origin.\n\nThis is a CLOSED taxonomy: an upstream is reached over either cleartext\nHTTP or TLS-wrapped HTTPS. Unlike the open ``RuntimeApplicationProtocol``,\nit carries neither ``other`` nor ``unknown`` \u2014 a proxy-to-origin hop that is\nneither HTTP nor HTTPS is not an application route upstream.","enum":["http","https"],"title":"RuntimeApplicationRouteUpstreamScheme","type":"string"}, - "RuntimeApplicationRouteUpstreamTarget": {"additionalProperties":false,"description":"The origin a reverse-proxied route forwards to.\n\nA proxy/gateway route does not itself serve content; it relays to an\nupstream origin on this or another node. ``target_node_ref`` /\n``target_service`` name that origin (the service-name forms mirror\n``RuntimeApplicationSurface.service``), ``scheme`` is the CLOSED\nproxy-to-origin wire scheme, and ``tls_terminated_here`` records whether\nTLS is terminated at the proxy (re-encrypted or plaintext to the origin).\nAll fields are observation metadata; nothing is resolved.","properties":{"scheme":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationRouteUpstreamScheme"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][tT][tT][pP]|[hH][tT][tT][pP][sS]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"http","title":"Scheme"},"target_node_ref":{"$ref":"#/$defs/_r75"},"target_service":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Service","type":"string"},"tls_terminated_here":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Tls Terminated Here"}},"title":"RuntimeApplicationRouteUpstreamTarget","type":"object"}, + "RuntimeApplicationRouteUpstreamTarget": {"additionalProperties":false,"description":"The origin a reverse-proxied route forwards to.\n\nA proxy/gateway route does not itself serve content; it relays to an\nupstream origin on this or another node. ``target_node_ref`` /\n``target_service`` name that origin (the service-name forms mirror\n``RuntimeApplicationSurface.service``), ``scheme`` is the CLOSED\nproxy-to-origin wire scheme, and ``tls_terminated_here`` records whether\nTLS is terminated at the proxy (re-encrypted or plaintext to the origin).\nAll fields are observation metadata; nothing is resolved.","properties":{"scheme":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationRouteUpstreamScheme"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][tT][tT][pP]|[hH][tT][tT][pP][sS]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"http","title":"Scheme"},"target_node_ref":{"$ref":"#/$defs/_r75"},"target_service":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Service","type":"string"},"tls_terminated_here":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Tls Terminated Here"}},"title":"RuntimeApplicationRouteUpstreamTarget","type":"object"}, "RuntimeApplicationSurface": {"additionalProperties":false,"description":"An observed application surface hosted by a transport service on a node.\n\n``service`` references the owning same-node ``Node.services[].name`` (bare\nname or the qualified ``nodes..services.`` form). The surface is\nobservation metadata; it never mutates ``Node.services``.","properties":{"application_id":{"$ref":"#/$defs/_r3"},"base_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Base Path","type":"string"},"description":{"$ref":"#/$defs/_r53"},"framework":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Framework","type":"string"},"name":{"$ref":"#/$defs/_r64"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeApplicationProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][tT][tT][pP]|[hH][tT][tT][pP][sS]|[wW][sS]|[wW][sS][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"http","title":"Protocol"},"routes":{"items":{"$ref":"#/$defs/RuntimeApplicationRoute"},"title":"Routes","type":"array"},"service":{"$ref":"#/$defs/_r70"}},"required":["application_id"],"title":"RuntimeApplicationSurface","type":"object"}, - "RuntimeAptPackageRepository": {"additionalProperties":false,"description":"Version 1 portable binary APT repository and dedicated trust binding.","properties":{"components":{"items":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9.+_~-]{0,127}$","type":"string"},"maxItems":32,"minItems":1,"title":"Components","type":"array","uniqueItems":true},"profile_version":{"const":"1","title":"Profile Version","type":"string"},"repository_profile":{"const":"apt","title":"Repository Profile","type":"string"},"signing_key":{"$ref":"#/$defs/RuntimePackageRepositorySigningKey"},"suite":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9.+_~:-]{0,127}$","title":"Suite","type":"string"},"uri":{"allOf":[{"$ref":"#/$defs/_r188"}],"description":"Credential-free HTTPS base URI of the binary APT repository.","maxLength":2048,"minLength":1,"not":{"anyOf":[{"pattern":"^https://[^/?#]*@"},{"pattern":"[?&](?:access_token|api_key|apikey|auth|credential|key|password|secret|sig|signature|token)(?:=|&|$)"}]},"pattern":"^https://[^\\s#]+$","title":"Uri","type":"string"}},"required":["repository_profile","profile_version","uri","suite","components","signing_key"],"title":"RuntimeAptPackageRepository","type":"object"}, + "RuntimeAptPackageRepository": {"additionalProperties":false,"description":"Version 1 portable binary APT repository and dedicated trust binding.","properties":{"components":{"items":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9.+_~-]{0,127}$","type":"string"},"maxItems":32,"minItems":1,"title":"Components","type":"array","uniqueItems":true},"profile_version":{"const":"1","title":"Profile Version","type":"string"},"repository_profile":{"const":"apt","title":"Repository Profile","type":"string"},"signing_key":{"$ref":"#/$defs/RuntimePackageRepositorySigningKey"},"suite":{"maxLength":128,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9.+_~:-]{0,127}$","title":"Suite","type":"string"},"uri":{"allOf":[{"$ref":"#/$defs/_r191"}],"description":"Credential-free HTTPS base URI of the binary APT repository.","maxLength":2048,"minLength":1,"not":{"anyOf":[{"pattern":"^https://[^/?#]*@"},{"pattern":"[?&](?:access_token|api_key|apikey|auth|credential|key|password|secret|sig|signature|token)(?:=|&|$)"}]},"pattern":"^https://[^\\s#]+$","title":"Uri","type":"string"}},"required":["repository_profile","profile_version","uri","suite","components","signing_key"],"title":"RuntimeAptPackageRepository","type":"object"}, "RuntimeCapabilityOverrideScope": {"description":"Scope of a ``RuntimeProcessCapabilityOverride``.\n\n``PROCESS`` records a capability delta that applies only to the subject\nprocess itself; ``SUBTREE`` records a delta that applies to the subject\nprocess and every descendant it spawns (the motivating case is\n``capsh --drop=cap_audit_control`` exec'ing ``sshd``, after which the\ninteractive shell subtree runs without ``CAP_AUDIT_CONTROL``).","enum":["process","subtree"],"title":"RuntimeCapabilityOverrideScope","type":"string"}, - "RuntimeCapabilityPolicy": {"additionalProperties":false,"description":"Linux/container capability policy observed for a runtime node.","properties":{"add":{"$ref":"#/$defs/_r100"},"description":{"$ref":"#/$defs/_r53"},"drop":{"$ref":"#/$defs/_r114"},"effective":{"$ref":"#/$defs/_r115"},"process_overrides":{"items":{"$ref":"#/$defs/RuntimeProcessCapabilityOverride"},"title":"Process Overrides","type":"array"},"required":{"items":{"$ref":"#/$defs/_r187"},"title":"Required","type":"array"}},"title":"RuntimeCapabilityPolicy","type":"object"}, + "RuntimeCapabilityPolicy": {"additionalProperties":false,"description":"Linux/container capability policy observed for a runtime node.","properties":{"add":{"$ref":"#/$defs/_r103"},"description":{"$ref":"#/$defs/_r53"},"drop":{"$ref":"#/$defs/_r117"},"effective":{"$ref":"#/$defs/_r118"},"process_overrides":{"items":{"$ref":"#/$defs/RuntimeProcessCapabilityOverride"},"title":"Process Overrides","type":"array"},"required":{"items":{"$ref":"#/$defs/_r190"},"title":"Required","type":"array"}},"title":"RuntimeCapabilityPolicy","type":"object"}, "RuntimeConfiguration": {"additionalProperties":false,"description":"Declarative runtime state required by a compute node.\n\nCaptured observations remain in evidence records unless an author\ndeliberately promotes the fact to one of these contract fields.","properties":{"app_authorizations":{"items":{"$ref":"#/$defs/RuntimeAppAuthorization"},"title":"App Authorizations","type":"array"},"applications":{"items":{"$ref":"#/$defs/RuntimeApplicationSurface"},"title":"Applications","type":"array"},"container":{"anyOf":[{"$ref":"#/$defs/RuntimeContainerConfiguration"},{"type":"null"}],"default":null},"database_services":{"items":{"$ref":"#/$defs/RuntimeDatabaseService"},"title":"Database Services","type":"array"},"datastore_services":{"items":{"$ref":"#/$defs/RuntimeDatastoreService"},"title":"Datastore Services","type":"array"},"dependency_manifests":{"items":{"$ref":"#/$defs/RuntimeDependencyManifest"},"title":"Dependency Manifests","type":"array"},"dns_services":{"items":{"$ref":"#/$defs/RuntimeDnsService"},"title":"Dns Services","type":"array"},"environment":{"items":{"$ref":"#/$defs/RuntimeEnvironmentVariable"},"title":"Environment","type":"array"},"environment_files":{"items":{"$ref":"#/$defs/RuntimeEnvironmentFile"},"title":"Environment Files","type":"array"},"file_services":{"items":{"$ref":"#/$defs/RuntimeFileService"},"title":"File Services","type":"array"},"filesystem_inventory":{"items":{"$ref":"#/$defs/RuntimeFilesystemEntry"},"title":"Filesystem Inventory","type":"array"},"forwarding_agents":{"items":{"allOf":[{"$ref":"#/$defs/RuntimeForwardingAgent"},{"properties":{"forwarding_agent_id":{"$ref":"#/$defs/_r3"}},"type":"object"}]},"title":"Forwarding Agents","type":"array"},"identity_authorities":{"items":{"$ref":"#/$defs/RuntimeIdentityAuthority"},"title":"Identity Authorities","type":"array"},"linux_capabilities":{"anyOf":[{"$ref":"#/$defs/RuntimeCapabilityPolicy"},{"type":"null"}],"default":null},"local_control_interfaces":{"items":{"$ref":"#/$defs/RuntimeControlInterface"},"title":"Local Control Interfaces","type":"array"},"local_identity":{"anyOf":[{"$ref":"#/$defs/RuntimeLocalIdentityInventory"},{"type":"null"}],"default":null},"mail_services":{"items":{"$ref":"#/$defs/RuntimeMailService"},"title":"Mail Services","type":"array"},"mounts":{"items":{"$ref":"#/$defs/RuntimeMount"},"title":"Mounts","type":"array"},"network":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkRealization"},{"type":"null"}],"default":null},"network_detection_engines":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionEngine"},"title":"Network Detection Engines","type":"array"},"network_sensors":{"items":{"$ref":"#/$defs/RuntimeNetworkSensor"},"title":"Network Sensors","type":"array"},"operational_policy":{"anyOf":[{"$ref":"#/$defs/RuntimeOperationalPolicy"},{"type":"null"}],"default":null},"orchestration_authorities":{"items":{"$ref":"#/$defs/RuntimeOrchestrationAuthority"},"title":"Orchestration Authorities","type":"array"},"packages":{"items":{"$ref":"#/$defs/RuntimePackage"},"title":"Packages","type":"array"},"platform_applications":{"items":{"$ref":"#/$defs/RuntimePlatformApplication"},"title":"Platform Applications","type":"array"},"processes":{"items":{"$ref":"#/$defs/RuntimeProcessIdentity"},"title":"Processes","type":"array"},"repository_state":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwareRepositoryState"},{"type":"null"}],"default":null},"scheduled_jobs":{"items":{"$ref":"#/$defs/RuntimeScheduledJob"},"title":"Scheduled Jobs","type":"array"},"security_monitoring_managers":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringManager"},"title":"Security Monitoring Managers","type":"array"},"service_listeners":{"items":{"$ref":"#/$defs/RuntimeServiceListener"},"title":"Service Listeners","type":"array"},"service_manager_units":{"items":{"$ref":"#/$defs/ServiceManagerUnit"},"title":"Service Manager Units","type":"array"},"software_components":{"items":{"$ref":"#/$defs/RuntimeSoftwareComponent"},"title":"Software Components","type":"array"},"ssh_servers":{"items":{"$ref":"#/$defs/RuntimeSshServer"},"title":"Ssh Servers","type":"array"}},"title":"RuntimeConfiguration","type":"object"}, - "RuntimeContainerConfiguration": {"additionalProperties":false,"description":"Required container runtime host and security configuration facts.","properties":{"autoremove":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Autoremove"},"cgroup_parent":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cgroup Parent","type":"string"},"command":{"$ref":"#/$defs/_r108"},"description":{"$ref":"#/$defs/_r53"},"device_cgroup_rules":{"items":{"$ref":"#/$defs/_r187"},"title":"Device Cgroup Rules","type":"array"},"devices":{"items":{"$ref":"#/$defs/RuntimeDeviceMapping"},"title":"Devices","type":"array"},"dns":{"items":{"$ref":"#/$defs/_r187"},"title":"Dns","type":"array"},"dns_options":{"items":{"$ref":"#/$defs/_r187"},"title":"Dns Options","type":"array"},"dns_search":{"items":{"$ref":"#/$defs/_r187"},"title":"Dns Search","type":"array"},"entrypoint":{"$ref":"#/$defs/_r116"},"extra_hosts":{"items":{"$ref":"#/$defs/RuntimeExtraHost"},"title":"Extra Hosts","type":"array"},"group_add":{"items":{"$ref":"#/$defs/_r187"},"title":"Group Add","type":"array"},"init_process":{"anyOf":[{"$ref":"#/$defs/RuntimeInitProcess"},{"type":"null"}],"default":null},"log_driver":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Log Driver","type":"string"},"log_options":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Log Options","type":"object"},"masked_paths":{"items":{"$ref":"#/$defs/_r187"},"title":"Masked Paths","type":"array"},"namespaces":{"anyOf":[{"$ref":"#/$defs/RuntimeNamespaceConfiguration"},{"type":"null"}],"default":null},"privileged":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Privileged"},"publish_all_ports":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Publish All Ports"},"read_only_paths":{"items":{"$ref":"#/$defs/_r187"},"title":"Read Only Paths","type":"array"},"read_only_rootfs":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Read Only Rootfs"},"runtime_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Runtime Name","type":"string"},"seccomp_profile":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Seccomp Profile","type":"string"},"security_opt":{"items":{"$ref":"#/$defs/_r187"},"title":"Security Opt","type":"array"},"shm_size":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Shm Size"}},"title":"RuntimeContainerConfiguration","type":"object"}, - "RuntimeControlInterface": {"additionalProperties":false,"allOf":[{"if":{"properties":{"bind_source_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["bind_source_sensitivity"]},"then":{"not":{"properties":{"bind_source":{"minLength":1,"type":"string"}},"required":["bind_source"]}}}],"description":"A non-network local control API exposed inside a runtime node.","properties":{"access":{"anyOf":[{"$ref":"#/$defs/RuntimeControlInterfaceAccess"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][eE][aA][dD][-_][oO][nN][lL][yY]|[rR][eE][aA][dD][-_][wW][rR][iI][tT][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Access"},"bind_source":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Bind Source","type":"string"},"bind_source_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Bind Source Sensitivity"},"control_interface_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Control Interface Id","type":"string"},"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeControlInterfaceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][nN][iI][xX][-_][sS][oO][cC][kK][eE][tT]|[nN][aA][mM][eE][dD][-_][pP][iI][pP][eE]|[fF][iI][lL][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unix_socket","title":"Kind"},"path":{"$ref":"#/$defs/_r178"},"protocol":{"$ref":"#/$defs/_r67"}},"required":["control_interface_id","path"],"title":"RuntimeControlInterface","type":"object"}, + "RuntimeContainerConfiguration": {"additionalProperties":false,"description":"Required container runtime host and security configuration facts.","properties":{"autoremove":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Autoremove"},"cgroup_parent":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cgroup Parent","type":"string"},"command":{"$ref":"#/$defs/_r111"},"description":{"$ref":"#/$defs/_r53"},"device_cgroup_rules":{"items":{"$ref":"#/$defs/_r190"},"title":"Device Cgroup Rules","type":"array"},"devices":{"items":{"$ref":"#/$defs/RuntimeDeviceMapping"},"title":"Devices","type":"array"},"dns":{"items":{"$ref":"#/$defs/_r190"},"title":"Dns","type":"array"},"dns_options":{"items":{"$ref":"#/$defs/_r190"},"title":"Dns Options","type":"array"},"dns_search":{"items":{"$ref":"#/$defs/_r190"},"title":"Dns Search","type":"array"},"entrypoint":{"$ref":"#/$defs/_r119"},"extra_hosts":{"items":{"$ref":"#/$defs/RuntimeExtraHost"},"title":"Extra Hosts","type":"array"},"group_add":{"items":{"$ref":"#/$defs/_r190"},"title":"Group Add","type":"array"},"init_process":{"anyOf":[{"$ref":"#/$defs/RuntimeInitProcess"},{"type":"null"}],"default":null},"log_driver":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Log Driver","type":"string"},"log_options":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Log Options","type":"object"},"masked_paths":{"items":{"$ref":"#/$defs/_r190"},"title":"Masked Paths","type":"array"},"namespaces":{"anyOf":[{"$ref":"#/$defs/RuntimeNamespaceConfiguration"},{"type":"null"}],"default":null},"privileged":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Privileged"},"publish_all_ports":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Publish All Ports"},"read_only_paths":{"items":{"$ref":"#/$defs/_r190"},"title":"Read Only Paths","type":"array"},"read_only_rootfs":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Read Only Rootfs"},"runtime_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Runtime Name","type":"string"},"seccomp_profile":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Seccomp Profile","type":"string"},"security_opt":{"items":{"$ref":"#/$defs/_r190"},"title":"Security Opt","type":"array"},"shm_size":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Shm Size"}},"title":"RuntimeContainerConfiguration","type":"object"}, + "RuntimeControlInterface": {"additionalProperties":false,"allOf":[{"if":{"properties":{"bind_source_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["bind_source_sensitivity"]},"then":{"not":{"properties":{"bind_source":{"minLength":1,"type":"string"}},"required":["bind_source"]}}}],"description":"A non-network local control API exposed inside a runtime node.","properties":{"access":{"anyOf":[{"$ref":"#/$defs/RuntimeControlInterfaceAccess"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][eE][aA][dD][-_][oO][nN][lL][yY]|[rR][eE][aA][dD][-_][wW][rR][iI][tT][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Access"},"bind_source":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Bind Source","type":"string"},"bind_source_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Bind Source Sensitivity"},"control_interface_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Control Interface Id","type":"string"},"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeControlInterfaceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][nN][iI][xX][-_][sS][oO][cC][kK][eE][tT]|[nN][aA][mM][eE][dD][-_][pP][iI][pP][eE]|[fF][iI][lL][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unix_socket","title":"Kind"},"path":{"$ref":"#/$defs/_r181"},"protocol":{"$ref":"#/$defs/_r67"}},"required":["control_interface_id","path"],"title":"RuntimeControlInterface","type":"object"}, "RuntimeControlInterfaceAccess": {"description":"Observed local-control access mode.","enum":["read_only","read_write","unknown","other"],"title":"RuntimeControlInterfaceAccess","type":"string"}, "RuntimeControlInterfaceKind": {"description":"Path-local control interface shape observed at runtime.","enum":["unix_socket","named_pipe","file","other","unknown"],"title":"RuntimeControlInterfaceKind","type":"string"}, "RuntimeDatabaseService": {"additionalProperties":false,"description":"An observed database service hosted by a transport service on a node.\n\n``service`` references the owning same-node ``Node.services[].name`` (bare\nname or the qualified ``nodes..services.`` form). The inventory\nis observation metadata; it never mutates ``Node.services``.","properties":{"database_service_id":{"$ref":"#/$defs/_r3"},"databases":{"items":{"$ref":"#/$defs/Database"},"title":"Databases","type":"array"},"description":{"$ref":"#/$defs/_r53"},"engine":{"anyOf":[{"$ref":"#/$defs/DatabaseEngine"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][oO][sS][tT][gG][rR][eE][sS][qQ][lL]|[mM][yY][sS][qQ][lL]|[mM][aA][rR][iI][aA][dD][bB]|[sS][qQ][lL][iI][tT][eE]|[mM][oO][nN][gG][oO][dD][bB]|[mM][sS][sS][qQ][lL]|[oO][rR][aA][cC][lL][eE]|[rR][eE][dD][iI][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Engine"},"grants":{"items":{"$ref":"#/$defs/DatabaseGrant"},"title":"Grants","type":"array"},"listeners":{"items":{"$ref":"#/$defs/DatabaseListener"},"title":"Listeners","type":"array"},"name":{"$ref":"#/$defs/_r64"},"protocol":{"anyOf":[{"$ref":"#/$defs/DatabaseProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][oO][sS][tT][gG][rR][eE][sS][qQ][lL]|[mM][yY][sS][qQ][lL]|[tT][dD][sS]|[mM][oO][nN][gG][oO][dD][bB]|[rR][eE][dD][iI][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Protocol"},"roles":{"items":{"$ref":"#/$defs/DatabaseRole"},"title":"Roles","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/DatabaseSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"}},"required":["database_service_id"],"title":"RuntimeDatabaseService","type":"object"}, - "RuntimeDatastoreCluster": {"additionalProperties":false,"description":"The single observed cluster posture of a datastore service.\n\nCaptures the cluster-identity facts a search/wide-column cluster exposes:\nnative UUID, aggregate cardinality and size, shard totals, health,\ndiscovery mode, partitioner, and native protocol version.","properties":{"cluster_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cluster Id","type":"string"},"description":{"$ref":"#/$defs/_r53"},"discovery_mode":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Discovery Mode","type":"string"},"doc_count":{"$ref":"#/$defs/_r34"},"health":{"$ref":"#/$defs/_r59"},"name":{"$ref":"#/$defs/_r64"},"native_protocol_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Native Protocol Version","type":"string"},"node_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Node Count"},"partitioner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Partitioner","type":"string"},"shard_primaries":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Shard Primaries"},"shard_total":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Shard Total"},"store_size_bytes":{"$ref":"#/$defs/_r40"},"uuid":{"$ref":"#/$defs/_r79"}},"required":["cluster_id"],"title":"RuntimeDatastoreCluster","type":"object"}, + "RuntimeDatastoreCluster": {"additionalProperties":false,"description":"The single observed cluster posture of a datastore service.\n\nCaptures the cluster-identity facts a search/wide-column cluster exposes:\nnative UUID, aggregate cardinality and size, shard totals, health,\ndiscovery mode, partitioner, and native protocol version.","properties":{"cluster_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cluster Id","type":"string"},"description":{"$ref":"#/$defs/_r53"},"discovery_mode":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Discovery Mode","type":"string"},"doc_count":{"$ref":"#/$defs/_r34"},"health":{"$ref":"#/$defs/_r59"},"name":{"$ref":"#/$defs/_r64"},"native_protocol_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Native Protocol Version","type":"string"},"node_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Node Count"},"partitioner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Partitioner","type":"string"},"shard_primaries":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Shard Primaries"},"shard_total":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Shard Total"},"store_size_bytes":{"$ref":"#/$defs/_r40"},"uuid":{"$ref":"#/$defs/_r79"}},"required":["cluster_id"],"title":"RuntimeDatastoreCluster","type":"object"}, "RuntimeDatastoreDataModel": {"description":"The logical data model of a datastore \u2014 the spine discriminator.\n\nOPEN taxonomy (per the SCN-010 adversarial verdict): carries both\n``unknown`` and ``other`` so an unrecognized model is permissive rather than\nforcing a shallow relational encoding. ``document`` is intentionally absent \u2014\nno observed container realizes it (forbidden-completion discipline).","enum":["search_index","wide_column","key_value","relational","unknown","other"],"title":"RuntimeDatastoreDataModel","type":"string"}, "RuntimeDatastoreEngine": {"description":"Observed product family for a datastore service.\n\nOPEN taxonomy: real-world datastore engines are unbounded, so both\n``unknown`` and ``other`` are carried.","enum":["opensearch","elasticsearch","cassandra","scylladb","redis","valkey","memcached","unknown","other"],"title":"RuntimeDatastoreEngine","type":"string"}, "RuntimeDatastoreEnginePlugin": {"additionalProperties":false,"description":"An engine extension/plugin/module installed on a datastore node.\n\nPer-node installed-capability inventory (OpenSearch plugins, Redis modules,\n\u2026). Carries the per-plugin ``version`` the name-only service-level list could\nnot. ``plugin_id`` is a stable symbol; ``name`` is the observed engine name.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"plugin_id":{"$ref":"#/$defs/_r3"},"version":{"$ref":"#/$defs/_r81"}},"required":["plugin_id"],"title":"RuntimeDatastoreEnginePlugin","type":"object"}, "RuntimeDatastoreEvictionPolicy": {"description":"A key-value eviction policy.\n\nOPEN taxonomy: carries both ``unknown`` and ``other``. Covers Redis\n``maxmemory-policy`` values.","enum":["noeviction","allkeys_lru","allkeys_lfu","allkeys_random","volatile_lru","volatile_lfu","volatile_random","volatile_ttl","unknown","other"],"title":"RuntimeDatastoreEvictionPolicy","type":"string"}, - "RuntimeDatastoreMapping": {"additionalProperties":false,"description":"A bounded manifest of an observed search-index mapping/schema.\n\nCarries schema geometry and digest/evidence facts, never the raw\nOpenSearch/Elasticsearch ``_mapping`` response body.","properties":{"date_detection":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Date Detection"},"description":{"$ref":"#/$defs/_r53"},"dynamic_policy":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Dynamic Policy","type":"string"},"dynamic_template_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Dynamic Template Count"},"evidence_refs":{"$ref":"#/$defs/_r119"},"field_type_census":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Field Type Census","type":"object"},"leaf_field_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Leaf Field Count"},"mapping_id":{"$ref":"#/$defs/_r3"},"name":{"$ref":"#/$defs/_r64"},"partition_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Partition Ref","type":"string"},"schema_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Digest","type":"string"},"top_level_field_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Top Level Field Count"}},"required":["mapping_id"],"title":"RuntimeDatastoreMapping","type":"object"}, - "RuntimeDatastoreNode": {"additionalProperties":false,"description":"An observed node participating in a datastore cluster.\n\nBeyond cluster membership and roles, a node carries product-neutral engine\nprovenance (version, build hash/type), JVM/process memory posture (initial\nand maximum heap byte bounds, memory-lock state), a typed per-node engine\nplugin inventory, and typed published endpoints (client vs peer listeners).\nAll are observed runtime facts \u2014 never host policy or software-component\nidentity (ADR-058 amending ADR-048).","properties":{"build_hash":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Build Hash","type":"string"},"build_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Build Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"endpoints":{"items":{"$ref":"#/$defs/RuntimeDatastoreNodeEndpoint"},"title":"Endpoints","type":"array"},"engine_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Engine Version","type":"string"},"heap_init_bytes":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Heap Init Bytes"},"heap_max_bytes":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Heap Max Bytes"},"is_coordinator":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Is Coordinator"},"memory_locked":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Memory Locked"},"name":{"$ref":"#/$defs/_r64"},"node_id":{"$ref":"#/$defs/_r3"},"plugins":{"items":{"$ref":"#/$defs/RuntimeDatastoreEnginePlugin"},"title":"Plugins","type":"array"},"roles":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreNodeRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][lL][uU][sS][tT][eE][rR][-_][mM][aA][nN][aA][gG][eE][rR]|[dD][aA][tT][aA]|[iI][nN][gG][eE][sS][tT]|[cC][oO][oO][rR][dD][iI][nN][aA][tT][iI][nN][gG]|[mM][lL]|[sS][eE][eE][dD]|[cC][oO][oO][rR][dD][iI][nN][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Roles","type":"array"}},"required":["node_id"],"title":"RuntimeDatastoreNode","type":"object"}, + "RuntimeDatastoreMapping": {"additionalProperties":false,"description":"A bounded manifest of an observed search-index mapping/schema.\n\nCarries schema geometry and digest/evidence facts, never the raw\nOpenSearch/Elasticsearch ``_mapping`` response body.","properties":{"date_detection":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Date Detection"},"description":{"$ref":"#/$defs/_r53"},"dynamic_policy":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Dynamic Policy","type":"string"},"dynamic_template_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Dynamic Template Count"},"evidence_refs":{"$ref":"#/$defs/_r122"},"field_type_census":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Field Type Census","type":"object"},"leaf_field_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Leaf Field Count"},"mapping_id":{"$ref":"#/$defs/_r3"},"name":{"$ref":"#/$defs/_r64"},"partition_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Partition Ref","type":"string"},"schema_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Schema Digest","type":"string"},"top_level_field_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Top Level Field Count"}},"required":["mapping_id"],"title":"RuntimeDatastoreMapping","type":"object"}, + "RuntimeDatastoreNode": {"additionalProperties":false,"description":"An observed node participating in a datastore cluster.\n\nBeyond cluster membership and roles, a node carries product-neutral engine\nprovenance (version, build hash/type), JVM/process memory posture (initial\nand maximum heap byte bounds, memory-lock state), a typed per-node engine\nplugin inventory, and typed published endpoints (client vs peer listeners).\nAll are observed runtime facts \u2014 never host policy or software-component\nidentity (ADR-058 amending ADR-048).","properties":{"build_hash":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Build Hash","type":"string"},"build_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Build Type","type":"string"},"description":{"$ref":"#/$defs/_r53"},"endpoints":{"items":{"$ref":"#/$defs/RuntimeDatastoreNodeEndpoint"},"title":"Endpoints","type":"array"},"engine_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Engine Version","type":"string"},"heap_init_bytes":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Heap Init Bytes"},"heap_max_bytes":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Heap Max Bytes"},"is_coordinator":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Is Coordinator"},"memory_locked":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Memory Locked"},"name":{"$ref":"#/$defs/_r64"},"node_id":{"$ref":"#/$defs/_r3"},"plugins":{"items":{"$ref":"#/$defs/RuntimeDatastoreEnginePlugin"},"title":"Plugins","type":"array"},"roles":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreNodeRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][lL][uU][sS][tT][eE][rR][-_][mM][aA][nN][aA][gG][eE][rR]|[dD][aA][tT][aA]|[iI][nN][gG][eE][sS][tT]|[cC][oO][oO][rR][dD][iI][nN][aA][tT][iI][nN][gG]|[mM][lL]|[sS][eE][eE][dD]|[cC][oO][oO][rR][dD][iI][nN][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Roles","type":"array"}},"required":["node_id"],"title":"RuntimeDatastoreNode","type":"object"}, "RuntimeDatastoreNodeEndpoint": {"additionalProperties":false,"description":"An observed published listener on a datastore node.\n\nProduct-neutral node listener topology: ``role`` distinguishes the\nparticipant-facing ``client`` listener from the inter-node ``peer`` listener\nwithout encoding engine-native names. ``address`` and ``port`` stay split,\nmatching every other runtime listener surface. A node endpoint records\npublished topology, not proof of an OS bind or host publication (ADR-058).","properties":{"address":{"$ref":"#/$defs/_r47"},"description":{"$ref":"#/$defs/_r53"},"endpoint_id":{"$ref":"#/$defs/_r3"},"port":{"$ref":"#/$defs/_r37"},"protocol":{"$ref":"#/$defs/_r67"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreNodeEndpointRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][lL][iI][eE][nN][tT]|[pP][eE][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Role"}},"required":["endpoint_id"],"title":"RuntimeDatastoreNodeEndpoint","type":"object"}, "RuntimeDatastoreNodeEndpointRole": {"description":"The role a datastore node's published listener fulfils.\n\nOPEN taxonomy: carries both ``unknown`` and ``other``. ``client`` is the\nparticipant/application-facing listener (OpenSearch ``http``, Cassandra\nnative/CQL, Redis client); ``peer`` is the inter-node/cluster listener\n(OpenSearch ``transport``, Cassandra internode, Redis cluster-bus).\nEngine-native listener names are intentionally not modelled \u2014 the datastore\nspine stays product-neutral (ADR-048, ADR-058).","enum":["client","peer","unknown","other"],"title":"RuntimeDatastoreNodeEndpointRole","type":"string"}, "RuntimeDatastoreNodeRole": {"description":"A role a cluster node fulfils.\n\nOPEN taxonomy: carries both ``unknown`` and ``other``. Covers OpenSearch\n``cluster_manager``/``data``/``ingest``/``ml`` roles and Cassandra\n``coordinator``/``seed`` roles uniformly.","enum":["cluster_manager","data","ingest","coordinating","ml","seed","coordinator","unknown","other"],"title":"RuntimeDatastoreNodeRole","type":"string"}, - "RuntimeDatastorePartition": {"additionalProperties":false,"description":"An observed partition primitive (index / keyspace / logical_db / family).\n\nCarries the geometry that differentiates one datastore data model from\nanother: native partition/index UUID, shard/replica and document counts for\na search index, replication strategy + factor + per-DC factor map for a\nwide-column keyspace, and a datatype census for a key-value logical\ndatabase.","properties":{"creation_timestamp":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Creation Timestamp","type":"string"},"datatype_census":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Datatype Census","type":"object"},"description":{"$ref":"#/$defs/_r53"},"doc_count":{"$ref":"#/$defs/_r34"},"doc_count_deleted":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Doc Count Deleted"},"durable_writes":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Durable Writes"},"health":{"$ref":"#/$defs/_r59"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastorePartitionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX]|[kK][eE][yY][sS][pP][aA][cC][eE]|[lL][oO][gG][iI][cC][aA][lL][-_][dD][bB]|[cC][oO][lL][uU][mM][nN][-_][fF][aA][mM][iI][lL][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"open_closed_status":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Open Closed Status","type":"string"},"partition_id":{"$ref":"#/$defs/_r3"},"per_dc_factor_map":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Per Dc Factor Map","type":"object"},"replica_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Replica Count"},"replication_factor":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Replication Factor"},"replication_strategy":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreReplicationStrategy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][iI][mM][pP][lL][eE][-_][sS][tT][rR][aA][tT][eE][gG][yY]|[nN][eE][tT][wW][oO][rR][kK][-_][tT][oO][pP][oO][lL][oO][gG][yY][-_][sS][tT][rR][aA][tT][eE][gG][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Replication Strategy"},"shard_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Shard Count"},"store_size_bytes":{"$ref":"#/$defs/_r40"},"uuid":{"$ref":"#/$defs/_r79"}},"required":["partition_id"],"title":"RuntimeDatastorePartition","type":"object"}, + "RuntimeDatastorePartition": {"additionalProperties":false,"description":"An observed partition primitive (index / keyspace / logical_db / family).\n\nCarries the geometry that differentiates one datastore data model from\nanother: native partition/index UUID, shard/replica and document counts for\na search index, replication strategy + factor + per-DC factor map for a\nwide-column keyspace, and a datatype census for a key-value logical\ndatabase.","properties":{"creation_timestamp":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Creation Timestamp","type":"string"},"datatype_census":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Datatype Census","type":"object"},"description":{"$ref":"#/$defs/_r53"},"doc_count":{"$ref":"#/$defs/_r34"},"doc_count_deleted":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Doc Count Deleted"},"durable_writes":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Durable Writes"},"health":{"$ref":"#/$defs/_r59"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastorePartitionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX]|[kK][eE][yY][sS][pP][aA][cC][eE]|[lL][oO][gG][iI][cC][aA][lL][-_][dD][bB]|[cC][oO][lL][uU][mM][nN][-_][fF][aA][mM][iI][lL][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"open_closed_status":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Open Closed Status","type":"string"},"partition_id":{"$ref":"#/$defs/_r3"},"per_dc_factor_map":{"additionalProperties":{"$ref":"#/$defs/_r44"},"title":"Per Dc Factor Map","type":"object"},"replica_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Replica Count"},"replication_factor":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Replication Factor"},"replication_strategy":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreReplicationStrategy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][iI][mM][pP][lL][eE][-_][sS][tT][rR][aA][tT][eE][gG][yY]|[nN][eE][tT][wW][oO][rR][kK][-_][tT][oO][pP][oO][lL][oO][gG][yY][-_][sS][tT][rR][aA][tT][eE][gG][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Replication Strategy"},"shard_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Shard Count"},"store_size_bytes":{"$ref":"#/$defs/_r40"},"uuid":{"$ref":"#/$defs/_r79"}},"required":["partition_id"],"title":"RuntimeDatastorePartition","type":"object"}, "RuntimeDatastorePartitionKind": {"description":"The kind of a datastore partition/namespace primitive.\n\nOPEN taxonomy: carries both ``unknown`` and ``other``. An ``index`` is the\nsearch-cluster primary object, a ``keyspace`` the wide-column one, a\n``logical_db`` a numbered key-value database, and a ``column_family`` a\nwide-column table.","enum":["index","keyspace","logical_db","column_family","unknown","other"],"title":"RuntimeDatastorePartitionKind","type":"string"}, - "RuntimeDatastorePersistence": {"additionalProperties":false,"description":"The single observed persistence posture of a key-value datastore.\n\nCaptures Redis-style persistence: RDB save points, AOF on/off, the eviction\npolicy, and the maxmemory ceiling. Its presence is the defining profile a\n``key_value`` data model must carry.","properties":{"aof":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Aof"},"description":{"$ref":"#/$defs/_r53"},"eviction":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreEvictionPolicy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][eE][vV][iI][cC][tT][iI][oO][nN]|[aA][lL][lL][kK][eE][yY][sS][-_][lL][rR][uU]|[aA][lL][lL][kK][eE][yY][sS][-_][lL][fF][uU]|[aA][lL][lL][kK][eE][yY][sS][-_][rR][aA][nN][dD][oO][mM]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][lL][rR][uU]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][lL][fF][uU]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][rR][aA][nN][dD][oO][mM]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][tT][tT][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Eviction"},"maxmemory":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Maxmemory","type":"string"},"persistence_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Persistence Id","type":"string"},"rdb_save_points":{"items":{"$ref":"#/$defs/_r187"},"title":"Rdb Save Points","type":"array"}},"required":["persistence_id"],"title":"RuntimeDatastorePersistence","type":"object"}, + "RuntimeDatastorePersistence": {"additionalProperties":false,"description":"The single observed persistence posture of a key-value datastore.\n\nCaptures Redis-style persistence: RDB save points, AOF on/off, the eviction\npolicy, and the maxmemory ceiling. Its presence is the defining profile a\n``key_value`` data model must carry.","properties":{"aof":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Aof"},"description":{"$ref":"#/$defs/_r53"},"eviction":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreEvictionPolicy"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][eE][vV][iI][cC][tT][iI][oO][nN]|[aA][lL][lL][kK][eE][yY][sS][-_][lL][rR][uU]|[aA][lL][lL][kK][eE][yY][sS][-_][lL][fF][uU]|[aA][lL][lL][kK][eE][yY][sS][-_][rR][aA][nN][dD][oO][mM]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][lL][rR][uU]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][lL][fF][uU]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][rR][aA][nN][dD][oO][mM]|[vV][oO][lL][aA][tT][iI][lL][eE][-_][tT][tT][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Eviction"},"maxmemory":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Maxmemory","type":"string"},"persistence_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Persistence Id","type":"string"},"rdb_save_points":{"items":{"$ref":"#/$defs/_r190"},"title":"Rdb Save Points","type":"array"}},"required":["persistence_id"],"title":"RuntimeDatastorePersistence","type":"object"}, "RuntimeDatastoreReplicationStrategy": {"description":"A wide-column replication strategy \u2014 the spine discriminator's geometry.\n\nOPEN taxonomy (per the SCN-010 verdict): carries both ``unknown`` and\n``other``. Covers Cassandra ``SimpleStrategy``/``NetworkTopologyStrategy``.","enum":["simple_strategy","network_topology_strategy","unknown","other"],"title":"RuntimeDatastoreReplicationStrategy","type":"string"}, - "RuntimeDatastoreService": {"additionalProperties":false,"description":"An observed datastore service hosted by a transport service on a node.\n\nThe single non-relational datastore spine. ``service`` references the owning\nsame-node ``Node.services[].name`` (bare name or the qualified\n``nodes..services.`` form). The ``data_model`` discriminator\ndescribes the logical model without imposing a complete deployment recipe.","properties":{"aliases":{"$ref":"#/$defs/_r101"},"authorization_ref":{"$ref":"#/$defs/_r48"},"backup_targets":{"items":{"$ref":"#/$defs/_r187"},"title":"Backup Targets","type":"array"},"cluster":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreCluster"},{"type":"null"}],"default":null},"data_model":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreDataModel"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][eE][aA][rR][cC][hH][-_][iI][nN][dD][eE][xX]|[wW][iI][dD][eE][-_][cC][oO][lL][uU][mM][nN]|[kK][eE][yY][-_][vV][aA][lL][uU][eE]|[rR][eE][lL][aA][tT][iI][oO][nN][aA][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Data Model"},"datastore_service_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"engine":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreEngine"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[oO][pP][eE][nN][sS][eE][aA][rR][cC][hH]|[eE][lL][aA][sS][tT][iI][cC][sS][eE][aA][rR][cC][hH]|[cC][aA][sS][sS][aA][nN][dD][rR][aA]|[sS][cC][yY][lL][lL][aA][dD][bB]|[rR][eE][dD][iI][sS]|[vV][aA][lL][kK][eE][yY]|[mM][eE][mM][cC][aA][cC][hH][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine"},"ingest_pipelines":{"items":{"$ref":"#/$defs/_r187"},"title":"Ingest Pipelines","type":"array"},"lifecycle_policies":{"items":{"$ref":"#/$defs/_r187"},"title":"Lifecycle Policies","type":"array"},"mappings":{"items":{"$ref":"#/$defs/RuntimeDatastoreMapping"},"title":"Mappings","type":"array"},"name":{"$ref":"#/$defs/_r64"},"nodes":{"items":{"$ref":"#/$defs/RuntimeDatastoreNode"},"title":"Nodes","type":"array"},"partitions":{"items":{"$ref":"#/$defs/RuntimeDatastorePartition"},"title":"Partitions","type":"array"},"persistence":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastorePersistence"},{"type":"null"}],"default":null},"protocol":{"$ref":"#/$defs/_r67"},"pubsub_channels":{"items":{"$ref":"#/$defs/_r187"},"title":"Pubsub Channels","type":"array"},"queues_streams":{"items":{"$ref":"#/$defs/_r187"},"title":"Queues Streams","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimeDatastoreSetting"},"title":"Settings","type":"array"},"templates":{"items":{"$ref":"#/$defs/RuntimeDatastoreTemplate"},"title":"Templates","type":"array"},"transport_security":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreTransportSecurity"},{"type":"null"}],"default":null},"version":{"$ref":"#/$defs/_r81"}},"required":["datastore_service_id"],"title":"RuntimeDatastoreService","type":"object"}, - "RuntimeDatastoreSetting": {"additionalProperties":false,"description":"An observed datastore runtime setting with scope, provenance, and class.\n\nExplicit ``redacted`` / ``operator_secret`` classifications omit raw values;\nnames that look credential-bearing remain scenario content unless the\nauthor marks the value withheld.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreSettingProvenance"},{"$ref":"#/$defs/_r155"}],"default":"unknown","title":"Provenance"},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreSettingScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][lL][uU][sS][tT][eE][rR]|[nN][oO][dD][eE]|[pP][aA][rR][tT][iI][tT][iI][oO][nN]|[eE][nN][gG][iI][nN][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"engine","title":"Scope"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeDatastoreSetting","type":"object"}, + "RuntimeDatastoreService": {"additionalProperties":false,"description":"An observed datastore service hosted by a transport service on a node.\n\nThe single non-relational datastore spine. ``service`` references the owning\nsame-node ``Node.services[].name`` (bare name or the qualified\n``nodes..services.`` form). The ``data_model`` discriminator\ndescribes the logical model without imposing a complete deployment recipe.","properties":{"aliases":{"$ref":"#/$defs/_r104"},"authorization_ref":{"$ref":"#/$defs/_r48"},"backup_targets":{"items":{"$ref":"#/$defs/_r190"},"title":"Backup Targets","type":"array"},"cluster":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreCluster"},{"type":"null"}],"default":null},"data_model":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreDataModel"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][eE][aA][rR][cC][hH][-_][iI][nN][dD][eE][xX]|[wW][iI][dD][eE][-_][cC][oO][lL][uU][mM][nN]|[kK][eE][yY][-_][vV][aA][lL][uU][eE]|[rR][eE][lL][aA][tT][iI][oO][nN][aA][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Data Model"},"datastore_service_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"engine":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreEngine"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[oO][pP][eE][nN][sS][eE][aA][rR][cC][hH]|[eE][lL][aA][sS][tT][iI][cC][sS][eE][aA][rR][cC][hH]|[cC][aA][sS][sS][aA][nN][dD][rR][aA]|[sS][cC][yY][lL][lL][aA][dD][bB]|[rR][eE][dD][iI][sS]|[vV][aA][lL][kK][eE][yY]|[mM][eE][mM][cC][aA][cC][hH][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine"},"ingest_pipelines":{"items":{"$ref":"#/$defs/_r190"},"title":"Ingest Pipelines","type":"array"},"lifecycle_policies":{"items":{"$ref":"#/$defs/_r190"},"title":"Lifecycle Policies","type":"array"},"mappings":{"items":{"$ref":"#/$defs/RuntimeDatastoreMapping"},"title":"Mappings","type":"array"},"name":{"$ref":"#/$defs/_r64"},"nodes":{"items":{"$ref":"#/$defs/RuntimeDatastoreNode"},"title":"Nodes","type":"array"},"partitions":{"items":{"$ref":"#/$defs/RuntimeDatastorePartition"},"title":"Partitions","type":"array"},"persistence":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastorePersistence"},{"type":"null"}],"default":null},"protocol":{"$ref":"#/$defs/_r67"},"pubsub_channels":{"items":{"$ref":"#/$defs/_r190"},"title":"Pubsub Channels","type":"array"},"queues_streams":{"items":{"$ref":"#/$defs/_r190"},"title":"Queues Streams","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimeDatastoreSetting"},"title":"Settings","type":"array"},"templates":{"items":{"$ref":"#/$defs/RuntimeDatastoreTemplate"},"title":"Templates","type":"array"},"transport_security":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreTransportSecurity"},{"type":"null"}],"default":null},"version":{"$ref":"#/$defs/_r81"}},"required":["datastore_service_id"],"title":"RuntimeDatastoreService","type":"object"}, + "RuntimeDatastoreSetting": {"additionalProperties":false,"description":"An observed datastore runtime setting with scope, provenance, and class.\n\nExplicit ``redacted`` / ``operator_secret`` classifications omit raw values;\nnames that look credential-bearing remain scenario content unless the\nauthor marks the value withheld.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreSettingProvenance"},{"$ref":"#/$defs/_r158"}],"default":"unknown","title":"Provenance"},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreSettingScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][lL][uU][sS][tT][eE][rR]|[nN][oO][dD][eE]|[pP][aA][rR][tT][iI][tT][iI][oO][nN]|[eE][nN][gG][iI][nN][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"engine","title":"Scope"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeDatastoreSetting","type":"object"}, "RuntimeDatastoreSettingProvenance": {"description":"Where an observed datastore runtime setting value came from.\n\nOPEN taxonomy: provenance sources are extensible, so both ``unknown`` and\n``other`` are carried (mirrors ``DatabaseSettingProvenance``).","enum":["introspection","configuration_file","image_default","operator_override","runtime_default","unknown","other"],"title":"RuntimeDatastoreSettingProvenance","type":"string"}, "RuntimeDatastoreSettingScope": {"description":"The scope a datastore runtime setting applies at.\n\nCLOSED structural vocab: the scope lattice (cluster / node / partition /\nengine) is fixed by the spine's own topology, so no ``unknown`` / ``other``.","enum":["cluster","node","partition","engine"],"title":"RuntimeDatastoreSettingScope","type":"string"}, - "RuntimeDatastoreTemplate": {"additionalProperties":false,"description":"A bounded manifest of an observed index template body.\n\nThe template captures patterns, selected settings, optional mapping linkage,\ndigest, and evidence refs without embedding the backend's raw template JSON.","properties":{"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"index_patterns":{"items":{"$ref":"#/$defs/_r187"},"title":"Index Patterns","type":"array"},"mapping_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mapping Ref","type":"string"},"name":{"$ref":"#/$defs/_r64"},"settings_summary":{"additionalProperties":{"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"integer"},{"type":"boolean"}]},"title":"Settings Summary","type":"object"},"template_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Template Digest","type":"string"},"template_id":{"$ref":"#/$defs/_r3"}},"required":["template_id"],"title":"RuntimeDatastoreTemplate","type":"object"}, - "RuntimeDatastoreTransportSecurity": {"additionalProperties":false,"description":"The single observed transport-security posture of a datastore service.\n\nRecords the intra-cluster transport TLS mode and whether client/node\ncertificate verification is enforced \u2014 the observable ``xpack.security`` /\n``SKIPSSL_VERIFY`` posture, never the certificate material itself.","properties":{"client_verification":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Client Verification"},"description":{"$ref":"#/$defs/_r53"},"mode":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreTransportSecurityMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[tT][lL][sS]|[mM][uU][tT][uU][aA][lL][-_][tT][lL][sS]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"none","title":"Mode"},"node_verification":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Node Verification"},"transport_security_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Transport Security Id","type":"string"}},"required":["transport_security_id"],"title":"RuntimeDatastoreTransportSecurity","type":"object"}, + "RuntimeDatastoreTemplate": {"additionalProperties":false,"description":"A bounded manifest of an observed index template body.\n\nThe template captures patterns, selected settings, optional mapping linkage,\ndigest, and evidence refs without embedding the backend's raw template JSON.","properties":{"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"index_patterns":{"items":{"$ref":"#/$defs/_r190"},"title":"Index Patterns","type":"array"},"mapping_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mapping Ref","type":"string"},"name":{"$ref":"#/$defs/_r64"},"settings_summary":{"additionalProperties":{"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"integer"},{"type":"boolean"}]},"title":"Settings Summary","type":"object"},"template_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Template Digest","type":"string"},"template_id":{"$ref":"#/$defs/_r3"}},"required":["template_id"],"title":"RuntimeDatastoreTemplate","type":"object"}, + "RuntimeDatastoreTransportSecurity": {"additionalProperties":false,"description":"The single observed transport-security posture of a datastore service.\n\nRecords the intra-cluster transport TLS mode and whether client/node\ncertificate verification is enforced \u2014 the observable ``xpack.security`` /\n``SKIPSSL_VERIFY`` posture, never the certificate material itself.","properties":{"client_verification":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Client Verification"},"description":{"$ref":"#/$defs/_r53"},"mode":{"anyOf":[{"$ref":"#/$defs/RuntimeDatastoreTransportSecurityMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[tT][lL][sS]|[mM][uU][tT][uU][aA][lL][-_][tT][lL][sS]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"none","title":"Mode"},"node_verification":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Node Verification"},"transport_security_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Transport Security Id","type":"string"}},"required":["transport_security_id"],"title":"RuntimeDatastoreTransportSecurity","type":"object"}, "RuntimeDatastoreTransportSecurityMode": {"description":"The transport-security posture of a datastore service.\n\nCLOSED structural vocab: the observable TLS posture is a fixed three-way\ndistinction (none / one-way TLS / mutual TLS), so no ``unknown`` / ``other``.\nA ``${var}`` placeholder remains expressible at the field level.","enum":["none","tls","mutual_tls"],"title":"RuntimeDatastoreTransportSecurityMode","type":"string"}, - "RuntimeDependencyManifest": {"additionalProperties":false,"description":"A dependency manifest required in the runtime artifact.","properties":{"ecosystem":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ecosystem","type":"string"},"format":{"$ref":"#/$defs/_r58"},"name":{"$ref":"#/$defs/_r64"},"path":{"$ref":"#/$defs/_r178"},"version":{"$ref":"#/$defs/_r81"}},"required":["ecosystem","path"],"title":"RuntimeDependencyManifest","type":"object"}, + "RuntimeDependencyManifest": {"additionalProperties":false,"description":"A dependency manifest required in the runtime artifact.","properties":{"ecosystem":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ecosystem","type":"string"},"format":{"$ref":"#/$defs/_r58"},"name":{"$ref":"#/$defs/_r64"},"path":{"$ref":"#/$defs/_r181"},"version":{"$ref":"#/$defs/_r81"}},"required":["ecosystem","path"],"title":"RuntimeDependencyManifest","type":"object"}, "RuntimeDeviceMapping": {"additionalProperties":false,"description":"A host device mapping required in runtime configuration.","properties":{"container_path":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Container Path","type":"string"},"description":{"$ref":"#/$defs/_r53"},"host_path":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Host Path","type":"string"},"permissions":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Permissions","type":"string"}},"required":["host_path","container_path"],"title":"RuntimeDeviceMapping","type":"object"}, - "RuntimeDnsService": {"additionalProperties":false,"description":"An observed DNS service hosted by a node.","properties":{"configuration_file_refs":{"$ref":"#/$defs/_r109"},"description":{"$ref":"#/$defs/_r53"},"dns_service_id":{"$ref":"#/$defs/_r3"},"dynamic_update":{"anyOf":[{"$ref":"#/$defs/DnsDynamicUpdatePolicy"},{"type":"null"}],"default":null},"implementation":{"anyOf":[{"$ref":"#/$defs/DnsServerImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][iI][nN][dD]|[cC][oO][rR][eE][dD][nN][sS]|[pP][oO][wW][eE][rR][dD][nN][sS]|[kK][nN][oO][tT][-_][dD][nN][sS]|[nN][sS][dD]|[wW][iI][nN][dD][oO][wW][sS][-_][dD][nN][sS]|[dD][nN][sS][mM][aA][sS][qQ]|[uU][nN][bB][oO][uU][nN][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r124"},"name":{"$ref":"#/$defs/_r64"},"resolver_policy":{"anyOf":[{"$ref":"#/$defs/DnsResolverPolicy"},{"type":"null"}],"default":null},"roles":{"items":{"anyOf":[{"$ref":"#/$defs/DnsServiceRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][uU][tT][hH][oO][rR][iI][tT][aA][tT][iI][vV][eE]|[rR][eE][cC][uU][rR][sS][iI][vV][eE][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[fF][oO][rR][wW][aA][rR][dD][iI][nN][gG][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[cC][aA][cC][hH][iI][nN][gG][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[sS][tT][uU][bB][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Roles","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/DnsRuntimeSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"},"zones":{"items":{"$ref":"#/$defs/DnsZone"},"title":"Zones","type":"array"}},"required":["dns_service_id"],"title":"RuntimeDnsService","type":"object"}, + "RuntimeDnsService": {"additionalProperties":false,"description":"An observed DNS service hosted by a node.","properties":{"configuration_file_refs":{"$ref":"#/$defs/_r112"},"description":{"$ref":"#/$defs/_r53"},"dns_service_id":{"$ref":"#/$defs/_r3"},"dynamic_update":{"anyOf":[{"$ref":"#/$defs/DnsDynamicUpdatePolicy"},{"type":"null"}],"default":null},"implementation":{"anyOf":[{"$ref":"#/$defs/DnsServerImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][iI][nN][dD]|[cC][oO][rR][eE][dD][nN][sS]|[pP][oO][wW][eE][rR][dD][nN][sS]|[kK][nN][oO][tT][-_][dD][nN][sS]|[nN][sS][dD]|[wW][iI][nN][dD][oO][wW][sS][-_][dD][nN][sS]|[dD][nN][sS][mM][aA][sS][qQ]|[uU][nN][bB][oO][uU][nN][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r127"},"name":{"$ref":"#/$defs/_r64"},"resolver_policy":{"anyOf":[{"$ref":"#/$defs/DnsResolverPolicy"},{"type":"null"}],"default":null},"roles":{"items":{"anyOf":[{"$ref":"#/$defs/DnsServiceRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][uU][tT][hH][oO][rR][iI][tT][aA][tT][iI][vV][eE]|[rR][eE][cC][uU][rR][sS][iI][vV][eE][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[fF][oO][rR][wW][aA][rR][dD][iI][nN][gG][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[cC][aA][cC][hH][iI][nN][gG][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[sS][tT][uU][bB][-_][rR][eE][sS][oO][lL][vV][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Roles","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/DnsRuntimeSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"},"zones":{"items":{"$ref":"#/$defs/DnsZone"},"title":"Zones","type":"array"}},"required":["dns_service_id"],"title":"RuntimeDnsService","type":"object"}, "RuntimeEnvironmentFile": {"additionalProperties":false,"description":"A node runtime env-file delivered from a generated-artifact output.\n\nThe file is an opaque generated-artifact output projected as one runtime\nenvironment input; RAES does not parse or compare its individual key/value\nentries. Authors declare the binding here, on the node, not as a fake\nvariable name and not as an ordinary read-only file mount.\n\n``name`` is a bounded portable identity, not a filesystem path: the compiler\nforwards it as the env-file target in the provisioning projection, so it must\nnot admit path traversal, newlines, or shell metacharacters that could\nredirect the generated secret outside the runtime env-file namespace.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r1"},"value_from":{"$ref":"#/$defs/GeneratedArtifactValueSource"}},"required":["name","value_from"],"title":"RuntimeEnvironmentFile","type":"object"}, "RuntimeEnvironmentValueClassification": {"description":"Sensitivity classification for a required runtime environment value.","enum":["plain","redacted","secret_fixture","operator_secret","unknown","other"],"title":"RuntimeEnvironmentValueClassification","type":"string"}, - "RuntimeEnvironmentVariable": {"additionalProperties":false,"allOf":[{"not":{"allOf":[{"properties":{"value_from":{"not":{"type":"null"}}},"required":["value_from"]},{"properties":{"value":{"minLength":1}},"required":["value"]}]}},{"not":{"allOf":[{"properties":{"value_from":{"not":{"type":"null"}}},"required":["value_from"]},{"properties":{"value_classification":{"const":"operator_secret"}},"required":["value_classification"]}]}}],"description":"Required runtime environment variable with provenance and sensitivity.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeEnvironmentVariableProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][mM][pP][oO][sS][eE]|[iI][mM][aA][gG][eE]|[oO][pP][eE][rR][aA][tT][oO][rR]|[cC][oO][nN][tT][aA][iI][nN][eE][rR]|[rR][uU][nN][tT][iI][mM][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"source":{"$ref":"#/$defs/_r74"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"},"value_from":{"$ref":"#/$defs/_r7"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeEnvironmentVariable","type":"object"}, + "RuntimeEnvironmentVariable": {"additionalProperties":false,"allOf":[{"not":{"allOf":[{"properties":{"value_from":{"not":{"type":"null"}}},"required":["value_from"]},{"properties":{"value":{"minLength":1}},"required":["value"]}]}},{"not":{"allOf":[{"properties":{"value_from":{"not":{"type":"null"}}},"required":["value_from"]},{"properties":{"value_classification":{"const":"operator_secret"}},"required":["value_classification"]}]}}],"description":"Required runtime environment variable with provenance and sensitivity.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeEnvironmentVariableProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][mM][pP][oO][sS][eE]|[iI][mM][aA][gG][eE]|[oO][pP][eE][rR][aA][tT][oO][rR]|[cC][oO][nN][tT][aA][iI][nN][eE][rR]|[rR][uU][nN][tT][iI][mM][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"source":{"$ref":"#/$defs/_r74"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r9"},"value_from":{"$ref":"#/$defs/_r7"}},"required":["name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeEnvironmentVariable","type":"object"}, "RuntimeEnvironmentVariableProvenance": {"description":"Required origin class for a runtime environment variable.","enum":["compose","image","operator","container","runtime","other","unknown"],"title":"RuntimeEnvironmentVariableProvenance","type":"string"}, - "RuntimeExtraHost": {"additionalProperties":false,"description":"A required extra host mapping in runtime configuration.","properties":{"address":{"$ref":"#/$defs/_r170"},"description":{"$ref":"#/$defs/_r53"},"hostname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Hostname","type":"string"}},"required":["hostname","address"],"title":"RuntimeExtraHost","type":"object"}, + "RuntimeExtraHost": {"additionalProperties":false,"description":"A required extra host mapping in runtime configuration.","properties":{"address":{"$ref":"#/$defs/_r173"},"description":{"$ref":"#/$defs/_r53"},"hostname":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Hostname","type":"string"}},"required":["hostname","address"],"title":"RuntimeExtraHost","type":"object"}, "RuntimeFileService": {"additionalProperties":false,"description":"A node-scoped runtime file-service inventory.\n\n``service`` references the owning same-node ``Node.services[].name``\n(bare name or qualified ``nodes..services.``).","properties":{"access_observations":{"items":{"$ref":"#/$defs/RuntimeFileServiceAccessObservation"},"title":"Access Observations","type":"array"},"access_rules":{"items":{"$ref":"#/$defs/RuntimeFileServiceAccessRule"},"title":"Access Rules","type":"array"},"backend":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Backend","type":"string"},"description":{"$ref":"#/$defs/_r53"},"file_service_id":{"$ref":"#/$defs/_r3"},"principals":{"items":{"$ref":"#/$defs/RuntimeFileServicePrincipal"},"title":"Principals","type":"array"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][mM][bB]|[cC][iI][fF][sS]|[nN][fF][sS]|[aA][fF][pP]|[fF][tT][pP]|[sS][fF][tT][pP]|[wW][eE][bB][dD][aA][vV]|[oO][bB][jJ][eE][cC][tT][-_][sS][tT][oO][rR][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Protocol"},"service":{"$ref":"#/$defs/_r70"},"shares":{"items":{"$ref":"#/$defs/RuntimeFileServiceShare"},"title":"Shares","type":"array"}},"required":["file_service_id"],"title":"RuntimeFileService","type":"object"}, "RuntimeFileServiceAccessAction": {"description":"Portable action vocabulary for file-service access policy/observations.","enum":["browse","list","read","write","create","delete","execute","administer","other","unknown"],"title":"RuntimeFileServiceAccessAction","type":"string"}, "RuntimeFileServiceAccessBasis": {"description":"Basis/provenance for an access claim or observation.","enum":["share_config","passdb","filesystem_acl","directory_policy","observed_probe","computed","unknown","other"],"title":"RuntimeFileServiceAccessBasis","type":"string"}, "RuntimeFileServiceAccessEffect": {"description":"Portable effect for an authored or computed file-service access rule.","enum":["allow","deny","not_applicable","unknown","other"],"title":"RuntimeFileServiceAccessEffect","type":"string"}, - "RuntimeFileServiceAccessObservation": {"additionalProperties":false,"description":"An observed probe outcome against a file-service resource.\n\nObservations are evidence; they support but do not overwrite authored\nor configured policy.","properties":{"action":{"$ref":"#/$defs/_r10"},"basis":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessBasis"},{"$ref":"#/$defs/_r164"}],"default":"observed_probe","title":"Basis"},"description":{"$ref":"#/$defs/_r53"},"observation_id":{"$ref":"#/$defs/_r3"},"outcome":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessOutcome"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW][eE][dD]|[dD][eE][nN][iI][eE][dD]|[eE][rR][rR][oO][rR]|[nN][oO][tT][-_][oO][bB][sS][eE][rR][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Outcome"},"resource_ref":{"$ref":"#/$defs/_r181"},"sensitivity":{"$ref":"#/$defs/_r19"},"subject_ref":{"$ref":"#/$defs/_r183"}},"required":["observation_id","subject_ref","resource_ref"],"title":"RuntimeFileServiceAccessObservation","type":"object"}, + "RuntimeFileServiceAccessObservation": {"additionalProperties":false,"description":"An observed probe outcome against a file-service resource.\n\nObservations are evidence; they support but do not overwrite authored\nor configured policy.","properties":{"action":{"$ref":"#/$defs/_r10"},"basis":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessBasis"},{"$ref":"#/$defs/_r167"}],"default":"observed_probe","title":"Basis"},"description":{"$ref":"#/$defs/_r53"},"observation_id":{"$ref":"#/$defs/_r3"},"outcome":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessOutcome"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW][eE][dD]|[dD][eE][nN][iI][eE][dD]|[eE][rR][rR][oO][rR]|[nN][oO][tT][-_][oO][bB][sS][eE][rR][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Outcome"},"resource_ref":{"$ref":"#/$defs/_r184"},"sensitivity":{"$ref":"#/$defs/_r19"},"subject_ref":{"$ref":"#/$defs/_r186"}},"required":["observation_id","subject_ref","resource_ref"],"title":"RuntimeFileServiceAccessObservation","type":"object"}, "RuntimeFileServiceAccessOutcome": {"description":"Observed outcome class for a per-share access probe.","enum":["allowed","denied","error","not_observed","unknown","other"],"title":"RuntimeFileServiceAccessOutcome","type":"string"}, - "RuntimeFileServiceAccessRule": {"additionalProperties":false,"description":"An authored or computed access rule for a file-service resource.","properties":{"action":{"$ref":"#/$defs/_r10"},"basis":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessBasis"},{"$ref":"#/$defs/_r164"}],"default":"unknown","title":"Basis"},"description":{"$ref":"#/$defs/_r53"},"effect":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessEffect"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW]|[dD][eE][nN][yY]|[nN][oO][tT][-_][aA][pP][pP][lL][iI][cC][aA][bB][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Effect"},"resource_ref":{"$ref":"#/$defs/_r181"},"rule_id":{"$ref":"#/$defs/_r3"},"subject_ref":{"$ref":"#/$defs/_r183"}},"required":["rule_id","subject_ref","resource_ref"],"title":"RuntimeFileServiceAccessRule","type":"object"}, + "RuntimeFileServiceAccessRule": {"additionalProperties":false,"description":"An authored or computed access rule for a file-service resource.","properties":{"action":{"$ref":"#/$defs/_r10"},"basis":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessBasis"},{"$ref":"#/$defs/_r167"}],"default":"unknown","title":"Basis"},"description":{"$ref":"#/$defs/_r53"},"effect":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessEffect"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][lL][oO][wW]|[dD][eE][nN][yY]|[nN][oO][tT][-_][aA][pP][pP][lL][iI][cC][aA][bB][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Effect"},"resource_ref":{"$ref":"#/$defs/_r184"},"rule_id":{"$ref":"#/$defs/_r3"},"subject_ref":{"$ref":"#/$defs/_r186"}},"required":["rule_id","subject_ref","resource_ref"],"title":"RuntimeFileServiceAccessRule","type":"object"}, "RuntimeFileServiceCredentialClassification": {"description":"Semantic classification of a service-local credential.\n\nThe raw credential value MUST NOT be recorded; the principal model\nhas no field that can hold one. This vocabulary is the only credential\nrepresentation in the file-service surface \u2014 it describes the\nstrength/posture of the credential as observed (or its absence) so\ndownstream consumers can reason about exposure without leaking secret\nmaterial into fixtures, schemas, diagnostics, or logs.","enum":["no_credential","weak","default_or_trivial","strong","redacted","unknown","other"],"title":"RuntimeFileServiceCredentialClassification","type":"string"}, - "RuntimeFileServicePrincipal": {"additionalProperties":false,"description":"A service-local principal (Samba passdb-style account or group).\n\nService-local principals are NOT promoted to top-level ``accounts``,\n``runtime.local_identity``, or ``runtime.identity_authorities``.\nOptional ``local_user_ref`` and ``directory_subject_ref`` carry refs to\nthose surfaces when a mapping is observed.\n\nRaw credential material (passwords, NT/LM hashes, Kerberos keys, private\nkeys, bearer tokens, captured credentials) is unrepresentable on this\nrecord per ADR-037 \u00a74 and the secret-handling gate; only\n``credential_classification`` is carried, so the field surface itself\ncannot smuggle a secret into models, schemas, fixtures, diagnostics, or\nsnapshots.","properties":{"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceCredentialClassification"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][-_][cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[wW][eE][aA][kK]|[dD][eE][fF][aA][uU][lL][tT][-_][oO][rR][-_][tT][rR][iI][vV][iI][aA][lL]|[sS][tT][rR][oO][nN][gG]|[rR][eE][dD][aA][cC][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"directory_subject_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Directory Subject Ref","type":"string"},"external_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"External Id","type":"string"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[mM][aA][cC][hH][iI][nN][eE]|[aA][lL][iI][aA][sS]|[gG][uU][eE][sS][tT]|[aA][nN][oO][nN][yY][mM][oO][uU][sS]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"local_user_ref":{"$ref":"#/$defs/_r63"},"name":{"$ref":"#/$defs/_r176"},"origin":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalOrigin"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[pP][rR][oO][vV][iI][sS][iI][oO][nN][eE][dD]|[sS][yY][nN][cC][hH][rR][oO][nN][iI][zZ][eE][dD]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Origin"},"principal_id":{"$ref":"#/$defs/_r3"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[lL][oO][cC][kK][eE][dD]|[nN][oO][-_][lL][oO][gG][iI][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"}},"required":["principal_id","name"],"title":"RuntimeFileServicePrincipal","type":"object"}, + "RuntimeFileServicePrincipal": {"additionalProperties":false,"description":"A service-local principal (Samba passdb-style account or group).\n\nService-local principals are NOT promoted to top-level ``accounts``,\n``runtime.local_identity``, or ``runtime.identity_authorities``.\nOptional ``local_user_ref`` and ``directory_subject_ref`` carry refs to\nthose surfaces when a mapping is observed.\n\nRaw credential material (passwords, NT/LM hashes, Kerberos keys, private\nkeys, bearer tokens, captured credentials) is unrepresentable on this\nrecord per ADR-037 \u00a74 and the secret-handling gate; only\n``credential_classification`` is carried, so the field surface itself\ncannot smuggle a secret into models, schemas, fixtures, diagnostics, or\nsnapshots.","properties":{"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceCredentialClassification"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][-_][cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[wW][eE][aA][kK]|[dD][eE][fF][aA][uU][lL][tT][-_][oO][rR][-_][tT][rR][iI][vV][iI][aA][lL]|[sS][tT][rR][oO][nN][gG]|[rR][eE][dD][aA][cC][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"directory_subject_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Directory Subject Ref","type":"string"},"external_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"External Id","type":"string"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[mM][aA][cC][hH][iI][nN][eE]|[aA][lL][iI][aA][sS]|[gG][uU][eE][sS][tT]|[aA][nN][oO][nN][yY][mM][oO][uU][sS]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"local_user_ref":{"$ref":"#/$defs/_r63"},"name":{"$ref":"#/$defs/_r179"},"origin":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalOrigin"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[pP][rR][oO][vV][iI][sS][iI][oO][nN][eE][dD]|[sS][yY][nN][cC][hH][rR][oO][nN][iI][zZ][eE][dD]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Origin"},"principal_id":{"$ref":"#/$defs/_r3"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeFileServicePrincipalStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[lL][oO][cC][kK][eE][dD]|[nN][oO][-_][lL][oO][gG][iI][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"}},"required":["principal_id","name"],"title":"RuntimeFileServicePrincipal","type":"object"}, "RuntimeFileServicePrincipalKind": {"description":"Portable kind of a service-local principal in a file service.","enum":["user","group","machine","alias","guest","anonymous","service_account","other","unknown"],"title":"RuntimeFileServicePrincipalKind","type":"string"}, "RuntimeFileServicePrincipalOrigin": {"description":"Origin/provenance class for a service-local principal record.","enum":["built_in","provisioned","synchronized","runtime_created","operator","unknown","other"],"title":"RuntimeFileServicePrincipalOrigin","type":"string"}, "RuntimeFileServicePrincipalStatus": {"description":"Observed account status for a service-local principal.","enum":["enabled","disabled","locked","no_login","unknown","other"],"title":"RuntimeFileServicePrincipalStatus","type":"string"}, "RuntimeFileServiceProtocol": {"description":"Portable protocol family for an observed runtime file service.","enum":["smb","cifs","nfs","afp","ftp","sftp","webdav","object_store","other","unknown"],"title":"RuntimeFileServiceProtocol","type":"string"}, - "RuntimeFileServiceShare": {"additionalProperties":false,"description":"A published share/resource on a runtime file service.","properties":{"backing_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Backing Path","type":"string"},"browseable":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Browseable"},"comment":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Comment","type":"string"},"description":{"$ref":"#/$defs/_r53"},"guest_ok":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Guest Ok"},"invalid_users":{"items":{"$ref":"#/$defs/_r187"},"title":"Invalid Users","type":"array"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeFileShareKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][iI][sS][kK]|[iI][pP][cC]|[pP][rR][iI][nN][tT][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"disk","title":"Kind"},"name":{"$ref":"#/$defs/_r176"},"read_only":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Read Only"},"share_id":{"$ref":"#/$defs/_r3"},"valid_groups":{"items":{"$ref":"#/$defs/_r187"},"title":"Valid Groups","type":"array"},"valid_users":{"items":{"$ref":"#/$defs/_r187"},"title":"Valid Users","type":"array"},"write_users":{"items":{"$ref":"#/$defs/_r187"},"title":"Write Users","type":"array"}},"required":["share_id","name"],"title":"RuntimeFileServiceShare","type":"object"}, + "RuntimeFileServiceShare": {"additionalProperties":false,"description":"A published share/resource on a runtime file service.","properties":{"backing_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Backing Path","type":"string"},"browseable":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Browseable"},"comment":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Comment","type":"string"},"description":{"$ref":"#/$defs/_r53"},"guest_ok":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Guest Ok"},"invalid_users":{"items":{"$ref":"#/$defs/_r190"},"title":"Invalid Users","type":"array"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeFileShareKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][iI][sS][kK]|[iI][pP][cC]|[pP][rR][iI][nN][tT][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"disk","title":"Kind"},"name":{"$ref":"#/$defs/_r179"},"read_only":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Read Only"},"share_id":{"$ref":"#/$defs/_r3"},"valid_groups":{"items":{"$ref":"#/$defs/_r190"},"title":"Valid Groups","type":"array"},"valid_users":{"items":{"$ref":"#/$defs/_r190"},"title":"Valid Users","type":"array"},"write_users":{"items":{"$ref":"#/$defs/_r190"},"title":"Write Users","type":"array"}},"required":["share_id","name"],"title":"RuntimeFileServiceShare","type":"object"}, "RuntimeFileShareKind": {"description":"Observed kind of a published file-service share/resource.","enum":["disk","ipc","printer","other","unknown"],"title":"RuntimeFileShareKind","type":"string"}, - "RuntimeFilesystemEntry": {"additionalProperties":false,"description":"A filesystem entry observed inside a runtime node or container asset.","if":{"properties":{"presence":{"pattern":"^[Ee][Xx][Pp][Ee][Cc][Tt][Ee][Dd][_-][Aa][Bb][Ss][Ee][Nn][Tt]$"}},"required":["presence"]},"properties":{"content_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Digest","type":"string"},"description":{"$ref":"#/$defs/_r53"},"digest_algorithm":{"$ref":"#/$defs/_r55"},"entry_type":{"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemEntryType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][iI][lL][eE]|[dD][iI][rR][eE][cC][tT][oO][rR][yY]|[sS][yY][mM][lL][iI][nN][kK]|[dD][eE][vV][iI][cC][eE]|[sS][oO][cC][kK][eE][tT]|[fF][iI][fF][oO]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Entry Type"},"gid":{"$ref":"#/$defs/_r35"},"mode":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mode","type":"string"},"owner_group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner Group","type":"string"},"owner_user":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner User","type":"string"},"path":{"$ref":"#/$defs/_r178"},"presence":{"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemPresence"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][eE][sS][eE][nN][tT]|[eE][xX][pP][eE][cC][tT][eE][dD][-_][aA][bB][sS][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"present","title":"Presence"},"provenance":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Provenance","type":"string"},"sensitivity":{"$ref":"#/$defs/_r19"},"size":{"$ref":"#/$defs/_r38"},"source_path":{"$ref":"#/$defs/_r73"},"stability":{"$ref":"#/$defs/_r11"},"uid":{"$ref":"#/$defs/_r41"}},"required":["path"],"then":{"properties":{"content_digest":{"enum":["",null]},"digest_algorithm":{"enum":["",null]},"gid":{"enum":["",null]},"mode":{"enum":["",null]},"owner_group":{"enum":["",null]},"owner_user":{"enum":["",null]},"size":{"enum":["",null]},"uid":{"enum":["",null]}}},"title":"RuntimeFilesystemEntry","type":"object"}, + "RuntimeFilesystemEntry": {"additionalProperties":false,"description":"A filesystem entry observed inside a runtime node or container asset.","if":{"properties":{"presence":{"pattern":"^[Ee][Xx][Pp][Ee][Cc][Tt][Ee][Dd][_-][Aa][Bb][Ss][Ee][Nn][Tt]$"}},"required":["presence"]},"properties":{"content_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Digest","type":"string"},"description":{"$ref":"#/$defs/_r53"},"digest_algorithm":{"$ref":"#/$defs/_r55"},"entry_type":{"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemEntryType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[fF][iI][lL][eE]|[dD][iI][rR][eE][cC][tT][oO][rR][yY]|[sS][yY][mM][lL][iI][nN][kK]|[dD][eE][vV][iI][cC][eE]|[sS][oO][cC][kK][eE][tT]|[fF][iI][fF][oO]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Entry Type"},"gid":{"$ref":"#/$defs/_r35"},"mode":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mode","type":"string"},"owner_group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner Group","type":"string"},"owner_user":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Owner User","type":"string"},"path":{"$ref":"#/$defs/_r181"},"presence":{"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemPresence"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][eE][sS][eE][nN][tT]|[eE][xX][pP][eE][cC][tT][eE][dD][-_][aA][bB][sS][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"present","title":"Presence"},"provenance":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Provenance","type":"string"},"sensitivity":{"$ref":"#/$defs/_r19"},"size":{"$ref":"#/$defs/_r38"},"source_path":{"$ref":"#/$defs/_r73"},"stability":{"$ref":"#/$defs/_r11"},"uid":{"$ref":"#/$defs/_r41"}},"required":["path"],"then":{"properties":{"content_digest":{"enum":["",null]},"digest_algorithm":{"enum":["",null]},"gid":{"enum":["",null]},"mode":{"enum":["",null]},"owner_group":{"enum":["",null]},"owner_user":{"enum":["",null]},"size":{"enum":["",null]},"uid":{"enum":["",null]}}},"title":"RuntimeFilesystemEntry","type":"object"}, "RuntimeFilesystemEntryType": {"description":"Observed type of a runtime filesystem inventory entry.","enum":["file","directory","symlink","device","socket","fifo","other","unknown"],"title":"RuntimeFilesystemEntryType","type":"string"}, "RuntimeFilesystemPresence": {"description":"Observed presence state for a runtime filesystem inventory entry.\n\n``present`` is the default and preserves prior behavior. ``expected_absent``\nrecords an authored or expected path that was not observed at capture time \u2014\nfor example a deploy-key path attempted by setup code but missing in the\ncaptured steady state. Absent entries retain their expected ``entry_type``\ninstead of collapsing to ``other``; present-only facts (size, content\ndigest, owner ids, mode) must be omitted, per ADR-037.","enum":["present","expected_absent","unknown","other"],"title":"RuntimeFilesystemPresence","type":"string"}, "RuntimeFilesystemStability": {"description":"Stability class for an observed runtime filesystem or mount fact.","enum":["stable","generated","log","cache","runtime_created","volume_backed","transient","unknown","other"],"title":"RuntimeFilesystemStability","type":"string"}, @@ -348,91 +358,91 @@ "RuntimeForwardingAgentKind": {"description":"Portable forwarding-agent role discriminator (OPEN per the verdict).","enum":["log_forwarder","content_sync","unknown","other"],"title":"RuntimeForwardingAgentKind","type":"string"}, "RuntimeForwardingAgentOwnershipRole": {"description":"Closed ownership of an agent relative to the system under test.","enum":["system_under_test","measurement_apparatus"],"title":"RuntimeForwardingAgentOwnershipRole","type":"string"}, "RuntimeForwardingBufferCrypto": {"description":"Portable at-rest / in-transit crypto of a buffer policy (OPEN).","enum":["none","aes","tls","unknown","other"],"title":"RuntimeForwardingBufferCrypto","type":"string"}, - "RuntimeForwardingBufferPolicy": {"additionalProperties":false,"description":"The single observed buffer / back-pressure posture of a forwarder.\n\nCaptures the ``client_buffer`` shape: queue capacity, events-per-second\nceiling, at-rest/in-transit crypto, and reconnect interval. Its presence is\nthe defining profile a ``log_forwarder`` must carry.","properties":{"buffer_policy_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Buffer Policy Id","type":"string"},"crypto":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingBufferCrypto"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[aA][eE][sS]|[tT][lL][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Crypto"},"description":{"$ref":"#/$defs/_r53"},"eps":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Eps"},"queue_capacity":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Queue Capacity"},"reconnect_seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Reconnect Seconds"}},"required":["buffer_policy_id"],"title":"RuntimeForwardingBufferPolicy","type":"object"}, + "RuntimeForwardingBufferPolicy": {"additionalProperties":false,"description":"The single observed buffer / back-pressure posture of a forwarder.\n\nCaptures the ``client_buffer`` shape: queue capacity, events-per-second\nceiling, at-rest/in-transit crypto, and reconnect interval. Its presence is\nthe defining profile a ``log_forwarder`` must carry.","properties":{"buffer_policy_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Buffer Policy Id","type":"string"},"crypto":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingBufferCrypto"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[aA][eE][sS]|[tT][lL][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Crypto"},"description":{"$ref":"#/$defs/_r53"},"eps":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Eps"},"queue_capacity":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Queue Capacity"},"reconnect_seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Reconnect Seconds"}},"required":["buffer_policy_id"],"title":"RuntimeForwardingBufferPolicy","type":"object"}, "RuntimeForwardingEnrollmentClassification": {"description":"Redaction class for a ship-target enrollment identity (CLOSED).\n\nA fixed structural lattice \u2014 an enrollment credential is either absent\n(``none``) or present-but-not-recorded (``redacted`` / ``operator_secret``).\nRaw enrollment-key material is never carried; per the enum-sentinel\ndiscipline this closed set carries no ``unknown`` / ``other`` tail.","enum":["none","redacted","operator_secret"],"title":"RuntimeForwardingEnrollmentClassification","type":"string"}, "RuntimeForwardingParseFormat": {"description":"Portable on-the-wire / on-disk parse format of a source (OPEN).","enum":["json","syslog","eve_json","cef","leef","csv","text","stix","misp_json","unknown","other"],"title":"RuntimeForwardingParseFormat","type":"string"}, "RuntimeForwardingProtocol": {"description":"Portable wire protocol of a ship target (OPEN).","enum":["syslog","syslog_tls","syslog_tcp","beats","http","https","tcp","udp","kafka","unknown","other"],"title":"RuntimeForwardingProtocol","type":"string"}, "RuntimeForwardingReloadChannel": {"additionalProperties":false,"description":"An observed downstream reload channel a content-sync agent drives.\n\nReferences the downstream consumer's control channel (e.g. the Suricata\nrule-reload socket) rather than inventing a parallel socket model; the\ninter-node trust edge is carried by ``RelationshipForwardingEdge``.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingReloadChannelKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][nN][iI][xX][-_][sS][oO][cC][kK][eE][tT]|[sS][iI][gG][nN][aA][lL]|[hH][tT][tT][pP][-_][aA][pP][iI]|[cC][lL][iI]|[fF][iI][lL][eE][-_][dD][rR][oO][pP]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"reload_channel_id":{"$ref":"#/$defs/_r3"},"target_ref":{"$ref":"#/$defs/_r76"}},"required":["reload_channel_id"],"title":"RuntimeForwardingReloadChannel","type":"object"}, "RuntimeForwardingReloadChannelKind": {"description":"Portable control / reload channel family for a downstream consumer (OPEN).","enum":["unix_socket","signal","http_api","cli","file_drop","unknown","other"],"title":"RuntimeForwardingReloadChannelKind","type":"string"}, - "RuntimeForwardingSetting": {"additionalProperties":false,"description":"An observed forwarding-agent runtime setting with provenance and class.\n\nExplicit ``redacted`` / ``operator_secret`` classifications omit raw values;\ncredential-shaped names remain scenario content unless the author marks the\nvalue withheld.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingSettingClassification"},{"$ref":"#/$defs/_r161"}],"default":"plain","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[cC][oO][mM][mM][aA][nN][dD][-_][lL][iI][nN][eE]|[dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeForwardingSetting","type":"object"}, + "RuntimeForwardingSetting": {"additionalProperties":false,"description":"An observed forwarding-agent runtime setting with provenance and class.\n\nExplicit ``redacted`` / ``operator_secret`` classifications omit raw values;\ncredential-shaped names remain scenario content unless the author marks the\nvalue withheld.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingSettingClassification"},{"$ref":"#/$defs/_r164"}],"default":"plain","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[cC][oO][mM][mM][aA][nN][dD][-_][lL][iI][nN][eE]|[dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeForwardingSetting","type":"object"}, "RuntimeForwardingSettingClassification": {"description":"Redaction class for an observed forwarding setting value (CLOSED).\n\nThe fixed structural redaction lattice for a setting: a plain value, a\npresent-but-not-recorded secret, or an operator-only secret. Carries no\nopen tail by the enum-sentinel discipline.","enum":["plain","redacted","operator_secret"],"title":"RuntimeForwardingSettingClassification","type":"string"}, "RuntimeForwardingSettingProvenance": {"description":"Portable provenance of an observed forwarding setting (OPEN).","enum":["configuration_file","environment","command_line","default","unknown","other"],"title":"RuntimeForwardingSettingProvenance","type":"string"}, - "RuntimeForwardingShipTarget": {"additionalProperties":false,"description":"An observed downstream ship target (event ingest and/or enrollment).\n\n``ingestion_port`` is the event-ingest endpoint (e.g. ``wazuh.manager:1514``);\n``enrollment_port`` is the enrollment endpoint (e.g. ``:1515``). The\nenrollment identity itself is never recorded \u2014 only the closed\n``enrollment_identity_classification`` lattice (``none`` / ``redacted`` /\n``operator_secret``).","properties":{"description":{"$ref":"#/$defs/_r53"},"enrollment_identity_classification":{"$ref":"#/$defs/_r12"},"enrollment_port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Enrollment Port"},"ingestion_port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Ingestion Port"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][yY][sS][lL][oO][gG]|[sS][yY][sS][lL][oO][gG][-_][tT][lL][sS]|[sS][yY][sS][lL][oO][gG][-_][tT][cC][pP]|[bB][eE][aA][tT][sS]|[hH][tT][tT][pP]|[hH][tT][tT][pP][sS]|[tT][cC][pP]|[uU][dD][pP]|[kK][aA][fF][kK][aA]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Protocol"},"target_id":{"$ref":"#/$defs/_r3"},"target_node_ref":{"$ref":"#/$defs/_r75"},"target_service_ref":{"$ref":"#/$defs/_r77"}},"required":["target_id"],"title":"RuntimeForwardingShipTarget","type":"object"}, + "RuntimeForwardingShipTarget": {"additionalProperties":false,"description":"An observed downstream ship target (event ingest and/or enrollment).\n\n``ingestion_port`` is the event-ingest endpoint (e.g. ``wazuh.manager:1514``);\n``enrollment_port`` is the enrollment endpoint (e.g. ``:1515``). The\nenrollment identity itself is never recorded \u2014 only the closed\n``enrollment_identity_classification`` lattice (``none`` / ``redacted`` /\n``operator_secret``).","properties":{"description":{"$ref":"#/$defs/_r53"},"enrollment_identity_classification":{"$ref":"#/$defs/_r12"},"enrollment_port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Enrollment Port"},"ingestion_port":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Ingestion Port"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][yY][sS][lL][oO][gG]|[sS][yY][sS][lL][oO][gG][-_][tT][lL][sS]|[sS][yY][sS][lL][oO][gG][-_][tT][cC][pP]|[bB][eE][aA][tT][sS]|[hH][tT][tT][pP]|[hH][tT][tT][pP][sS]|[tT][cC][pP]|[uU][dD][pP]|[kK][aA][fF][kK][aA]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Protocol"},"target_id":{"$ref":"#/$defs/_r3"},"target_node_ref":{"$ref":"#/$defs/_r75"},"target_service_ref":{"$ref":"#/$defs/_r77"}},"required":["target_id"],"title":"RuntimeForwardingShipTarget","type":"object"}, "RuntimeForwardingSource": {"additionalProperties":false,"description":"An observed forwarder input source (tailed path, API pull, or queue).","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingSourceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][aA][iI][lL][eE][dD][-_][pP][aA][tT][hH]|[aA][pP][iI][-_][pP][uU][lL][lL]|[qQ][uU][eE][uU][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"location":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Location","type":"string"},"parse_format":{"$ref":"#/$defs/_r13"},"selector":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Selector","type":"string"},"source_id":{"$ref":"#/$defs/_r3"}},"required":["source_id"],"title":"RuntimeForwardingSource","type":"object"}, "RuntimeForwardingSourceKind": {"description":"Portable provenance family for a forwarder input source (OPEN).","enum":["tailed_path","api_pull","queue","unknown","other"],"title":"RuntimeForwardingSourceKind","type":"string"}, "RuntimeForwardingTransform": {"additionalProperties":false,"description":"An observed transform applied between a source and a ship target.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeForwardingTransformKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][tT][hH][rR][oO][uU][gG][hH]|[pP][aA][rR][sS][eE]|[iI][oO][cC][-_][tT][oO][-_][rR][uU][lL][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"sid_namespace":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Sid Namespace","type":"string"},"transform_id":{"$ref":"#/$defs/_r3"}},"required":["transform_id"],"title":"RuntimeForwardingTransform","type":"object"}, "RuntimeForwardingTransformKind": {"description":"Portable transform family applied between source and ship target (OPEN).","enum":["passthrough","parse","ioc_to_rule","unknown","other"],"title":"RuntimeForwardingTransformKind","type":"string"}, - "RuntimeIdentityAttribute": {"additionalProperties":false,"description":"Observed identity attribute or bounded setting.\n\nSecret-bearing names must not carry raw values. This keeps directory\npasswords, Kerberos keys, keytabs, tokens, and client secrets out of\nfixtures, diagnostics, schemas, and generated runtime artifacts.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"origin":{"$ref":"#/$defs/_r15"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityRecordOrigin"},{"$ref":"#/$defs/_r152"}],"default":"unknown","title":"Provenance"},"value_classification":{"$ref":"#/$defs/_r20"},"values":{"items":{"$ref":"#/$defs/_r187"},"title":"Values","type":"array"}},"required":["name"],"then":{"not":{"properties":{"values":{"minItems":1,"type":"array"}},"required":["values"]}},"title":"RuntimeIdentityAttribute","type":"object"}, + "RuntimeIdentityAttribute": {"additionalProperties":false,"description":"Observed identity attribute or bounded setting.\n\nSecret-bearing names must not carry raw values. This keeps directory\npasswords, Kerberos keys, keytabs, tokens, and client secrets out of\nfixtures, diagnostics, schemas, and generated runtime artifacts.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"origin":{"$ref":"#/$defs/_r15"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityRecordOrigin"},{"$ref":"#/$defs/_r155"}],"default":"unknown","title":"Provenance"},"value_classification":{"$ref":"#/$defs/_r20"},"values":{"items":{"$ref":"#/$defs/_r190"},"title":"Values","type":"array"}},"required":["name"],"then":{"not":{"properties":{"values":{"minItems":1,"type":"array"}},"required":["values"]}},"title":"RuntimeIdentityAttribute","type":"object"}, "RuntimeIdentityAuthority": {"additionalProperties":false,"description":"A node-scoped identity authority inventory.","properties":{"base_dn":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Base Dn","type":"string"},"description":{"$ref":"#/$defs/_r53"},"domain_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Domain Name","type":"string"},"identity_authority_id":{"$ref":"#/$defs/_r3"},"issuer":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Issuer","type":"string"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityAuthorityKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][iI][rR][eE][cC][tT][oO][rR][yY]|[dD][oO][mM][aA][iI][nN]|[kK][eE][rR][bB][eE][rR][oO][sS][-_][rR][eE][aA][lL][mM]|[iI][dD][eE][nN][tT][iI][tT][yY][-_][pP][rR][oO][vV][iI][dD][eE][rR]|[cC][lL][oO][uU][dD][-_][iI][aA][mM]|[aA][uU][tT][hH][oO][rR][iI][zZ][aA][tT][iI][oO][nN][-_][sS][yY][sS][tT][eE][mM]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"namespace":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Namespace","type":"string"},"policies":{"items":{"$ref":"#/$defs/RuntimeIdentityPolicy"},"title":"Policies","type":"array"},"realm":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Realm","type":"string"},"relationships":{"items":{"$ref":"#/$defs/RuntimeIdentityRelationship"},"title":"Relationships","type":"array"},"services":{"items":{"$ref":"#/$defs/RuntimeIdentityAuthorityService"},"title":"Services","type":"array"},"subjects":{"items":{"$ref":"#/$defs/RuntimeIdentitySubject"},"title":"Subjects","type":"array"},"tenant_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Tenant Id","type":"string"}},"required":["identity_authority_id"],"title":"RuntimeIdentityAuthority","type":"object"}, "RuntimeIdentityAuthorityKind": {"description":"Portable kind of identity authority represented by the inventory.","enum":["directory","domain","kerberos_realm","identity_provider","cloud_iam","authorization_system","other","unknown"],"title":"RuntimeIdentityAuthorityKind","type":"string"}, "RuntimeIdentityAuthorityProtocol": {"description":"Protocol or API family exposed by an identity authority service.","enum":["ldap","ldaps","kerberos","saml","oidc","oauth2","scim","ad_ds_rpc","graph_api","other","unknown"],"title":"RuntimeIdentityAuthorityProtocol","type":"string"}, "RuntimeIdentityAuthorityService": {"additionalProperties":false,"description":"A protocol/API endpoint associated with an identity authority.","properties":{"address":{"$ref":"#/$defs/_r47"},"description":{"$ref":"#/$defs/_r53"},"port":{"$ref":"#/$defs/_r37"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityAuthorityProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][dD][aA][pP]|[lL][dD][aA][pP][sS]|[kK][eE][rR][bB][eE][rR][oO][sS]|[sS][aA][mM][lL]|[oO][iI][dD][cC]|[oO][aA][uU][tT][hH]2|[sS][cC][iI][mM]|[aA][dD][-_][dD][sS][-_][rR][pP][cC]|[gG][rR][aA][pP][hH][-_][aA][pP][iI]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Protocol"},"service":{"$ref":"#/$defs/_r70"},"service_id":{"$ref":"#/$defs/_r3"}},"required":["service_id"],"title":"RuntimeIdentityAuthorityService","type":"object"}, - "RuntimeIdentityPolicy": {"additionalProperties":false,"description":"Observed identity authority policy or bounded policy setting group.","properties":{"applies_to_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Applies To Refs","type":"array"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"policy_id":{"$ref":"#/$defs/_r3"},"policy_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityPolicyKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][wW][oO][rR][dD]|[lL][oO][cC][kK][oO][uU][tT]|[kK][eE][rR][bB][eE][rR][oO][sS]|[aA][cC][cC][eE][sS][sS]|[cC][oO][nN][dD][iI][tT][iI][oO][nN][aA][lL][-_][aA][cC][cC][eE][sS][sS]|[mM][fF][aA]|[gG][rR][oO][uU][pP][-_][pP][oO][lL][iI][cC][yY]|[tT][rR][uU][sS][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Policy Kind"},"settings":{"items":{"$ref":"#/$defs/RuntimeIdentityAttribute"},"title":"Settings","type":"array"}},"required":["policy_id"],"title":"RuntimeIdentityPolicy","type":"object"}, + "RuntimeIdentityPolicy": {"additionalProperties":false,"description":"Observed identity authority policy or bounded policy setting group.","properties":{"applies_to_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Applies To Refs","type":"array"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"policy_id":{"$ref":"#/$defs/_r3"},"policy_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityPolicyKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][wW][oO][rR][dD]|[lL][oO][cC][kK][oO][uU][tT]|[kK][eE][rR][bB][eE][rR][oO][sS]|[aA][cC][cC][eE][sS][sS]|[cC][oO][nN][dD][iI][tT][iI][oO][nN][aA][lL][-_][aA][cC][cC][eE][sS][sS]|[mM][fF][aA]|[gG][rR][oO][uU][pP][-_][pP][oO][lL][iI][cC][yY]|[tT][rR][uU][sS][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Policy Kind"},"settings":{"items":{"$ref":"#/$defs/RuntimeIdentityAttribute"},"title":"Settings","type":"array"}},"required":["policy_id"],"title":"RuntimeIdentityPolicy","type":"object"}, "RuntimeIdentityPolicyKind": {"description":"Portable policy family attached to an identity authority.","enum":["password","lockout","kerberos","access","conditional_access","mfa","group_policy","trust","other","unknown"],"title":"RuntimeIdentityPolicyKind","type":"string"}, "RuntimeIdentityProvenance": {"description":"Origin class for an observed local identity record.","enum":["image","package","runtime_created","operator","unknown","other"],"title":"RuntimeIdentityProvenance","type":"string"}, "RuntimeIdentityRecordOrigin": {"description":"Origin class for an observed identity authority record.","enum":["built_in","directory","synchronized","federated","provisioned","runtime_created","operator","unknown","other"],"title":"RuntimeIdentityRecordOrigin","type":"string"}, "RuntimeIdentityRelationship": {"additionalProperties":false,"description":"Observed membership, trust, federation, or delegation relationship.","properties":{"description":{"$ref":"#/$defs/_r53"},"external_target":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"External Target","type":"string"},"relationship_id":{"$ref":"#/$defs/_r3"},"relationship_type":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentityRelationshipKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[mM][eE][mM][bB][eE][rR][-_][oO][fF]|[hH][aA][sS][-_][mM][eE][mM][bB][eE][rR]|[tT][rR][uU][sS][tT][sS]|[fF][eE][dD][eE][rR][aA][tT][eE][sS][-_][wW][iI][tT][hH]|[mM][aA][nN][aA][gG][eE][sS]|[oO][wW][nN][sS]|[dD][eE][lL][eE][gG][aA][tT][eE][dD][-_][aA][dD][mM][iI][nN]|[sS][yY][nN][cC][sS][-_][fF][rR][oO][mM]|[aA][sS][sS][oO][cC][iI][aA][tT][eE][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Relationship Type"},"source_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Ref","type":"string"},"target_ref":{"$ref":"#/$defs/_r76"}},"required":["relationship_id","source_ref"],"title":"RuntimeIdentityRelationship","type":"object"}, "RuntimeIdentityRelationshipKind": {"description":"Portable relationship kind between authority-local identity objects.","enum":["member_of","has_member","trusts","federates_with","manages","owns","delegated_admin","syncs_from","associated","other","unknown"],"title":"RuntimeIdentityRelationshipKind","type":"string"}, - "RuntimeIdentitySubject": {"additionalProperties":false,"description":"An authority-local user, group, device, role, or service principal.","properties":{"attributes":{"items":{"$ref":"#/$defs/RuntimeIdentityAttribute"},"title":"Attributes","type":"array"},"description":{"$ref":"#/$defs/_r53"},"display_name":{"$ref":"#/$defs/_r56"},"distinguished_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Distinguished Name","type":"string"},"domain":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Domain","type":"string"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentitySubjectKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[cC][oO][mM][pP][uU][tT][eE][rR]|[dD][eE][vV][iI][cC][eE]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[sS][eE][rR][vV][iI][cC][eE][-_][pP][rR][iI][nN][cC][iI][pP][aA][lL]|[rR][oO][lL][eE]|[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[oO][rR][gG][aA][nN][iI][zZ][aA][tT][iI][oO][nN][aA][lL][-_][uU][nN][iI][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r176"},"origin":{"$ref":"#/$defs/_r15"},"principal_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Principal Name","type":"string"},"service_principal_names":{"items":{"$ref":"#/$defs/_r187"},"title":"Service Principal Names","type":"array"},"subject_id":{"$ref":"#/$defs/_r3"}},"required":["subject_id","name"],"title":"RuntimeIdentitySubject","type":"object"}, + "RuntimeIdentitySubject": {"additionalProperties":false,"description":"An authority-local user, group, device, role, or service principal.","properties":{"attributes":{"items":{"$ref":"#/$defs/RuntimeIdentityAttribute"},"title":"Attributes","type":"array"},"description":{"$ref":"#/$defs/_r53"},"display_name":{"$ref":"#/$defs/_r56"},"distinguished_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Distinguished Name","type":"string"},"domain":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Domain","type":"string"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeIdentitySubjectKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[cC][oO][mM][pP][uU][tT][eE][rR]|[dD][eE][vV][iI][cC][eE]|[sS][eE][rR][vV][iI][cC][eE][-_][aA][cC][cC][oO][uU][nN][tT]|[sS][eE][rR][vV][iI][cC][eE][-_][pP][rR][iI][nN][cC][iI][pP][aA][lL]|[rR][oO][lL][eE]|[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[oO][rR][gG][aA][nN][iI][zZ][aA][tT][iI][oO][nN][aA][lL][-_][uU][nN][iI][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r179"},"origin":{"$ref":"#/$defs/_r15"},"principal_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Principal Name","type":"string"},"service_principal_names":{"items":{"$ref":"#/$defs/_r190"},"title":"Service Principal Names","type":"array"},"subject_id":{"$ref":"#/$defs/_r3"}},"required":["subject_id","name"],"title":"RuntimeIdentitySubject","type":"object"}, "RuntimeIdentitySubjectKind": {"description":"Portable subject/principal kind within an identity authority.","enum":["user","group","computer","device","service_account","service_principal","role","application","organizational_unit","other","unknown"],"title":"RuntimeIdentitySubjectKind","type":"string"}, - "RuntimeInitProcess": {"additionalProperties":false,"description":"Required backend-injected container init / PID-1 reaper configuration.\n\nModels authored container runtime intent \u2014 for example Docker Compose\n``init: true`` causing PID 1 to be ``/sbin/docker-init`` (tini). This is\ndistinct from the observed PID-1 process recorded in\n``runtime.processes``; see ADR-027.","if":{"properties":{"argv_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["argv_redacted"]},"properties":{"argv":{"items":{"$ref":"#/$defs/_r187"},"title":"Argv","type":"array"},"argv_redacted":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Argv Redacted"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"executable_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Executable Path","type":"string"},"implementation":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Implementation","type":"string"},"reaps_children":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Reaps Children"}},"then":{"properties":{"argv":{"maxItems":0}}},"title":"RuntimeInitProcess","type":"object"}, + "RuntimeInitProcess": {"additionalProperties":false,"description":"Required backend-injected container init / PID-1 reaper configuration.\n\nModels authored container runtime intent \u2014 for example Docker Compose\n``init: true`` causing PID 1 to be ``/sbin/docker-init`` (tini). This is\ndistinct from the observed PID-1 process recorded in\n``runtime.processes``; see ADR-027.","if":{"properties":{"argv_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["argv_redacted"]},"properties":{"argv":{"items":{"$ref":"#/$defs/_r190"},"title":"Argv","type":"array"},"argv_redacted":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Argv Redacted"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"executable_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Executable Path","type":"string"},"implementation":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Implementation","type":"string"},"reaps_children":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Reaps Children"}},"then":{"properties":{"argv":{"maxItems":0}}},"title":"RuntimeInitProcess","type":"object"}, "RuntimeListenerAddressFamily": {"description":"Address family observed for a runtime listener.","enum":["ipv4","ipv6","unix","unspecified","other","unknown"],"title":"RuntimeListenerAddressFamily","type":"string"}, "RuntimeListenerProtocol": {"description":"Transport or IPC family for an observed listener.","enum":["tcp","udp","sctp","unix","other","unknown"],"title":"RuntimeListenerProtocol","type":"string"}, "RuntimeListenerProvenance": {"description":"Source class for an observed runtime listener fact.","enum":["osquery","ss","netstat","lsof","nmap","docker_inspect","kubernetes","systemd","operator","scanner","unknown","other"],"title":"RuntimeListenerProvenance","type":"string"}, - "RuntimeListenerReadiness": {"additionalProperties":false,"description":"Optional readiness/probe evidence for an observed listener.","properties":{"criteria":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Criteria","type":"string"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"probe":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Probe","type":"string"}},"title":"RuntimeListenerReadiness","type":"object"}, + "RuntimeListenerReadiness": {"additionalProperties":false,"description":"Optional readiness/probe evidence for an observed listener.","properties":{"criteria":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Criteria","type":"string"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"probe":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Probe","type":"string"}},"title":"RuntimeListenerReadiness","type":"object"}, "RuntimeListenerScope": {"description":"Reachability class of the bind endpoint in the node namespace.","enum":["wildcard","loopback_only","network_facing","node_local","local_socket","unknown","other"],"title":"RuntimeListenerScope","type":"string"}, - "RuntimeLocalGroup": {"additionalProperties":false,"description":"A local group record observed in a node's identity database (/etc/group).","properties":{"description":{"$ref":"#/$defs/_r53"},"gid":{"$ref":"#/$defs/_r35"},"members":{"items":{"$ref":"#/$defs/_r187"},"title":"Members","type":"array"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"$ref":"#/$defs/_r14"}},"required":["name"],"title":"RuntimeLocalGroup","type":"object"}, + "RuntimeLocalGroup": {"additionalProperties":false,"description":"A local group record observed in a node's identity database (/etc/group).","properties":{"description":{"$ref":"#/$defs/_r53"},"gid":{"$ref":"#/$defs/_r35"},"members":{"items":{"$ref":"#/$defs/_r190"},"title":"Members","type":"array"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"$ref":"#/$defs/_r14"}},"required":["name"],"title":"RuntimeLocalGroup","type":"object"}, "RuntimeLocalIdentityInventory": {"additionalProperties":false,"description":"Observed local identity database (users, groups, sudo rules) for a node.","properties":{"description":{"$ref":"#/$defs/_r53"},"groups":{"items":{"$ref":"#/$defs/RuntimeLocalGroup"},"title":"Groups","type":"array"},"sudo_rules":{"items":{"$ref":"#/$defs/RuntimeSudoRule"},"title":"Sudo Rules","type":"array"},"users":{"items":{"$ref":"#/$defs/RuntimeLocalUser"},"title":"Users","type":"array"}},"title":"RuntimeLocalIdentityInventory","type":"object"}, - "RuntimeLocalUser": {"additionalProperties":false,"description":"A local user record observed in a node's identity database (/etc/passwd).","properties":{"description":{"$ref":"#/$defs/_r53"},"disabled":{"$ref":"#/$defs/_r33"},"gecos":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gecos","type":"string"},"home":{"$ref":"#/$defs/_r60"},"locked":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Locked"},"no_login":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"No Login"},"primary_gid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Primary Gid"},"primary_group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Primary Group","type":"string"},"provenance":{"$ref":"#/$defs/_r14"},"shell":{"$ref":"#/$defs/_r72"},"stability":{"$ref":"#/$defs/_r11"},"supplemental_groups":{"items":{"$ref":"#/$defs/_r187"},"title":"Supplemental Groups","type":"array"},"uid":{"$ref":"#/$defs/_r41"},"username":{"$ref":"#/$defs/_r185"}},"required":["username"],"title":"RuntimeLocalUser","type":"object"}, - "RuntimeMailAlias": {"additionalProperties":false,"description":"A service-local mailbox alias or forwarding address.","properties":{"address":{"$ref":"#/$defs/_r47"},"alias_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"external_targets":{"items":{"$ref":"#/$defs/_r187"},"title":"External Targets","type":"array"},"target_refs":{"$ref":"#/$defs/_r130"}},"required":["alias_id"],"title":"RuntimeMailAlias","type":"object"}, + "RuntimeLocalUser": {"additionalProperties":false,"description":"A local user record observed in a node's identity database (/etc/passwd).","properties":{"description":{"$ref":"#/$defs/_r53"},"disabled":{"$ref":"#/$defs/_r33"},"gecos":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gecos","type":"string"},"home":{"$ref":"#/$defs/_r60"},"locked":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Locked"},"no_login":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"No Login"},"primary_gid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Primary Gid"},"primary_group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Primary Group","type":"string"},"provenance":{"$ref":"#/$defs/_r14"},"shell":{"$ref":"#/$defs/_r72"},"stability":{"$ref":"#/$defs/_r11"},"supplemental_groups":{"items":{"$ref":"#/$defs/_r190"},"title":"Supplemental Groups","type":"array"},"uid":{"$ref":"#/$defs/_r41"},"username":{"$ref":"#/$defs/_r188"}},"required":["username"],"title":"RuntimeLocalUser","type":"object"}, + "RuntimeMailAlias": {"additionalProperties":false,"description":"A service-local mailbox alias or forwarding address.","properties":{"address":{"$ref":"#/$defs/_r47"},"alias_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"external_targets":{"items":{"$ref":"#/$defs/_r190"},"title":"External Targets","type":"array"},"target_refs":{"$ref":"#/$defs/_r133"}},"required":["alias_id"],"title":"RuntimeMailAlias","type":"object"}, "RuntimeMailAuthMechanism": {"description":"Portable mail authentication mechanism vocabulary.","enum":["none","plain","login","cram_md5","digest_md5","scram_sha_1","scram_sha_256","oauthbearer","external","anonymous","other","unknown"],"title":"RuntimeMailAuthMechanism","type":"string"}, - "RuntimeMailComponent": {"additionalProperties":false,"description":"A mail-service engine/component such as Postfix, Dovecot, or a filter.","properties":{"component_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailComponentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[mM][tT][aA]|[mM][dD][aA]|[iI][mM][aA][pP][-_][sS][eE][rR][vV][eE][rR]|[pP][oO][pP]3[-_][sS][eE][rR][vV][eE][rR]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN][-_][aA][gG][eE][nN][tT]|[mM][aA][iI][lL][bB][oO][xX][-_][sS][tT][oO][rR][eE]|[sS][pP][aA][mM][-_][fF][iI][lL][tT][eE][rR]|[aA][nN][tT][iI][vV][iI][rR][uU][sS]|[qQ][uU][eE][uU][eE][-_][mM][aA][nN][aA][gG][eE][rR]|[rR][eE][lL][aA][yY]|[pP][oO][lL][iI][cC][yY][-_][sS][eE][rR][vV][iI][cC][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r176"},"version":{"$ref":"#/$defs/_r81"}},"required":["component_id","name"],"title":"RuntimeMailComponent","type":"object"}, + "RuntimeMailComponent": {"additionalProperties":false,"description":"A mail-service engine/component such as Postfix, Dovecot, or a filter.","properties":{"component_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailComponentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[mM][tT][aA]|[mM][dD][aA]|[iI][mM][aA][pP][-_][sS][eE][rR][vV][eE][rR]|[pP][oO][pP]3[-_][sS][eE][rR][vV][eE][rR]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN][-_][aA][gG][eE][nN][tT]|[mM][aA][iI][lL][bB][oO][xX][-_][sS][tT][oO][rR][eE]|[sS][pP][aA][mM][-_][fF][iI][lL][tT][eE][rR]|[aA][nN][tT][iI][vV][iI][rR][uU][sS]|[qQ][uU][eE][uU][eE][-_][mM][aA][nN][aA][gG][eE][rR]|[rR][eE][lL][aA][yY]|[pP][oO][lL][iI][cC][yY][-_][sS][eE][rR][vV][iI][cC][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r179"},"version":{"$ref":"#/$defs/_r81"}},"required":["component_id","name"],"title":"RuntimeMailComponent","type":"object"}, "RuntimeMailComponentKind": {"description":"Portable component kind inside a runtime mail service.","enum":["mta","mda","imap_server","pop3_server","submission_agent","mailbox_store","spam_filter","antivirus","queue_manager","relay","policy_service","other","unknown"],"title":"RuntimeMailComponentKind","type":"string"}, "RuntimeMailCredentialClassification": {"description":"Semantic classification of a mailbox credential, never its raw value.","enum":["no_credential","weak","default_or_trivial","fixture","strong","redacted","unknown","other"],"title":"RuntimeMailCredentialClassification","type":"string"}, - "RuntimeMailDomain": {"additionalProperties":false,"description":"A domain known to the runtime mail service.","properties":{"description":{"$ref":"#/$defs/_r53"},"domain_id":{"$ref":"#/$defs/_r3"},"name":{"$ref":"#/$defs/_r176"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailDomainRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][cC][aA][lL][-_][dD][eE][lL][iI][vV][eE][rR][yY]|[vV][iI][rR][tT][uU][aA][lL]|[rR][eE][lL][aA][yY]|[aA][lL][iI][aA][sS]|[cC][aA][tT][cC][hH][-_][aA][lL][lL]|[oO][uU][tT][bB][oO][uU][nN][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"}},"required":["domain_id","name"],"title":"RuntimeMailDomain","type":"object"}, + "RuntimeMailDomain": {"additionalProperties":false,"description":"A domain known to the runtime mail service.","properties":{"description":{"$ref":"#/$defs/_r53"},"domain_id":{"$ref":"#/$defs/_r3"},"name":{"$ref":"#/$defs/_r179"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailDomainRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][cC][aA][lL][-_][dD][eE][lL][iI][vV][eE][rR][yY]|[vV][iI][rR][tT][uU][aA][lL]|[rR][eE][lL][aA][yY]|[aA][lL][iI][aA][sS]|[cC][aA][tT][cC][hH][-_][aA][lL][lL]|[oO][uU][tT][bB][oO][uU][nN][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"}},"required":["domain_id","name"],"title":"RuntimeMailDomain","type":"object"}, "RuntimeMailDomainRole": {"description":"Role of a domain known to the mail service.","enum":["local_delivery","virtual","relay","alias","catch_all","outbound","other","unknown"],"title":"RuntimeMailDomainRole","type":"string"}, - "RuntimeMailListener": {"additionalProperties":false,"description":"A protocol listener bound to a same-node transport service.","properties":{"advertised_identity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Advertised Identity","type":"string"},"auth_mechanisms":{"$ref":"#/$defs/_r92"},"banner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Banner","type":"string"},"capabilities":{"items":{"$ref":"#/$defs/_r187"},"title":"Capabilities","type":"array"},"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"listener_id":{"$ref":"#/$defs/_r3"},"protocol":{"$ref":"#/$defs/_r17"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailListenerRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][bB][oO][uU][nN][dD][-_][mM][xX]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN]|[mM][aA][iI][lL][-_][aA][cC][cC][eE][sS][sS]|[lL][oO][cC][aA][lL][-_][dD][eE][lL][iI][vV][eE][rR][yY]|[rR][eE][lL][aA][yY]|[lL][mM][tT][pP]|[sS][iI][eE][vV][eE]|[mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"},"service":{"$ref":"#/$defs/_r70"},"tls_mode":{"$ref":"#/$defs/_r18"},"tls_versions":{"items":{"$ref":"#/$defs/_r187"},"title":"Tls Versions","type":"array"}},"required":["listener_id"],"title":"RuntimeMailListener","type":"object"}, + "RuntimeMailListener": {"additionalProperties":false,"description":"A protocol listener bound to a same-node transport service.","properties":{"advertised_identity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Advertised Identity","type":"string"},"auth_mechanisms":{"$ref":"#/$defs/_r92"},"banner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Banner","type":"string"},"capabilities":{"items":{"$ref":"#/$defs/_r190"},"title":"Capabilities","type":"array"},"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"listener_id":{"$ref":"#/$defs/_r3"},"protocol":{"$ref":"#/$defs/_r17"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailListenerRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][bB][oO][uU][nN][dD][-_][mM][xX]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN]|[mM][aA][iI][lL][-_][aA][cC][cC][eE][sS][sS]|[lL][oO][cC][aA][lL][-_][dD][eE][lL][iI][vV][eE][rR][yY]|[rR][eE][lL][aA][yY]|[lL][mM][tT][pP]|[sS][iI][eE][vV][eE]|[mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"},"service":{"$ref":"#/$defs/_r70"},"tls_mode":{"$ref":"#/$defs/_r18"},"tls_versions":{"items":{"$ref":"#/$defs/_r190"},"title":"Tls Versions","type":"array"}},"required":["listener_id"],"title":"RuntimeMailListener","type":"object"}, "RuntimeMailListenerRole": {"description":"Observed role a mail listener plays for the node-scoped mail service.","enum":["inbound_mx","submission","mail_access","local_delivery","relay","lmtp","sieve","monitoring","other","unknown"],"title":"RuntimeMailListenerRole","type":"string"}, - "RuntimeMailMailbox": {"additionalProperties":false,"description":"A service-local mailbox/account record.\n\nRaw credentials are intentionally unrepresentable. The model records only\nauthentication mechanisms and credential-strength classification.","properties":{"account_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Account Ref","type":"string"},"address":{"$ref":"#/$defs/_r170"},"auth_mechanisms":{"$ref":"#/$defs/_r92"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeMailCredentialClassification"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][-_][cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[wW][eE][aA][kK]|[dD][eE][fF][aA][uU][lL][tT][-_][oO][rR][-_][tT][rR][iI][vV][iI][aA][lL]|[fF][iI][xX][tT][uU][rR][eE]|[sS][tT][rR][oO][nN][gG]|[rR][eE][dD][aA][cC][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"local_part":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Local Part","type":"string"},"local_user_ref":{"$ref":"#/$defs/_r63"},"mailbox_id":{"$ref":"#/$defs/_r3"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailMailboxRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[aA][dD][mM][iI][nN]|[sS][eE][rR][vV][iI][cC][eE]|[sS][hH][aA][rR][eE][dD]|[pP][oO][sS][tT][mM][aA][sS][tT][eE][rR]|[aA][bB][uU][sS][eE]|[aA][uU][tT][oO][mM][aA][tT][eE][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"user","title":"Role"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeMailMailboxStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[lL][oO][cC][kK][eE][dD]|[sS][uU][sS][pP][eE][nN][dD][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"},"store_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Store Ref","type":"string"}},"required":["mailbox_id","address"],"title":"RuntimeMailMailbox","type":"object"}, + "RuntimeMailMailbox": {"additionalProperties":false,"description":"A service-local mailbox/account record.\n\nRaw credentials are intentionally unrepresentable. The model records only\nauthentication mechanisms and credential-strength classification.","properties":{"account_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Account Ref","type":"string"},"address":{"$ref":"#/$defs/_r173"},"auth_mechanisms":{"$ref":"#/$defs/_r92"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimeMailCredentialClassification"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][-_][cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[wW][eE][aA][kK]|[dD][eE][fF][aA][uU][lL][tT][-_][oO][rR][-_][tT][rR][iI][vV][iI][aA][lL]|[fF][iI][xX][tT][uU][rR][eE]|[sS][tT][rR][oO][nN][gG]|[rR][eE][dD][aA][cC][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"domain_ref":{"$ref":"#/$defs/_r57"},"local_part":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Local Part","type":"string"},"local_user_ref":{"$ref":"#/$defs/_r63"},"mailbox_id":{"$ref":"#/$defs/_r3"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeMailMailboxRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[aA][dD][mM][iI][nN]|[sS][eE][rR][vV][iI][cC][eE]|[sS][hH][aA][rR][eE][dD]|[pP][oO][sS][tT][mM][aA][sS][tT][eE][rR]|[aA][bB][uU][sS][eE]|[aA][uU][tT][oO][mM][aA][tT][eE][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"user","title":"Role"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeMailMailboxStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[lL][oO][cC][kK][eE][dD]|[sS][uU][sS][pP][eE][nN][dD][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"},"store_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Store Ref","type":"string"}},"required":["mailbox_id","address"],"title":"RuntimeMailMailbox","type":"object"}, "RuntimeMailMailboxRole": {"description":"Portable role/classification of a service-local mailbox.","enum":["user","admin","service","shared","postmaster","abuse","automated","other","unknown"],"title":"RuntimeMailMailboxRole","type":"string"}, "RuntimeMailMailboxStatus": {"description":"Observed account status for a service-local mailbox.","enum":["enabled","disabled","locked","suspended","unknown","other"],"title":"RuntimeMailMailboxStatus","type":"string"}, "RuntimeMailMailboxStore": {"additionalProperties":false,"description":"Mailbox storage backing for service-local mailboxes.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailMailboxStoreKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[mM][aA][iI][lL][dD][iI][rR]|[mM][bB][oO][xX]|[dD][aA][tT][aA][bB][aA][sS][eE]|[oO][bB][jJ][eE][cC][tT][-_][sS][tT][oO][rR][eE]|[rR][eE][mM][oO][tT][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"path":{"$ref":"#/$defs/_r65"},"store_id":{"$ref":"#/$defs/_r3"}},"required":["store_id"],"title":"RuntimeMailMailboxStore","type":"object"}, "RuntimeMailMailboxStoreKind": {"description":"Observed mailbox storage backing kind.","enum":["maildir","mbox","database","object_store","remote","other","unknown"],"title":"RuntimeMailMailboxStoreKind","type":"string"}, "RuntimeMailProtocol": {"description":"Portable protocol family for a runtime mail listener or relationship.","enum":["smtp","esmtp","submission","smtps","imap","imaps","pop3","pop3s","lmtp","sieve","other","unknown"],"title":"RuntimeMailProtocol","type":"string"}, - "RuntimeMailQueue": {"additionalProperties":false,"description":"Shape of a mail queue; dynamic content is explicitly classified.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailQueueKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][cC][oO][mM][iI][nN][gG]|[aA][cC][tT][iI][vV][eE]|[dD][eE][fF][eE][rR][rR][eE][dD]|[hH][oO][lL][dD]|[bB][oO][uU][nN][cC][eE]|[cC][oO][rR][rR][uU][pP][tT]|[mM][aA][iI][lL][dD][rR][oO][pP]|[mM][aA][iI][lL][bB][oO][xX]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"message_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Message Count"},"name":{"$ref":"#/$defs/_r64"},"queue_id":{"$ref":"#/$defs/_r3"},"stability":{"anyOf":[{"$ref":"#/$defs/RuntimeMailQueueStability"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][tT][eE][aA][dD][yY][-_][sS][tT][aA][tT][eE]|[dD][yY][nN][aA][mM][iI][cC]|[vV][oO][lL][aA][tT][iI][lL][eE]|[lL][oO][gG][-_][dD][eE][rR][iI][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"dynamic","title":"Stability"}},"required":["queue_id"],"title":"RuntimeMailQueue","type":"object"}, + "RuntimeMailQueue": {"additionalProperties":false,"description":"Shape of a mail queue; dynamic content is explicitly classified.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailQueueKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][cC][oO][mM][iI][nN][gG]|[aA][cC][tT][iI][vV][eE]|[dD][eE][fF][eE][rR][rR][eE][dD]|[hH][oO][lL][dD]|[bB][oO][uU][nN][cC][eE]|[cC][oO][rR][rR][uU][pP][tT]|[mM][aA][iI][lL][dD][rR][oO][pP]|[mM][aA][iI][lL][bB][oO][xX]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"message_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Message Count"},"name":{"$ref":"#/$defs/_r64"},"queue_id":{"$ref":"#/$defs/_r3"},"stability":{"anyOf":[{"$ref":"#/$defs/RuntimeMailQueueStability"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][tT][eE][aA][dD][yY][-_][sS][tT][aA][tT][eE]|[dD][yY][nN][aA][mM][iI][cC]|[vV][oO][lL][aA][tT][iI][lL][eE]|[lL][oO][gG][-_][dD][eE][rR][iI][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"dynamic","title":"Stability"}},"required":["queue_id"],"title":"RuntimeMailQueue","type":"object"}, "RuntimeMailQueueKind": {"description":"Observed mail queue kind.","enum":["incoming","active","deferred","hold","bounce","corrupt","maildrop","mailbox","other","unknown"],"title":"RuntimeMailQueueKind","type":"string"}, "RuntimeMailQueueStability": {"description":"Stability class for dynamic mail queue facts.","enum":["steady_state","dynamic","volatile","log_derived","unknown","other"],"title":"RuntimeMailQueueStability","type":"string"}, "RuntimeMailRoutingKind": {"description":"Portable mail routing/aliasing rule kind.","enum":["alias","forward","virtual_alias","relay","local_delivery","catch_all","list","other","unknown"],"title":"RuntimeMailRoutingKind","type":"string"}, "RuntimeMailRoutingRule": {"additionalProperties":false,"description":"A portable routing, aliasing, local-delivery, or relay rule.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMailRoutingKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][iI][aA][sS]|[fF][oO][rR][wW][aA][rR][dD]|[vV][iI][rR][tT][uU][aA][lL][-_][aA][lL][iI][aA][sS]|[rR][eE][lL][aA][yY]|[lL][oO][cC][aA][lL][-_][dD][eE][lL][iI][vV][eE][rR][yY]|[cC][aA][tT][cC][hH][-_][aA][lL][lL]|[lL][iI][sS][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"relay_host":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Relay Host","type":"string"},"rule_id":{"$ref":"#/$defs/_r3"},"source_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Ref","type":"string"},"target_ref":{"$ref":"#/$defs/_r76"}},"required":["rule_id"],"title":"RuntimeMailRoutingRule","type":"object"}, "RuntimeMailService": {"additionalProperties":false,"description":"A node-scoped runtime mail-service logical inventory.","properties":{"aliases":{"items":{"$ref":"#/$defs/RuntimeMailAlias"},"title":"Aliases","type":"array"},"components":{"items":{"$ref":"#/$defs/RuntimeMailComponent"},"title":"Components","type":"array"},"description":{"$ref":"#/$defs/_r53"},"domains":{"items":{"$ref":"#/$defs/RuntimeMailDomain"},"title":"Domains","type":"array"},"engine":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Engine","type":"string"},"listeners":{"items":{"$ref":"#/$defs/RuntimeMailListener"},"title":"Listeners","type":"array"},"mail_service_id":{"$ref":"#/$defs/_r3"},"mailbox_stores":{"items":{"$ref":"#/$defs/RuntimeMailMailboxStore"},"title":"Mailbox Stores","type":"array"},"mailboxes":{"items":{"$ref":"#/$defs/RuntimeMailMailbox"},"title":"Mailboxes","type":"array"},"name":{"$ref":"#/$defs/_r64"},"queues":{"items":{"$ref":"#/$defs/RuntimeMailQueue"},"title":"Queues","type":"array"},"routing_rules":{"items":{"$ref":"#/$defs/RuntimeMailRoutingRule"},"title":"Routing Rules","type":"array"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimeMailSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"}},"required":["mail_service_id"],"title":"RuntimeMailService","type":"object"}, - "RuntimeMailSetting": {"additionalProperties":false,"description":"A mail-service runtime setting with source/provenance and redaction.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeMailSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[cC][oO][mM][mM][aA][nN][dD][-_][oO][uU][tT][pP][uU][tT]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"source_path":{"$ref":"#/$defs/_r73"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["setting_id","name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeMailSetting","type":"object"}, + "RuntimeMailSetting": {"additionalProperties":false,"description":"A mail-service runtime setting with source/provenance and redaction.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeMailSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[cC][oO][mM][mM][aA][nN][dD][-_][oO][uU][tT][pP][uU][tT]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"source_path":{"$ref":"#/$defs/_r73"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["setting_id","name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeMailSetting","type":"object"}, "RuntimeMailSettingProvenance": {"description":"Origin/provenance class for a mail-service configuration setting.","enum":["configuration_file","command_output","image_default","operator_override","runtime_default","environment","unknown","other"],"title":"RuntimeMailSettingProvenance","type":"string"}, "RuntimeMailTlsMode": {"description":"Observed TLS/STARTTLS posture for a mail listener or relationship.","enum":["none","starttls_available","starttls_required","implicit_tls","tls_terminated_upstream","unknown","other"],"title":"RuntimeMailTlsMode","type":"string"}, - "RuntimeMount": {"additionalProperties":false,"allOf":[{"if":{"properties":{"source_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["source_sensitivity"]},"then":{"not":{"properties":{"source":{"minLength":1,"type":"string"}},"required":["source"]}}},{"if":{"properties":{"options_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["options_sensitivity"]},"then":{"not":{"properties":{"options":{"minItems":1,"type":"array"}},"required":["options"]}}}],"description":"A filesystem mount observed on a runtime node.","properties":{"backend_generated":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Backend Generated"},"description":{"$ref":"#/$defs/_r53"},"filesystem_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Filesystem Type","type":"string"},"options":{"items":{"$ref":"#/$defs/_r187"},"title":"Options","type":"array"},"options_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Options Sensitivity"},"propagation":{"anyOf":[{"$ref":"#/$defs/RuntimeMountPropagation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][vV][aA][tT][eE]|[rR][pP][rR][iI][vV][aA][tT][eE]|[sS][hH][aA][rR][eE][dD]|[rR][sS][hH][aA][rR][eE][dD]|[sS][lL][aA][vV][eE]|[rR][sS][lL][aA][vV][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Propagation"},"read_only":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Read Only"},"source":{"$ref":"#/$defs/_r74"},"source_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMountSourceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[vV][oO][lL][uU][mM][eE]|[bB][iI][nN][dD]|[tT][mM][pP][fF][sS]|[iI][mM][aA][gG][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Source Kind"},"source_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Source Sensitivity"},"stability":{"$ref":"#/$defs/_r11"},"target":{"$ref":"#/$defs/_r184"}},"required":["target"],"title":"RuntimeMount","type":"object"}, + "RuntimeMount": {"additionalProperties":false,"allOf":[{"if":{"properties":{"source_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["source_sensitivity"]},"then":{"not":{"properties":{"source":{"minLength":1,"type":"string"}},"required":["source"]}}},{"if":{"properties":{"options_sensitivity":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["options_sensitivity"]},"then":{"not":{"properties":{"options":{"minItems":1,"type":"array"}},"required":["options"]}}}],"description":"A filesystem mount observed on a runtime node.","properties":{"backend_generated":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Backend Generated"},"description":{"$ref":"#/$defs/_r53"},"filesystem_type":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Filesystem Type","type":"string"},"options":{"items":{"$ref":"#/$defs/_r190"},"title":"Options","type":"array"},"options_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Options Sensitivity"},"propagation":{"anyOf":[{"$ref":"#/$defs/RuntimeMountPropagation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][vV][aA][tT][eE]|[rR][pP][rR][iI][vV][aA][tT][eE]|[sS][hH][aA][rR][eE][dD]|[rR][sS][hH][aA][rR][eE][dD]|[sS][lL][aA][vV][eE]|[rR][sS][lL][aA][vV][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Propagation"},"read_only":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Read Only"},"source":{"$ref":"#/$defs/_r74"},"source_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeMountSourceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[vV][oO][lL][uU][mM][eE]|[bB][iI][nN][dD]|[tT][mM][pP][fF][sS]|[iI][mM][aA][gG][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Source Kind"},"source_sensitivity":{"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Source Sensitivity"},"stability":{"$ref":"#/$defs/_r11"},"target":{"$ref":"#/$defs/_r187"}},"required":["target"],"title":"RuntimeMount","type":"object"}, "RuntimeMountPropagation": {"description":"Portable propagation mode for a runtime filesystem mount.","enum":["private","rprivate","shared","rshared","slave","rslave","unknown","other"],"title":"RuntimeMountPropagation","type":"string"}, "RuntimeMountSourceKind": {"description":"Portable source kind for a runtime filesystem mount.","enum":["volume","bind","tmpfs","image","other","unknown"],"title":"RuntimeMountSourceKind","type":"string"}, "RuntimeNamespaceConfiguration": {"additionalProperties":false,"description":"Required namespace modes for a runtime node or container.","properties":{"cgroup":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cgroup","type":"string"},"ipc":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ipc","type":"string"},"network":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkNamespace"},{"type":"null"}],"default":null},"pid":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Pid","type":"string"},"userns":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Userns","type":"string"},"uts":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Uts","type":"string"}},"title":"RuntimeNamespaceConfiguration","type":"object"}, - "RuntimeNetworkBackendDetail": {"additionalProperties":false,"description":"Required backend network driver and IPAM detail for an endpoint's network.\n\n``driver_options`` and ``ipam_options`` are the bounded extension seam for\nbackend-native key/value facts; raw backend inspect payloads are not stored.","properties":{"description":{"$ref":"#/$defs/_r53"},"driver":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDriver"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][rR][iI][dD][gG][eE]|[oO][vV][eE][rR][lL][aA][yY]|[hH][oO][sS][tT]|[iI][pP][vV][lL][aA][nN]|[mM][aA][cC][vV][lL][aA][nN]|[nN][oO][nN][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Driver"},"driver_options":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Driver Options","type":"object"},"ipam_driver":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ipam Driver","type":"string"},"ipam_options":{"additionalProperties":{"$ref":"#/$defs/_r187"},"title":"Ipam Options","type":"object"}},"title":"RuntimeNetworkBackendDetail","type":"object"}, + "RuntimeNetworkBackendDetail": {"additionalProperties":false,"description":"Required backend network driver and IPAM detail for an endpoint's network.\n\n``driver_options`` and ``ipam_options`` are the bounded extension seam for\nbackend-native key/value facts; raw backend inspect payloads are not stored.","properties":{"description":{"$ref":"#/$defs/_r53"},"driver":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDriver"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][rR][iI][dD][gG][eE]|[oO][vV][eE][rR][lL][aA][yY]|[hH][oO][sS][tT]|[iI][pP][vV][lL][aA][nN]|[mM][aA][cC][vV][lL][aA][nN]|[nN][oO][nN][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Driver"},"driver_options":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Driver Options","type":"object"},"ipam_driver":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ipam Driver","type":"string"},"ipam_options":{"additionalProperties":{"$ref":"#/$defs/_r190"},"title":"Ipam Options","type":"object"}},"title":"RuntimeNetworkBackendDetail","type":"object"}, "RuntimeNetworkDetectionAppProtocol": {"description":"App-layer parser family enabled in the detection engine.","enum":["http","tls","dns","ssh","smtp","ftp","smb","http2","nfs","rdp","krb5","mqtt","modbus","unknown","other"],"title":"RuntimeNetworkDetectionAppProtocol","type":"string"}, "RuntimeNetworkDetectionControlCapability": {"description":"Operation supported by a detection-engine control channel.","enum":["rule_reload","ruleset_update","config_reload","stats_query","pause","resume","shutdown","unknown","other"],"title":"RuntimeNetworkDetectionControlCapability","type":"string"}, "RuntimeNetworkDetectionControlChannel": {"additionalProperties":false,"description":"A bounded detection-engine control or reload channel.","properties":{"auth_required":{"$ref":"#/$defs/_r26"},"capabilities":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionControlCapability"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][lL][eE][-_][rR][eE][lL][oO][aA][dD]|[rR][uU][lL][eE][sS][eE][tT][-_][uU][pP][dD][aA][tT][eE]|[cC][oO][nN][fF][iI][gG][-_][rR][eE][lL][oO][aA][dD]|[sS][tT][aA][tT][sS][-_][qQ][uU][eE][rR][yY]|[pP][aA][uU][sS][eE]|[rR][eE][sS][uU][mM][eE]|[sS][hH][uU][tT][dD][oO][wW][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Capabilities","type":"array"},"channel_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionControlChannelKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][nN][iI][xX][-_][sS][oO][cC][kK][eE][tT]|[tT][cC][pP][-_][aA][pP][iI]|[hH][tT][tT][pP][-_][aA][pP][iI]|[cC][lL][iI]|[sS][iI][gG][nN][aA][lL]|[fF][iI][lL][eE][-_][dD][rR][oO][pP]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"path":{"$ref":"#/$defs/_r65"},"service":{"$ref":"#/$defs/_r70"}},"required":["channel_id"],"title":"RuntimeNetworkDetectionControlChannel","type":"object"}, "RuntimeNetworkDetectionControlChannelKind": {"description":"Portable local or remote control-channel family.","enum":["unix_socket","tcp_api","http_api","cli","signal","file_drop","unknown","other"],"title":"RuntimeNetworkDetectionControlChannelKind","type":"string"}, - "RuntimeNetworkDetectionEngine": {"additionalProperties":false,"description":"Node-scoped runtime inventory for an IDS/NDR detection engine.","properties":{"app_layer_protocols":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionAppProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][tT][tT][pP]|[tT][lL][sS]|[dD][nN][sS]|[sS][sS][hH]|[sS][mM][tT][pP]|[fF][tT][pP]|[sS][mM][bB]|[hH][tT][tT][pP]2|[nN][fF][sS]|[rR][dD][pP]|[kK][rR][bB]5|[mM][qQ][tT][tT]|[mM][oO][dD][bB][uU][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"App Layer Protocols","type":"array"},"configuration_file_refs":{"$ref":"#/$defs/_r109"},"control_channels":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionControlChannel"},"title":"Control Channels","type":"array"},"description":{"$ref":"#/$defs/_r53"},"engine_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionEngineKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][dD][sS]|[iI][pP][sS]|[nN][dD][rR]|[nN][sS][mM]|[nN][tT][aA]|[dD][eE][tT][eE][cC][tT][iI][oO][nN][-_][eE][nN][gG][iI][nN][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine Kind"},"evidence_refs":{"$ref":"#/$defs/_r119"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionEngineImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA]|[sS][nN][oO][rR][tT]|[zZ][eE][eE][kK]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[aA][rR][kK][iI][mM][eE]|[cC][oO][rR][eE][lL][iI][gG][hH][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r124"},"name":{"$ref":"#/$defs/_r64"},"network_detection_engine_id":{"$ref":"#/$defs/_r3"},"network_sets":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionNetworkSet"},"title":"Network Sets","type":"array"},"output_streams":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionOutputStream"},"title":"Output Streams","type":"array"},"process_ref":{"$ref":"#/$defs/_r66"},"revision":{"$ref":"#/$defs/_r68"},"rule_sources":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionRuleSource"},"title":"Rule Sources","type":"array"},"sensor_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Sensor Ref","type":"string"},"version":{"$ref":"#/$defs/_r81"}},"required":["network_detection_engine_id"],"title":"RuntimeNetworkDetectionEngine","type":"object"}, + "RuntimeNetworkDetectionEngine": {"additionalProperties":false,"description":"Node-scoped runtime inventory for an IDS/NDR detection engine.","properties":{"app_layer_protocols":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionAppProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][tT][tT][pP]|[tT][lL][sS]|[dD][nN][sS]|[sS][sS][hH]|[sS][mM][tT][pP]|[fF][tT][pP]|[sS][mM][bB]|[hH][tT][tT][pP]2|[nN][fF][sS]|[rR][dD][pP]|[kK][rR][bB]5|[mM][qQ][tT][tT]|[mM][oO][dD][bB][uU][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"App Layer Protocols","type":"array"},"configuration_file_refs":{"$ref":"#/$defs/_r112"},"control_channels":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionControlChannel"},"title":"Control Channels","type":"array"},"description":{"$ref":"#/$defs/_r53"},"engine_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionEngineKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][dD][sS]|[iI][pP][sS]|[nN][dD][rR]|[nN][sS][mM]|[nN][tT][aA]|[dD][eE][tT][eE][cC][tT][iI][oO][nN][-_][eE][nN][gG][iI][nN][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine Kind"},"evidence_refs":{"$ref":"#/$defs/_r122"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionEngineImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA]|[sS][nN][oO][rR][tT]|[zZ][eE][eE][kK]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[aA][rR][kK][iI][mM][eE]|[cC][oO][rR][eE][lL][iI][gG][hH][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r127"},"name":{"$ref":"#/$defs/_r64"},"network_detection_engine_id":{"$ref":"#/$defs/_r3"},"network_sets":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionNetworkSet"},"title":"Network Sets","type":"array"},"output_streams":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionOutputStream"},"title":"Output Streams","type":"array"},"process_ref":{"$ref":"#/$defs/_r66"},"revision":{"$ref":"#/$defs/_r68"},"rule_sources":{"items":{"$ref":"#/$defs/RuntimeNetworkDetectionRuleSource"},"title":"Rule Sources","type":"array"},"sensor_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Sensor Ref","type":"string"},"version":{"$ref":"#/$defs/_r81"}},"required":["network_detection_engine_id"],"title":"RuntimeNetworkDetectionEngine","type":"object"}, "RuntimeNetworkDetectionEngineImplementation": {"description":"Observed product family for a network detection engine.","enum":["suricata","snort","zeek","security_onion","arkime","corelight","unknown","other"],"title":"RuntimeNetworkDetectionEngineImplementation","type":"string"}, "RuntimeNetworkDetectionEngineKind": {"description":"Portable detection-engine role/family.","enum":["ids","ips","ndr","nsm","nta","detection_engine","unknown","other"],"title":"RuntimeNetworkDetectionEngineKind","type":"string"}, "RuntimeNetworkDetectionEventType": {"description":"Event family emitted by a detection output stream.","enum":["alert","http","dns","tls","ssh","smtp","ftp","smb","flow","netflow","stats","fileinfo","anomaly","unknown","other"],"title":"RuntimeNetworkDetectionEventType","type":"string"}, - "RuntimeNetworkDetectionNetworkSet": {"additionalProperties":false,"description":"A network zoning or service-group address-set variable.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionNetworkSetKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][oO][mM][eE][-_][nN][eE][tT]|[eE][xX][tT][eE][rR][nN][aA][lL][-_][nN][eE][tT]|[dD][mM][zZ][-_][nN][eE][tT]|[iI][nN][tT][eE][rR][nN][aA][lL][-_][nN][eE][tT]|[sS][eE][rR][vV][iI][cC][eE][-_][gG][rR][oO][uU][pP]|[cC][uU][sS][tT][oO][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"network_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Network Refs","type":"array"},"selector_values":{"items":{"$ref":"#/$defs/_r187"},"title":"Selector Values","type":"array"},"set_id":{"$ref":"#/$defs/_r3"}},"required":["set_id"],"title":"RuntimeNetworkDetectionNetworkSet","type":"object"}, + "RuntimeNetworkDetectionNetworkSet": {"additionalProperties":false,"description":"A network zoning or service-group address-set variable.","properties":{"description":{"$ref":"#/$defs/_r53"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionNetworkSetKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[hH][oO][mM][eE][-_][nN][eE][tT]|[eE][xX][tT][eE][rR][nN][aA][lL][-_][nN][eE][tT]|[dD][mM][zZ][-_][nN][eE][tT]|[iI][nN][tT][eE][rR][nN][aA][lL][-_][nN][eE][tT]|[sS][eE][rR][vV][iI][cC][eE][-_][gG][rR][oO][uU][pP]|[cC][uU][sS][tT][oO][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"},"network_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Network Refs","type":"array"},"selector_values":{"items":{"$ref":"#/$defs/_r190"},"title":"Selector Values","type":"array"},"set_id":{"$ref":"#/$defs/_r3"}},"required":["set_id"],"title":"RuntimeNetworkDetectionNetworkSet","type":"object"}, "RuntimeNetworkDetectionNetworkSetKind": {"description":"Portable network/address-set variable role.","enum":["home_net","external_net","dmz_net","internal_net","service_group","custom","unknown","other"],"title":"RuntimeNetworkDetectionNetworkSetKind","type":"string"}, "RuntimeNetworkDetectionOutputFormat": {"description":"Portable detection output stream format.","enum":["eve_json","fast_log","json","pcap","netflow","syslog","text","unknown","other"],"title":"RuntimeNetworkDetectionOutputFormat","type":"string"}, "RuntimeNetworkDetectionOutputStream": {"additionalProperties":false,"description":"A detection alert, telemetry, or summary output stream.","properties":{"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"event_types":{"items":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionEventType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][lL][eE][rR][tT]|[hH][tT][tT][pP]|[dD][nN][sS]|[tT][lL][sS]|[sS][sS][hH]|[sS][mM][tT][pP]|[fF][tT][pP]|[sS][mM][bB]|[fF][lL][oO][wW]|[nN][eE][tT][fF][lL][oO][wW]|[sS][tT][aA][tT][sS]|[fF][iI][lL][eE][iI][nN][fF][oO]|[aA][nN][oO][mM][aA][lL][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}]},"title":"Event Types","type":"array"},"format":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionOutputFormat"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][vV][eE][-_][jJ][sS][oO][nN]|[fF][aA][sS][tT][-_][lL][oO][gG]|[jJ][sS][oO][nN]|[pP][cC][aA][pP]|[nN][eE][tT][fF][lL][oO][wW]|[sS][yY][sS][lL][oO][gG]|[tT][eE][xX][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Format"},"path":{"$ref":"#/$defs/_r65"},"stream_id":{"$ref":"#/$defs/_r3"}},"required":["stream_id"],"title":"RuntimeNetworkDetectionOutputStream","type":"object"}, "RuntimeNetworkDetectionRuleFormat": {"description":"Portable rule/content syntax family.","enum":["suricata_rule","snort_rule","zeek_script","sigma","yara","stix","json","yaml","text","unknown","other"],"title":"RuntimeNetworkDetectionRuleFormat","type":"string"}, - "RuntimeNetworkDetectionRuleSource": {"additionalProperties":false,"description":"A loaded rule, IOC, script, or managed detection-content source.","properties":{"description":{"$ref":"#/$defs/_r53"},"file_refs":{"$ref":"#/$defs/_r120"},"format":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionRuleFormat"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA][-_][rR][uU][lL][eE]|[sS][nN][oO][rR][tT][-_][rR][uU][lL][eE]|[zZ][eE][eE][kK][-_][sS][cC][rR][iI][pP][tT]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][tT][iI][xX]|[jJ][sS][oO][nN]|[yY][aA][mM][lL]|[tT][eE][xX][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Format"},"generated_by":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Generated By","type":"string"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionRuleSourceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[cC][oO][mM][mM][uU][nN][iI][tT][yY]|[mM][aA][nN][aA][gG][eE][dD]|[lL][oO][cC][aA][lL]|[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL]|[iI][oO][cC]|[eE][mM][eE][rR][gG][iI][nN][gG][-_][tT][hH][rR][eE][aA][tT][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"loaded":{"$ref":"#/$defs/_r28"},"name":{"$ref":"#/$defs/_r64"},"rule_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Rule Count"},"source_id":{"$ref":"#/$defs/_r3"}},"required":["source_id"],"title":"RuntimeNetworkDetectionRuleSource","type":"object"}, + "RuntimeNetworkDetectionRuleSource": {"additionalProperties":false,"description":"A loaded rule, IOC, script, or managed detection-content source.","properties":{"description":{"$ref":"#/$defs/_r53"},"file_refs":{"$ref":"#/$defs/_r123"},"format":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionRuleFormat"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA][-_][rR][uU][lL][eE]|[sS][nN][oO][rR][tT][-_][rR][uU][lL][eE]|[zZ][eE][eE][kK][-_][sS][cC][rR][iI][pP][tT]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][tT][iI][xX]|[jJ][sS][oO][nN]|[yY][aA][mM][lL]|[tT][eE][xX][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Format"},"generated_by":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Generated By","type":"string"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkDetectionRuleSourceKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[cC][oO][mM][mM][uU][nN][iI][tT][yY]|[mM][aA][nN][aA][gG][eE][dD]|[lL][oO][cC][aA][lL]|[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL]|[iI][oO][cC]|[eE][mM][eE][rR][gG][iI][nN][gG][-_][tT][hH][rR][eE][aA][tT][sS]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"loaded":{"$ref":"#/$defs/_r28"},"name":{"$ref":"#/$defs/_r64"},"rule_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Rule Count"},"source_id":{"$ref":"#/$defs/_r3"}},"required":["source_id"],"title":"RuntimeNetworkDetectionRuleSource","type":"object"}, "RuntimeNetworkDetectionRuleSourceKind": {"description":"Portable rule-source provenance/family.","enum":["built_in","community","managed","local","threat_intel","ioc","emerging_threats","unknown","other"],"title":"RuntimeNetworkDetectionRuleSourceKind","type":"string"}, "RuntimeNetworkDriver": {"description":"Backend network driver class required by the scenario.","enum":["bridge","overlay","host","ipvlan","macvlan","none","other","unknown"],"title":"RuntimeNetworkDriver","type":"string"}, - "RuntimeNetworkEndpoint": {"additionalProperties":false,"description":"A required container network attachment.\n\n``network`` references a declared switch-backed infrastructure network by\nname. Runtime-generated identifiers and names are capture evidence, not\ndeclaration identity.","properties":{"aliases":{"$ref":"#/$defs/_r101"},"backend":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkBackendDetail"},{"type":"null"}],"default":null},"description":{"$ref":"#/$defs/_r53"},"dns_names":{"items":{"$ref":"#/$defs/_r187"},"title":"Dns Names","type":"array"},"gateway":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gateway","type":"string"},"ip_address":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ip Address","type":"string"},"ip_prefix_length":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Ip Prefix Length"},"mac_address":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mac Address","type":"string"},"network":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Network","type":"string"}},"required":["network"],"title":"RuntimeNetworkEndpoint","type":"object"}, + "RuntimeNetworkEndpoint": {"additionalProperties":false,"description":"A required container network attachment.\n\n``network`` references a declared switch-backed infrastructure network by\nname. Runtime-generated identifiers and names are capture evidence, not\ndeclaration identity.","properties":{"aliases":{"$ref":"#/$defs/_r104"},"backend":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkBackendDetail"},{"type":"null"}],"default":null},"description":{"$ref":"#/$defs/_r53"},"dns_names":{"items":{"$ref":"#/$defs/_r190"},"title":"Dns Names","type":"array"},"gateway":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gateway","type":"string"},"ip_address":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ip Address","type":"string"},"ip_prefix_length":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Ip Prefix Length"},"mac_address":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mac Address","type":"string"},"network":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Network","type":"string"}},"required":["network"],"title":"RuntimeNetworkEndpoint","type":"object"}, "RuntimeNetworkNamespace": {"additionalProperties":false,"description":"A request to use the exact network namespace owned by another node.","properties":{"target_node_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Node Ref","type":"string"}},"required":["target_node_ref"],"title":"RuntimeNetworkNamespace","type":"object"}, "RuntimeNetworkRealization": {"additionalProperties":false,"description":"Declarative container network state for a node.\n\n``hostname`` and ``domainname`` are required container network identities,\nkept distinct from per-network aliases and DNS names.","properties":{"description":{"$ref":"#/$defs/_r53"},"domainname":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Domainname","type":"string"},"endpoints":{"items":{"$ref":"#/$defs/RuntimeNetworkEndpoint"},"title":"Endpoints","type":"array"},"hostname":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Hostname","type":"string"},"published_ports":{"items":{"$ref":"#/$defs/RuntimePublishedPort"},"title":"Published Ports","type":"array"}},"title":"RuntimeNetworkRealization","type":"object"}, - "RuntimeNetworkSensor": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a passive or inline network sensor.","properties":{"capture_interfaces":{"items":{"$ref":"#/$defs/_r187"},"title":"Capture Interfaces","type":"array"},"capture_mode":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorCaptureMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][cC][aA][pP]|[aA][fF][-_][pP][aA][cC][kK][eE][tT]|[nN][fF][qQ][uU][eE][uU][eE]|[nN][eE][tT][mM][aA][pP]|[dD][pP][dD][kK]|[fF][lL][oO][wW]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Capture Mode"},"configuration_file_refs":{"$ref":"#/$defs/_r109"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA]|[sS][nN][oO][rR][tT]|[zZ][eE][eE][kK]|[tT][cC][pP][dD][uU][mM][pP]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r124"},"monitored_network_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Monitored Network Refs","type":"array"},"monitoring_posture":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorMonitoringPosture"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][iI][vV][eE]|[iI][nN][lL][iI][nN][eE]|[hH][oO][sS][tT][-_][lL][oO][cC][aA][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Monitoring Posture"},"name":{"$ref":"#/$defs/_r64"},"network_sensor_id":{"$ref":"#/$defs/_r3"},"process_ref":{"$ref":"#/$defs/_r66"},"revision":{"$ref":"#/$defs/_r68"},"sensor_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][dD][sS]|[iI][pP][sS]|[nN][sS][mM]|[nN][dD][rR]|[pP][aA][cC][kK][eE][tT][-_][cC][aA][pP][tT][uU][rR][eE]|[fF][lL][oO][wW][-_][cC][oO][lL][lL][eE][cC][tT][oO][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Sensor Kind"},"version":{"$ref":"#/$defs/_r81"}},"required":["network_sensor_id"],"title":"RuntimeNetworkSensor","type":"object"}, + "RuntimeNetworkSensor": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a passive or inline network sensor.","properties":{"capture_interfaces":{"items":{"$ref":"#/$defs/_r190"},"title":"Capture Interfaces","type":"array"},"capture_mode":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorCaptureMode"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][cC][aA][pP]|[aA][fF][-_][pP][aA][cC][kK][eE][tT]|[nN][fF][qQ][uU][eE][uU][eE]|[nN][eE][tT][mM][aA][pP]|[dD][pP][dD][kK]|[fF][lL][oO][wW]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Capture Mode"},"configuration_file_refs":{"$ref":"#/$defs/_r112"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][rR][iI][cC][aA][tT][aA]|[sS][nN][oO][rR][tT]|[zZ][eE][eE][kK]|[tT][cC][pP][dD][uU][mM][pP]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"log_file_refs":{"$ref":"#/$defs/_r127"},"monitored_network_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Monitored Network Refs","type":"array"},"monitoring_posture":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorMonitoringPosture"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][sS][sS][iI][vV][eE]|[iI][nN][lL][iI][nN][eE]|[hH][oO][sS][tT][-_][lL][oO][cC][aA][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Monitoring Posture"},"name":{"$ref":"#/$defs/_r64"},"network_sensor_id":{"$ref":"#/$defs/_r3"},"process_ref":{"$ref":"#/$defs/_r66"},"revision":{"$ref":"#/$defs/_r68"},"sensor_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeNetworkSensorKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][dD][sS]|[iI][pP][sS]|[nN][sS][mM]|[nN][dD][rR]|[pP][aA][cC][kK][eE][tT][-_][cC][aA][pP][tT][uU][rR][eE]|[fF][lL][oO][wW][-_][cC][oO][lL][lL][eE][cC][tT][oO][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Sensor Kind"},"version":{"$ref":"#/$defs/_r81"}},"required":["network_sensor_id"],"title":"RuntimeNetworkSensor","type":"object"}, "RuntimeNetworkSensorCaptureMode": {"description":"Portable capture mechanism family for an observed sensor.","enum":["pcap","af_packet","nfqueue","netmap","dpdk","flow","unknown","other"],"title":"RuntimeNetworkSensorCaptureMode","type":"string"}, "RuntimeNetworkSensorImplementation": {"description":"Observed product family for a network sensor.","enum":["suricata","snort","zeek","tcpdump","security_onion","unknown","other"],"title":"RuntimeNetworkSensorImplementation","type":"string"}, "RuntimeNetworkSensorKind": {"description":"Portable network-sensor function.","enum":["ids","ips","nsm","ndr","packet_capture","flow_collector","other","unknown"],"title":"RuntimeNetworkSensorKind","type":"string"}, @@ -442,89 +452,89 @@ "RuntimeOrchestrationEngine": {"description":"Open taxonomy for the orchestration engine/runtime family.\n\nOpen taxonomy: carries both ``unknown`` and ``other`` per the DSL-139\nenum-sentinel rule.","enum":["docker","containerd","podman","kubernetes","cri_o","unknown","other"],"title":"RuntimeOrchestrationEngine","type":"string"}, "RuntimeOrchestrationLifecyclePolicy": {"additionalProperties":false,"description":"The lifecycle posture applied to children the authority spawns.","properties":{"cleanup":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cleanup","type":"string"},"description":{"$ref":"#/$defs/_r53"},"execution_timeout":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Execution Timeout","type":"string"},"timeout":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Timeout","type":"string"}},"title":"RuntimeOrchestrationLifecyclePolicy","type":"object"}, "RuntimeOrchestrationPrivilegeClass": {"description":"Open taxonomy for the privilege an orchestration authority commands.\n\n``host_root_equivalent`` denotes an authority whose spawn surface is\nequivalent to host root (e.g. a read-write ``docker.sock`` holder);\n``namespaced`` denotes a privilege-scoped/rootless authority. Open\ntaxonomy: carries both ``unknown`` and ``other``.","enum":["host_root_equivalent","namespaced","unknown","other"],"title":"RuntimeOrchestrationPrivilegeClass","type":"string"}, - "RuntimeOrchestrationRealizedChild": {"additionalProperties":false,"description":"An observed, realized child workload spawned by the authority.","properties":{"count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Count"},"description":{"$ref":"#/$defs/_r53"},"evidence_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Evidence Ref","type":"string"},"image_ref":{"$ref":"#/$defs/_r62"},"workload_id":{"$ref":"#/$defs/_r3"}},"required":["workload_id"],"title":"RuntimeOrchestrationRealizedChild","type":"object"}, + "RuntimeOrchestrationRealizedChild": {"additionalProperties":false,"description":"An observed, realized child workload spawned by the authority.","properties":{"count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Count"},"description":{"$ref":"#/$defs/_r53"},"evidence_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Evidence Ref","type":"string"},"image_ref":{"$ref":"#/$defs/_r62"},"workload_id":{"$ref":"#/$defs/_r3"}},"required":["workload_id"],"title":"RuntimeOrchestrationRealizedChild","type":"object"}, "RuntimeOrchestrationScope": {"additionalProperties":false,"description":"The organizational/environment scope an orchestration authority governs.","properties":{"description":{"$ref":"#/$defs/_r53"},"environment_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Environment Name","type":"string"},"organization_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Organization Ref","type":"string"}},"title":"RuntimeOrchestrationScope","type":"object"}, "RuntimeOrchestrationSpawnTemplate": {"additionalProperties":false,"description":"A template the authority is authorized to instantiate (image + purpose).","properties":{"description":{"$ref":"#/$defs/_r53"},"image_ref":{"$ref":"#/$defs/_r62"},"purpose":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Purpose","type":"string"},"template_id":{"$ref":"#/$defs/_r3"}},"required":["template_id"],"title":"RuntimeOrchestrationSpawnTemplate","type":"object"}, "RuntimePackage": {"additionalProperties":false,"allOf":[{"if":{"properties":{"repository":{"not":{"type":"null"}}},"required":["repository"]},"then":{"properties":{"manager":{"const":"apt"},"name":{"anyOf":[{"pattern":"^[a-z0-9][a-z0-9+.-]{0,127}$"},{"pattern":"^\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}$"}]},"version":{"anyOf":[{"pattern":"^[0-9][A-Za-z0-9.+:~_-]{0,255}$"},{"pattern":"^\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}$"}]}}}}],"description":"An exact package required in a runtime image or node.\n\n``repository`` is absent for ordinary target-configured repositories. When\npresent, it is required final node state and stays within the existing\n``runtime-packages`` realization concern.","properties":{"architecture":{"$ref":"#/$defs/_r46"},"manager":{"description":"Package manager identity used by the target node.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Manager","type":"string"},"name":{"description":"Package name interpreted by the selected package manager.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Name","type":"string"},"purl":{"default":"","description":"Package URL identity metadata; never a repository locator, trust binding, or acquisition command.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Purl","type":"string"},"repository":{"anyOf":[{"discriminator":{"mapping":{"apt":"#/$defs/RuntimeAptPackageRepository"},"propertyName":"repository_profile"},"oneOf":[{"$ref":"#/$defs/RuntimeAptPackageRepository"}]},{"type":"null"}],"default":null,"description":"Closed third-party repository profile; absence selects the target's ordinary configured sources.","title":"Repository"},"source":{"default":"","description":"Opaque package source or provenance label; never a repository declaration or executable value.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source","type":"string"},"version":{"description":"Exact package version interpreted by the selected package manager.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Version","type":"string"}},"required":["manager","name","version"],"title":"RuntimePackage","type":"object"}, - "RuntimePackageRepositorySigningKey": {"additionalProperties":false,"description":"Exact public OpenPGP key bytes trusted by one package repository.","properties":{"digest":{"description":"Canonical SHA-256 digest of the exact public signing-key bytes.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[a-f0-9]{64}|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","title":"Digest","type":"string"},"format":{"enum":["openpgp-ascii-armored","openpgp-binary"],"title":"Format","type":"string"},"uri":{"allOf":[{"$ref":"#/$defs/_r188"}],"description":"Credential-free HTTPS location of the public signing-key bytes.","maxLength":2048,"minLength":1,"not":{"anyOf":[{"pattern":"^https://[^/?#]*@"},{"pattern":"[?&](?:access_token|api_key|apikey|auth|credential|key|password|secret|sig|signature|token)(?:=|&|$)"}]},"pattern":"^https://[^\\s#]+$","title":"Uri","type":"string"}},"required":["uri","format","digest"],"title":"RuntimePackageRepositorySigningKey","type":"object"}, + "RuntimePackageRepositorySigningKey": {"additionalProperties":false,"description":"Exact public OpenPGP key bytes trusted by one package repository.","properties":{"digest":{"description":"Canonical SHA-256 digest of the exact public signing-key bytes.","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:sha256:[a-f0-9]{64}|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","title":"Digest","type":"string"},"format":{"enum":["openpgp-ascii-armored","openpgp-binary"],"title":"Format","type":"string"},"uri":{"allOf":[{"$ref":"#/$defs/_r191"}],"description":"Credential-free HTTPS location of the public signing-key bytes.","maxLength":2048,"minLength":1,"not":{"anyOf":[{"pattern":"^https://[^/?#]*@"},{"pattern":"[?&](?:access_token|api_key|apikey|auth|credential|key|password|secret|sig|signature|token)(?:=|&|$)"}]},"pattern":"^https://[^\\s#]+$","title":"Uri","type":"string"}},"required":["uri","format","digest"],"title":"RuntimePackageRepositorySigningKey","type":"object"}, "RuntimePlatformApplication": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a security platform application.\n\n``service`` references the owning same-node ``Node.services[].name``. The\ninventory is application state above transport; it never duplicates the\ninbound HTTP route surface (``runtime.applications``) or mutates\n``Node.services``. ``capabilities`` declare composable provider-neutral\nfunctional roles without implying content or configuration completeness.\n``authorization_ref`` is the ``app_authorization_id`` of the platform's\ninternal RBAC store (resolved by the semantic validator).","properties":{"authorization_ref":{"$ref":"#/$defs/_r48"},"capabilities":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationCapability"},"title":"Capabilities","type":"array"},"connectors":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationConnector"},"title":"Connectors","type":"array"},"content_objects":{"deprecated":true,"description":"Legacy bounded platform-content manifests retained for compatibility; content presence does not define application capabilities.","items":{"$ref":"#/$defs/RuntimePlatformApplicationContentObject"},"title":"Content Objects","type":"array"},"description":{"$ref":"#/$defs/_r53"},"execution_policy":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationExecutionPolicy"},{"type":"null"}],"default":null},"markings":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationMarking"},"title":"Markings","type":"array"},"name":{"$ref":"#/$defs/_r64"},"organizations":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationOrganization"},"title":"Organizations","type":"array"},"platform_application_id":{"$ref":"#/$defs/_r3"},"platform_kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][tT][iI][cC][sS][-_][dD][aA][sS][hH][bB][oO][aA][rR][dD]|[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL]|[cC][aA][sS][eE][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[aA][nN][aA][lL][yY][zZ][eE][rR][-_][eE][nN][gG][iI][nN][eE]|[sS][oO][aA][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","deprecated":true,"description":"Legacy product-family category retained for compatibility; does not imply capabilities or configuration completeness. Use capabilities for new documents.","title":"Platform Kind"},"product":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Product","type":"string"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationSetting"},"title":"Settings","type":"array"},"tenants":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationTenant"},"title":"Tenants","type":"array"},"upstream_bindings":{"items":{"$ref":"#/$defs/RuntimePlatformApplicationUpstreamBinding"},"title":"Upstream Bindings","type":"array"},"version":{"$ref":"#/$defs/_r81"}},"required":["platform_application_id"],"title":"RuntimePlatformApplication","type":"object"}, - "RuntimePlatformApplicationCapability": {"additionalProperties":false,"description":"A provider-neutral functional role exposed by the application.\n\nCapability declarations are composable and independent of product\ncategories, configuration completeness, loaded content, policy, and\nexecution guarantees. ``evidence_refs`` may identify the evidence supporting\nthe declared runtime contract without embedding backend payloads.","properties":{"capability_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationCapabilityKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL][lL][iI][gG][eE][nN][cC][eE][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[iI][nN][tT][eE][lL][lL][iI][gG][eE][nN][cC][eE][-_][eE][xX][cC][hH][aA][nN][gG][eE]|[cC][aA][sS][eE][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[aA][nN][aA][lL][yY][sS][iI][sS][-_][eE][xX][eE][cC][uU][tT][iI][oO][nN]|[wW][oO][rR][kK][fF][lL][oO][wW][-_][aA][uU][tT][oO][mM][aA][tT][iI][oO][nN]|[aA][nN][aA][lL][yY][tT][iI][cC][sS][-_][pP][rR][eE][sS][eE][nN][tT][aA][tT][iI][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"}},"required":["capability_id"],"title":"RuntimePlatformApplicationCapability","type":"object"}, + "RuntimePlatformApplicationCapability": {"additionalProperties":false,"description":"A provider-neutral functional role exposed by the application.\n\nCapability declarations are composable and independent of product\ncategories, configuration completeness, loaded content, policy, and\nexecution guarantees. ``evidence_refs`` may identify the evidence supporting\nthe declared runtime contract without embedding backend payloads.","properties":{"capability_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationCapabilityKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL][lL][iI][gG][eE][nN][cC][eE][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[iI][nN][tT][eE][lL][lL][iI][gG][eE][nN][cC][eE][-_][eE][xX][cC][hH][aA][nN][gG][eE]|[cC][aA][sS][eE][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[aA][nN][aA][lL][yY][sS][iI][sS][-_][eE][xX][eE][cC][uU][tT][iI][oO][nN]|[wW][oO][rR][kK][fF][lL][oO][wW][-_][aA][uU][tT][oO][mM][aA][tT][iI][oO][nN]|[aA][nN][aA][lL][yY][tT][iI][cC][sS][-_][pP][rR][eE][sS][eE][nN][tT][aA][tT][iI][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"}},"required":["capability_id"],"title":"RuntimePlatformApplicationCapability","type":"object"}, "RuntimePlatformApplicationCapabilityKind": {"description":"Open taxonomy of provider-neutral application capabilities.\n\nA capability describes a functional role exposed by an application. It\ndoes not imply a product identity, configuration profile, content\ninventory, policy, or execution guarantee. Open taxonomy: carries both\n``unknown`` and ``other``.","enum":["threat_intelligence_management","intelligence_exchange","case_management","analysis_execution","workflow_automation","analytics_presentation","unknown","other"],"title":"RuntimePlatformApplicationCapabilityKind","type":"string"}, - "RuntimePlatformApplicationConnector": {"additionalProperties":false,"description":"A connector/integration wired into the platform.\n\nA connector never carries a raw credential value; its credential posture is\nrecorded purely via :attr:`credential_classification`.","properties":{"connector_id":{"$ref":"#/$defs/_r3"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingClassification"},{"$ref":"#/$defs/_r161"}],"default":"plain","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationConnectorKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][zZ][eE][rR][-_][eE][nN][gG][iI][nN][eE]|[rR][eE][sS][pP][oO][nN][dD][eE][rR]|[wW][eE][bB][hH][oO][oO][kK]|[nN][oO][tT][iI][fF][iI][cC][aA][tT][iI][oO][nN]|[sS][yY][nN][cC]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"}},"required":["connector_id"],"title":"RuntimePlatformApplicationConnector","type":"object"}, + "RuntimePlatformApplicationConnector": {"additionalProperties":false,"description":"A connector/integration wired into the platform.\n\nA connector never carries a raw credential value; its credential posture is\nrecorded purely via :attr:`credential_classification`.","properties":{"connector_id":{"$ref":"#/$defs/_r3"},"credential_classification":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingClassification"},{"$ref":"#/$defs/_r164"}],"default":"plain","title":"Credential Classification"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationConnectorKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][zZ][eE][rR][-_][eE][nN][gG][iI][nN][eE]|[rR][eE][sS][pP][oO][nN][dD][eE][rR]|[wW][eE][bB][hH][oO][oO][kK]|[nN][oO][tT][iI][fF][iI][cC][aA][tT][iI][oO][nN]|[sS][yY][nN][cC]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"name":{"$ref":"#/$defs/_r64"}},"required":["connector_id"],"title":"RuntimePlatformApplicationConnector","type":"object"}, "RuntimePlatformApplicationConnectorKind": {"description":"Open taxonomy of platform connector/integration kinds.\n\nOpen taxonomy: carries both ``unknown`` and ``other``.","enum":["analyzer_engine","responder","webhook","notification","sync","unknown","other"],"title":"RuntimePlatformApplicationConnectorKind","type":"string"}, - "RuntimePlatformApplicationContentObject": {"additionalProperties":false,"description":"A legacy typed platform content object as a bounded manifest entry.\n\nThe object carries a typed ``kind``, bounded typed ``attributes``, typed\n``references`` (to other ``content_object_id`` values), ``marking_refs``,\nand ``evidence_refs`` \u2014 structurally **never** a raw object body. Its\npresence does not imply an application capability.","properties":{"attributes":{"additionalProperties":true,"title":"Attributes","type":"object"},"content_object_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationContentObjectKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX][-_][pP][aA][tT][tT][eE][rR][nN]|[vV][iI][sS][uU][aA][lL][iI][zZ][aA][tT][iI][oO][nN]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[sS][eE][aA][rR][cC][hH]|[fF][eE][eE][dD]|[tT][aA][xX][oO][nN][oO][mM][yY]|[gG][aA][lL][aA][xX][yY][-_][cC][lL][uU][sS][tT][eE][rR]|[wW][aA][rR][nN][iI][nN][gG][lL][iI][sS][tT]|[oO][bB][jJ][eE][cC][tT][-_][tT][eE][mM][pP][lL][aA][tT][eE]|[sS][hH][aA][rR][iI][nN][gG][-_][gG][rR][oO][uU][pP]|[cC][aA][sS][eE][-_][tT][eE][mM][pP][lL][aA][tT][eE]|[cC][uU][sS][tT][oO][mM][-_][fF][iI][eE][lL][dD]|[aA][nN][aA][lL][yY][zZ][eE][rR]|[rR][eE][sS][pP][oO][nN][dD][eE][rR]|[wW][oO][rR][kK][fF][lL][oO][wW]|[aA][pP][pP]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"marking_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Marking Refs","type":"array"},"name":{"$ref":"#/$defs/_r64"},"references":{"items":{"$ref":"#/$defs/_r187"},"title":"References","type":"array"}},"required":["content_object_id"],"title":"RuntimePlatformApplicationContentObject","type":"object"}, + "RuntimePlatformApplicationContentObject": {"additionalProperties":false,"description":"A legacy typed platform content object as a bounded manifest entry.\n\nThe object carries a typed ``kind``, bounded typed ``attributes``, typed\n``references`` (to other ``content_object_id`` values), ``marking_refs``,\nand ``evidence_refs`` \u2014 structurally **never** a raw object body. Its\npresence does not imply an application capability.","properties":{"attributes":{"additionalProperties":true,"title":"Attributes","type":"object"},"content_object_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationContentObjectKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX][-_][pP][aA][tT][tT][eE][rR][nN]|[vV][iI][sS][uU][aA][lL][iI][zZ][aA][tT][iI][oO][nN]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[sS][eE][aA][rR][cC][hH]|[fF][eE][eE][dD]|[tT][aA][xX][oO][nN][oO][mM][yY]|[gG][aA][lL][aA][xX][yY][-_][cC][lL][uU][sS][tT][eE][rR]|[wW][aA][rR][nN][iI][nN][gG][lL][iI][sS][tT]|[oO][bB][jJ][eE][cC][tT][-_][tT][eE][mM][pP][lL][aA][tT][eE]|[sS][hH][aA][rR][iI][nN][gG][-_][gG][rR][oO][uU][pP]|[cC][aA][sS][eE][-_][tT][eE][mM][pP][lL][aA][tT][eE]|[cC][uU][sS][tT][oO][mM][-_][fF][iI][eE][lL][dD]|[aA][nN][aA][lL][yY][zZ][eE][rR]|[rR][eE][sS][pP][oO][nN][dD][eE][rR]|[wW][oO][rR][kK][fF][lL][oO][wW]|[aA][pP][pP]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Kind"},"marking_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Marking Refs","type":"array"},"name":{"$ref":"#/$defs/_r64"},"references":{"items":{"$ref":"#/$defs/_r190"},"title":"References","type":"array"}},"required":["content_object_id"],"title":"RuntimePlatformApplicationContentObject","type":"object"}, "RuntimePlatformApplicationContentObjectKind": {"description":"Legacy open taxonomy of typed platform content objects.\n\nA content object is a bounded parsed manifest entry (typed kind + bounded\nattributes + typed references) \u2014 never a raw object body. The collection is\nretained for compatibility and does not define an application's\ncapabilities. Open taxonomy: carries both ``unknown`` and ``other``.","enum":["index_pattern","visualization","dashboard","search","feed","taxonomy","galaxy_cluster","warninglist","object_template","sharing_group","case_template","custom_field","analyzer","responder","workflow","app","unknown","other"],"title":"RuntimePlatformApplicationContentObjectKind","type":"string"}, - "RuntimePlatformApplicationExecutionPolicy": {"additionalProperties":false,"description":"The platform's job/analyzer execution model (rate limits, runner).","properties":{"description":{"$ref":"#/$defs/_r53"},"job_timeout":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Job Timeout","type":"string"},"max_concurrent_jobs":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Max Concurrent Jobs"},"policy_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Id","type":"string"},"rate_limit":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rate Limit","type":"string"},"runner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Runner","type":"string"}},"title":"RuntimePlatformApplicationExecutionPolicy","type":"object"}, + "RuntimePlatformApplicationExecutionPolicy": {"additionalProperties":false,"description":"The platform's job/analyzer execution model (rate limits, runner).","properties":{"description":{"$ref":"#/$defs/_r53"},"job_timeout":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Job Timeout","type":"string"},"max_concurrent_jobs":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Max Concurrent Jobs"},"policy_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Id","type":"string"},"rate_limit":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Rate Limit","type":"string"},"runner":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Runner","type":"string"}},"title":"RuntimePlatformApplicationExecutionPolicy","type":"object"}, "RuntimePlatformApplicationKind": {"description":"Legacy open category for a platform-application product family.\n\nThis category is retained for compatibility. It does not assert\nconfiguration completeness or imply application capabilities. New\ndocuments should use composable ``capabilities`` instead. Open taxonomy:\ncarries both ``unknown`` and ``other``.","enum":["analytics_dashboard","threat_intel","case_management","analyzer_engine","soar","unknown","other"],"title":"RuntimePlatformApplicationKind","type":"string"}, "RuntimePlatformApplicationMarking": {"additionalProperties":false,"description":"A releasability marking (TLP/PAP/distribution) defined by the platform.","properties":{"description":{"$ref":"#/$defs/_r53"},"level":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Level","type":"string"},"marking_id":{"$ref":"#/$defs/_r3"},"scheme":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationMarkingScheme"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][lL][pP]|[pP][aA][pP]|[dD][iI][sS][tT][rR][iI][bB][uU][tT][iI][oO][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"tlp","title":"Scheme"},"value":{"$ref":"#/$defs/_r80"}},"required":["marking_id"],"title":"RuntimePlatformApplicationMarking","type":"object"}, "RuntimePlatformApplicationMarkingScheme": {"description":"Closed releasability-marking scheme vocabulary.\n\nStandard-fixed (FIRST TLP 2.0 / PAP / MISP distribution lattice), so per\nthe enum-sentinel rule it carries neither ``unknown`` nor ``other``.","enum":["tlp","pap","distribution"],"title":"RuntimePlatformApplicationMarkingScheme","type":"string"}, "RuntimePlatformApplicationOrganization": {"additionalProperties":false,"description":"An organization/owner tenant known to the platform application.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"organization_id":{"$ref":"#/$defs/_r3"}},"required":["organization_id"],"title":"RuntimePlatformApplicationOrganization","type":"object"}, - "RuntimePlatformApplicationSetting": {"additionalProperties":false,"description":"An observed platform setting with provenance and sensitivity.\n\nExplicitly redacted/operator-secret settings must omit their raw ``value``.\nA setting name does not by itself redact SDL scenario content.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingClassification"},{"$ref":"#/$defs/_r161"}],"default":"plain","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][eE][fF][aA][uU][lL][tT]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[cC][oO][nN][fF][iI][gG][-_][fF][iI][lL][eE]|[dD][aA][tT][aA][bB][aA][sS][eE]|[rR][uU][nN][tT][iI][mM][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"redaction":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Redaction","type":"string"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimePlatformApplicationSetting","type":"object"}, + "RuntimePlatformApplicationSetting": {"additionalProperties":false,"description":"An observed platform setting with provenance and sensitivity.\n\nExplicitly redacted/operator-secret settings must omit their raw ``value``.\nA setting name does not by itself redact SDL scenario content.","if":{"properties":{"classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["classification"]},"properties":{"classification":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingClassification"},{"$ref":"#/$defs/_r164"}],"default":"plain","title":"Classification"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][eE][fF][aA][uU][lL][tT]|[eE][nN][vV][iI][rR][oO][nN][mM][eE][nN][tT]|[cC][oO][nN][fF][iI][gG][-_][fF][iI][lL][eE]|[dD][aA][tT][aA][bB][aA][sS][eE]|[rR][uU][nN][tT][iI][mM][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"redaction":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Redaction","type":"string"},"setting_id":{"$ref":"#/$defs/_r3"},"value":{"$ref":"#/$defs/_r80"}},"required":["setting_id"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimePlatformApplicationSetting","type":"object"}, "RuntimePlatformApplicationSettingClassification": {"description":"Closed sensitivity classification for a platform setting value.\n\nClosed structural redaction vocabulary: carries neither ``unknown`` nor\n``other`` (an unclassified value is ``plain``).","enum":["plain","redacted","operator_secret"],"title":"RuntimePlatformApplicationSettingClassification","type":"string"}, "RuntimePlatformApplicationSettingProvenance": {"description":"Open taxonomy of where an observed platform setting originated.\n\nOpen taxonomy: carries both ``unknown`` and ``other``.","enum":["default","environment","config_file","database","runtime","unknown","other"],"title":"RuntimePlatformApplicationSettingProvenance","type":"string"}, "RuntimePlatformApplicationTenant": {"additionalProperties":false,"description":"A tenant/namespace scope within the platform application.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"tenant_id":{"$ref":"#/$defs/_r3"}},"required":["tenant_id"],"title":"RuntimePlatformApplicationTenant","type":"object"}, "RuntimePlatformApplicationUpstreamBinding": {"additionalProperties":false,"description":"An outbound binding to an upstream node/service (data source, backend).","properties":{"binding_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimePlatformApplicationUpstreamBindingRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[dD][aA][tT][aA][-_][sS][oO][uU][rR][cC][eE]|[bB][aA][cC][kK][eE][nN][dD][-_][aA][pP][iI]|[sS][yY][nN][cC][-_][pP][eE][eE][rR]|[iI][nN][dD][eE][xX][-_][bB][aA][cC][kK][eE][nN][dD]|[cC][qQ][lL][-_][bB][aA][cC][kK][eE][nN][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Role"},"target_node_ref":{"$ref":"#/$defs/_r75"},"target_service_ref":{"$ref":"#/$defs/_r77"}},"required":["binding_id"],"title":"RuntimePlatformApplicationUpstreamBinding","type":"object"}, "RuntimePlatformApplicationUpstreamBindingRole": {"description":"Open taxonomy for the role an outbound upstream binding plays.\n\nOpen taxonomy: carries both ``unknown`` and ``other``.","enum":["data_source","backend_api","sync_peer","index_backend","cql_backend","unknown","other"],"title":"RuntimePlatformApplicationUpstreamBindingRole","type":"string"}, - "RuntimeProcessCapabilityOverride": {"additionalProperties":false,"description":"A capability delta scoped to a single process or its descendant subtree.\n\nPer ADR-030, scoped Linux-capability facts stay under\n``RuntimeCapabilityPolicy`` rather than migrating onto\n``RuntimeProcessIdentity``. ``subject`` reuses the existing process\nidentity model as a selector / evidence anchor \u2014 it identifies *which*\nprocess or subtree the delta applies to but does not own capability\nsemantics. ``effective`` / ``add`` / ``drop`` record the scoped delta\nrelative to the container-wide baseline on the enclosing\n``RuntimeCapabilityPolicy``; ``required`` is intentionally omitted from\nthis surface because overrides describe deltas, not new container-wide\nrequirements.","properties":{"add":{"$ref":"#/$defs/_r100"},"description":{"$ref":"#/$defs/_r53"},"drop":{"$ref":"#/$defs/_r114"},"effective":{"$ref":"#/$defs/_r115"},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeCapabilityOverrideScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][oO][cC][eE][sS][sS]|[sS][uU][bB][tT][rR][eE][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"process","title":"Scope"},"subject":{"$ref":"#/$defs/RuntimeProcessIdentity"}},"required":["subject"],"title":"RuntimeProcessCapabilityOverride","type":"object"}, - "RuntimeProcessIdentity": {"additionalProperties":false,"description":"Observed process identity for a runtime node.","properties":{"command":{"$ref":"#/$defs/_r108"},"command_redacted":{"$ref":"#/$defs/_r32"},"description":{"$ref":"#/$defs/_r53"},"group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Group","type":"string"},"name":{"$ref":"#/$defs/_r64"},"parent_pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Parent Pid"},"pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Pid"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeProcessRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][mM][aA][rR][yY]|[sS][uU][pP][eE][rR][vV][iI][sS][oO][rR]|[wW][oO][rR][kK][eE][rR]|[sS][iI][dD][eE][cC][aA][rR]|[aA][gG][eE][nN][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"},"user":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"User","type":"string"},"working_directory":{"$ref":"#/$defs/_r82"}},"title":"RuntimeProcessIdentity","type":"object"}, + "RuntimeProcessCapabilityOverride": {"additionalProperties":false,"description":"A capability delta scoped to a single process or its descendant subtree.\n\nPer ADR-030, scoped Linux-capability facts stay under\n``RuntimeCapabilityPolicy`` rather than migrating onto\n``RuntimeProcessIdentity``. ``subject`` reuses the existing process\nidentity model as a selector / evidence anchor \u2014 it identifies *which*\nprocess or subtree the delta applies to but does not own capability\nsemantics. ``effective`` / ``add`` / ``drop`` record the scoped delta\nrelative to the container-wide baseline on the enclosing\n``RuntimeCapabilityPolicy``; ``required`` is intentionally omitted from\nthis surface because overrides describe deltas, not new container-wide\nrequirements.","properties":{"add":{"$ref":"#/$defs/_r103"},"description":{"$ref":"#/$defs/_r53"},"drop":{"$ref":"#/$defs/_r117"},"effective":{"$ref":"#/$defs/_r118"},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeCapabilityOverrideScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][oO][cC][eE][sS][sS]|[sS][uU][bB][tT][rR][eE][eE]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"process","title":"Scope"},"subject":{"$ref":"#/$defs/RuntimeProcessIdentity"}},"required":["subject"],"title":"RuntimeProcessCapabilityOverride","type":"object"}, + "RuntimeProcessIdentity": {"additionalProperties":false,"description":"Observed process identity for a runtime node.","properties":{"command":{"$ref":"#/$defs/_r111"},"command_redacted":{"$ref":"#/$defs/_r32"},"description":{"$ref":"#/$defs/_r53"},"group":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Group","type":"string"},"name":{"$ref":"#/$defs/_r64"},"parent_pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Parent Pid"},"pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Pid"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeProcessRole"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][rR][iI][mM][aA][rR][yY]|[sS][uU][pP][eE][rR][vV][iI][sS][oO][rR]|[wW][oO][rR][kK][eE][rR]|[sS][iI][dD][eE][cC][aA][rR]|[aA][gG][eE][nN][tT]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Role"},"user":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"User","type":"string"},"working_directory":{"$ref":"#/$defs/_r82"}},"title":"RuntimeProcessIdentity","type":"object"}, "RuntimeProcessResourceLimit": {"additionalProperties":false,"description":"One portable soft/hard process limit for a selected process or subtree.","properties":{"description":{"$ref":"#/$defs/_r53"},"hard":{"anyOf":[{"minimum":0,"type":"integer"},{"const":"unlimited","type":"string"}],"title":"Hard"},"resource":{"$ref":"#/$defs/ProcessResourceLimitKind"},"scope":{"$ref":"#/$defs/ProcessResourceLimitScope","default":"process"},"soft":{"anyOf":[{"minimum":0,"type":"integer"},{"const":"unlimited","type":"string"}],"title":"Soft"},"subject":{"$ref":"#/$defs/RuntimeProcessIdentity","allOf":[{"if":{"properties":{"command_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["command_redacted"]},"then":{"properties":{"command":{"maxItems":0}}}}]}},"required":["resource","soft","hard","subject"],"title":"RuntimeProcessResourceLimit","type":"object"}, "RuntimeProcessRole": {"description":"Observed role of a process in a runtime process set.","enum":["primary","supervisor","worker","sidecar","agent","other","unknown"],"title":"RuntimeProcessRole","type":"string"}, "RuntimePublishedPort": {"additionalProperties":false,"description":"A required host-published port binding for a container endpoint.\n\nHost IP, host port, container port, and protocol are kept distinct; this is\na runtime/host exposure fact, not a node service declaration (ADR-025).","properties":{"container_port":{"$ref":"#/$defs/_r42"},"description":{"$ref":"#/$defs/_r53"},"host_ip":{"$ref":"#/$defs/_r61"},"host_port":{"$ref":"#/$defs/_r36"},"protocol":{"$ref":"#/$defs/_r84"}},"required":["container_port"],"title":"RuntimePublishedPort","type":"object"}, "RuntimePublishedPortRef": {"additionalProperties":false,"description":"Typed reference to an observed host-published port binding.\n\n``RuntimePublishedPort`` currently has no stable id, so the tuple is the\nreference shape used by semantic validation.","properties":{"container_port":{"$ref":"#/$defs/_r42"},"host_ip":{"$ref":"#/$defs/_r61"},"host_port":{"$ref":"#/$defs/_r36"},"protocol":{"$ref":"#/$defs/_r84"}},"required":["container_port"],"title":"RuntimePublishedPortRef","type":"object"}, - "RuntimeResourceLimits": {"additionalProperties":false,"description":"Required capacity and process-resource policy for a runtime node.","properties":{"cpu":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Cpu"},"description":{"$ref":"#/$defs/_r53"},"memory":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Memory"},"memory_swap":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Memory Swap"},"pids":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Pids"},"process_limits":{"items":{"$ref":"#/$defs/RuntimeProcessResourceLimit"},"title":"Process Limits","type":"array"}},"title":"RuntimeResourceLimits","type":"object"}, + "RuntimeResourceLimits": {"additionalProperties":false,"description":"Required capacity and process-resource policy for a runtime node.","properties":{"cpu":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Cpu"},"description":{"$ref":"#/$defs/_r53"},"memory":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Memory"},"memory_swap":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Memory Swap"},"pids":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Pids"},"process_limits":{"items":{"$ref":"#/$defs/RuntimeProcessResourceLimit"},"title":"Process Limits","type":"array"}},"title":"RuntimeResourceLimits","type":"object"}, "RuntimeRestartPolicy": {"description":"Portable restart policy required by the scenario.","enum":["no","always","on_failure","unless_stopped","unknown","other"],"title":"RuntimeRestartPolicy","type":"string"}, "RuntimeScheduledJob": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a recurring scheduled job (cadence + run-state).","properties":{"command_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Command Ref","type":"string"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"name":{"$ref":"#/$defs/_r64"},"run_state":{"anyOf":[{"$ref":"#/$defs/RuntimeScheduledJobRunState"},{"type":"null"}],"default":null},"schedule":{"anyOf":[{"$ref":"#/$defs/RuntimeScheduledJobSchedule"},{"type":"null"}],"default":null},"scheduled_job_id":{"$ref":"#/$defs/_r3"}},"required":["scheduled_job_id"],"title":"RuntimeScheduledJob","type":"object"}, "RuntimeScheduledJobLastResult": {"description":"Open run-outcome taxonomy for the most recent scheduled-job execution.","enum":["success","failure","pending","unknown","other"],"title":"RuntimeScheduledJobLastResult","type":"string"}, "RuntimeScheduledJobRunState": {"additionalProperties":false,"description":"Observed run-state for a scheduled job.","properties":{"last_result":{"anyOf":[{"$ref":"#/$defs/RuntimeScheduledJobLastResult"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][cC][cC][eE][sS][sS]|[fF][aA][iI][lL][uU][rR][eE]|[pP][eE][nN][dD][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Last Result"},"last_run":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Last Run","type":"string"},"next_run":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Next Run","type":"string"}},"title":"RuntimeScheduledJobRunState","type":"object"}, "RuntimeScheduledJobSchedule": {"additionalProperties":false,"description":"The recurrence cadence for a scheduled job.","properties":{"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeScheduledJobScheduleKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][tT][eE][rR][vV][aA][lL]|[cC][rR][oO][nN]|[cC][aA][lL][eE][nN][dD][aA][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"interval","title":"Kind"},"spec":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Spec","type":"string"}},"title":"RuntimeScheduledJobSchedule","type":"object"}, "RuntimeScheduledJobScheduleKind": {"description":"Closed structural recurrence vocabulary for a scheduled-job schedule.\n\nThis is a fixed structural vocabulary (POSIX crontab / RFC 5545 RRULE /\nfixed-interval), so per the DSL-139 enum-sentinel rule it carries neither\n``unknown`` nor ``other``.","enum":["interval","cron","calendar"],"title":"RuntimeScheduledJobScheduleKind","type":"string"}, - "RuntimeSecurityMonitoringAgent": {"additionalProperties":false,"description":"An agent or sensor enrolled with the manager.","properties":{"address":{"$ref":"#/$defs/_r47"},"agent_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"group_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Group Refs","type":"array"},"name":{"$ref":"#/$defs/_r176"},"node_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node Ref","type":"string"},"os":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Os","type":"string"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringAgentStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][vV][aA][iI][lL][aA][bB][lL][eE]|[aA][cC][tT][iI][vV][eE]|[dD][iI][sS][cC][oO][nN][nN][eE][cC][tT][eE][dD]|[nN][eE][vV][eE][rR][-_][cC][oO][nN][nN][eE][cC][tT][eE][dD]|[pP][eE][nN][dD][iI][nN][gG]|[rR][eE][mM][oO][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"},"version":{"$ref":"#/$defs/_r81"}},"required":["agent_id","name"],"title":"RuntimeSecurityMonitoringAgent","type":"object"}, - "RuntimeSecurityMonitoringAgentGroup": {"additionalProperties":false,"description":"A manager-side enrolled-agent group.","properties":{"configuration_file_refs":{"$ref":"#/$defs/_r109"},"description":{"$ref":"#/$defs/_r53"},"group_id":{"$ref":"#/$defs/_r3"},"member_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Member Refs","type":"array"},"name":{"$ref":"#/$defs/_r64"}},"required":["group_id"],"title":"RuntimeSecurityMonitoringAgentGroup","type":"object"}, + "RuntimeSecurityMonitoringAgent": {"additionalProperties":false,"description":"An agent or sensor enrolled with the manager.","properties":{"address":{"$ref":"#/$defs/_r47"},"agent_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"group_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Group Refs","type":"array"},"name":{"$ref":"#/$defs/_r179"},"node_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node Ref","type":"string"},"os":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Os","type":"string"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringAgentStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][vV][aA][iI][lL][aA][bB][lL][eE]|[aA][cC][tT][iI][vV][eE]|[dD][iI][sS][cC][oO][nN][nN][eE][cC][tT][eE][dD]|[nN][eE][vV][eE][rR][-_][cC][oO][nN][nN][eE][cC][tT][eE][dD]|[pP][eE][nN][dD][iI][nN][gG]|[rR][eE][mM][oO][vV][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"},"version":{"$ref":"#/$defs/_r81"}},"required":["agent_id","name"],"title":"RuntimeSecurityMonitoringAgent","type":"object"}, + "RuntimeSecurityMonitoringAgentGroup": {"additionalProperties":false,"description":"A manager-side enrolled-agent group.","properties":{"configuration_file_refs":{"$ref":"#/$defs/_r112"},"description":{"$ref":"#/$defs/_r53"},"group_id":{"$ref":"#/$defs/_r3"},"member_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Member Refs","type":"array"},"name":{"$ref":"#/$defs/_r64"}},"required":["group_id"],"title":"RuntimeSecurityMonitoringAgentGroup","type":"object"}, "RuntimeSecurityMonitoringAgentStatus": {"description":"Observed enrolled-agent status.","enum":["available","active","disconnected","never_connected","pending","removed","unknown","other"],"title":"RuntimeSecurityMonitoringAgentStatus","type":"string"}, - "RuntimeSecurityMonitoringComponent": {"additionalProperties":false,"description":"A manager daemon, module, or internal component.","properties":{"component_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringComponentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][sS][iI][sS][-_][eE][nN][gG][iI][nN][eE]|[aA][gG][eE][nN][tT][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][gG][eE][nN][tT][-_][eE][nN][rR][oO][lL][lL][mM][eE][nN][tT]|[mM][oO][dD][uU][lL][eE][-_][sS][uU][pP][eE][rR][vV][iI][sS][oO][rR]|[lL][oO][gG][-_][cC][oO][lL][lL][eE][cC][tT][iI][oO][nN]|[aA][lL][eE][rR][tT][iI][nN][gG]|[aA][pP][iI]|[cC][lL][uU][sS][tT][eE][rR]|[iI][nN][dD][eE][xX][eE][rR][-_][fF][oO][rR][wW][aA][rR][dD][eE][rR]|[vV][uU][lL][nN][eE][rR][aA][bB][iI][lL][iI][tT][yY][-_][dD][eE][tT][eE][cC][tT][iI][oO][nN]|[fF][iI][lL][eE][-_][iI][nN][tT][eE][gG][rR][iI][tT][yY][-_][mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[rR][oO][oO][tT][kK][iI][tT][-_][dD][eE][tT][eE][cC][tT][iI][oO][nN]|[sS][cC][aA]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE]|[iI][nN][tT][eE][gG][rR][aA][tT][iI][oO][nN]|[dD][aA][tT][aA][bB][aA][sS][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r176"},"process_ref":{"$ref":"#/$defs/_r66"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringComponentStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][nN][nN][iI][nN][gG]|[sS][tT][oO][pP][pP][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[eE][nN][aA][bB][lL][eE][dD]|[dD][eE][gG][rR][aA][dD][eE][dD]|[fF][aA][iI][lL][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"}},"required":["component_id","name"],"title":"RuntimeSecurityMonitoringComponent","type":"object"}, + "RuntimeSecurityMonitoringComponent": {"additionalProperties":false,"description":"A manager daemon, module, or internal component.","properties":{"component_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"enabled":{"$ref":"#/$defs/_r27"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringComponentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][nN][aA][lL][yY][sS][iI][sS][-_][eE][nN][gG][iI][nN][eE]|[aA][gG][eE][nN][tT][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][gG][eE][nN][tT][-_][eE][nN][rR][oO][lL][lL][mM][eE][nN][tT]|[mM][oO][dD][uU][lL][eE][-_][sS][uU][pP][eE][rR][vV][iI][sS][oO][rR]|[lL][oO][gG][-_][cC][oO][lL][lL][eE][cC][tT][iI][oO][nN]|[aA][lL][eE][rR][tT][iI][nN][gG]|[aA][pP][iI]|[cC][lL][uU][sS][tT][eE][rR]|[iI][nN][dD][eE][xX][eE][rR][-_][fF][oO][rR][wW][aA][rR][dD][eE][rR]|[vV][uU][lL][nN][eE][rR][aA][bB][iI][lL][iI][tT][yY][-_][dD][eE][tT][eE][cC][tT][iI][oO][nN]|[fF][iI][lL][eE][-_][iI][nN][tT][eE][gG][rR][iI][tT][yY][-_][mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[rR][oO][oO][tT][kK][iI][tT][-_][dD][eE][tT][eE][cC][tT][iI][oO][nN]|[sS][cC][aA]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE]|[iI][nN][tT][eE][gG][rR][aA][tT][iI][oO][nN]|[dD][aA][tT][aA][bB][aA][sS][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"name":{"$ref":"#/$defs/_r179"},"process_ref":{"$ref":"#/$defs/_r66"},"status":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringComponentStatus"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][nN][nN][iI][nN][gG]|[sS][tT][oO][pP][pP][eE][dD]|[dD][iI][sS][aA][bB][lL][eE][dD]|[eE][nN][aA][bB][lL][eE][dD]|[dD][eE][gG][rR][aA][dD][eE][dD]|[fF][aA][iI][lL][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Status"}},"required":["component_id","name"],"title":"RuntimeSecurityMonitoringComponent","type":"object"}, "RuntimeSecurityMonitoringComponentKind": {"description":"Portable component/module kind inside a security-monitoring manager.","enum":["analysis_engine","agent_ingestion","agent_enrollment","module_supervisor","log_collection","alerting","api","cluster","indexer_forwarder","vulnerability_detection","file_integrity_monitoring","rootkit_detection","sca","active_response","integration","database","other","unknown"],"title":"RuntimeSecurityMonitoringComponentKind","type":"string"}, "RuntimeSecurityMonitoringComponentStatus": {"description":"Observed component/module status.","enum":["running","stopped","disabled","enabled","degraded","failed","unknown","other"],"title":"RuntimeSecurityMonitoringComponentStatus","type":"string"}, "RuntimeSecurityMonitoringContentFormat": {"description":"Portable format family for manager-owned content.","enum":["wazuh_rule_xml","wazuh_decoder_xml","sigma","yara","stix","json","yaml","xml","query","unknown","other"],"title":"RuntimeSecurityMonitoringContentFormat","type":"string"}, "RuntimeSecurityMonitoringContentKind": {"description":"Kind of manager-owned detection or monitoring content.","enum":["rule_corpus","decoder_corpus","correlation_rules","sca_policies","active_response","cdb_list","threat_intel","dashboard","other","unknown"],"title":"RuntimeSecurityMonitoringContentKind","type":"string"}, - "RuntimeSecurityMonitoringContentSet": {"additionalProperties":false,"description":"A manager-owned rule, decoder, policy, list, or query corpus.","properties":{"content_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"file_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"File Count"},"file_refs":{"$ref":"#/$defs/_r120"},"format":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringContentFormat"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH][-_][rR][uU][lL][eE][-_][xX][mM][lL]|[wW][aA][zZ][uU][hH][-_][dD][eE][cC][oO][dD][eE][rR][-_][xX][mM][lL]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][tT][iI][xX]|[jJ][sS][oO][nN]|[yY][aA][mM][lL]|[xX][mM][lL]|[qQ][uU][eE][rR][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Format"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringContentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][lL][eE][-_][cC][oO][rR][pP][uU][sS]|[dD][eE][cC][oO][dD][eE][rR][-_][cC][oO][rR][pP][uU][sS]|[cC][oO][rR][rR][eE][lL][aA][tT][iI][oO][nN][-_][rR][uU][lL][eE][sS]|[sS][cC][aA][-_][pP][oO][lL][iI][cC][iI][eE][sS]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE]|[cC][dD][bB][-_][lL][iI][sS][tT]|[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"loaded":{"$ref":"#/$defs/_r28"},"name":{"$ref":"#/$defs/_r64"}},"required":["content_id"],"title":"RuntimeSecurityMonitoringContentSet","type":"object"}, - "RuntimeSecurityMonitoringDetectionDefinition": {"additionalProperties":false,"description":"A parsed detection definition loaded by a security-monitoring manager.","properties":{"canonical_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Canonical Digest","type":"string"},"compliance_tags":{"items":{"$ref":"#/$defs/_r187"},"title":"Compliance Tags","type":"array"},"content_set_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Set Ref","type":"string"},"decoded_as":{"items":{"$ref":"#/$defs/_r187"},"title":"Decoded As","type":"array"},"decoder_fields":{"items":{"$ref":"#/$defs/_r187"},"title":"Decoder Fields","type":"array"},"decoder_names":{"items":{"$ref":"#/$defs/_r187"},"title":"Decoder Names","type":"array"},"definition_id":{"$ref":"#/$defs/_r3"},"definition_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionDefinitionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][lL][eE]|[cC][oO][rR][rR][eE][lL][aA][tT][iI][oO][nN][-_][rR][uU][lL][eE]|[dD][eE][cC][oO][dD][eE][rR]|[lL][iI][sS][tT][-_][bB][aA][cC][kK][eE][dD][-_][rR][uU][lL][eE]|[sS][cC][aA][-_][pP][oO][lL][iI][cC][yY][-_][cC][hH][eE][cC][kK]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE][-_][tT][rR][iI][gG][gG][eE][rR]|[sS][iI][gG][mM][aA][-_][rR][uU][lL][eE]|[yY][aA][rR][aA][-_][rR][uU][lL][eE]|[sS][uU][rR][iI][cC][aA][tT][aA][-_][rR][uU][lL][eE]|[sS][iI][eE][mM][-_][aA][nN][aA][lL][yY][tT][iI][cC]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Definition Kind"},"description":{"$ref":"#/$defs/_r53"},"digest_algorithm":{"$ref":"#/$defs/_r55"},"enabled":{"$ref":"#/$defs/_r27"},"engine":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionEngine"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH]|[oO][sS][sS][eE][cC]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][uU][rR][iI][cC][aA][tT][aA]|[eE][lL][aA][sS][tT][iI][cC][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][pP][lL][uU][nN][kK][-_][eE][nN][tT][eE][rR][pP][rR][iI][sS][eE][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[mM][iI][cC][rR][oO][sS][oO][fF][tT][-_][sS][eE][nN][tT][iI][nN][eE][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine"},"evidence_refs":{"$ref":"#/$defs/_r119"},"field_predicates":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringFieldPredicate"},"title":"Field Predicates","type":"array"},"frequency":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Frequency"},"groups":{"$ref":"#/$defs/_r121"},"if_matched_sid_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"If Matched Sid Refs","type":"array"},"if_sid_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"If Sid Refs","type":"array"},"level":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Level"},"loaded":{"$ref":"#/$defs/_r28"},"match_strings":{"items":{"$ref":"#/$defs/_r187"},"title":"Match Strings","type":"array"},"mitre_attack_ids":{"items":{"$ref":"#/$defs/_r187"},"title":"Mitre Attack Ids","type":"array"},"name":{"$ref":"#/$defs/_r64"},"native_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Native Id","type":"string"},"parent_definition_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Parent Definition Refs","type":"array"},"parser_accepted":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Parser Accepted"},"regex_patterns":{"items":{"$ref":"#/$defs/_r187"},"title":"Regex Patterns","type":"array"},"same_source_constraints":{"items":{"$ref":"#/$defs/_r187"},"title":"Same Source Constraints","type":"array"},"severity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Severity","type":"string"},"source_artifact_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Artifact Ref","type":"string"},"source_end_line":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Source End Line"},"source_file_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source File Ref","type":"string"},"source_start_line":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Source Start Line"},"tactic_labels":{"items":{"$ref":"#/$defs/_r187"},"title":"Tactic Labels","type":"array"},"tags":{"$ref":"#/$defs/_r129"},"target_refs":{"$ref":"#/$defs/_r130"},"technique_labels":{"items":{"$ref":"#/$defs/_r187"},"title":"Technique Labels","type":"array"},"timeframe_seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Timeframe Seconds"}},"required":["definition_id"],"title":"RuntimeSecurityMonitoringDetectionDefinition","type":"object"}, + "RuntimeSecurityMonitoringContentSet": {"additionalProperties":false,"description":"A manager-owned rule, decoder, policy, list, or query corpus.","properties":{"content_id":{"$ref":"#/$defs/_r3"},"description":{"$ref":"#/$defs/_r53"},"file_count":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"File Count"},"file_refs":{"$ref":"#/$defs/_r123"},"format":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringContentFormat"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH][-_][rR][uU][lL][eE][-_][xX][mM][lL]|[wW][aA][zZ][uU][hH][-_][dD][eE][cC][oO][dD][eE][rR][-_][xX][mM][lL]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][tT][iI][xX]|[jJ][sS][oO][nN]|[yY][aA][mM][lL]|[xX][mM][lL]|[qQ][uU][eE][rR][yY]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Format"},"kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringContentKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][lL][eE][-_][cC][oO][rR][pP][uU][sS]|[dD][eE][cC][oO][dD][eE][rR][-_][cC][oO][rR][pP][uU][sS]|[cC][oO][rR][rR][eE][lL][aA][tT][iI][oO][nN][-_][rR][uU][lL][eE][sS]|[sS][cC][aA][-_][pP][oO][lL][iI][cC][iI][eE][sS]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE]|[cC][dD][bB][-_][lL][iI][sS][tT]|[tT][hH][rR][eE][aA][tT][-_][iI][nN][tT][eE][lL]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Kind"},"loaded":{"$ref":"#/$defs/_r28"},"name":{"$ref":"#/$defs/_r64"}},"required":["content_id"],"title":"RuntimeSecurityMonitoringContentSet","type":"object"}, + "RuntimeSecurityMonitoringDetectionDefinition": {"additionalProperties":false,"description":"A parsed detection definition loaded by a security-monitoring manager.","properties":{"canonical_digest":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Canonical Digest","type":"string"},"compliance_tags":{"items":{"$ref":"#/$defs/_r190"},"title":"Compliance Tags","type":"array"},"content_set_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Content Set Ref","type":"string"},"decoded_as":{"items":{"$ref":"#/$defs/_r190"},"title":"Decoded As","type":"array"},"decoder_fields":{"items":{"$ref":"#/$defs/_r190"},"title":"Decoder Fields","type":"array"},"decoder_names":{"items":{"$ref":"#/$defs/_r190"},"title":"Decoder Names","type":"array"},"definition_id":{"$ref":"#/$defs/_r3"},"definition_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionDefinitionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[rR][uU][lL][eE]|[cC][oO][rR][rR][eE][lL][aA][tT][iI][oO][nN][-_][rR][uU][lL][eE]|[dD][eE][cC][oO][dD][eE][rR]|[lL][iI][sS][tT][-_][bB][aA][cC][kK][eE][dD][-_][rR][uU][lL][eE]|[sS][cC][aA][-_][pP][oO][lL][iI][cC][yY][-_][cC][hH][eE][cC][kK]|[aA][cC][tT][iI][vV][eE][-_][rR][eE][sS][pP][oO][nN][sS][eE][-_][tT][rR][iI][gG][gG][eE][rR]|[sS][iI][gG][mM][aA][-_][rR][uU][lL][eE]|[yY][aA][rR][aA][-_][rR][uU][lL][eE]|[sS][uU][rR][iI][cC][aA][tT][aA][-_][rR][uU][lL][eE]|[sS][iI][eE][mM][-_][aA][nN][aA][lL][yY][tT][iI][cC]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Definition Kind"},"description":{"$ref":"#/$defs/_r53"},"digest_algorithm":{"$ref":"#/$defs/_r55"},"enabled":{"$ref":"#/$defs/_r27"},"engine":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionEngine"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH]|[oO][sS][sS][eE][cC]|[sS][iI][gG][mM][aA]|[yY][aA][rR][aA]|[sS][uU][rR][iI][cC][aA][tT][aA]|[eE][lL][aA][sS][tT][iI][cC][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][pP][lL][uU][nN][kK][-_][eE][nN][tT][eE][rR][pP][rR][iI][sS][eE][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[mM][iI][cC][rR][oO][sS][oO][fF][tT][-_][sS][eE][nN][tT][iI][nN][eE][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Engine"},"evidence_refs":{"$ref":"#/$defs/_r122"},"field_predicates":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringFieldPredicate"},"title":"Field Predicates","type":"array"},"frequency":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Frequency"},"groups":{"$ref":"#/$defs/_r124"},"if_matched_sid_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"If Matched Sid Refs","type":"array"},"if_sid_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"If Sid Refs","type":"array"},"level":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Level"},"loaded":{"$ref":"#/$defs/_r28"},"match_strings":{"items":{"$ref":"#/$defs/_r190"},"title":"Match Strings","type":"array"},"mitre_attack_ids":{"items":{"$ref":"#/$defs/_r190"},"title":"Mitre Attack Ids","type":"array"},"name":{"$ref":"#/$defs/_r64"},"native_id":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Native Id","type":"string"},"parent_definition_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Parent Definition Refs","type":"array"},"parser_accepted":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Parser Accepted"},"regex_patterns":{"items":{"$ref":"#/$defs/_r190"},"title":"Regex Patterns","type":"array"},"same_source_constraints":{"items":{"$ref":"#/$defs/_r190"},"title":"Same Source Constraints","type":"array"},"severity":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Severity","type":"string"},"source_artifact_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Artifact Ref","type":"string"},"source_end_line":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Source End Line"},"source_file_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source File Ref","type":"string"},"source_start_line":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Source Start Line"},"tactic_labels":{"items":{"$ref":"#/$defs/_r190"},"title":"Tactic Labels","type":"array"},"tags":{"$ref":"#/$defs/_r132"},"target_refs":{"$ref":"#/$defs/_r133"},"technique_labels":{"items":{"$ref":"#/$defs/_r190"},"title":"Technique Labels","type":"array"},"timeframe_seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Timeframe Seconds"}},"required":["definition_id"],"title":"RuntimeSecurityMonitoringDetectionDefinition","type":"object"}, "RuntimeSecurityMonitoringDetectionDefinitionKind": {"description":"Portable kind of parsed security-monitoring detection definition.","enum":["rule","correlation_rule","decoder","list_backed_rule","sca_policy_check","active_response_trigger","sigma_rule","yara_rule","suricata_rule","siem_analytic","other","unknown"],"title":"RuntimeSecurityMonitoringDetectionDefinitionKind","type":"string"}, "RuntimeSecurityMonitoringDetectionEngine": {"description":"Portable detection-definition engine family.","enum":["wazuh","ossec","sigma","yara","suricata","elastic_security","splunk_enterprise_security","microsoft_sentinel","unknown","other"],"title":"RuntimeSecurityMonitoringDetectionEngine","type":"string"}, "RuntimeSecurityMonitoringFieldPredicate": {"additionalProperties":false,"description":"A normalized field predicate extracted from a detection definition.","properties":{"description":{"$ref":"#/$defs/_r53"},"field":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Field","type":"string"},"operator":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringFieldPredicateOperator"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][qQ][uU][aA][lL][sS]|[mM][aA][tT][cC][hH][eE][sS]|[cC][oO][nN][tT][aA][iI][nN][sS]|[eE][xX][iI][sS][tT][sS]|[iI][nN]|[rR][eE][gG][eE][xX]|[lL][eE][sS][sS][-_][tT][hH][aA][nN]|[gG][rR][eE][aA][tT][eE][rR][-_][tT][hH][aA][nN]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Operator"},"value":{"$ref":"#/$defs/_r80"}},"required":["field"],"title":"RuntimeSecurityMonitoringFieldPredicate","type":"object"}, "RuntimeSecurityMonitoringFieldPredicateOperator": {"description":"Portable operator for a parsed field-level predicate.","enum":["equals","matches","contains","exists","in","regex","less_than","greater_than","other","unknown"],"title":"RuntimeSecurityMonitoringFieldPredicateOperator","type":"string"}, "RuntimeSecurityMonitoringImplementation": {"description":"Product family for an observed security-monitoring manager.","enum":["wazuh","ossec","elastic_security","splunk_enterprise_security","security_onion","microsoft_sentinel","unknown","other"],"title":"RuntimeSecurityMonitoringImplementation","type":"string"}, - "RuntimeSecurityMonitoringListener": {"additionalProperties":false,"description":"A manager listener bound to a same-node transport service.","properties":{"auth_required":{"$ref":"#/$defs/_r26"},"description":{"$ref":"#/$defs/_r53"},"listener_id":{"$ref":"#/$defs/_r3"},"protocol":{"$ref":"#/$defs/_r67"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringListenerRole"},{"$ref":"#/$defs/_r149"}],"default":"other","title":"Role"},"service":{"$ref":"#/$defs/_r70"},"tls_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Tls Enabled"}},"required":["listener_id"],"title":"RuntimeSecurityMonitoringListener","type":"object"}, + "RuntimeSecurityMonitoringListener": {"additionalProperties":false,"description":"A manager listener bound to a same-node transport service.","properties":{"auth_required":{"$ref":"#/$defs/_r26"},"description":{"$ref":"#/$defs/_r53"},"listener_id":{"$ref":"#/$defs/_r3"},"protocol":{"$ref":"#/$defs/_r67"},"role":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringListenerRole"},{"$ref":"#/$defs/_r152"}],"default":"other","title":"Role"},"service":{"$ref":"#/$defs/_r70"},"tls_enabled":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Tls Enabled"}},"required":["listener_id"],"title":"RuntimeSecurityMonitoringListener","type":"object"}, "RuntimeSecurityMonitoringListenerRole": {"description":"Logical role of a manager transport listener.","enum":["agent_event_ingestion","agent_enrollment","syslog_ingestion","api","alert_forwarding","indexer_forwarding","dashboard","other","unknown"],"title":"RuntimeSecurityMonitoringListenerRole","type":"string"}, - "RuntimeSecurityMonitoringManager": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a SIEM/security-monitoring manager.","properties":{"agent_groups":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringAgentGroup"},"title":"Agent Groups","type":"array"},"agents":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringAgent"},"title":"Agents","type":"array"},"components":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringComponent"},"title":"Components","type":"array"},"configuration_file_refs":{"$ref":"#/$defs/_r109"},"content_sets":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringContentSet"},"title":"Content Sets","type":"array"},"description":{"$ref":"#/$defs/_r53"},"detection_definitions":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionDefinition"},"title":"Detection Definitions","type":"array"},"evidence_refs":{"$ref":"#/$defs/_r119"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH]|[oO][sS][sS][eE][cC]|[eE][lL][aA][sS][tT][iI][cC][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][pP][lL][uU][nN][kK][-_][eE][nN][tT][eE][rR][pP][rR][iI][sS][eE][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[mM][iI][cC][rR][oO][sS][oO][fF][tT][-_][sS][eE][nN][tT][iI][nN][eE][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"listeners":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringListener"},"title":"Listeners","type":"array"},"log_file_refs":{"$ref":"#/$defs/_r124"},"manager_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringManagerKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][iI][eE][mM]|[xX][dD][rR]|[hH][iI][dD][sS]|[nN][dD][rR]|[lL][oO][gG][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[dD][eE][tT][eE][cC][tT][iI][oO][nN][-_][eE][nN][gG][iI][nN][eE]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Manager Kind"},"name":{"$ref":"#/$defs/_r64"},"revision":{"$ref":"#/$defs/_r68"},"security_monitoring_manager_id":{"$ref":"#/$defs/_r3"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"}},"required":["security_monitoring_manager_id"],"title":"RuntimeSecurityMonitoringManager","type":"object"}, + "RuntimeSecurityMonitoringManager": {"additionalProperties":false,"description":"Node-scoped runtime inventory for a SIEM/security-monitoring manager.","properties":{"agent_groups":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringAgentGroup"},"title":"Agent Groups","type":"array"},"agents":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringAgent"},"title":"Agents","type":"array"},"components":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringComponent"},"title":"Components","type":"array"},"configuration_file_refs":{"$ref":"#/$defs/_r112"},"content_sets":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringContentSet"},"title":"Content Sets","type":"array"},"description":{"$ref":"#/$defs/_r53"},"detection_definitions":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringDetectionDefinition"},"title":"Detection Definitions","type":"array"},"evidence_refs":{"$ref":"#/$defs/_r122"},"implementation":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringImplementation"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][aA][zZ][uU][hH]|[oO][sS][sS][eE][cC]|[eE][lL][aA][sS][tT][iI][cC][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][pP][lL][uU][nN][kK][-_][eE][nN][tT][eE][rR][pP][rR][iI][sS][eE][-_][sS][eE][cC][uU][rR][iI][tT][yY]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][oO][nN][iI][oO][nN]|[mM][iI][cC][rR][oO][sS][oO][fF][tT][-_][sS][eE][nN][tT][iI][nN][eE][lL]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Implementation"},"listeners":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringListener"},"title":"Listeners","type":"array"},"log_file_refs":{"$ref":"#/$defs/_r127"},"manager_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringManagerKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][iI][eE][mM]|[xX][dD][rR]|[hH][iI][dD][sS]|[nN][dD][rR]|[lL][oO][gG][-_][mM][aA][nN][aA][gG][eE][mM][eE][nN][tT]|[dD][eE][tT][eE][cC][tT][iI][oO][nN][-_][eE][nN][gG][iI][nN][eE]|[sS][eE][cC][uU][rR][iI][tT][yY][-_][mM][oO][nN][iI][tT][oO][rR][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Manager Kind"},"name":{"$ref":"#/$defs/_r64"},"revision":{"$ref":"#/$defs/_r68"},"security_monitoring_manager_id":{"$ref":"#/$defs/_r3"},"service":{"$ref":"#/$defs/_r70"},"settings":{"items":{"$ref":"#/$defs/RuntimeSecurityMonitoringSetting"},"title":"Settings","type":"array"},"version":{"$ref":"#/$defs/_r81"}},"required":["security_monitoring_manager_id"],"title":"RuntimeSecurityMonitoringManager","type":"object"}, "RuntimeSecurityMonitoringManagerKind": {"description":"Portable manager role/family.","enum":["siem","xdr","hids","ndr","log_management","detection_engine","security_monitoring","unknown","other"],"title":"RuntimeSecurityMonitoringManagerKind","type":"string"}, - "RuntimeSecurityMonitoringSetting": {"additionalProperties":false,"description":"A bounded manager setting with sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r176"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[aA][pP][iI]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"source_path":{"$ref":"#/$defs/_r73"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["setting_id","name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeSecurityMonitoringSetting","type":"object"}, + "RuntimeSecurityMonitoringSetting": {"additionalProperties":false,"description":"A bounded manager setting with sensitivity classification.","if":{"properties":{"value_classification":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["value_classification"]},"properties":{"component_ref":{"$ref":"#/$defs/_r52"},"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r179"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeSecurityMonitoringSettingProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[aA][pP][iI]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"setting_id":{"$ref":"#/$defs/_r3"},"source_path":{"$ref":"#/$defs/_r73"},"value":{"$ref":"#/$defs/_r80"},"value_classification":{"$ref":"#/$defs/_r20"}},"required":["setting_id","name"],"then":{"not":{"properties":{"value":{"minLength":1,"type":"string"}},"required":["value"]}},"title":"RuntimeSecurityMonitoringSetting","type":"object"}, "RuntimeSecurityMonitoringSettingProvenance": {"description":"Where an observed manager setting came from.","enum":["introspection","configuration_file","api","image_default","operator_override","runtime_default","unknown","other"],"title":"RuntimeSecurityMonitoringSettingProvenance","type":"string"}, "RuntimeSensitivityClassification": {"description":"Sensitivity/redaction class for observed runtime facts.","enum":["plain","redacted","secret_fixture","operator_secret","unknown","other"],"title":"RuntimeSensitivityClassification","type":"string"}, - "RuntimeServiceListener": {"additionalProperties":false,"description":"Possibly partial runtime listener description attached to a node.\n\nOnly ``service_listener_id`` is universally required. Supplied facts are\nvalidated for bounds and contradictions, but missing endpoint facts are\nnot fabricated or rejected at this descriptive boundary.","properties":{"address":{"$ref":"#/$defs/_r47"},"address_family":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerAddressFamily"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][pP][vV]4|[iI][pP][vV]6|[uU][nN][iI][xX]|[uU][nN][sS][pP][eE][cC][iI][fF][iI][eE][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unspecified","title":"Address Family"},"bind_interface":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Bind Interface","type":"string"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r119"},"port":{"$ref":"#/$defs/_r37"},"process_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Process Name","type":"string"},"process_ref":{"$ref":"#/$defs/_r66"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][cC][pP]|[uU][dD][pP]|[sS][cC][tT][pP]|[uU][nN][iI][xX]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"tcp","title":"Protocol"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[oO][sS][qQ][uU][eE][rR][yY]|[sS][sS]|[nN][eE][tT][sS][tT][aA][tT]|[lL][sS][oO][fF]|[nN][mM][aA][pP]|[dD][oO][cC][kK][eE][rR][-_][iI][nN][sS][pP][eE][cC][tT]|[kK][uU][bB][eE][rR][nN][eE][tT][eE][sS]|[sS][yY][sS][tT][eE][mM][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[sS][cC][aA][nN][nN][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"published_port_refs":{"items":{"$ref":"#/$defs/RuntimePublishedPortRef"},"title":"Published Port Refs","type":"array"},"readiness":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerReadiness"},{"type":"null"}],"default":null},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][iI][lL][dD][cC][aA][rR][dD]|[lL][oO][oO][pP][bB][aA][cC][kK][-_][oO][nN][lL][yY]|[nN][eE][tT][wW][oO][rR][kK][-_][fF][aA][cC][iI][nN][gG]|[nN][oO][dD][eE][-_][lL][oO][cC][aA][lL]|[lL][oO][cC][aA][lL][-_][sS][oO][cC][kK][eE][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Scope"},"service":{"$ref":"#/$defs/_r70"},"service_listener_id":{"$ref":"#/$defs/_r3"},"socket_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Socket Path","type":"string"}},"required":["service_listener_id"],"title":"RuntimeServiceListener","type":"object"}, - "RuntimeSoftwareComponent": {"additionalProperties":false,"description":"A software component required as part of a runtime node's state.","properties":{"component_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Component Id","type":"string"},"component_type":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwareComponentType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[fF][rR][aA][mM][eE][wW][oO][rR][kK]|[lL][iI][bB][rR][aA][rR][yY]|[cC][oO][nN][tT][aA][iI][nN][eE][rR]|[pP][lL][aA][tT][fF][oO][rR][mM]|[oO][pP][eE][rR][aA][tT][iI][nN][gG][-_][sS][yY][sS][tT][eE][mM]|[dD][eE][vV][iI][cC][eE]|[dD][eE][vV][iI][cC][eE][-_][dD][rR][iI][vV][eE][rR]|[fF][iI][rR][mM][wW][aA][rR][eE]|[fF][iI][lL][eE]|[dD][aA][tT][aA]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Component Type"},"cpe":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cpe","type":"string"},"description":{"$ref":"#/$defs/_r53"},"ecosystem":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ecosystem","type":"string"},"hashes":{"items":{"$ref":"#/$defs/RuntimeSoftwareComponentHash"},"title":"Hashes","type":"array"},"installed_paths":{"items":{"$ref":"#/$defs/_r187"},"title":"Installed Paths","type":"array"},"manifest_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Manifest Path","type":"string"},"name":{"$ref":"#/$defs/_r176"},"package":{"anyOf":[{"$ref":"#/$defs/RuntimePackage"},{"type":"null"}],"default":null},"package_manager":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Manager","type":"string"},"package_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Name","type":"string"},"package_ref":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwarePackageReference"},{"type":"null"}],"default":null},"package_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Version","type":"string"},"package_version_constraint":{"anyOf":[{"$ref":"#/$defs/VersionDomain"},{"type":"null"}],"default":null},"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwareComponentProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][cC][kK][aA][gG][eE][-_][mM][aA][nN][aA][gG][eE][rR]|[dD][eE][pP][eE][nN][dD][eE][nN][cC][yY][-_][mM][aA][nN][iI][fF][eE][sS][tT]|[iI][mM][aA][gG][eE][-_][mM][eE][tT][aA][dD][aA][tT][aA]|[oO][pP][eE][rR][aA][tT][oO][rR]|[sS][eE][lL][fF][-_][rR][eE][pP][oO][rR][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"purl":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Purl","type":"string"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareComponentRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"repository_refs":{"items":{"$ref":"#/$defs/_r3"},"maxItems":256,"title":"Repository Refs","type":"array"},"version":{"$ref":"#/$defs/_r81"},"version_constraint":{"anyOf":[{"$ref":"#/$defs/VersionDomain"},{"type":"null"}],"default":null}},"required":["component_id","name"],"title":"RuntimeSoftwareComponent","type":"object"}, - "RuntimeSoftwareComponentHash": {"additionalProperties":false,"description":"Digest required for a runtime software component.","properties":{"algorithm":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Algorithm","type":"string"},"value":{"$ref":"#/$defs/_r186"}},"required":["algorithm","value"],"title":"RuntimeSoftwareComponentHash","type":"object"}, + "RuntimeServiceListener": {"additionalProperties":false,"description":"Possibly partial runtime listener description attached to a node.\n\nOnly ``service_listener_id`` is universally required. Supplied facts are\nvalidated for bounds and contradictions, but missing endpoint facts are\nnot fabricated or rejected at this descriptive boundary.","properties":{"address":{"$ref":"#/$defs/_r47"},"address_family":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerAddressFamily"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][pP][vV]4|[iI][pP][vV]6|[uU][nN][iI][xX]|[uU][nN][sS][pP][eE][cC][iI][fF][iI][eE][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unspecified","title":"Address Family"},"bind_interface":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Bind Interface","type":"string"},"description":{"$ref":"#/$defs/_r53"},"evidence_refs":{"$ref":"#/$defs/_r122"},"port":{"$ref":"#/$defs/_r37"},"process_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Process Name","type":"string"},"process_ref":{"$ref":"#/$defs/_r66"},"protocol":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerProtocol"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[tT][cC][pP]|[uU][dD][pP]|[sS][cC][tT][pP]|[uU][nN][iI][xX]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"tcp","title":"Protocol"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[oO][sS][qQ][uU][eE][rR][yY]|[sS][sS]|[nN][eE][tT][sS][tT][aA][tT]|[lL][sS][oO][fF]|[nN][mM][aA][pP]|[dD][oO][cC][kK][eE][rR][-_][iI][nN][sS][pP][eE][cC][tT]|[kK][uU][bB][eE][rR][nN][eE][tT][eE][sS]|[sS][yY][sS][tT][eE][mM][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[sS][cC][aA][nN][nN][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"published_port_refs":{"items":{"$ref":"#/$defs/RuntimePublishedPortRef"},"title":"Published Port Refs","type":"array"},"readiness":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerReadiness"},{"type":"null"}],"default":null},"scope":{"anyOf":[{"$ref":"#/$defs/RuntimeListenerScope"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[wW][iI][lL][dD][cC][aA][rR][dD]|[lL][oO][oO][pP][bB][aA][cC][kK][-_][oO][nN][lL][yY]|[nN][eE][tT][wW][oO][rR][kK][-_][fF][aA][cC][iI][nN][gG]|[nN][oO][dD][eE][-_][lL][oO][cC][aA][lL]|[lL][oO][cC][aA][lL][-_][sS][oO][cC][kK][eE][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Scope"},"service":{"$ref":"#/$defs/_r70"},"service_listener_id":{"$ref":"#/$defs/_r3"},"socket_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Socket Path","type":"string"}},"required":["service_listener_id"],"title":"RuntimeServiceListener","type":"object"}, + "RuntimeSoftwareComponent": {"additionalProperties":false,"description":"A software component required as part of a runtime node's state.","properties":{"component_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Component Id","type":"string"},"component_type":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwareComponentType"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]|[fF][rR][aA][mM][eE][wW][oO][rR][kK]|[lL][iI][bB][rR][aA][rR][yY]|[cC][oO][nN][tT][aA][iI][nN][eE][rR]|[pP][lL][aA][tT][fF][oO][rR][mM]|[oO][pP][eE][rR][aA][tT][iI][nN][gG][-_][sS][yY][sS][tT][eE][mM]|[dD][eE][vV][iI][cC][eE]|[dD][eE][vV][iI][cC][eE][-_][dD][rR][iI][vV][eE][rR]|[fF][iI][rR][mM][wW][aA][rR][eE]|[fF][iI][lL][eE]|[dD][aA][tT][aA]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Component Type"},"cpe":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cpe","type":"string"},"description":{"$ref":"#/$defs/_r53"},"ecosystem":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ecosystem","type":"string"},"hashes":{"items":{"$ref":"#/$defs/RuntimeSoftwareComponentHash"},"title":"Hashes","type":"array"},"installed_paths":{"items":{"$ref":"#/$defs/_r190"},"title":"Installed Paths","type":"array"},"manifest_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Manifest Path","type":"string"},"name":{"$ref":"#/$defs/_r179"},"package":{"anyOf":[{"$ref":"#/$defs/RuntimePackage"},{"type":"null"}],"default":null},"package_manager":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Manager","type":"string"},"package_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Name","type":"string"},"package_ref":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwarePackageReference"},{"type":"null"}],"default":null},"package_version":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Package Version","type":"string"},"package_version_constraint":{"anyOf":[{"$ref":"#/$defs/VersionDomain"},{"type":"null"}],"default":null},"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"provenance":{"anyOf":[{"$ref":"#/$defs/RuntimeSoftwareComponentProvenance"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][aA][cC][kK][aA][gG][eE][-_][mM][aA][nN][aA][gG][eE][rR]|[dD][eE][pP][eE][nN][dD][eE][nN][cC][yY][-_][mM][aA][nN][iI][fF][eE][sS][tT]|[iI][mM][aA][gG][eE][-_][mM][eE][tT][aA][dD][aA][tT][aA]|[oO][pP][eE][rR][aA][tT][oO][rR]|[sS][eE][lL][fF][-_][rR][eE][pP][oO][rR][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Provenance"},"purl":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Purl","type":"string"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareComponentRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"repository_refs":{"items":{"$ref":"#/$defs/_r3"},"maxItems":256,"title":"Repository Refs","type":"array"},"version":{"$ref":"#/$defs/_r81"},"version_constraint":{"anyOf":[{"$ref":"#/$defs/VersionDomain"},{"type":"null"}],"default":null}},"required":["component_id","name"],"title":"RuntimeSoftwareComponent","type":"object"}, + "RuntimeSoftwareComponentHash": {"additionalProperties":false,"description":"Digest required for a runtime software component.","properties":{"algorithm":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Algorithm","type":"string"},"value":{"$ref":"#/$defs/_r189"}},"required":["algorithm","value"],"title":"RuntimeSoftwareComponentHash","type":"object"}, "RuntimeSoftwareComponentProvenance": {"description":"Required source origin for a runtime software component.","enum":["package_manager","dependency_manifest","image_metadata","operator","self_reported","unknown","other"],"title":"RuntimeSoftwareComponentProvenance","type":"string"}, "RuntimeSoftwareComponentRefinement": {"additionalProperties":false,"description":"A component's acquisition or application/package correspondence constraint.","properties":{"definition":{"$ref":"#/$defs/DomainProfileDefinitionModel"},"profile_value":{"$ref":"#/$defs/JsonValue"},"purpose":{"enum":["acquisition","version-correspondence"],"title":"Purpose","type":"string"},"refinement_id":{"$ref":"#/$defs/_r2"}},"required":["refinement_id","purpose","definition","profile_value"],"title":"RuntimeSoftwareComponentRefinement","type":"object"}, "RuntimeSoftwareComponentType": {"description":"Portable type for a software component required on a runtime node.","enum":["application","framework","library","container","platform","operating_system","device","device_driver","firmware","file","data","unknown","other"],"title":"RuntimeSoftwareComponentType","type":"string"}, "RuntimeSoftwarePackageReference": {"additionalProperties":false,"description":"Explicit correspondence to a package row; no identity is inferred.","properties":{"architecture":{"$ref":"#/$defs/_r46"},"manager":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Manager","type":"string"},"name":{"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Name","type":"string"}},"required":["manager","name"],"title":"RuntimeSoftwarePackageReference","type":"object"}, - "RuntimeSoftwareRepository": {"additionalProperties":false,"description":"A stable final-state repository identity shared by software requirements.","properties":{"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareRepositoryRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"repository_id":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Repository Id","type":"string"},"trust_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Trust Ref"}},"required":["repository_id"],"title":"RuntimeSoftwareRepository","type":"object"}, + "RuntimeSoftwareRepository": {"additionalProperties":false,"description":"A stable final-state repository identity shared by software requirements.","properties":{"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareRepositoryRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"repository_id":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Repository Id","type":"string"},"trust_ref":{"anyOf":[{"$ref":"#/$defs/_r3"},{"type":"null"}],"default":null,"title":"Trust Ref"}},"required":["repository_id"],"title":"RuntimeSoftwareRepository","type":"object"}, "RuntimeSoftwareRepositoryRefinement": {"additionalProperties":false,"description":"A final-state constraint attached to a shared repository identity.","properties":{"definition":{"$ref":"#/$defs/DomainProfileDefinitionModel"},"profile_value":{"$ref":"#/$defs/JsonValue"},"purpose":{"const":"repository-state","title":"Purpose","type":"string"},"refinement_id":{"$ref":"#/$defs/_r2"}},"required":["refinement_id","purpose","definition","profile_value"],"title":"RuntimeSoftwareRepositoryRefinement","type":"object"}, "RuntimeSoftwareRepositoryState": {"additionalProperties":false,"description":"Bounded shared repository and trust identities, not an installation route.","properties":{"repositories":{"items":{"$ref":"#/$defs/RuntimeSoftwareRepository"},"maxItems":256,"title":"Repositories","type":"array"},"trust_bindings":{"items":{"$ref":"#/$defs/RuntimeSoftwareTrustBinding"},"maxItems":256,"title":"Trust Bindings","type":"array"}},"title":"RuntimeSoftwareRepositoryState","type":"object"}, - "RuntimeSoftwareTrustBinding": {"additionalProperties":false,"description":"An author-owned trust identity; concrete trust semantics require a profile.","properties":{"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareTrustRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"trust_id":{"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Trust Id","type":"string"}},"required":["trust_id"],"title":"RuntimeSoftwareTrustBinding","type":"object"}, + "RuntimeSoftwareTrustBinding": {"additionalProperties":false,"description":"An author-owned trust identity; concrete trust semantics require a profile.","properties":{"presence":{"$ref":"#/$defs/RealizationPresence","default":"required"},"refinements":{"items":{"$ref":"#/$defs/RuntimeSoftwareTrustRefinement"},"maxItems":256,"title":"Refinements","type":"array"},"trust_id":{"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Trust Id","type":"string"}},"required":["trust_id"],"title":"RuntimeSoftwareTrustBinding","type":"object"}, "RuntimeSoftwareTrustRefinement": {"additionalProperties":false,"description":"A final-state constraint attached to a shared trust identity.","properties":{"definition":{"$ref":"#/$defs/DomainProfileDefinitionModel"},"profile_value":{"$ref":"#/$defs/JsonValue"},"purpose":{"const":"repository-trust","title":"Purpose","type":"string"},"refinement_id":{"$ref":"#/$defs/_r2"}},"required":["refinement_id","purpose","definition","profile_value"],"title":"RuntimeSoftwareTrustRefinement","type":"object"}, - "RuntimeSshServer": {"additionalProperties":false,"description":"A scoped sshd server configuration observed on a node.\n\nEach configuration carries a stable ``ssh_server_id`` and an explicit\n``service`` reference pointing at the owning same-node service (bare\nname or ``nodes..services.`` form). Global sshd directives\nsit at the top level; scoped overrides live in ``match_rules``.\n\nThe configuration is the SDL surface for participant-observable sshd\npolicy. It is not a backend sshd-payload dump and must not embed raw\n``sshd_config`` text, raw ``sshd -T`` output, container inspect\npayloads, session transcripts, or environment values.","properties":{"accept_env":{"$ref":"#/$defs/_r98"},"allow_groups":{"$ref":"#/$defs/_r102"},"allow_users":{"$ref":"#/$defs/_r103"},"authentication_methods":{"$ref":"#/$defs/_r106"},"authorized_keys_file":{"$ref":"#/$defs/_r49"},"chroot_directory":{"$ref":"#/$defs/_r50"},"deny_groups":{"$ref":"#/$defs/_r110"},"deny_users":{"$ref":"#/$defs/_r111"},"description":{"$ref":"#/$defs/_r53"},"forced_command":{"anyOf":[{"$ref":"#/$defs/SshForcedCommand"},{"type":"null"}],"default":null},"match_rules":{"items":{"$ref":"#/$defs/SshMatchRule"},"title":"Match Rules","type":"array"},"password_authentication":{"$ref":"#/$defs/_r29"},"permit_tty":{"$ref":"#/$defs/_r30"},"pubkey_authentication":{"$ref":"#/$defs/_r31"},"service":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Service","type":"string"},"ssh_server_id":{"$ref":"#/$defs/_r3"}},"required":["ssh_server_id","service"],"title":"RuntimeSshServer","type":"object"}, + "RuntimeSshServer": {"additionalProperties":false,"description":"A scoped sshd server configuration observed on a node.\n\nEach configuration carries a stable ``ssh_server_id`` and an explicit\n``service`` reference pointing at the owning same-node service (bare\nname or ``nodes..services.`` form). Global sshd directives\nsit at the top level; scoped overrides live in ``match_rules``.\n\nThe configuration is the SDL surface for participant-observable sshd\npolicy. It is not a backend sshd-payload dump and must not embed raw\n``sshd_config`` text, raw ``sshd -T`` output, container inspect\npayloads, session transcripts, or environment values.","properties":{"accept_env":{"$ref":"#/$defs/_r101"},"allow_groups":{"$ref":"#/$defs/_r105"},"allow_users":{"$ref":"#/$defs/_r106"},"authentication_methods":{"$ref":"#/$defs/_r109"},"authorized_keys_file":{"$ref":"#/$defs/_r49"},"chroot_directory":{"$ref":"#/$defs/_r50"},"deny_groups":{"$ref":"#/$defs/_r113"},"deny_users":{"$ref":"#/$defs/_r114"},"description":{"$ref":"#/$defs/_r53"},"forced_command":{"anyOf":[{"$ref":"#/$defs/SshForcedCommand"},{"type":"null"}],"default":null},"match_rules":{"items":{"$ref":"#/$defs/SshMatchRule"},"title":"Match Rules","type":"array"},"password_authentication":{"$ref":"#/$defs/_r29"},"permit_tty":{"$ref":"#/$defs/_r30"},"pubkey_authentication":{"$ref":"#/$defs/_r31"},"service":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Service","type":"string"},"ssh_server_id":{"$ref":"#/$defs/_r3"}},"required":["ssh_server_id","service"],"title":"RuntimeSshServer","type":"object"}, "RuntimeSudoPrincipalKind": {"description":"Kind of principal a sudo rule grants privilege to.","enum":["user","group","other","unknown"],"title":"RuntimeSudoPrincipalKind","type":"string"}, - "RuntimeSudoRule": {"additionalProperties":false,"description":"An observed sudo/sudoers privilege grant.\n\nThe portable model is the structured principal/run-as/command scope.\n``raw_entry`` may carry the original sudoers line only as optional\ndescriptive evidence; ``command_redacted`` marks a rule whose command\nscope was withheld because it carried sensitive arguments.","if":{"properties":{"command_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["command_redacted"]},"properties":{"command_redacted":{"$ref":"#/$defs/_r32"},"commands":{"items":{"$ref":"#/$defs/_r187"},"title":"Commands","type":"array"},"description":{"$ref":"#/$defs/_r53"},"host_scope":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Host Scope","type":"string"},"nopasswd":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Nopasswd"},"principal":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Principal","type":"string"},"principal_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSudoPrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"user","title":"Principal Kind"},"raw_entry":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Raw Entry","type":"string"},"run_as_groups":{"items":{"$ref":"#/$defs/_r187"},"title":"Run As Groups","type":"array"},"run_as_users":{"items":{"$ref":"#/$defs/_r187"},"title":"Run As Users","type":"array"}},"required":["principal"],"then":{"properties":{"commands":{"maxItems":0}}},"title":"RuntimeSudoRule","type":"object"}, - "Script": {"additionalProperties":false,"description":"A timed sequence of human-readable durations parsed to seconds.","properties":{"description":{"$ref":"#/$defs/_r53"},"end_time":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"End Time"},"events":{"additionalProperties":{"$ref":"#/$defs/_r44"},"minProperties":1,"title":"Events","type":"object"},"name":{"$ref":"#/$defs/_r64"},"speed":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r187"}],"title":"Speed"},"start_time":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Start Time"}},"required":["start_time","end_time","speed","events"],"title":"Script","type":"object"}, + "RuntimeSudoRule": {"additionalProperties":false,"description":"An observed sudo/sudoers privilege grant.\n\nThe portable model is the structured principal/run-as/command scope.\n``raw_entry`` may carry the original sudoers line only as optional\ndescriptive evidence; ``command_redacted`` marks a rule whose command\nscope was withheld because it carried sensitive arguments.","if":{"properties":{"command_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["command_redacted"]},"properties":{"command_redacted":{"$ref":"#/$defs/_r32"},"commands":{"items":{"$ref":"#/$defs/_r190"},"title":"Commands","type":"array"},"description":{"$ref":"#/$defs/_r53"},"host_scope":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Host Scope","type":"string"},"nopasswd":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Nopasswd"},"principal":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Principal","type":"string"},"principal_kind":{"anyOf":[{"$ref":"#/$defs/RuntimeSudoPrincipalKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"user","title":"Principal Kind"},"raw_entry":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Raw Entry","type":"string"},"run_as_groups":{"items":{"$ref":"#/$defs/_r190"},"title":"Run As Groups","type":"array"},"run_as_users":{"items":{"$ref":"#/$defs/_r190"},"title":"Run As Users","type":"array"}},"required":["principal"],"then":{"properties":{"commands":{"maxItems":0}}},"title":"RuntimeSudoRule","type":"object"}, + "Script": {"additionalProperties":false,"description":"A timed sequence of human-readable durations parsed to seconds.","properties":{"description":{"$ref":"#/$defs/_r53"},"end_time":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"End Time"},"events":{"additionalProperties":{"$ref":"#/$defs/_r44"},"minProperties":1,"title":"Events","type":"object"},"name":{"$ref":"#/$defs/_r64"},"speed":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r190"}],"title":"Speed"},"start_time":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Start Time"}},"required":["start_time","end_time","speed","events"],"title":"Script","type":"object"}, "SearchIndexFieldSemantic": {"description":"Portable top-level search-index field behavior.","enum":["exact-token","full-text","integer","temporal","boolean"],"title":"SearchIndexFieldSemantic","type":"string"}, - "SecretFixtureCredentialMaterial": {"additionalProperties":false,"description":"Deliberately disclosed scenario credential material.","properties":{"classification":{"const":"secret_fixture","title":"Classification","type":"string"},"value":{"$ref":"#/$defs/_r186"}},"required":["classification","value"],"title":"SecretFixtureCredentialMaterial","type":"object"}, - "SemanticDigest": {"additionalProperties":false,"description":"Profile-labelled digest of one expanded authoring scenario.","properties":{"algorithm":{"const":"sha256","title":"Algorithm","type":"string"},"profile":{"const":"raes-sdl-semantic/v2","title":"Profile","type":"string"},"value":{"$ref":"#/$defs/_r169"}},"required":["profile","algorithm","value"],"title":"SemanticDigest","type":"object"}, + "SecretFixtureCredentialMaterial": {"additionalProperties":false,"description":"Deliberately disclosed scenario credential material.","properties":{"classification":{"const":"secret_fixture","title":"Classification","type":"string"},"value":{"$ref":"#/$defs/_r189"}},"required":["classification","value"],"title":"SecretFixtureCredentialMaterial","type":"object"}, + "SemanticDigest": {"additionalProperties":false,"description":"Profile-labelled digest of one expanded authoring scenario.","properties":{"algorithm":{"const":"sha256","title":"Algorithm","type":"string"},"profile":{"const":"raes-sdl-semantic/v2","title":"Profile","type":"string"},"value":{"$ref":"#/$defs/_r172"}},"required":["profile","algorithm","value"],"title":"SemanticDigest","type":"object"}, "ServiceManagerKind": {"description":"Kind of service manager whose unit inventory is being recorded.\n\nInitially scoped to ``systemd``; ``other`` is the escape hatch for managers\nthat have not yet been promoted to their own typed enum value (per\nADR-035 \u00a7 5).","enum":["systemd","other","unknown"],"title":"ServiceManagerKind","type":"string"}, - "ServiceManagerUnit": {"additionalProperties":false,"allOf":[{"if":{"properties":{"manager_kind":{"pattern":"^[sS][yY][sS][tT][eE][mM][dD]$"}},"required":["manager_kind"]},"then":{"properties":{"unit_name":{"pattern":"^[^\\s]+\\.[^\\s]+$"}}}},{"if":{"properties":{"manager_kind":{"anyOf":[{"pattern":"^(?:[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN])$"},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}]}},"required":["manager_kind"]},"then":{"properties":{"active_state":{"const":"unknown"},"enabled_state":{"const":"unknown"},"exec_start":{"const":null},"exit_code":{"const":null},"load_state":{"const":"unknown"},"main_pid":{"const":null},"result":{"const":"unknown"},"status_text":{"const":""},"sub_state":{"const":""},"unit_type":{"const":"other"}}}}],"description":"Observed service-manager unit state on a realized range node.\n\nEach record carries a stable RAES ``unit_id`` (the reference target), the\nnative ``unit_name`` (e.g. ``sshd.service``), the participant-observable\nlifecycle facts captured by ``systemctl`` (load/active/sub/enabled/result),\nand bounded optional evidence: the unit-file path, an ``ExecStart``\ndescriptor with explicit redaction discipline, the main PID when present,\nand an optional same-node ``Node.services[]`` ref.\n\nThis is observed WHAT-IS state, not provisioning intent or authored\nbehavior; see ADR-035 for the boundary against ``Node.services``,\n``conditions``, ``runtime.processes``, ``runtime.container.init_process``,\n``runtime.operational_policy``, and ``runtime.ssh_servers``.","properties":{"active_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitActiveState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][cC][tT][iI][vV][eE]|[rR][eE][lL][oO][aA][dD][iI][nN][gG]|[iI][nN][aA][cC][tT][iI][vV][eE]|[fF][aA][iI][lL][eE][dD]|[aA][cC][tT][iI][vV][aA][tT][iI][nN][gG]|[dD][eE][aA][cC][tT][iI][vV][aA][tT][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Active State"},"description":{"$ref":"#/$defs/_r53"},"enabled_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitEnabledState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[eE][nN][aA][bB][lL][eE][dD][-_][rR][uU][nN][tT][iI][mM][eE]|[dD][iI][sS][aA][bB][lL][eE][dD]|[sS][tT][aA][tT][iI][cC]|[aA][lL][iI][aA][sS]|[mM][aA][sS][kK][eE][dD]|[gG][eE][nN][eE][rR][aA][tT][eE][dD]|[iI][nN][dD][iI][rR][eE][cC][tT]|[tT][rR][aA][nN][sS][iI][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Enabled State"},"exec_start":{"anyOf":[{"$ref":"#/$defs/ServiceUnitExecStart"},{"type":"null"}],"default":null},"exit_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Exit Code"},"load_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitLoadState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][aA][dD][eE][dD]|[nN][oO][tT][-_][fF][oO][uU][nN][dD]|[mM][aA][sS][kK][eE][dD]|[eE][rR][rR][oO][rR]|[mM][eE][rR][gG][eE][dD]|[sS][tT][uU][bB]|[bB][aA][dD][-_][sS][eE][tT][tT][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Load State"},"main_pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Main Pid"},"manager_kind":{"anyOf":[{"$ref":"#/$defs/ServiceManagerKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][yY][sS][tT][eE][mM][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"systemd","title":"Manager Kind"},"result":{"anyOf":[{"$ref":"#/$defs/ServiceUnitResult"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][cC][cC][eE][sS][sS]|[eE][xX][iI][tT][-_][cC][oO][dD][eE]|[sS][iI][gG][nN][aA][lL]|[tT][iI][mM][eE][oO][uU][tT]|[wW][aA][tT][cC][hH][dD][oO][gG]|[oO][oO][mM][-_][kK][iI][lL][lL]|[cC][oO][rR][eE][-_][dD][uU][mM][pP]|[sS][tT][aA][rR][tT][-_][lL][iI][mM][iI][tT][-_][hH][iI][tT]|[rR][eE][sS][oO][uU][rR][cC][eE][sS]|[pP][rR][oO][tT][oO][cC][oO][lL]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Result"},"service":{"$ref":"#/$defs/_r70"},"status_text":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Status Text","type":"string"},"sub_state":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Sub State","type":"string"},"unit_file_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit File Path","type":"string"},"unit_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit Id","type":"string"},"unit_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^\\S+$","title":"Unit Name","type":"string"},"unit_type":{"anyOf":[{"$ref":"#/$defs/ServiceUnitKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][eE][rR][vV][iI][cC][eE]|[sS][oO][cC][kK][eE][tT]|[tT][aA][rR][gG][eE][tT]|[tT][iI][mM][eE][rR]|[pP][aA][tT][hH]|[mM][oO][uU][nN][tT]|[aA][uU][tT][oO][mM][oO][uU][nN][tT]|[sS][wW][aA][pP]|[dD][eE][vV][iI][cC][eE]|[sS][lL][iI][cC][eE]|[sS][cC][oO][pP][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Unit Type"}},"required":["unit_id"],"title":"ServiceManagerUnit","type":"object"}, - "ServiceMaterialization": {"additionalProperties":false,"description":"Portable control contract for placing content through a named service.","properties":{"evidence_requirement_refs":{"$ref":"#/$defs/_r95"},"interface_profile":{"const":"service-content","default":"service-content","title":"Interface Profile","type":"string"},"observation_boundary_refs":{"$ref":"#/$defs/_r96"},"ordering_content_refs":{"$ref":"#/$defs/_r125"},"profile_version":{"const":"1","default":"1","title":"Profile Version","type":"string"},"readback_assertion_refs":{"$ref":"#/$defs/_r97"},"requirements":{"$ref":"#/$defs/ServiceMaterializationRequirements"},"shared_service_relationship_ref":{"$ref":"#/$defs/_r71"},"target_service_ref":{"$ref":"#/$defs/_r147"}},"required":["target_service_ref","readback_assertion_refs","evidence_requirement_refs","observation_boundary_refs","requirements"],"title":"ServiceMaterialization","type":"object"}, + "ServiceManagerUnit": {"additionalProperties":false,"allOf":[{"if":{"properties":{"manager_kind":{"pattern":"^[sS][yY][sS][tT][eE][mM][dD]$"}},"required":["manager_kind"]},"then":{"properties":{"unit_name":{"pattern":"^[^\\s]+\\.[^\\s]+$"}}}},{"if":{"properties":{"manager_kind":{"anyOf":[{"pattern":"^(?:[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN])$"},{"pattern":"^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$"}]}},"required":["manager_kind"]},"then":{"properties":{"active_state":{"const":"unknown"},"enabled_state":{"const":"unknown"},"exec_start":{"const":null},"exit_code":{"const":null},"load_state":{"const":"unknown"},"main_pid":{"const":null},"result":{"const":"unknown"},"status_text":{"const":""},"sub_state":{"const":""},"unit_type":{"const":"other"}}}}],"description":"Observed service-manager unit state on a realized range node.\n\nEach record carries a stable RAES ``unit_id`` (the reference target), the\nnative ``unit_name`` (e.g. ``sshd.service``), the participant-observable\nlifecycle facts captured by ``systemctl`` (load/active/sub/enabled/result),\nand bounded optional evidence: the unit-file path, an ``ExecStart``\ndescriptor with explicit redaction discipline, the main PID when present,\nand an optional same-node ``Node.services[]`` ref.\n\nThis is observed WHAT-IS state, not provisioning intent or authored\nbehavior; see ADR-035 for the boundary against ``Node.services``,\n``conditions``, ``runtime.processes``, ``runtime.container.init_process``,\n``runtime.operational_policy``, and ``runtime.ssh_servers``.","properties":{"active_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitActiveState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][cC][tT][iI][vV][eE]|[rR][eE][lL][oO][aA][dD][iI][nN][gG]|[iI][nN][aA][cC][tT][iI][vV][eE]|[fF][aA][iI][lL][eE][dD]|[aA][cC][tT][iI][vV][aA][tT][iI][nN][gG]|[dD][eE][aA][cC][tT][iI][vV][aA][tT][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Active State"},"description":{"$ref":"#/$defs/_r53"},"enabled_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitEnabledState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[eE][nN][aA][bB][lL][eE][dD]|[eE][nN][aA][bB][lL][eE][dD][-_][rR][uU][nN][tT][iI][mM][eE]|[dD][iI][sS][aA][bB][lL][eE][dD]|[sS][tT][aA][tT][iI][cC]|[aA][lL][iI][aA][sS]|[mM][aA][sS][kK][eE][dD]|[gG][eE][nN][eE][rR][aA][tT][eE][dD]|[iI][nN][dD][iI][rR][eE][cC][tT]|[tT][rR][aA][nN][sS][iI][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Enabled State"},"exec_start":{"anyOf":[{"$ref":"#/$defs/ServiceUnitExecStart"},{"type":"null"}],"default":null},"exit_code":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Exit Code"},"load_state":{"anyOf":[{"$ref":"#/$defs/ServiceUnitLoadState"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[lL][oO][aA][dD][eE][dD]|[nN][oO][tT][-_][fF][oO][uU][nN][dD]|[mM][aA][sS][kK][eE][dD]|[eE][rR][rR][oO][rR]|[mM][eE][rR][gG][eE][dD]|[sS][tT][uU][bB]|[bB][aA][dD][-_][sS][eE][tT][tT][iI][nN][gG]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Load State"},"main_pid":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Main Pid"},"manager_kind":{"anyOf":[{"$ref":"#/$defs/ServiceManagerKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][yY][sS][tT][eE][mM][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"systemd","title":"Manager Kind"},"result":{"anyOf":[{"$ref":"#/$defs/ServiceUnitResult"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][uU][cC][cC][eE][sS][sS]|[eE][xX][iI][tT][-_][cC][oO][dD][eE]|[sS][iI][gG][nN][aA][lL]|[tT][iI][mM][eE][oO][uU][tT]|[wW][aA][tT][cC][hH][dD][oO][gG]|[oO][oO][mM][-_][kK][iI][lL][lL]|[cC][oO][rR][eE][-_][dD][uU][mM][pP]|[sS][tT][aA][rR][tT][-_][lL][iI][mM][iI][tT][-_][hH][iI][tT]|[rR][eE][sS][oO][uU][rR][cC][eE][sS]|[pP][rR][oO][tT][oO][cC][oO][lL]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"unknown","title":"Result"},"service":{"$ref":"#/$defs/_r70"},"status_text":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Status Text","type":"string"},"sub_state":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Sub State","type":"string"},"unit_file_path":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit File Path","type":"string"},"unit_id":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Unit Id","type":"string"},"unit_name":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^\\S+$","title":"Unit Name","type":"string"},"unit_type":{"anyOf":[{"$ref":"#/$defs/ServiceUnitKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][eE][rR][vV][iI][cC][eE]|[sS][oO][cC][kK][eE][tT]|[tT][aA][rR][gG][eE][tT]|[tT][iI][mM][eE][rR]|[pP][aA][tT][hH]|[mM][oO][uU][nN][tT]|[aA][uU][tT][oO][mM][oO][uU][nN][tT]|[sS][wW][aA][pP]|[dD][eE][vV][iI][cC][eE]|[sS][lL][iI][cC][eE]|[sS][cC][oO][pP][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"other","title":"Unit Type"}},"required":["unit_id"],"title":"ServiceManagerUnit","type":"object"}, + "ServiceMaterialization": {"additionalProperties":false,"description":"Portable control contract for placing content through a named service.","properties":{"evidence_requirement_refs":{"$ref":"#/$defs/_r98"},"interface_profile":{"const":"service-content","default":"service-content","title":"Interface Profile","type":"string"},"observation_boundary_refs":{"$ref":"#/$defs/_r99"},"ordering_content_refs":{"$ref":"#/$defs/_r128"},"profile_version":{"const":"1","default":"1","title":"Profile Version","type":"string"},"readback_assertion_refs":{"$ref":"#/$defs/_r100"},"requirements":{"$ref":"#/$defs/ServiceMaterializationRequirements"},"shared_service_relationship_ref":{"$ref":"#/$defs/_r71"},"target_service_ref":{"$ref":"#/$defs/_r150"}},"required":["target_service_ref","readback_assertion_refs","evidence_requirement_refs","observation_boundary_refs","requirements"],"title":"ServiceMaterialization","type":"object"}, "ServiceMaterializationRequirements": {"additionalProperties":false,"description":"Exact portable operation, ownership, and readback requirements.","properties":{"conflict_policy":{"$ref":"#/$defs/_r45"},"operation":{"const":"ensure-owned-items","default":"ensure-owned-items","title":"Operation","type":"string"},"readback":{"const":"canonical-content-digest","default":"canonical-content-digest","title":"Readback","type":"string"}},"title":"ServiceMaterializationRequirements","type":"object"}, "ServicePort": {"additionalProperties":false,"description":"Authored identity of a node-local transport binding.\n\nA service declaration does not authorize traffic, prove a live listener,\npublish a host port, or classify an internal/external audience. Traffic\nauthorization belongs to infrastructure ACLs; observed bind state and host\npublication belong to their dedicated runtime surfaces.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r21"},"port":{"$ref":"#/$defs/_r43"},"protocol":{"$ref":"#/$defs/_r84"}},"required":["port"],"title":"ServicePort","type":"object"}, - "ServiceSearchIndexSchemaMaterialization": {"additionalProperties":false,"description":"Portable desired field schema for a named service-owned search index.","properties":{"evidence_requirement_refs":{"$ref":"#/$defs/_r95"},"interface_profile":{"const":"service-search-index-schema","title":"Interface Profile","type":"string"},"observation_boundary_refs":{"$ref":"#/$defs/_r96"},"ordering_content_refs":{"$ref":"#/$defs/_r125"},"profile_version":{"const":"1","default":"1","title":"Profile Version","type":"string"},"readback_assertion_refs":{"$ref":"#/$defs/_r97"},"requirements":{"$ref":"#/$defs/ServiceSearchIndexSchemaRequirements"},"shared_service_relationship_ref":{"$ref":"#/$defs/_r71"},"target_service_ref":{"$ref":"#/$defs/_r147"}},"required":["target_service_ref","readback_assertion_refs","evidence_requirement_refs","observation_boundary_refs","interface_profile","requirements"],"title":"ServiceSearchIndexSchemaMaterialization","type":"object"}, + "ServiceSearchIndexSchemaMaterialization": {"additionalProperties":false,"description":"Portable desired field schema for a named service-owned search index.","properties":{"evidence_requirement_refs":{"$ref":"#/$defs/_r98"},"interface_profile":{"const":"service-search-index-schema","title":"Interface Profile","type":"string"},"observation_boundary_refs":{"$ref":"#/$defs/_r99"},"ordering_content_refs":{"$ref":"#/$defs/_r128"},"profile_version":{"const":"1","default":"1","title":"Profile Version","type":"string"},"readback_assertion_refs":{"$ref":"#/$defs/_r100"},"requirements":{"$ref":"#/$defs/ServiceSearchIndexSchemaRequirements"},"shared_service_relationship_ref":{"$ref":"#/$defs/_r71"},"target_service_ref":{"$ref":"#/$defs/_r150"}},"required":["target_service_ref","readback_assertion_refs","evidence_requirement_refs","observation_boundary_refs","interface_profile","requirements"],"title":"ServiceSearchIndexSchemaMaterialization","type":"object"}, "ServiceSearchIndexSchemaRequirements": {"additionalProperties":false,"description":"Exact portable search-index schema operation and readback.","properties":{"conflict_policy":{"$ref":"#/$defs/_r45"},"field_semantics":{"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/SearchIndexFieldSemantic"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Field Semantics","type":"object"},"operation":{"const":"ensure-search-index-field-schema","default":"ensure-search-index-field-schema","title":"Operation","type":"string"},"readback":{"const":"canonical-portable-field-schema-digest","default":"canonical-portable-field-schema-digest","title":"Readback","type":"string"}},"required":["field_semantics"],"title":"ServiceSearchIndexSchemaRequirements","type":"object"}, "ServiceUnitActiveState": {"description":"Observed unit *active* state (``systemctl list-units`` ACTIVE column).","enum":["active","reloading","inactive","failed","activating","deactivating","unknown","other"],"title":"ServiceUnitActiveState","type":"string"}, "ServiceUnitEnabledState": {"description":"Observed unit-file enable state (``systemctl is-enabled``).","enum":["enabled","enabled_runtime","disabled","static","alias","masked","generated","indirect","transient","unknown","other"],"title":"ServiceUnitEnabledState","type":"string"}, @@ -533,36 +543,36 @@ "ServiceUnitKind": {"description":"Type of service-manager unit (systemd unit kinds with ``other`` escape).","enum":["service","socket","target","timer","path","mount","automount","swap","device","slice","scope","other","unknown"],"title":"ServiceUnitKind","type":"string"}, "ServiceUnitLoadState": {"description":"Observed unit *load* state (``systemctl list-units`` LOAD column).","enum":["loaded","not_found","masked","error","merged","stub","bad_setting","unknown","other"],"title":"ServiceUnitLoadState","type":"string"}, "ServiceUnitResult": {"description":"Observed last-run unit result class (systemd ``Result=`` values).","enum":["success","exit_code","signal","timeout","watchdog","oom_kill","core_dump","start_limit_hit","resources","protocol","other","unknown"],"title":"ServiceUnitResult","type":"string"}, - "SimpleProperties": {"additionalProperties":false,"description":"Network properties for a switch/subnet: CIDR, gateway, and flags.","properties":{"cidr":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cidr","type":"string"},"gateway":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gateway","type":"string"},"internal":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Internal"}},"required":["cidr","gateway"],"title":"SimpleProperties","type":"object"}, - "Source": {"additionalProperties":false,"description":"Provider-neutral artifact reference.\n\nShorthand: ``source: \"package-name\"`` (version defaults to ``\"*\"``).\nLonghand: ``source: {name: \"package-name\", version: \"1.2.3\"}``.","properties":{"artifact_requirement":{"anyOf":[{"$ref":"#/$defs/ArtifactRequirement"},{"type":"null"}],"default":null},"build":{"anyOf":[{"$ref":"#/$defs/ContainerImageBuildProvenance"},{"type":"null"}],"default":null},"name":{"$ref":"#/$defs/_r176"},"version":{"$ref":"#/$defs/_r83"}},"required":["name"],"title":"Source","type":"object"}, + "SimpleProperties": {"additionalProperties":false,"description":"Network properties for a switch/subnet: CIDR, gateway, and flags.","properties":{"cidr":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Cidr","type":"string"},"gateway":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Gateway","type":"string"},"internal":{"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Internal"}},"required":["cidr","gateway"],"title":"SimpleProperties","type":"object"}, + "Source": {"additionalProperties":false,"description":"Provider-neutral artifact reference.\n\nShorthand: ``source: \"package-name\"`` (version defaults to ``\"*\"``).\nLonghand: ``source: {name: \"package-name\", version: \"1.2.3\"}``.","properties":{"artifact_requirement":{"anyOf":[{"$ref":"#/$defs/ArtifactRequirement"},{"type":"null"}],"default":null},"build":{"anyOf":[{"$ref":"#/$defs/ContainerImageBuildProvenance"},{"type":"null"}],"default":null},"name":{"$ref":"#/$defs/_r179"},"version":{"$ref":"#/$defs/_r83"}},"required":["name"],"title":"Source","type":"object"}, "SshForcedCommand": {"additionalProperties":false,"allOf":[{"$ref":"#/$defs/_r91"},{"$ref":"#/$defs/_r90"}],"description":"A typed sshd ``ForceCommand`` configuration.\n\nThe ``command_kind`` discriminates how ``command`` is interpreted:\n\n- ``absolute_path``: a concrete executable path (or ``${var}``) starting\n with ``/``. Validated via ``absolute_path_or_var``.\n- ``internal_sftp``: the sshd-internal sftp subsystem; ``command`` must\n equal the literal ``\"internal-sftp\"``.\n- ``redacted``: the underlying command is withheld from the SDL model\n because it carries secrets, session identifiers, or operator-only\n arguments; ``command`` must be empty and ``command_redacted`` must\n be true.","properties":{"command":{"$ref":"#/$defs/_r51"},"command_kind":{"anyOf":[{"$ref":"#/$defs/SshForcedCommandKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][bB][sS][oO][lL][uU][tT][eE][-_][pP][aA][tT][hH]|[iI][nN][tT][eE][rR][nN][aA][lL][-_][sS][fF][tT][pP]|[rR][eE][dD][aA][cC][tT][eE][dD]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"default":"absolute_path","title":"Command Kind"},"command_redacted":{"$ref":"#/$defs/_r32"},"description":{"$ref":"#/$defs/_r53"}},"title":"SshForcedCommand","type":"object"}, "SshForcedCommandKind": {"description":"Kind of forced command an sshd ``ForceCommand`` directive carries.","enum":["absolute_path","internal_sftp","redacted"],"title":"SshForcedCommandKind","type":"string"}, "SshMatchCriterion": {"additionalProperties":false,"description":"A single sshd ``Match`` criterion (one ``kind`` + one ``pattern``).","properties":{"kind":{"anyOf":[{"$ref":"#/$defs/SshMatchCriterionKind"},{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[uU][sS][eE][rR]|[gG][rR][oO][uU][pP]|[hH][oO][sS][tT]|[aA][dD][dD][rR][eE][sS][sS]|[lL][oO][cC][aA][lL][-_][uU][sS][eE][rR]|[lL][oO][cC][aA][lL][-_][pP][oO][rR][tT]|[rR][dD][oO][mM][aA][iI][nN]|[aA][lL][lL]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}],"title":"Kind"},"pattern":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Pattern","type":"string"}},"required":["kind","pattern"],"title":"SshMatchCriterion","type":"object"}, "SshMatchCriterionKind": {"description":"OpenSSH ``Match`` criterion kinds.\n\n``LOCAL_USER`` is the explicit \"match this concrete account\" form that\nsemantic validation may cross-check against ``runtime.local_identity``\nwhen that inventory is present. ``USER`` is the looser pattern form\n(wildcards, comma-separated lists) and is not cross-checked.","enum":["user","group","host","address","local_user","local_port","rdomain","all"],"title":"SshMatchCriterionKind","type":"string"}, - "SshMatchRule": {"additionalProperties":false,"description":"A scoped sshd ``Match`` rule.\n\n``criteria`` is the ordered conjunction of one-or-more match criteria\n(``Match User kali`` is one criterion; ``Match User kali Address 10.0.0.0/8``\nis two). Per-rule sshd directives override the surrounding global\ndirectives for sessions that match all listed criteria.","properties":{"accept_env":{"$ref":"#/$defs/_r98"},"allow_groups":{"$ref":"#/$defs/_r102"},"allow_users":{"$ref":"#/$defs/_r103"},"authentication_methods":{"$ref":"#/$defs/_r106"},"authorized_keys_file":{"$ref":"#/$defs/_r49"},"chroot_directory":{"$ref":"#/$defs/_r50"},"criteria":{"items":{"$ref":"#/$defs/SshMatchCriterion"},"title":"Criteria","type":"array"},"deny_groups":{"$ref":"#/$defs/_r110"},"deny_users":{"$ref":"#/$defs/_r111"},"description":{"$ref":"#/$defs/_r53"},"forced_command":{"anyOf":[{"$ref":"#/$defs/SshForcedCommand"},{"type":"null"}],"default":null},"match_id":{"$ref":"#/$defs/_r3"},"password_authentication":{"$ref":"#/$defs/_r29"},"permit_tty":{"$ref":"#/$defs/_r30"},"pubkey_authentication":{"$ref":"#/$defs/_r31"}},"required":["match_id"],"title":"SshMatchRule","type":"object"}, + "SshMatchRule": {"additionalProperties":false,"description":"A scoped sshd ``Match`` rule.\n\n``criteria`` is the ordered conjunction of one-or-more match criteria\n(``Match User kali`` is one criterion; ``Match User kali Address 10.0.0.0/8``\nis two). Per-rule sshd directives override the surrounding global\ndirectives for sessions that match all listed criteria.","properties":{"accept_env":{"$ref":"#/$defs/_r101"},"allow_groups":{"$ref":"#/$defs/_r105"},"allow_users":{"$ref":"#/$defs/_r106"},"authentication_methods":{"$ref":"#/$defs/_r109"},"authorized_keys_file":{"$ref":"#/$defs/_r49"},"chroot_directory":{"$ref":"#/$defs/_r50"},"criteria":{"items":{"$ref":"#/$defs/SshMatchCriterion"},"title":"Criteria","type":"array"},"deny_groups":{"$ref":"#/$defs/_r113"},"deny_users":{"$ref":"#/$defs/_r114"},"description":{"$ref":"#/$defs/_r53"},"forced_command":{"anyOf":[{"$ref":"#/$defs/SshForcedCommand"},{"type":"null"}],"default":null},"match_id":{"$ref":"#/$defs/_r3"},"password_authentication":{"$ref":"#/$defs/_r29"},"permit_tty":{"$ref":"#/$defs/_r30"},"pubkey_authentication":{"$ref":"#/$defs/_r31"}},"required":["match_id"],"title":"SshMatchRule","type":"object"}, "StateOwner": {"description":"Owner of mutable state or reset generation.","enum":["none","consumer_tenant","shared_service"],"title":"StateOwner","type":"string"}, - "StatefulResourceConsumer": {"additionalProperties":false,"description":"A node that consumes a generated artifact or persistent volume.","properties":{"access_mode":{"$ref":"#/$defs/ConsumerAccessMode"},"mount_destination":{"$ref":"#/$defs/_r175"},"node":{"$ref":"#/$defs/_r177"}},"required":["node","mount_destination","access_mode"],"title":"StatefulResourceConsumer","type":"object"}, - "Story": {"additionalProperties":false,"description":"Top-level exercise orchestration \u2014 a group of scripts.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"scripts":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Scripts","type":"array"},"speed":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r187"}],"default":1.0,"title":"Speed"}},"required":["scripts"],"title":"Story","type":"object"}, - "StringPredicate": {"additionalProperties":false,"allOf":[{"anyOf":[{"properties":{"expected":{"not":{"type":"null"}}},"required":["expected"]},{"properties":{"expected_from":{"not":{"type":"null"}}},"required":["expected_from"]}]},{"not":{"allOf":[{"properties":{"expected":{"not":{"type":"null"}}},"required":["expected"]},{"properties":{"expected_from":{"not":{"type":"null"}}},"required":["expected_from"]}]}}],"description":"Compare a governed string property with typed string operands.","properties":{"expected":{"anyOf":[{"$ref":"#/$defs/_r187"},{"items":{"$ref":"#/$defs/_r187"},"type":"array"},{"type":"null"}],"default":null,"title":"Expected"},"expected_from":{"$ref":"#/$defs/_r7"},"kind":{"const":"string","default":"string","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals","in","not_in"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r137"},"semantic_ref":{"$ref":"#/$defs/_r133"}},"required":["property","semantic_ref"],"title":"StringPredicate","type":"object"}, + "StatefulResourceConsumer": {"additionalProperties":false,"description":"A node that consumes a generated artifact or persistent volume.","properties":{"access_mode":{"$ref":"#/$defs/ConsumerAccessMode"},"mount_destination":{"$ref":"#/$defs/_r178"},"node":{"$ref":"#/$defs/_r180"}},"required":["node","mount_destination","access_mode"],"title":"StatefulResourceConsumer","type":"object"}, + "Story": {"additionalProperties":false,"description":"Top-level exercise orchestration \u2014 a group of scripts.","properties":{"description":{"$ref":"#/$defs/_r53"},"name":{"$ref":"#/$defs/_r64"},"scripts":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Scripts","type":"array"},"speed":{"anyOf":[{"type":"number"},{"$ref":"#/$defs/_r190"}],"default":1.0,"title":"Speed"}},"required":["scripts"],"title":"Story","type":"object"}, + "StringPredicate": {"additionalProperties":false,"allOf":[{"anyOf":[{"properties":{"expected":{"not":{"type":"null"}}},"required":["expected"]},{"properties":{"expected_from":{"not":{"type":"null"}}},"required":["expected_from"]}]},{"not":{"allOf":[{"properties":{"expected":{"not":{"type":"null"}}},"required":["expected"]},{"properties":{"expected_from":{"not":{"type":"null"}}},"required":["expected_from"]}]}}],"description":"Compare a governed string property with typed string operands.","properties":{"expected":{"anyOf":[{"$ref":"#/$defs/_r190"},{"items":{"$ref":"#/$defs/_r190"},"type":"array"},{"type":"null"}],"default":null,"title":"Expected"},"expected_from":{"$ref":"#/$defs/_r7"},"kind":{"const":"string","default":"string","title":"Kind","type":"string"},"operator":{"default":"equals","enum":["equals","not_equals","in","not_in"],"title":"Operator","type":"string"},"property":{"$ref":"#/$defs/_r140"},"semantic_ref":{"$ref":"#/$defs/_r136"}},"required":["property","semantic_ref"],"title":"StringPredicate","type":"object"}, "SubjectQuantifier": {"description":"Quantification over a proposition's finite, resolved subject set.","enum":["all","any","at_least"],"title":"SubjectQuantifier","type":"string"}, - "TemporalConstraint": {"additionalProperties":false,"description":"One typed temporal predicate over ordinary RAES subjects.","properties":{"cadence_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Cadence Ticks"},"clock_ref":{"$ref":"#/$defs/_r171"},"constraint_kind":{"$ref":"#/$defs/TemporalConstraintKind"},"description":{"$ref":"#/$defs/_r172"},"duration_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Duration Ticks"},"end":{"anyOf":[{"$ref":"#/$defs/TimeCoordinate"},{"type":"null"}],"default":null},"start":{"anyOf":[{"$ref":"#/$defs/TimeCoordinate"},{"type":"null"}],"default":null},"subject_refs":{"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Subject Refs","type":"array"}},"required":["constraint_kind","clock_ref","subject_refs","description"],"title":"TemporalConstraint","type":"object"}, + "TemporalConstraint": {"additionalProperties":false,"description":"One typed temporal predicate over ordinary RAES subjects.","properties":{"cadence_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Cadence Ticks"},"clock_ref":{"$ref":"#/$defs/_r174"},"constraint_kind":{"$ref":"#/$defs/TemporalConstraintKind"},"description":{"$ref":"#/$defs/_r175"},"duration_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Duration Ticks"},"end":{"anyOf":[{"$ref":"#/$defs/TimeCoordinate"},{"type":"null"}],"default":null},"start":{"anyOf":[{"$ref":"#/$defs/TimeCoordinate"},{"type":"null"}],"default":null},"subject_refs":{"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Subject Refs","type":"array"}},"required":["constraint_kind","clock_ref","subject_refs","description"],"title":"TemporalConstraint","type":"object"}, "TemporalConstraintKind": {"description":"Backend-independent temporal predicate families.","enum":["precedence","duration","window","deadline","cadence"],"title":"TemporalConstraintKind","type":"string"}, "TenantClaimOwner": {"description":"Authority allowed to issue the server-controlled tenant claim.","enum":["facade"],"title":"TenantClaimOwner","type":"string"}, "TenantIsolationMode": {"description":"Shared-service tenant isolation posture.","enum":["none","stateless","tenant_partitioned"],"title":"TenantIsolationMode","type":"string"}, "TimeAdvancementMode": {"description":"How a clock may advance.","enum":["real_time","dilated","stepped","event_driven","externally_paced"],"title":"TimeAdvancementMode","type":"string"}, "TimeCoordinate": {"additionalProperties":false,"description":"One superdense point on a declared clock.","properties":{"microstep":{"default":0,"minimum":0,"title":"Microstep","type":"integer"},"tick":{"title":"Tick","type":"integer"}},"required":["tick"],"title":"TimeCoordinate","type":"object"}, - "TimeDomain": {"additionalProperties":false,"description":"Authored meaning and resolution of one time domain.","properties":{"description":{"$ref":"#/$defs/_r172"},"epoch":{"$ref":"#/$defs/TimeEpochKind"},"kind":{"$ref":"#/$defs/TimeDomainKind"},"tick_period_seconds":{"$ref":"#/$defs/ExactRatio"},"visibility":{"$ref":"#/$defs/TimeDomainVisibility","default":"runtime_only"}},"required":["kind","tick_period_seconds","epoch","description"],"title":"TimeDomain","type":"object"}, + "TimeDomain": {"additionalProperties":false,"description":"Authored meaning and resolution of one time domain.","properties":{"description":{"$ref":"#/$defs/_r175"},"epoch":{"$ref":"#/$defs/TimeEpochKind"},"kind":{"$ref":"#/$defs/TimeDomainKind"},"tick_period_seconds":{"$ref":"#/$defs/ExactRatio"},"visibility":{"$ref":"#/$defs/TimeDomainVisibility","default":"runtime_only"}},"required":["kind","tick_period_seconds","epoch","description"],"title":"TimeDomain","type":"object"}, "TimeDomainKind": {"description":"Meaning of values carried by a time domain.","enum":["wall_clock","monotonic","simulated","logical","external"],"title":"TimeDomainKind","type":"string"}, - "TimeDomainMapping": {"additionalProperties":false,"description":"Explicit exact conversion between otherwise incomparable domains.","properties":{"description":{"$ref":"#/$defs/_r172"},"mapping_kind":{"$ref":"#/$defs/TimeMappingKind"},"offset_ticks":{"default":0,"title":"Offset Ticks","type":"integer"},"scale":{"$ref":"#/$defs/ExactRatio"},"source_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Domain Ref","type":"string"},"target_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Domain Ref","type":"string"}},"required":["source_domain_ref","target_domain_ref","mapping_kind","description"],"title":"TimeDomainMapping","type":"object"}, + "TimeDomainMapping": {"additionalProperties":false,"description":"Explicit exact conversion between otherwise incomparable domains.","properties":{"description":{"$ref":"#/$defs/_r175"},"mapping_kind":{"$ref":"#/$defs/TimeMappingKind"},"offset_ticks":{"default":0,"title":"Offset Ticks","type":"integer"},"scale":{"$ref":"#/$defs/ExactRatio"},"source_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Source Domain Ref","type":"string"},"target_domain_ref":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Domain Ref","type":"string"}},"required":["source_domain_ref","target_domain_ref","mapping_kind","description"],"title":"TimeDomainMapping","type":"object"}, "TimeDomainVisibility": {"description":"Who may observe a time domain.","enum":["runtime_only","participant_visible","evidence_only"],"title":"TimeDomainVisibility","type":"string"}, "TimeEpochKind": {"description":"Interpretation of tick zero.","enum":["unix","scenario_start","run_start","unanchored","external"],"title":"TimeEpochKind","type":"string"}, "TimeMappingKind": {"description":"Supported exact conversion families.","enum":["identity","affine_rational"],"title":"TimeMappingKind","type":"string"}, - "TimeProgressionPolicy": {"additionalProperties":false,"description":"Authored advancement, pacing, synchronization, and lifecycle policy.","properties":{"advancement_mode":{"$ref":"#/$defs/TimeAdvancementMode"},"clock_ref":{"$ref":"#/$defs/_r171"},"description":{"$ref":"#/$defs/_r172"},"drift_bound_ticks":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Drift Bound Ticks"},"pacing_ratio":{"$ref":"#/$defs/ExactRatio"},"replay_behavior":{"$ref":"#/$defs/TimeReplayBehavior"},"reset_behavior":{"$ref":"#/$defs/TimeResetBehavior"},"step_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Step Ticks"},"synchronization_mode":{"$ref":"#/$defs/TimeSynchronizationMode"}},"required":["clock_ref","advancement_mode","synchronization_mode","reset_behavior","replay_behavior","description"],"title":"TimeProgressionPolicy","type":"object"}, + "TimeProgressionPolicy": {"additionalProperties":false,"description":"Authored advancement, pacing, synchronization, and lifecycle policy.","properties":{"advancement_mode":{"$ref":"#/$defs/TimeAdvancementMode"},"clock_ref":{"$ref":"#/$defs/_r174"},"description":{"$ref":"#/$defs/_r175"},"drift_bound_ticks":{"anyOf":[{"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Drift Bound Ticks"},"pacing_ratio":{"$ref":"#/$defs/ExactRatio"},"replay_behavior":{"$ref":"#/$defs/TimeReplayBehavior"},"reset_behavior":{"$ref":"#/$defs/TimeResetBehavior"},"step_ticks":{"anyOf":[{"exclusiveMinimum":0,"type":"integer"},{"type":"null"}],"default":null,"title":"Step Ticks"},"synchronization_mode":{"$ref":"#/$defs/TimeSynchronizationMode"}},"required":["clock_ref","advancement_mode","synchronization_mode","reset_behavior","replay_behavior","description"],"title":"TimeProgressionPolicy","type":"object"}, "TimeReplayBehavior": {"description":"Clock behavior when a run is replayed.","enum":["restart_from_anchor","restore_recorded_advances","unsupported"],"title":"TimeReplayBehavior","type":"string"}, "TimeResetBehavior": {"description":"Clock behavior at a reset boundary.","enum":["new_segment_zero","new_segment_preserve_value","unsupported"],"title":"TimeResetBehavior","type":"string"}, "TimeSynchronizationMode": {"description":"How multiple time consumers coordinate progress.","enum":["none","authority","barrier","conservative"],"title":"TimeSynchronizationMode","type":"string"}, "TruthCompositionMode": {"description":"Portable composition over assertion outcomes.","enum":["all_of","any_of","at_least"],"title":"TruthCompositionMode","type":"string"}, - "VersionDomain": {"additionalProperties":false,"anyOf":[{"properties":{"lower":{"$ref":"#/$defs/_r187"}},"required":["lower"]},{"properties":{"upper":{"$ref":"#/$defs/_r187"}},"required":["upper"]}],"description":"An optional one-sided or bounded restriction; exact SDL strings stay exact.\n\nComparison equality is relation-owned. This never asserts correspondence\nbetween an application version and a distribution package version.","properties":{"kind":{"const":"version","default":"version","title":"Kind","type":"string"},"lower":{"anyOf":[{"$ref":"#/$defs/_r134"},{"type":"null"}],"default":null,"title":"Lower"},"lower_closed":{"default":true,"title":"Lower Closed","type":"boolean"},"relation":{"$ref":"#/$defs/DomainProfileSemanticContractModel"},"upper":{"anyOf":[{"$ref":"#/$defs/_r134"},{"type":"null"}],"default":null,"title":"Upper"},"upper_closed":{"default":true,"title":"Upper Closed","type":"boolean"}},"required":["relation"],"title":"VersionDomain","type":"object"}, + "VersionDomain": {"additionalProperties":false,"anyOf":[{"properties":{"lower":{"$ref":"#/$defs/_r190"}},"required":["lower"]},{"properties":{"upper":{"$ref":"#/$defs/_r190"}},"required":["upper"]}],"description":"An optional one-sided or bounded restriction; exact SDL strings stay exact.\n\nComparison equality is relation-owned. This never asserts correspondence\nbetween an application version and a distribution package version.","properties":{"kind":{"const":"version","default":"version","title":"Kind","type":"string"},"lower":{"anyOf":[{"$ref":"#/$defs/_r137"},{"type":"null"}],"default":null,"title":"Lower"},"lower_closed":{"default":true,"title":"Lower Closed","type":"boolean"},"relation":{"$ref":"#/$defs/DomainProfileSemanticContractModel"},"upper":{"anyOf":[{"$ref":"#/$defs/_r137"},{"type":"null"}],"default":null,"title":"Upper"},"upper_closed":{"default":true,"title":"Upper Closed","type":"boolean"}},"required":["relation"],"title":"VersionDomain","type":"object"}, "VolumeAccessMode": {"enum":["read_write_once","read_write_many","read_only_many"],"title":"VolumeAccessMode","type":"string"}, "VolumeLifecycle": {"enum":["retain","ephemeral"],"title":"VolumeLifecycle","type":"string"}, "Workflow": {"additionalProperties":false,"description":"A declarative experiment control graph over objectives.","properties":{"compensation":{"anyOf":[{"$ref":"#/$defs/WorkflowCompensationPolicy"},{"type":"null"}],"default":null},"description":{"$ref":"#/$defs/_r53"},"start":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Start","type":"string"},"steps":{"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/WorkflowStep"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Steps","type":"object"},"timeout":{"anyOf":[{"$ref":"#/$defs/WorkflowTimeoutPolicy"},{"type":"null"}],"default":null}},"required":["start","steps"],"title":"Workflow","type":"object"}, @@ -570,150 +580,153 @@ "WorkflowCompensationMode": {"description":"Workflow-level compensation behavior.","enum":["automatic","disabled"],"title":"WorkflowCompensationMode","type":"string"}, "WorkflowCompensationPolicy": {"additionalProperties":false,"description":"Workflow-level compensation policy.","properties":{"failure_policy":{"$ref":"#/$defs/WorkflowCompensationFailurePolicy","default":"fail_workflow"},"mode":{"$ref":"#/$defs/WorkflowCompensationMode","default":"disabled"},"on":{"items":{"$ref":"#/$defs/WorkflowCompensationTrigger"},"title":"On","type":"array"},"order":{"default":"reverse_completion","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Order","type":"string"}},"title":"WorkflowCompensationPolicy","type":"object"}, "WorkflowCompensationTrigger": {"description":"Terminal workflow reasons that may trigger compensation.","enum":["failed","cancelled","timed_out"],"title":"WorkflowCompensationTrigger","type":"string"}, - "WorkflowPredicate": {"additionalProperties":false,"description":"Typed branch predicate over assertions, objectives, and prior step state.","properties":{"assertions":{"$ref":"#/$defs/_r105"},"objectives":{"items":{"$ref":"#/$defs/_r187"},"title":"Objectives","type":"array"},"steps":{"items":{"$ref":"#/$defs/WorkflowStepStateRef"},"title":"Steps","type":"array"}},"title":"WorkflowPredicate","type":"object"}, - "WorkflowStep": {"additionalProperties":false,"description":"A named workflow step with explicit portable control semantics.","properties":{"allowed_action_families":{"items":{"$ref":"#/$defs/_r187"},"title":"Allowed Action Families","type":"array"},"branches":{"items":{"$ref":"#/$defs/_r187"},"title":"Branches","type":"array"},"capability_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Capability Refs","type":"array"},"cases":{"items":{"$ref":"#/$defs/WorkflowSwitchCase"},"title":"Cases","type":"array"},"compensate_with":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Compensate With","type":"string"},"default":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Default","type":"string"},"description":{"$ref":"#/$defs/_r53"},"else":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Else","type":"string"},"execution_mode":{"$ref":"#/$defs/WorkflowStepExecutionMode","default":"scripted"},"fact_binding_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Fact Binding Refs","type":"array"},"join":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Join","type":"string"},"max_attempts":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Max Attempts"},"next":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Next","type":"string"},"objective":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Objective","type":"string"},"on_exhausted":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Exhausted","type":"string"},"on_failure":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Failure","type":"string"},"on_success":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Success","type":"string"},"procedure_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Procedure Ref","type":"string"},"scaffold_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Scaffold Refs","type":"array"},"then":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Then","type":"string"},"tool_affordance_refs":{"items":{"$ref":"#/$defs/_r187"},"title":"Tool Affordance Refs","type":"array"},"type":{"$ref":"#/$defs/WorkflowStepType"},"when":{"anyOf":[{"$ref":"#/$defs/WorkflowPredicate"},{"type":"null"}],"default":null},"workflow":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Workflow","type":"string"}},"required":["type"],"title":"WorkflowStep","type":"object"}, + "WorkflowPredicate": {"additionalProperties":false,"description":"Typed branch predicate over assertions, objectives, and prior step state.","properties":{"assertions":{"$ref":"#/$defs/_r108"},"objectives":{"items":{"$ref":"#/$defs/_r190"},"title":"Objectives","type":"array"},"steps":{"items":{"$ref":"#/$defs/WorkflowStepStateRef"},"title":"Steps","type":"array"}},"title":"WorkflowPredicate","type":"object"}, + "WorkflowStep": {"additionalProperties":false,"description":"A named workflow step with explicit portable control semantics.","properties":{"allowed_action_families":{"items":{"$ref":"#/$defs/_r190"},"title":"Allowed Action Families","type":"array"},"branches":{"items":{"$ref":"#/$defs/_r190"},"title":"Branches","type":"array"},"capability_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Capability Refs","type":"array"},"cases":{"items":{"$ref":"#/$defs/WorkflowSwitchCase"},"title":"Cases","type":"array"},"compensate_with":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Compensate With","type":"string"},"default":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Default","type":"string"},"description":{"$ref":"#/$defs/_r53"},"else":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Else","type":"string"},"execution_mode":{"$ref":"#/$defs/WorkflowStepExecutionMode","default":"scripted"},"fact_binding_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Fact Binding Refs","type":"array"},"join":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Join","type":"string"},"max_attempts":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Max Attempts"},"next":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Next","type":"string"},"objective":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Objective","type":"string"},"on_exhausted":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Exhausted","type":"string"},"on_failure":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Failure","type":"string"},"on_success":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"On Success","type":"string"},"procedure_ref":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Procedure Ref","type":"string"},"scaffold_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Scaffold Refs","type":"array"},"then":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Then","type":"string"},"tool_affordance_refs":{"items":{"$ref":"#/$defs/_r190"},"title":"Tool Affordance Refs","type":"array"},"type":{"$ref":"#/$defs/WorkflowStepType"},"when":{"anyOf":[{"$ref":"#/$defs/WorkflowPredicate"},{"type":"null"}],"default":null},"workflow":{"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Workflow","type":"string"}},"required":["type"],"title":"WorkflowStep","type":"object"}, "WorkflowStepExecutionMode": {"description":"Authored realization boundary for an executable workflow step.","enum":["scripted","objective","scaffolded"],"title":"WorkflowStepExecutionMode","type":"string"}, "WorkflowStepOutcome": {"description":"Portable workflow-visible outcomes emitted by executable steps.","enum":["succeeded","failed","exhausted"],"title":"WorkflowStepOutcome","type":"string"}, - "WorkflowStepStateRef": {"additionalProperties":false,"description":"Predicate reference to previously observed workflow step state.","properties":{"min_attempts":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Min Attempts"},"outcomes":{"items":{"$ref":"#/$defs/WorkflowStepOutcome"},"minItems":1,"title":"Outcomes","type":"array"},"step":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Step","type":"string"}},"required":["step","outcomes"],"title":"WorkflowStepStateRef","type":"object"}, + "WorkflowStepStateRef": {"additionalProperties":false,"description":"Predicate reference to previously observed workflow step state.","properties":{"min_attempts":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Min Attempts"},"outcomes":{"items":{"$ref":"#/$defs/WorkflowStepOutcome"},"minItems":1,"title":"Outcomes","type":"array"},"step":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Step","type":"string"}},"required":["step","outcomes"],"title":"WorkflowStepStateRef","type":"object"}, "WorkflowStepType": {"description":"Control-flow node types for declarative experiment workflows.","enum":["objective","decision","switch","parallel","join","retry","call","end"],"title":"WorkflowStepType","type":"string"}, "WorkflowSwitchCase": {"additionalProperties":false,"description":"One ordered branch case within a ``switch`` workflow step.","properties":{"description":{"$ref":"#/$defs/_r53"},"next":{"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Next","type":"string"},"when":{"$ref":"#/$defs/WorkflowPredicate"}},"required":["when","next"],"title":"WorkflowSwitchCase","type":"object"}, - "WorkflowTimeoutPolicy": {"additionalProperties":false,"description":"Workflow-level timeout policy.","properties":{"seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Seconds"}},"required":["seconds"],"title":"WorkflowTimeoutPolicy","type":"object"}, + "WorkflowTimeoutPolicy": {"additionalProperties":false,"description":"Workflow-level timeout policy.","properties":{"seconds":{"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Seconds"}},"required":["seconds"],"title":"WorkflowTimeoutPolicy","type":"object"}, "WorkloadAuthenticationMode": {"description":"Workload authentication posture at a shared-service boundary.","enum":["none","shared_credential","workload_identity","tenant_scoped_workload_identity"],"title":"WorkloadAuthenticationMode","type":"string"}, - "_r0": {"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":2048,"minLength":1,"not":{"pattern":"[^a-z0-9_.-]"},"pattern":"^(?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63}$","type":"string"}, - "_r1": {"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Name","type":"string"}, - "_r10": {"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessAction"},{"$ref":"#/$defs/_r151"}],"default":"other","title":"Action"}, - "_r100": {"items":{"$ref":"#/$defs/_r187"},"title":"Add","type":"array"}, - "_r101": {"items":{"$ref":"#/$defs/_r187"},"title":"Aliases","type":"array"}, - "_r102": {"items":{"$ref":"#/$defs/_r187"},"title":"Allow Groups","type":"array"}, - "_r103": {"items":{"$ref":"#/$defs/_r187"},"title":"Allow Users","type":"array"}, - "_r104": {"items":{"$ref":"#/$defs/_r187"},"title":"Allowed Clients","type":"array"}, - "_r105": {"items":{"$ref":"#/$defs/_r187"},"title":"Assertions","type":"array"}, - "_r106": {"items":{"$ref":"#/$defs/_r187"},"title":"Authentication Methods","type":"array"}, - "_r107": {"items":{"$ref":"#/$defs/_r187"},"title":"Backend Roles","type":"array"}, - "_r108": {"items":{"$ref":"#/$defs/_r187"},"title":"Command","type":"array"}, - "_r109": {"items":{"$ref":"#/$defs/_r187"},"title":"Configuration File Refs","type":"array"}, - "_r11": {"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemStability"},{"$ref":"#/$defs/_r166"}],"default":"unknown","title":"Stability"}, - "_r110": {"items":{"$ref":"#/$defs/_r187"},"title":"Deny Groups","type":"array"}, - "_r111": {"items":{"$ref":"#/$defs/_r187"},"title":"Deny Users","type":"array"}, - "_r112": {"items":{"$ref":"#/$defs/_r187"},"title":"Dependencies","type":"array"}, - "_r113": {"items":{"$ref":"#/$defs/_r187"},"title":"Diagnostics","type":"array"}, - "_r114": {"items":{"$ref":"#/$defs/_r187"},"title":"Drop","type":"array"}, - "_r115": {"items":{"$ref":"#/$defs/_r187"},"title":"Effective","type":"array"}, - "_r116": {"items":{"$ref":"#/$defs/_r187"},"title":"Entrypoint","type":"array"}, - "_r117": {"items":{"$ref":"#/$defs/_r187"},"title":"Environment","type":"array"}, - "_r118": {"items":{"$ref":"#/$defs/_r187"},"title":"Events","type":"array"}, - "_r119": {"items":{"$ref":"#/$defs/_r187"},"title":"Evidence Refs","type":"array"}, - "_r12": {"anyOf":[{"$ref":"#/$defs/RuntimeForwardingEnrollmentClassification"},{"$ref":"#/$defs/_r159"}],"default":"none","title":"Enrollment Identity Classification"}, - "_r120": {"items":{"$ref":"#/$defs/_r187"},"title":"File Refs","type":"array"}, - "_r121": {"items":{"$ref":"#/$defs/_r187"},"title":"Groups","type":"array"}, - "_r122": {"items":{"$ref":"#/$defs/_r187"},"title":"Hosts","type":"array"}, - "_r123": {"items":{"$ref":"#/$defs/_r187"},"title":"Limitations","type":"array"}, - "_r124": {"items":{"$ref":"#/$defs/_r187"},"title":"Log File Refs","type":"array"}, - "_r125": {"items":{"$ref":"#/$defs/_r187"},"title":"Ordering Content Refs","type":"array"}, - "_r126": {"items":{"$ref":"#/$defs/_r187"},"title":"Ordering Dependencies","type":"array","uniqueItems":true}, - "_r127": {"items":{"$ref":"#/$defs/_r187"},"title":"Refresh Dependencies","type":"array","uniqueItems":true}, - "_r128": {"items":{"$ref":"#/$defs/_r187"},"title":"Scope Refs","type":"array"}, - "_r129": {"items":{"$ref":"#/$defs/_r187"},"title":"Tags","type":"array"}, - "_r13": {"anyOf":[{"$ref":"#/$defs/RuntimeForwardingParseFormat"},{"$ref":"#/$defs/_r157"}],"default":"unknown","title":"Parse Format"}, - "_r130": {"items":{"$ref":"#/$defs/_r187"},"title":"Target Refs","type":"array"}, - "_r131": {"maxLength":1024,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, - "_r132": {"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9._+-]*$","title":"Revision","type":"string"}, - "_r133": {"maxLength":2048,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:https://[^\\s]+|urn:[A-Za-z0-9][A-Za-z0-9:._~-]*)$","title":"Semantic Ref","type":"string"}, - "_r134": {"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, - "_r135": {"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Scope","type":"string"}, - "_r136": {"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","type":"string"}, - "_r137": {"maxLength":512,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z0-9][a-z0-9_-]{0,63}(?:\\.[a-z0-9][a-z0-9_-]{0,63})*$","title":"Property","type":"string"}, - "_r138": {"maxLength":64,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[a-z0-9][a-z0-9_-]{0,63}|__private)$","type":"string"}, - "_r139": {"maxProperties":1024,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantActivityActionCandidate"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Action Candidates","type":"object"}, - "_r14": {"anyOf":[{"$ref":"#/$defs/RuntimeIdentityProvenance"},{"$ref":"#/$defs/_r153"}],"default":"unknown","title":"Provenance"}, - "_r140": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","type":"string"}, - "_r141": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority","type":"string"}, - "_r142": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Ref","type":"string"}, - "_r143": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Observation Boundary Ref","type":"string"}, - "_r144": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Implementation Ref","type":"string"}, - "_r145": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Progression Policy Ref","type":"string"}, - "_r146": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Stochastic Control Ref","type":"string"}, - "_r147": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Service Ref","type":"string"}, - "_r148": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, - "_r149": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][gG][eE][nN][tT][-_][eE][vV][eE][nN][tT][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][gG][eE][nN][tT][-_][eE][nN][rR][oO][lL][lL][mM][eE][nN][tT]|[sS][yY][sS][lL][oO][gG][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][pP][iI]|[aA][lL][eE][rR][tT][-_][fF][oO][rR][wW][aA][rR][dD][iI][nN][gG]|[iI][nN][dD][eE][xX][eE][rR][-_][fF][oO][rR][wW][aA][rR][dD][iI][nN][gG]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r15": {"anyOf":[{"$ref":"#/$defs/RuntimeIdentityRecordOrigin"},{"$ref":"#/$defs/_r152"}],"default":"unknown","title":"Origin"}, - "_r150": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][xX][fF][rR]|[iI][xX][fF][rR]|[qQ][uU][eE][rR][yY]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[zZ][oO][nN][eE][-_][fF][iI][lL][eE]|[pP][rR][oO][vV][iI][dD][eE][rR][-_][aA][pP][iI]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r151": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][rR][oO][wW][sS][eE]|[lL][iI][sS][tT]|[rR][eE][aA][dD]|[wW][rR][iI][tT][eE]|[cC][rR][eE][aA][tT][eE]|[dD][eE][lL][eE][tT][eE]|[eE][xX][eE][cC][uU][tT][eE]|[aA][dD][mM][iI][nN][iI][sS][tT][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r152": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[dD][iI][rR][eE][cC][tT][oO][rR][yY]|[sS][yY][nN][cC][hH][rR][oO][nN][iI][zZ][eE][dD]|[fF][eE][dD][eE][rR][aA][tT][eE][dD]|[pP][rR][oO][vV][iI][sS][iI][oO][nN][eE][dD]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r153": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][mM][aA][gG][eE]|[pP][aA][cC][kK][aA][gG][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r154": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX][-_][pP][aA][tT][tT][eE][rR][nN]|[cC][qQ][lL][-_][rR][eE][sS][oO][uU][rR][cC][eE]|[rR][eE][dD][iI][sS][-_][aA][cC][lL]|[aA][pP][pP][-_][rR][eE][sS][oO][uU][rR][cC][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r155": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r156": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN]|[cC][hH]|[hH][sS]|[nN][oO][nN][eE]|[aA][nN][yY]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r157": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[jJ][sS][oO][nN]|[sS][yY][sS][lL][oO][gG]|[eE][vV][eE][-_][jJ][sS][oO][nN]|[cC][eE][fF]|[lL][eE][eE][fF]|[cC][sS][vV]|[tT][eE][xX][tT]|[sS][tT][iI][xX]|[mM][iI][sS][pP][-_][jJ][sS][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r158": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[pP][lL][aA][iI][nN]|[lL][oO][gG][iI][nN]|[cC][rR][aA][mM][-_][mM][dD]5|[dD][iI][gG][eE][sS][tT][-_][mM][dD]5|[sS][cC][rR][aA][mM][-_][sS][hH][aA][-_]1|[sS][cC][rR][aA][mM][-_][sS][hH][aA][-_]256|[oO][aA][uU][tT][hH][bB][eE][aA][rR][eE][rR]|[eE][xX][tT][eE][rR][nN][aA][lL]|[aA][nN][oO][nN][yY][mM][oO][uU][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r159": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[rR][eE][dD][aA][cC][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r16": {"anyOf":[{"$ref":"#/$defs/RuntimeMailAuthMechanism"},{"$ref":"#/$defs/_r158"}]}, - "_r160": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[sS][tT][aA][rR][tT][tT][lL][sS][-_][aA][vV][aA][iI][lL][aA][bB][lL][eE]|[sS][tT][aA][rR][tT][tT][lL][sS][-_][rR][eE][qQ][uU][iI][rR][eE][dD]|[iI][mM][pP][lL][iI][cC][iI][tT][-_][tT][lL][sS]|[tT][lL][sS][-_][tT][eE][rR][mM][iI][nN][aA][tT][eE][dD][-_][uU][pP][sS][tT][rR][eE][aA][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r161": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][lL][aA][iI][nN]|[rR][eE][dD][aA][cC][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r162": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][lL][aA][iI][nN]|[rR][eE][dD][aA][cC][tT][eE][dD]|[sS][eE][cC][rR][eE][tT][-_][fF][iI][xX][tT][uU][rR][eE]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r163": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][cC][eE][nN][aA][rR][iI][oO]|[bB][uU][iI][lL][tT][-_][iI][nN]|[sS][yY][sS][tT][eE][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r164": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][hH][aA][rR][eE][-_][cC][oO][nN][fF][iI][gG]|[pP][aA][sS][sS][dD][bB]|[fF][iI][lL][eE][sS][yY][sS][tT][eE][mM][-_][aA][cC][lL]|[dD][iI][rR][eE][cC][tT][oO][rR][yY][-_][pP][oO][lL][iI][cC][yY]|[oO][bB][sS][eE][rR][vV][eE][dD][-_][pP][rR][oO][bB][eE]|[cC][oO][mM][pP][uU][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r165": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][mM][tT][pP]|[eE][sS][mM][tT][pP]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN]|[sS][mM][tT][pP][sS]|[iI][mM][aA][pP]|[iI][mM][aA][pP][sS]|[pP][oO][pP]3|[pP][oO][pP]3[sS]|[lL][mM][tT][pP]|[sS][iI][eE][vV][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r166": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][tT][aA][bB][lL][eE]|[gG][eE][nN][eE][rR][aA][tT][eE][dD]|[lL][oO][gG]|[cC][aA][cC][hH][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[vV][oO][lL][uU][mM][eE][-_][bB][aA][cC][kK][eE][dD]|[tT][rR][aA][nN][sS][iI][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, - "_r167": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:password|key|certificate|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"}, - "_r168": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Digest","type":"string"}, - "_r169": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Value","type":"string"}, - "_r17": {"anyOf":[{"$ref":"#/$defs/RuntimeMailProtocol"},{"$ref":"#/$defs/_r165"}],"default":"other","title":"Protocol"}, - "_r170": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Address","type":"string"}, - "_r171": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Ref","type":"string"}, - "_r172": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Description","type":"string"}, - "_r173": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Information Ref","type":"string"}, - "_r174": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Latency Profile","type":"string"}, - "_r175": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mount Destination","type":"string"}, - "_r176": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Name","type":"string"}, - "_r177": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node","type":"string"}, - "_r178": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Path","type":"string"}, - "_r179": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Revision","type":"string"}, - "_r18": {"anyOf":[{"$ref":"#/$defs/RuntimeMailTlsMode"},{"$ref":"#/$defs/_r160"}],"default":"unknown","title":"Tls Mode"}, - "_r180": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ref","type":"string"}, - "_r181": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Resource Ref","type":"string"}, - "_r182": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Semantic Version","type":"string"}, - "_r183": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Subject Ref","type":"string"}, - "_r184": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target","type":"string"}, - "_r185": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Username","type":"string"}, - "_r186": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Value","type":"string"}, - "_r187": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, - "_r188": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"}}, - "_r19": {"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Sensitivity"}, - "_r2": {"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Refinement Id","type":"string"}, - "_r20": {"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Value Classification"}, + "_r0": {"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":2048,"minLength":1,"not":{"pattern":"[^a-z0-9_.-]"},"pattern":"^(?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63}$","type":"string"}, + "_r1": {"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Name","type":"string"}, + "_r10": {"anyOf":[{"$ref":"#/$defs/RuntimeFileServiceAccessAction"},{"$ref":"#/$defs/_r154"}],"default":"other","title":"Action"}, + "_r100": {"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Readback Assertion Refs","type":"array"}, + "_r101": {"items":{"$ref":"#/$defs/_r190"},"title":"Accept Env","type":"array"}, + "_r102": {"items":{"$ref":"#/$defs/_r190"},"title":"Actions","type":"array"}, + "_r103": {"items":{"$ref":"#/$defs/_r190"},"title":"Add","type":"array"}, + "_r104": {"items":{"$ref":"#/$defs/_r190"},"title":"Aliases","type":"array"}, + "_r105": {"items":{"$ref":"#/$defs/_r190"},"title":"Allow Groups","type":"array"}, + "_r106": {"items":{"$ref":"#/$defs/_r190"},"title":"Allow Users","type":"array"}, + "_r107": {"items":{"$ref":"#/$defs/_r190"},"title":"Allowed Clients","type":"array"}, + "_r108": {"items":{"$ref":"#/$defs/_r190"},"title":"Assertions","type":"array"}, + "_r109": {"items":{"$ref":"#/$defs/_r190"},"title":"Authentication Methods","type":"array"}, + "_r11": {"anyOf":[{"$ref":"#/$defs/RuntimeFilesystemStability"},{"$ref":"#/$defs/_r169"}],"default":"unknown","title":"Stability"}, + "_r110": {"items":{"$ref":"#/$defs/_r190"},"title":"Backend Roles","type":"array"}, + "_r111": {"items":{"$ref":"#/$defs/_r190"},"title":"Command","type":"array"}, + "_r112": {"items":{"$ref":"#/$defs/_r190"},"title":"Configuration File Refs","type":"array"}, + "_r113": {"items":{"$ref":"#/$defs/_r190"},"title":"Deny Groups","type":"array"}, + "_r114": {"items":{"$ref":"#/$defs/_r190"},"title":"Deny Users","type":"array"}, + "_r115": {"items":{"$ref":"#/$defs/_r190"},"title":"Dependencies","type":"array"}, + "_r116": {"items":{"$ref":"#/$defs/_r190"},"title":"Diagnostics","type":"array"}, + "_r117": {"items":{"$ref":"#/$defs/_r190"},"title":"Drop","type":"array"}, + "_r118": {"items":{"$ref":"#/$defs/_r190"},"title":"Effective","type":"array"}, + "_r119": {"items":{"$ref":"#/$defs/_r190"},"title":"Entrypoint","type":"array"}, + "_r12": {"anyOf":[{"$ref":"#/$defs/RuntimeForwardingEnrollmentClassification"},{"$ref":"#/$defs/_r162"}],"default":"none","title":"Enrollment Identity Classification"}, + "_r120": {"items":{"$ref":"#/$defs/_r190"},"title":"Environment","type":"array"}, + "_r121": {"items":{"$ref":"#/$defs/_r190"},"title":"Events","type":"array"}, + "_r122": {"items":{"$ref":"#/$defs/_r190"},"title":"Evidence Refs","type":"array"}, + "_r123": {"items":{"$ref":"#/$defs/_r190"},"title":"File Refs","type":"array"}, + "_r124": {"items":{"$ref":"#/$defs/_r190"},"title":"Groups","type":"array"}, + "_r125": {"items":{"$ref":"#/$defs/_r190"},"title":"Hosts","type":"array"}, + "_r126": {"items":{"$ref":"#/$defs/_r190"},"title":"Limitations","type":"array"}, + "_r127": {"items":{"$ref":"#/$defs/_r190"},"title":"Log File Refs","type":"array"}, + "_r128": {"items":{"$ref":"#/$defs/_r190"},"title":"Ordering Content Refs","type":"array"}, + "_r129": {"items":{"$ref":"#/$defs/_r190"},"title":"Ordering Dependencies","type":"array","uniqueItems":true}, + "_r13": {"anyOf":[{"$ref":"#/$defs/RuntimeForwardingParseFormat"},{"$ref":"#/$defs/_r160"}],"default":"unknown","title":"Parse Format"}, + "_r130": {"items":{"$ref":"#/$defs/_r190"},"title":"Refresh Dependencies","type":"array","uniqueItems":true}, + "_r131": {"items":{"$ref":"#/$defs/_r190"},"title":"Scope Refs","type":"array"}, + "_r132": {"items":{"$ref":"#/$defs/_r190"},"title":"Tags","type":"array"}, + "_r133": {"items":{"$ref":"#/$defs/_r190"},"title":"Target Refs","type":"array"}, + "_r134": {"maxLength":1024,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, + "_r135": {"maxLength":128,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[A-Za-z0-9][A-Za-z0-9._+-]*$","title":"Revision","type":"string"}, + "_r136": {"maxLength":2048,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:https://[^\\s]+|urn:[A-Za-z0-9][A-Za-z0-9:._~-]*)$","title":"Semantic Ref","type":"string"}, + "_r137": {"maxLength":256,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, + "_r138": {"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","title":"Scope","type":"string"}, + "_r139": {"maxLength":4096,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:/(?:[^~/]|~[01])*)*$","type":"string"}, + "_r14": {"anyOf":[{"$ref":"#/$defs/RuntimeIdentityProvenance"},{"$ref":"#/$defs/_r156"}],"default":"unknown","title":"Provenance"}, + "_r140": {"maxLength":512,"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^[a-z0-9][a-z0-9_-]{0,63}(?:\\.[a-z0-9][a-z0-9_-]{0,63})*$","title":"Property","type":"string"}, + "_r141": {"maxLength":64,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[a-z0-9][a-z0-9_-]{0,63}|__private)$","type":"string"}, + "_r142": {"maxProperties":1024,"minProperties":1,"patternProperties":{"^[a-z0-9]":{"$ref":"#/$defs/ParticipantActivityActionCandidate"}},"propertyNames":{"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"}},"title":"Action Candidates","type":"object"}, + "_r143": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"\\S","type":"string"}, + "_r144": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authority","type":"string"}, + "_r145": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Ref","type":"string"}, + "_r146": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Observation Boundary Ref","type":"string"}, + "_r147": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Participant Implementation Ref","type":"string"}, + "_r148": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Progression Policy Ref","type":"string"}, + "_r149": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Stochastic Control Ref","type":"string"}, + "_r15": {"anyOf":[{"$ref":"#/$defs/RuntimeIdentityRecordOrigin"},{"$ref":"#/$defs/_r155"}],"default":"unknown","title":"Origin"}, + "_r150": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target Service Ref","type":"string"}, + "_r151": {"minLength":1,"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, + "_r152": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][gG][eE][nN][tT][-_][eE][vV][eE][nN][tT][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][gG][eE][nN][tT][-_][eE][nN][rR][oO][lL][lL][mM][eE][nN][tT]|[sS][yY][sS][lL][oO][gG][-_][iI][nN][gG][eE][sS][tT][iI][oO][nN]|[aA][pP][iI]|[aA][lL][eE][rR][tT][-_][fF][oO][rR][wW][aA][rR][dD][iI][nN][gG]|[iI][nN][dD][eE][xX][eE][rR][-_][fF][oO][rR][wW][aA][rR][dD][iI][nN][gG]|[dD][aA][sS][hH][bB][oO][aA][rR][dD]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r153": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[aA][xX][fF][rR]|[iI][xX][fF][rR]|[qQ][uU][eE][rR][yY]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[zZ][oO][nN][eE][-_][fF][iI][lL][eE]|[pP][rR][oO][vV][iI][dD][eE][rR][-_][aA][pP][iI]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r154": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][rR][oO][wW][sS][eE]|[lL][iI][sS][tT]|[rR][eE][aA][dD]|[wW][rR][iI][tT][eE]|[cC][rR][eE][aA][tT][eE]|[dD][eE][lL][eE][tT][eE]|[eE][xX][eE][cC][uU][tT][eE]|[aA][dD][mM][iI][nN][iI][sS][tT][eE][rR]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r155": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[bB][uU][iI][lL][tT][-_][iI][nN]|[dD][iI][rR][eE][cC][tT][oO][rR][yY]|[sS][yY][nN][cC][hH][rR][oO][nN][iI][zZ][eE][dD]|[fF][eE][dD][eE][rR][aA][tT][eE][dD]|[pP][rR][oO][vV][iI][sS][iI][oO][nN][eE][dD]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r156": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][mM][aA][gG][eE]|[pP][aA][cC][kK][aA][gG][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r157": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][dD][eE][xX][-_][pP][aA][tT][tT][eE][rR][nN]|[cC][qQ][lL][-_][rR][eE][sS][oO][uU][rR][cC][eE]|[rR][eE][dD][iI][sS][-_][aA][cC][lL]|[aA][pP][pP][-_][rR][eE][sS][oO][uU][rR][cC][eE]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r158": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN][tT][rR][oO][sS][pP][eE][cC][tT][iI][oO][nN]|[cC][oO][nN][fF][iI][gG][uU][rR][aA][tT][iI][oO][nN][-_][fF][iI][lL][eE]|[iI][mM][aA][gG][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][oO][vV][eE][rR][rR][iI][dD][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][dD][eE][fF][aA][uU][lL][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r159": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[iI][nN]|[cC][hH]|[hH][sS]|[nN][oO][nN][eE]|[aA][nN][yY]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r16": {"anyOf":[{"$ref":"#/$defs/RuntimeMailAuthMechanism"},{"$ref":"#/$defs/_r161"}]}, + "_r160": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[jJ][sS][oO][nN]|[sS][yY][sS][lL][oO][gG]|[eE][vV][eE][-_][jJ][sS][oO][nN]|[cC][eE][fF]|[lL][eE][eE][fF]|[cC][sS][vV]|[tT][eE][xX][tT]|[sS][tT][iI][xX]|[mM][iI][sS][pP][-_][jJ][sS][oO][nN]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r161": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[pP][lL][aA][iI][nN]|[lL][oO][gG][iI][nN]|[cC][rR][aA][mM][-_][mM][dD]5|[dD][iI][gG][eE][sS][tT][-_][mM][dD]5|[sS][cC][rR][aA][mM][-_][sS][hH][aA][-_]1|[sS][cC][rR][aA][mM][-_][sS][hH][aA][-_]256|[oO][aA][uU][tT][hH][bB][eE][aA][rR][eE][rR]|[eE][xX][tT][eE][rR][nN][aA][lL]|[aA][nN][oO][nN][yY][mM][oO][uU][sS]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r162": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[rR][eE][dD][aA][cC][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r163": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[nN][oO][nN][eE]|[sS][tT][aA][rR][tT][tT][lL][sS][-_][aA][vV][aA][iI][lL][aA][bB][lL][eE]|[sS][tT][aA][rR][tT][tT][lL][sS][-_][rR][eE][qQ][uU][iI][rR][eE][dD]|[iI][mM][pP][lL][iI][cC][iI][tT][-_][tT][lL][sS]|[tT][lL][sS][-_][tT][eE][rR][mM][iI][nN][aA][tT][eE][dD][-_][uU][pP][sS][tT][rR][eE][aA][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r164": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][lL][aA][iI][nN]|[rR][eE][dD][aA][cC][tT][eE][dD]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r165": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[pP][lL][aA][iI][nN]|[rR][eE][dD][aA][cC][tT][eE][dD]|[sS][eE][cC][rR][eE][tT][-_][fF][iI][xX][tT][uU][rR][eE]|[oO][pP][eE][rR][aA][tT][oO][rR][-_][sS][eE][cC][rR][eE][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r166": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][cC][eE][nN][aA][rR][iI][oO]|[bB][uU][iI][lL][tT][-_][iI][nN]|[sS][yY][sS][tT][eE][mM]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r167": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][hH][aA][rR][eE][-_][cC][oO][nN][fF][iI][gG]|[pP][aA][sS][sS][dD][bB]|[fF][iI][lL][eE][sS][yY][sS][tT][eE][mM][-_][aA][cC][lL]|[dD][iI][rR][eE][cC][tT][oO][rR][yY][-_][pP][oO][lL][iI][cC][yY]|[oO][bB][sS][eE][rR][vV][eE][dD][-_][pP][rR][oO][bB][eE]|[cC][oO][mM][pP][uU][tT][eE][dD]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r168": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][mM][tT][pP]|[eE][sS][mM][tT][pP]|[sS][uU][bB][mM][iI][sS][sS][iI][oO][nN]|[sS][mM][tT][pP][sS]|[iI][mM][aA][pP]|[iI][mM][aA][pP][sS]|[pP][oO][pP]3|[pP][oO][pP]3[sS]|[lL][mM][tT][pP]|[sS][iI][eE][vV][eE]|[oO][tT][hH][eE][rR]|[uU][nN][kK][nN][oO][wW][nN]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r169": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:[sS][tT][aA][bB][lL][eE]|[gG][eE][nN][eE][rR][aA][tT][eE][dD]|[lL][oO][gG]|[cC][aA][cC][hH][eE]|[rR][uU][nN][tT][iI][mM][eE][-_][cC][rR][eE][aA][tT][eE][dD]|[vV][oO][lL][uU][mM][eE][-_][bB][aA][cC][kK][eE][dD]|[tT][rR][aA][nN][sS][iI][eE][nN][tT]|[uU][nN][kK][nN][oO][wW][nN]|[oO][tT][hH][eE][rR]|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$(?![\\s\\S])","type":"string"}, + "_r17": {"anyOf":[{"$ref":"#/$defs/RuntimeMailProtocol"},{"$ref":"#/$defs/_r168"}],"default":"other","title":"Protocol"}, + "_r170": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:password|key|certificate|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})$","type":"string"}, + "_r171": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Digest","type":"string"}, + "_r172": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^sha256:[a-f0-9]{64}$","title":"Value","type":"string"}, + "_r173": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Address","type":"string"}, + "_r174": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Clock Ref","type":"string"}, + "_r175": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Description","type":"string"}, + "_r176": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Information Ref","type":"string"}, + "_r177": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Latency Profile","type":"string"}, + "_r178": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Mount Destination","type":"string"}, + "_r179": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Name","type":"string"}, + "_r18": {"anyOf":[{"$ref":"#/$defs/RuntimeMailTlsMode"},{"$ref":"#/$defs/_r163"}],"default":"unknown","title":"Tls Mode"}, + "_r180": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Node","type":"string"}, + "_r181": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Path","type":"string"}, + "_r182": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Policy Revision","type":"string"}, + "_r183": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Ref","type":"string"}, + "_r184": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Resource Ref","type":"string"}, + "_r185": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Semantic Version","type":"string"}, + "_r186": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Subject Ref","type":"string"}, + "_r187": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Target","type":"string"}, + "_r188": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Username","type":"string"}, + "_r189": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Value","type":"string"}, + "_r19": {"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Sensitivity"}, + "_r190": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"type":"string"}, + "_r191": {"not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"}}, + "_r2": {"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","title":"Refinement Id","type":"string"}, + "_r20": {"anyOf":[{"$ref":"#/$defs/RuntimeSensitivityClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Value Classification"}, "_r21": {"anyOf":[{"const":""},{"$ref":"#/$defs/_r3"}],"default":"","title":"Name"}, "_r22": {"anyOf":[{"minimum":1,"type":"integer"},{"type":"null"}],"default":null,"title":"Threshold"}, - "_r23": {"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"integer"},{"type":"number"},{"type":"boolean"}]}, - "_r24": {"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Disclosure Rule"}, - "_r25": {"anyOf":[{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Realized Backend Disclosure"}, - "_r26": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Auth Required"}, - "_r27": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Enabled"}, - "_r28": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Loaded"}, - "_r29": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Password Authentication"}, - "_r3": {"allOf":[{"$ref":"#/$defs/_r188"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","type":"string"}, - "_r30": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Permit Tty"}, - "_r31": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Pubkey Authentication"}, - "_r32": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Command Redacted"}, - "_r33": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r187"}],"default":false,"title":"Disabled"}, - "_r34": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Doc Count"}, - "_r35": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Gid"}, - "_r36": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Host Port"}, - "_r37": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Port"}, - "_r38": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Size"}, - "_r39": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Status Code"}, - "_r4": {"anyOf":[{"$ref":"#/$defs/DatabaseObjectOrigin"},{"$ref":"#/$defs/_r163"}],"default":"unknown","title":"Origin"}, - "_r40": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Store Size Bytes"}, - "_r41": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"},{"type":"null"}],"default":null,"title":"Uid"}, - "_r42": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Container Port"}, - "_r43": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}],"title":"Port"}, - "_r44": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r187"}]}, + "_r23": {"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"integer"},{"type":"number"},{"type":"boolean"}]}, + "_r24": {"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Disclosure Rule"}, + "_r25": {"anyOf":[{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Realized Backend Disclosure"}, + "_r26": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Auth Required"}, + "_r27": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Enabled"}, + "_r28": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Loaded"}, + "_r29": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Password Authentication"}, + "_r3": {"allOf":[{"$ref":"#/$defs/_r191"}],"maxLength":64,"minLength":1,"not":{"pattern":"[^a-z0-9_-]"},"pattern":"^[a-z0-9]","type":"string"}, + "_r30": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Permit Tty"}, + "_r31": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Pubkey Authentication"}, + "_r32": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Command Redacted"}, + "_r33": {"anyOf":[{"type":"boolean"},{"$ref":"#/$defs/_r190"}],"default":false,"title":"Disabled"}, + "_r34": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Doc Count"}, + "_r35": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Gid"}, + "_r36": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Host Port"}, + "_r37": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Port"}, + "_r38": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Size"}, + "_r39": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Status Code"}, + "_r4": {"anyOf":[{"$ref":"#/$defs/DatabaseObjectOrigin"},{"$ref":"#/$defs/_r166"}],"default":"unknown","title":"Origin"}, + "_r40": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Store Size Bytes"}, + "_r41": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"},{"type":"null"}],"default":null,"title":"Uid"}, + "_r42": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Container Port"}, + "_r43": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}],"title":"Port"}, + "_r44": {"anyOf":[{"type":"integer"},{"$ref":"#/$defs/_r190"}]}, "_r45": {"const":"reject-unowned-collision","default":"reject-unowned-collision","title":"Conflict Policy","type":"string"}, "_r46": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"pattern":"^(?:x86_64|aarch64|amd64|x64|x86-64|arm64|x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*|\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\})?$","title":"Architecture","type":"string"}, "_r47": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Address","type":"string"}, "_r48": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authorization Ref","type":"string"}, "_r49": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Authorized Keys File","type":"string"}, - "_r5": {"anyOf":[{"$ref":"#/$defs/DnsRecordClass"},{"$ref":"#/$defs/_r156"}],"default":"in","title":"Zone Class"}, + "_r5": {"anyOf":[{"$ref":"#/$defs/DnsRecordClass"},{"$ref":"#/$defs/_r159"}],"default":"in","title":"Zone Class"}, "_r50": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Chroot Directory","type":"string"}, "_r51": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Command","type":"string"}, "_r52": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Component Ref","type":"string"}, @@ -724,7 +737,7 @@ "_r57": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Domain Ref","type":"string"}, "_r58": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Format","type":"string"}, "_r59": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Health","type":"string"}, - "_r6": {"anyOf":[{"$ref":"#/$defs/DnsRecordProvenance"},{"$ref":"#/$defs/_r150"}],"default":"unknown","title":"Provenance"}, + "_r6": {"anyOf":[{"$ref":"#/$defs/DnsRecordProvenance"},{"$ref":"#/$defs/_r153"}],"default":"unknown","title":"Provenance"}, "_r60": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Home","type":"string"}, "_r61": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Host Ip","type":"string"}, "_r62": {"default":"","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Image Ref","type":"string"}, @@ -754,20 +767,20 @@ "_r84": {"default":"tcp","not":{"pattern":"\\$\\{((?:(?:[a-z0-9][a-z0-9_-]{0,63}|__private)\\.)*[a-z0-9][a-z0-9_-]{0,63})\\}"},"title":"Protocol","type":"string"}, "_r85": {"default":1,"maximum":1024,"minimum":1,"title":"Max Burst Size","type":"integer"}, "_r86": {"default":1,"maximum":1024,"minimum":1,"title":"Max In Flight","type":"integer"}, - "_r87": {"default":[],"items":{"$ref":"#/$defs/_r138"},"maxItems":31,"title":"Namespace","type":"array"}, + "_r87": {"default":[],"items":{"$ref":"#/$defs/_r141"},"maxItems":31,"title":"Namespace","type":"array"}, "_r88": {"enum":["complete","wait"],"title":"Empty Eligible Disposition","type":"string"}, "_r89": {"enum":["next_opening","skip"],"title":"Outside Window Disposition","type":"string"}, - "_r9": {"anyOf":[{"$ref":"#/$defs/RuntimeEnvironmentValueClassification"},{"$ref":"#/$defs/_r162"}],"default":"unknown","title":"Value Classification"}, + "_r9": {"anyOf":[{"$ref":"#/$defs/RuntimeEnvironmentValueClassification"},{"$ref":"#/$defs/_r165"}],"default":"unknown","title":"Value Classification"}, "_r90": {"if":{"properties":{"command_kind":{"anyOf":[{"pattern":"^[Rr][Ee][Dd][Aa][Cc][Tt][Ee][Dd]$","type":"string"},{"pattern":"^[Oo][Pp][Ee][Rr][Aa][Tt][Oo][Rr][_-][Ss][Ee][Cc][Rr][Ee][Tt]$","type":"string"}]}},"required":["command_kind"]},"then":{"not":{"properties":{"command":{"minLength":1,"type":"string"}},"required":["command"]}}}, "_r91": {"if":{"properties":{"command_redacted":{"anyOf":[{"const":true},{"pattern":"^\\s*(?:[Tt][Rr][Uu][Ee]|1|[Yy][Ee][Ss]|[Oo][Nn])\\s*$","type":"string"}]}},"required":["command_redacted"]},"then":{"properties":{"command":{"maxLength":0}}}}, "_r92": {"items":{"$ref":"#/$defs/_r16"},"title":"Auth Mechanisms","type":"array"}, - "_r93": {"items":{"$ref":"#/$defs/_r187"},"maxItems":1024,"minItems":1,"title":"Work Window Refs","type":"array"}, - "_r94": {"items":{"$ref":"#/$defs/_r187"},"maxItems":1024,"title":"Pause Window Refs","type":"array"}, - "_r95": {"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Evidence Requirement Refs","type":"array"}, - "_r96": {"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Observation Boundary Refs","type":"array"}, - "_r97": {"items":{"$ref":"#/$defs/_r187"},"minItems":1,"title":"Readback Assertion Refs","type":"array"}, - "_r98": {"items":{"$ref":"#/$defs/_r187"},"title":"Accept Env","type":"array"}, - "_r99": {"items":{"$ref":"#/$defs/_r187"},"title":"Actions","type":"array"} + "_r93": {"items":{"$ref":"#/$defs/_r143"},"minItems":1,"title":"Action Contract Refs","type":"array","uniqueItems":true}, + "_r94": {"items":{"$ref":"#/$defs/_r143"},"minItems":1,"title":"Assertion Refs","type":"array","uniqueItems":true}, + "_r95": {"items":{"$ref":"#/$defs/_r143"},"minItems":1,"title":"Evidence Requirement Refs","type":"array","uniqueItems":true}, + "_r96": {"items":{"$ref":"#/$defs/_r190"},"maxItems":1024,"minItems":1,"title":"Work Window Refs","type":"array"}, + "_r97": {"items":{"$ref":"#/$defs/_r190"},"maxItems":1024,"title":"Pause Window Refs","type":"array"}, + "_r98": {"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Evidence Requirement Refs","type":"array"}, + "_r99": {"items":{"$ref":"#/$defs/_r190"},"minItems":1,"title":"Observation Boundary Refs","type":"array"} }, "$id": "https://openrae.github.io/rae/schemas/materialized-scenario-v1.json", "$schema": "https://json-schema.org/draft/2020-12/schema", diff --git a/contracts/schemas/sdl/sdl-authoring-input-v1.json b/contracts/schemas/sdl/sdl-authoring-input-v1.json index aac79b2a5..c41230953 100644 --- a/contracts/schemas/sdl/sdl-authoring-input-v1.json +++ b/contracts/schemas/sdl/sdl-authoring-input-v1.json @@ -9040,6 +9040,17 @@ "default": null, "title": "Behavior Mode" }, + "episode_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodePolicy" + }, + { + "type": "null" + } + ], + "default": null + }, "evidence_contract_refs": { "items": { "type": "string" @@ -9184,6 +9195,364 @@ "title": "ParticipantEffectClass", "type": "string" }, + "ParticipantEpisodeCompletionCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as completed.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "terminal_reason": { + "const": "completed", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeCompletionCondition", + "type": "object" + }, + "ParticipantEpisodeInitialization": { + "additionalProperties": false, + "description": "Preconditions of every new episode generation.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs" + ], + "title": "ParticipantEpisodeInitialization", + "type": "object" + }, + "ParticipantEpisodeInteractionStructure": { + "additionalProperties": false, + "description": "Turn order authority and the actions a turn offers.", + "properties": { + "action_contract_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Action Contract Refs", + "type": "array", + "uniqueItems": true + }, + "order_basis": { + "$ref": "#/$defs/ParticipantEpisodeTurnOrderBasis" + } + }, + "required": [ + "order_basis", + "action_contract_refs" + ], + "title": "ParticipantEpisodeInteractionStructure", + "type": "object" + }, + "ParticipantEpisodeMemoryScope": { + "description": "ADR-095 participant-memory scope across a reset.", + "enum": [ + "episode_local_reset", + "persistent_across_episodes" + ], + "title": "ParticipantEpisodeMemoryScope", + "type": "string" + }, + "ParticipantEpisodePolicy": { + "additionalProperties": false, + "description": "Versioned episode structure intent of a behavior specification.", + "properties": { + "initialization": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInitialization" + }, + { + "type": "null" + } + ], + "default": null + }, + "interaction_structure": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeInteractionStructure" + }, + { + "type": "null" + } + ], + "default": null + }, + "profile": { + "const": "participant-episode-policy/v1", + "title": "Profile", + "type": "string" + }, + "reset_policy": { + "anyOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeResetPolicy" + }, + { + "type": "null" + } + ], + "default": null + }, + "terminal_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "discriminator": { + "mapping": { + "completed": "#/$defs/ParticipantEpisodeCompletionCondition", + "timed_out": "#/$defs/ParticipantEpisodeTimeoutCondition" + }, + "propertyName": "terminal_reason" + }, + "oneOf": [ + { + "$ref": "#/$defs/ParticipantEpisodeCompletionCondition" + }, + { + "$ref": "#/$defs/ParticipantEpisodeTimeoutCondition" + } + ] + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Terminal Conditions", + "type": "object" + }, + "truncation_conditions": { + "additionalProperties": false, + "patternProperties": { + "^[a-z0-9]": { + "$ref": "#/$defs/ParticipantEpisodeTruncationCondition" + } + }, + "propertyNames": { + "maxLength": 64, + "minLength": 1, + "not": { + "pattern": "[^a-z0-9_-]" + } + }, + "title": "Truncation Conditions", + "type": "object" + } + }, + "required": [ + "profile" + ], + "title": "ParticipantEpisodePolicy", + "type": "object" + }, + "ParticipantEpisodeResetAction": { + "description": "ADR-013 control actions that start a later episode.", + "enum": [ + "reset", + "restart" + ], + "title": "ParticipantEpisodeResetAction", + "type": "string" + }, + "ParticipantEpisodeResetPolicy": { + "additionalProperties": false, + "allOf": [ + { + "else": { + "properties": { + "memory_reset_authority_ref": { + "type": "null" + } + } + }, + "if": { + "properties": { + "participant_memory_scope": { + "const": "episode_local_reset" + } + } + }, + "then": { + "properties": { + "memory_reset_authority_ref": { + "type": "string" + } + }, + "required": [ + "memory_reset_authority_ref" + ] + } + } + ], + "description": "Admitted reset actions, memory scope, reset authority, and evidence.", + "properties": { + "control_actions": { + "items": { + "$ref": "#/$defs/ParticipantEpisodeResetAction" + }, + "minItems": 1, + "title": "Control Actions", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "memory_reset_authority_ref": { + "anyOf": [ + { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Memory Reset Authority Ref" + }, + "participant_memory_scope": { + "$ref": "#/$defs/ParticipantEpisodeMemoryScope" + } + }, + "required": [ + "control_actions", + "participant_memory_scope", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeResetPolicy", + "type": "object" + }, + "ParticipantEpisodeTimeoutCondition": { + "additionalProperties": false, + "description": "Evidenced clock limit that ends the episode as timed out.", + "properties": { + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + }, + "temporal_constraint_ref": { + "minLength": 1, + "pattern": "\\S", + "title": "Temporal Constraint Ref", + "type": "string" + }, + "terminal_reason": { + "const": "timed_out", + "title": "Terminal Reason", + "type": "string" + } + }, + "required": [ + "terminal_reason", + "temporal_constraint_ref", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTimeoutCondition", + "type": "object" + }, + "ParticipantEpisodeTruncationCondition": { + "additionalProperties": false, + "description": "Evidenced assertions that end the episode as truncated.", + "properties": { + "assertion_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Assertion Refs", + "type": "array", + "uniqueItems": true + }, + "evidence_requirement_refs": { + "items": { + "minLength": 1, + "pattern": "\\S", + "type": "string" + }, + "minItems": 1, + "title": "Evidence Requirement Refs", + "type": "array", + "uniqueItems": true + } + }, + "required": [ + "assertion_refs", + "evidence_requirement_refs" + ], + "title": "ParticipantEpisodeTruncationCondition", + "type": "object" + }, + "ParticipantEpisodeTurnOrderBasis": { + "description": "Authority that orders a participant's turns.", + "enum": [ + "decision-epoch" + ], + "title": "ParticipantEpisodeTurnOrderBasis", + "type": "string" + }, "ParticipantEvaluationAuthority": { "additionalProperties": false, "description": "Explicit evaluator-plane authority kept separate from participant actions.", diff --git a/docs/explain/sdl/lineage.md b/docs/explain/sdl/lineage.md index 7f519dfd7..0a347ca94 100644 --- a/docs/explain/sdl/lineage.md +++ b/docs/explain/sdl/lineage.md @@ -965,6 +965,38 @@ which dynamic queue/log/config details remain evidence or bounded settings. Because it only binds already governed carriers and does not change their normative derivation or compatibility claims, the SDL lineage ledger and source audit remain unchanged. +- DSL-120 composes the incumbent `episodes` concept-family lineage, the + Gymnasium and OpenAI Gym episode notion recorded in + `specs/concept-authority/reference-models.md`, with the existing + proposition/assertion, shared-time, action-contract, and evidence lineages. + The exact RAES mapping is `ParticipantBehaviorSpecification.episode_policy`: + a versioned record of initialization assertions, decision-epoch turn + structure, completion and timeout terminal conditions, truncation + conditions, and a reset policy with admitted control actions, an ADR-095 + participant-memory scope, and, for an episode-local reset, its reset + authority. Each participant has at most one such policy, and each condition + maps to exactly one ADR-013 terminal reason and names the evidence + requirements that back the transition. Termination and truncation stay + distinct, as the lineage separates an end reached by the task's own dynamics + from an imposed early stop; interruption is never authored. The record + rejects realized episode coordinates, which remain on the ADR-013 + participant episode contracts. +- DSL-120 delivery evidence is the governed SDL schemas and publication + entries, the valid/invalid participant episode policy fixtures, and + `implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py`. + This delivers authoring, composition, semantic and post-instantiation + validation, deterministic compilation to `participant.episode-policy.`, + and schema compatibility. It does not claim episode execution, condition + evaluation, reset handling, evidence capture, backend realization, or + Gymnasium API compatibility. Because it only binds already governed carriers + and does not change their normative derivation or compatibility claims, the + SDL lineage ledger and source audit remain unchanged. +- ACT-623 makes that policy a first-class member of the behavior specification + aggregate for every participant kind and checks recorded ADR-013 episode + history against it in `raes_conformance`. Its evidence is the standalone and + autonomous-profile fixtures and + `implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py`. + It introduces no external derivation, so the ledger remains unchanged. - DSL-437 composes the incumbent participant and time lineages rather than introducing a live-activity ontology. CybORG and the Gymnasium, PettingZoo, and OpenSpiel family remain precedents for agents, actions, observations, diff --git a/docs/explain/sdl/sections.md b/docs/explain/sdl/sections.md index 67b60941b..3132421d8 100644 --- a/docs/explain/sdl/sections.md +++ b/docs/explain/sdl/sections.md @@ -2195,6 +2195,99 @@ or `environment` commands into participant metadata. Runtime delivery, receipts, persistence, backend realization, and proof of observation remain downstream contracts. +`episode_policy` is an optional, closed record of participant episode intent +(DSL-120). It names existing assertions, action contracts, temporal +constraints, and evidence requirements, and, for an episode-local reset, a +declared reset authority. It never carries a new expression, counter, or +backend callback. + +```yaml +episode_policy: + profile: participant-episode-policy/v1 + initialization: + assertion_refs: [console-ready] + interaction_structure: + order_basis: decision-epoch + action_contract_refs: [triage-alert] + terminal_conditions: + ticket-closed: + terminal_reason: completed + assertion_refs: [ticket-closed] + evidence_requirement_refs: [ticket-evidence] + shift-ended: + terminal_reason: timed_out + temporal_constraint_ref: shift-deadline + evidence_requirement_refs: [shift-clock-evidence] + truncation_conditions: + queue-stalled: + assertion_refs: [queue-stalled] + evidence_requirement_refs: [queue-evidence] + reset_policy: + control_actions: [reset, restart] + participant_memory_scope: persistent_across_episodes + evidence_requirement_refs: [reset-evidence] +``` + +Initialization assertions must be preconditions. Completion and truncation +assertions must be invariants or postconditions. A turn's action contracts must +belong to the owning specification and to every participant it selects. A +timeout must name a deadline, window, or duration constraint that binds the +specification or every participant it selects. Each condition maps to exactly +one terminal reason: `completed`, `timed_out`, or `truncated`. `interrupted` +stays an external stop and cannot be authored. Condition keys are local +identifiers that module composition preserves while it rewrites the external +refs. A participant may be governed by one episode policy at most. A second +policy that selects the same participant, by name or by role, is rejected. + +A condition holds only when every assertion it names holds. To end the episode +when any one of several assertions holds, declare one condition per assertion. +A truncation condition cannot reuse the exact assertion set of a completion +condition. The evidence requirements a condition names together back its +transition; validation checks that each one is declared, not which record it +captures. + +The example declares `persistent_across_episodes`, so it names no reset +authority. An `episode_local_reset` scope must add a +`memory_reset_authority_ref` that names the authority resetting the +participant implementation and its participant-visible memory. ADR-095's +assurance and information-state contracts require the same pairing; the policy +does not supply their values. The reference must resolve to exactly one +declared targetable element, for example `agents.analyst` or +`nodes.siem.services.console`. A dangling or ambiguous reference is rejected, +module composition namespaces it, and compilation records the element's +canonical address, such as `sdl.agents.analyst`. + +The policy is intent, not an execution record. Fields such as `episode_id`, +`status`, `initialized_at`, or `decision_epoch` are rejected with a diagnostic +that points to the ADR-013 participant episode contracts. So is a +`terminal_reason` anywhere except a terminal condition; on a truncation +condition the diagnostic says that truncation already fixes the reason. +Compilation emits +`participant.episode-policy.` with the resolved assertion, action, +time, evidence, and reset-authority addresses. It keys the policy to the +selected participants' `participant.behavior.` addresses, which also +key realized episode state. The full fixture at +`contracts/fixtures/sdl/participant-episode-policy-v1/valid/analyst-shift-episode.yaml` +shows the complete document. Episode execution, condition evaluation, reset +handling, and evidence capture remain runtime surfaces; this surface claims no +executable or runtime adoption. + +The episode policy is a first-class member of the behavior specification, not +an option of one participant kind. It works the same way for autonomous, +scripted, replayed, policy-directed, human-supervised, human-control-proxy, and +mixed-control participants, and a specification may declare only an episode +policy. The fixture +`contracts/fixtures/sdl/participant-episode-policy-v1/valid/standalone-episode-structure.yaml` +shows such a specification. The autonomous execution profile rejects an +episode policy, so the behavior specification stays its only home. + +`participant_episode_structure_conformance_diagnostics()` in +`raes_conformance.conformance` checks recorded episode history against the +compiled policies. It reports a terminal reason that no authored condition +produces, other than `interrupted`, and a reset or restart that the reset +policy does not admit. For a policy without a `reset_policy`, it admits any +reset or restart. It reads history only and does not evaluate conditions. + For `behavior_mode: mixed-control`, authors must also provide a closed `mixed_control` declaration. It binds one controlled participant, explicit controller states, fail-closed disposition rules, and ordered control facts. diff --git a/docs/public/participant-control.md b/docs/public/participant-control.md index 1405f4ee3..c5883f220 100644 --- a/docs/public/participant-control.md +++ b/docs/public/participant-control.md @@ -135,16 +135,21 @@ observation boundary. Reuse the action, control, or inject carrier. to the delivery compiles to that delivery's `participant.*` address; it constrains the authored occurrence and does not prove dispatch, delivery, or observation. +- Use an `episode_policy` on the behavior specification to declare how a + participant's episodes start, take turns, end, and reset. Each end condition + names one terminal reason and its evidence. The policy declares intent only. + It does not start, reset, or end an episode. - Do not infer a participant addressee from an environment inject. Do not put policy text, hidden answers, credentials, or raw evidence in a participant carrier. The -[mixed-control fixture](https://github.com/OpenRAE/rae/blob/main/contracts/fixtures/sdl/mixed-control-v1/valid/mixed-control-participant.yaml) +[mixed-control fixture](https://github.com/OpenRAE/rae/blob/main/contracts/fixtures/sdl/mixed-control-v1/valid/mixed-control-participant.yaml), +[participant-directed inject fixture](https://github.com/OpenRAE/rae/blob/main/contracts/fixtures/sdl/participant-inject-delivery-v1/valid/participant-directed.yaml), and -[participant-directed inject fixture](https://github.com/OpenRAE/rae/blob/main/contracts/fixtures/sdl/participant-inject-delivery-v1/valid/participant-directed.yaml) +[episode policy fixture](https://github.com/OpenRAE/rae/blob/main/contracts/fixtures/sdl/participant-episode-policy-v1/valid/analyst-shift-episode.yaml) show the governed authoring shapes. They show SDL checks. They do not show -runtime delivery. +runtime delivery or episode execution. ### Participant-implementation author diff --git a/docs/requirements/ACT-623/requirement.md b/docs/requirements/ACT-623/requirement.md index b3c71087b..4ebb34c39 100644 --- a/docs/requirements/ACT-623/requirement.md +++ b/docs/requirements/ACT-623/requirement.md @@ -21,3 +21,18 @@ Primary-source refresh shows that participant behavior is often organized as bou ## Traceability - DOCUMENTS → SPEC `specs/formal/participant-episode-model/README.md` (Participant episode + budget model formal design (issue #122)) +- IMPLEMENTS → GITHUB_ISSUE `309` (ACT-623 — Participant Episode Structure) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/participant_behavior_specification.py` (ACT-623 episode policy as a behavior specification aggregate member) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/participant_episode_policy.py` (DSL-120 authored episode structure that the ACT-623 member aggregates) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_processor/models/behavior_resources.py` (ACT-623 compiled aggregate episode_policy_address) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_processor/compiler/participant_behaviors.py` (ACT-623 compiled aggregate episode_policy_address) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_conformance/conformance/participant_episode_structure.py` (ACT-623 recorded episode history conformance against the compiled structure) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_conformance/conformance/diagnostics.py` (ACT-623 episode-structure conformance diagnostic code) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_conformance/conformance/__init__.py` (ACT-623 episode-structure conformance facade export) +- IMPLEMENTS → SPEC `specs/sdl/sections.md` (ACT-623 first-class episode structure and conformance contract) +- DOCUMENTS → DOCUMENTATION `docs/explain/sdl/sections.md` (ACT-623 first-class episode structure guide) +- TESTS → TEST `implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py` (ACT-623 cross-kind attachment, aggregate membership, conformance refusal of a participant governed by two compiled policies, and recorded-history conformance tests) +- TESTS → TEST `implementations/python/tests/test_conformance_facade_parity.py` (ACT-623 conformance facade export parity) +- TESTS → TEST `implementations/python/tests/test_specification_coverage.py` (ACT-623 specification-coverage release pinned to the current source state) +- TESTS → TEST `implementations/python/tests/test_formal_semantic_validation.py` (ACT-623 formal-validation release pinned to the current source state) +- TESTS → TEST `implementations/python/tests/test_issue_989_versioned_evidence.py` (ACT-623 evidence releases pinned to the current source state) diff --git a/docs/requirements/DSL-120/requirement.md b/docs/requirements/DSL-120/requirement.md index 78d25f92f..3f2230e82 100644 --- a/docs/requirements/DSL-120/requirement.md +++ b/docs/requirements/DSL-120/requirement.md @@ -21,3 +21,16 @@ Primary-source refresh shows that participant-supporting ecosystems frequently t ## Traceability - DOCUMENTS → SPEC `specs/formal/participant-episode-model/README.md` (Participant episode + budget model formal design (issue #122)) +- IMPLEMENTS → GITHUB_ISSUE `307` (DSL-120 — Participant Episode Structure And Termination Surface) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/participant_episode_policy.py` (DSL-120 authored participant episode policy model; rejects realized episode state) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/participant_behavior_specification.py` (DSL-120 behavior specification episode_policy member) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/validator/_participant_episode_policies.py` (DSL-120 fail-closed episode policy reference and role validation) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes/composition/_behavior.py` (DSL-120 module-composition episode policy reference rewriting) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_processor/compiler/participant_episode_policies.py` (DSL-120 participant.episode-policy compiled records) +- IMPLEMENTS → CODE_FILE `implementations/python/packages/raes_processor/models/participant_episode_resources.py` (DSL-120 compiled episode policy and condition records) +- IMPLEMENTS → SPEC `specs/sdl/sections.md` (DSL-120 normative participant episode structure contract) +- IMPLEMENTS → SPEC `specs/sdl/references.md` (DSL-120 episode policy reference semantics) +- IMPLEMENTS → SPEC `contracts/schemas/sdl/sdl-authoring-input-v1.json` (DSL-120 governed authoring schema) +- IMPLEMENTS → SPEC `contracts/schemas/sdl/instantiated-scenario-v1.json` (DSL-120 governed instantiated scenario schema) +- DOCUMENTS → DOCUMENTATION `docs/explain/sdl/sections.md` (DSL-120 episode policy authoring guide) +- TESTS → TEST `implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py` (DSL-120 authoring, validation, composition, compilation, and schema tests; no episode execution) diff --git a/docs/research/formal-semantic-validation/analysis-v70.json b/docs/research/formal-semantic-validation/analysis-v70.json new file mode 100644 index 000000000..7775f3ee3 --- /dev/null +++ b/docs/research/formal-semantic-validation/analysis-v70.json @@ -0,0 +1,163 @@ +{ + "analysis_id": "issue-307-analysis-v70", + "claim": { + "allowed_evidence": [ + "production parser and semantic-validator results", + "canonical compiled digests", + "participant contract regression tests", + "pinned protocol, corpus, and execution snapshot" + ], + "claim_id": "asr-530-formal-semantic-validation-retest", + "disallowed_evidence": [ + "schema success as semantic proof", + "workflow reachability as network or exploit reachability", + "FM labels as gate outcomes", + "attribution as counterfactual proof", + "formal prose or maintainer confidence alone" + ], + "evidence_artifacts": [ + "docs/research/formal-semantic-validation/protocol-v2.json", + "docs/research/formal-semantic-validation/corpus/manifest-v4.json", + "docs/research/formal-semantic-validation/execution-snapshot-v70.json", + "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json" + ], + "falsification_protocol": "Replay every retained and new case through its production entrypoint, require complete digest and evidence joins, execute participant fixtures, and derive status from the recorded outcomes.", + "objective_fail_criteria": "A supported negative passes, a positive fails, an observation drifts, a required participant case is missing, or weaker evidence is promoted to solver, exploit-path, runtime-stability, or counterfactual assurance.", + "objective_pass_criteria": "Every claim class has positive and negative cases, all supported cases reproduce the frozen outcome, every participant obligation has passing positive and negative fixtures, and unsupported classes remain untested.", + "statement": "At the recorded source-state digest, the retained RAES controls have the bounded statuses recorded here; historical releases are integrity evidence, not current replay evidence.", + "threats_to_validity": [ + "The issue-specific corpus is intentionally small and does not enumerate every validator invariant.", + "The participant fixtures exercise reference production contracts and tests, not every independent backend realization.", + "The replay gate runs on one Python reference configuration and one pinned RAES revision.", + "Unsupported solver-level classes have protocol cases but no executable observations." + ] + }, + "claim_results": [ + { + "case_count": 2, + "claim_class_id": "schema-validity", + "evidence_status": "demonstrated", + "limitations": [ + "Bounded to the named source/model structural controls." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 4, + "claim_class_id": "semantic-consistency", + "evidence_status": "partial", + "limitations": [ + "Partial coverage of named static semantics and participant obligations, not universal consistency." + ], + "matching_case_count": 4, + "participant_obligation_count": 7, + "replayable_case_count": 4, + "unsupported_case_count": 0 + }, + { + "case_count": 2, + "claim_class_id": "graph-reachability", + "evidence_status": "partial", + "limitations": [ + "Partial workflow control-flow reachability only; not network, service, or exploit reachability." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 4, + "claim_class_id": "constraint-satisfiability", + "evidence_status": "demonstrated", + "limitations": [ + "Demonstrated only for raes-finite-domain-satisfiability-v1 and its pinned solver configuration." + ], + "matching_case_count": 4, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 2 + }, + { + "case_count": 4, + "claim_class_id": "exploit-path-validity", + "evidence_status": "demonstrated", + "limitations": [ + "Demonstrated only for the admitted snapshot, typed graph, query, semantics, and bounded search profile." + ], + "matching_case_count": 4, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 2 + }, + { + "case_count": 2, + "claim_class_id": "determinism-stability", + "evidence_status": "partial", + "limitations": [ + "Partial parse-to-compile repeatability only; runtime and backend determinism are untested." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 2, + "claim_class_id": "counterfactual-necessity", + "evidence_status": "untested", + "limitations": [ + "Untested because no governed intervention or ablation entrypoint ran." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 0, + "unsupported_case_count": 2 + } + ], + "corpus_revision": "4.0.0", + "evidence_status": "partial", + "execution_id": "issue-307-execution-v70", + "generated_at": "2026-10-10T14:13:23.809480+00:00", + "limitations": [ + "Satisfiability is limited to raes-finite-domain-satisfiability-v1 and its exact translation, theory, and Z3 configuration.", + "The subset-minimal unsatisfiable core is not a universal proof certificate.", + "Exploit-path results are limited to the admitted snapshot, normalized graph, query, transition semantics, and bounded search profile.", + "A valid path is not backend execution and an invalid path is not real-world non-exploitability.", + "The production exploit-path JSON loader permits duplicate keys; the research loader rejects them without claiming stronger production behavior.", + "Participant replay inherits the host environment and is not described as hermetic.", + "Counterfactual necessity remains untested.", + "Scoped observation demand is not a claim class in this preregistration and is not promoted to demonstrated by this retest.", + "EXP-732 provenance joins are verified by their dedicated regression suite; this retained corpus makes no universal run, apparatus, source, or augmentation assurance claim.", + "This retained corpus does not establish native backend attestation fidelity; materialization contract checks remain separate operational provenance, not experimental observations.", + "Capture admission and evidence-proof authority are verified by issue-1237 regression tests, not promoted to a new claim class by this retained corpus.", + "Evidence-requirement refinement lineage is outside this retained formal claim set; this retest refreshes integrated source provenance without promoting that feature to a formal claim.", + "Authoring-adapter transport behavior is outside this retained formal claim set.", + "Operational recovery observation and startup reconciliation are verified by their API-404 regression suite, not promoted to a new formal claim class by this retained corpus.", + "Single-owner store admission, immutable target/run scope, and provider shutdown ordering are verified by their API-404 CP-5 regression suite, not promoted to a formal claim by this retained corpus.", + "Mixed and staged trial admission is verified by its SEM-234/SCE-002/API-407 regression suite, not promoted to a new formal claim class by this retained corpus.", + "Offline control-plane maintenance, readiness, and bounded audit behavior are verified by issue #1186 runtime tests, not promoted to a formal claim by this retained corpus.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 profile declarations and capability admission are covered by dedicated runtime tests; the retained formal corpus does not execute control-plane profile composition.", + "Issue #1016 mixed-runtime coordination is covered by dedicated runtime tests; the retained formal corpus does not establish backend-native mixed realization, multi-controller coordination, IFC, or equivalence.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Issue #1389 temporal-subject admission is verified by dedicated compiler tests and adds no new formal-semantic claim to this retained corpus.", + "Issue #971 model construction is verified by its own tests; this retained corpus establishes no participant-crossing equivalence or runtime-realization claim.", + "Issue #1359 control-plane route authority, participant-view scoping, and no-store HTTP boundary are verified by their dedicated HTTP-boundary suite and add no new formal-semantic claim to this retained corpus.", + "Issue #1401 required-evidence media-type coherence is verified by its dedicated suite and adds no new formal-semantic claim to this retained corpus.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "Issue #307 authored participant episode policies are covered by their dedicated SDL authoring, validation, composition and compilation tests; this retained matrix makes no new episode execution, reset or termination claim." + ], + "plain_language_outcome": "The retained formal cases reproduce their prior outcomes after issue #307 added optional authored participant episode policies to behavior specifications. The bounded claims and unsupported classes are unchanged.", + "protocol_revision": "2.0.0" +} diff --git a/docs/research/formal-semantic-validation/analysis-v71.json b/docs/research/formal-semantic-validation/analysis-v71.json new file mode 100644 index 000000000..4ca8c6b30 --- /dev/null +++ b/docs/research/formal-semantic-validation/analysis-v71.json @@ -0,0 +1,164 @@ +{ + "analysis_id": "issue-309-analysis-v71", + "claim": { + "allowed_evidence": [ + "production parser and semantic-validator results", + "canonical compiled digests", + "participant contract regression tests", + "pinned protocol, corpus, and execution snapshot" + ], + "claim_id": "asr-530-formal-semantic-validation-retest", + "disallowed_evidence": [ + "schema success as semantic proof", + "workflow reachability as network or exploit reachability", + "FM labels as gate outcomes", + "attribution as counterfactual proof", + "formal prose or maintainer confidence alone" + ], + "evidence_artifacts": [ + "docs/research/formal-semantic-validation/protocol-v2.json", + "docs/research/formal-semantic-validation/corpus/manifest-v4.json", + "docs/research/formal-semantic-validation/execution-snapshot-v71.json", + "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json" + ], + "falsification_protocol": "Replay every retained and new case through its production entrypoint, require complete digest and evidence joins, execute participant fixtures, and derive status from the recorded outcomes.", + "objective_fail_criteria": "A supported negative passes, a positive fails, an observation drifts, a required participant case is missing, or weaker evidence is promoted to solver, exploit-path, runtime-stability, or counterfactual assurance.", + "objective_pass_criteria": "Every claim class has positive and negative cases, all supported cases reproduce the frozen outcome, every participant obligation has passing positive and negative fixtures, and unsupported classes remain untested.", + "statement": "At the recorded source-state digest, the retained RAES controls have the bounded statuses recorded here; historical releases are integrity evidence, not current replay evidence.", + "threats_to_validity": [ + "The issue-specific corpus is intentionally small and does not enumerate every validator invariant.", + "The participant fixtures exercise reference production contracts and tests, not every independent backend realization.", + "The replay gate runs on one Python reference configuration and one pinned RAES revision.", + "Unsupported solver-level classes have protocol cases but no executable observations." + ] + }, + "claim_results": [ + { + "case_count": 2, + "claim_class_id": "schema-validity", + "evidence_status": "demonstrated", + "limitations": [ + "Bounded to the named source/model structural controls." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 4, + "claim_class_id": "semantic-consistency", + "evidence_status": "partial", + "limitations": [ + "Partial coverage of named static semantics and participant obligations, not universal consistency." + ], + "matching_case_count": 4, + "participant_obligation_count": 7, + "replayable_case_count": 4, + "unsupported_case_count": 0 + }, + { + "case_count": 2, + "claim_class_id": "graph-reachability", + "evidence_status": "partial", + "limitations": [ + "Partial workflow control-flow reachability only; not network, service, or exploit reachability." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 4, + "claim_class_id": "constraint-satisfiability", + "evidence_status": "demonstrated", + "limitations": [ + "Demonstrated only for raes-finite-domain-satisfiability-v1 and its pinned solver configuration." + ], + "matching_case_count": 4, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 2 + }, + { + "case_count": 4, + "claim_class_id": "exploit-path-validity", + "evidence_status": "demonstrated", + "limitations": [ + "Demonstrated only for the admitted snapshot, typed graph, query, semantics, and bounded search profile." + ], + "matching_case_count": 4, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 2 + }, + { + "case_count": 2, + "claim_class_id": "determinism-stability", + "evidence_status": "partial", + "limitations": [ + "Partial parse-to-compile repeatability only; runtime and backend determinism are untested." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 2, + "unsupported_case_count": 0 + }, + { + "case_count": 2, + "claim_class_id": "counterfactual-necessity", + "evidence_status": "untested", + "limitations": [ + "Untested because no governed intervention or ablation entrypoint ran." + ], + "matching_case_count": 2, + "participant_obligation_count": 0, + "replayable_case_count": 0, + "unsupported_case_count": 2 + } + ], + "corpus_revision": "4.0.0", + "evidence_status": "partial", + "execution_id": "issue-309-execution-v71", + "generated_at": "2026-10-10T15:14:16.484268+00:00", + "limitations": [ + "Satisfiability is limited to raes-finite-domain-satisfiability-v1 and its exact translation, theory, and Z3 configuration.", + "The subset-minimal unsatisfiable core is not a universal proof certificate.", + "Exploit-path results are limited to the admitted snapshot, normalized graph, query, transition semantics, and bounded search profile.", + "A valid path is not backend execution and an invalid path is not real-world non-exploitability.", + "The production exploit-path JSON loader permits duplicate keys; the research loader rejects them without claiming stronger production behavior.", + "Participant replay inherits the host environment and is not described as hermetic.", + "Counterfactual necessity remains untested.", + "Scoped observation demand is not a claim class in this preregistration and is not promoted to demonstrated by this retest.", + "EXP-732 provenance joins are verified by their dedicated regression suite; this retained corpus makes no universal run, apparatus, source, or augmentation assurance claim.", + "This retained corpus does not establish native backend attestation fidelity; materialization contract checks remain separate operational provenance, not experimental observations.", + "Capture admission and evidence-proof authority are verified by issue-1237 regression tests, not promoted to a new claim class by this retained corpus.", + "Evidence-requirement refinement lineage is outside this retained formal claim set; this retest refreshes integrated source provenance without promoting that feature to a formal claim.", + "Authoring-adapter transport behavior is outside this retained formal claim set.", + "Operational recovery observation and startup reconciliation are verified by their API-404 regression suite, not promoted to a new formal claim class by this retained corpus.", + "Single-owner store admission, immutable target/run scope, and provider shutdown ordering are verified by their API-404 CP-5 regression suite, not promoted to a formal claim by this retained corpus.", + "Mixed and staged trial admission is verified by its SEM-234/SCE-002/API-407 regression suite, not promoted to a new formal claim class by this retained corpus.", + "Offline control-plane maintenance, readiness, and bounded audit behavior are verified by issue #1186 runtime tests, not promoted to a formal claim by this retained corpus.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 profile declarations and capability admission are covered by dedicated runtime tests; the retained formal corpus does not execute control-plane profile composition.", + "Issue #1016 mixed-runtime coordination is covered by dedicated runtime tests; the retained formal corpus does not establish backend-native mixed realization, multi-controller coordination, IFC, or equivalence.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Issue #1389 temporal-subject admission is verified by dedicated compiler tests and adds no new formal-semantic claim to this retained corpus.", + "Issue #971 model construction is verified by its own tests; this retained corpus establishes no participant-crossing equivalence or runtime-realization claim.", + "Issue #1359 control-plane route authority, participant-view scoping, and no-store HTTP boundary are verified by their dedicated HTTP-boundary suite and add no new formal-semantic claim to this retained corpus.", + "Issue #1401 required-evidence media-type coherence is verified by its dedicated suite and adds no new formal-semantic claim to this retained corpus.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "Issue #307 authored participant episode policies are covered by their dedicated SDL authoring, validation, composition and compilation tests; this retained matrix makes no new episode execution, reset or termination claim.", + "Issue #309 first-class participant episode structure and its recorded-history conformance check are covered by their dedicated aggregate, validation and conformance tests; this retained matrix makes no new episode execution, reset or termination claim." + ], + "plain_language_outcome": "The retained formal cases reproduce their prior outcomes after issue #309 made participant episode structure a first-class member of the behavior specification aggregate. The bounded claims and unsupported classes are unchanged.", + "protocol_revision": "2.0.0" +} diff --git a/docs/research/formal-semantic-validation/bundles/retest-v70.json b/docs/research/formal-semantic-validation/bundles/retest-v70.json new file mode 100644 index 000000000..3752e896f --- /dev/null +++ b/docs/research/formal-semantic-validation/bundles/retest-v70.json @@ -0,0 +1,122 @@ +{ + "analysis_path": "docs/research/formal-semantic-validation/analysis-v70.json", + "analysis_sha256": "ec5a90f0c1e02526b288bf5847c672da4982d15933f717c0c2866ddb316bd04b", + "artifacts": [ + { + "artifact_id": "finite-domain-satisfiable-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "sha256": "0ca9eaba9dc47171f7a042dc6753faa6c820c65ee966538f9d65fac5342202e8" + }, + { + "artifact_id": "finite-domain-satisfiable-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "sha256": "554202313d678046958b5c028e2de26ff03c74895cfac552677eed74e8153add" + }, + { + "artifact_id": "finite-domain-unsatisfiable-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "sha256": "cfef56a1f56d5f0db9da195377fd75694bdd0f0b92932fdb8fafcbd3f7baf6c5" + }, + { + "artifact_id": "finite-domain-unsatisfiable-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "sha256": "c972725ef64822a75a60380afc11f08eac25b7fe9b091d39b058b3c9f7c8031d" + }, + { + "artifact_id": "typed-exploit-path-valid-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "sha256": "0afe635a63db5b6e6380ac70982fd61d09790745d51a10d670321304121e7c39" + }, + { + "artifact_id": "typed-exploit-path-valid-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "sha256": "1b7f55d04db172da32658187c64a88c13b5f4d565267ce2be7cb86a9d04cb70c" + }, + { + "artifact_id": "typed-exploit-path-invalid-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "sha256": "0b2293d4a8983515ff05c516be6e6b418a4f3f09e055250a00bf15fda861aab3" + }, + { + "artifact_id": "typed-exploit-path-invalid-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "sha256": "244f895a64f14c10916ab0533ab462ce80a328021cd6a50c30a4aa59266d5533" + }, + { + "artifact_id": "schema-valid-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/schema-valid.sdl.yaml", + "sha256": "41a9adffdf9f5f2ccc2f887dcf7b15fba3b47c83a1af15f33db872c4a2449d67" + }, + { + "artifact_id": "schema-unknown-field-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/schema-invalid-unknown-field.sdl.yaml", + "sha256": "51cf62319a86c95a2517995939d1f370573051835e4b55bb6d5beaf049640481" + }, + { + "artifact_id": "semantic-resolved-objective-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-valid-participant-identity-v2.sdl.yaml", + "sha256": "75834bdc883e2003e1c473870bdf75700978955bb83095c6bd718ba6bd3908a6" + }, + { + "artifact_id": "semantic-dangling-assertion-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-dangling-ref-participant-identity-v2.sdl.yaml", + "sha256": "1d25bee5f556054e5f0a518df025e4c62e080e1964035e3c1a12e074d88d3a5d" + }, + { + "artifact_id": "semantic-ambiguous-reference-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-ambiguous-ref.sdl.yaml", + "sha256": "653cbd2fd62e220d49fb86f80133884207df5ae6752846345ae3085b93f6e4ed" + }, + { + "artifact_id": "semantic-feature-cycle-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-feature-cycle.sdl.yaml", + "sha256": "e1f66d95a9ad039687aec8cccbc8843b514072ff08e006c1b4ca6aa5cd8d4ed1" + }, + { + "artifact_id": "workflow-reachable-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/workflow-reachable.sdl.yaml", + "sha256": "54c40ceb98ad47247447d737973b2c55e8fb2045e209c7545c4fb20cf42dc3dc" + }, + { + "artifact_id": "workflow-unreachable-step-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/workflow-unreachable.sdl.yaml", + "sha256": "ef22ef2e260f1a7fd92d286f9b571716436b192ddfd54aea7bdfcfdda4ca52a2" + }, + { + "artifact_id": "compile-repeatability-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml", + "sha256": "0bc40900d598c1af7a405d798ca19710405e53ced262d8733081abf12edf89fe" + }, + { + "artifact_id": "compile-non-vacuity-control-comparison-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/determinism-b.sdl.yaml", + "sha256": "d85338f89f20a45515b12da8640173c1a52e47eb17ca0f4f6b4f8f3306e863a1" + } + ], + "bundle_id": "raes-formal-semantic-validation", + "corpus_path": "docs/research/formal-semantic-validation/corpus/manifest-v4.json", + "corpus_sha256": "c57207af72406aa4f70882b9bbeb7cedcc79cf3854c878a95e3eb1fa59ea7a72", + "protocol_path": "docs/research/formal-semantic-validation/protocol-v2.json", + "protocol_sha256": "abf94093e344bf495dfb04e8b0c5985c0beaab8ebb17a75e15c8674fa81b1a7c", + "revision": "70.0.0", + "snapshot_path": "docs/research/formal-semantic-validation/execution-snapshot-v70.json", + "snapshot_sha256": "0a5ec8b20b8e6287deb9ce6f72a2a052eef1815a09dc2afe26cc2bb66db71b4d" +} diff --git a/docs/research/formal-semantic-validation/bundles/retest-v71.json b/docs/research/formal-semantic-validation/bundles/retest-v71.json new file mode 100644 index 000000000..1df08a3eb --- /dev/null +++ b/docs/research/formal-semantic-validation/bundles/retest-v71.json @@ -0,0 +1,122 @@ +{ + "analysis_path": "docs/research/formal-semantic-validation/analysis-v71.json", + "analysis_sha256": "b72390d3aef7706eac5f0cc32988c8c800c0b4c456ad753c4bb1fc6fcbd99590", + "artifacts": [ + { + "artifact_id": "finite-domain-satisfiable-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "sha256": "0ca9eaba9dc47171f7a042dc6753faa6c820c65ee966538f9d65fac5342202e8" + }, + { + "artifact_id": "finite-domain-satisfiable-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "sha256": "554202313d678046958b5c028e2de26ff03c74895cfac552677eed74e8153add" + }, + { + "artifact_id": "finite-domain-unsatisfiable-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "sha256": "cfef56a1f56d5f0db9da195377fd75694bdd0f0b92932fdb8fafcbd3f7baf6c5" + }, + { + "artifact_id": "finite-domain-unsatisfiable-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "sha256": "c972725ef64822a75a60380afc11f08eac25b7fe9b091d39b058b3c9f7c8031d" + }, + { + "artifact_id": "typed-exploit-path-valid-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "sha256": "0afe635a63db5b6e6380ac70982fd61d09790745d51a10d670321304121e7c39" + }, + { + "artifact_id": "typed-exploit-path-valid-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "sha256": "1b7f55d04db172da32658187c64a88c13b5f4d565267ce2be7cb86a9d04cb70c" + }, + { + "artifact_id": "typed-exploit-path-invalid-v2-input", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "sha256": "0b2293d4a8983515ff05c516be6e6b418a4f3f09e055250a00bf15fda861aab3" + }, + { + "artifact_id": "typed-exploit-path-invalid-v2-evidence", + "kind": "production-evidence", + "path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "sha256": "244f895a64f14c10916ab0533ab462ce80a328021cd6a50c30a4aa59266d5533" + }, + { + "artifact_id": "schema-valid-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/schema-valid.sdl.yaml", + "sha256": "41a9adffdf9f5f2ccc2f887dcf7b15fba3b47c83a1af15f33db872c4a2449d67" + }, + { + "artifact_id": "schema-unknown-field-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/schema-invalid-unknown-field.sdl.yaml", + "sha256": "51cf62319a86c95a2517995939d1f370573051835e4b55bb6d5beaf049640481" + }, + { + "artifact_id": "semantic-resolved-objective-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-valid-participant-identity-v2.sdl.yaml", + "sha256": "75834bdc883e2003e1c473870bdf75700978955bb83095c6bd718ba6bd3908a6" + }, + { + "artifact_id": "semantic-dangling-assertion-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-dangling-ref-participant-identity-v2.sdl.yaml", + "sha256": "1d25bee5f556054e5f0a518df025e4c62e080e1964035e3c1a12e074d88d3a5d" + }, + { + "artifact_id": "semantic-ambiguous-reference-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-ambiguous-ref.sdl.yaml", + "sha256": "653cbd2fd62e220d49fb86f80133884207df5ae6752846345ae3085b93f6e4ed" + }, + { + "artifact_id": "semantic-feature-cycle-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/semantic-invalid-feature-cycle.sdl.yaml", + "sha256": "e1f66d95a9ad039687aec8cccbc8843b514072ff08e006c1b4ca6aa5cd8d4ed1" + }, + { + "artifact_id": "workflow-reachable-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/workflow-reachable.sdl.yaml", + "sha256": "54c40ceb98ad47247447d737973b2c55e8fb2045e209c7545c4fb20cf42dc3dc" + }, + { + "artifact_id": "workflow-unreachable-step-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/workflow-unreachable.sdl.yaml", + "sha256": "ef22ef2e260f1a7fd92d286f9b571716436b192ddfd54aea7bdfcfdda4ca52a2" + }, + { + "artifact_id": "compile-repeatability-control-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml", + "sha256": "0bc40900d598c1af7a405d798ca19710405e53ced262d8733081abf12edf89fe" + }, + { + "artifact_id": "compile-non-vacuity-control-comparison-fixture", + "kind": "corpus-input", + "path": "docs/research/formal-semantic-validation/corpus/determinism-b.sdl.yaml", + "sha256": "d85338f89f20a45515b12da8640173c1a52e47eb17ca0f4f6b4f8f3306e863a1" + } + ], + "bundle_id": "raes-formal-semantic-validation", + "corpus_path": "docs/research/formal-semantic-validation/corpus/manifest-v4.json", + "corpus_sha256": "c57207af72406aa4f70882b9bbeb7cedcc79cf3854c878a95e3eb1fa59ea7a72", + "protocol_path": "docs/research/formal-semantic-validation/protocol-v2.json", + "protocol_sha256": "abf94093e344bf495dfb04e8b0c5985c0beaab8ebb17a75e15c8674fa81b1a7c", + "revision": "71.0.0", + "snapshot_path": "docs/research/formal-semantic-validation/execution-snapshot-v71.json", + "snapshot_sha256": "230fb20e8a3317207e65f4c33adef29913f0976f98468c42a7607a7522344b28" +} diff --git a/docs/research/formal-semantic-validation/execution-snapshot-v70.json b/docs/research/formal-semantic-validation/execution-snapshot-v70.json new file mode 100644 index 000000000..75e20979c --- /dev/null +++ b/docs/research/formal-semantic-validation/execution-snapshot-v70.json @@ -0,0 +1,691 @@ +{ + "baseline": { + "execution_id": "issue-1361-merged-execution-v69", + "release_path": "docs/research/formal-semantic-validation/bundles/retest-v69.json", + "release_revision": "69.0.0", + "release_sha256": "c9db66ba3abc167274b7c555d3a8ccc189155bc9e70647c144c81f0c18d99e6f" + }, + "captured_at": "2026-10-10T14:13:23.809480+00:00", + "commands": [ + { + "argv": [ + "implementations/python/.venv/bin/python", + "tools/check_formal_semantic_validation.py" + ], + "command_id": "bundle-replay", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/pytest", + "-q", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_disclosure_is_separate_from_observable_projection", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_cannot_be_observed_without_explicit_disclosure_rule", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_contract_declares_sem_211_classes_and_compiles_them", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_result_rejects_success_when_preconditions_are_unresolved", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_runtime_snapshot_publishes_joint_action_and_time_context_records", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_joint_action_record_contract_rejects_unordered_conflicting_writes", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_accepts_supported_order_claim_strengths", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_rejects_wall_clock_causality", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_attribution_edge_round_trips_on_terminal_observation", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_timestamp_adjacency_cannot_be_reported_as_strong_causality", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_outcome_interpretation_rule_parses_and_compiles_explicit_layers", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_local_action_success_does_not_imply_objective_success_without_rule_record", + "implementations/python/tests/test_realization_honesty_conformance.py::test_constructive_envelope_runs_positive_and_negative_honesty_probes", + "implementations/python/tests/test_realization_honesty_conformance.py::test_only_native_live_can_support_native_conformance" + ], + "command_id": "participant-fixtures", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "satisfiability", + "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "--profile", + "raes-finite-domain-satisfiability-v1" + ], + "command_id": "finite-domain-satisfiable-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "satisfiability", + "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "--profile", + "raes-finite-domain-satisfiability-v1" + ], + "command_id": "finite-domain-unsatisfiable-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "exploit-path", + "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "--profile", + "raes-exploit-path-analysis-v1" + ], + "command_id": "typed-exploit-path-valid-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "exploit-path", + "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "--profile", + "raes-exploit-path-analysis-v1" + ], + "command_id": "typed-exploit-path-invalid-v2", + "network": "disabled" + } + ], + "configuration_id": "raes-python-reference-offline-v41", + "corpus_revision": "4.0.0", + "deviations": [ + { + "baseline": { + "actual_outcome": "stable", + "diagnostic_kind": null, + "result_digest": "647a3e7436e9f5ec0529c206cb0f3eef46c4fcda8886227b55626372950ef177" + }, + "case_id": "compile-repeatability-control", + "category": "compiled-policy-metadata", + "changed_fields": [ + "result_digest" + ], + "disposition": "accepted", + "rationale": "Issue #307 adds the typed participant_episode_policies field to the compiled runtime model. These policy-free controls retain their outcomes; only canonical compiled digests change.", + "retest": { + "actual_outcome": "stable", + "diagnostic_kind": null, + "result_digest": "21e2e450d0780902e93d2a3e61d582b5067b5a19c3e8b7d59b4b72b6a61cc323" + } + }, + { + "baseline": { + "actual_outcome": "distinguishable", + "diagnostic_kind": null, + "result_digest": "59f1443f868b170ad0552706f4e76436bee678a0acd842e7e72473f2a5ef5635" + }, + "case_id": "compile-non-vacuity-control", + "category": "compiled-policy-metadata", + "changed_fields": [ + "result_digest" + ], + "disposition": "accepted", + "rationale": "Issue #307 adds the typed participant_episode_policies field to the compiled runtime model. These policy-free controls retain their outcomes; only canonical compiled digests change.", + "retest": { + "actual_outcome": "distinguishable", + "diagnostic_kind": null, + "result_digest": "55234feafeded8c132d055185bdcb2ce6b1cb47dbf0cbba82d7e5d121acc85ea" + } + } + ], + "execution_id": "issue-307-execution-v70", + "execution_status": "complete", + "observations": [ + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "schema-valid-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/schema-valid.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "A passing minimal source does not establish semantic correctness." + ], + "replayable": true, + "result_digest": "f7d364ef384df8a1526b489501835b635021c860793b5764f91d956710d2250c", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "schema-unknown-field", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLParseError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/schema-invalid-unknown-field.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The observation covers one unknown-field defect only." + ], + "replayable": true, + "result_digest": "f55d834b458f8e069e1c69061b4cc0a6d61e0e052bf90c670f2e6a5ad8b5bd98", + "source_digest": null + }, + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "semantic-resolved-objective", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-valid-participant-identity-v2.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "This is a positive control for one objective-reference slice." + ], + "replayable": true, + "result_digest": "652288785dc09095955ed3649f6407d616fb7c4d4f4188df4ed513ccb7537e0b", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-dangling-assertion", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-dangling-ref-participant-identity-v2.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "A single dangling reference does not prove complete semantic coverage." + ], + "replayable": true, + "result_digest": "0207cf616b56708ca9b8c4499d3301abe22dbe52162cf8d58d3bec429d9db024", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-ambiguous-reference", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-ambiguous-ref.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "One namespace collision does not enumerate every ambiguity surface." + ], + "replayable": true, + "result_digest": "9da4a87797d228e0012ab6b30459f4892e41aa6f224a9840be035fee4a2eea73", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-feature-cycle", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-feature-cycle.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "One static dependency cycle does not establish general constraint satisfiability." + ], + "replayable": true, + "result_digest": "d15dbcd99fb4f20b965d7031b07dd6534576302270399c3fa656d29e7de02b83", + "source_digest": null + }, + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "workflow-reachable-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/workflow-reachable.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The graph is workflow control flow only." + ], + "replayable": true, + "result_digest": "b1b49649b54bd59d4ef357b39cf9158da90f4eae560f8dd756acf97bd0827a06", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "workflow-unreachable-step", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/workflow-unreachable.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The result does not establish network, service, participant, or exploit reachability." + ], + "replayable": true, + "result_digest": "bb931d19346ef9193408ae6c85deb4079704378fc5f00dc5f47a2817cff21943", + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "whole-scenario-satisfiable-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "No governed whole-scenario constraint theory or solver exists." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "whole-scenario-unsatisfiable-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Local checks cannot produce a whole-scenario unsat certificate." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "valid-exploit-path-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The issue-168 baseline had no canonical typed attack graph or path-query entrypoint." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "invalid-exploit-path-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Vulnerability and topology declarations are not an invalid-path proof." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "stable", + "analysis_profile": null, + "case_id": "compile-repeatability-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The witness ends at compiled output." + ], + "replayable": true, + "result_digest": "21e2e450d0780902e93d2a3e61d582b5067b5a19c3e8b7d59b4b72b6a61cc323", + "source_digest": null + }, + { + "actual_outcome": "distinguishable", + "analysis_profile": null, + "case_id": "compile-non-vacuity-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml", + "docs/research/formal-semantic-validation/corpus/determinism-b.sdl.yaml" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Distinct digests are a non-vacuity control, not semantic non-equivalence proof." + ], + "replayable": true, + "result_digest": "55234feafeded8c132d055185bdcb2ce6b1cb47dbf0cbba82d7e5d121acc85ea", + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "necessity-witness-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "No governed intervention or ablation protocol exists." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "non-necessity-control-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Attribution and negative fixtures do not demonstrate non-necessity." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "satisfiable", + "analysis_profile": "raes-finite-domain-satisfiability-v1", + "case_id": "finite-domain-satisfiable-v2", + "configuration_digest": "sha256:1204635e17e759e9ad3bd6be2ecb28c6de05c07ead6dfdd15936ed5d3d5b81b2", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "scenario-satisfiability-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "evidence_artifact_sha256": "554202313d678046958b5c028e2de26ff03c74895cfac552677eed74e8153add", + "evidence_digest": "sha256:23c2cae7d95d4cc83d77ca576e3911477b169ecc311c977cb45490345f633b5a", + "evidence_profile": "scenario-satisfiability-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "specs/formal/scenario-satisfiability/README.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Demonstrates only the pinned finite-domain theory, translation, solver profile, and source." + ], + "replayable": true, + "result_digest": "sha256:23c2cae7d95d4cc83d77ca576e3911477b169ecc311c977cb45490345f633b5a", + "source_digest": "sha256:0ca9eaba9dc47171f7a042dc6753faa6c820c65ee966538f9d65fac5342202e8" + }, + { + "actual_outcome": "unsatisfiable", + "analysis_profile": "raes-finite-domain-satisfiability-v1", + "case_id": "finite-domain-unsatisfiable-v2", + "configuration_digest": "sha256:1204635e17e759e9ad3bd6be2ecb28c6de05c07ead6dfdd15936ed5d3d5b81b2", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "scenario-satisfiability-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "evidence_artifact_sha256": "c972725ef64822a75a60380afc11f08eac25b7fe9b091d39b058b3c9f7c8031d", + "evidence_digest": "sha256:317b5cad00aa7f4f7868dca66127611ba19d40ffd86f35815502622814df54c1", + "evidence_profile": "scenario-satisfiability-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "specs/formal/scenario-satisfiability/README.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The subset-minimal core is evidence for the pinned translation and solver, not a proof certificate for arbitrary SDL." + ], + "replayable": true, + "result_digest": "sha256:317b5cad00aa7f4f7868dca66127611ba19d40ffd86f35815502622814df54c1", + "source_digest": "sha256:cfef56a1f56d5f0db9da195377fd75694bdd0f0b92932fdb8fafcbd3f7baf6c5" + }, + { + "actual_outcome": "valid-path", + "analysis_profile": "raes-exploit-path-analysis-v1", + "case_id": "typed-exploit-path-valid-v2", + "configuration_digest": "sha256:7f8876d81feb77d3a3239be2fb8337de8885e2744f8786728ba23e4e6027bc0a", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "exploit-path-analysis-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "evidence_artifact_sha256": "1b7f55d04db172da32658187c64a88c13b5f4d565267ce2be7cb86a9d04cb70c", + "evidence_digest": "sha256:2d4d1a362751abd9544beb8af7f8c6331d04dac8f4abc315fb261f81fbaf4387", + "evidence_profile": "exploit-path-analysis-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "specs/formal/exploit-path-analysis/README.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The witness is bounded to the admitted snapshot, normalized graph, query, semantics, and search profile; it does not establish backend execution." + ], + "replayable": true, + "result_digest": "sha256:2d4d1a362751abd9544beb8af7f8c6331d04dac8f4abc315fb261f81fbaf4387", + "source_digest": "sha256:0afe635a63db5b6e6380ac70982fd61d09790745d51a10d670321304121e7c39" + }, + { + "actual_outcome": "invalid-path", + "analysis_profile": "raes-exploit-path-analysis-v1", + "case_id": "typed-exploit-path-invalid-v2", + "configuration_digest": "sha256:7f8876d81feb77d3a3239be2fb8337de8885e2744f8786728ba23e4e6027bc0a", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "exploit-path-analysis-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "evidence_artifact_sha256": "244f895a64f14c10916ab0533ab462ce80a328021cd6a50c30a4aa59266d5533", + "evidence_digest": "sha256:1b416bb5a4d29d57c961b769cc9d3af5d9328624e3eebf104d57f39a94c5bb97", + "evidence_profile": "exploit-path-analysis-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "specs/formal/exploit-path-analysis/README.md" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Structured rejection proves only that this bounded graph/query cannot reach its goal; it does not establish real-world non-exploitability." + ], + "replayable": true, + "result_digest": "sha256:1b416bb5a4d29d57c961b769cc9d3af5d9328624e3eebf104d57f39a94c5bb97", + "source_digest": "sha256:0b2293d4a8983515ff05c516be6e6b418a4f3f09e055250a00bf15fda861aab3" + } + ], + "participant_observations": [ + { + "evidence_refs": [ + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_disclosure_is_separate_from_observable_projection", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_cannot_be_observed_without_explicit_disclosure_rule" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Covers the reference SDL/contract path, not every backend projection." + ], + "negative_outcome": "passed", + "obligation_id": "hidden-vs-visible-projection", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_contract_declares_sem_211_classes_and_compiles_them", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_result_rejects_success_when_preconditions_are_unresolved" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Covers declared applicability and one unresolved-precondition failure." + ], + "negative_outcome": "passed", + "obligation_id": "fail-closed-action-applicability", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_runtime_snapshot_publishes_joint_action_and_time_context_records", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_joint_action_record_contract_rejects_unordered_conflicting_writes" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Contract evidence does not prove every backend's live concurrency fidelity." + ], + "negative_outcome": "passed", + "obligation_id": "shared-state-effects", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_accepts_supported_order_claim_strengths", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_rejects_wall_clock_causality" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Rejecting timestamp-only causality does not supply counterfactual proof." + ], + "negative_outcome": "passed", + "obligation_id": "ordering-before-causality", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_attribution_edge_round_trips_on_terminal_observation", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_timestamp_adjacency_cannot_be_reported_as_strong_causality" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Attribution labels disclose basis; they do not demonstrate necessity." + ], + "negative_outcome": "passed", + "obligation_id": "evidence-labeled-attribution", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_outcome_interpretation_rule_parses_and_compiles_explicit_layers", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_local_action_success_does_not_imply_objective_success_without_rule_record" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "The fixtures establish layer separation, not outcome validity in every realization." + ], + "negative_outcome": "passed", + "obligation_id": "participant-local-outcome-separation", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_realization_honesty_conformance.py::test_constructive_envelope_runs_positive_and_negative_honesty_probes", + "implementations/python/tests/test_realization_honesty_conformance.py::test_only_native_live_can_support_native_conformance" + ], + "execution_id": "issue-307-execution-v70", + "limitations": [ + "Reference conformance evidence remains bounded to declared realization profiles." + ], + "negative_outcome": "passed", + "obligation_id": "realization-profile-honesty", + "positive_outcome": "passed" + } + ], + "protocol_revision": "2.0.0", + "raes_revision": "86840a96890f12e5f5bc19c0e468bbb76799f095", + "source_state": { + "base_revision": "86840a96890f12e5f5bc19c0e468bbb76799f095", + "checkout_state": "modified", + "implementation_digest": "e0cc2be360acaca1d0a131a1d317757f142bac316dc00e61b6a02fc1f7c69351", + "profile": "python-reference-source/v2" + }, + "versions": { + "python": "3.14.4", + "raes": "5.0.0", + "z3_engine": "4.16.0", + "z3_solver": "4.16.0.0" + } +} diff --git a/docs/research/formal-semantic-validation/execution-snapshot-v71.json b/docs/research/formal-semantic-validation/execution-snapshot-v71.json new file mode 100644 index 000000000..79b6ef1d8 --- /dev/null +++ b/docs/research/formal-semantic-validation/execution-snapshot-v71.json @@ -0,0 +1,652 @@ +{ + "baseline": { + "execution_id": "issue-307-execution-v70", + "release_path": "docs/research/formal-semantic-validation/bundles/retest-v70.json", + "release_revision": "70.0.0", + "release_sha256": "1d7737999428333aa7ed0b553a1a416913c618c424eaf633a8b587972b5306dc" + }, + "captured_at": "2026-10-10T15:14:16.484268+00:00", + "commands": [ + { + "argv": [ + "implementations/python/.venv/bin/python", + "tools/check_formal_semantic_validation.py" + ], + "command_id": "bundle-replay", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/pytest", + "-q", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_disclosure_is_separate_from_observable_projection", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_cannot_be_observed_without_explicit_disclosure_rule", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_contract_declares_sem_211_classes_and_compiles_them", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_result_rejects_success_when_preconditions_are_unresolved", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_runtime_snapshot_publishes_joint_action_and_time_context_records", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_joint_action_record_contract_rejects_unordered_conflicting_writes", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_accepts_supported_order_claim_strengths", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_rejects_wall_clock_causality", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_attribution_edge_round_trips_on_terminal_observation", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_timestamp_adjacency_cannot_be_reported_as_strong_causality", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_outcome_interpretation_rule_parses_and_compiles_explicit_layers", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_local_action_success_does_not_imply_objective_success_without_rule_record", + "implementations/python/tests/test_realization_honesty_conformance.py::test_constructive_envelope_runs_positive_and_negative_honesty_probes", + "implementations/python/tests/test_realization_honesty_conformance.py::test_only_native_live_can_support_native_conformance" + ], + "command_id": "participant-fixtures", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "satisfiability", + "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "--profile", + "raes-finite-domain-satisfiability-v1" + ], + "command_id": "finite-domain-satisfiable-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "satisfiability", + "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "--profile", + "raes-finite-domain-satisfiability-v1" + ], + "command_id": "finite-domain-unsatisfiable-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "exploit-path", + "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "--profile", + "raes-exploit-path-analysis-v1" + ], + "command_id": "typed-exploit-path-valid-v2", + "network": "disabled" + }, + { + "argv": [ + "implementations/python/.venv/bin/raes", + "processor", + "exploit-path", + "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "--profile", + "raes-exploit-path-analysis-v1" + ], + "command_id": "typed-exploit-path-invalid-v2", + "network": "disabled" + } + ], + "configuration_id": "raes-python-reference-offline-v41", + "corpus_revision": "4.0.0", + "deviations": [], + "execution_id": "issue-309-execution-v71", + "execution_status": "complete", + "observations": [ + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "schema-valid-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/schema-valid.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "A passing minimal source does not establish semantic correctness." + ], + "replayable": true, + "result_digest": "f7d364ef384df8a1526b489501835b635021c860793b5764f91d956710d2250c", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "schema-unknown-field", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLParseError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/schema-invalid-unknown-field.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The observation covers one unknown-field defect only." + ], + "replayable": true, + "result_digest": "f55d834b458f8e069e1c69061b4cc0a6d61e0e052bf90c670f2e6a5ad8b5bd98", + "source_digest": null + }, + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "semantic-resolved-objective", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-valid-participant-identity-v2.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "This is a positive control for one objective-reference slice." + ], + "replayable": true, + "result_digest": "652288785dc09095955ed3649f6407d616fb7c4d4f4188df4ed513ccb7537e0b", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-dangling-assertion", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-dangling-ref-participant-identity-v2.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "A single dangling reference does not prove complete semantic coverage." + ], + "replayable": true, + "result_digest": "0207cf616b56708ca9b8c4499d3301abe22dbe52162cf8d58d3bec429d9db024", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-ambiguous-reference", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-ambiguous-ref.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "One namespace collision does not enumerate every ambiguity surface." + ], + "replayable": true, + "result_digest": "9da4a87797d228e0012ab6b30459f4892e41aa6f224a9840be035fee4a2eea73", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "semantic-feature-cycle", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/semantic-invalid-feature-cycle.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "One static dependency cycle does not establish general constraint satisfiability." + ], + "replayable": true, + "result_digest": "d15dbcd99fb4f20b965d7031b07dd6534576302270399c3fa656d29e7de02b83", + "source_digest": null + }, + { + "actual_outcome": "accepted", + "analysis_profile": null, + "case_id": "workflow-reachable-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/workflow-reachable.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The graph is workflow control flow only." + ], + "replayable": true, + "result_digest": "b1b49649b54bd59d4ef357b39cf9158da90f4eae560f8dd756acf97bd0827a06", + "source_digest": null + }, + { + "actual_outcome": "rejected", + "analysis_profile": null, + "case_id": "workflow-unreachable-step", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "SDLValidationError", + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/workflow-unreachable.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The result does not establish network, service, participant, or exploit reachability." + ], + "replayable": true, + "result_digest": "bb931d19346ef9193408ae6c85deb4079704378fc5f00dc5f47a2817cff21943", + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "whole-scenario-satisfiable-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "No governed whole-scenario constraint theory or solver exists." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "whole-scenario-unsatisfiable-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Local checks cannot produce a whole-scenario unsat certificate." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "valid-exploit-path-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The issue-168 baseline had no canonical typed attack graph or path-query entrypoint." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "invalid-exploit-path-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Vulnerability and topology declarations are not an invalid-path proof." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "stable", + "analysis_profile": null, + "case_id": "compile-repeatability-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The witness ends at compiled output." + ], + "replayable": true, + "result_digest": "21e2e450d0780902e93d2a3e61d582b5067b5a19c3e8b7d59b4b72b6a61cc323", + "source_digest": null + }, + { + "actual_outcome": "distinguishable", + "analysis_profile": null, + "case_id": "compile-non-vacuity-control", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/determinism-a.sdl.yaml", + "docs/research/formal-semantic-validation/corpus/determinism-b.sdl.yaml" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Distinct digests are a non-vacuity control, not semantic non-equivalence proof." + ], + "replayable": true, + "result_digest": "55234feafeded8c132d055185bdcb2ce6b1cb47dbf0cbba82d7e5d121acc85ea", + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "necessity-witness-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "No governed intervention or ablation protocol exists." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "unsupported", + "analysis_profile": null, + "case_id": "non-necessity-control-request", + "configuration_digest": null, + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": null, + "evidence_artifact_path": null, + "evidence_artifact_sha256": null, + "evidence_digest": null, + "evidence_profile": null, + "evidence_refs": [ + "docs/decisions/issue-168-formal-semantic-validation-reachability-preflight.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Attribution and negative fixtures do not demonstrate non-necessity." + ], + "replayable": false, + "result_digest": null, + "source_digest": null + }, + { + "actual_outcome": "satisfiable", + "analysis_profile": "raes-finite-domain-satisfiability-v1", + "case_id": "finite-domain-satisfiable-v2", + "configuration_digest": "sha256:1204635e17e759e9ad3bd6be2ecb28c6de05c07ead6dfdd15936ed5d3d5b81b2", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "scenario-satisfiability-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "evidence_artifact_sha256": "554202313d678046958b5c028e2de26ff03c74895cfac552677eed74e8153add", + "evidence_digest": "sha256:23c2cae7d95d4cc83d77ca576e3911477b169ecc311c977cb45490345f633b5a", + "evidence_profile": "scenario-satisfiability-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/satisfiable-control.sdl.yaml", + "docs/research/formal-semantic-validation/evidence/finite-domain-satisfiable-v4.json", + "specs/formal/scenario-satisfiability/README.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Demonstrates only the pinned finite-domain theory, translation, solver profile, and source." + ], + "replayable": true, + "result_digest": "sha256:23c2cae7d95d4cc83d77ca576e3911477b169ecc311c977cb45490345f633b5a", + "source_digest": "sha256:0ca9eaba9dc47171f7a042dc6753faa6c820c65ee966538f9d65fac5342202e8" + }, + { + "actual_outcome": "unsatisfiable", + "analysis_profile": "raes-finite-domain-satisfiability-v1", + "case_id": "finite-domain-unsatisfiable-v2", + "configuration_digest": "sha256:1204635e17e759e9ad3bd6be2ecb28c6de05c07ead6dfdd15936ed5d3d5b81b2", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "scenario-satisfiability-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "evidence_artifact_sha256": "c972725ef64822a75a60380afc11f08eac25b7fe9b091d39b058b3c9f7c8031d", + "evidence_digest": "sha256:317b5cad00aa7f4f7868dca66127611ba19d40ffd86f35815502622814df54c1", + "evidence_profile": "scenario-satisfiability-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/unsatisfiable-control.sdl.yaml", + "docs/research/formal-semantic-validation/evidence/finite-domain-unsatisfiable-v4.json", + "specs/formal/scenario-satisfiability/README.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The subset-minimal core is evidence for the pinned translation and solver, not a proof certificate for arbitrary SDL." + ], + "replayable": true, + "result_digest": "sha256:317b5cad00aa7f4f7868dca66127611ba19d40ffd86f35815502622814df54c1", + "source_digest": "sha256:cfef56a1f56d5f0db9da195377fd75694bdd0f0b92932fdb8fafcbd3f7baf6c5" + }, + { + "actual_outcome": "valid-path", + "analysis_profile": "raes-exploit-path-analysis-v1", + "case_id": "typed-exploit-path-valid-v2", + "configuration_digest": "sha256:7f8876d81feb77d3a3239be2fb8337de8885e2744f8786728ba23e4e6027bc0a", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "exploit-path-analysis-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "evidence_artifact_sha256": "1b7f55d04db172da32658187c64a88c13b5f4d565267ce2be7cb86a9d04cb70c", + "evidence_digest": "sha256:2d4d1a362751abd9544beb8af7f8c6331d04dac8f4abc315fb261f81fbaf4387", + "evidence_profile": "exploit-path-analysis-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/exploit-path-valid-v3.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-valid-v4.json", + "specs/formal/exploit-path-analysis/README.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The witness is bounded to the admitted snapshot, normalized graph, query, semantics, and search profile; it does not establish backend execution." + ], + "replayable": true, + "result_digest": "sha256:2d4d1a362751abd9544beb8af7f8c6331d04dac8f4abc315fb261f81fbaf4387", + "source_digest": "sha256:0afe635a63db5b6e6380ac70982fd61d09790745d51a10d670321304121e7c39" + }, + { + "actual_outcome": "invalid-path", + "analysis_profile": "raes-exploit-path-analysis-v1", + "case_id": "typed-exploit-path-invalid-v2", + "configuration_digest": "sha256:7f8876d81feb77d3a3239be2fb8337de8885e2744f8786728ba23e4e6027bc0a", + "configuration_id": "raes-python-reference-offline-v41", + "diagnostic_kind": "exploit-path-analysis-evidence/v1", + "evidence_artifact_path": "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "evidence_artifact_sha256": "244f895a64f14c10916ab0533ab462ce80a328021cd6a50c30a4aa59266d5533", + "evidence_digest": "sha256:1b416bb5a4d29d57c961b769cc9d3af5d9328624e3eebf104d57f39a94c5bb97", + "evidence_profile": "exploit-path-analysis-evidence/v1", + "evidence_refs": [ + "docs/research/formal-semantic-validation/corpus/exploit-path-invalid-v3.json", + "docs/research/formal-semantic-validation/evidence/typed-exploit-path-invalid-v4.json", + "specs/formal/exploit-path-analysis/README.md" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Structured rejection proves only that this bounded graph/query cannot reach its goal; it does not establish real-world non-exploitability." + ], + "replayable": true, + "result_digest": "sha256:1b416bb5a4d29d57c961b769cc9d3af5d9328624e3eebf104d57f39a94c5bb97", + "source_digest": "sha256:0b2293d4a8983515ff05c516be6e6b418a4f3f09e055250a00bf15fda861aab3" + } + ], + "participant_observations": [ + { + "evidence_refs": [ + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_disclosure_is_separate_from_observable_projection", + "implementations/python/tests/test_sem_208_participant_behavior.py::test_hidden_truth_cannot_be_observed_without_explicit_disclosure_rule" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Covers the reference SDL/contract path, not every backend projection." + ], + "negative_outcome": "passed", + "obligation_id": "hidden-vs-visible-projection", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_contract_declares_sem_211_classes_and_compiles_them", + "implementations/python/tests/test_sem_211_participant_action_semantics.py::test_action_result_rejects_success_when_preconditions_are_unresolved" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Covers declared applicability and one unresolved-precondition failure." + ], + "negative_outcome": "passed", + "obligation_id": "fail-closed-action-applicability", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_runtime_snapshot_publishes_joint_action_and_time_context_records", + "implementations/python/tests/test_run_308_concurrent_participant_execution.py::test_joint_action_record_contract_rejects_unordered_conflicting_writes" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Contract evidence does not prove every backend's live concurrency fidelity." + ], + "negative_outcome": "passed", + "obligation_id": "shared-state-effects", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_accepts_supported_order_claim_strengths", + "implementations/python/tests/test_participant_runtime_invariants.py::test_order_discipline_rejects_wall_clock_causality" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Rejecting timestamp-only causality does not supply counterfactual proof." + ], + "negative_outcome": "passed", + "obligation_id": "ordering-before-causality", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_attribution_edge_round_trips_on_terminal_observation", + "implementations/python/tests/test_sem_212_participant_attribution_semantics.py::test_timestamp_adjacency_cannot_be_reported_as_strong_causality" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Attribution labels disclose basis; they do not demonstrate necessity." + ], + "negative_outcome": "passed", + "obligation_id": "evidence-labeled-attribution", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_outcome_interpretation_rule_parses_and_compiles_explicit_layers", + "implementations/python/tests/test_sem_215_participant_outcome_interpretation.py::test_local_action_success_does_not_imply_objective_success_without_rule_record" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "The fixtures establish layer separation, not outcome validity in every realization." + ], + "negative_outcome": "passed", + "obligation_id": "participant-local-outcome-separation", + "positive_outcome": "passed" + }, + { + "evidence_refs": [ + "implementations/python/tests/test_realization_honesty_conformance.py::test_constructive_envelope_runs_positive_and_negative_honesty_probes", + "implementations/python/tests/test_realization_honesty_conformance.py::test_only_native_live_can_support_native_conformance" + ], + "execution_id": "issue-309-execution-v71", + "limitations": [ + "Reference conformance evidence remains bounded to declared realization profiles." + ], + "negative_outcome": "passed", + "obligation_id": "realization-profile-honesty", + "positive_outcome": "passed" + } + ], + "protocol_revision": "2.0.0", + "raes_revision": "a0bcf20e8a9f7cde928b3987f8a792d0a85d1cc9", + "source_state": { + "base_revision": "a0bcf20e8a9f7cde928b3987f8a792d0a85d1cc9", + "checkout_state": "modified", + "implementation_digest": "24446d9191a749847670b888918d12f05d47830bdabc8a3c8b3f9821c89ecb15", + "profile": "python-reference-source/v2" + }, + "versions": { + "python": "3.14.4", + "raes": "5.0.0", + "z3_engine": "4.16.0", + "z3_solver": "4.16.0.0" + } +} diff --git a/docs/research/formal-semantic-validation/index.md b/docs/research/formal-semantic-validation/index.md index 158767ff3..ce9f3c858 100644 --- a/docs/research/formal-semantic-validation/index.md +++ b/docs/research/formal-semantic-validation/index.md @@ -336,7 +336,7 @@ outcomes and claim limits, recording the positive successor's changed result digest; the dangling-reference diagnostic remains identical. It establishes no autonomy threshold, authority grant, or realized attribution. -Current validation requires explicit release 69.0.0, rejects unsupported future +Current validation requires explicit release 71.0.0, rejects unsupported future or duplicate revisions, and never accepts an old/new output-digest pair as a substitute for replay. Historical releases (including the issue-826 supplement) undergo pin, shape, control, and internal-join checks without executing current @@ -585,3 +585,18 @@ retains its original bytes. Pre-synchronization issue #1361 captures are Retained outcomes and bounded claim limits are unchanged. Two compiled digests differ because the runtime model carries execution-policy metadata; their exact baseline and retest values are recorded as deviations. + +Release 70.0.0 replays the retained formal cases after issue #307 added +optional authored participant episode policies to behavior specifications, in +[`execution-snapshot-v70.json`](execution-snapshot-v70.json) and +[`analysis-v70.json`](analysis-v70.json). Outcomes and claim limits remain +unchanged. Two compiled digests differ because the runtime model carries +participant episode policy metadata; their exact baseline and retest values are +recorded as deviations. + +Release 71.0.0 replays the retained formal cases after issue #309 made +participant episode structure a first-class member of the behavior +specification aggregate, in +[`execution-snapshot-v71.json`](execution-snapshot-v71.json) and +[`analysis-v71.json`](analysis-v71.json). Outcomes and claim limits remain +unchanged. diff --git a/docs/research/specification-coverage/analysis-v69.json b/docs/research/specification-coverage/analysis-v69.json new file mode 100644 index 000000000..efcf39580 --- /dev/null +++ b/docs/research/specification-coverage/analysis-v69.json @@ -0,0 +1,112 @@ +{ + "analysis_id": "raes-standardized-specification-coverage-issue-307-v69", + "backend_leakage": [], + "claim": { + "allowed_evidence": [ + "pinned source metadata and bounded paraphrases", + "production parser, semantic, instantiation, admission, compiler, contract, and profile results", + "exact artifact digests and typed pointers", + "documented missing-concept and backend-specific dispositions" + ], + "claim_id": "raes-standardized-configurable-specification-coverage", + "disallowed_evidence": [ + "field-count or schema breadth alone", + "the existing scenario stress corpus as the representative request corpus", + "free-form metadata as typed coverage", + "backend-private interpretation", + "post-hoc removal or repair of falsifying concepts" + ], + "evidence_artifacts": [ + "docs/research/specification-coverage/protocol-v1.json", + "docs/research/specification-coverage/execution-snapshot-v69.json", + "docs/research/specification-coverage/analysis-v69.json" + ], + "falsification_protocol": "docs/research/specification-coverage/protocol-v1.json", + "objective_fail_criteria": "A load-bearing concept is missing or lossy, an applicable stage fails, or backend vocabulary is required in core SDL while the result claims success.", + "objective_pass_criteria": "Every load-bearing concept passes at every owning stage, backend-specific mechanics stay outside core SDL, and no requested concept is silently lost.", + "statement": "RAES provides a standardized configurable portable specification surface for the preregistered representative cyber-agent evaluation environment requirements without backend vocabulary in core SDL.", + "threats_to_validity": [ + "The representative corpus contains four source strata and sixteen atomic concepts rather than every cyber-range requirement.", + "The reference processor and repository fixtures are not independent backend implementations.", + "No live range, simulator federation, or participant execution was part of this offline specification-coverage test." + ] + }, + "classification_counts": { + "deliberately-backend-specific": 1, + "directly-expressible": 10, + "missing": 3, + "profile-or-manifest-constraint": 2 + }, + "evidence_status": "partial", + "execution_status": "complete", + "generated_at": "2026-10-10T14:13:23.809480+00:00", + "limitations": [ + "This result demonstrates bounded specification coverage, not universal cyber-range coverage, usability, adoption, backend substitution, or behavioral equivalence.", + "The three missing concepts are evidence, not implementation tasks within this snapshot.", + "The retained protocol does not test recursive realization or plan-level profile semantics; this release only re-establishes its original bounded coverage result against the current implementation.", + "The retained protocol does not test evidence-requirement refinement lineage; the dedicated EXP-731 regression suite covers that production boundary.", + "Authoring-adapter transport behavior is outside this retained protocol.", + "Reviewed OCI mirror and pre-seed admission is covered by its own regression suites and the development artifact policy gate, not a new claim in this preregistered matrix.", + "Operational recovery observation and startup reconciliation are covered by their API-404 regression suite, not a new claim in this preregistered matrix.", + "Store ownership, immutable runtime scope, and provider shutdown ordering are covered by the API-404 CP-5 regression suite, not by this retained specification-coverage protocol.", + "Mixed/staged trial compilation and admission are covered by issue #1015 regression tests, not by this retained specification-coverage corpus; no live mixed-runtime result is claimed.", + "Issue #1186 control-plane recovery operations are covered by their runtime regression suite, not by this retained specification-coverage corpus.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 control-plane profile declarations are covered by their dedicated runtime suite, not promoted to new claims by the retained language corpus.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Participant-local outcome state is verified by the ACT-618 tests; this retained corpus makes no additional outcome-state claim.", + "Backend operation supervision contracts are covered by issue #1360 contract tests; this retained offline corpus establishes no live backend supervision or recovery guarantee.", + "This capture replays the merged issue #1360 and #1357 source; the protocol makes no live backend execution or supervision claim.", + "This capture replays the merged issue #1360 and #1358 source; the protocol makes no live backend execution or supervision claim.", + "Issue #1389 participant inject delivery temporal-subject admission is covered by dedicated compiler tests; this retained matrix makes no new timing or execution claim.", + "Issue #971 adds offline crossing model construction; this retained protocol establishes no crossing equivalence or runtime-realization claim.", + "Issue #1359 control-plane route authority, participant-view scoping, and no-store HTTP boundary are covered by their dedicated HTTP-boundary suite; this retained matrix makes no new exposure or execution claim.", + "Issue #1401 required-evidence media-type coherence is verified by its dedicated suite; this retained matrix makes no new admission or capture claim.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "Issue #307 authored participant episode policies are covered by their dedicated SDL authoring, validation, composition and compilation tests; this retained matrix makes no new episode execution, reset or termination claim." + ], + "load_bearing_results": { + "failed": 0, + "missing": 0, + "passed": 10, + "total": 10 + }, + "plain_language_outcome": "The retained specification-coverage matrix reproduces its prior classifications after issue #307 added optional authored participant episode policies to behavior specifications; classifications and claim limits are unchanged.", + "protocol_revision": "1.0.0", + "request_results": [ + { + "concept_count": 6, + "failed_stage_count": 0, + "missing_count": 0, + "request_id": "survey-representative-range", + "status": "demonstrated" + }, + { + "concept_count": 5, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "cyborg-participant-evaluation", + "status": "partial" + }, + { + "concept_count": 3, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "vsdl-configurable-infrastructure", + "status": "partial" + }, + { + "concept_count": 2, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "cyber-dem-federation", + "status": "partial" + } + ], + "snapshot_id": "raes-standardized-specification-coverage-issue-307-v69", + "snapshot_sha256": "bcd0f9e41881fc7983bcf719b2f929ae96ec1f39762ff3337a1bbc85ad27891c" +} diff --git a/docs/research/specification-coverage/analysis-v70.json b/docs/research/specification-coverage/analysis-v70.json new file mode 100644 index 000000000..594a2518a --- /dev/null +++ b/docs/research/specification-coverage/analysis-v70.json @@ -0,0 +1,113 @@ +{ + "analysis_id": "raes-standardized-specification-coverage-issue-309-v70", + "backend_leakage": [], + "claim": { + "allowed_evidence": [ + "pinned source metadata and bounded paraphrases", + "production parser, semantic, instantiation, admission, compiler, contract, and profile results", + "exact artifact digests and typed pointers", + "documented missing-concept and backend-specific dispositions" + ], + "claim_id": "raes-standardized-configurable-specification-coverage", + "disallowed_evidence": [ + "field-count or schema breadth alone", + "the existing scenario stress corpus as the representative request corpus", + "free-form metadata as typed coverage", + "backend-private interpretation", + "post-hoc removal or repair of falsifying concepts" + ], + "evidence_artifacts": [ + "docs/research/specification-coverage/protocol-v1.json", + "docs/research/specification-coverage/execution-snapshot-v70.json", + "docs/research/specification-coverage/analysis-v70.json" + ], + "falsification_protocol": "docs/research/specification-coverage/protocol-v1.json", + "objective_fail_criteria": "A load-bearing concept is missing or lossy, an applicable stage fails, or backend vocabulary is required in core SDL while the result claims success.", + "objective_pass_criteria": "Every load-bearing concept passes at every owning stage, backend-specific mechanics stay outside core SDL, and no requested concept is silently lost.", + "statement": "RAES provides a standardized configurable portable specification surface for the preregistered representative cyber-agent evaluation environment requirements without backend vocabulary in core SDL.", + "threats_to_validity": [ + "The representative corpus contains four source strata and sixteen atomic concepts rather than every cyber-range requirement.", + "The reference processor and repository fixtures are not independent backend implementations.", + "No live range, simulator federation, or participant execution was part of this offline specification-coverage test." + ] + }, + "classification_counts": { + "deliberately-backend-specific": 1, + "directly-expressible": 10, + "missing": 3, + "profile-or-manifest-constraint": 2 + }, + "evidence_status": "partial", + "execution_status": "complete", + "generated_at": "2026-10-10T15:14:16.484268+00:00", + "limitations": [ + "This result demonstrates bounded specification coverage, not universal cyber-range coverage, usability, adoption, backend substitution, or behavioral equivalence.", + "The three missing concepts are evidence, not implementation tasks within this snapshot.", + "The retained protocol does not test recursive realization or plan-level profile semantics; this release only re-establishes its original bounded coverage result against the current implementation.", + "The retained protocol does not test evidence-requirement refinement lineage; the dedicated EXP-731 regression suite covers that production boundary.", + "Authoring-adapter transport behavior is outside this retained protocol.", + "Reviewed OCI mirror and pre-seed admission is covered by its own regression suites and the development artifact policy gate, not a new claim in this preregistered matrix.", + "Operational recovery observation and startup reconciliation are covered by their API-404 regression suite, not a new claim in this preregistered matrix.", + "Store ownership, immutable runtime scope, and provider shutdown ordering are covered by the API-404 CP-5 regression suite, not by this retained specification-coverage protocol.", + "Mixed/staged trial compilation and admission are covered by issue #1015 regression tests, not by this retained specification-coverage corpus; no live mixed-runtime result is claimed.", + "Issue #1186 control-plane recovery operations are covered by their runtime regression suite, not by this retained specification-coverage corpus.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 control-plane profile declarations are covered by their dedicated runtime suite, not promoted to new claims by the retained language corpus.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Participant-local outcome state is verified by the ACT-618 tests; this retained corpus makes no additional outcome-state claim.", + "Backend operation supervision contracts are covered by issue #1360 contract tests; this retained offline corpus establishes no live backend supervision or recovery guarantee.", + "This capture replays the merged issue #1360 and #1357 source; the protocol makes no live backend execution or supervision claim.", + "This capture replays the merged issue #1360 and #1358 source; the protocol makes no live backend execution or supervision claim.", + "Issue #1389 participant inject delivery temporal-subject admission is covered by dedicated compiler tests; this retained matrix makes no new timing or execution claim.", + "Issue #971 adds offline crossing model construction; this retained protocol establishes no crossing equivalence or runtime-realization claim.", + "Issue #1359 control-plane route authority, participant-view scoping, and no-store HTTP boundary are covered by their dedicated HTTP-boundary suite; this retained matrix makes no new exposure or execution claim.", + "Issue #1401 required-evidence media-type coherence is verified by its dedicated suite; this retained matrix makes no new admission or capture claim.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "Issue #307 authored participant episode policies are covered by their dedicated SDL authoring, validation, composition and compilation tests; this retained matrix makes no new episode execution, reset or termination claim.", + "Issue #309 first-class participant episode structure and its recorded-history conformance check are covered by their dedicated aggregate, validation and conformance tests; this retained matrix makes no new episode execution, reset or termination claim." + ], + "load_bearing_results": { + "failed": 0, + "missing": 0, + "passed": 10, + "total": 10 + }, + "plain_language_outcome": "The retained specification-coverage matrix reproduces its prior classifications after issue #309 made participant episode structure a first-class member of the behavior specification aggregate; classifications and claim limits are unchanged.", + "protocol_revision": "1.0.0", + "request_results": [ + { + "concept_count": 6, + "failed_stage_count": 0, + "missing_count": 0, + "request_id": "survey-representative-range", + "status": "demonstrated" + }, + { + "concept_count": 5, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "cyborg-participant-evaluation", + "status": "partial" + }, + { + "concept_count": 3, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "vsdl-configurable-infrastructure", + "status": "partial" + }, + { + "concept_count": 2, + "failed_stage_count": 1, + "missing_count": 1, + "request_id": "cyber-dem-federation", + "status": "partial" + } + ], + "snapshot_id": "raes-standardized-specification-coverage-issue-309-v70", + "snapshot_sha256": "7302e17e16495a3c1e347bcc516107acf9ba2cfeeab4d3f8ff32d4a5d1b7f40b" +} diff --git a/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-307-v69.json b/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-307-v69.json new file mode 100644 index 000000000..7261443f2 --- /dev/null +++ b/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-307-v69.json @@ -0,0 +1,10 @@ +{ + "analysis_path": "docs/research/specification-coverage/analysis-v69.json", + "analysis_sha256": "314441d18e66ad28ca4a45e832cca26c13fb14d07ee849d39bab30ca89f54d39", + "bundle_id": "raes-standardized-specification-coverage", + "protocol_path": "docs/research/specification-coverage/protocol-v1.json", + "protocol_sha256": "e97a19e643e94c9e589dca823a63c6ce49d3329fe2a3cb888ab630838ed93125", + "revision": "69.0.0", + "snapshot_path": "docs/research/specification-coverage/execution-snapshot-v69.json", + "snapshot_sha256": "7422e898e8cb70f98c258e0a689c389390e78668c190b43115814f05b3f736a8" +} diff --git a/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-309-v70.json b/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-309-v70.json new file mode 100644 index 000000000..11361fac5 --- /dev/null +++ b/docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-309-v70.json @@ -0,0 +1,10 @@ +{ + "analysis_path": "docs/research/specification-coverage/analysis-v70.json", + "analysis_sha256": "45773803858f49bc3f72dcfa3f7553769cf88104ac452552fe82b3ffa09ac323", + "bundle_id": "raes-standardized-specification-coverage", + "protocol_path": "docs/research/specification-coverage/protocol-v1.json", + "protocol_sha256": "e97a19e643e94c9e589dca823a63c6ce49d3329fe2a3cb888ab630838ed93125", + "revision": "70.0.0", + "snapshot_path": "docs/research/specification-coverage/execution-snapshot-v70.json", + "snapshot_sha256": "24983719613744fc65118390ee873cb961d5ea27a547699e6856567c513146b4" +} diff --git a/docs/research/specification-coverage/execution-snapshot-v69.json b/docs/research/specification-coverage/execution-snapshot-v69.json new file mode 100644 index 000000000..8c3803f36 --- /dev/null +++ b/docs/research/specification-coverage/execution-snapshot-v69.json @@ -0,0 +1,704 @@ +{ + "artifacts": [ + { + "artifact_id": "enterprise-participant-sdl", + "kind": "sdl", + "path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "sha256": "f7a8897beec243e188ee081975006fad32725f469f267db6e75a1e1cf5727032", + "validator": "raes parse, semantic, instantiation/admission, and compiler pipeline" + }, + { + "artifact_id": "port-range-sdl", + "kind": "sdl", + "path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "sha256": "0d5497ec946b863e6985284ec487dde7d7f6bf710a985be51401ac0e5e79dc4f", + "validator": "raes parse, semantic, instantiation/admission, and compiler pipeline" + }, + { + "artifact_id": "experiment-task-contract", + "kind": "experiment-task", + "path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "sha256": "f3edf713ac6af26bad609136851c6dd434bfb87ce919a2d8c4414c1035deeafc", + "validator": "raes_contracts.contracts.ExperimentTaskModel" + }, + { + "artifact_id": "apparatus-context-contract", + "kind": "experiment-apparatus-context", + "path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "sha256": "e6fa559c5e961f0aab448d0f70dead24aa74fa8ba5f20e1b72f88e11473c9299", + "validator": "raes_contracts.contracts.ExperimentApparatusContextModel" + }, + { + "artifact_id": "backend-profile", + "kind": "backend-profile", + "path": "contracts/profiles/backend/orchestration-capable.json", + "sha256": "f70b8505a5c0055416db86c533e2e5bf08b11e5a514f076223b6d6c36215a092", + "validator": "raes_contracts.backend_profiles.BackendProfileModel" + }, + { + "artifact_id": "known-limitations", + "kind": "documentation", + "path": "docs/explain/sdl/limitations.md", + "sha256": "489eeab3ce682627682311581eb98af9abb9ff42a437145af266eefb71dc7fc4", + "validator": "documentation evidence only" + } + ], + "baseline": { + "release_revision": "1.1.0", + "release_sha256": "4020a1d56c7fe2831cec59ea64a12bbda9d38ccd94f93b916dd90f1a28f17fcb" + }, + "captured_at": "2026-10-10T14:13:23.809480+00:00", + "concept_results": [ + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "range-topology", + "rationale": "SDL nodes and infrastructure own host, network, link, and dependency meaning; the compiler emits canonical node deployment addresses.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed VM declaration.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Links and dependencies resolved.", + "outcome": "passed", + "pointer": "/infrastructure/shipping-portal", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Published instantiated shape admitted.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical deployment address retained.", + "outcome": "passed", + "pointer": "/node_deployments/provision.node.shipping-portal", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/nodes/shipping-portal" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "exercise-roles", + "rationale": "SDL entity roles own exercise responsibility without becoming control-plane identity or authorization.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed red role.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant/role", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Entity references validated.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Role retained after instantiation.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant/role", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Role retained in entity specification.", + "outcome": "passed", + "pointer": "/entity_specs/enterprise-participant/role", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/entities/enterprise-participant/role" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "evaluation-objectives", + "rationale": "SDL objectives own organization ownership, participant assignment, targets, windows, and assertion-based success; measures remain experiment contracts.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed objective declaration.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Owner, participant assignment, targets, assertions, and workflow refs resolved.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff/success", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Objective retained in admitted artifact.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical objective address retained.", + "outcome": "passed", + "pointer": "/objectives/evaluation.objective.demonstrate-handoff", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/objectives/demonstrate-handoff" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "control-workflows", + "rationale": "SDL workflows own the portable control graph and compile to canonical orchestration state contracts.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed control graph.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Step graph and objective refs validated.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery/steps", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Workflow retained after instantiation.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical control graph retained.", + "outcome": "passed", + "pointer": "/workflows/orchestration.workflow.yard-recovery", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/workflows/yard-recovery" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "authored-evidence-expectations", + "rationale": "SDL evidence requirements own portable capture intent and remain distinct from evidence records and measures.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed capture obligation.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Source refs and bindings validated.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Evidence intent retained in admitted artifact.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + } + ], + "typed_pointer": "/evidence_requirements/objective-truth-evidence" + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [], + "classification": "profile-or-manifest-constraint", + "completeness_disposition": "implemented", + "concept_id": "apparatus-selection-constraints", + "rationale": "The experiment task contract binds processor/backend identities, manifest refs, and capabilities outside SDL.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed ExperimentTaskModel validated.", + "outcome": "passed", + "pointer": "/apparatus_constraints/allowed_backend_refs/0", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/apparatus_constraints/allowed_backend_refs/0" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-agent", + "rationale": "SDL agents own participant entity, knowledge, actions, observation boundaries, and operating scope.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed participant declaration.", + "outcome": "passed", + "pointer": "/agents/participant-agent", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Participant refs and scope validated.", + "outcome": "passed", + "pointer": "/agents/participant-agent/observation_boundaries", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Participant retained in admitted artifact.", + "outcome": "passed", + "pointer": "/agents/participant-agent", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Compiled participant scope retained.", + "outcome": "passed", + "pointer": "/agent_specs/participant-agent", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/agents/participant-agent" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-action-contract", + "rationale": "The action contract declares portable preconditions, effects, observations, evidence, and failure classes without a runner command.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed action contract.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Action refs and evidence bindings validated.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login/effects", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Action retained in admitted artifact.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical action address retained.", + "outcome": "passed", + "pointer": "/action_contracts/participant.action-contract.probe-customer-portal-login", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/action_contracts/probe-customer-portal-login" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-observation-boundary", + "rationale": "The observation boundary separately declares visible, hidden, and evidence-only information with transition rules.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed observation boundary.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Information refs and transitions validated.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view/view_rules", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Boundary retained in admitted artifact.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical boundary address retained.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant.observation-boundary.participant-view", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/observation_boundaries/participant-view" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "evaluation-measure", + "rationale": "ExperimentTaskModel owns metric construct, unit, direction, aggregation, and evidence requirements outside SDL objectives.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed task contract validated.", + "outcome": "passed", + "pointer": "/evaluation_protocol/metric_definitions/foothold-achieved", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/evaluation_protocol/metric_definitions/foothold-achieved" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "participant-tool-affordance", + "rationale": "This preregistered matrix has no tested carrier for participant tool affordances. The retained missing classification records missing coverage evidence, not the absence of current participant-behavior capabilities.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "The preregistered carrier slot was not run; metadata does not substitute for a typed coverage test.", + "outcome": "not_run", + "pointer": null, + "stage_id": "authored", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "resource-constrained-topology", + "rationale": "SDL node resources and infrastructure dependencies express portable resource intent without provider resource identifiers.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed CPU and memory declaration.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal/resources", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Resource-bearing topology validated.", + "outcome": "passed", + "pointer": "/infrastructure/shipping-portal", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Constraints retained in admitted artifact.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal/resources", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Deployment specification retains resource intent.", + "outcome": "passed", + "pointer": "/node_deployments/provision.node.shipping-portal", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/nodes/shipping-portal/resources" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "formal-constraint-satisfiability", + "rationale": "This coverage matrix did not exercise a solver-backed carrier. The separate formal-semantic-validation release demonstrates its bounded finite-domain profile; that result is not silently imported into this protocol's missing carrier slot.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "No coverage-carrier execution was performed here; independent solver evidence does not change this preregistered denominator.", + "outcome": "not_run", + "pointer": null, + "stage_id": "semantic", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [ + { + "allowed": true, + "artifact_path": "source:vsdl-paper", + "pointer": "source sections 4-5", + "reason": "Legitimate VSDL realization vocabulary, not RAES core SDL structure.", + "term": "OpenStack/Terraform/Packer" + } + ], + "classification": "deliberately-backend-specific", + "completeness_disposition": "external", + "concept_id": "provider-specific-provisioning", + "rationale": "Provider image selection and provisioning engines are realization mechanics and therefore remain outside core SDL.", + "stage_results": [ + { + "artifact_path": "contracts/profiles/backend/orchestration-capable.json", + "diagnostic_codes": [], + "note": "The portable boundary requires backend contracts; it does not standardize a provider engine.", + "outcome": "not_applicable", + "pointer": "/required_contracts", + "stage_id": "realization-disclosure", + "validation_strength": "profile" + } + ], + "typed_pointer": null + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [], + "classification": "profile-or-manifest-constraint", + "completeness_disposition": "implemented", + "concept_id": "apparatus-clock-context", + "rationale": "ExperimentApparatusContextModel records clock authority, time domain, and synchronization as apparatus facts outside scenario meaning.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed apparatus context contract validated.", + "outcome": "passed", + "pointer": "/clocks/0", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/clocks/0" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "federated-object-event-exchange", + "rationale": "The federated cyber object/event exchange carrier was not exercised by this preregistered matrix. Runtime event internals are not treated as equivalent evidence.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "The missing coverage-carrier test is recorded explicitly, without inferring an ecosystem-wide capability absence.", + "outcome": "not_run", + "pointer": null, + "stage_id": "contract", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + } + ], + "deviations": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "baseline_sha256": "54ba1a60220e27a55da9cd2a407d7d3ab836fa54460d0b0c6cad87c2e744ddbb", + "rationale": "Migrate participant affiliations and explicit objective assignment, retaining organizational intent and portable action-contract declarations without granting execution authority.", + "retest_sha256": "f7a8897beec243e188ee081975006fad32725f469f267db6e75a1e1cf5727032" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "baseline_sha256": "a27c7a64e0c5c618fadaccafdf1a4e71600170a8b77b983190822b5141f00dec", + "rationale": "Migrate participant affiliations and explicit objective assignment, retaining organizational intent and portable action-contract declarations without granting execution authority.", + "retest_sha256": "0d5497ec946b863e6985284ec487dde7d7f6bf710a985be51401ac0e5e79dc4f" + }, + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "baseline_sha256": "21952a752f4e8581a9fc3b872e4bc308150548170d38bcfc83dbbe35ff5e0b9f", + "rationale": "Replay the retained preregistered artifact against the current evidence-provenance validation implementation.", + "retest_sha256": "f3edf713ac6af26bad609136851c6dd434bfb87ce919a2d8c4414c1035deeafc" + }, + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "baseline_sha256": "9536d897a09cbc6920e667e4f8f9371e51307aa0b3b5ff3c7de682dd783420ab", + "rationale": "Replay the retained preregistered artifact against the current evidence-provenance validation implementation.", + "retest_sha256": "e6fa559c5e961f0aab448d0f70dead24aa74fa8ba5f20e1b72f88e11473c9299" + }, + { + "artifact_path": "docs/explain/sdl/limitations.md", + "baseline_sha256": "129cf17810aad4c51988bc872e28fe43ae95019a80053c42d800ff7e2b9cc93e", + "rationale": "Correct historical mandatory-profile guidance after issue #1207; retain the preregistered missing-concept classifications and coverage limits.", + "retest_sha256": "489eeab3ce682627682311581eb98af9abb9ff42a437145af266eefb71dc7fc4" + } + ], + "execution_status": "complete", + "implementation_surfaces": [ + { + "content_sha256": "81923b0930e7f140cda10d59f7e6c17615b740f827813b431338a6a5db832f43", + "path": "implementations/python/packages/raes_contracts", + "surface_id": "contract-models" + }, + { + "content_sha256": "8bcffd29ade7652f029c9865c01ff4eee82846880e79ea88c3b035548cdc0026", + "path": "implementations/python/packages/raes_processor", + "surface_id": "processor-pipeline" + }, + { + "content_sha256": "a30bab3bcba48092b79d763704e3b4b23b292576fe791ca0524c9d38279b73c2", + "path": "implementations/python/packages/raes", + "surface_id": "sdl-pipeline" + } + ], + "limitations": [ + "The execution validates the pinned reference implementation and published contracts, not an independent backend.", + "Repository-owned examples are exact execution artifacts but are not themselves the literature-derived request corpus; the protocol's requests and concepts are.", + "No live range, participant, simulator federation, or provider provisioning engine was executed.", + "Missing concepts remain frozen in this snapshot and require separately scoped product work before a later rerun.", + "This capture replays the retained protocol after EXP-732 run, apparatus, measurement-channel, and augmentation-producer provenance validation; it adds no independent backend or universal provenance assurance claim.", + "Materialization attestation is covered by its dedicated regression suite, not a new claim in this preregistered matrix.", + "This capture refreshes the corrected runtime limitations prose for issue #959; the protocol, coverage classifications and implementation source are unchanged.", + "This capture replays open-by-default augmentation scope integrated with the EXP-731 evidence refinements after composition type refinement; it does not evaluate native backend scope enforcement or broaden the preregistered coverage claims.", + "This capture replays the retained protocol after merging ACT-612 participant relationships with open-by-default augmentation scope; it adds no claim of realized participant relationships or native backend scope enforcement.", + "This capture replays issue #1299 partial listener descriptions on the integrated source state; endpoint completeness and backend admission remain outside this protocol's claims.", + "This capture also binds authoring-adapter semantic conformance to the integrated source; adapter transport behavior remains outside this protocol's claims.", + "Reviewed OCI mirror and pre-seed admission is covered by its own regression suites and the development artifact policy gate, not a new claim in this preregistered matrix.", + "This capture binds issue #1297 service-manager identity, native-name, and explicitly selected systemd-state contract changes to the integrated source. It exercises no live service manager and adds no backend-execution claim.", + "This capture replays the retained specification-coverage protocol after API-404 startup reconciliation added an operational recovery-observation contract. It does not evaluate crash recovery, classify provider effects, or broaden EXP-715 experiment-observation claims.", + "This capture binds API-404 single-owner store admission and immutable target/run scope to the integrated source. The retained offline protocol does not exercise process leases, SQLite lifecycle ordering, or crash recovery.", + "This capture binds issue #1015 deterministic mixed and staged trial admission to the integrated source. The retained offline language corpus does not execute mixed runtimes, phase transitions, backend handoff, or scheduler-driven realization.", + "This replay binds issue #1186 offline control-plane maintenance, readiness, and bounded audit code to the integrated source. The retained language corpus does not execute store recovery, HTTP health behavior, or audit redaction.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 control-plane profile declarations are covered by their dedicated runtime suite, not promoted to new claims by the retained language corpus.", + "Issue #1016 mixed-runtime coordination is covered by its dedicated runtime suite. The retained language corpus does not execute mixed providers or establish backend-native realization, multi-controller coordination, IFC, or equivalence.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee." + ], + "protocol_revision": "1.0.0", + "protocol_sha256": "e97a19e643e94c9e589dca823a63c6ce49d3329fe2a3cb888ab630838ed93125", + "raes_revision": "86840a96890f12e5f5bc19c0e468bbb76799f095", + "snapshot_id": "raes-standardized-specification-coverage-issue-307-v69", + "snapshot_revision": "69.0.0", + "source_state": { + "base_revision": "86840a96890f12e5f5bc19c0e468bbb76799f095", + "checkout_state": "modified", + "implementation_digest": "e0cc2be360acaca1d0a131a1d317757f142bac316dc00e61b6a02fc1f7c69351", + "profile": "python-reference-source/v2" + } +} diff --git a/docs/research/specification-coverage/execution-snapshot-v70.json b/docs/research/specification-coverage/execution-snapshot-v70.json new file mode 100644 index 000000000..17d2ed93a --- /dev/null +++ b/docs/research/specification-coverage/execution-snapshot-v70.json @@ -0,0 +1,704 @@ +{ + "artifacts": [ + { + "artifact_id": "enterprise-participant-sdl", + "kind": "sdl", + "path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "sha256": "f7a8897beec243e188ee081975006fad32725f469f267db6e75a1e1cf5727032", + "validator": "raes parse, semantic, instantiation/admission, and compiler pipeline" + }, + { + "artifact_id": "port-range-sdl", + "kind": "sdl", + "path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "sha256": "0d5497ec946b863e6985284ec487dde7d7f6bf710a985be51401ac0e5e79dc4f", + "validator": "raes parse, semantic, instantiation/admission, and compiler pipeline" + }, + { + "artifact_id": "experiment-task-contract", + "kind": "experiment-task", + "path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "sha256": "f3edf713ac6af26bad609136851c6dd434bfb87ce919a2d8c4414c1035deeafc", + "validator": "raes_contracts.contracts.ExperimentTaskModel" + }, + { + "artifact_id": "apparatus-context-contract", + "kind": "experiment-apparatus-context", + "path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "sha256": "e6fa559c5e961f0aab448d0f70dead24aa74fa8ba5f20e1b72f88e11473c9299", + "validator": "raes_contracts.contracts.ExperimentApparatusContextModel" + }, + { + "artifact_id": "backend-profile", + "kind": "backend-profile", + "path": "contracts/profiles/backend/orchestration-capable.json", + "sha256": "f70b8505a5c0055416db86c533e2e5bf08b11e5a514f076223b6d6c36215a092", + "validator": "raes_contracts.backend_profiles.BackendProfileModel" + }, + { + "artifact_id": "known-limitations", + "kind": "documentation", + "path": "docs/explain/sdl/limitations.md", + "sha256": "489eeab3ce682627682311581eb98af9abb9ff42a437145af266eefb71dc7fc4", + "validator": "documentation evidence only" + } + ], + "baseline": { + "release_revision": "1.1.0", + "release_sha256": "4020a1d56c7fe2831cec59ea64a12bbda9d38ccd94f93b916dd90f1a28f17fcb" + }, + "captured_at": "2026-10-10T15:14:16.484268+00:00", + "concept_results": [ + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "range-topology", + "rationale": "SDL nodes and infrastructure own host, network, link, and dependency meaning; the compiler emits canonical node deployment addresses.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed VM declaration.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Links and dependencies resolved.", + "outcome": "passed", + "pointer": "/infrastructure/shipping-portal", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Published instantiated shape admitted.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical deployment address retained.", + "outcome": "passed", + "pointer": "/node_deployments/provision.node.shipping-portal", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/nodes/shipping-portal" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "exercise-roles", + "rationale": "SDL entity roles own exercise responsibility without becoming control-plane identity or authorization.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed red role.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant/role", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Entity references validated.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Role retained after instantiation.", + "outcome": "passed", + "pointer": "/entities/enterprise-participant/role", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Role retained in entity specification.", + "outcome": "passed", + "pointer": "/entity_specs/enterprise-participant/role", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/entities/enterprise-participant/role" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "evaluation-objectives", + "rationale": "SDL objectives own organization ownership, participant assignment, targets, windows, and assertion-based success; measures remain experiment contracts.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed objective declaration.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Owner, participant assignment, targets, assertions, and workflow refs resolved.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff/success", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Objective retained in admitted artifact.", + "outcome": "passed", + "pointer": "/objectives/demonstrate-handoff", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical objective address retained.", + "outcome": "passed", + "pointer": "/objectives/evaluation.objective.demonstrate-handoff", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/objectives/demonstrate-handoff" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "control-workflows", + "rationale": "SDL workflows own the portable control graph and compile to canonical orchestration state contracts.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed control graph.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Step graph and objective refs validated.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery/steps", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Workflow retained after instantiation.", + "outcome": "passed", + "pointer": "/workflows/yard-recovery", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical control graph retained.", + "outcome": "passed", + "pointer": "/workflows/orchestration.workflow.yard-recovery", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/workflows/yard-recovery" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "authored-evidence-expectations", + "rationale": "SDL evidence requirements own portable capture intent and remain distinct from evidence records and measures.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed capture obligation.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Source refs and bindings validated.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Evidence intent retained in admitted artifact.", + "outcome": "passed", + "pointer": "/evidence_requirements/objective-truth-evidence", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + } + ], + "typed_pointer": "/evidence_requirements/objective-truth-evidence" + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [], + "classification": "profile-or-manifest-constraint", + "completeness_disposition": "implemented", + "concept_id": "apparatus-selection-constraints", + "rationale": "The experiment task contract binds processor/backend identities, manifest refs, and capabilities outside SDL.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed ExperimentTaskModel validated.", + "outcome": "passed", + "pointer": "/apparatus_constraints/allowed_backend_refs/0", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/apparatus_constraints/allowed_backend_refs/0" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-agent", + "rationale": "SDL agents own participant entity, knowledge, actions, observation boundaries, and operating scope.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed participant declaration.", + "outcome": "passed", + "pointer": "/agents/participant-agent", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Participant refs and scope validated.", + "outcome": "passed", + "pointer": "/agents/participant-agent/observation_boundaries", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Participant retained in admitted artifact.", + "outcome": "passed", + "pointer": "/agents/participant-agent", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Compiled participant scope retained.", + "outcome": "passed", + "pointer": "/agent_specs/participant-agent", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/agents/participant-agent" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-action-contract", + "rationale": "The action contract declares portable preconditions, effects, observations, evidence, and failure classes without a runner command.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed action contract.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Action refs and evidence bindings validated.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login/effects", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Action retained in admitted artifact.", + "outcome": "passed", + "pointer": "/action_contracts/probe-customer-portal-login", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical action address retained.", + "outcome": "passed", + "pointer": "/action_contracts/participant.action-contract.probe-customer-portal-login", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/action_contracts/probe-customer-portal-login" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "participant-observation-boundary", + "rationale": "The observation boundary separately declares visible, hidden, and evidence-only information with transition rules.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed observation boundary.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Information refs and transitions validated.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view/view_rules", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Boundary retained in admitted artifact.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant-view", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "diagnostic_codes": [], + "note": "Canonical boundary address retained.", + "outcome": "passed", + "pointer": "/observation_boundaries/participant.observation-boundary.participant-view", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/observation_boundaries/participant-view" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "evaluation-measure", + "rationale": "ExperimentTaskModel owns metric construct, unit, direction, aggregation, and evidence requirements outside SDL objectives.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed task contract validated.", + "outcome": "passed", + "pointer": "/evaluation_protocol/metric_definitions/foothold-achieved", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/evaluation_protocol/metric_definitions/foothold-achieved" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "participant-tool-affordance", + "rationale": "This preregistered matrix has no tested carrier for participant tool affordances. The retained missing classification records missing coverage evidence, not the absence of current participant-behavior capabilities.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "The preregistered carrier slot was not run; metadata does not substitute for a typed coverage test.", + "outcome": "not_run", + "pointer": null, + "stage_id": "authored", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "directly-expressible", + "completeness_disposition": "implemented", + "concept_id": "resource-constrained-topology", + "rationale": "SDL node resources and infrastructure dependencies express portable resource intent without provider resource identifiers.", + "stage_results": [ + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Typed CPU and memory declaration.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal/resources", + "stage_id": "authored", + "validation_strength": "structural" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Resource-bearing topology validated.", + "outcome": "passed", + "pointer": "/infrastructure/shipping-portal", + "stage_id": "semantic", + "validation_strength": "semantic" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Constraints retained in admitted artifact.", + "outcome": "passed", + "pointer": "/nodes/shipping-portal/resources", + "stage_id": "instantiated", + "validation_strength": "phase-admitted" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "diagnostic_codes": [], + "note": "Deployment specification retains resource intent.", + "outcome": "passed", + "pointer": "/node_deployments/provision.node.shipping-portal", + "stage_id": "compiled", + "validation_strength": "compiled" + } + ], + "typed_pointer": "/nodes/shipping-portal/resources" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "formal-constraint-satisfiability", + "rationale": "This coverage matrix did not exercise a solver-backed carrier. The separate formal-semantic-validation release demonstrates its bounded finite-domain profile; that result is not silently imported into this protocol's missing carrier slot.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "No coverage-carrier execution was performed here; independent solver evidence does not change this preregistered denominator.", + "outcome": "not_run", + "pointer": null, + "stage_id": "semantic", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [ + { + "allowed": true, + "artifact_path": "source:vsdl-paper", + "pointer": "source sections 4-5", + "reason": "Legitimate VSDL realization vocabulary, not RAES core SDL structure.", + "term": "OpenStack/Terraform/Packer" + } + ], + "classification": "deliberately-backend-specific", + "completeness_disposition": "external", + "concept_id": "provider-specific-provisioning", + "rationale": "Provider image selection and provisioning engines are realization mechanics and therefore remain outside core SDL.", + "stage_results": [ + { + "artifact_path": "contracts/profiles/backend/orchestration-capable.json", + "diagnostic_codes": [], + "note": "The portable boundary requires backend contracts; it does not standardize a provider engine.", + "outcome": "not_applicable", + "pointer": "/required_contracts", + "stage_id": "realization-disclosure", + "validation_strength": "profile" + } + ], + "typed_pointer": null + }, + { + "backend_support": "profile-bound", + "backend_vocabulary_occurrences": [], + "classification": "profile-or-manifest-constraint", + "completeness_disposition": "implemented", + "concept_id": "apparatus-clock-context", + "rationale": "ExperimentApparatusContextModel records clock authority, time domain, and synchronization as apparatus facts outside scenario meaning.", + "stage_results": [ + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "diagnostic_codes": [], + "note": "Closed apparatus context contract validated.", + "outcome": "passed", + "pointer": "/clocks/0", + "stage_id": "contract", + "validation_strength": "contract" + } + ], + "typed_pointer": "/clocks/0" + }, + { + "backend_support": "not-evaluated", + "backend_vocabulary_occurrences": [], + "classification": "missing", + "completeness_disposition": "documented-gap", + "concept_id": "federated-object-event-exchange", + "rationale": "The federated cyber object/event exchange carrier was not exercised by this preregistered matrix. Runtime event internals are not treated as equivalent evidence.", + "stage_results": [ + { + "artifact_path": "docs/explain/sdl/limitations.md", + "diagnostic_codes": [], + "note": "The missing coverage-carrier test is recorded explicitly, without inferring an ecosystem-wide capability absence.", + "outcome": "not_run", + "pointer": null, + "stage_id": "contract", + "validation_strength": "not-applicable" + } + ], + "typed_pointer": null + } + ], + "deviations": [ + { + "artifact_path": "examples/scenarios/enterprise-participant-evidence-loop.sdl.yaml", + "baseline_sha256": "54ba1a60220e27a55da9cd2a407d7d3ab836fa54460d0b0c6cad87c2e744ddbb", + "rationale": "Migrate participant affiliations and explicit objective assignment, retaining organizational intent and portable action-contract declarations without granting execution authority.", + "retest_sha256": "f7a8897beec243e188ee081975006fad32725f469f267db6e75a1e1cf5727032" + }, + { + "artifact_path": "examples/scenarios/port-authority-surge-response.sdl.yaml", + "baseline_sha256": "a27c7a64e0c5c618fadaccafdf1a4e71600170a8b77b983190822b5141f00dec", + "rationale": "Migrate participant affiliations and explicit objective assignment, retaining organizational intent and portable action-contract declarations without granting execution authority.", + "retest_sha256": "0d5497ec946b863e6985284ec487dde7d7f6bf710a985be51401ac0e5e79dc4f" + }, + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-task-v1/valid/reference.json", + "baseline_sha256": "21952a752f4e8581a9fc3b872e4bc308150548170d38bcfc83dbbe35ff5e0b9f", + "rationale": "Replay the retained preregistered artifact against the current evidence-provenance validation implementation.", + "retest_sha256": "f3edf713ac6af26bad609136851c6dd434bfb87ce919a2d8c4414c1035deeafc" + }, + { + "artifact_path": "contracts/fixtures/experiment-core/experiment-apparatus-context-v1/valid/reference.json", + "baseline_sha256": "9536d897a09cbc6920e667e4f8f9371e51307aa0b3b5ff3c7de682dd783420ab", + "rationale": "Replay the retained preregistered artifact against the current evidence-provenance validation implementation.", + "retest_sha256": "e6fa559c5e961f0aab448d0f70dead24aa74fa8ba5f20e1b72f88e11473c9299" + }, + { + "artifact_path": "docs/explain/sdl/limitations.md", + "baseline_sha256": "129cf17810aad4c51988bc872e28fe43ae95019a80053c42d800ff7e2b9cc93e", + "rationale": "Correct historical mandatory-profile guidance after issue #1207; retain the preregistered missing-concept classifications and coverage limits.", + "retest_sha256": "489eeab3ce682627682311581eb98af9abb9ff42a437145af266eefb71dc7fc4" + } + ], + "execution_status": "complete", + "implementation_surfaces": [ + { + "content_sha256": "81923b0930e7f140cda10d59f7e6c17615b740f827813b431338a6a5db832f43", + "path": "implementations/python/packages/raes_contracts", + "surface_id": "contract-models" + }, + { + "content_sha256": "b56b0d93b1214bd6934cd82183b270b21738798674b316dafe51cb8acb862d9b", + "path": "implementations/python/packages/raes_processor", + "surface_id": "processor-pipeline" + }, + { + "content_sha256": "c78139343ba4a3990fba2b126615615368a6931edadf50c033d21d14d5737e4e", + "path": "implementations/python/packages/raes", + "surface_id": "sdl-pipeline" + } + ], + "limitations": [ + "The execution validates the pinned reference implementation and published contracts, not an independent backend.", + "Repository-owned examples are exact execution artifacts but are not themselves the literature-derived request corpus; the protocol's requests and concepts are.", + "No live range, participant, simulator federation, or provider provisioning engine was executed.", + "Missing concepts remain frozen in this snapshot and require separately scoped product work before a later rerun.", + "This capture replays the retained protocol after EXP-732 run, apparatus, measurement-channel, and augmentation-producer provenance validation; it adds no independent backend or universal provenance assurance claim.", + "Materialization attestation is covered by its dedicated regression suite, not a new claim in this preregistered matrix.", + "This capture refreshes the corrected runtime limitations prose for issue #959; the protocol, coverage classifications and implementation source are unchanged.", + "This capture replays open-by-default augmentation scope integrated with the EXP-731 evidence refinements after composition type refinement; it does not evaluate native backend scope enforcement or broaden the preregistered coverage claims.", + "This capture replays the retained protocol after merging ACT-612 participant relationships with open-by-default augmentation scope; it adds no claim of realized participant relationships or native backend scope enforcement.", + "This capture replays issue #1299 partial listener descriptions on the integrated source state; endpoint completeness and backend admission remain outside this protocol's claims.", + "This capture also binds authoring-adapter semantic conformance to the integrated source; adapter transport behavior remains outside this protocol's claims.", + "Reviewed OCI mirror and pre-seed admission is covered by its own regression suites and the development artifact policy gate, not a new claim in this preregistered matrix.", + "This capture binds issue #1297 service-manager identity, native-name, and explicitly selected systemd-state contract changes to the integrated source. It exercises no live service manager and adds no backend-execution claim.", + "This capture replays the retained specification-coverage protocol after API-404 startup reconciliation added an operational recovery-observation contract. It does not evaluate crash recovery, classify provider effects, or broaden EXP-715 experiment-observation claims.", + "This capture binds API-404 single-owner store admission and immutable target/run scope to the integrated source. The retained offline protocol does not exercise process leases, SQLite lifecycle ordering, or crash recovery.", + "This capture binds issue #1015 deterministic mixed and staged trial admission to the integrated source. The retained offline language corpus does not execute mixed runtimes, phase transitions, backend handoff, or scheduler-driven realization.", + "This replay binds issue #1186 offline control-plane maintenance, readiness, and bounded audit code to the integrated source. The retained language corpus does not execute store recovery, HTTP health behavior, or audit redaction.", + "Issue #1187 control-plane crash/profile conformance and HTTP security changes are covered by their dedicated regression suite, not promoted to new claims by this retained corpus.", + "Issue #1189 control-plane profile declarations are covered by their dedicated runtime suite, not promoted to new claims by the retained language corpus.", + "Issue #1016 mixed-runtime coordination is covered by its dedicated runtime suite. The retained language corpus does not execute mixed providers or establish backend-native realization, multi-controller coordination, IFC, or equivalence.", + "Issue #610's reconciliation demonstration harness is covered by its dedicated processor and CLI suite, not promoted to new claims by the retained language corpus.", + "Participant identity, organization ownership, and participant assignment are separated by issue #1338. This retained offline corpus does not establish participant autonomy, execution authority, live backend fidelity, or causal attribution.", + "Issue #1361 execution and recovery requirements are verified by dedicated policy, composition, and admission tests; this retained corpus establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 maintainability repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The issue #1361 resource type-hint repair preserves policy semantics and retained corpus outcomes; it establishes no live recovery, continuation, or trial-allocation guarantee.", + "The combined issue #1361 execution-policy and hatchling update preserves retained outcomes and bounded claims; it establishes no live recovery, continuation, or trial-allocation guarantee." + ], + "protocol_revision": "1.0.0", + "protocol_sha256": "e97a19e643e94c9e589dca823a63c6ce49d3329fe2a3cb888ab630838ed93125", + "raes_revision": "a0bcf20e8a9f7cde928b3987f8a792d0a85d1cc9", + "snapshot_id": "raes-standardized-specification-coverage-issue-309-v70", + "snapshot_revision": "70.0.0", + "source_state": { + "base_revision": "a0bcf20e8a9f7cde928b3987f8a792d0a85d1cc9", + "checkout_state": "modified", + "implementation_digest": "24446d9191a749847670b888918d12f05d47830bdabc8a3c8b3f9821c89ecb15", + "profile": "python-reference-source/v2" + } +} diff --git a/docs/research/specification-coverage/index.md b/docs/research/specification-coverage/index.md index d2c1a57a2..c83193c57 100644 --- a/docs/research/specification-coverage/index.md +++ b/docs/research/specification-coverage/index.md @@ -292,7 +292,7 @@ the port scenario. Historical captures and archived example bytes are retained. The matrix classifications and untested concepts are unchanged; no execution authority, successful action, or live backend fidelity is inferred. -Current validation requires release 68.0.0 and rejects duplicate or unsupported +Current validation requires release 70.0.0 and rejects duplicate or unsupported future revisions. It executes current artifacts, requires exact source and package hashes, and checks all passing stage pointers. `source_state` discloses the base Git commit, modified checkout state, and exact implementation digest; @@ -527,3 +527,15 @@ and [`analysis-v68.json`](analysis-v68.json). The incoming release 67.0.0 retains its original bytes. Pre-synchronization issue #1361 captures are [archived with exact digests](../execution-recovery-pre-sync-evidence/README.md). Retained outcomes and bounded claim limits are unchanged. + +Release 69.0.0 replays the retained matrix after issue #307 added optional +authored participant episode policies to behavior specifications, in +[`execution-snapshot-v69.json`](execution-snapshot-v69.json) and +[`analysis-v69.json`](analysis-v69.json). Classifications and claim limits +remain unchanged. + +Release 70.0.0 replays the retained matrix after issue #309 made participant +episode structure a first-class member of the behavior specification aggregate, +in [`execution-snapshot-v70.json`](execution-snapshot-v70.json) and +[`analysis-v70.json`](analysis-v70.json). Classifications and claim limits +remain unchanged. diff --git a/implementations/python/packages/raes/_language_metadata.py b/implementations/python/packages/raes/_language_metadata.py index 68c810a88..c3dc9dc94 100644 --- a/implementations/python/packages/raes/_language_metadata.py +++ b/implementations/python/packages/raes/_language_metadata.py @@ -67,6 +67,8 @@ ("behavior_specifications", "observation_boundary_ref"): "observation_boundaries", ("behavior_specifications", "temporal_constraint_refs"): "temporal_constraints", ("behavior_specifications", "evidence_requirement_refs"): "evidence_requirements", + ("behavior_specifications", "assertion_refs"): "assertions", + ("behavior_specifications", "temporal_constraint_ref"): "temporal_constraints", ("behavior_specifications", "controller_ref"): "agents", ("behavior_specifications", "control_authority_scope_refs"): "targetable", ("behavior_specifications", "control_evidence_refs"): "targetable", @@ -194,6 +196,7 @@ "evidence_contract_refs", "tool_affordances", "participant_inject_deliveries", + "episode_policy", "extension_policy", "extensions", ), diff --git a/implementations/python/packages/raes/_mapping_scopes.py b/implementations/python/packages/raes/_mapping_scopes.py index e80c9ca2d..b645a33d3 100644 --- a/implementations/python/packages/raes/_mapping_scopes.py +++ b/implementations/python/packages/raes/_mapping_scopes.py @@ -80,6 +80,8 @@ class MappingScope(str, Enum): "fixed_positions", "tool_affordances", "participant_inject_deliveries", + "terminal_conditions", + "truncation_conditions", "owners", "dimensions", } diff --git a/implementations/python/packages/raes/composition/_behavior.py b/implementations/python/packages/raes/composition/_behavior.py index f4fd4baa2..9a6a13866 100644 --- a/implementations/python/packages/raes/composition/_behavior.py +++ b/implementations/python/packages/raes/composition/_behavior.py @@ -1,8 +1,8 @@ """Behavior-specification and agent reference rewriters for composition. Autonomous resource budgets, mixed-control state, tool affordances, participant -inject deliveries, agent sections, and the behavior-reference maps that seed -namespaced tool-affordance / inject-delivery identifiers. +inject deliveries, episode policies, agent sections, and the behavior-reference +maps that seed namespaced tool-affordance / inject-delivery identifiers. """ from __future__ import annotations @@ -149,6 +149,56 @@ def _rewrite_participant_inject_delivery( ] +_EPISODE_POLICY_REF_LISTS = ( + ("assertion_refs", "assertions"), + ("action_contract_refs", "action_contracts"), + ("evidence_requirement_refs", "evidence_requirements"), +) +_EPISODE_POLICY_REFS = ( + ("temporal_constraint_ref", "temporal_constraints"), + # The reset authority is any one targetable declaration, like authority_scope_refs. + ("memory_reset_authority_ref", "named"), +) + + +def _episode_policy_records(policy: dict[str, Any]) -> list[object]: + records: list[object] = [ + policy.get("initialization"), + policy.get("interaction_structure"), + policy.get("reset_policy"), + ] + for field_name in ("terminal_conditions", "truncation_conditions"): + conditions = policy.get(field_name) + if isinstance(conditions, dict): + records.extend(conditions.values()) + return records + + +def _rewrite_participant_episode_policy( + policy: object, + symbols: dict[str, dict[str, str] | set[str]], +) -> None: + """Rewrite episode-policy refs; condition ids stay local to the policy.""" + + if not isinstance(policy, dict): + return + for record in _episode_policy_records(policy): + if isinstance(record, dict): + _rewrite_episode_policy_record(record, symbols) + + +def _rewrite_episode_policy_record( + record: dict[str, Any], + symbols: dict[str, dict[str, str] | set[str]], +) -> None: + for field_name, section in _EPISODE_POLICY_REF_LISTS: + if isinstance(record.get(field_name), list): + record[field_name] = [_maybe_rename(str(ref), symbols[section]) for ref in record[field_name]] + for field_name, section in _EPISODE_POLICY_REFS: + if record.get(field_name): + record[field_name] = _maybe_rename(str(record[field_name]), symbols[section]) + + def _behavior_reference_maps( payload: dict[str, Any], symbols: dict[str, dict[str, str] | set[str]], @@ -297,6 +347,7 @@ def _rewrite_behavior_specification( for binding in behavior_spec.get("participant_inject_deliveries", {}).values(): if isinstance(binding, dict): _rewrite_participant_inject_delivery(binding, symbols) + _rewrite_participant_episode_policy(behavior_spec.get("episode_policy"), symbols) def _rewrite_behavior_sections( diff --git a/implementations/python/packages/raes/participant_behavior_specification.py b/implementations/python/packages/raes/participant_behavior_specification.py index 1ecc83c8b..85494f812 100644 --- a/implementations/python/packages/raes/participant_behavior_specification.py +++ b/implementations/python/packages/raes/participant_behavior_specification.py @@ -12,6 +12,7 @@ from ._base import SDLModel from ._classification_guard import LegacyClassificationGuard from ._identifiers import PortableIdentifier +from .participant_episode_policy import ParticipantEpisodePolicy from .participant_execution import ParticipantAutonomousExecutionPolicy from .participant_inject_delivery import ParticipantInjectDelivery @@ -341,6 +342,7 @@ class ParticipantBehaviorSpecification(LegacyClassificationGuard): default_factory=dict, json_schema_extra={"additionalProperties": False}, ) + episode_policy: ParticipantEpisodePolicy | None = Field(default=None, exclude_if=lambda value: value is None) extension_policy: str = "governed-extension" extensions: dict[str, BehaviorSpecificationExtensionValue] = Field(default_factory=dict) @@ -413,6 +415,7 @@ def _validate_aggregate_shape(self) -> ParticipantBehaviorSpecification: self.evidence_contract_refs, self.tool_affordances, self.participant_inject_deliveries, + self.episode_policy, ) ): raise ValueError("behavior specifications must aggregate at least one behavior surface reference") diff --git a/implementations/python/packages/raes/participant_episode_policy.py b/implementations/python/packages/raes/participant_episode_policy.py new file mode 100644 index 000000000..0ed6c6851 --- /dev/null +++ b/implementations/python/packages/raes/participant_episode_policy.py @@ -0,0 +1,246 @@ +"""Authored participant episode structure and termination intent (DSL-120). + +An episode policy is participant *intent* attached to one behavior +specification. It names the closed SDL declarations that define episode +initialization, the turn order authority, terminal and truncation conditions, +and reset-related policy. It is never an execution record: realized episode +identity, lifecycle state, terminal reasons, history and decision epochs stay on +the ADR-013 participant episode contracts and the ADR-095 decision surface. +""" + +from __future__ import annotations + +from dataclasses import fields +from enum import Enum +from typing import Annotated, Any, ClassVar, Literal, TypeVar + +from pydantic import AfterValidator, Field, GetJsonSchemaHandler, model_validator +from pydantic_core import CoreSchema +from raes_contracts.participant_episode import ( + ParticipantEpisodeControlAction, + ParticipantEpisodeExecutionState, + ParticipantEpisodeHistoryEvent, +) + +from ._base import SDLModel +from ._identifiers import PortableIdentifier + +# Realized coordinates owned by the ADR-013 episode state and history contracts, +# plus the ADR-095 decision epoch that callers never author. A policy record that +# carries one of them would be asserting execution rather than declaring intent. +REALIZED_EPISODE_STATE_FIELDS = frozenset( + {item.name for item in fields(ParticipantEpisodeExecutionState)} + | {item.name for item in fields(ParticipantEpisodeHistoryEvent)} + | {"decision_epoch"} +) +# A policy must declare at least one of these elements. +_STRUCTURE_RECORDS = ("initialization", "interaction_structure", "reset_policy") +_STRUCTURE_MAPS = ("terminal_conditions", "truncation_conditions") + +_Item = TypeVar("_Item") + + +def _unique_items(values: list[_Item]) -> list[_Item]: + if len(values) != len(set(values)): + raise ValueError("participant episode policy lists must not repeat an item") + return values + + +EpisodePolicyRef = Annotated[str, Field(min_length=1, pattern=r"\S")] +EpisodePolicyRefs = Annotated[ + list[EpisodePolicyRef], + Field(min_length=1, json_schema_extra={"uniqueItems": True}), + AfterValidator(_unique_items), +] + + +class ParticipantEpisodeTurnOrderBasis(str, Enum): + """Authority that orders a participant's turns.""" + + DECISION_EPOCH = "decision-epoch" + + +class ParticipantEpisodeResetAction(str, Enum): + """ADR-013 control actions that start a later episode.""" + + RESET = ParticipantEpisodeControlAction.RESET.value + RESTART = ParticipantEpisodeControlAction.RESTART.value + + +class ParticipantEpisodeMemoryScope(str, Enum): + """ADR-095 participant-memory scope across a reset.""" + + EPISODE_LOCAL_RESET = "episode_local_reset" + PERSISTENT_ACROSS_EPISODES = "persistent_across_episodes" + + +class _EpisodePolicyIntent(SDLModel): + """Closed policy record that rejects realized episode state by name.""" + + # Set by a condition whose map already fixes its terminal reason. + implied_terminal_reason: ClassVar[str | None] = None + + @model_validator(mode="before") + @classmethod + def _reject_realized_episode_state(cls, data: object) -> object: + if not isinstance(data, dict): + return data + if cls.implied_terminal_reason is not None and "terminal_reason" in data: + raise ValueError( + f"these conditions always end the episode as {cls.implied_terminal_reason} and carry no terminal_reason" + ) + realized = sorted(REALIZED_EPISODE_STATE_FIELDS.intersection(data) - set(cls.model_fields)) + if realized: + raise ValueError( + "participant episode policies declare intent only; realized episode state belongs to " + "the ADR-013 participant episode state and history contracts: " + ", ".join(realized) + ) + return data + + +class ParticipantEpisodeInitialization(_EpisodePolicyIntent): + """Preconditions of every new episode generation.""" + + assertion_refs: EpisodePolicyRefs + + +class ParticipantEpisodeInteractionStructure(_EpisodePolicyIntent): + """Turn order authority and the actions a turn offers.""" + + order_basis: ParticipantEpisodeTurnOrderBasis + action_contract_refs: EpisodePolicyRefs + + +class ParticipantEpisodeCompletionCondition(_EpisodePolicyIntent): + """Evidenced assertions that end the episode as completed.""" + + terminal_reason: Literal["completed"] + assertion_refs: EpisodePolicyRefs + evidence_requirement_refs: EpisodePolicyRefs + + +class ParticipantEpisodeTimeoutCondition(_EpisodePolicyIntent): + """Evidenced clock limit that ends the episode as timed out.""" + + terminal_reason: Literal["timed_out"] + temporal_constraint_ref: EpisodePolicyRef + evidence_requirement_refs: EpisodePolicyRefs + + +ParticipantEpisodeTerminalCondition = Annotated[ + ParticipantEpisodeCompletionCondition | ParticipantEpisodeTimeoutCondition, + Field(discriminator="terminal_reason"), +] + + +class ParticipantEpisodeTruncationCondition(_EpisodePolicyIntent): + """Evidenced assertions that end the episode as truncated.""" + + implied_terminal_reason: ClassVar[str | None] = "truncated" + + assertion_refs: EpisodePolicyRefs + evidence_requirement_refs: EpisodePolicyRefs + + +class ParticipantEpisodeResetPolicy(_EpisodePolicyIntent): + """Admitted reset actions, memory scope, reset authority, and evidence.""" + + # The ADR-095 assurance and information-state contracts require the same pairing: an + # episode_local_reset scope names the authority that resets the participant + # implementation and every participant-visible memory channel, and a + # persistent_across_episodes scope claims no reset authority. Semantic + # validation resolves the authority to exactly one declared targetable element. + + control_actions: Annotated[ + list[ParticipantEpisodeResetAction], + Field(min_length=1, json_schema_extra={"uniqueItems": True}), + AfterValidator(_unique_items), + ] + participant_memory_scope: ParticipantEpisodeMemoryScope + memory_reset_authority_ref: EpisodePolicyRef | None = None + evidence_requirement_refs: EpisodePolicyRefs + + @model_validator(mode="after") + def _validate_reset_authority(self) -> ParticipantEpisodeResetPolicy: + local = self.participant_memory_scope is ParticipantEpisodeMemoryScope.EPISODE_LOCAL_RESET + if local and self.memory_reset_authority_ref is None: + raise ValueError("episode_local_reset memory scope requires memory_reset_authority_ref") + if not local and self.memory_reset_authority_ref is not None: + raise ValueError("persistent_across_episodes memory scope must not claim a reset authority") + return self + + @classmethod + def __get_pydantic_json_schema__(cls, core_schema: CoreSchema, handler: GetJsonSchemaHandler) -> dict[str, Any]: + json_schema = handler.resolve_ref_schema(handler(core_schema)) + json_schema["allOf"] = [ + { + "if": {"properties": {"participant_memory_scope": {"const": "episode_local_reset"}}}, + "then": { + "required": ["memory_reset_authority_ref"], + "properties": {"memory_reset_authority_ref": {"type": "string"}}, + }, + "else": {"properties": {"memory_reset_authority_ref": {"type": "null"}}}, + } + ] + return json_schema + + +class ParticipantEpisodePolicy(_EpisodePolicyIntent): + """Versioned episode structure intent of a behavior specification.""" + + profile: Literal["participant-episode-policy/v1"] + initialization: ParticipantEpisodeInitialization | None = None + interaction_structure: ParticipantEpisodeInteractionStructure | None = None + terminal_conditions: dict[PortableIdentifier, ParticipantEpisodeTerminalCondition] = Field( + default_factory=dict, + json_schema_extra={"additionalProperties": False}, + ) + truncation_conditions: dict[PortableIdentifier, ParticipantEpisodeTruncationCondition] = Field( + default_factory=dict, + json_schema_extra={"additionalProperties": False}, + ) + reset_policy: ParticipantEpisodeResetPolicy | None = None + + @model_validator(mode="after") + def _validate_policy_shape(self) -> ParticipantEpisodePolicy: + if not any(getattr(self, name) for name in (*_STRUCTURE_RECORDS, *_STRUCTURE_MAPS)): + raise ValueError("participant episode policies must declare at least one episode structure element") + shared = sorted(set(self.terminal_conditions).intersection(self.truncation_conditions)) + if shared: + raise ValueError( + "participant episode condition ids must be unique across terminal and truncation conditions: " + + ", ".join(shared) + ) + # One evidenced set of assertions cannot end an episode as both completed and truncated. + completions = { + frozenset(condition.assertion_refs) + for condition in self.terminal_conditions.values() + if isinstance(condition, ParticipantEpisodeCompletionCondition) + } + aliases = sorted( + condition_id + for condition_id, condition in self.truncation_conditions.items() + if frozenset(condition.assertion_refs) in completions + ) + if aliases: + raise ValueError( + "participant episode truncation conditions must not reuse the assertions of a completion condition: " + + ", ".join(aliases) + ) + return self + + +__all__ = [ + "REALIZED_EPISODE_STATE_FIELDS", + "ParticipantEpisodeCompletionCondition", + "ParticipantEpisodeInitialization", + "ParticipantEpisodeInteractionStructure", + "ParticipantEpisodeMemoryScope", + "ParticipantEpisodePolicy", + "ParticipantEpisodeResetAction", + "ParticipantEpisodeResetPolicy", + "ParticipantEpisodeTerminalCondition", + "ParticipantEpisodeTimeoutCondition", + "ParticipantEpisodeTruncationCondition", + "ParticipantEpisodeTurnOrderBasis", +] diff --git a/implementations/python/packages/raes/validator/__init__.py b/implementations/python/packages/raes/validator/__init__.py index 289882ed7..b020f1deb 100644 --- a/implementations/python/packages/raes/validator/__init__.py +++ b/implementations/python/packages/raes/validator/__init__.py @@ -12,6 +12,7 @@ from ._execution_policy import _ExecutionPolicyMixin from ._mixed_control import _MixedControlMixin from ._nodes_infra_network import _NodesInfraNetworkMixin +from ._participant_episode_policies import _ParticipantEpisodePoliciesMixin from ._participant_inject_deliveries import _ParticipantInjectDeliveriesMixin from ._participant_relationships import _ParticipantRelationshipsMixin from ._participant_tool_affordances import _ParticipantToolAffordancesMixin @@ -49,6 +50,7 @@ class SemanticValidator( _RelationshipsMixin, _RelationshipsProxyMixin, _MixedControlMixin, + _ParticipantEpisodePoliciesMixin, _ParticipantInjectDeliveriesMixin, _ParticipantRelationshipsMixin, _ParticipantToolAffordancesMixin, diff --git a/implementations/python/packages/raes/validator/_content_objectives.py b/implementations/python/packages/raes/validator/_content_objectives.py index ae1eb1b5e..b1568c581 100644 --- a/implementations/python/packages/raes/validator/_content_objectives.py +++ b/implementations/python/packages/raes/validator/_content_objectives.py @@ -380,6 +380,7 @@ def _verify_participant_behavior(self) -> None: self._err(error) self._verify_tool_affordance_tool_refs() self._verify_participant_inject_deliveries() + self._verify_participant_episode_policies() self._verify_participant_interaction_refs() self._verify_behavior_specification_authority_refs() self._verify_mixed_control_semantics() diff --git a/implementations/python/packages/raes/validator/_participant_episode_policies.py b/implementations/python/packages/raes/validator/_participant_episode_policies.py new file mode 100644 index 000000000..75031ab64 --- /dev/null +++ b/implementations/python/packages/raes/validator/_participant_episode_policies.py @@ -0,0 +1,195 @@ +"""Participant episode policy reference validation (DSL-120). + +Every reference an authored episode policy makes must resolve to an existing +closed SDL declaration of the right kind and role, and the policy must be the +only one that governs each participant it selects. Nothing here evaluates a +condition or observes an episode; realized episode state stays on the ADR-013 +contracts. Checks that depend on a participant selection or reference that is +still a ``${var}`` wait for the post-instantiation validation pass. +""" + +from __future__ import annotations + +from collections.abc import Iterable +from dataclasses import dataclass + +from ..participant_episode_policy import ParticipantEpisodeTimeoutCondition +from ..propositions import AssertionRole +from ..semantics.participant_behavior import select_participants +from ..time_model import TemporalConstraintKind + +_DECLARATION_INDEX_REQUIRED = "declaration index must be built before reference validation" +# Constraint kinds that bound elapsed shared time, so their expiry can be a +# timeout. Precedence and cadence constrain order or rhythm, not a limit. +_TIMEOUT_CONSTRAINT_KINDS = frozenset( + { + TemporalConstraintKind.DEADLINE, + TemporalConstraintKind.WINDOW, + TemporalConstraintKind.DURATION, + } +) +# Initialization constrains the start boundary of each episode generation; +# terminal and truncation conditions constrain its end boundary. +_INITIALIZATION_ROLES = frozenset({AssertionRole.PRECONDITION}) +_CLOSURE_ROLES = frozenset({AssertionRole.INVARIANT, AssertionRole.POSTCONDITION}) + + +@dataclass(frozen=True) +class _EpisodeOwner: + """The behavior specification that owns a policy and the participants it selects.""" + + spec_name: str + behavior_spec: object + participants: frozenset[str] + selection_resolved: bool + + +class _ParticipantEpisodePoliciesMixin: + def _verify_participant_episode_policies(self) -> None: + if self._declaration_index is None: + raise RuntimeError(_DECLARATION_INDEX_REQUIRED) + governed = [ + (str(spec_name), behavior_spec) + for spec_name, behavior_spec in self._s.behavior_specifications.items() + if behavior_spec.episode_policy is not None + ] + if not governed: + return + roles = self._participant_roles_by_agent() + owners = [self._episode_owner(spec_name, behavior_spec, roles) for spec_name, behavior_spec in governed] + for owner in owners: + self._verify_episode_policy(owner) + self._verify_one_episode_policy_per_participant(owners) + + def _episode_owner(self, spec_name: str, behavior_spec: object, roles: dict[str, str]) -> _EpisodeOwner: + role_selected = bool(behavior_spec.participant_role_refs) + unresolved = any(self._is_unresolved_var(ref) for ref in behavior_spec.participant_refs) or ( + role_selected + and any(self._is_unresolved_var(ref) for ref in (*behavior_spec.participant_role_refs, *roles.values())) + ) + participants = frozenset(select_participants(behavior_spec, set(self._s.agents), roles)) + return _EpisodeOwner(spec_name, behavior_spec, participants, selection_resolved=not unresolved) + + def _verify_one_episode_policy_per_participant(self, owners: list[_EpisodeOwner]) -> None: + # Realized ADR-013 episodes are keyed by participant, so a participant whose + # episodes two policies govern would have no single authored structure. + governing: dict[str, list[str]] = {} + for owner in owners: + for participant in owner.participants: + governing.setdefault(participant, []).append(owner.spec_name) + for participant, spec_names in sorted(governing.items()): + if len(spec_names) > 1: + joined = ", ".join(f"'{name}'" for name in sorted(spec_names)) + self._err( + f"Participant '{participant}' is governed by more than one episode policy " + f"(behavior specifications {joined})" + ) + + def _verify_episode_policy(self, owner: _EpisodeOwner) -> None: + policy = owner.behavior_spec.episode_policy + label = f"Behavior specification '{owner.spec_name}' episode policy" + if policy.initialization is not None: + self._verify_episode_assertions( + f"{label} initialization", + policy.initialization.assertion_refs, + _INITIALIZATION_ROLES, + "a precondition", + ) + if policy.interaction_structure is not None: + self._verify_episode_turn_actions(label, owner, policy.interaction_structure.action_contract_refs) + for condition_id, condition in policy.terminal_conditions.items(): + condition_label = f"{label} terminal condition '{condition_id}'" + if isinstance(condition, ParticipantEpisodeTimeoutCondition): + self._verify_episode_timeout(condition_label, condition.temporal_constraint_ref, owner) + else: + self._verify_closure_assertions(condition_label, condition.assertion_refs) + self._verify_episode_evidence(condition_label, condition.evidence_requirement_refs) + for condition_id, condition in policy.truncation_conditions.items(): + condition_label = f"{label} truncation condition '{condition_id}'" + self._verify_closure_assertions(condition_label, condition.assertion_refs) + self._verify_episode_evidence(condition_label, condition.evidence_requirement_refs) + if policy.reset_policy is not None: + self._verify_episode_reset_policy(f"{label} reset policy", policy.reset_policy) + + def _verify_episode_reset_policy(self, label: str, reset_policy: object) -> None: + # The ADR-095 reset authority must be exactly one declared targetable element. + authority = reset_policy.memory_reset_authority_ref + if authority is not None and not self._is_unresolved_var(authority): + self._validate_named_ref( + authority, + owner_label=label, + ref_label="memory_reset_authority_ref", + targetable=True, + ) + self._verify_episode_evidence(label, reset_policy.evidence_requirement_refs) + + def _verify_closure_assertions(self, label: str, refs: Iterable[str]) -> None: + self._verify_episode_assertions(label, refs, _CLOSURE_ROLES, "an invariant or postcondition") + + def _verify_episode_assertions( + self, + label: str, + refs: Iterable[str], + roles: frozenset[AssertionRole], + role_label: str, + ) -> None: + for ref in refs: + if self._is_unresolved_var(ref): + continue + assertion = self._s.assertions.get(ref) + if assertion is None: + self._err(f"{label} assertion '{ref}' not in assertions section") + elif assertion.role not in roles: + self._err(f"{label} assertion '{ref}' must be {role_label}") + + def _verify_episode_turn_actions(self, label: str, owner: _EpisodeOwner, refs: Iterable[str]) -> None: + spec_actions = owner.behavior_spec.action_contract_refs + spec_actions_resolved = not any(self._is_unresolved_var(ref) for ref in spec_actions) + for ref in refs: + if self._is_unresolved_var(ref): + continue + ref_label = f"{label} interaction_structure action_contract_ref '{ref}'" + if spec_actions_resolved and ref not in spec_actions: + self._err(f"{ref_label} is outside the owning behavior specification") + for participant in sorted(owner.participants): + actions = self._s.agents[participant].actions + if ref not in actions and not any(self._is_unresolved_var(action) for action in actions): + self._err(f"{ref_label} is outside participant '{participant}'") + + def _verify_episode_timeout(self, label: str, ref: str, owner: _EpisodeOwner) -> None: + if self._is_unresolved_var(ref): + return + constraint = self._s.temporal_constraints.get(ref) + if constraint is None: + self._err(f"{label} temporal_constraint_ref '{ref}' does not reference a declared temporal constraint") + return + if constraint.constraint_kind not in _TIMEOUT_CONSTRAINT_KINDS: + self._err(f"{label} temporal_constraint_ref '{ref}' must be a deadline, window, or duration constraint") + if not owner.selection_resolved or any(self._is_unresolved_var(subject) for subject in constraint.subject_refs): + return + subjects: set[str] = set() + for subject in constraint.subject_refs: + subjects |= self._declaration_index.resolve(subject) + if not self._timeout_binds_owner(owner, subjects): + self._err( + f"{label} temporal_constraint_ref '{ref}' binds neither the owning behavior specification " + "nor every participant it selects" + ) + + def _timeout_binds_owner(self, owner: _EpisodeOwner, subjects: set[str]) -> bool: + # A timeout applies to every selected participant's episode, so its clock limit + # must bind the specification itself or each of those participants. + if self._declaration_index.resolve(f"behavior_specifications.{owner.spec_name}") & subjects: + return True + return bool(owner.participants) and all( + self._declaration_index.resolve(f"agents.{participant}") & subjects for participant in owner.participants + ) + + def _verify_episode_evidence(self, label: str, refs: Iterable[str]) -> None: + for ref in refs: + if self._is_unresolved_var(ref): + continue + if ref not in self._s.evidence_requirements: + self._err( + f"{label} evidence_requirement_ref '{ref}' does not reference a declared evidence requirement" + ) diff --git a/implementations/python/packages/raes_conformance/conformance/__init__.py b/implementations/python/packages/raes_conformance/conformance/__init__.py index b0ede9fbd..9d8cf7d6d 100644 --- a/implementations/python/packages/raes_conformance/conformance/__init__.py +++ b/implementations/python/packages/raes_conformance/conformance/__init__.py @@ -11,6 +11,9 @@ from raes_conformance.conformance.observability import ( observability_evidence_conformance_diagnostics, ) +from raes_conformance.conformance.participant_episode_structure import ( + participant_episode_structure_conformance_diagnostics, +) from raes_conformance.conformance.profiles import ( BackendCapabilityProfile, BackendProfileSelector, @@ -53,6 +56,7 @@ "contract_validation_strength", "fixtures_root", "observability_evidence_conformance_diagnostics", + "participant_episode_structure_conformance_diagnostics", "profile_for_manifest", "profiles_root", "required_contracts", diff --git a/implementations/python/packages/raes_conformance/conformance/diagnostics.py b/implementations/python/packages/raes_conformance/conformance/diagnostics.py index eb69cd55e..b2c19c350 100644 --- a/implementations/python/packages/raes_conformance/conformance/diagnostics.py +++ b/implementations/python/packages/raes_conformance/conformance/diagnostics.py @@ -11,6 +11,7 @@ _SEMANTIC_INVALID_DIAGNOSTIC_CODE = "conformance.semantic-invalid" _OBSERVABILITY_EVIDENCE_INVALID_DIAGNOSTIC_CODE = "conformance.observability-evidence-invalid" +_PARTICIPANT_EPISODE_STRUCTURE_INVALID_DIAGNOSTIC_CODE = "conformance.participant-episode-structure-invalid" _MAX_REPORTED_VALIDATION_ERRORS = 5 diff --git a/implementations/python/packages/raes_conformance/conformance/participant_episode_structure.py b/implementations/python/packages/raes_conformance/conformance/participant_episode_structure.py new file mode 100644 index 000000000..49d7ce47a --- /dev/null +++ b/implementations/python/packages/raes_conformance/conformance/participant_episode_structure.py @@ -0,0 +1,103 @@ +"""Participant episode-structure conformance (ACT-623). + +A behavior specification's compiled episode policy is the first-class episode +structure of every participant it selects. These diagnostics compare recorded +ADR-013 episode history for those participants with that structure: a realized +terminal reason must come from an authored condition unless the stop was an +externally induced interruption, and a recorded reset or restart must be one the +reset policy admits. Snapshot integrity itself stays with +``iter_participant_episode_snapshot_violations``; nothing here evaluates an +authored condition or claims that a backend enforces the policy. +""" + +from __future__ import annotations + +from collections.abc import Iterator, Mapping + +from raes_contracts.diagnostics import Diagnostic +from raes_contracts.participant_episode import ( + ParticipantEpisodeControlAction, + ParticipantEpisodeHistoryEvent, + ParticipantEpisodeTerminalReason, +) +from raes_processor.models import ParticipantEpisodePolicyRuntime + +from raes_conformance.conformance.diagnostics import ( + _PARTICIPANT_EPISODE_STRUCTURE_INVALID_DIAGNOSTIC_CODE, + _diagnostic, +) + +_HISTORY_KEY = "runtime.snapshot.participant-episode-history" +_RESET_ACTIONS = frozenset({ParticipantEpisodeControlAction.RESET, ParticipantEpisodeControlAction.RESTART}) + + +def participant_episode_structure_conformance_diagnostics( + policies: Mapping[str, ParticipantEpisodePolicyRuntime], + participant_episode_history: Mapping[str, object], +) -> tuple[Diagnostic, ...]: + """Return ACT-623 diagnostics for recorded episodes that contradict their authored structure.""" + + governing: dict[str, list[ParticipantEpisodePolicyRuntime]] = {} + for policy in policies.values(): + for participant_address in policy.participant_addresses: + governing.setdefault(participant_address, []).append(policy) + diagnostics: list[Diagnostic] = [] + for participant_address, governed_by in sorted(governing.items()): + address = f"{_HISTORY_KEY}.{participant_address}" + if len(governed_by) > 1: + joined = ", ".join(sorted(policy.address for policy in governed_by)) + diagnostics.append( + _diagnostic( + _PARTICIPANT_EPISODE_STRUCTURE_INVALID_DIAGNOSTIC_CODE, + address, + f"participant is governed by more than one episode policy: {joined}", + ) + ) + continue + diagnostics.extend( + _diagnostic(_PARTICIPANT_EPISODE_STRUCTURE_INVALID_DIAGNOSTIC_CODE, f"{address}[{index}]", message) + for index, message in _history_violations( + governed_by[0], participant_episode_history.get(participant_address) + ) + ) + return tuple(diagnostics) + + +def _history_violations(policy: ParticipantEpisodePolicyRuntime, history: object) -> Iterator[tuple[int, str]]: + if not isinstance(history, list): + return + authored_reasons = {condition.terminal_reason for condition in policy.conditions} + for index, payload in enumerate(history): + event = _history_event(payload) + if event is None: + continue + reason = event.terminal_reason + if ( + reason is not None + and reason is not ParticipantEpisodeTerminalReason.INTERRUPTED + and reason.value not in authored_reasons + ): + yield ( + index, + f"terminal reason {reason.value!r} has no authored condition in {policy.address!r}; " + "only an interruption may end a governed episode without one", + ) + action = event.control_action + if ( + action in _RESET_ACTIONS + and policy.reset_control_actions + and action.value not in policy.reset_control_actions + ): + yield (index, f"control action {action.value!r} is not admitted by the reset policy of {policy.address!r}") + + +def _history_event(payload: object) -> ParticipantEpisodeHistoryEvent | None: + if not isinstance(payload, Mapping): + return None + try: + return ParticipantEpisodeHistoryEvent.from_payload(payload) + except (TypeError, ValueError): + return None + + +__all__ = ["participant_episode_structure_conformance_diagnostics"] diff --git a/implementations/python/packages/raes_processor/compiler/addresses.py b/implementations/python/packages/raes_processor/compiler/addresses.py index f4b0aeb3d..b63499631 100644 --- a/implementations/python/packages/raes_processor/compiler/addresses.py +++ b/implementations/python/packages/raes_processor/compiler/addresses.py @@ -156,6 +156,10 @@ def _participant_inject_delivery_address(spec_name: str, binding_id: str) -> str ) +def _participant_episode_policy_address(spec_name: str) -> str: + return _address("participant", "episode-policy", spec_name) + + def _condition_binding_address(node_name: str, condition_name: str) -> str: return _address("evaluation", "condition", node_name, condition_name) diff --git a/implementations/python/packages/raes_processor/compiler/participant_behaviors.py b/implementations/python/packages/raes_processor/compiler/participant_behaviors.py index 376173acb..d3c603ccf 100644 --- a/implementations/python/packages/raes_processor/compiler/participant_behaviors.py +++ b/implementations/python/packages/raes_processor/compiler/participant_behaviors.py @@ -24,6 +24,7 @@ _observation_boundary_address, _outcome_interpretation_rule_address, _participant_behavior_address, + _participant_episode_policy_address, _participant_inject_delivery_address, _section_ref_name, _tool_affordance_address, @@ -360,6 +361,9 @@ def _compile_behavior_specifications( evidence_contract_refs=tuple(behavior_spec.evidence_contract_refs), tool_affordance_addresses=tool_affordance_addresses, participant_inject_delivery_addresses=participant_inject_delivery_addresses, + episode_policy_address=( + _participant_episode_policy_address(name) if behavior_spec.episode_policy is not None else "" + ), extension_policy=str(behavior_spec.extension_policy), extension_keys=tuple(sorted(behavior_spec.extensions)), refresh_dependencies=dependencies, diff --git a/implementations/python/packages/raes_processor/compiler/participant_episode_policies.py b/implementations/python/packages/raes_processor/compiler/participant_episode_policies.py new file mode 100644 index 000000000..8d6d0de99 --- /dev/null +++ b/implementations/python/packages/raes_processor/compiler/participant_episode_policies.py @@ -0,0 +1,201 @@ +"""Participant episode policy compilation (DSL-120). + +Each admitted ``behavior_specifications..episode_policy`` compiles to one +``participant.episode-policy.`` record of authored intent with resolved +canonical addresses. Compilation never creates episode identity, state, +history, or terminal facts; those remain ADR-013 runtime contracts. +""" + +from collections.abc import Callable, Iterable + +from raes.entities import flatten_entities +from raes.participant_episode_policy import ( + ParticipantEpisodePolicy, + ParticipantEpisodeResetPolicy, + ParticipantEpisodeTimeoutCondition, +) +from raes.scenario import InstantiatedScenario +from raes.semantics.participant_behavior import select_participants +from raes_contracts.participant_episode import ParticipantEpisodeTerminalReason + +from ..models.participant_episode_resources import ( + ParticipantEpisodeConditionRuntime, + ParticipantEpisodePolicyRuntime, +) +from .addresses import ( + _action_contract_address, + _assertion_address, + _behavior_specification_address, + _participant_behavior_address, + _participant_episode_policy_address, + _section_ref_name, +) +from .support import _address, _dedupe, _dump + + +def _compile_participant_episode_policies( + scenario: InstantiatedScenario, + declaration_index: object, +) -> dict[str, ParticipantEpisodePolicyRuntime]: + """Compile admitted episode policies as participant metadata.""" + + governed = [ + (spec_name, behavior_spec) + for spec_name, behavior_spec in scenario.behavior_specifications.items() + if behavior_spec.episode_policy is not None + ] + if not governed: + return {} + entities = flatten_entities(scenario.entities) + roles = {name: agent.effective_role(entities) for name, agent in scenario.agents.items()} + policies: dict[str, ParticipantEpisodePolicyRuntime] = {} + for spec_name, behavior_spec in governed: + participants = sorted(select_participants(behavior_spec, set(scenario.agents), roles)) + reset_authority = _reset_authority_address(declaration_index, behavior_spec.episode_policy.reset_policy) + runtime = _compile_policy(scenario, spec_name, behavior_spec.episode_policy, participants, reset_authority) + policies[runtime.address] = runtime + return policies + + +def _reset_authority_address(declaration_index: object, reset: ParticipantEpisodeResetPolicy | None) -> str: + """Render the one targetable declaration that validation resolved as the reset authority.""" + + ref = reset.memory_reset_authority_ref if reset is not None else None + if ref is None: + return "" + candidates = declaration_index.reference_aliases(targetable=True).get(ref, set()) + if len(candidates) != 1: + raise ValueError(f"validated memory_reset_authority_ref did not resolve to one declaration: {ref}") + section, _, name = next(iter(candidates)).partition(".") + return _address("sdl", section.replace("_", "-"), name) + + +def _addresses( + scenario: InstantiatedScenario, + refs: Iterable[str], + section: str, + render: Callable[[str], str], +) -> tuple[str, ...]: + declarations = getattr(scenario, section) + return tuple(render(_section_ref_name(ref, section, declarations)) for ref in refs) + + +def _evidence_addresses(scenario: InstantiatedScenario, refs: Iterable[str]) -> tuple[str, ...]: + return _addresses( + scenario, + refs, + "evidence_requirements", + lambda name: _address("sdl", "evidence-requirements", name), + ) + + +def _assertion_condition( + scenario: InstantiatedScenario, + condition_id: str, + terminal_reason: str, + condition: object, +) -> ParticipantEpisodeConditionRuntime: + return ParticipantEpisodeConditionRuntime( + condition_id=condition_id, + terminal_reason=terminal_reason, + evidence_requirement_addresses=_evidence_addresses(scenario, condition.evidence_requirement_refs), + assertion_addresses=_addresses(scenario, condition.assertion_refs, "assertions", _assertion_address), + ) + + +def _timeout_condition( + scenario: InstantiatedScenario, + condition_id: str, + condition: ParticipantEpisodeTimeoutCondition, +) -> ParticipantEpisodeConditionRuntime: + constraint = _section_ref_name( + condition.temporal_constraint_ref, "temporal_constraints", scenario.temporal_constraints + ) + return ParticipantEpisodeConditionRuntime( + condition_id=condition_id, + terminal_reason=condition.terminal_reason, + evidence_requirement_addresses=_evidence_addresses(scenario, condition.evidence_requirement_refs), + temporal_constraint_address=_address("time", "constraint", constraint), + ) + + +def _compile_conditions( + scenario: InstantiatedScenario, + policy: ParticipantEpisodePolicy, +) -> tuple[ParticipantEpisodeConditionRuntime, ...]: + compiled = [ + _timeout_condition(scenario, condition_id, condition) + if isinstance(condition, ParticipantEpisodeTimeoutCondition) + else _assertion_condition(scenario, condition_id, condition.terminal_reason, condition) + for condition_id, condition in policy.terminal_conditions.items() + ] + compiled.extend( + _assertion_condition(scenario, condition_id, ParticipantEpisodeTerminalReason.TRUNCATED.value, condition) + for condition_id, condition in policy.truncation_conditions.items() + ) + return tuple(sorted(compiled, key=lambda item: item.condition_id)) + + +def _condition_dependencies(conditions: Iterable[ParticipantEpisodeConditionRuntime]) -> list[str]: + dependencies: list[str] = [] + for condition in conditions: + dependencies.extend(condition.assertion_addresses) + if condition.temporal_constraint_address: + dependencies.append(condition.temporal_constraint_address) + dependencies.extend(condition.evidence_requirement_addresses) + return dependencies + + +def _compile_policy( + scenario: InstantiatedScenario, + spec_name: str, + policy: ParticipantEpisodePolicy, + participants: list[str], + reset_authority: str, +) -> ParticipantEpisodePolicyRuntime: + owner = _behavior_specification_address(spec_name) + participant_addresses = tuple(_participant_behavior_address(name) for name in participants) + initialization = policy.initialization + initialization_addresses = _addresses( + scenario, + initialization.assertion_refs if initialization is not None else (), + "assertions", + _assertion_address, + ) + structure = policy.interaction_structure + turn_actions = _addresses( + scenario, + structure.action_contract_refs if structure is not None else (), + "action_contracts", + _action_contract_address, + ) + reset = policy.reset_policy + reset_evidence = _evidence_addresses(scenario, reset.evidence_requirement_refs if reset is not None else ()) + conditions = _compile_conditions(scenario, policy) + return ParticipantEpisodePolicyRuntime( + address=_participant_episode_policy_address(spec_name), + name=spec_name, + spec=_dump(policy), + refresh_dependencies=_dedupe( + [ + owner, + *participant_addresses, + *initialization_addresses, + *turn_actions, + *_condition_dependencies(conditions), + *reset_evidence, + *((reset_authority,) if reset_authority else ()), + ] + ), + behavior_specification_address=owner, + participant_addresses=participant_addresses, + profile=policy.profile, + initialization_assertion_addresses=initialization_addresses, + turn_order_basis=structure.order_basis.value if structure is not None else "", + turn_action_contract_addresses=turn_actions, + conditions=conditions, + reset_control_actions=tuple(action.value for action in reset.control_actions) if reset is not None else (), + participant_memory_scope=reset.participant_memory_scope.value if reset is not None else "", + memory_reset_authority_address=reset_authority, + reset_evidence_requirement_addresses=reset_evidence, + ) diff --git a/implementations/python/packages/raes_processor/compiler/pipeline.py b/implementations/python/packages/raes_processor/compiler/pipeline.py index 2c9d93602..8a0809ed3 100644 --- a/implementations/python/packages/raes_processor/compiler/pipeline.py +++ b/implementations/python/packages/raes_processor/compiler/pipeline.py @@ -39,6 +39,7 @@ _compile_observation_boundaries, _compile_outcome_interpretation_rules, ) +from .participant_episode_policies import _compile_participant_episode_policies from .participant_inject_deliveries import _compile_participant_inject_deliveries from .placement import ( _compile_account_placements, @@ -151,6 +152,7 @@ def _compiled_behavior_parts( "behavior_specifications": _compile_behavior_specifications(scenario, diagnostics), "tool_affordances": _compile_tool_affordances(scenario, diagnostics), "participant_inject_deliveries": _compile_participant_inject_deliveries(scenario), + "participant_episode_policies": _compile_participant_episode_policies(scenario, declaration_index), "events": _compile_events( scenario, assertions, structure["injects"], structure["inject_bindings"], diagnostics ), diff --git a/implementations/python/packages/raes_processor/models/__init__.py b/implementations/python/packages/raes_processor/models/__init__.py index 79b5de92a..2fbf2dfc6 100644 --- a/implementations/python/packages/raes_processor/models/__init__.py +++ b/implementations/python/packages/raes_processor/models/__init__.py @@ -159,6 +159,10 @@ ) from .outcome_interpretation_validation import validate_participant_outcome_interpretation_record from .participant_action_arguments import resolve_participant_action_arguments +from .participant_episode_resources import ( + ParticipantEpisodeConditionRuntime, + ParticipantEpisodePolicyRuntime, +) from .participant_exposure_authority import ( ParticipantExposureAssessment, ParticipantExposureAuthorizationRecord, @@ -291,6 +295,8 @@ "ParticipantBehaviorProjectionAnchorRequestV2", "ParticipantBehaviorSpecificationRuntime", "ParticipantInjectDeliveryRuntime", + "ParticipantEpisodeConditionRuntime", + "ParticipantEpisodePolicyRuntime", "ParticipantAutonomousExecutionRuntime", "ParticipantExecutionBindingRuntime", "ParticipantResourceDemandRuntime", diff --git a/implementations/python/packages/raes_processor/models/behavior_resources.py b/implementations/python/packages/raes_processor/models/behavior_resources.py index c35239775..7116c0fe3 100644 --- a/implementations/python/packages/raes_processor/models/behavior_resources.py +++ b/implementations/python/packages/raes_processor/models/behavior_resources.py @@ -238,6 +238,7 @@ class ParticipantBehaviorSpecificationRuntime(ResolvedResource): evidence_contract_refs: tuple[str, ...] = () tool_affordance_addresses: tuple[str, ...] = () participant_inject_delivery_addresses: tuple[str, ...] = () + episode_policy_address: str = "" extension_policy: str = "" extension_keys: tuple[str, ...] = () diff --git a/implementations/python/packages/raes_processor/models/participant_episode_resources.py b/implementations/python/packages/raes_processor/models/participant_episode_resources.py new file mode 100644 index 000000000..595148263 --- /dev/null +++ b/implementations/python/packages/raes_processor/models/participant_episode_resources.py @@ -0,0 +1,67 @@ +"""Compiled participant episode policy records (DSL-120). + +The compiled policy is participant metadata at +``participant.episode-policy.``. It carries authored +intent and the canonical addresses that intent resolves to. Realized episode +identity, state, history and terminal reasons remain the ADR-013 participant +episode contracts keyed by the same ``participant.behavior.`` addresses. +""" + +from dataclasses import dataclass + +from raes.participant_episode_policy import ParticipantEpisodeMemoryScope +from raes_contracts.participant_episode import ParticipantEpisodeTerminalReason + +from .resources import ResolvedResource + +# Authored conditions may map only to these ADR-013 terminal reasons. An +# ``interrupted`` episode is externally induced and is never an authored condition. +AUTHORED_EPISODE_TERMINAL_REASONS = frozenset( + { + ParticipantEpisodeTerminalReason.COMPLETED.value, + ParticipantEpisodeTerminalReason.TIMED_OUT.value, + ParticipantEpisodeTerminalReason.TRUNCATED.value, + } +) + + +@dataclass(frozen=True) +class ParticipantEpisodeConditionRuntime: + """One compiled terminal or truncation condition and its explicit terminal reason.""" + + condition_id: str + terminal_reason: str + evidence_requirement_addresses: tuple[str, ...] + assertion_addresses: tuple[str, ...] = () + temporal_constraint_address: str = "" + + def __post_init__(self) -> None: + if self.terminal_reason not in AUTHORED_EPISODE_TERMINAL_REASONS: + raise ValueError(f"compiled episode condition cannot map to terminal reason {self.terminal_reason!r}") + if not self.evidence_requirement_addresses: + raise ValueError("compiled episode conditions must name the evidence that backs the transition") + timed_out = self.terminal_reason == ParticipantEpisodeTerminalReason.TIMED_OUT.value + if timed_out != bool(self.temporal_constraint_address) or timed_out == bool(self.assertion_addresses): + raise ValueError("timed_out conditions use one temporal constraint; other conditions use assertions") + + +@dataclass(frozen=True) +class ParticipantEpisodePolicyRuntime(ResolvedResource): + """Compiled authored episode intent for one behavior specification.""" + + behavior_specification_address: str = "" + participant_addresses: tuple[str, ...] = () + profile: str = "" + initialization_assertion_addresses: tuple[str, ...] = () + turn_order_basis: str = "" + turn_action_contract_addresses: tuple[str, ...] = () + conditions: tuple[ParticipantEpisodeConditionRuntime, ...] = () + reset_control_actions: tuple[str, ...] = () + participant_memory_scope: str = "" + memory_reset_authority_address: str = "" + reset_evidence_requirement_addresses: tuple[str, ...] = () + + def __post_init__(self) -> None: + local = self.participant_memory_scope == ParticipantEpisodeMemoryScope.EPISODE_LOCAL_RESET.value + if local != bool(self.memory_reset_authority_address): + raise ValueError("compiled episode policies name a reset authority exactly when the scope is episode-local") diff --git a/implementations/python/packages/raes_processor/models/runtime_model.py b/implementations/python/packages/raes_processor/models/runtime_model.py index 9e25fc3cf..1dcdc5e74 100644 --- a/implementations/python/packages/raes_processor/models/runtime_model.py +++ b/implementations/python/packages/raes_processor/models/runtime_model.py @@ -32,6 +32,7 @@ StoryRuntime, WorkflowRuntime, ) +from .participant_episode_resources import ParticipantEpisodePolicyRuntime from .resources import ( AccountPlacement, AssertionRuntime, @@ -144,6 +145,7 @@ class RuntimeModel: behavior_specifications: dict[str, ParticipantBehaviorSpecificationRuntime] = field(default_factory=dict) tool_affordances: dict[str, ParticipantToolAffordanceRuntime] = field(default_factory=dict) participant_inject_deliveries: dict[str, ParticipantInjectDeliveryRuntime] = field(default_factory=dict) + participant_episode_policies: dict[str, ParticipantEpisodePolicyRuntime] = field(default_factory=dict) events: dict[str, EventRuntime] = field(default_factory=dict) scripts: dict[str, ScriptRuntime] = field(default_factory=dict) stories: dict[str, StoryRuntime] = field(default_factory=dict) @@ -186,6 +188,7 @@ def __post_init__(self) -> None: "behavior_specifications", "tool_affordances", "participant_inject_deliveries", + "participant_episode_policies", "events", "scripts", "stories", diff --git a/implementations/python/tests/test_conformance_facade_parity.py b/implementations/python/tests/test_conformance_facade_parity.py index 3b03a3929..b76cd9139 100644 --- a/implementations/python/tests/test_conformance_facade_parity.py +++ b/implementations/python/tests/test_conformance_facade_parity.py @@ -13,6 +13,7 @@ from raes_conformance.conformance import ( fixture_suite, observability, + participant_episode_structure, profiles, report, semantics, @@ -30,6 +31,7 @@ "contract_validation_strength", "fixtures_root", "observability_evidence_conformance_diagnostics", + "participant_episode_structure_conformance_diagnostics", "profile_for_manifest", "profiles_root", "required_contracts", @@ -50,6 +52,7 @@ "ConformanceCaseResult": report, "backend_conformance_report_payload": report, "observability_evidence_conformance_diagnostics": observability, + "participant_episode_structure_conformance_diagnostics": participant_episode_structure, "run_fixture_suite": fixture_suite, "profile_for_manifest": target, "run_target_conformance": target, diff --git a/implementations/python/tests/test_formal_semantic_validation.py b/implementations/python/tests/test_formal_semantic_validation.py index ed4ffa137..05a10608e 100644 --- a/implementations/python/tests/test_formal_semantic_validation.py +++ b/implementations/python/tests/test_formal_semantic_validation.py @@ -148,6 +148,8 @@ def test_atomic_release_index_validates_every_historical_bundle() -> None: "67.0.0", "68.0.0", "69.0.0", + "70.0.0", + "71.0.0", ] assert all(validate_release_bundle(REPO_ROOT, release) == [] for release in releases) @@ -156,14 +158,11 @@ def test_atomic_release_index_validates_every_historical_bundle() -> None: def test_current_retest_bundle_is_coherent_and_clean() -> None: release, protocol, corpus, snapshot, analysis = copy_bundle(load_retest_bundle, REPO_ROOT) - assert release.manifest["revision"] == "69.0.0" + assert release.manifest["revision"] == "71.0.0" assert protocol["revision"] == "2.0.0" assert corpus["revision"] == "4.0.0" - assert snapshot["baseline"]["release_revision"] == "68.0.0" - assert {item["case_id"] for item in snapshot["deviations"]} == { - "compile-repeatability-control", - "compile-non-vacuity-control", - } + assert snapshot["baseline"]["release_revision"] == "70.0.0" + assert snapshot["deviations"] == [] assert validate_retest_bundle(REPO_ROOT, release, protocol, corpus, snapshot, analysis) == [] diff --git a/implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py b/implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py new file mode 100644 index 000000000..f2fce3873 --- /dev/null +++ b/implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py @@ -0,0 +1,667 @@ +"""DSL-120 authored participant episode structure and termination surface.""" + +from __future__ import annotations + +import json +import textwrap +from pathlib import Path + +import pytest +from jsonschema import Draft202012Validator +from raes._errors import SDLInstantiationError, SDLParseError, SDLValidationError +from raes.instantiate import instantiate_scenario +from raes.language_service import language_completions +from raes.parser import parse_sdl, parse_sdl_file +from raes_contracts.contracts import schema_bundle +from raes_processor.compiler import compile_runtime_model +from raes_processor.models import ParticipantEpisodeConditionRuntime, ParticipantEpisodePolicyRuntime + +REPO_ROOT = Path(__file__).resolve().parents[3] +FIXTURE_ROOT = REPO_ROOT / "contracts" / "fixtures" / "sdl" / "participant-episode-policy-v1" +VALID_FIXTURE = FIXTURE_ROOT / "valid" / "analyst-shift-episode.yaml" +INVALID_FIXTURE = FIXTURE_ROOT / "invalid" / "realized-episode-state.yaml" +POLICY_ADDRESS = "participant.episode-policy.analyst-triage" +SPEC_ADDRESS = "participant.behavior-specification.analyst-triage" +PARTICIPANT_ADDRESS = "participant.behavior.analyst" +REALIZED_STATE = "declare intent only" +CLOSED_RECORD = "Extra inputs are not permitted" +PERSISTENT_SCOPE = "participant_memory_scope: persistent_across_episodes" +LOCAL_RESET = "participant_memory_scope: episode_local_reset\n memory_reset_authority_ref: {authority}" + + +def _source() -> str: + return VALID_FIXTURE.read_text(encoding="utf-8") + + +def _replace(source: str, old: str, new: str) -> str: + assert old in source + return source.replace(old, new, 1) + + +def _edit(old: str, new: str) -> str: + return _replace(_source(), old, new) + + +def _policy_free_source() -> str: + source = _source() + start = source.index(" episode_policy:\n") + return source[:start] + + +def test_authored_policy_compiles_to_episode_refs() -> None: + model = compile_runtime_model(parse_sdl(_source())) + compiled = model.participant_episode_policies[POLICY_ADDRESS] + + assert compiled.behavior_specification_address == SPEC_ADDRESS + assert compiled.participant_addresses == (PARTICIPANT_ADDRESS,) + assert PARTICIPANT_ADDRESS in model.participant_behaviors + assert compiled.profile == "participant-episode-policy/v1" + assert compiled.initialization_assertion_addresses == ("evaluation.assertion.console-ready",) + assert compiled.turn_order_basis == "decision-epoch" + assert compiled.turn_action_contract_addresses == ("participant.action-contract.triage-alert",) + assert { + (item.condition_id, item.terminal_reason, item.assertion_addresses, item.temporal_constraint_address) + for item in compiled.conditions + } == { + ("ticket-closed", "completed", ("evaluation.assertion.ticket-closed",), ""), + ("shift-ended", "timed_out", (), "time.constraint.shift-deadline"), + ("queue-stalled", "truncated", ("evaluation.assertion.queue-stalled",), ""), + } + assert all(item.evidence_requirement_addresses for item in compiled.conditions) + assert compiled.reset_control_actions == ("reset", "restart") + assert compiled.participant_memory_scope == "persistent_across_episodes" + assert compiled.reset_evidence_requirement_addresses == ("sdl.evidence-requirements.reset-evidence",) + assert {SPEC_ADDRESS, PARTICIPANT_ADDRESS, "time.constraint.shift-deadline"} <= set(compiled.refresh_dependencies) + + +@pytest.mark.parametrize( + ("old", "new", "realized"), + [ + ( + " profile: participant-episode-policy/v1\n", + " profile: participant-episode-policy/v1\n episode_id: analyst-ep-0001\n", + "episode_id", + ), + ( + " assertion_refs: [console-ready]\n", + " assertion_refs: [console-ready]\n initialized_at: '2026-10-09T00:00:00Z'\n", + "initialized_at", + ), + ( + " order_basis: decision-epoch\n", + " order_basis: decision-epoch\n decision_epoch: 4\n", + "decision_epoch", + ), + ( + " terminal_reason: completed\n", + " terminal_reason: completed\n terminated_at: '2026-10-09T08:00:00Z'\n", + "terminated_at", + ), + ( + " control_actions: [reset, restart]\n", + " control_actions: [reset, restart]\n previous_episode_id: analyst-ep-0000\n", + "previous_episode_id", + ), + ], +) +def test_policy_records_reject_realized_episode_state(old: str, new: str, realized: str) -> None: + source = _edit(old, new) + + with pytest.raises(SDLParseError, match=rf"{REALIZED_STATE}.*{realized}"): + parse_sdl(source) + + +@pytest.mark.parametrize( + ("old", "new", "expected"), + [ + ( + " profile: participant-episode-policy/v1\n", + " profile: participant-episode-policy/v1\n max_turns: 20\n", + CLOSED_RECORD, + ), + ( + " temporal_constraint_ref: shift-deadline\n", + " temporal_constraint_ref: shift-deadline\n expression: clock > 480\n", + CLOSED_RECORD, + ), + ( + " assertion_refs: [console-ready]\n", + " assertion_refs: [console-ready]\n command: ./check-console.sh\n", + CLOSED_RECORD, + ), + ("profile: participant-episode-policy/v1", "profile: participant-episode-policy/v2", "participant-episode"), + ("assertion_refs: [console-ready]", "assertion_refs: []", "at least 1 item"), + ("assertion_refs: [console-ready]", "assertion_refs: [console-ready, console-ready]", "must not repeat"), + ("control_actions: [reset, restart]", "control_actions: [initialize]", "control_actions"), + ("order_basis: decision-epoch", "order_basis: wall-clock", "order_basis"), + ("participant_memory_scope: persistent_across_episodes", "participant_memory_scope: global", "memory"), + ("assertion_refs: [console-ready]", "assertion_refs: [' ']", "should match pattern"), + ( + "participant_memory_scope: persistent_across_episodes", + "participant_memory_scope: episode_local_reset", + "episode_local_reset memory scope requires memory_reset_authority_ref", + ), + ( + "participant_memory_scope: persistent_across_episodes", + "participant_memory_scope: persistent_across_episodes\n memory_reset_authority_ref: analyst-console-reset", + "persistent_across_episodes memory scope must not claim a reset authority", + ), + ], +) +def test_policy_records_are_closed_and_typed(old: str, new: str, expected: str) -> None: + source = _edit(old, new) + + with pytest.raises(SDLParseError, match=expected): + parse_sdl(source) + + +@pytest.mark.parametrize( + ("old", "new"), + [ + (" ticket-closed:\n", " ${closing_condition}:\n"), + (" queue-stalled:\n", " ${stall_condition}:\n"), + ], +) +def test_variable_created_condition_keys_are_rejected(old: str, new: str) -> None: + source = _edit(old, new) + + with pytest.raises(SDLParseError, match="Variable placeholders are not allowed in user-defined mapping keys"): + parse_sdl(source) + + +@pytest.mark.parametrize( + ("old", "new", "expected"), + [ + ("terminal_reason: completed", "terminal_reason: truncated", "terminal_reason"), + ("terminal_reason: completed", "terminal_reason: interrupted", "terminal_reason"), + ( + " assertion_refs: [queue-stalled]\n", + " assertion_refs: [queue-stalled]\n temporal_constraint_ref: shift-deadline\n", + CLOSED_RECORD, + ), + ( + " temporal_constraint_ref: shift-deadline\n", + " temporal_constraint_ref: shift-deadline\n assertion_refs: [ticket-closed]\n", + CLOSED_RECORD, + ), + (" queue-stalled:\n", " ticket-closed:\n", "unique across terminal and truncation conditions"), + ( + " assertion_refs: [queue-stalled]\n", + " assertion_refs: [queue-stalled]\n terminal_reason: truncated\n", + "always end the episode as truncated and carry no terminal_reason", + ), + ( + " assertion_refs: [queue-stalled]\n", + " assertion_refs: [ticket-closed]\n", + "truncation conditions must not reuse the assertions of a completion condition: queue-stalled", + ), + ], +) +def test_terminal_reasons_stay_distinct(old: str, new: str, expected: str) -> None: + source = _edit(old, new) + + with pytest.raises(SDLParseError, match=expected): + parse_sdl(source) + + +def test_policy_must_declare_an_episode_structure_element() -> None: + source = _policy_free_source() + " episode_policy:\n profile: participant-episode-policy/v1\n" + + with pytest.raises(SDLParseError, match="at least one episode structure element"): + parse_sdl(source) + + +_SHIFT_DEADLINE = """ shift-deadline: + constraint_kind: deadline + clock_ref: shift-clock + subject_refs: [behavior_specifications.analyst-triage] + end: {tick: 480} +""" + + +@pytest.mark.parametrize( + ("old", "new", "expected"), + [ + ( + " assertion_refs: [console-ready]\n", + " assertion_refs: [missing-assertion]\n", + "initialization assertion 'missing-assertion' not in assertions section", + ), + ( + " assertion_refs: [console-ready]\n", + " assertion_refs: [ticket-closed]\n", + "initialization assertion 'ticket-closed' must be a precondition", + ), + ( + " action_contract_refs: [triage-alert]\n", + " action_contract_refs: [escalate-alert]\n", + "action_contract_ref 'escalate-alert' is outside the owning behavior specification", + ), + ( + " assertion_refs: [ticket-closed]\n", + " assertion_refs: [missing-assertion]\n", + "terminal condition 'ticket-closed' assertion 'missing-assertion' not in assertions section", + ), + ( + " assertion_refs: [ticket-closed]\n", + " assertion_refs: [console-ready]\n", + "terminal condition 'ticket-closed' assertion 'console-ready' must be an invariant or postcondition", + ), + ( + " assertion_refs: [queue-stalled]\n", + " assertion_refs: [console-ready]\n", + "truncation condition 'queue-stalled' assertion 'console-ready' must be an invariant or postcondition", + ), + ( + "temporal_constraint_ref: shift-deadline", + "temporal_constraint_ref: missing-deadline", + "temporal_constraint_ref 'missing-deadline' does not reference a declared temporal constraint", + ), + ( + _SHIFT_DEADLINE, + _SHIFT_DEADLINE.replace("constraint_kind: deadline", "constraint_kind: cadence").replace( + "end: {tick: 480}", "cadence_ticks: 60" + ), + "temporal_constraint_ref 'shift-deadline' must be a deadline, window, or duration constraint", + ), + ( + _SHIFT_DEADLINE, + _SHIFT_DEADLINE.replace("[behavior_specifications.analyst-triage]", "[nodes.siem]"), + "temporal_constraint_ref 'shift-deadline' binds neither the owning behavior specification", + ), + ( + " actions: [triage-alert]\n", + " actions: []\n", + "action_contract_ref 'triage-alert' is outside participant 'analyst'", + ), + ( + " evidence_requirement_refs: [ticket-evidence]\n", + " evidence_requirement_refs: [missing-evidence]\n", + "terminal condition 'ticket-closed' evidence_requirement_ref 'missing-evidence' does not reference", + ), + ( + " evidence_requirement_refs: [queue-evidence]\n", + " evidence_requirement_refs: [missing-evidence]\n", + "truncation condition 'queue-stalled' evidence_requirement_ref 'missing-evidence' does not reference", + ), + ( + " evidence_requirement_refs: [reset-evidence]\n", + " evidence_requirement_refs: [missing-evidence]\n", + "reset policy evidence_requirement_ref 'missing-evidence' does not reference", + ), + ( + PERSISTENT_SCOPE, + LOCAL_RESET.format(authority="analyst-console-reset"), + "reset policy memory_reset_authority_ref 'analyst-console-reset' does not reference any defined targetable", + ), + ( + PERSISTENT_SCOPE, + LOCAL_RESET.format(authority="ticket-closed"), + "reset policy memory_reset_authority_ref 'ticket-closed' is ambiguous", + ), + ], +) +def test_policy_references_fail_closed(old: str, new: str, expected: str) -> None: + source = _edit(old, new) + + with pytest.raises(SDLValidationError, match=expected): + parse_sdl(source) + + +def test_role_selected_participants_own_the_timeout_and_the_compiled_policy() -> None: + source = _replace( + _edit(" participant_refs: [analyst]\n", " participant_role_refs: [blue]\n"), + "subject_refs: [behavior_specifications.analyst-triage]", + "subject_refs: [agents.analyst]", + ) + + compiled = compile_runtime_model(parse_sdl(source)).participant_episode_policies[POLICY_ADDRESS] + + assert compiled.participant_addresses == (PARTICIPANT_ADDRESS,) + + +_SECOND_ANALYST = " analyst-2:\n affiliations: [blue-team]\n actions: [triage-alert]\n" + + +def _two_analyst_source(subjects: str) -> str: + source = _replace( + _edit(" participant_refs: [analyst]\n", " participant_role_refs: [blue]\n"), + "subject_refs: [behavior_specifications.analyst-triage]", + f"subject_refs: {subjects}", + ) + return _replace(source, "agents:\n", "agents:\n" + _SECOND_ANALYST) + + +def test_a_timeout_must_bind_every_selected_participant() -> None: + bound = compile_runtime_model(parse_sdl(_two_analyst_source("[agents.analyst, agents.analyst-2]"))) + source = _two_analyst_source("[agents.analyst]") + + assert bound.participant_episode_policies[POLICY_ADDRESS].participant_addresses == ( + PARTICIPANT_ADDRESS, + "participant.behavior.analyst-2", + ) + with pytest.raises( + SDLValidationError, match="binds neither the owning behavior specification nor every participant" + ): + parse_sdl(source) + + +_SECOND_POLICY = """ analyst-escalation: + semantic_version: 1.0.0 + {selector} + action_contract_refs: [triage-alert] + episode_policy: + profile: participant-episode-policy/v1 + interaction_structure: + order_basis: decision-epoch + action_contract_refs: [triage-alert] +""" + + +@pytest.mark.parametrize("selector", ["participant_refs: [analyst]", "participant_role_refs: [blue]"]) +def test_one_episode_policy_governs_each_participant(selector: str) -> None: + source = _edit( + "behavior_specifications:\n", "behavior_specifications:\n" + _SECOND_POLICY.format(selector=selector) + ) + + with pytest.raises( + SDLValidationError, + match=r"Participant 'analyst' is governed by more than one episode policy " + r"\(behavior specifications 'analyst-escalation', 'analyst-triage'\)", + ): + parse_sdl(source) + + +def test_a_policy_free_specification_may_share_the_governed_participant() -> None: + second = _SECOND_POLICY.format(selector="participant_refs: [analyst]") + second = second[: second.index(" episode_policy:\n")] + model = compile_runtime_model(parse_sdl(_edit("behavior_specifications:\n", "behavior_specifications:\n" + second))) + + assert set(model.participant_episode_policies) == {POLICY_ADDRESS} + + +_VARIABLES = """name: dsl-120 +variables: + {name}: + type: string + default: {default} + allowed_values: [{default}] +""" + + +@pytest.mark.parametrize( + ("variable", "default", "old", "new"), + [ + ("who", "analyst", " participant_refs: [analyst]\n", " participant_refs: ['${who}']\n"), + ( + "contract", + "triage-alert", + " action_contract_refs: [triage-alert]\n behavior_mode", + (" action_contract_refs: ['${contract}']\n behavior_mode"), + ), + ], +) +def test_checks_that_need_a_resolved_selection_wait_for_instantiation( + variable: str, + default: str, + old: str, + new: str, +) -> None: + source = _replace(_edit(old, new), "name: dsl-120\n", _VARIABLES.format(name=variable, default=default)) + if variable == "who": + source = _replace( + source, + "subject_refs: [behavior_specifications.analyst-triage]", + "subject_refs: [agents.analyst]", + ) + + instantiated = instantiate_scenario(parse_sdl(source), parameters={variable: default}) + + assert compile_runtime_model(instantiated).participant_episode_policies[POLICY_ADDRESS].participant_addresses == ( + PARTICIPANT_ADDRESS, + ) + + +@pytest.mark.parametrize( + ("authority", "address"), + [ + ("nodes.siem.services.console", "sdl.nodes.siem.services.console"), + ("agents.analyst", "sdl.agents.analyst"), + ("blue-team", "sdl.entities.blue-team"), + ], +) +def test_episode_local_reset_resolves_the_reset_authority(authority: str, address: str) -> None: + source = _edit(PERSISTENT_SCOPE, LOCAL_RESET.format(authority=authority)) + + compiled = compile_runtime_model(parse_sdl(source)).participant_episode_policies[POLICY_ADDRESS] + + assert compiled.participant_memory_scope == "episode_local_reset" + assert compiled.memory_reset_authority_address == address + assert address in compiled.refresh_dependencies + + +def test_module_composition_rewrites_policy_refs_and_keeps_condition_ids(tmp_path: Path) -> None: + module = textwrap.dedent( + """ + name: dsl-120 + module: + id: acme/analyst-episode + version: 1.0.0 + exports: + nodes: [siem] + entities: [blue-team] + propositions: [console-ready, ticket-closed, queue-stalled] + assertions: [console-ready, ticket-closed, queue-stalled] + time_domains: [shift-time] + clocks: [shift-clock] + temporal_constraints: [shift-deadline] + evidence_requirements: [ticket-evidence, queue-evidence, shift-clock-evidence, reset-evidence] + action_contracts: [triage-alert] + agents: [analyst] + behavior_specifications: [analyst-triage] + """ + ).lstrip() + source = _edit(PERSISTENT_SCOPE, LOCAL_RESET.format(authority="agents.analyst")) + (tmp_path / "module.yaml").write_text(_replace(source, "name: dsl-120\n", module), encoding="utf-8") + root = tmp_path / "root.yaml" + root.write_text("name: root\nimports:\n - source: local:module.yaml\n namespace: shared\n", encoding="utf-8") + + scenario = parse_sdl_file(root) + policy = scenario.behavior_specifications["shared.analyst-triage"].episode_policy + + assert policy.initialization.assertion_refs == ["shared.console-ready"] + assert policy.interaction_structure.action_contract_refs == ["shared.triage-alert"] + assert set(policy.terminal_conditions) == {"ticket-closed", "shift-ended"} + assert policy.terminal_conditions["ticket-closed"].assertion_refs == ["shared.ticket-closed"] + assert policy.terminal_conditions["shift-ended"].temporal_constraint_ref == "shared.shift-deadline" + assert policy.truncation_conditions["queue-stalled"].evidence_requirement_refs == ["shared.queue-evidence"] + assert policy.reset_policy.evidence_requirement_refs == ["shared.reset-evidence"] + assert policy.reset_policy.memory_reset_authority_ref == "agents.shared.analyst" + compiled = compile_runtime_model(scenario).participant_episode_policies + assert set(compiled) == {"participant.episode-policy.shared.analyst-triage"} + assert ( + compiled["participant.episode-policy.shared.analyst-triage"].memory_reset_authority_address + == "sdl.agents.shared.analyst" + ) + + +_CHOICE = """name: dsl-120 +variables: + choice: + type: string + default: {good} + allowed_values: [{good}, {bad}] +""" + + +@pytest.mark.parametrize( + ("old", "new", "good", "bad", "compiled_field", "expected"), + [ + ( + " assertion_refs: [console-ready]\n", + " assertion_refs: ['${choice}']\n", + "console-ready", + "missing-assertion", + "initialization_assertion_addresses", + ("evaluation.assertion.console-ready",), + ), + ( + PERSISTENT_SCOPE, + LOCAL_RESET.format(authority="'${choice}'"), + "agents.analyst", + "analyst-console-reset", + "memory_reset_authority_address", + "sdl.agents.analyst", + ), + ], +) +def test_variable_refs_are_revalidated_after_instantiation( + old: str, + new: str, + good: str, + bad: str, + compiled_field: str, + expected: object, +) -> None: + source = _replace(_edit(old, new), "name: dsl-120\n", _CHOICE.format(good=good, bad=bad)) + authored = parse_sdl(source) + + instantiated = instantiate_scenario(authored, parameters={"choice": good}) + compiled = compile_runtime_model(instantiated).participant_episode_policies[POLICY_ADDRESS] + assert getattr(compiled, compiled_field) == expected + with pytest.raises(SDLInstantiationError, match=bad): + instantiate_scenario(authored, parameters={"choice": bad}) + + +def test_policy_free_behavior_specifications_keep_their_existing_shape() -> None: + scenario = parse_sdl(_policy_free_source()) + model = compile_runtime_model(scenario) + + assert "episode_policy" not in scenario.behavior_specifications["analyst-triage"].model_dump(mode="json") + assert "episode_policy" not in model.behavior_specifications[SPEC_ADDRESS].spec + assert model.participant_episode_policies == {} + + +@pytest.mark.parametrize( + ("fields", "expected"), + [ + ({"terminal_reason": "interrupted", "assertion_addresses": ("evaluation.assertion.a",)}, "interrupted"), + ({"terminal_reason": "completed", "evidence_requirement_addresses": ()}, "evidence"), + ({"terminal_reason": "timed_out", "assertion_addresses": ("evaluation.assertion.a",)}, "temporal"), + ( + { + "terminal_reason": "completed", + "assertion_addresses": ("evaluation.assertion.a",), + "temporal_constraint_address": "time.constraint.t", + }, + "temporal", + ), + ], +) +def test_compiled_conditions_reassert_the_authored_pairing(fields: dict[str, object], expected: str) -> None: + values: dict[str, object] = { + "condition_id": "c", + "evidence_requirement_addresses": ("sdl.evidence-requirements.e",), + **fields, + } + + with pytest.raises(ValueError, match=expected): + ParticipantEpisodeConditionRuntime(**values) + + +@pytest.mark.parametrize( + ("scope", "authority"), + [ + ("episode_local_reset", ""), + ("persistent_across_episodes", "sdl.agents.analyst"), + ("", "sdl.agents.analyst"), + ], +) +def test_compiled_policies_reassert_the_reset_authority_pairing(scope: str, authority: str) -> None: + with pytest.raises(ValueError, match="reset authority"): + ParticipantEpisodePolicyRuntime( + address=POLICY_ADDRESS, + name="analyst-triage", + spec={}, + participant_memory_scope=scope, + memory_reset_authority_address=authority, + ) + + +@pytest.mark.parametrize( + ("cursor_path", "label"), + [ + ("/behavior_specifications/analyst-triage", "episode_policy"), + ("/behavior_specifications/analyst-triage/episode_policy/initialization/assertion_refs", "console-ready"), + ( + "/behavior_specifications/analyst-triage/episode_policy/terminal_conditions/shift-ended/" + "temporal_constraint_ref", + "shift-deadline", + ), + ], +) +def test_language_service_offers_the_policy_surface(cursor_path: str, label: str) -> None: + result = language_completions(_source(), cursor_path=cursor_path) + + assert result["status"] == "ok" + assert label in {item["label"] for item in result["items"]} + + +@pytest.mark.parametrize( + "contract_id", + [ + "sdl-authoring-input-v1", + "instantiated-scenario-v1", + "instantiated-scenario-snapshot-v1", + "scenario-satisfiability-evidence-v1", + ], +) +def test_scenario_contracts_publish_the_closed_policy_shape(contract_id: str) -> None: + definitions = schema_bundle()[contract_id]["$defs"] + + assert "episode_policy" in definitions["ParticipantBehaviorSpecification"]["properties"] + for name in ( + "ParticipantEpisodePolicy", + "ParticipantEpisodeInitialization", + "ParticipantEpisodeInteractionStructure", + "ParticipantEpisodeCompletionCondition", + "ParticipantEpisodeTimeoutCondition", + "ParticipantEpisodeTruncationCondition", + "ParticipantEpisodeResetPolicy", + ): + assert definitions[name]["additionalProperties"] is False + assert definitions["ParticipantEpisodePolicy"]["required"] == ["profile"] + + +def _published_authoring_schema() -> dict[str, object]: + return json.loads( + (REPO_ROOT / "contracts" / "schemas" / "sdl" / "sdl-authoring-input-v1.json").read_text(encoding="utf-8") + ) + + +@pytest.mark.parametrize( + "mutate", + [ + lambda policy: policy["initialization"].update(assertion_refs=[" "]), + lambda policy: policy["reset_policy"].update(participant_memory_scope="episode_local_reset"), + lambda policy: policy["reset_policy"].update(memory_reset_authority_ref="analyst-console-reset"), + ], + ids=["blank-ref", "local-reset-without-authority", "persistent-with-authority"], +) +def test_published_schema_states_the_parser_rules(mutate: object) -> None: + payload = parse_sdl_file(VALID_FIXTURE).model_dump(mode="json", exclude_defaults=True) + mutate(payload["behavior_specifications"]["analyst-triage"]["episode_policy"]) + + assert list(Draft202012Validator(_published_authoring_schema()).iter_errors(payload)) + + +def test_published_valid_and_invalid_policy_fixtures() -> None: + scenario = parse_sdl_file(VALID_FIXTURE) + + Draft202012Validator(_published_authoring_schema()).validate( + scenario.model_dump(mode="json", exclude_defaults=True) + ) + with pytest.raises( + SDLParseError, match=rf"{REALIZED_STATE}.*decision_epoch, initialized_at, status, terminal_reason" + ): + parse_sdl_file(INVALID_FIXTURE) diff --git a/implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py b/implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py new file mode 100644 index 000000000..2cc6b2a91 --- /dev/null +++ b/implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py @@ -0,0 +1,259 @@ +"""ACT-623 participant episode structure as a first-class participant concern.""" + +from __future__ import annotations + +from collections.abc import Callable +from dataclasses import replace +from pathlib import Path + +import pytest +from raes._errors import SDLParseError +from raes.parser import parse_sdl, parse_sdl_file +from raes_backend_stubs.stubs import create_stub_target +from raes_conformance.conformance import participant_episode_structure_conformance_diagnostics +from raes_contracts.participant_episode import ( + ParticipantEpisodeTerminalReason, + iter_participant_episode_snapshot_violations, +) +from raes_processor.compiler import compile_runtime_model +from raes_runtime.control_plane import RuntimeControlPlane + +REPO_ROOT = Path(__file__).resolve().parents[3] +FIXTURE_ROOT = REPO_ROOT / "contracts" / "fixtures" / "sdl" / "participant-episode-policy-v1" +ANALYST_FIXTURE = FIXTURE_ROOT / "valid" / "analyst-shift-episode.yaml" +STANDALONE_FIXTURE = FIXTURE_ROOT / "valid" / "standalone-episode-structure.yaml" +AUTONOMOUS_PROFILE_FIXTURE = FIXTURE_ROOT / "invalid" / "autonomous-profile-episode-structure.yaml" +MIXED_CONTROL_FIXTURE = ( + REPO_ROOT / "contracts" / "fixtures" / "sdl" / "mixed-control-v1" / "valid" / ("mixed-control-participant.yaml") +) +ANALYST = "participant.behavior.analyst" +REPLAYER = "participant.behavior.replayer" +CONFORMANCE_CODE = "conformance.participant-episode-structure-invalid" +MIXED_CONTROL_EPISODE_DECLARATIONS = """propositions: + web-ready: + description: The web node is reachable before a red episode starts. + subjects: [nodes.web] + basis: declared_state + predicate: + kind: boolean + property: web-reachable + semantic_ref: urn:raes:observable:web-reachable + expected: true +assertions: + web-ready: + proposition: web-ready + role: precondition +agents: +""" +MIXED_CONTROL_EPISODE_POLICY = """ episode_policy: + profile: participant-episode-policy/v1 + initialization: + assertion_refs: [web-ready] +""" + + +def _analyst_source() -> str: + return ANALYST_FIXTURE.read_text(encoding="utf-8") + + +def _replace(source: str, old: str, new: str) -> str: + assert old in source + return source.replace(old, new, 1) + + +def _mixed_control_source() -> str: + source = _replace( + MIXED_CONTROL_FIXTURE.read_text(encoding="utf-8"), "agents:\n", MIXED_CONTROL_EPISODE_DECLARATIONS + ) + return source.rstrip("\n") + "\n" + MIXED_CONTROL_EPISODE_POLICY + + +@pytest.mark.parametrize( + ("source", "spec_name", "participant"), + [ + *( + ( + _replace(_analyst_source(), "behavior_mode: human-supervised", f"behavior_mode: {mode}"), + "analyst-triage", + ANALYST, + ) + for mode in ( + "autonomous", + "human-control-proxy", + "human-supervised", + "policy-directed", + "replayed", + "scripted", + ) + ), + (_mixed_control_source(), "controlled-red", "participant.behavior.red-agent"), + (STANDALONE_FIXTURE.read_text(encoding="utf-8"), "replay-episodes", REPLAYER), + ], + ids=[ + "autonomous", + "human-control-proxy", + "human-supervised", + "policy-directed", + "replayed", + "scripted", + "mixed-control", + "no-behavior-mode", + ], +) +def test_episode_structure_is_a_member_of_every_participant_kind_aggregate( + source: str, + spec_name: str, + participant: str, +) -> None: + model = compile_runtime_model(parse_sdl(source)) + aggregate = model.behavior_specifications[f"participant.behavior-specification.{spec_name}"] + + assert aggregate.episode_policy_address == f"participant.episode-policy.{spec_name}" + assert model.participant_episode_policies[aggregate.episode_policy_address].participant_addresses == (participant,) + + +def test_episode_structure_alone_satisfies_the_behavior_aggregate() -> None: + scenario = parse_sdl_file(STANDALONE_FIXTURE) + specification = scenario.behavior_specifications["replay-episodes"] + + assert not specification.action_contract_refs + assert specification.behavior_mode is None + assert specification.episode_policy is not None + + +def test_policy_free_aggregates_name_no_episode_structure() -> None: + source = _analyst_source() + model = compile_runtime_model(parse_sdl(source[: source.index(" episode_policy:\n")])) + + assert ( + model.behavior_specifications["participant.behavior-specification.analyst-triage"].episode_policy_address == "" + ) + + +def test_the_autonomous_profile_cannot_carry_episode_structure() -> None: + with pytest.raises( + SDLParseError, match="autonomous_execution/ParticipantAutonomousExecutionPolicyV1/episode_policy" + ): + parse_sdl_file(AUTONOMOUS_PROFILE_FIXTURE) + + +def _history(control_plane: RuntimeControlPlane) -> dict[str, object]: + return control_plane.get_snapshot().snapshot.participant_episode_history + + +def _messages(diagnostics: tuple[object, ...]) -> list[str]: + assert {diagnostic.code for diagnostic in diagnostics} <= {CONFORMANCE_CODE} + return [diagnostic.message for diagnostic in diagnostics] + + +def test_recorded_episodes_conform_to_their_authored_structure() -> None: + policies = compile_runtime_model(parse_sdl_file(ANALYST_FIXTURE)).participant_episode_policies + control_plane = RuntimeControlPlane(create_stub_target()) + control_plane.initialize_participant_episode(ANALYST) + control_plane.terminate_participant_episode(ANALYST, terminal_reason=ParticipantEpisodeTerminalReason.COMPLETED) + control_plane.restart_participant_episode(ANALYST) + control_plane.reset_participant_episode(ANALYST) + control_plane.terminate_participant_episode(ANALYST, terminal_reason=ParticipantEpisodeTerminalReason.TRUNCATED) + control_plane.restart_participant_episode(ANALYST) + control_plane.terminate_participant_episode(ANALYST, terminal_reason=ParticipantEpisodeTerminalReason.INTERRUPTED) + + history = _history(control_plane)[ANALYST] + assert [event["event_type"] for event in history] == [ + "episode_initialized", + "episode_running", + "episode_completed", + "episode_restarted", + "episode_running", + "episode_reset", + "episode_running", + "episode_truncated", + "episode_restarted", + "episode_running", + "episode_interrupted", + ] + assert participant_episode_structure_conformance_diagnostics(policies, _history(control_plane)) == () + + +def _recorded_replays(final_reason: ParticipantEpisodeTerminalReason) -> RuntimeControlPlane: + control_plane = RuntimeControlPlane(create_stub_target()) + control_plane.initialize_participant_episode(REPLAYER) + control_plane.reset_participant_episode(REPLAYER) + control_plane.terminate_participant_episode(REPLAYER, terminal_reason=ParticipantEpisodeTerminalReason.TIMED_OUT) + control_plane.restart_participant_episode(REPLAYER) + control_plane.terminate_participant_episode(REPLAYER, terminal_reason=final_reason) + return control_plane + + +def test_recorded_episodes_that_contradict_their_structure_are_reported() -> None: + policies = compile_runtime_model(parse_sdl_file(STANDALONE_FIXTURE)).participant_episode_policies + control_plane = _recorded_replays(ParticipantEpisodeTerminalReason.COMPLETED) + control_plane.initialize_participant_episode("participant.behavior.observer") + control_plane.terminate_participant_episode( + "participant.behavior.observer", + terminal_reason=ParticipantEpisodeTerminalReason.TRUNCATED, + ) + + history = _history(control_plane) + diagnostics = participant_episode_structure_conformance_diagnostics(policies, history) + + assert _messages(diagnostics) == [ + "control action 'restart' is not admitted by the reset policy of 'participant.episode-policy.replay-episodes'", + "terminal reason 'completed' has no authored condition in 'participant.episode-policy.replay-episodes'; " + "only an interruption may end a governed episode without one", + ] + event_types = [event["event_type"] for event in history[REPLAYER]] + assert [diagnostic.address for diagnostic in diagnostics] == [ + f"runtime.snapshot.participant-episode-history.{REPLAYER}[{event_types.index(event_type)}]" + for event_type in ("episode_restarted", "episode_completed") + ] + + +def test_a_policy_without_a_reset_policy_admits_every_reset_and_restart() -> None: + source = STANDALONE_FIXTURE.read_text(encoding="utf-8") + model = compile_runtime_model(parse_sdl(source[: source.index(" reset_policy:\n")])) + history = _history(_recorded_replays(ParticipantEpisodeTerminalReason.TIMED_OUT)) + + assert [event["control_action"] for event in history[REPLAYER] if event["control_action"]] == [ + "initialize", + "reset", + "restart", + ] + assert participant_episode_structure_conformance_diagnostics(model.participant_episode_policies, history) == () + + +@pytest.mark.parametrize( + "unreadable", + [ + pytest.param(tuple, id="non-list-history"), + pytest.param(lambda events: [str(event) for event in events], id="non-mapping-events"), + pytest.param( + lambda events: [{**event, "sequence_number": str(event["sequence_number"])} for event in events], + id="malformed-events", + ), + ], +) +def test_conformance_leaves_unreadable_history_to_snapshot_integrity( + unreadable: Callable[[list[dict[str, object]]], object], +) -> None: + policies = compile_runtime_model(parse_sdl_file(STANDALONE_FIXTURE)).participant_episode_policies + snapshot = _recorded_replays(ParticipantEpisodeTerminalReason.COMPLETED).get_snapshot().snapshot + history = {REPLAYER: unreadable(snapshot.participant_episode_history[REPLAYER])} + + assert list(iter_participant_episode_snapshot_violations(snapshot.participant_episode_results, history)) + assert participant_episode_structure_conformance_diagnostics(policies, history) == () + + +def test_conformance_refuses_a_participant_with_two_compiled_structures() -> None: + policies = compile_runtime_model(parse_sdl_file(STANDALONE_FIXTURE)).participant_episode_policies + original = policies["participant.episode-policy.replay-episodes"] + duplicate = replace(original, address="participant.episode-policy.replay-copy", name="replay-copy") + + diagnostics = participant_episode_structure_conformance_diagnostics( + {original.address: original, duplicate.address: duplicate}, + {}, + ) + + assert _messages(diagnostics) == [ + "participant is governed by more than one episode policy: " + "participant.episode-policy.replay-copy, participant.episode-policy.replay-episodes" + ] diff --git a/implementations/python/tests/test_issue_989_versioned_evidence.py b/implementations/python/tests/test_issue_989_versioned_evidence.py index c65a0c6d2..b54405c5d 100644 --- a/implementations/python/tests/test_issue_989_versioned_evidence.py +++ b/implementations/python/tests/test_issue_989_versioned_evidence.py @@ -241,18 +241,18 @@ def _stub_release(revision: str, *, protocol_revision: str = "2.0.0"): [ pytest.param([], "selects no v2 retest release", id="no-release"), pytest.param( - [_stub_release("67.0.0"), _stub_release("68.0.0")], - "must be the explicit 69.0.0 retest", + [_stub_release("69.0.0"), _stub_release("70.0.0")], + "must be the explicit 71.0.0 retest", id="stale-current", ), pytest.param( - [_stub_release("68.0.0"), _stub_release("70.0.0")], - "must be the explicit 69.0.0 retest", + [_stub_release("70.0.0"), _stub_release("72.0.0")], + "must be the explicit 71.0.0 retest", id="unsupported-future", ), pytest.param( - [_stub_release("69.0.0", protocol_revision="1.0.0")], - "must be the explicit 69.0.0 retest", + [_stub_release("71.0.0", protocol_revision="1.0.0")], + "must be the explicit 71.0.0 retest", id="wrong-protocol", ), ], @@ -269,8 +269,8 @@ def test_current_formal_release_selection_is_explicit(monkeypatch, releases, mes def test_current_formal_release_selection_returns_the_explicit_retest(monkeypatch): from tools.formal_semantic_validation import _loading - current = _stub_release("69.0.0") - monkeypatch.setattr(_loading, "load_release_bundles", lambda _root: [_stub_release("68.0.0"), current]) + current = _stub_release("71.0.0") + monkeypatch.setattr(_loading, "load_release_bundles", lambda _root: [_stub_release("70.0.0"), current]) assert _loading.load_retest_bundle(ROOT)[0] is current @@ -282,7 +282,7 @@ def test_latest_current_release_is_versioned_and_strict(monkeypatch): from tools.formal_semantic_validation._releases import validate_retest_bundle release, protocol, corpus, snapshot, analysis = copy_bundle(load_retest_bundle, ROOT) - assert release.manifest["revision"] == "69.0.0" + assert release.manifest["revision"] == "71.0.0" original = _retest.replay_case def changed_result(root, case): @@ -335,7 +335,7 @@ def test_specification_current_capture_does_not_accept_old_artifact_digest(artif from tools.check_specification_coverage import load_bundle, validate_bundle manifest, protocol, snapshot, analysis = copy_bundle(load_bundle, ROOT) - assert manifest["revision"] == "68.0.0" + assert manifest["revision"] == "70.0.0" snapshot = deepcopy(snapshot) artifact = next(a for a in snapshot["artifacts"] if a["artifact_id"] == artifact_id) artifact["sha256"] = old_digest @@ -573,6 +573,8 @@ def test_no_capture_can_be_silently_dropped(monkeypatch, family, removed): "67.0.0", "68.0.0", "69.0.0", + "70.0.0", + "71.0.0", ] if family == "formal" else [ @@ -645,6 +647,8 @@ def test_no_capture_can_be_silently_dropped(monkeypatch, family, removed): "66.0.0", "67.0.0", "68.0.0", + "69.0.0", + "70.0.0", ] ) revisions.pop(-1 if removed == "current" else 0) diff --git a/implementations/python/tests/test_specification_coverage.py b/implementations/python/tests/test_specification_coverage.py index 9217a2ade..5ed1684eb 100644 --- a/implementations/python/tests/test_specification_coverage.py +++ b/implementations/python/tests/test_specification_coverage.py @@ -53,7 +53,7 @@ def test_immutable_bundle_index_preserves_concurrent_captures() -> None: bundles = copy_bundle(load_bundles, REPO_ROOT) assert {manifest["revision"] for manifest, *_rest in bundles} >= {"1.0.0", "1.1.0", "19.0.0"} manifest, *_rest = copy_bundle(load_bundle, REPO_ROOT) - assert manifest["revision"] == "68.0.0" + assert manifest["revision"] == "70.0.0" def test_historical_failures_name_the_revision_specific_documents() -> None: diff --git a/specs/concept-authority/semantic-profiles.md b/specs/concept-authority/semantic-profiles.md index 6d2187ba5..094927b4b 100644 --- a/specs/concept-authority/semantic-profiles.md +++ b/specs/concept-authority/semantic-profiles.md @@ -62,10 +62,12 @@ only one profile. The reference stack requires the native `episodes` concept family in the `exchange` and `execution` phases because those phases exchange and execute the participant episode state and episode history contracts. Authoring and -processing do not require the family today: ADR-013 explicitly avoids adding -SDL authoring syntax for episode semantics, and the reference processor does -not publish participant episode state/history contracts as a processing -capability. The profile therefore records episode coverage through +processing do not require the family today. Since ADR-013's amendment, SDL may +carry an optional `behavior_specifications.*.episode_policy` record of authored +episode intent (DSL-120). That record compiles to participant metadata, not to +episode state or history, and the reference processor does not publish +participant episode state/history contracts as a processing capability. The +profile therefore records episode coverage through `required_contracts` and `required_concept_families`, not through a `required_bindings` entry on `capabilities.supported_participant_contracts`; that manifest scope also contains implementation, behavior, and provenance diff --git a/specs/formal/assurance-fulfillment.yaml b/specs/formal/assurance-fulfillment.yaml index 3a4faf2fc..a7d97b3f5 100644 --- a/specs/formal/assurance-fulfillment.yaml +++ b/specs/formal/assurance-fulfillment.yaml @@ -570,31 +570,39 @@ entries: path: implementations/python/tests/test_sem_222_episode_termination_oracle.py - kind: typed_ir_or_contract_coverage path: implementations/python/packages/raes_contracts/participant_episode_closure.py + # Delivered by #307 (DSL-120): the authored episode-structure SDL contract, + # its generated schemas, and its authoring/validation/compilation tests. + - kind: unit_tests + path: implementations/python/tests/test_issue_307_dsl_120_participant_episode_policy.py + - kind: typed_ir_or_contract_coverage + path: implementations/python/packages/raes/participant_episode_policy.py + # Delivered by #309 (ACT-623): the first-class episode-structure member, + # cross-kind attachment, and recorded-history conformance tests. + - kind: unit_tests + path: implementations/python/tests/test_issue_309_act_623_participant_episode_structure.py waived_artifacts: - kind: unit_tests date: 2026-08-02 tracking: - "#306" - - "#307" - "#308" - - "#309" - "#310" rationale: >- - Joint-design run (#122). #305 (SEM-222) delivers the episode/termination - unit tests above; per-requirement unit tests for budget/exhaustion - semantics and the authored SDL surfaces remain owned by the spawned - implementation issues #306-#310. + Joint-design run (#122). #305 (SEM-222), #307 (DSL-120), and #309 + (ACT-623) deliver the episode unit tests above; per-requirement unit + tests for budget/exhaustion semantics, the interaction-budget SDL + surface, and the first-class budget member remain owned by the + spawned implementation issues #306, #308, and #310. - kind: typed_ir_or_contract_coverage date: 2026-08-02 tracking: - - "#307" - "#308" rationale: >- #305 (SEM-222) delivers the typed RL termination/truncation - closure-record contract above; the authored episode-structure and - interaction-budget SDL contracts and their generated schemas remain - owned by the DSL implementation issues #307 (DSL-120) and #308 - (DSL-121). + closure-record contract and #307 (DSL-120) delivers the authored + episode-structure SDL contract above; the interaction-budget SDL + contract and its generated schemas remain owned by the DSL + implementation issue #308 (DSL-121). - kind: property_based_or_differential_tests date: 2026-08-02 tracking: diff --git a/specs/sdl/references.md b/specs/sdl/references.md index 76fef8fae..bc313041e 100644 --- a/specs/sdl/references.md +++ b/specs/sdl/references.md @@ -407,6 +407,15 @@ the source of the row's normative meaning. | `behavior_specifications.*.participant_inject_deliveries.*.controller_ref` | `agents` | semantic validation | fatal disagreement with the selected control-transition target controller | [participant semantics](../formal/participant-semantics/README.md) | [participant-inject delivery validator](../../implementations/python/packages/raes/validator/_participant_inject_deliveries.py) | | `behavior_specifications.*.participant_inject_deliveries.*.control_authority_scope_refs[]` | `targetable` | semantic validation | fatal dangling, ambiguous, or disagreement with the selected target-state scope | [participant semantics](../formal/participant-semantics/README.md) | [participant-inject delivery validator](../../implementations/python/packages/raes/validator/_participant_inject_deliveries.py) | | `behavior_specifications.*.participant_inject_deliveries.*.control_evidence_refs[]` | `targetable` | semantic validation | fatal dangling, control disagreement, or absent evidence-requirement coverage | [participant semantics](../formal/participant-semantics/README.md) | [participant-inject delivery validator](../../implementations/python/packages/raes/validator/_participant_inject_deliveries.py) | +| `behavior_specifications.*.episode_policy.initialization.assertion_refs[]` | `assertions` | semantic validation | fatal dangling or not a precondition assertion | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.interaction_structure.action_contract_refs[]` | `action_contracts` | semantic validation | fatal outside the owning behavior specification or a selected participant | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.terminal_conditions.*.assertion_refs[]` | `assertions` | semantic validation | fatal dangling or not an invariant or postcondition assertion | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.terminal_conditions.*.temporal_constraint_ref` | `temporal_constraints` | semantic validation | fatal dangling, not a deadline, window, or duration constraint, or binding neither the owning behavior specification nor every selected participant | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.terminal_conditions.*.evidence_requirement_refs[]` | `evidence_requirements` | semantic validation | fatal dangling | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.truncation_conditions.*.assertion_refs[]` | `assertions` | semantic validation | fatal dangling or not an invariant or postcondition assertion | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.truncation_conditions.*.evidence_requirement_refs[]` | `evidence_requirements` | semantic validation | fatal dangling | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.reset_policy.evidence_requirement_refs[]` | `evidence_requirements` | semantic validation | fatal dangling | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | +| `behavior_specifications.*.episode_policy.reset_policy.memory_reset_authority_ref` | `targetable` | semantic validation | fatal dangling or ambiguous | [participant episode model](../formal/participant-episode-model/README.md) | [episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py) | | `behavior_specifications.*.behavior_mode` | `vocabulary:behavior_mode` | structural validation | fatal invalid vocabulary value | [behavior model](../formal/participant-behavior-model/README.md) | [behavior model](../../implementations/python/packages/raes/participant_behavior/__init__.py) | | `behavior_specifications.*.mixed_control.participant_ref` | `agents` | semantic validation | fatal unless owned by the enclosing behavior specification | [behavior model](../formal/participant-behavior-model/README.md) | [behavior validator](../../implementations/python/packages/raes/validator/_mixed_control.py) | | `behavior_specifications.*.mixed_control.controller_states.*.controller_ref` | `agents-or-self` | semantic validation | fatal operator/role/identity impersonation or dangling agent | [behavior model](../formal/participant-behavior-model/README.md) | [behavior validator](../../implementations/python/packages/raes/validator/_mixed_control.py) | diff --git a/specs/sdl/sections.md b/specs/sdl/sections.md index bd5047992..d0287753b 100644 --- a/specs/sdl/sections.md +++ b/specs/sdl/sections.md @@ -176,6 +176,75 @@ experiment/evaluator plane [ADR-069](../../docs/decisions/adrs/adr-069-cage-2-replication-architecture.md)), never as authored SDL. +## Participant episode structure + +`behavior_specifications.*.episode_policy` is an optional, closed record of +authored episode intent (DSL-120) for the participants that its behavior +specification selects. Its design authority is the +[participant episode model](../formal/participant-episode-model/README.md). +The required `profile` is `participant-episode-policy/v1`. The record declares +at least one of the following: + +- `initialization` names precondition assertions for every new episode + generation. +- `interaction_structure` orders turns by the `decision-epoch` authority and + names the action contracts a turn offers. Each one must belong to the owning + behavior specification and to every participant it selects. +- `terminal_conditions` is keyed by local condition identifiers. A `completed` + condition names invariant or postcondition assertions. A `timed_out` + condition names one deadline, window, or duration constraint. That + constraint must bind the owning behavior specification or every participant + it selects. +- `truncation_conditions` is keyed by local condition identifiers that differ + from the terminal ones. Each names the invariant or postcondition assertions + whose evidenced truth ends the episode as `truncated`, and it carries no + `terminal_reason`. Its assertion set must differ from that of every + `completed` condition, so one evidenced fact never ends an episode as both. +- `reset_policy` names the admitted `reset`/`restart` control actions and the + ADR-095 participant-memory scope across the reset boundary. An + `episode_local_reset` scope also names a `memory_reset_authority_ref`, and a + `persistent_across_episodes` scope names none. The ADR-095 decision-surface + assurance and information-state contracts require the same pairing; the + policy does not supply their values. The authority must resolve to exactly + one declared targetable element, such as a participant, an entity, or a + service. Module composition namespaces it, and compilation records that + element's canonical address. + +A condition holds only when every assertion it names holds. Every condition +and the reset policy name the evidence requirements that together back the +transition. Semantic validation requires each named requirement to be +declared; it does not check which record the requirement captures. +`interrupted` is never authored, because interruption is externally induced. A participant is governed by at most one episode policy, +because realized episodes are keyed by participant. The record holds +references only. It rejects realized episode coordinates such as episode +identity, lifecycle status, timestamps, sequence numbers, and decision epochs. +Those stay on the ADR-013 participant episode state and history contracts. +Checks that need a participant selection or a reference still written as a +`${var}` run again after instantiation. + +Compilation emits one `participant.episode-policy.` record beside the +selected participants' `participant.behavior.` episode addresses. It +never initializes, resets, or ends an episode, and it claims no executable or +runtime adoption. + +Episode structure is a first-class member of the behavior specification +aggregate (ACT-623). An episode policy may be the only behavior surface a +specification aggregates. It attaches to participants of every behavior mode. +The autonomous execution profile cannot carry one, so episode structure never +depends on that profile. The compiled aggregate names its member through +`episode_policy_address`. Turns are ordered by the decision epoch, while the +episode `sequence_number` orders episode instances only. The structure +describes observable episodes and does not imply that a participant exposes +an internal reasoning loop. + +Conformance compares recorded ADR-013 episode history with the compiled +structure. For a governed participant, a terminal reason other than +`interrupted` must come from an authored condition, and a recorded reset or +restart must be one that the reset policy admits. A policy without a +`reset_policy` admits any recorded reset or restart. This check reads recorded +history only. It does not evaluate conditions or claim that a backend enforces +the policy. + ## Extending the section set A new top-level authoring section is added by: defining its model and the diff --git a/tools/check_specification_coverage.py b/tools/check_specification_coverage.py index 6bd80d2e6..22abd4af4 100644 --- a/tools/check_specification_coverage.py +++ b/tools/check_specification_coverage.py @@ -173,12 +173,14 @@ def _load_bundle_index(repo_root: Path) -> list[tuple[str, dict[str, object]]]: "66.0.0", "67.0.0", "68.0.0", + "69.0.0", + "70.0.0", } if ( - dict(records)[current_path].get("revision") != "68.0.0" + dict(records)[current_path].get("revision") != "70.0.0" or {record.get("revision") for _, record in records} != supported_revisions ): - raise ValueError("coverage evidence requires the explicit current 68.0.0 release and supported history") + raise ValueError("coverage evidence requires the explicit current 70.0.0 release and supported history") return records diff --git a/tools/formal_semantic_validation/_baseline.py b/tools/formal_semantic_validation/_baseline.py index e2cefb421..499ea92cc 100644 --- a/tools/formal_semantic_validation/_baseline.py +++ b/tools/formal_semantic_validation/_baseline.py @@ -204,6 +204,9 @@ def _selected_baseline_manifest( "66.0.0", "67.0.0", "68.0.0", + "69.0.0", + "70.0.0", + "71.0.0", }: expected_corpus_path = "docs/research/formal-semantic-validation/corpus/manifest-v4.json" elif baseline_revision in _V3_CORPUS_REVISIONS: diff --git a/tools/formal_semantic_validation/_loading.py b/tools/formal_semantic_validation/_loading.py index d19e06a93..94560fed2 100644 --- a/tools/formal_semantic_validation/_loading.py +++ b/tools/formal_semantic_validation/_loading.py @@ -82,6 +82,6 @@ def load_retest_bundle( if not releases: raise ValueError("the formal semantic-validation index selects no v2 retest release") release = max(releases, key=lambda item: revision_key(item.manifest.get("revision"))) - if release.manifest.get("revision") != "69.0.0" or release.protocol.get("revision") != "2.0.0": - raise ValueError("the current formal evidence release must be the explicit 69.0.0 retest") + if release.manifest.get("revision") != "71.0.0" or release.protocol.get("revision") != "2.0.0": + raise ValueError("the current formal evidence release must be the explicit 71.0.0 retest") return release, release.protocol, release.corpus, release.snapshot, release.analysis diff --git a/tools/formal_semantic_validation/_release_revisions.py b/tools/formal_semantic_validation/_release_revisions.py index 96530a86d..b09c19e90 100644 --- a/tools/formal_semantic_validation/_release_revisions.py +++ b/tools/formal_semantic_validation/_release_revisions.py @@ -70,9 +70,11 @@ "66.0.0", "67.0.0", "68.0.0", + "69.0.0", + "70.0.0", } -_SUPPORTED_RETEST_REVISIONS = _HISTORICAL_RETEST_REVISIONS | {"69.0.0"} +_SUPPORTED_RETEST_REVISIONS = _HISTORICAL_RETEST_REVISIONS | {"71.0.0"} _SOURCE_BOUND_RETEST_REVISIONS = _SUPPORTED_RETEST_REVISIONS - {"3.0.0"} _RETEST_BASELINE_REVISIONS = { @@ -144,4 +146,6 @@ "67.0.0": "66.0.0", "68.0.0": "67.0.0", "69.0.0": "68.0.0", + "70.0.0": "69.0.0", + "71.0.0": "70.0.0", } diff --git a/tools/formal_semantic_validation/_releases.py b/tools/formal_semantic_validation/_releases.py index b60b37bbd..1230a0199 100644 --- a/tools/formal_semantic_validation/_releases.py +++ b/tools/formal_semantic_validation/_releases.py @@ -160,7 +160,7 @@ def validate_release_bundle(repo_root: Path, release: EvidenceRelease) -> list[P release.corpus, release.snapshot, release.analysis, - replay_current=manifest.get("revision") == "69.0.0", + replay_current=manifest.get("revision") == "71.0.0", ) ) else: @@ -287,6 +287,8 @@ def _expected_corpus_revision(release_revision: object) -> str: "67.0.0", "68.0.0", "69.0.0", + "70.0.0", + "71.0.0", }: expected_corpus_revision = "4.0.0" return expected_corpus_revision @@ -314,7 +316,7 @@ def validate_retest_bundle( return [ _failure( "formal-validation-current-replay-required", - "only releases 3.0.0 through 66.0.0 can use integrated historical validation", + "only releases 3.0.0 through 70.0.0 can use integrated historical validation", snapshot_path, ) ] diff --git a/tools/formal_semantic_validation/_retest.py b/tools/formal_semantic_validation/_retest.py index e5e05d6b9..0a2090a96 100644 --- a/tools/formal_semantic_validation/_retest.py +++ b/tools/formal_semantic_validation/_retest.py @@ -37,7 +37,7 @@ ) from tools.policy.common import PolicyFailure -_SOURCE_STATE_REVISIONS = frozenset(f"{revision}.0.0" for revision in range(4, 70)) +_SOURCE_STATE_REVISIONS = frozenset(f"{revision}.0.0" for revision in range(4, 72)) @dataclasses.dataclass(frozen=True) diff --git a/tools/sdl_catalog_parity/_expectations_4.py b/tools/sdl_catalog_parity/_expectations_4.py new file mode 100644 index 000000000..c19d4d17f --- /dev/null +++ b/tools/sdl_catalog_parity/_expectations_4.py @@ -0,0 +1,70 @@ +"""Reference-edge expectations, part 4: participant episode policies (DSL-120).""" + +from __future__ import annotations + +from tools.sdl_catalog_parity._paths import _DANGLING, _SEMANTIC + +_EPISODE_POLICY_VALIDATOR = ( + "[episode-policy validator](../../implementations/python/packages/raes/validator/_participant_episode_policies.py)" +) +_EPISODE_POLICY = "behavior_specifications.*.episode_policy" +_FATAL_DANGLING = "fatal dangling" +_CLOSURE_ASSERTION = "fatal dangling or not an invariant or postcondition assertion" + +EXPECTATIONS_PART_4: dict[str, tuple[str, str, str, str]] = { + f"{_EPISODE_POLICY}.initialization.assertion_refs[]": ( + "assertions", + _SEMANTIC, + "fatal dangling or not a precondition assertion", + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.interaction_structure.action_contract_refs[]": ( + "action_contracts", + _SEMANTIC, + "fatal outside the owning behavior specification or a selected participant", + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.terminal_conditions.*.assertion_refs[]": ( + "assertions", + _SEMANTIC, + _CLOSURE_ASSERTION, + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.terminal_conditions.*.temporal_constraint_ref": ( + "temporal_constraints", + _SEMANTIC, + "fatal dangling, not a deadline, window, or duration constraint, or binding neither the owning behavior " + "specification nor every selected participant", + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.terminal_conditions.*.evidence_requirement_refs[]": ( + "evidence_requirements", + _SEMANTIC, + _FATAL_DANGLING, + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.truncation_conditions.*.assertion_refs[]": ( + "assertions", + _SEMANTIC, + _CLOSURE_ASSERTION, + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.truncation_conditions.*.evidence_requirement_refs[]": ( + "evidence_requirements", + _SEMANTIC, + _FATAL_DANGLING, + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.reset_policy.evidence_requirement_refs[]": ( + "evidence_requirements", + _SEMANTIC, + _FATAL_DANGLING, + _EPISODE_POLICY_VALIDATOR, + ), + f"{_EPISODE_POLICY}.reset_policy.memory_reset_authority_ref": ( + "targetable", + _SEMANTIC, + _DANGLING, + _EPISODE_POLICY_VALIDATOR, + ), +} diff --git a/tools/sdl_catalog_parity/_registry.py b/tools/sdl_catalog_parity/_registry.py index 00f200c14..6a285a975 100644 --- a/tools/sdl_catalog_parity/_registry.py +++ b/tools/sdl_catalog_parity/_registry.py @@ -5,13 +5,15 @@ from tools.sdl_catalog_parity._expectations_1 import EXPECTATIONS_PART_1 from tools.sdl_catalog_parity._expectations_2 import EXPECTATIONS_PART_2 from tools.sdl_catalog_parity._expectations_3 import EXPECTATIONS_PART_3 +from tools.sdl_catalog_parity._expectations_4 import EXPECTATIONS_PART_4 REFERENCE_EDGE_EXPECTATIONS: dict[str, tuple[str, str, str, str]] = { **EXPECTATIONS_PART_1, **EXPECTATIONS_PART_2, **EXPECTATIONS_PART_3, + **EXPECTATIONS_PART_4, } -_PART_TOTAL = len(EXPECTATIONS_PART_1) + len(EXPECTATIONS_PART_2) + len(EXPECTATIONS_PART_3) +_PART_TOTAL = len(EXPECTATIONS_PART_1) + len(EXPECTATIONS_PART_2) + len(EXPECTATIONS_PART_3) + len(EXPECTATIONS_PART_4) if len(REFERENCE_EDGE_EXPECTATIONS) != _PART_TOTAL: raise AssertionError("reference-edge expectation parts overlap")