Promote schema and canonicalizer out of history; add EvidenceModel (T06)

Verified the three published hashes reproduce byte for byte before promoting
anything, then moved the schema, canonicalizer and vectors into governed assets.
history/20260909-initial-exploration/ is untouched and stays the provenance
record.

- schemas/, informed_decision/, tests/vectors/ populated; the reference
  canonicalizer's ad-hoc __main__ block replaced by a real
  `python -m informed_decision` entry point.
- tests/test_canonicalize.py — 20 tests, all green. Published vectors, all four
  isolation properties, canonical-form round-trip, key sorting, and a provenance
  test asserting the governed fixtures have not drifted from history/.
- docs/specs/EvidenceModel.md — the two hashes, the split and why it exists, the
  four isolation properties, the presentation record, the bundle, and the
  relationship to audit-core.
- pyproject.toml, Makefile.

One test of mine was wrong on first run: it scanned for ", " to assert no
insignificant whitespace, which fires on prose inside a brief. Replaced with a
canonical round-trip comparison, which is the property actually meant. The
canonicalizer was correct.

EvidenceModel leads with what the model does NOT claim — no proof of
comprehension, no proof of reading (deliberately, since the alternative is
surveillance), no survival of a compromised surface, and audit-core's inherited
bound that a hash chain cannot prove a record was never sent.

T06 stays progress: the SCOPE.md rewrite is gated on the T02 ruling.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
This commit is contained in:
tegwick 2026-09-09 14:16:28 +02:00
parent 7ae67b2f4e
commit a8e227851e
19 changed files with 2207 additions and 2 deletions

View file

@ -0,0 +1,150 @@
{
"id": "01K4Q8Z3R7V2N6K9M1P5T8W4XC",
"version": 2,
"schema_version": "0.2.0",
"status": "awaiting_actor",
"depth": 2,
"title": "Accept ADR-0042: event-sourced billing ledger",
"question": "Do you formally accept ADR-0042 as the billing architecture for prod?",
"requested_act": "accept",
"binding_level": "aes",
"locale": "en",
"created_at": "2026-09-08T14:02:11Z",
"updated_at": "2026-09-09T07:18:44Z",
"submitted_at": "2026-09-08T15:10:00Z",
"due_at": "2026-09-12T16:00:00Z",
"requester": {
"id": "01K4Q8A1B2C3D4E5F6G7H8J9K0",
"kind": "person",
"display_name": "Lea Hoffmann",
"role": "staff engineer",
"identifiers": [
{ "scheme": "email", "value": "lea.hoffmann@example.com" },
{ "scheme": "idp:oidc-sub", "value": "auth.example.com|a8f21c" }
]
},
"parties": [
{
"id": "01K4Q8MANDATE000000000001",
"kind": "person",
"display_name": "Bernd Worsch",
"role": "principal engineer / ADR acceptor",
"mandate": {
"id": "01K4Q8MANDATE00000000000A",
"scope": "Accept architecture decision records for billing and payments",
"policy_ref": "https://policy.example.com/adr-acceptance"
}
}
],
"brief": "Replace nightly batch invoicing with an append-only event ledger. Replay is the source of truth for invoices. Dual-run for 60 days. Rollback: freeze the ledger and revert the read model to the last nightly snapshot.",
"consequences": "On-call owns replay tooling. Finance reporting moves from SQL warehouse tables to a projection job. No in-place updates of posted invoices.",
"packet": [
{
"id": "01K4Q8DOC0000000000000001",
"role": "primary",
"filename": "ADR-0042.md",
"media_type": "text/markdown",
"language": "en",
"bytes": 12880,
"hash": { "alg": "sha256", "hex": "6b1c0f8a9d2e4c7b8a1f0e3d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b" },
"storage_uri": "s3://decisions/adr/0042.md",
"version": 2,
"is_to_be_signed": true,
"label": "ADR-0042"
}
],
"highlights": [
{
"id": "01K4Q8HL00000000000000001",
"item_id": "01K4Q8DOC0000000000000001",
"severity": "critical",
"locator": {
"kind": "markdown_heading",
"heading": "Consequences / rollback"
},
"title": "Rollback is operationally expensive",
"note": "Accepting this ADR commits on-call to ledger freeze drills before go-live.",
"required_ack": true,
"author_id": "01K4Q8A1B2C3D4E5F6G7H8J9K0",
"created_at": "2026-09-08T14:20:00Z",
"source": "requester"
}
],
"route": {
"mode": "sequential",
"steps": [
{
"id": "01K4Q8STEP000000000000001",
"ordinal": 1,
"kind": "review",
"assignee": {
"id": "01K4Q8MANDATE000000000002",
"kind": "role",
"display_name": "Billing domain reviewer"
},
"required_verbs": ["acknowledge"],
"status": "completed",
"completed_at": "2026-09-08T17:40:00Z"
},
{
"id": "01K4Q8STEP000000000000002",
"ordinal": 2,
"kind": "schlusszeichnung",
"assignee": {
"id": "01K4Q8MANDATE000000000001",
"kind": "person",
"display_name": "Bernd Worsch"
},
"required_verbs": ["accept", "return", "escalate"],
"min_binding_level": "aes",
"status": "active",
"due_at": "2026-09-12T16:00:00Z"
}
],
"current_step_ids": ["01K4Q8STEP000000000000002"]
},
"thread": [
{
"id": "01K4Q8MSG0000000000000001",
"author_id": "01K4Q8MANDATE000000000002",
"body": "Rollback drill date is missing. Acceptable if added before go-live.",
"created_at": "2026-09-08T17:39:12Z"
}
],
"presentations": [
{
"id": "01K4Q8PRES000000000000001",
"actor_id": "01K4Q8MANDATE000000000001",
"memo_version": 2,
"opened_at": "2026-09-09T07:10:00Z",
"ui_release": "informed-decision@0.3.1",
"locale": "en",
"viewport": "brief",
"packet_hashes": [
{
"item_id": "01K4Q8DOC0000000000000001",
"hash": { "alg": "sha256", "hex": "6b1c0f8a9d2e4c7b8a1f0e3d5c6b7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b" }
}
],
"highlight_ids": ["01K4Q8HL00000000000000001"],
"highlight_set_hash": { "alg": "sha256", "hex": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" },
"brief_hash": { "alg": "sha256", "hex": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" },
"view_hash": { "alg": "sha256", "hex": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" },
"acked_highlight_ids": ["01K4Q8HL00000000000000001"],
"auth_context": {
"method": "passkey",
"assurance": "substantial",
"idp": "https://auth.example.com"
}
}
],
"dispositions": [],
"relations": [
{ "kind": "supersedes", "to": "01K4Q8OLDADR0000000000001", "note": "Supersedes ADR-0011 batch invoicing" }
],
"legal": {
"form_requirement": "none",
"retention_years": 10,
"classification": "internal"
}
}

View file

@ -0,0 +1,153 @@
{
"id": "01K4LOGIN00000000000000001",
"version": 1,
"schema_version": "0.2.0",
"status": "awaiting_actor",
"depth": 0,
"title": "Login to Payroll-Prod / ACME",
"question": "Log into Payroll-Prod as Bernd Worsch in tenant ACME?",
"requested_act": "login",
"binding_level": "organizational",
"locale": "en",
"created_at": "2026-09-09T08:01:00Z",
"updated_at": "2026-09-09T08:01:00Z",
"requester": {
"id": "01K4SYSTEM00000000000000001",
"kind": "system",
"display_name": "Payroll-Prod IdP"
},
"subject": {
"id": "01K4PERSONBERND00000000001",
"kind": "person",
"display_name": "Bernd Worsch"
},
"brief": "You are entering Payroll-Prod. Sessions are recorded. Privileges at the gate are identity-scoped, not hat-scoped.",
"identity_context": {
"system": "Payroll-Prod",
"environment": "prod",
"binding": {
"principal": {
"id": "01K4PERSONBERND00000000001",
"kind": "person",
"display_name": "Bernd Worsch",
"role": "employee",
"identifiers": [
{ "scheme": "email", "value": "bernd.worsch@example.com" },
{ "scheme": "idp:oidc-sub", "value": "auth.example.com|bernd" }
]
},
"available_identities": [
{
"id": "01K4PERSONBERND00000000001",
"kind": "person",
"display_name": "Bernd Worsch"
},
{
"id": "01K4PERSONBERNDADMIN000001",
"kind": "person",
"display_name": "Bernd Worsch (break-glass)"
}
],
"target": {
"kind": "tenant",
"id": "tenant:acme",
"label": "ACME Corp",
"environment": "prod",
"requires_new_bind": true
},
"available_bind_scopes": [
{
"kind": "tenant",
"id": "tenant:acme",
"label": "ACME Corp",
"environment": "prod",
"requires_new_bind": true
},
{
"kind": "tenant",
"id": "tenant:beta",
"label": "Beta GmbH",
"environment": "prod",
"requires_new_bind": true
}
],
"granted_at_bind": {
"roles": ["authenticated"],
"permissions": ["session.create"]
},
"terms": {
"monitoring": true,
"consent_code": "LOGIN-PROD-2026"
}
},
"awareness": {
"proposed_hat": {
"id": "hat:finance-controller",
"label": "Finance Controller",
"kind": "access_profile",
"elevates": false,
"scope_id": "tenant:acme"
},
"proposed_hat_source": "last_used",
"available_hats": [
{
"id": "hat:finance-controller",
"label": "Finance Controller",
"kind": "access_profile",
"elevates": false
},
{
"id": "hat:auditor-readonly",
"label": "Auditor (read-only)",
"kind": "perspective",
"elevates": false
},
{
"id": "hat:payroll-admin",
"label": "Payroll Admin",
"kind": "role",
"elevates": true
}
],
"available_scopes": [
{
"kind": "tenant",
"id": "tenant:beta",
"label": "Beta GmbH",
"environment": "prod",
"requires_new_bind": true
}
],
"last_session": {
"ended_at": "2026-09-08T16:12:00Z",
"hat_id": "hat:finance-controller",
"scope_id": "tenant:acme"
},
"situation_note": "Last session Tuesday 18:12 CEST as Finance Controller in ACME."
}
},
"packet": [],
"highlights": [],
"route": {
"mode": "sequential",
"steps": [
{
"id": "01K4LOGINSTEP0000000000001",
"ordinal": 1,
"kind": "acknowledge",
"assignee": {
"id": "01K4PERSONBERND00000000001",
"kind": "person",
"display_name": "Bernd Worsch"
},
"required_verbs": ["accept", "decline"],
"min_binding_level": "organizational",
"status": "active"
}
],
"current_step_ids": ["01K4LOGINSTEP0000000000001"]
},
"session": {
"status": "pending"
}
}

View file

@ -0,0 +1,910 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://informed-decision.dev/schema/decision-memo/v0.2",
"title": "Informed-Decision Decision Memo",
"description": "Portable decision object: context, circulation, disposition, and cryptographic evidence of an informed identity-bound act.",
"$defs": {
"uri": { "type": "string", "format": "uri" },
"datetime": { "type": "string", "format": "date-time" },
"ulid": {
"type": "string",
"pattern": "^[0-9A-HJKMNP-TV-Z]{26}$",
"description": "ULID. UUID v7 is also acceptable at the API boundary."
},
"sha256": {
"type": "string",
"pattern": "^sha256:[a-f0-9]{64}$"
},
"contentHash": {
"type": "object",
"additionalProperties": false,
"required": ["alg", "hex"],
"properties": {
"alg": { "type": "string", "enum": ["sha256", "sha384", "sha3-256"] },
"hex": { "type": "string", "pattern": "^[a-f0-9]{64,96}$" }
}
},
"locale": { "type": "string", "pattern": "^[a-z]{2}(-[A-Z]{2})?$" },
"markdown": { "type": "string", "maxLength": 100000 },
"shortText": { "type": "string", "minLength": 1, "maxLength": 280 },
"mediumText": { "type": "string", "maxLength": 4000 },
"bindingLevel": {
"type": "string",
"description": "How strongly the resulting act is meant to bind.",
"enum": [
"none",
"acknowledgment",
"organizational",
"ses",
"aes",
"qes",
"qeseal"
]
},
"assuranceLevel": {
"type": "string",
"enum": ["low", "substantial", "high"]
},
"depthLevel": {
"type": "integer",
"minimum": 0,
"maximum": 5,
"description": "L0 login … L5 multi-party instrument. Advisory; schema is shared."
},
"requestedAct": {
"type": "string",
"enum": [
"login",
"elevate",
"acknowledge",
"approve",
"accept",
"decline",
"sign",
"seal",
"countersign",
"ratify"
]
},
"memoStatus": {
"type": "string",
"enum": [
"draft",
"submitted",
"circulating",
"awaiting_actor",
"in_discussion",
"returned",
"completed",
"withdrawn",
"expired",
"superseded"
]
},
"outcome": {
"type": "string",
"enum": [
"accepted",
"declined",
"acknowledged",
"abstained",
"recused",
"cancelled",
"timed_out"
]
},
"dispositionVerb": {
"type": "string",
"enum": [
"comment",
"discuss",
"return",
"forward",
"escalate",
"acknowledge",
"accept",
"decline",
"abstain",
"recuse",
"withdraw",
"stamp",
"configure",
"promote"
]
},
"sessionStatus": {
"type": "string",
"enum": ["none", "pending", "active", "ended"]
},
"awarenessSource": {
"type": "string",
"enum": ["system_default", "last_used", "policy", "explicit", "inferred"]
},
"scopeKind": {
"type": "string",
"enum": ["system", "tenant", "workspace", "resource", "privilege_set", "environment"]
},
"partyKind": {
"type": "string",
"enum": ["person", "org", "role", "group", "system", "agent"]
},
"routeMode": {
"type": "string",
"enum": ["sequential", "parallel", "hybrid"]
},
"stepKind": {
"type": "string",
"enum": [
"inform",
"comment",
"review",
"mitzeichnung",
"schlusszeichnung",
"acknowledge",
"approve",
"sign",
"seal",
"deposit"
]
},
"documentRole": {
"type": "string",
"enum": [
"brief",
"primary",
"annex",
"supporting",
"prior_decision",
"diff",
"translation",
"evidence_export"
]
},
"highlightSeverity": {
"type": "string",
"enum": ["critical", "material", "informational"]
},
"evidenceEventType": {
"type": "string",
"enum": [
"memo.created",
"memo.updated",
"memo.submitted",
"memo.withdrawn",
"memo.superseded",
"memo.expired",
"packet.attached",
"packet.detached",
"highlight.added",
"highlight.updated",
"route.started",
"route.step_assigned",
"route.step_completed",
"route.returned",
"route.forwarded",
"route.escalated",
"presentation.opened",
"presentation.viewed",
"presentation.highlight_acked",
"identity.authenticated",
"identity.step_up",
"disposition.recorded",
"signature.created",
"seal.created",
"timestamp.qualified",
"file.stamped",
"bundle.sealed",
"awareness.shown",
"session.started",
"session.configured",
"session.hat_selected",
"session.ended",
"scope.rebind_required"
]
},
"identifier": {
"type": "object",
"additionalProperties": false,
"required": ["scheme", "value"],
"properties": {
"scheme": {
"type": "string",
"description": "idp:oidc-sub | eudi:pid | eidas:person | email | employee_id | lei | orga_id | did"
},
"value": { "type": "string", "minLength": 1, "maxLength": 1024 },
"issuing_authority": { "type": "string" }
}
},
"mandate": {
"type": "object",
"additionalProperties": false,
"required": ["id", "scope"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"scope": {
"type": "string",
"description": "Human-readable competence: 'CFO contracts ≤ 250k EUR', 'prod-admin JIT', 'ADR acceptor'."
},
"policy_ref": { "$ref": "#/$defs/uri" },
"max_value": {
"type": "object",
"additionalProperties": false,
"properties": {
"amount": { "type": "number" },
"currency": { "type": "string", "minLength": 3, "maxLength": 3 }
}
},
"valid_from": { "$ref": "#/$defs/datetime" },
"valid_until": { "$ref": "#/$defs/datetime" },
"delegation_of": { "$ref": "#/$defs/ulid" }
}
},
"partyRef": {
"type": "object",
"additionalProperties": false,
"required": ["id", "kind", "display_name"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"kind": { "$ref": "#/$defs/partyKind" },
"display_name": { "type": "string", "minLength": 1, "maxLength": 200 },
"identifiers": {
"type": "array",
"items": { "$ref": "#/$defs/identifier" }
},
"org_id": { "$ref": "#/$defs/ulid" },
"role": { "type": "string" },
"mandate": { "$ref": "#/$defs/mandate" },
"contact": {
"type": "object",
"additionalProperties": false,
"properties": {
"email": { "type": "string", "format": "email" },
"channel": { "type": "string", "enum": ["in_app", "email", "matrix", "teams"] }
}
}
}
},
"locator": {
"type": "object",
"additionalProperties": false,
"description": "Stable pointer into a packet item. Prefer quote+context over pixel boxes.",
"required": ["kind"],
"properties": {
"kind": {
"type": "string",
"enum": [
"text_quote",
"pdf_page_region",
"markdown_heading",
"json_pointer",
"xpath",
"sheet_range",
"whole_document"
]
},
"quote": { "type": "string", "maxLength": 2000 },
"prefix": { "type": "string", "maxLength": 200 },
"suffix": { "type": "string", "maxLength": 200 },
"page": { "type": "integer", "minimum": 1 },
"bbox": {
"type": "array",
"items": { "type": "number" },
"minItems": 4,
"maxItems": 4
},
"heading": { "type": "string" },
"pointer": { "type": "string" },
"sheet": { "type": "string" },
"range": { "type": "string" }
}
},
"packetItem": {
"type": "object",
"additionalProperties": false,
"required": ["id", "role", "filename", "media_type", "hash", "bytes"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"role": { "$ref": "#/$defs/documentRole" },
"filename": { "type": "string" },
"media_type": { "type": "string" },
"language": { "$ref": "#/$defs/locale" },
"bytes": { "type": "integer", "minimum": 0 },
"hash": { "$ref": "#/$defs/contentHash" },
"storage_uri": { "$ref": "#/$defs/uri" },
"pages": { "type": "integer", "minimum": 1 },
"version": { "type": "integer", "minimum": 1 },
"replaces": { "$ref": "#/$defs/ulid" },
"is_to_be_signed": { "type": "boolean", "default": false },
"is_to_be_stamped": { "type": "boolean", "default": false },
"label": { "type": "string" }
}
},
"highlight": {
"type": "object",
"additionalProperties": false,
"required": ["id", "item_id", "severity", "locator", "author_id", "created_at"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"item_id": { "$ref": "#/$defs/ulid" },
"severity": { "$ref": "#/$defs/highlightSeverity" },
"locator": { "$ref": "#/$defs/locator" },
"title": { "$ref": "#/$defs/shortText" },
"note": { "$ref": "#/$defs/mediumText" },
"required_ack": { "type": "boolean", "default": false },
"author_id": { "$ref": "#/$defs/ulid" },
"created_at": { "$ref": "#/$defs/datetime" },
"source": { "type": "string", "enum": ["requester", "reviewer", "system", "agent"] }
}
},
"routeStep": {
"type": "object",
"additionalProperties": false,
"required": ["id", "ordinal", "kind", "assignee", "required_verbs"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"ordinal": { "type": "integer", "minimum": 1 },
"parallel_group": {
"type": "string",
"description": "Steps sharing a group may complete in any order. Next ordinal waits for the group."
},
"kind": { "$ref": "#/$defs/stepKind" },
"assignee": { "$ref": "#/$defs/partyRef" },
"required_verbs": {
"type": "array",
"minItems": 1,
"items": { "$ref": "#/$defs/dispositionVerb" }
},
"min_binding_level": { "$ref": "#/$defs/bindingLevel" },
"due_at": { "$ref": "#/$defs/datetime" },
"started_at": { "$ref": "#/$defs/datetime" },
"completed_at": { "$ref": "#/$defs/datetime" },
"status": {
"type": "string",
"enum": ["pending", "ready", "active", "blocked", "completed", "skipped", "returned"]
},
"completion_disposition_id": { "$ref": "#/$defs/ulid" },
"instructions": { "$ref": "#/$defs/mediumText" }
}
},
"route": {
"type": "object",
"additionalProperties": false,
"required": ["mode", "steps"],
"properties": {
"mode": { "$ref": "#/$defs/routeMode" },
"policy_ref": { "$ref": "#/$defs/uri" },
"steps": {
"type": "array",
"minItems": 1,
"items": { "$ref": "#/$defs/routeStep" }
},
"current_step_ids": {
"type": "array",
"items": { "$ref": "#/$defs/ulid" }
}
}
},
"commentAnchor": {
"type": "object",
"additionalProperties": false,
"properties": {
"item_id": { "$ref": "#/$defs/ulid" },
"highlight_id": { "$ref": "#/$defs/ulid" },
"locator": { "$ref": "#/$defs/locator" }
}
},
"threadMessage": {
"type": "object",
"additionalProperties": false,
"required": ["id", "author_id", "body", "created_at"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"author_id": { "$ref": "#/$defs/ulid" },
"body": { "$ref": "#/$defs/markdown" },
"anchor": { "$ref": "#/$defs/commentAnchor" },
"created_at": { "$ref": "#/$defs/datetime" },
"visibility": {
"type": "string",
"enum": ["all_parties", "internal", "step_only"],
"default": "all_parties"
}
}
},
"presentationSnapshot": {
"type": "object",
"additionalProperties": false,
"description": "Canonical record of what an actor was shown. The disposition MUST reference a snapshot.",
"required": [
"id",
"actor_id",
"memo_version",
"opened_at",
"ui_release",
"locale",
"packet_hashes",
"highlight_set_hash",
"view_hash"
],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"actor_id": { "$ref": "#/$defs/ulid" },
"memo_version": { "type": "integer", "minimum": 1 },
"opened_at": { "$ref": "#/$defs/datetime" },
"closed_at": { "$ref": "#/$defs/datetime" },
"ui_release": { "type": "string" },
"locale": { "$ref": "#/$defs/locale" },
"viewport": { "type": "string", "enum": ["banner", "brief", "packet", "sign", "awareness", "configure"] },
"phase": { "type": "string", "enum": ["pre_bind", "bind", "post_bind"] },
"awareness_hash": {
"$ref": "#/$defs/contentHash",
"description": "Hash of the awareness slice as shown. Not part of view_hash unless a promote disposition copied fields into binding."
},
"packet_hashes": {
"type": "array",
"items": {
"type": "object",
"required": ["item_id", "hash"],
"additionalProperties": false,
"properties": {
"item_id": { "$ref": "#/$defs/ulid" },
"hash": { "$ref": "#/$defs/contentHash" }
}
}
},
"highlight_ids": {
"type": "array",
"items": { "$ref": "#/$defs/ulid" }
},
"highlight_set_hash": { "$ref": "#/$defs/contentHash" },
"brief_hash": { "$ref": "#/$defs/contentHash" },
"view_hash": {
"$ref": "#/$defs/contentHash",
"description": "Hash of the canonical presentation document (brief + ordered highlights + visible packet manifests)."
},
"acked_highlight_ids": {
"type": "array",
"items": { "$ref": "#/$defs/ulid" }
},
"auth_context": {
"type": "object",
"additionalProperties": false,
"properties": {
"method": {
"type": "string",
"enum": [
"password",
"mfa",
"passkey",
"oidc",
"saml",
"eudi_wallet",
"national_eid",
"qscd"
]
},
"assurance": { "$ref": "#/$defs/assuranceLevel" },
"idp": { "type": "string" },
"session_id": { "type": "string" }
}
}
}
},
"returnPayload": {
"type": "object",
"additionalProperties": false,
"required": ["reasons"],
"properties": {
"reasons": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"required": ["code", "text"],
"additionalProperties": false,
"properties": {
"code": {
"type": "string",
"enum": [
"insufficient_context",
"wrong_scope",
"wrong_assignee",
"highlights_incomplete",
"document_stale",
"legal_issue",
"commercial_issue",
"risk_unaddressed",
"other"
]
},
"text": { "$ref": "#/$defs/mediumText" },
"anchor": { "$ref": "#/$defs/commentAnchor" }
}
}
},
"required_changes": { "$ref": "#/$defs/markdown" }
}
},
"transferPayload": {
"type": "object",
"additionalProperties": false,
"required": ["to"],
"properties": {
"to": { "$ref": "#/$defs/partyRef" },
"reason": { "$ref": "#/$defs/mediumText" },
"keep_self_informed": { "type": "boolean", "default": true }
}
},
"signaturePayload": {
"type": "object",
"additionalProperties": false,
"required": ["level", "signed_hash"],
"properties": {
"level": { "$ref": "#/$defs/bindingLevel" },
"profile": {
"type": "string",
"enum": ["PAdES-B-LT", "PAdES-B-LTA", "XAdES-B-LT", "CAdES-B-LT", "JAdES", "raw"]
},
"signed_hash": { "$ref": "#/$defs/contentHash" },
"signed_item_ids": {
"type": "array",
"items": { "$ref": "#/$defs/ulid" }
},
"presentation_bound": {
"type": "boolean",
"description": "True when view_hash is included in the signed attributes (dynamic linking)."
},
"certificate_ref": { "type": "string" },
"tsp": { "type": "string" },
"qts_token_ref": { "type": "string" },
"cms_or_jose": { "type": "string", "description": "Detached signature reference or storage URI." }
}
},
"disposition": {
"type": "object",
"additionalProperties": false,
"required": [
"id",
"verb",
"actor",
"step_id",
"presentation_id",
"created_at",
"payload_hash"
],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"verb": { "$ref": "#/$defs/dispositionVerb" },
"actor": { "$ref": "#/$defs/partyRef" },
"step_id": { "$ref": "#/$defs/ulid" },
"presentation_id": {
"$ref": "#/$defs/ulid",
"description": "Required binding to a presentation snapshot. No snapshot, no binding act."
},
"body": { "$ref": "#/$defs/markdown" },
"return": { "$ref": "#/$defs/returnPayload" },
"transfer": { "$ref": "#/$defs/transferPayload" },
"signature": { "$ref": "#/$defs/signaturePayload" },
"configure": { "$ref": "#/$defs/configurePayload" },
"created_at": { "$ref": "#/$defs/datetime" },
"payload_hash": { "$ref": "#/$defs/contentHash" },
"actor_signature": {
"description": "Optional signature over payload_hash + presentation.view_hash + memo.id@version.",
"$ref": "#/$defs/signaturePayload"
}
}
},
"evidenceEvent": {
"type": "object",
"additionalProperties": false,
"required": ["id", "seq", "type", "at", "payload_hash", "prev_hash", "event_hash"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"seq": { "type": "integer", "minimum": 0 },
"type": { "$ref": "#/$defs/evidenceEventType" },
"at": { "$ref": "#/$defs/datetime" },
"actor_id": { "$ref": "#/$defs/ulid" },
"payload": { "type": "object" },
"payload_hash": { "$ref": "#/$defs/contentHash" },
"prev_hash": { "$ref": "#/$defs/contentHash" },
"event_hash": { "$ref": "#/$defs/contentHash" },
"ip_hash": {
"type": "string",
"description": "Optional HMAC of network address; store raw IP only where lawful."
},
"device_attestation": { "type": "string" }
}
},
"evidenceBundle": {
"type": "object",
"additionalProperties": false,
"required": ["id", "memo_id", "memo_version", "events", "head_hash"],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"memo_id": { "$ref": "#/$defs/ulid" },
"memo_version": { "type": "integer" },
"events": {
"type": "array",
"items": { "$ref": "#/$defs/evidenceEvent" }
},
"head_hash": { "$ref": "#/$defs/contentHash" },
"sealed_at": { "$ref": "#/$defs/datetime" },
"seal": { "$ref": "#/$defs/signaturePayload" },
"qualified_timestamp_ref": { "type": "string" },
"export_uri": { "$ref": "#/$defs/uri" }
}
},
"relation": {
"type": "object",
"additionalProperties": false,
"required": ["kind", "to"],
"properties": {
"kind": {
"type": "string",
"enum": [
"supersedes",
"superseded_by",
"relates_to",
"implements",
"triggered_by",
"attachment_of",
"translation_of"
]
},
"to": { "$ref": "#/$defs/ulid" },
"note": { "type": "string" }
}
},
"scopeRef": {
"type": "object",
"additionalProperties": false,
"required": ["kind", "id", "label"],
"properties": {
"kind": { "$ref": "#/$defs/scopeKind" },
"id": { "type": "string", "minLength": 1, "maxLength": 200 },
"label": { "type": "string" },
"environment": { "type": "string", "enum": ["dev", "test", "stage", "prod", "other"] },
"requires_new_bind": {
"type": "boolean",
"default": false,
"description": "If true, entering this scope is a new binding act, not a post-sign configure."
}
}
},
"hat": {
"type": "object",
"additionalProperties": false,
"description": "Post-bind perspective: role, access profile, or UI/work mode inside an already bound scope.",
"required": ["id", "label"],
"properties": {
"id": { "type": "string", "minLength": 1, "maxLength": 200 },
"label": { "type": "string" },
"kind": {
"type": "string",
"enum": ["role", "access_profile", "perspective", "duty"]
},
"permissions_preview": { "type": "array", "items": { "type": "string" } },
"scope_id": { "type": "string" },
"elevates": {
"type": "boolean",
"default": false,
"description": "If true, selecting this hat is a privilege act and MUST be promoted into binding or a child memo."
}
}
},
"bindingSlice": {
"type": "object",
"additionalProperties": false,
"description": "PRE-SIGN. Identity and scope being bound. Included in view_hash. Choosing among identities or bind-scopes happens here.",
"required": ["principal", "target"],
"properties": {
"principal": { "$ref": "#/$defs/partyRef" },
"available_identities": {
"type": "array",
"items": { "$ref": "#/$defs/partyRef" }
},
"target": { "$ref": "#/$defs/scopeRef" },
"available_bind_scopes": {
"type": "array",
"description": "Scopes the actor may enter as part of THIS bind (e.g. pick tenant at login).",
"items": { "$ref": "#/$defs/scopeRef" }
},
"granted_at_bind": {
"type": "object",
"additionalProperties": false,
"properties": {
"roles": { "type": "array", "items": { "type": "string" } },
"permissions": { "type": "array", "items": { "type": "string" } },
"duration_seconds": { "type": "integer", "minimum": 1 }
}
},
"justification": { "$ref": "#/$defs/mediumText" },
"blast_radius": { "$ref": "#/$defs/mediumText" },
"terms": {
"type": "object",
"additionalProperties": false,
"properties": {
"monitoring": { "type": "boolean" },
"consent_code": { "type": "string" },
"consent_text_hash": { "$ref": "#/$defs/contentHash" }
}
}
}
},
"awarenessSlice": {
"type": "object",
"additionalProperties": false,
"description": "Shown before and after bind for situational awareness. Hashed separately as awareness_hash. NOT in view_hash unless promoted.",
"properties": {
"proposed_hat": { "$ref": "#/$defs/hat" },
"proposed_hat_source": { "$ref": "#/$defs/awarenessSource" },
"available_hats": { "type": "array", "items": { "$ref": "#/$defs/hat" } },
"available_scopes": {
"type": "array",
"description": "Other scopes visible for orientation. Those with requires_new_bind=true cannot be configured post-sign.",
"items": { "$ref": "#/$defs/scopeRef" }
},
"last_session": {
"type": "object",
"additionalProperties": false,
"properties": {
"ended_at": { "$ref": "#/$defs/datetime" },
"hat_id": { "type": "string" },
"scope_id": { "type": "string" },
"principal_id": { "$ref": "#/$defs/ulid" }
}
},
"situation_note": { "$ref": "#/$defs/mediumText" }
}
},
"sessionState": {
"type": "object",
"additionalProperties": false,
"description": "POST-SIGN live configuration inside a completed bind (login, elevation). Configure acts mutate this, not the sealed binding slice.",
"required": ["status"],
"properties": {
"status": { "$ref": "#/$defs/sessionStatus" },
"started_at": { "$ref": "#/$defs/datetime" },
"ended_at": { "$ref": "#/$defs/datetime" },
"bound_memo_version": { "type": "integer", "minimum": 1 },
"bound_presentation_id": { "$ref": "#/$defs/ulid" },
"active_hat": { "$ref": "#/$defs/hat" },
"active_hat_source": { "$ref": "#/$defs/awarenessSource" }
}
},
"configurePayload": {
"type": "object",
"additionalProperties": false,
"properties": {
"hat": { "$ref": "#/$defs/hat" },
"source": { "$ref": "#/$defs/awarenessSource" },
"note": { "$ref": "#/$defs/mediumText" }
}
},
"identityContext": {
"type": "object",
"additionalProperties": false,
"description": "L0/L1 split: binding_slice is pre-sign and signed; awareness_slice is orientation and optional post-sign configure.",
"properties": {
"system": { "type": "string" },
"environment": { "type": "string", "enum": ["dev", "test", "stage", "prod", "other"] },
"principal": { "$ref": "#/$defs/partyRef" },
"requested_roles": { "type": "array", "items": { "type": "string" } },
"requested_permissions": { "type": "array", "items": { "type": "string" } },
"duration_seconds": { "type": "integer", "minimum": 1 },
"justification": { "$ref": "#/$defs/mediumText" },
"blast_radius": { "$ref": "#/$defs/mediumText" },
"binding": { "$ref": "#/$defs/bindingSlice" },
"awareness": { "$ref": "#/$defs/awarenessSlice" }
}
}
},
"type": "object",
"additionalProperties": false,
"required": [
"id",
"version",
"schema_version",
"status",
"created_at",
"updated_at",
"requester",
"question",
"requested_act",
"binding_level",
"brief",
"packet",
"route"
],
"properties": {
"id": { "$ref": "#/$defs/ulid" },
"version": { "type": "integer", "minimum": 1 },
"schema_version": { "type": "string", "const": "0.2.0" },
"status": { "$ref": "#/$defs/memoStatus" },
"outcome": { "$ref": "#/$defs/outcome" },
"depth": { "$ref": "#/$defs/depthLevel" },
"title": { "$ref": "#/$defs/shortText" },
"question": {
"$ref": "#/$defs/shortText",
"description": "Single present-tense decision question."
},
"requested_act": { "$ref": "#/$defs/requestedAct" },
"binding_level": { "$ref": "#/$defs/bindingLevel" },
"locale": { "$ref": "#/$defs/locale" },
"created_at": { "$ref": "#/$defs/datetime" },
"updated_at": { "$ref": "#/$defs/datetime" },
"submitted_at": { "$ref": "#/$defs/datetime" },
"due_at": { "$ref": "#/$defs/datetime" },
"completed_at": { "$ref": "#/$defs/datetime" },
"expires_at": { "$ref": "#/$defs/datetime" },
"requester": { "$ref": "#/$defs/partyRef" },
"subject": {
"$ref": "#/$defs/partyRef",
"description": "Who the decision is about, if different from requester (e.g. the person requesting elevation)."
},
"parties": {
"type": "array",
"items": { "$ref": "#/$defs/partyRef" }
},
"brief": {
"$ref": "#/$defs/markdown",
"description": "Minimum necessary context. Hash of brief is part of presentation.view_hash."
},
"consequences": { "$ref": "#/$defs/markdown" },
"identity_context": { "$ref": "#/$defs/identityContext" },
"session": { "$ref": "#/$defs/sessionState" },
"packet": {
"type": "array",
"items": { "$ref": "#/$defs/packetItem" }
},
"highlights": {
"type": "array",
"items": { "$ref": "#/$defs/highlight" }
},
"route": { "$ref": "#/$defs/route" },
"thread": {
"type": "array",
"items": { "$ref": "#/$defs/threadMessage" }
},
"presentations": {
"type": "array",
"items": { "$ref": "#/$defs/presentationSnapshot" }
},
"dispositions": {
"type": "array",
"items": { "$ref": "#/$defs/disposition" }
},
"relations": {
"type": "array",
"items": { "$ref": "#/$defs/relation" }
},
"evidence": { "$ref": "#/$defs/evidenceBundle" },
"legal": {
"type": "object",
"additionalProperties": false,
"properties": {
"governing_law": { "type": "string" },
"form_requirement": {
"type": "string",
"enum": ["none", "textform", "schriftform", "notarial", "other"]
},
"retention_years": { "type": "integer", "minimum": 1 },
"classification": {
"type": "string",
"enum": ["public", "internal", "confidential", "restricted"]
}
}
},
"extensions": {
"type": "object",
"description": "Namespaced vendor or domain extensions. Must not alter binding semantics.",
"additionalProperties": true
}
}
}