{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://policy.coulomb.social/schemas/tenancy-posture/v0.1",
  "title": "NetKingdom tenancy posture declaration v0.1",
  "type": "object",
  "required": [
    "schema_version",
    "framework"
  ],
  "properties": {
    "schema_version": {
      "const": "0.1"
    },
    "framework": {
      "const": "netkingdom-tenancy-posture"
    },
    "service": {
      "$ref": "#/$defs/serviceName"
    },
    "role": {
      "type": "string",
      "minLength": 1
    },
    "responsible_repo": {
      "$ref": "#/$defs/repoName"
    },
    "workload_identity": {
      "$ref": "#/$defs/workloadIdentity"
    },
    "tenancy": {
      "$ref": "#/$defs/tenancy"
    },
    "provider": {
      "$ref": "#/$defs/provider"
    },
    "zones": {
      "$ref": "#/$defs/zoneDeclaration"
    },
    "evidence": {
      "$ref": "#/$defs/evidence"
    },
    "evidence_freshness": {
      "$ref": "#/$defs/evidenceFreshness"
    },
    "notes": {
      "$ref": "#/$defs/stringList"
    },
    "services": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/service"
      }
    }
  },
  "oneOf": [
    {
      "required": [
        "service",
        "role",
        "tenancy"
      ],
      "not": {
        "required": [
          "services"
        ]
      }
    },
    {
      "required": [
        "services"
      ],
      "not": {
        "anyOf": [
          {
            "required": [
              "service"
            ]
          },
          {
            "required": [
              "role"
            ]
          },
          {
            "required": [
              "tenancy"
            ]
          },
          {
            "required": [
              "provider"
            ]
          },
          {
            "required": [
              "workload_identity"
            ]
          },
          {
            "required": [
              "zones"
            ]
          },
          {
            "required": [
              "evidence"
            ]
          },
          {
            "required": [
              "responsible_repo"
            ]
          },
          {
            "required": [
              "evidence_freshness"
            ]
          }
        ]
      }
    }
  ],
  "allOf": [
    {
      "if": {
        "required": [
          "zones"
        ]
      },
      "then": {
        "required": [
          "workload_identity"
        ]
      }
    }
  ],
  "additionalProperties": false,
  "$defs": {
    "serviceName": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9._-]*$"
    },
    "repoName": {
      "type": "string",
      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$"
    },
    "axisName": {
      "enum": [
        "I",
        "A",
        "E",
        "P",
        "R",
        "V"
      ]
    },
    "level": {
      "oneOf": [
        {
          "type": "integer",
          "minimum": 0,
          "maximum": 4
        },
        {
          "const": "n/a"
        }
      ]
    },
    "axisVector": {
      "type": "object",
      "required": [
        "I",
        "A",
        "E",
        "P",
        "R",
        "V"
      ],
      "properties": {
        "I": {
          "oneOf": [
            {
              "type": "integer",
              "minimum": 0,
              "maximum": 3
            },
            {
              "const": "n/a"
            }
          ]
        },
        "A": {
          "$ref": "#/$defs/level"
        },
        "E": {
          "$ref": "#/$defs/level"
        },
        "P": {
          "$ref": "#/$defs/level"
        },
        "R": {
          "$ref": "#/$defs/level"
        },
        "V": {
          "$ref": "#/$defs/level"
        }
      },
      "additionalProperties": false
    },
    "partialAxisVector": {
      "type": "object",
      "minProperties": 1,
      "properties": {
        "I": {
          "oneOf": [
            {
              "type": "integer",
              "minimum": 0,
              "maximum": 3
            },
            {
              "const": "n/a"
            }
          ]
        },
        "A": {
          "$ref": "#/$defs/level"
        },
        "E": {
          "$ref": "#/$defs/level"
        },
        "P": {
          "$ref": "#/$defs/level"
        },
        "R": {
          "$ref": "#/$defs/level"
        },
        "V": {
          "$ref": "#/$defs/level"
        }
      },
      "additionalProperties": false
    },
    "stringMap": {
      "type": "object",
      "additionalProperties": {
        "type": "string",
        "minLength": 1
      }
    },
    "stringList": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "identityBinding": {
      "type": "object",
      "required": [
        "scheme",
        "authority",
        "subject",
        "principal_type"
      ],
      "properties": {
        "scheme": {
          "type": "string",
          "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
          "description": "Identity mechanism, for example iam-profile, kubernetes-service-account, ssh-certificate, or openbao-auth-role."
        },
        "authority": {
          "type": "string",
          "minLength": 1,
          "description": "Authoritative issuer or registry for this principal."
        },
        "subject": {
          "type": "string",
          "minLength": 1,
          "description": "Exact principal value asserted by the authority."
        },
        "principal_type": {
          "enum": [
            "service",
            "agent"
          ],
          "description": "IAM Profile principal type. A human identity is caller context and cannot be the sole workload identity."
        },
        "environment": {
          "type": "string",
          "minLength": 1
        },
        "evidence": {
          "$ref": "#/$defs/stringList"
        }
      },
      "additionalProperties": false
    },
    "workloadIdentity": {
      "type": "object",
      "required": [
        "name",
        "kind",
        "responsible_repo",
        "identity_bindings"
      ],
      "properties": {
        "name": {
          "$ref": "#/$defs/serviceName",
          "description": "Stable workload id. It must equal the containing service field."
        },
        "kind": {
          "enum": [
            "application",
            "platform-service",
            "automation",
            "operational-control-plane",
            "maintenance-job"
          ]
        },
        "responsible_repo": {
          "$ref": "#/$defs/repoName",
          "description": "Repository accountable for the workload identity and zone declaration."
        },
        "declaration_ref": {
          "type": "string",
          "minLength": 1,
          "description": "Authoritative owner declaration. Required by RMGR-ADR-004 for a managed deployable, for example rapp-user-engine/declarations/rapp.yaml."
        },
        "identity_bindings": {
          "type": "array",
          "minItems": 1,
          "items": {
            "$ref": "#/$defs/identityBinding"
          }
        }
      },
      "additionalProperties": false
    },
    "zoneEvidence": {
      "type": "object",
      "required": [
        "ref",
        "supports"
      ],
      "properties": {
        "ref": {
          "type": "string",
          "minLength": 1
        },
        "supports": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": {
            "type": "string",
            "minLength": 1
          }
        }
      },
      "additionalProperties": false
    },
    "zoneDeclaration": {
      "type": "object",
      "required": [
        "standard",
        "membership",
        "responsible_party",
        "justification",
        "context",
        "evidence",
        "reviewed",
        "review_due"
      ],
      "properties": {
        "standard": {
          "const": "security-zones_v0.1"
        },
        "membership": {
          "enum": [
            "z0-experimental",
            "z1-operational",
            "z2-protected",
            "z3-critical",
            "z2-continuity"
          ]
        },
        "responsible_party": {
          "type": "string",
          "minLength": 1
        },
        "justification": {
          "type": "string",
          "minLength": 1
        },
        "context": {
          "type": "object",
          "required": [
            "maturity",
            "criticality",
            "data_classification"
          ],
          "properties": {
            "maturity": {
              "enum": ["M0", "M1", "M2", "M3"]
            },
            "criticality": {
              "enum": ["low", "medium", "high", "critical", "n/a"]
            },
            "data_classification": {
              "type": "string",
              "minLength": 1
            }
          },
          "additionalProperties": false
        },
        "evidence": {
          "type": "array",
          "minItems": 1,
          "items": {
            "$ref": "#/$defs/zoneEvidence"
          }
        },
        "reviewed": {
          "type": "string",
          "format": "date"
        },
        "review_due": {
          "type": "string",
          "format": "date"
        }
      },
      "additionalProperties": false
    },
    "paths": {
      "type": "object",
      "propertyNames": {
        "$ref": "#/$defs/axisName"
      },
      "additionalProperties": {
        "type": "object",
        "minProperties": 1,
        "additionalProperties": {
          "$ref": "#/$defs/level"
        }
      }
    },
    "placementException": {
      "type": "object",
      "required": [
        "tenants",
        "P",
        "reason"
      ],
      "properties": {
        "tenants": {
          "$ref": "#/$defs/stringList"
        },
        "P": {
          "type": "integer",
          "minimum": 0,
          "maximum": 4
        },
        "reason": {
          "type": "string",
          "minLength": 1
        },
        "tier_ref": {
          "type": "string",
          "minLength": 1
        }
      },
      "additionalProperties": false
    },
    "tenancy": {
      "type": "object",
      "required": [
        "current",
        "target",
        "reviewed",
        "review_due",
        "service_class"
      ],
      "properties": {
        "current": {
          "$ref": "#/$defs/axisVector"
        },
        "implemented": {
          "$ref": "#/$defs/partialAxisVector"
        },
        "target": {
          "$ref": "#/$defs/axisVector"
        },
        "reviewed": {
          "type": "string",
          "format": "date"
        },
        "review_due": {
          "type": "string",
          "format": "date"
        },
        "service_class": {
          "enum": [
            "latency-critical",
            "interactive",
            "batch"
          ]
        },
        "permanent": {
          "type": "array",
          "uniqueItems": true,
          "items": {
            "$ref": "#/$defs/axisName"
          }
        },
        "reason": {
          "$ref": "#/$defs/stringMap"
        },
        "gap": {
          "$ref": "#/$defs/stringMap"
        },
        "paths": {
          "$ref": "#/$defs/paths"
        },
        "placement_exceptions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/placementException"
          }
        },
        "secondary_stores": {
          "$ref": "#/$defs/stringList"
        }
      },
      "additionalProperties": false
    },
    "providerAxis": {
      "type": "object",
      "required": [
        "available",
        "maximum"
      ],
      "properties": {
        "available": {
          "$ref": "#/$defs/level"
        },
        "maximum": {
          "$ref": "#/$defs/level"
        },
        "conditions": {
          "$ref": "#/$defs/stringList"
        },
        "evidence": {
          "$ref": "#/$defs/stringList"
        },
        "reason": {
          "type": "string",
          "minLength": 1
        }
      },
      "additionalProperties": false
    },
    "provider": {
      "type": "object",
      "required": [
        "axes"
      ],
      "properties": {
        "capability": {
          "type": "string",
          "minLength": 1
        },
        "profile": {
          "type": "string",
          "minLength": 1
        },
        "axes": {
          "type": "object",
          "minProperties": 1,
          "properties": {
            "I": {
              "$ref": "#/$defs/providerAxis"
            },
            "A": {
              "$ref": "#/$defs/providerAxis"
            },
            "E": {
              "$ref": "#/$defs/providerAxis"
            },
            "P": {
              "$ref": "#/$defs/providerAxis"
            },
            "R": {
              "$ref": "#/$defs/providerAxis"
            },
            "V": {
              "$ref": "#/$defs/providerAxis"
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "evidence": {
      "type": "object",
      "additionalProperties": {
        "oneOf": [
          {
            "type": "string",
            "minLength": 1
          },
          {
            "$ref": "#/$defs/stringList"
          }
        ]
      }
    },
    "evidenceFreshnessEntry": {
      "type": "object",
      "required": [
        "kind",
        "observed_at",
        "responsible_repo",
        "scope",
        "remediation"
      ],
      "properties": {
        "kind": {
          "enum": [
            "mechanical",
            "adversarial"
          ]
        },
        "observed_at": {
          "type": "string",
          "format": "date-time"
        },
        "valid_until": {
          "type": "string",
          "format": "date-time"
        },
        "responsible_repo": {
          "$ref": "#/$defs/repoName"
        },
        "scope": {
          "type": "string",
          "minLength": 1
        },
        "remediation": {
          "type": "string",
          "minLength": 1
        },
        "source_revision": {
          "type": "string",
          "minLength": 1
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "kind": {
                "const": "adversarial"
              }
            },
            "required": [
              "kind"
            ]
          },
          "then": {
            "required": [
              "valid_until"
            ]
          }
        }
      ],
      "additionalProperties": false
    },
    "evidenceFreshness": {
      "type": "object",
      "patternProperties": {
        "^[IAEPRV][0-4]$": {
          "$ref": "#/$defs/evidenceFreshnessEntry"
        }
      },
      "additionalProperties": false
    },
    "service": {
      "type": "object",
      "required": [
        "service",
        "role",
        "tenancy"
      ],
      "properties": {
        "service": {
          "$ref": "#/$defs/serviceName"
        },
        "role": {
          "type": "string",
          "minLength": 1
        },
        "responsible_repo": {
          "$ref": "#/$defs/repoName"
        },
        "workload_identity": {
          "$ref": "#/$defs/workloadIdentity"
        },
        "tenancy": {
          "$ref": "#/$defs/tenancy"
        },
        "provider": {
          "$ref": "#/$defs/provider"
        },
        "evidence": {
          "$ref": "#/$defs/evidence"
        },
        "evidence_freshness": {
          "$ref": "#/$defs/evidenceFreshness"
        },
        "notes": {
          "$ref": "#/$defs/stringList"
        },
        "zones": {
          "$ref": "#/$defs/zoneDeclaration"
        }
      },
      "allOf": [
        {
          "if": {
            "required": [
              "zones"
            ]
          },
          "then": {
            "required": [
              "workload_identity"
            ]
          }
        }
      ],
      "additionalProperties": false
    }
  }
}