{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://coulomb.social/schemas/railiance/custody-projection-contract.v1.json",
  "title": "Railiance ephemeral custody projection contract v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "interface", "version", "workplan_id", "engagement_id", "status",
    "engagement_contract_sha256", "target", "runner", "window", "authority",
    "identities"
  ],
  "properties": {
    "interface": {"const": "railiance.custody-projection-contract"},
    "version": {"const": 1},
    "workplan_id": {"const": "RAILIANCE-WP-0025"},
    "engagement_id": {"type": "string", "pattern": "^[A-Z0-9][A-Z0-9._-]{7,127}$"},
    "status": {"const": "approved"},
    "engagement_contract_sha256": {"$ref": "#/$defs/sha256"},
    "target": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id", "namespace", "deployment", "container", "sender_external_secret", "revision",
        "image_digest", "contract_sha256"
      ],
      "properties": {
        "id": {"type": "string", "minLength": 1},
        "namespace": {"$ref": "#/$defs/dnsLabel"},
        "deployment": {"$ref": "#/$defs/dnsLabel"},
        "container": {"$ref": "#/$defs/dnsLabel"},
        "sender_external_secret": {"$ref": "#/$defs/dnsLabel"},
        "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
        "image_digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
        "contract_sha256": {"$ref": "#/$defs/sha256"}
      }
    },
    "runner": {
      "type": "object",
      "additionalProperties": false,
      "required": ["namespace", "service_account", "secret_name", "mount_root", "manifest_sha256"],
      "properties": {
        "namespace": {"$ref": "#/$defs/dnsLabel"},
        "service_account": {"$ref": "#/$defs/dnsLabel"},
        "secret_name": {"$ref": "#/$defs/dnsLabel"},
        "mount_root": {"type": "string", "pattern": "^/"},
        "manifest_sha256": {"$ref": "#/$defs/sha256"}
      }
    },
    "window": {
      "type": "object",
      "additionalProperties": false,
      "required": ["starts_at", "projection_cutoff", "expires_at"],
      "properties": {
        "starts_at": {"type": "string", "format": "date-time"},
        "projection_cutoff": {"type": "string", "format": "date-time"},
        "expires_at": {"type": "string", "format": "date-time"}
      }
    },
    "authority": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "remote", "registry_path", "registry_field", "kv_mount", "kv_prefix",
        "eso_service_account", "eso_namespace"
      ],
      "properties": {
        "remote": {"type": "string", "pattern": "^\\S+$"},
        "registry_path": {"type": "string", "minLength": 1},
        "registry_field": {"type": "string", "minLength": 1},
        "kv_mount": {"type": "string", "pattern": "^[^/]+$"},
        "kv_prefix": {"type": "string", "minLength": 1},
        "eso_service_account": {"$ref": "#/$defs/dnsLabel"},
        "eso_namespace": {"$ref": "#/$defs/dnsLabel"}
      }
    },
    "identities": {
      "type": "array",
      "minItems": 2,
      "maxItems": 2,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["handle", "role", "sender_name", "tenant", "mount_path", "may_read", "may_write"],
        "properties": {
          "handle": {"enum": ["token-a", "token-b"]},
          "role": {"enum": ["attacker", "owner"]},
          "sender_name": {"type": "string", "minLength": 1},
          "tenant": {"type": "string", "minLength": 1},
          "mount_path": {"type": "string", "pattern": "^/"},
          "may_read": {"const": true},
          "may_write": {"const": true}
        }
      }
    }
  },
  "$defs": {
    "sha256": {"type": "string", "pattern": "^(sha256:)?[0-9a-f]{64}$"},
    "dnsLabel": {"type": "string", "pattern": "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"}
  }
}