{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://sec.hypermedia.au/attestations/analysis-provenance/v1.json",
  "title": "Analysis Provenance Attestation",
  "description": "JSON Schema for analysis-provenance attestations in CycloneDX declarations format. Shape-only: inputRefs resolution into the sealed catalog, methodRef gate resolution, and Fulcio identity comparison (author distinct from approver) are verifier (adbom-cli) checks. Normative requirements: https://sec.hypermedia.au/standards/analysis-provenance/v1 Cross-document convention (ratified 2026-07-18): map.requirement cites the requirement's published URL (pattern-pinned, offline-checkable); claim.target is a BOM-Link to the L2 Finding. These deliberately reference documents outside this BOM; resolution is via sec.hypermedia.au and BOM-Links.",
  "type": "object",
  "required": [
    "bomFormat",
    "specVersion",
    "serialNumber",
    "version",
    "declarations"
  ],
  "properties": {
    "bomFormat": {
      "type": "string",
      "enum": [
        "CycloneDX"
      ]
    },
    "specVersion": {
      "type": "string",
      "const": "1.7"
    },
    "serialNumber": {
      "type": "string",
      "pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "version": {
      "type": "integer",
      "minimum": 1
    },
    "declarations": {
      "type": "object",
      "required": [
        "assessors",
        "evidence",
        "claims",
        "attestations"
      ],
      "properties": {
        "assessors": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "organization"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "thirdParty": {
                "type": "boolean"
              },
              "organization": {
                "type": "object",
                "required": [
                  "name",
                  "contact"
                ],
                "properties": {
                  "name": {
                    "type": "string",
                    "minLength": 1
                  },
                  "contact": {
                    "type": "array",
                    "minItems": 1,
                    "items": {
                      "type": "object",
                      "required": [
                        "name"
                      ],
                      "properties": {
                        "name": {
                          "type": "string",
                          "minLength": 1
                        },
                        "email": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "evidence": {
          "type": "array",
          "minItems": 2,
          "items": {
            "oneOf": [
              {
                "$ref": "#/definitions/provInputs"
              },
              {
                "$ref": "#/definitions/provNonrepro"
              }
            ]
          },
          "allOf": [
            {
              "contains": {
                "properties": {
                  "propertyName": {
                    "const": "cyberbench:provenance:inputs"
                  }
                },
                "required": [
                  "propertyName"
                ]
              }
            },
            {
              "contains": {
                "properties": {
                  "propertyName": {
                    "const": "cyberbench:provenance:reproducibility"
                  }
                },
                "required": [
                  "propertyName"
                ]
              }
            }
          ],
          "description": "APRV-001..005: both the prov-inputs and prov-nonrepro blocks are required"
        },
        "claims": {
          "type": "array",
          "minItems": 1,
          "maxItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "target",
              "predicate",
              "evidence",
              "externalReferences"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "target": {
                "type": "string",
                "pattern": "^urn:cdx:.+#finding-.+",
                "description": "APRV-008: BOM-Link to the L2 Finding"
              },
              "predicate": {
                "type": "string",
                "const": "produced-from-declared-evidence"
              },
              "reasoning": {
                "type": "string"
              },
              "evidence": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "string"
                }
              },
              "externalReferences": {
                "type": "array",
                "contains": {
                  "type": "object",
                  "required": [
                    "url",
                    "type",
                    "properties"
                  ],
                  "properties": {
                    "url": {
                      "type": "string",
                      "pattern": "^urn:cdx:.+"
                    },
                    "type": {
                      "type": "string",
                      "const": "attestation"
                    },
                    "properties": {
                      "type": "array",
                      "contains": {
                        "type": "object",
                        "required": [
                          "name",
                          "value"
                        ],
                        "properties": {
                          "name": {
                            "const": "cyberbench:role"
                          },
                          "value": {
                            "const": "methodRef"
                          }
                        }
                      }
                    }
                  }
                },
                "description": "APRV-006: methodRef into method-validation/v1 — an external reference of type \"attestation\" marked cyberbench:role=methodRef"
              }
            }
          }
        },
        "attestations": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "summary",
              "assessor",
              "map",
              "signature"
            ],
            "properties": {
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "assessor": {
                "type": "string",
                "minLength": 1
              },
              "map": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "object",
                  "required": [
                    "requirement",
                    "claims",
                    "conformance",
                    "confidence"
                  ],
                  "properties": {
                    "requirement": {
                      "type": "string",
                      "pattern": "^https://sec\\.hypermedia\\.au/standards/analysis-provenance/v1#[a-z0-9-]+$"
                    },
                    "claims": {
                      "type": "array",
                      "minItems": 1,
                      "items": {
                        "type": "string"
                      }
                    },
                    "conformance": {
                      "$ref": "#/definitions/score"
                    },
                    "confidence": {
                      "$ref": "#/definitions/score"
                    }
                  }
                }
              },
              "signature": {
                "$ref": "#/definitions/signature"
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "provInputs": {
      "type": "object",
      "required": [
        "bom-ref",
        "propertyName",
        "data",
        "created"
      ],
      "properties": {
        "bom-ref": {
          "type": "string",
          "minLength": 1
        },
        "propertyName": {
          "type": "string",
          "const": "cyberbench:provenance:inputs"
        },
        "created": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}"
        },
        "data": {
          "type": "array",
          "minItems": 1,
          "maxItems": 1,
          "items": {
            "type": "object",
            "required": [
              "name",
              "contents"
            ],
            "properties": {
              "name": {
                "type": "string",
                "const": "prov-inputs"
              },
              "contents": {
                "type": "object",
                "required": [
                  "attachment"
                ],
                "properties": {
                  "attachment": {
                    "type": "object",
                    "required": [
                      "content",
                      "contentType"
                    ],
                    "properties": {
                      "contentType": {
                        "type": "string",
                        "const": "application/json"
                      },
                      "content": {
                        "type": "string",
                        "minLength": 2,
                        "description": "JSON per https://sec.hypermedia.au/schemas/analysis-provenance/v1.schema.json#/definitions/provInputsData — the attestation is this data's authoritative home (FRE 901 set, frozen at promotion), so it travels in-band."
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "provNonrepro": {
      "type": "object",
      "required": [
        "bom-ref",
        "propertyName",
        "data",
        "created"
      ],
      "properties": {
        "bom-ref": {
          "type": "string",
          "minLength": 1
        },
        "propertyName": {
          "type": "string",
          "const": "cyberbench:provenance:reproducibility"
        },
        "created": {
          "type": "string",
          "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}"
        },
        "data": {
          "type": "array",
          "minItems": 1,
          "maxItems": 1,
          "items": {
            "type": "object",
            "required": [
              "name",
              "contents"
            ],
            "properties": {
              "name": {
                "type": "string",
                "const": "prov-nonrepro"
              },
              "contents": {
                "type": "object",
                "required": [
                  "attachment"
                ],
                "properties": {
                  "attachment": {
                    "type": "object",
                    "required": [
                      "content",
                      "contentType"
                    ],
                    "properties": {
                      "contentType": {
                        "type": "string",
                        "const": "application/json"
                      },
                      "content": {
                        "type": "string",
                        "minLength": 2,
                        "description": "JSON per https://sec.hypermedia.au/schemas/analysis-provenance/v1.schema.json#/definitions/provNonreproData — the attestation is this data's authoritative home (FRE 901 set, frozen at promotion), so it travels in-band."
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "digest": {
      "type": "object",
      "required": [
        "alg",
        "content"
      ],
      "properties": {
        "alg": {
          "type": "string",
          "enum": [
            "SHA-256",
            "SHA-512",
            "SHA3-256",
            "SHA3-512",
            "BLAKE3"
          ]
        },
        "content": {
          "type": "string",
          "pattern": "^[a-f0-9]{64}$|^[a-f0-9]{128}$"
        }
      }
    },
    "score": {
      "type": "object",
      "required": [
        "score",
        "rationale"
      ],
      "properties": {
        "score": {
          "type": "number",
          "minimum": 0,
          "maximum": 1
        },
        "rationale": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "signature": {
      "type": "object",
      "required": [
        "algorithm",
        "certificatePath",
        "value"
      ],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "ES256",
            "ES384",
            "ES512"
          ]
        },
        "certificatePath": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "string"
          }
        },
        "value": {
          "type": "string",
          "minLength": 1
        }
      }
    }
  }
}