{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://sec.hypermedia.au/attestations/case-catalog/v1.json",
  "title": "Case Catalog Integrity Attestation",
  "description": "JSON Schema for case-catalog (catalog-integrity) attestations in CycloneDX declarations format. Shape-only: corpus comparison, hash recomputation, signature verification and Fulcio identity comparison are verifier (adbom-cli) checks. Normative requirements: https://sec.hypermedia.au/standards/case-catalog/v1 Cross-document convention (ratified 2026-07-18): map.requirement cites the requirement's published URL (pattern-pinned, offline-checkable); claim.target is a BOM-Link to the sealed L1 version. These deliberately reference documents outside this BOM; resolution is via sec.hypermedia.au and BOM-Links.",
  "type": "object",
  "required": [
    "bomFormat",
    "specVersion",
    "serialNumber",
    "version",
    "declarations"
  ],
  "properties": {
    "bomFormat": {
      "type": "string",
      "enum": [
        "CycloneDX"
      ]
    },
    "specVersion": {
      "type": "string",
      "const": "1.7"
    },
    "serialNumber": {
      "type": "string",
      "pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "version": {
      "type": "integer",
      "minimum": 1
    },
    "declarations": {
      "type": "object",
      "required": [
        "assessors",
        "evidence",
        "claims",
        "attestations"
      ],
      "properties": {
        "assessors": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "organization"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "thirdParty": {
                "type": "boolean"
              },
              "organization": {
                "type": "object",
                "required": [
                  "name",
                  "contact"
                ],
                "properties": {
                  "name": {
                    "type": "string",
                    "minLength": 1
                  },
                  "contact": {
                    "type": "array",
                    "minItems": 1,
                    "items": {
                      "type": "object",
                      "required": [
                        "name"
                      ],
                      "properties": {
                        "name": {
                          "type": "string",
                          "minLength": 1
                        },
                        "email": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "evidence": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "propertyName",
              "data",
              "created"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "propertyName": {
                "type": "string",
                "enum": [
                  "cyberbench:catalog:enumeration-check",
                  "cyberbench:catalog:hash-check"
                ]
              },
              "created": {
                "type": "string",
                "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}"
              },
              "data": {
                "type": "array",
                "minItems": 1,
                "maxItems": 1,
                "items": {
                  "type": "object",
                  "required": [
                    "name",
                    "contents"
                  ],
                  "properties": {
                    "name": {
                      "type": "string",
                      "minLength": 1
                    },
                    "contents": {
                      "type": "object",
                      "required": [
                        "attachment"
                      ],
                      "properties": {
                        "attachment": {
                          "type": "object",
                          "required": [
                            "content",
                            "contentType"
                          ],
                          "properties": {
                            "contentType": {
                              "type": "string",
                              "const": "application/json"
                            },
                            "content": {
                              "type": "string",
                              "minLength": 2,
                              "description": "JSON payload of the check/evidence output (shape governed by the verifier contract, unconstrained here — as before, when data was a bare object)."
                            }
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          },
          "description": "CCAT-002/003: the enumeration and hash-check results at this seal"
        },
        "claims": {
          "type": "array",
          "minItems": 1,
          "maxItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "target",
              "predicate",
              "evidence"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "target": {
                "type": "string",
                "pattern": "^urn:cdx:.+",
                "description": "CCAT-001: BOM-Link to the sealed L1 version"
              },
              "predicate": {
                "type": "string",
                "const": "catalog-integrity-verified"
              },
              "reasoning": {
                "type": "string"
              },
              "evidence": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "string"
                }
              }
            }
          }
        },
        "attestations": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "summary",
              "assessor",
              "map",
              "signature"
            ],
            "properties": {
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "assessor": {
                "type": "string",
                "minLength": 1
              },
              "map": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "object",
                  "required": [
                    "requirement",
                    "claims",
                    "conformance",
                    "confidence"
                  ],
                  "properties": {
                    "requirement": {
                      "type": "string",
                      "pattern": "^https://sec\\.hypermedia\\.au/standards/case-catalog/v1#[a-z0-9-]+$"
                    },
                    "claims": {
                      "type": "array",
                      "minItems": 1,
                      "items": {
                        "type": "string"
                      }
                    },
                    "conformance": {
                      "$ref": "#/definitions/score"
                    },
                    "confidence": {
                      "$ref": "#/definitions/score"
                    }
                  }
                }
              },
              "signature": {
                "$ref": "#/definitions/signature"
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "score": {
      "type": "object",
      "required": [
        "score",
        "rationale"
      ],
      "properties": {
        "score": {
          "type": "number",
          "minimum": 0,
          "maximum": 1
        },
        "rationale": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "signature": {
      "type": "object",
      "required": [
        "algorithm",
        "certificatePath",
        "value"
      ],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "ES256",
            "ES384",
            "ES512"
          ]
        },
        "certificatePath": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "string"
          }
        },
        "value": {
          "type": "string",
          "minLength": 1
        }
      }
    }
  }
}