{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://sec.hypermedia.au/attestations/finding-approval/v1.json",
  "title": "Finding Approval Attestation",
  "description": "JSON Schema for finding-approval attestations in CycloneDX declarations format. Shape-only: approver-not-equal-author (comparison against the finding's author identity), target hash resolution, and the publication invariant are verifier (adbom-cli) checks the schema cannot perform. Normative requirements: https://sec.hypermedia.au/standards/finding-approval/v1 Cross-document convention (ratified 2026-07-18): map.requirement cites the requirement's published URL (pattern-pinned, offline-checkable); claim.target is a BOM-Link to the L2 Finding. These deliberately reference documents outside this BOM; resolution is via sec.hypermedia.au and BOM-Links.",
  "type": "object",
  "required": [
    "bomFormat",
    "specVersion",
    "serialNumber",
    "version",
    "declarations"
  ],
  "properties": {
    "bomFormat": {
      "type": "string",
      "enum": [
        "CycloneDX"
      ]
    },
    "specVersion": {
      "type": "string",
      "const": "1.7"
    },
    "serialNumber": {
      "type": "string",
      "pattern": "^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
    },
    "version": {
      "type": "integer",
      "minimum": 1
    },
    "declarations": {
      "type": "object",
      "required": [
        "assessors",
        "claims",
        "attestations"
      ],
      "properties": {
        "assessors": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "organization"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "thirdParty": {
                "type": "boolean"
              },
              "organization": {
                "type": "object",
                "required": [
                  "name",
                  "contact"
                ],
                "properties": {
                  "name": {
                    "type": "string",
                    "minLength": 1
                  },
                  "contact": {
                    "type": "array",
                    "minItems": 1,
                    "items": {
                      "type": "object",
                      "required": [
                        "name"
                      ],
                      "properties": {
                        "name": {
                          "type": "string",
                          "minLength": 1
                        },
                        "email": {
                          "type": "string"
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        },
        "claims": {
          "type": "array",
          "minItems": 1,
          "maxItems": 1,
          "items": {
            "type": "object",
            "required": [
              "bom-ref",
              "target",
              "predicate",
              "reasoning"
            ],
            "properties": {
              "bom-ref": {
                "type": "string",
                "minLength": 1
              },
              "target": {
                "type": "string",
                "pattern": "^urn:cdx:.+#finding-.+",
                "description": "FAPP-002: BOM-Link to the L2 Finding"
              },
              "predicate": {
                "type": "string",
                "enum": [
                  "finding-approved",
                  "finding-rejected",
                  "changes-requested"
                ]
              },
              "reasoning": {
                "type": "string",
                "minLength": 1,
                "description": "FAPP-005: non-empty rationale required for every predicate"
              }
            }
          }
        },
        "attestations": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "object",
            "required": [
              "summary",
              "assessor",
              "map",
              "signature"
            ],
            "properties": {
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "assessor": {
                "type": "string",
                "minLength": 1
              },
              "map": {
                "type": "array",
                "minItems": 1,
                "items": {
                  "type": "object",
                  "required": [
                    "requirement",
                    "claims",
                    "conformance",
                    "confidence"
                  ],
                  "properties": {
                    "requirement": {
                      "type": "string",
                      "pattern": "^https://sec\\.hypermedia\\.au/standards/finding-approval/v1#[a-z0-9-]+$"
                    },
                    "claims": {
                      "type": "array",
                      "minItems": 1,
                      "items": {
                        "type": "string"
                      }
                    },
                    "conformance": {
                      "$ref": "#/definitions/score"
                    },
                    "confidence": {
                      "$ref": "#/definitions/score"
                    }
                  }
                }
              },
              "signature": {
                "$ref": "#/definitions/signature"
              }
            }
          }
        }
      }
    }
  },
  "definitions": {
    "score": {
      "type": "object",
      "required": [
        "score",
        "rationale"
      ],
      "properties": {
        "score": {
          "type": "number",
          "minimum": 0,
          "maximum": 1
        },
        "rationale": {
          "type": "string",
          "minLength": 1
        }
      }
    },
    "signature": {
      "type": "object",
      "required": [
        "algorithm",
        "certificatePath",
        "value"
      ],
      "properties": {
        "algorithm": {
          "type": "string",
          "enum": [
            "ES256",
            "ES384",
            "ES512"
          ]
        },
        "certificatePath": {
          "type": "array",
          "minItems": 1,
          "items": {
            "type": "string"
          }
        },
        "value": {
          "type": "string",
          "minLength": 1
        }
      }
    }
  }
}