{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://jb.codes/harness-tools/nono/evidence.schema.json",
  "title": "Nono evidence summary",
  "description": "Schema-v1 for secret-free, redacted Slice 2 policy evidence. Raw command material is retained separately under the injected XDG_STATE_HOME root.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "runId",
    "testId",
    "suite",
    "repositoryCommit",
    "policySnapshotDigest",
    "installedSnapshotDigest",
    "nonoVersion",
    "status",
    "approver",
    "startedAt",
    "finishedAt",
    "rawEvidence",
    "resultHashes",
    "observations"
  ],
  "properties": {
    "schemaVersion": { "const": 1 },
    "runId": { "$ref": "#/$defs/id" },
    "testId": { "$ref": "#/$defs/id" },
    "suite": { "enum": ["hermetic", "host", "live"] },
    "repositoryCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
    "policySnapshotDigest": { "$ref": "#/$defs/sha256" },
    "installedSnapshotDigest": { "$ref": "#/$defs/sha256" },
    "nonoVersion": { "type": "string", "pattern": "^0\\.74\\.[0-9]+$" },
    "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
    "approver": { "type": ["string", "null"] },
    "startedAt": { "$ref": "#/$defs/utcTimestamp" },
    "finishedAt": { "$ref": "#/$defs/utcTimestamp" },
    "rawEvidence": {
      "type": "object",
      "additionalProperties": false,
      "required": ["sha256", "retainedUntil"],
      "properties": {
        "sha256": { "$ref": "#/$defs/sha256" },
        "retainedUntil": { "$ref": "#/$defs/utcTimestamp" }
      }
    },
    "resultHashes": {
      "type": "object",
      "propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" },
      "additionalProperties": { "$ref": "#/$defs/sha256" }
    },
    "observations": {
      "type": "array",
      "items": { "$ref": "#/$defs/observation" }
    }
  },
  "allOf": [
    {
      "if": { "properties": { "suite": { "const": "live" } } },
      "then": {
        "properties": {
          "approver": { "type": "string", "minLength": 1 }
        }
      }
    }
  ],
  "$defs": {
    "id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
    },
    "sha256": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "utcTimestamp": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,6})?Z$"
    },
    "observation": {
      "type": "object",
      "additionalProperties": false,
      "required": ["id", "capability", "expected", "actual", "status", "hash"],
      "properties": {
        "id": { "$ref": "#/$defs/id" },
        "capability": { "$ref": "#/$defs/id" },
        "expected": { "enum": ["allowed", "denied", "unknown", "not-run"] },
        "actual": { "enum": ["allowed", "denied", "unknown", "not-run"] },
        "status": { "enum": ["passed", "failed", "blocked", "not-run"] },
        "hash": { "$ref": "#/$defs/sha256" }
      }
    }
  }
}