95 lines
3.0 KiB
JSON
95 lines
3.0 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://jb.codes/harness-tools/nono/evidence.schema.json",
|
|
"title": "Nono evidence summary",
|
|
"description": "Schema-v1 for secret-free, redacted Slice 2 policy evidence. Raw command material is retained separately under the injected XDG_STATE_HOME root.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"schemaVersion",
|
|
"runId",
|
|
"testId",
|
|
"suite",
|
|
"repositoryCommit",
|
|
"policySnapshotDigest",
|
|
"installedSnapshotDigest",
|
|
"nonoVersion",
|
|
"status",
|
|
"approver",
|
|
"startedAt",
|
|
"finishedAt",
|
|
"rawEvidence",
|
|
"resultHashes",
|
|
"observations"
|
|
],
|
|
"properties": {
|
|
"schemaVersion": { "const": 1 },
|
|
"runId": { "$ref": "#/$defs/id" },
|
|
"testId": { "$ref": "#/$defs/id" },
|
|
"suite": { "enum": ["hermetic", "host", "live"] },
|
|
"repositoryCommit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
|
|
"policySnapshotDigest": { "$ref": "#/$defs/sha256" },
|
|
"installedSnapshotDigest": { "$ref": "#/$defs/sha256" },
|
|
"nonoVersion": { "type": "string", "pattern": "^0\\.74\\.[0-9]+$" },
|
|
"status": { "enum": ["passed", "failed", "blocked", "not-run"] },
|
|
"approver": { "type": ["string", "null"] },
|
|
"startedAt": { "$ref": "#/$defs/utcTimestamp" },
|
|
"finishedAt": { "$ref": "#/$defs/utcTimestamp" },
|
|
"rawEvidence": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["sha256", "retainedUntil"],
|
|
"properties": {
|
|
"sha256": { "$ref": "#/$defs/sha256" },
|
|
"retainedUntil": { "$ref": "#/$defs/utcTimestamp" }
|
|
}
|
|
},
|
|
"resultHashes": {
|
|
"type": "object",
|
|
"propertyNames": { "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$" },
|
|
"additionalProperties": { "$ref": "#/$defs/sha256" }
|
|
},
|
|
"observations": {
|
|
"type": "array",
|
|
"items": { "$ref": "#/$defs/observation" }
|
|
}
|
|
},
|
|
"allOf": [
|
|
{
|
|
"if": { "properties": { "suite": { "const": "live" } } },
|
|
"then": {
|
|
"properties": {
|
|
"approver": { "type": "string", "minLength": 1 }
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"$defs": {
|
|
"id": {
|
|
"type": "string",
|
|
"pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$"
|
|
},
|
|
"sha256": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{64}$"
|
|
},
|
|
"utcTimestamp": {
|
|
"type": "string",
|
|
"pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,6})?Z$"
|
|
},
|
|
"observation": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": ["id", "capability", "expected", "actual", "status", "hash"],
|
|
"properties": {
|
|
"id": { "$ref": "#/$defs/id" },
|
|
"capability": { "$ref": "#/$defs/id" },
|
|
"expected": { "enum": ["allowed", "denied", "unknown", "not-run"] },
|
|
"actual": { "enum": ["allowed", "denied", "unknown", "not-run"] },
|
|
"status": { "enum": ["passed", "failed", "blocked", "not-run"] },
|
|
"hash": { "$ref": "#/$defs/sha256" }
|
|
}
|
|
}
|
|
}
|
|
}
|