{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://capitalguard.io/contracts/v0.1.0/abom.schema.json",
  "title": "CapitalGuard AI Bill of Materials",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "claimBoundary",
    "documentType",
    "generatedAt",
    "generator",
    "material",
    "schemaVersion",
    "semanticDigestAlgorithm",
    "semanticDigestSha256",
    "subject"
  ],
  "properties": {
    "claimBoundary": { "type": "string", "minLength": 40, "maxLength": 500, "pattern": "does not prove" },
    "documentType": { "const": "ai_bill_of_materials" },
    "generatedAt": { "type": "string", "format": "date-time" },
    "generator": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "version"],
      "properties": {
        "name": { "const": "CapitalGuard" },
        "version": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^(?:unknown|[A-Za-z0-9][A-Za-z0-9._+-]{0,63})$" }
      }
    },
    "material": { "$ref": "#/$defs/material" },
    "schemaVersion": { "const": "cg-abom-0.1.0" },
    "semanticDigestAlgorithm": { "const": "sha256" },
    "semanticDigestSha256": { "$ref": "#/$defs/digest" },
    "subject": {
      "type": "object",
      "additionalProperties": false,
      "required": ["identity", "kind"],
      "properties": {
        "identity": { "const": "private" },
        "kind": { "const": "repository" }
      }
    }
  },
  "$defs": {
    "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
    "identifier": { "type": "string", "minLength": 2, "maxLength": 80, "pattern": "^[a-z0-9][a-z0-9._-]{1,79}$" },
    "evidenceId": { "type": "string", "minLength": 6, "maxLength": 96, "pattern": "^CGE-[A-Z0-9][A-Z0-9-]{2,92}$" },
    "evidenceRefs": {
      "type": "array",
      "maxItems": 32,
      "uniqueItems": true,
      "items": { "$ref": "#/$defs/evidenceId" }
    },
    "component": {
      "type": "object",
      "additionalProperties": false,
      "required": ["capabilities", "detected", "evidenceRefs", "id", "kind", "name", "trust", "version"],
      "properties": {
        "capabilities": {
          "type": "array",
          "maxItems": 8,
          "uniqueItems": true,
          "items": { "enum": ["admin", "change", "execute", "read", "transfer"] }
        },
        "detected": { "type": "boolean" },
        "evidenceRefs": { "$ref": "#/$defs/evidenceRefs" },
        "id": { "$ref": "#/$defs/identifier" },
        "kind": { "enum": ["agent", "connector", "mcp_server", "tool"] },
        "name": { "type": "string", "minLength": 1, "maxLength": 120 },
        "trust": { "enum": ["local", "pinned", "unknown", "unverified", "verified_publisher"] },
        "version": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^(?:unknown|[A-Za-z0-9][A-Za-z0-9._+-]{0,63})$" }
      }
    },
    "evidence": {
      "type": "object",
      "additionalProperties": false,
      "required": ["confidence", "contentIncluded", "id", "observed", "source"],
      "properties": {
        "confidence": { "enum": ["high", "low", "medium"] },
        "contentIncluded": { "const": false },
        "id": { "$ref": "#/$defs/evidenceId" },
        "observed": { "type": "boolean" },
        "source": { "enum": ["aggregate_path_metadata", "configuration_presence", "policy", "scanner", "workflow"] }
      }
    },
    "aggregateSurface": {
      "type": "object",
      "additionalProperties": false,
      "required": ["category", "evidenceRefs", "id", "observedCount", "sensitiveValuesIncluded"],
      "properties": {
        "category": { "$ref": "#/$defs/identifier" },
        "evidenceRefs": { "$ref": "#/$defs/evidenceRefs" },
        "id": { "$ref": "#/$defs/identifier" },
        "observedCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "sensitiveValuesIncluded": { "const": false }
      }
    },
    "permission": {
      "type": "object",
      "additionalProperties": false,
      "required": ["action", "evidenceRefs", "id", "scopeClass", "state", "subjectId"],
      "properties": {
        "action": { "enum": ["admin", "change", "execute", "read", "transfer"] },
        "evidenceRefs": { "$ref": "#/$defs/evidenceRefs" },
        "id": { "$ref": "#/$defs/identifier" },
        "scopeClass": { "enum": ["ci", "cloud", "command", "credential", "data", "filesystem", "network", "repository"] },
        "state": { "enum": ["inferred", "observed", "unknown"] },
        "subjectId": { "$ref": "#/$defs/identifier" }
      }
    },
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["evidenceRefs", "id", "mode", "name", "version"],
      "properties": {
        "evidenceRefs": { "$ref": "#/$defs/evidenceRefs" },
        "id": { "$ref": "#/$defs/identifier" },
        "mode": { "enum": ["installed", "recommended", "unknown"] },
        "name": { "type": "string", "minLength": 1, "maxLength": 120 },
        "version": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^(?:unknown|[A-Za-z0-9][A-Za-z0-9._+-]{0,63})$" }
      }
    },
    "privacy": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "absolutePathsIncluded",
        "aggregateOnly",
        "customerIdentityIncluded",
        "mode",
        "repositoryNameIncluded",
        "secretValuesIncluded",
        "sourceContentsIncluded"
      ],
      "properties": {
        "absolutePathsIncluded": { "const": false },
        "aggregateOnly": { "const": true },
        "customerIdentityIncluded": { "const": false },
        "mode": { "const": "shareable" },
        "repositoryNameIncluded": { "const": false },
        "secretValuesIncluded": { "const": false },
        "sourceContentsIncluded": { "const": false }
      }
    },
    "material": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "agents",
        "connectors",
        "evidence",
        "instructionSources",
        "mcpServers",
        "permissions",
        "policies",
        "privacy",
        "schemaVersion",
        "secretCategories",
        "tools",
        "workflows"
      ],
      "properties": {
        "agents": { "type": "array", "maxItems": 64, "items": { "allOf": [{ "$ref": "#/$defs/component" }, { "properties": { "kind": { "const": "agent" } } }] } },
        "connectors": { "type": "array", "maxItems": 64, "items": { "allOf": [{ "$ref": "#/$defs/component" }, { "properties": { "kind": { "const": "connector" } } }] } },
        "evidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidence" } },
        "instructionSources": { "type": "array", "maxItems": 128, "items": { "$ref": "#/$defs/aggregateSurface" } },
        "mcpServers": { "type": "array", "maxItems": 64, "items": { "allOf": [{ "$ref": "#/$defs/component" }, { "properties": { "kind": { "const": "mcp_server" } } }] } },
        "permissions": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/permission" } },
        "policies": { "type": "array", "maxItems": 64, "items": { "$ref": "#/$defs/policy" } },
        "privacy": { "$ref": "#/$defs/privacy" },
        "schemaVersion": { "const": "cg-abom-material-0.1.0" },
        "secretCategories": { "type": "array", "maxItems": 128, "items": { "$ref": "#/$defs/aggregateSurface" } },
        "tools": { "type": "array", "maxItems": 64, "items": { "allOf": [{ "$ref": "#/$defs/component" }, { "properties": { "kind": { "const": "tool" } } }] } },
        "workflows": { "type": "array", "maxItems": 128, "items": { "$ref": "#/$defs/aggregateSurface" } }
      }
    }
  }
}