{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://capitalguard.io/contracts/v0.1.0/security-event-batch.schema.json",
  "title": "CapitalGuard Security Event Batch",
  "type": "object",
  "additionalProperties": false,
  "required": ["batchDigestAlgorithm", "batchDigestSha256", "claimBoundary", "events", "generatedAt", "schemaVersion"],
  "properties": {
    "batchDigestAlgorithm": { "const": "sha256" },
    "batchDigestSha256": { "$ref": "#/$defs/digest" },
    "claimBoundary": { "type": "string", "minLength": 40, "maxLength": 500, "pattern": "do not prove" },
    "events": { "type": "array", "minItems": 1, "maxItems": 10000, "items": { "$ref": "#/$defs/event" } },
    "generatedAt": { "type": "string", "format": "date-time" },
    "schemaVersion": { "const": "cg-security-event-batch-0.1.0" }
  },
  "$defs": {
    "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
    "nullableDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
    "evidenceRef": { "type": "string", "minLength": 6, "maxLength": 96, "pattern": "^CGE-[A-Z0-9][A-Z0-9-]{2,92}$" },
    "privacy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["absolutePathsIncluded", "customerIdentityIncluded", "repositoryNameIncluded", "secretValuesIncluded", "sourceContentsIncluded"],
      "properties": {
        "absolutePathsIncluded": { "const": false },
        "customerIdentityIncluded": { "const": false },
        "repositoryNameIncluded": { "const": false },
        "secretValuesIncluded": { "const": false },
        "sourceContentsIncluded": { "const": false }
      }
    },
    "outcome": {
      "type": "object",
      "additionalProperties": false,
      "required": ["artifactDigestSha256", "controlId", "criticalCount", "findingCount", "highCount", "mediumCount", "observedCount", "status"],
      "properties": {
        "artifactDigestSha256": { "$ref": "#/$defs/nullableDigest" },
        "controlId": { "oneOf": [{ "type": "string", "pattern": "^(?:CGS|CGP|CGAL)-[A-Z0-9-]{3,88}$" }, { "type": "null" }] },
        "criticalCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "findingCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "highCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "mediumCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "observedCount": { "type": "integer", "minimum": 0, "maximum": 100000 },
        "status": { "enum": ["allowed", "approval_required", "blocked", "cleared", "completed", "failed", "observed", "redacted", "started", "unknown"] }
      }
    },
    "event": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "eventHashSha256",
        "eventId",
        "evidenceRefs",
        "occurredAt",
        "outcome",
        "previousEventHashSha256",
        "privacy",
        "schemaVersion",
        "sequence",
        "source",
        "type"
      ],
      "properties": {
        "eventHashSha256": { "$ref": "#/$defs/digest" },
        "eventId": { "type": "string", "minLength": 15, "maxLength": 96, "pattern": "^CG-EVT-[A-Z0-9][A-Z0-9-]{7,88}$" },
        "evidenceRefs": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "$ref": "#/$defs/evidenceRef" } },
        "occurredAt": { "type": "string", "format": "date-time" },
        "outcome": { "$ref": "#/$defs/outcome" },
        "previousEventHashSha256": { "$ref": "#/$defs/nullableDigest" },
        "privacy": { "$ref": "#/$defs/privacy" },
        "schemaVersion": { "const": "cg-security-event-0.1.0" },
        "sequence": { "type": "integer", "minimum": 1, "maximum": 10000 },
        "source": {
          "type": "object",
          "additionalProperties": false,
          "required": ["component", "version"],
          "properties": {
            "component": { "enum": ["auto_fix", "guard_gateway", "local_scanner", "policy_compiler", "proof_runner", "signer"] },
            "version": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$" }
          }
        },
        "type": {
          "enum": [
            "artifact.signed",
            "component.observed",
            "finding.cleared",
            "finding.observed",
            "fix.applied",
            "fix.proposed",
            "guard.allowed",
            "guard.approval_required",
            "guard.blocked",
            "guard.redacted",
            "inventory.completed",
            "policy.evaluated",
            "proof.completed",
            "proof.started",
            "retest.completed",
            "scan.completed",
            "scan.started"
          ]
        }
      }
    }
  }
}