{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://stellaops.local/schemas/policy-auth-signals-lib-115.json",
  "title": "PolicyAuthSignal",
  "type": "object",
  "additionalProperties": false,
  "required": ["id", "tenant", "subject", "signal_type", "source", "created", "evidence"],
  "properties": {
    "id": {"type": "string"},
    "tenant": {"type": "string"},
    "subject": {"type": "string"},
    "signal_type": {"type": "string", "enum": ["reachability", "attestation", "risk", "vex"]},
    "source": {"type": "string"},
    "confidence": {"type": "number"},
    "evidence": {
      "type": "array",
      "items": {"$ref": "#/$defs/EvidenceRef"},
      "minItems": 1
    },
    "provenance": {"$ref": "#/$defs/Provenance"},
    "created": {
      "type": "string",
      "format": "date-time"
    }
  },
  "$defs": {
    "EvidenceRef": {
      "type": "object",
      "additionalProperties": false,
      "required": ["kind", "uri", "digest"],
      "properties": {
        "kind": {"type": "string", "enum": ["linkset", "runtime", "attestation", "bundle"]},
        "uri": {"type": "string"},
        "digest": {"type": "string"},
        "scope": {"type": "string"}
      }
    },
    "Provenance": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "pipeline": {"type": "string"},
        "inputs": {"type": "array", "items": {"type": "string"}},
        "signer": {"type": "string"},
        "transparency": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "rekor_uuid": {"type": ["string", "null"]},
            "skip_reason": {"type": ["string", "null"]}
          }
        }
      }
    }
  }
}