openapi: 3.1.0
info:
  title: StellaOps Excititor Chunk API
  version: "0.1.0"
  description: |
    Frozen for Sprint 110 (EXCITITOR-AIAI-31-002). Aligns with Evidence Locker attestation contract v1.
servers:
  - url: https://excitor.local
paths:
  /vex/evidence/chunks:
    post:
      summary: Submit VEX evidence chunk (aggregation-only)
      requestBody:
        required: true
        content:
          application/x-ndjson:
            schema:
              $ref: '#/components/schemas/VexChunk'
      responses:
        '202':
          description: Accepted for processing
          content:
            application/json:
              schema:
                type: object
                required: [chunk_digest, queue_id]
                properties:
                  chunk_digest:
                    type: string
                    description: sha256 of canonical chunk JSON
                  queue_id:
                    type: string
                    description: Background job identifier
        '400':
          description: Validation error
components:
  schemas:
    VexChunk:
      type: object
      required: [chunk_id, tenant, source, schema, items, provenance]
      properties:
        chunk_id:
          type: string
          format: uuid
        tenant:
          type: string
        source:
          type: string
          description: feed id (e.g., ghsa, nvd)
        schema:
          type: string
          enum: [stellaops.vex.chunk.v1]
        items:
          type: array
          items:
            type: object
            required: [advisory_id, status, purl]
            properties:
              advisory_id:
                type: string
              status:
                type: string
                enum: [affected, unaffected, under_investigation, fixed, unknown]
              purl:
                type: string
              justification:
                type: string
              last_observed:
                type: string
                format: date-time
        provenance:
          type: object
          required: [fetched_at, artifact_sha]
          properties:
            fetched_at:
              type: string
              format: date-time
            artifact_sha:
              type: string
            signature:
              type: object
              nullable: true