{
  "$id": "https://stella-ops.org/schemas/zastava/webhook_admission.schema.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Zastava Webhook Admission",
  "type": "object",
  "required": [
    "tenant_id",
    "project_id",
    "request_uid",
    "resource_kind",
    "namespace",
    "workload_name",
    "policy_hash",
    "graph_revision_id",
    "decision",
    "decision_reason",
    "decision_at",
    "manifest_pointer",
    "signature"
  ],
  "properties": {
    "tenant_id": { "type": "string" },
    "project_id": { "type": "string" },
    "request_uid": { "type": "string" },
    "resource_kind": { "type": "string" },
    "namespace": { "type": "string" },
    "workload_name": { "type": "string" },
    "policy_hash": { "type": "string" },
    "graph_revision_id": { "type": "string" },
    "ledger_id": { "type": "string" },
    "replay_manifest": { "type": "string" },
    "manifest_pointer": { "type": "string", "description": "Surface.FS manifest pointer" },
    "decision": { "enum": ["allow", "deny", "dry-run"] },
    "decision_reason": { "type": "string" },
    "decision_at": { "type": "string", "format": "date-time" },
    "monotonic_nanos": { "type": "integer" },
    "side_effect": { "enum": ["none", "mutating", "bypass"] },
    "bypass_waiver_id": { "type": "string" },
    "payload_hash": { "type": "string" },
    "signature": { "type": "string", "description": "DSSE envelope reference" }
  }
}