{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://h33.ai/agent-zero/composite-attestation/v1/schema.json",
  "title": "H33 Composite Attestation v1",
  "description": "Self-contained decision record produced by Agent Zero Layer 5. Wraps a finalized h33-portability-descriptor-v1 (Layer 3) and embeds the verification context required for the 5-year regulator test: tenant snapshot, principal snapshot, agent snapshot (when actor is agent), policy snapshot with definition_bytes, governance chain, engine keys, summary, replay requirements, actor chain, not_performed declarations, and PQ envelope with multi-chain anchors. See https://h33.ai/standards/verification-model/ for the precision contract.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "format",
    "attestation_id",
    "finalized_at_ms",
    "schema_metadata",
    "descriptor",
    "tenant_snapshot",
    "principal_snapshot",
    "governance_chain",
    "engine_keys",
    "summary",
    "replay_requirements",
    "actor_chain",
    "not_performed",
    "envelope_signatures"
  ],
  "properties": {
    "format": {
      "type": "string",
      "const": "h33-composite-attestation-v1"
    },
    "attestation_id": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$",
      "description": "SHA3-256 of canonical form excluding this field. Content-addressable."
    },
    "finalized_at_ms": {"type": "integer", "minimum": 0},

    "schema_metadata": {
      "type": "object",
      "additionalProperties": false,
      "required": ["schema_url", "schema_archive_urls", "schema_hash", "canonical_encoding", "hash_algorithm", "canonicalization_hash", "verifier_profile_version"],
      "properties": {
        "schema_url": {"type": "string"},
        "schema_archive_urls": {
          "type": "array",
          "minItems": 1,
          "description": "At least one archive mirror (Internet Archive / IPFS / Arweave). Required so verification survives H33 disappearing.",
          "items": {"type": "string"}
        },
        "schema_hash": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "canonical_encoding": {"type": "string", "const": "rfc8785-jcs"},
        "hash_algorithm": {"type": "string", "const": "sha3-256"},
        "canonicalization_hash": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "SHA3-256 of the canonicalization specification. Embedded so a 5-year regulator can confirm their verifier implements the same canonicalization rules even if the human-readable name is later extended."
        },
        "verifier_profile_version": {
          "type": "string",
          "minLength": 1,
          "description": "Verifier profile version (e.g., h33-composite-verifier-profile-v1). A verifier implementing the profile MUST satisfy every check the profile defines."
        }
      }
    },

    "descriptor": {
      "description": "The embedded finalized h33-portability-descriptor-v1. Validated against https://h33.ai/agent-zero/replay-format/v1/schema.json.",
      "type": "object"
    },

    "tenant_snapshot": {
      "type": "object",
      "additionalProperties": false,
      "required": ["tenant_id", "display_name_at_attestation", "jurisdiction_at_attestation", "tenant_directory_url_at_attestation", "tenant_directory_snapshot_hash", "tenant_public_key", "tenant_public_key_fingerprint", "tenant_public_key_format"],
      "properties": {
        "tenant_id": {"type": "string", "pattern": "^[0-9a-f]{32}$"},
        "display_name_at_attestation": {"type": "string", "minLength": 1},
        "jurisdiction_at_attestation": {
          "type": "array",
          "items": {"type": "string"}
        },
        "tenant_directory_url_at_attestation": {"type": "string"},
        "tenant_directory_snapshot_hash": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "tenant_public_key": {
          "type": "string",
          "minLength": 1,
          "description": "Base64-encoded public key bytes. Embedded — must not be empty."
        },
        "tenant_public_key_fingerprint": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "tenant_public_key_format": {"type": "string"}
      }
    },

    "principal_snapshot": {
      "type": "object",
      "additionalProperties": false,
      "required": ["principal_id", "kind", "delegation_chain", "principal_public_key", "principal_public_key_fingerprint", "principal_public_key_format", "principal_directory_url_at_attestation"],
      "properties": {
        "principal_id": {"type": "string"},
        "kind": {"type": "string", "enum": ["human", "agent", "service", "delegated"]},
        "linked_customer_id": {"type": "string"},
        "delegation_chain": {"type": "array", "items": {"type": "string"}},
        "principal_public_key": {
          "type": "string",
          "minLength": 1,
          "description": "Base64-encoded public key bytes. Embedded — must not be empty."
        },
        "principal_public_key_fingerprint": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "principal_public_key_format": {"type": "string"},
        "principal_directory_url_at_attestation": {"type": "string"}
      }
    },

    "agent_snapshot": {
      "description": "REQUIRED when principal_snapshot.kind == 'agent'. Layer 0 agt_* identity backing the principal.",
      "type": "object",
      "additionalProperties": false,
      "required": ["agent_id", "agent_type", "owner_principal", "model_identifier", "version", "capabilities_at_attestation", "authority_chain_refs", "creation_time", "agent_public_key", "agent_public_key_fingerprint", "agent_public_key_format", "agent_directory_url_at_attestation"],
      "properties": {
        "agent_id": {"type": "string"},
        "agent_type": {"type": "string", "enum": ["autonomous", "human_supervised", "human_in_the_loop", "agent_swarm_member", "delegated"]},
        "owner_principal": {"type": "string"},
        "model_identifier": {"type": "string", "minLength": 1, "description": "Fully-qualified model + revision (e.g., claude-3.5-sonnet@20240620). Answers 'WHAT made the decision?' for AI agents."},
        "version": {"type": "string"},
        "capabilities_at_attestation": {"type": "array", "items": {"type": "string"}},
        "authority_chain_refs": {"type": "array", "items": {"type": "string"}},
        "creation_time": {"type": "integer", "minimum": 0},
        "agent_public_key": {"type": "string", "minLength": 1},
        "agent_public_key_fingerprint": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "agent_public_key_format": {"type": "string"},
        "agent_directory_url_at_attestation": {"type": "string"},
        "tool_boundaries": {
          "type": "object",
          "description": "Optional but strongly recommended for agent-managing-agent scenarios. Per Eric Layer 0/5 agent-delegation extension 2026-05-31.",
          "additionalProperties": false,
          "required": ["tools_allowed", "datasets_allowed", "systems_allowed", "external_calls_allowed"],
          "properties": {
            "tools_allowed": {"type": "array", "items": {"type": "string"}},
            "datasets_allowed": {"type": "array", "items": {"type": "string"}},
            "systems_allowed": {"type": "array", "items": {"type": "string"}},
            "external_calls_allowed": {"type": "array", "items": {"type": "string"}},
            "spend_limit_atomic_units": {"type": "integer", "minimum": 0},
            "signing_limit_per_period": {"type": "integer", "minimum": 0},
            "escalation_threshold": {"type": "string"}
          }
        }
      }
    },

    "agent_delegation_chain": {
      "description": "Required when the agent was created or delegated by another agent (depth ≥ 1). Captures 'agent A created agent B which assigned agent C.' Optional for root agents and non-agent principals. The validator enforces authority attenuation: every child's effective_scope ⊆ parent's effective_scope.",
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["depth", "agent_id", "supervision_mode", "inherited_scope", "reduced_scope", "effective_scope", "delegated_at_ms", "max_delegation_depth"],
        "properties": {
          "depth": {"type": "integer", "minimum": 0},
          "agent_id": {"type": "string"},
          "parent_agent_id": {"type": "string"},
          "delegated_by_agent_id": {"type": "string"},
          "delegation_policy_id": {"type": "string"},
          "delegation_attestation_id": {"type": "string"},
          "supervision_mode": {
            "type": "string",
            "enum": ["autonomous", "human_approved", "human_reviewed", "agent_approved", "quorum_approved", "policy_only", "emergency_override"]
          },
          "inherited_scope": {"type": "array", "items": {"type": "string"}},
          "reduced_scope": {"type": "array", "items": {"type": "string"}},
          "effective_scope": {
            "type": "array",
            "description": "MUST equal inherited_scope minus reduced_scope. MUST be ⊆ parent's effective_scope. Child agents NEVER silently equal or exceed parent authority.",
            "items": {"type": "string"}
          },
          "delegated_at_ms": {"type": "integer", "minimum": 0},
          "max_delegation_depth": {
            "type": "integer",
            "minimum": 0,
            "description": "How deep this agent's children may delegate. Strictly decreases across the chain."
          }
        }
      }
    },

    "routing_proof": {
      "description": "RECOMMENDED for multi-agent systems. Present when an orchestrator selected this agent over alternatives. Captures WHY this agent was chosen — one of the most common audit questions in agent-managing-agent deployments. Optional at the schema level for backward compatibility; production deployments handling orchestration SHOULD populate this.",
      "type": "object",
      "additionalProperties": false,
      "required": ["routing_policy_id", "routing_reason", "candidate_agents_considered", "selected_agent_id", "selection_constraints"],
      "properties": {
        "routing_policy_id": {"type": "string"},
        "routing_reason": {"type": "string"},
        "candidate_agents_considered": {"type": "array", "items": {"type": "string"}},
        "selected_agent_id": {"type": "string"},
        "selection_constraints": {"type": "array", "items": {"type": "string"}}
      }
    },

    "policy_snapshot": {
      "description": "REQUIRED when descriptor.intent.policy_id is present. Embeds the policy definition so regulators can read what the policy required.",
      "type": "object",
      "additionalProperties": false,
      "required": ["policy_id", "definition_bytes", "definition_hash", "policy_format", "registered_at_ms", "registered_by", "registration_signature"],
      "properties": {
        "policy_id": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
        "definition_bytes": {"type": "string", "minLength": 1, "description": "Base64-encoded canonical policy definition. EMBEDDED — must not be empty."},
        "definition_hash": {"type": "string", "pattern": "^[0-9a-f]{64}$", "description": "SHA3-256 of definition_bytes. MUST equal policy_id."},
        "policy_format": {"type": "string"},
        "registered_at_ms": {"type": "integer", "minimum": 0},
        "registered_by": {"type": "string"},
        "registration_signature": {"type": "string"}
      }
    },

    "governance_chain": {
      "type": "array",
      "description": "Authority delegation grants ordered root-to-leaf. Empty when not applicable.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["authority_id", "granted_by", "granted_to", "scope", "granted_at_ms", "effective_expiry_at_ms", "grant_signature", "grant_signature_algorithm"],
        "properties": {
          "authority_id": {"type": "string"},
          "granted_by": {"type": "string"},
          "granted_to": {"type": "string"},
          "scope": {},
          "granted_at_ms": {"type": "integer", "minimum": 0},
          "effective_expiry_at_ms": {"type": "integer", "minimum": 0, "description": "Per Layer 0 lock: min(parent_expiry, child_expiry, ..., root_expiry). Pre-computed at grant time."},
          "grant_signature": {"type": "string"},
          "grant_signature_algorithm": {"type": "string"}
        }
      }
    },

    "engine_keys": {
      "type": "array",
      "minItems": 1,
      "description": "One entry per engine that contributed a fragment. Public keys EMBEDDED so the regulator can verify Native-attestation engine signatures offline.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["engine_id", "engine_version", "abi_version", "public_key_bytes", "public_key_format", "public_key_fingerprint", "build_hash", "engine_attestation_class", "registry_url_at_attestation", "registry_snapshot_hash"],
        "properties": {
          "engine_id": {"type": "string"},
          "engine_version": {"type": "string"},
          "abi_version": {"type": "string"},
          "public_key_bytes": {"type": "string", "minLength": 1, "description": "Base64-encoded public key bytes. EMBEDDED — must not be empty."},
          "public_key_format": {"type": "string"},
          "public_key_fingerprint": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
          "build_hash": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
          "engine_attestation_class": {"type": "string", "enum": ["native", "wrapped", "foundational"]},
          "registry_url_at_attestation": {"type": "string"},
          "registry_snapshot_hash": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
        }
      }
    },

    "summary": {
      "type": "object",
      "additionalProperties": false,
      "required": ["decision_kind", "mode", "privacy_class", "leakage_summary_bits", "leakage_per_work_unit", "determinism_summary", "replayability_summary", "applicable_jurisdictions", "engines_used", "work_unit_count"],
      "properties": {
        "decision_kind": {"type": "string", "enum": ["classify", "search", "policy_evaluation", "governance_evaluation", "identity_verification", "jurisdiction_evaluation", "compliance_evaluation", "risk_scoring", "delegation_verification", "authorization_evaluation"]},
        "mode": {"type": "string", "enum": ["label_only", "threshold_proof", "customer_decryption"]},
        "privacy_class": {"type": "string", "enum": ["P1", "P2", "P3", "P4"]},
        "leakage_summary_bits": {"type": "integer", "minimum": 0},
        "leakage_per_work_unit": {"type": "array", "items": {"type": "integer", "minimum": 0}},
        "determinism_summary": {"type": "string", "enum": ["deterministic", "bounded", "probabilistic_seeded", "non_deterministic"]},
        "replayability_summary": {"type": "string", "enum": ["full", "partial", "structural_only", "none"]},
        "applicable_jurisdictions": {"type": "array", "items": {"type": "string"}},
        "engines_used": {"type": "array", "items": {"type": "string"}},
        "work_unit_count": {"type": "integer", "minimum": 0}
      }
    },

    "replay_requirements": {
      "type": "array",
      "description": "Per-Work-Unit verifier guidance. Tells the regulator what can and cannot be independently replayed.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["unit_id", "engine_id", "engine_version", "replayability_class", "what_verifier_needs", "what_verifier_cannot_do"],
        "properties": {
          "unit_id": {"type": "integer", "minimum": 0},
          "engine_id": {"type": "string"},
          "engine_version": {"type": "string"},
          "replayability_class": {"type": "string", "enum": ["full", "partial", "structural_only", "none"]},
          "what_verifier_needs": {
            "type": "object",
            "additionalProperties": false,
            "required": ["inputs_required", "eval_keys_required"],
            "properties": {
              "inputs_required": {"type": "array", "items": {"type": "string"}},
              "eval_keys_required": {"type": "array", "items": {"type": "string"}},
              "determinism_parameters": {},
              "tolerance": {"type": "string"}
            }
          },
          "what_verifier_cannot_do": {"type": "string"}
        }
      }
    },

    "actor_chain": {
      "type": "array",
      "minItems": 1,
      "description": "Full root-to-executor provenance. First link must be customer or principal kind; last link must have role 'executor'.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["actor_id", "actor_kind", "role"],
        "properties": {
          "actor_id": {"type": "string"},
          "actor_kind": {"type": "string", "enum": ["customer", "principal", "agent", "authority", "service"]},
          "principal_kind": {"type": "string", "enum": ["human", "agent", "service", "delegated"]},
          "agent_type": {"type": "string", "enum": ["autonomous", "human_supervised", "human_in_the_loop", "agent_swarm_member", "delegated"]},
          "model_identifier": {"type": "string"},
          "version": {"type": "string"},
          "role": {"type": "string"}
        }
      }
    },

    "not_performed": {
      "type": "array",
      "description": "Verifier-honesty contract per HATS-V-CHECK-001 + 007. Declares checks the verifier did NOT perform at attestation time.",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["check_code", "check_name", "reason", "reason_text"],
        "properties": {
          "check_code": {"type": "string"},
          "check_name": {"type": "string"},
          "reason": {"type": "string"},
          "reason_text": {"type": "string"}
        }
      }
    },

    "envelope_signatures": {
      "type": "object",
      "additionalProperties": false,
      "required": ["signing_message_algorithm", "signing_message", "h33_74_envelope", "pq_signatures", "anchors"],
      "properties": {
        "signing_message_algorithm": {"type": "string", "const": "sha3-256"},
        "signing_message": {"type": "string", "pattern": "^[0-9a-f]{64}$", "description": "SHA3-256 of canonical form of every field above EXCLUDING envelope_signatures itself. The PQ signatures sign this value."},
        "h33_74_envelope": {"type": "string", "pattern": "^[0-9a-f]{148}$"},
        "pq_signatures": {
          "type": "object",
          "additionalProperties": false,
          "required": ["ml_dsa_65", "falcon_512", "slh_dsa_128f"],
          "properties": {
            "ml_dsa_65": {"type": "string"},
            "falcon_512": {"type": "string"},
            "slh_dsa_128f": {"type": "string"}
          }
        },
        "anchors": {
          "type": "array",
          "minItems": 1,
          "description": "Multi-chain anchors per Layer 0 lock. Each carries verification_hint_url so a 5-year regulator knows which block explorer to use.",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["chain", "txid", "block_height", "anchored_at_ms", "verification_hint_url"],
            "properties": {
              "chain": {"type": "string"},
              "txid": {"type": "string"},
              "block_height": {"type": "integer", "minimum": 0},
              "anchored_at_ms": {"type": "integer", "minimum": 0},
              "verification_hint_url": {"type": "string", "minLength": 1}
            }
          }
        }
      }
    }
  }
}