154 lines
13 KiB
JSON
154 lines
13 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://casan.dev/schemas/assurance-kernel/1.0.0",
|
|
"title": "CASAN Assurance Kernel Execution Envelope",
|
|
"description": "Framework-independent canonical wire contract. Runtime-specific fields belong under a namespaced extensions object.",
|
|
"type": "object",
|
|
"required": ["schema_version", "extension_namespace", "run", "actors", "steps", "evidence", "trace_links", "extensions"],
|
|
"properties": {
|
|
"schema_version": {"const": "1.0.0"},
|
|
"extension_namespace": {"type": "string", "pattern": "^[a-z][a-z0-9.-]+$"},
|
|
"run": {"$ref": "#/$defs/ExecutionRun"},
|
|
"actors": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/Actor"}},
|
|
"steps": {"type": "array", "items": {"$ref": "#/$defs/ExecutionStep"}},
|
|
"delegations": {"type": "array", "items": {"$ref": "#/$defs/Delegation"}},
|
|
"context_items": {"type": "array", "items": {"$ref": "#/$defs/ContextItem"}},
|
|
"runtime_constraints": {"type": "array", "items": {"$ref": "#/$defs/RuntimeConstraint"}},
|
|
"runtime_capabilities": {"$ref": "#/$defs/RuntimeCapabilities"},
|
|
"approvals": {"type": "array", "items": {"$ref": "#/$defs/Approval"}},
|
|
"interventions": {"type": "array", "items": {"$ref": "#/$defs/Intervention"}},
|
|
"claims": {"type": "array", "items": {"$ref": "#/$defs/Claim"}},
|
|
"evidence": {"type": "array", "items": {"$ref": "#/$defs/EvidenceItem"}},
|
|
"trace_links": {"type": "array", "items": {"$ref": "#/$defs/TraceLink"}},
|
|
"extensions": {"type": "object", "additionalProperties": {"type": "object"}}
|
|
},
|
|
"additionalProperties": false,
|
|
"$defs": {
|
|
"Timestamp": {"type": "string", "format": "date-time"},
|
|
"Outcome": {
|
|
"type": "object",
|
|
"required": ["execution_result", "assurance_result", "certification_result", "business_result"],
|
|
"properties": {
|
|
"execution_result": {"enum": ["pending", "success", "failed", "cancelled", "quarantined", "unknown"]},
|
|
"assurance_result": {"enum": ["pending", "passed", "failed", "degraded", "not_evaluated", "unknown"]},
|
|
"certification_result": {"enum": ["pending", "certified", "non_certified", "ineligible"]},
|
|
"business_result": {"enum": ["achieved", "not_achieved", "partial", "not_evaluated", "unknown"]}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"ExecutionRun": {
|
|
"type": "object",
|
|
"required": ["run_id", "tenant", "project", "environment", "runtime", "mode", "requested_goal", "started_at", "status", "risk_summary", "correlation_id", "outcome"],
|
|
"properties": {
|
|
"run_id": {"type": "string", "minLength": 1},
|
|
"parent_run_id": {"type": ["string", "null"]},
|
|
"tenant": {"type": "string"},
|
|
"project": {"type": "string"},
|
|
"environment": {"type": "string"},
|
|
"runtime": {"type": "object", "required": ["type", "version"], "properties": {"type": {"type": "string"}, "version": {"type": "string"}}, "additionalProperties": false},
|
|
"mode": {"enum": ["observe", "enforce"]},
|
|
"requested_goal": {"type": "string"},
|
|
"started_at": {"$ref": "#/$defs/Timestamp"},
|
|
"completed_at": {"anyOf": [{"$ref": "#/$defs/Timestamp"}, {"type": "null"}]},
|
|
"status": {"enum": ["pending", "running", "success", "failed", "cancelled", "quarantined", "unknown"]},
|
|
"risk_summary": {"type": "object"},
|
|
"evidence_manifest_ref": {"type": ["string", "null"]},
|
|
"correlation_id": {"type": "string", "minLength": 1},
|
|
"outcome": {"$ref": "#/$defs/Outcome"}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"ExecutionStep": {
|
|
"type": "object",
|
|
"required": ["step_id", "run_id", "sequence", "actor_ref", "action", "input_context_refs", "policy_decisions", "verification_results", "evidence_refs", "outcome", "started_at", "completed_at"],
|
|
"properties": {
|
|
"step_id": {"type": "string"}, "run_id": {"type": "string"}, "parent_step_id": {"type": ["string", "null"]}, "sequence": {"type": "integer", "minimum": 1},
|
|
"actor_ref": {"type": "string"}, "action": {"$ref": "#/$defs/Action"}, "resource": {"type": ["object", "string", "null"]},
|
|
"input_context_refs": {"type": "array", "items": {"type": "string"}}, "policy_decisions": {"type": "array", "items": {"$ref": "#/$defs/PolicyDecision"}},
|
|
"tool_invocation": {"type": ["object", "null"]}, "verification_results": {"type": "array", "items": {"$ref": "#/$defs/VerificationResult"}},
|
|
"evidence_refs": {"type": "array", "items": {"type": "string"}}, "outcome": {"$ref": "#/$defs/Outcome"},
|
|
"started_at": {"$ref": "#/$defs/Timestamp"}, "completed_at": {"anyOf": [{"$ref": "#/$defs/Timestamp"}, {"type": "null"}]}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"Actor": {
|
|
"type": "object",
|
|
"required": ["actor_id", "actor_type", "issuer", "trust_level"],
|
|
"properties": {
|
|
"actor_id": {"type": "string"}, "actor_type": {"enum": ["human", "agent", "child_agent", "model", "tool", "service_account", "runtime", "approver", "policy_engine"]},
|
|
"issuer": {"type": "string"}, "trust_level": {"enum": ["unverified", "asserted", "verified", "hardware_backed"]}, "authentication_evidence_ref": {"type": ["string", "null"]}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"Delegation": {
|
|
"type": "object",
|
|
"required": ["delegation_id", "delegator_ref", "delegate_ref", "allowed_authority", "resource_scope", "expiry", "maximum_depth", "revoked"],
|
|
"properties": {
|
|
"delegation_id": {"type": "string"}, "delegator_ref": {"type": "string"}, "delegate_ref": {"type": "string"}, "allowed_authority": {"type": "array", "items": {"type": "string"}},
|
|
"resource_scope": {"type": "array", "items": {"type": "string"}}, "expiry": {"$ref": "#/$defs/Timestamp"}, "maximum_depth": {"type": "integer", "minimum": 0},
|
|
"parent_delegation_ref": {"type": ["string", "null"]}, "revoked": {"type": "boolean"}, "approval_ref": {"type": ["string", "null"]}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"ContextItem": {
|
|
"type": "object", "required": ["context_id", "source", "trust_classification", "content_hash", "transform_history", "compression_lineage", "classification", "injection_scan_result"],
|
|
"properties": {
|
|
"context_id": {"type": "string"}, "source": {"type": "string"}, "trust_classification": {"enum": ["trusted", "untrusted", "mixed", "unknown"]}, "content_hash": {"type": "string"},
|
|
"transform_history": {"type": "array", "items": {"type": "object"}}, "compression_lineage": {"type": "array", "items": {"type": "string"}},
|
|
"origin_ref": {"type": ["string", "null"]}, "classification": {"enum": ["instruction", "data", "mixed", "unknown"]}, "injection_scan_result": {"type": "object"}
|
|
}, "additionalProperties": false
|
|
},
|
|
"Action": {
|
|
"type": "object", "required": ["class", "name", "side_effect_level"],
|
|
"properties": {"class": {"enum": ["read_only", "write", "delete", "database_mutation", "migration", "deployment", "release", "credential_access", "identity_permission_modification", "external_network_side_effect", "infrastructure_modification", "unknown"]}, "name": {"type": "string"}, "tool": {"type": ["string", "null"]}, "side_effect_level": {"enum": ["none", "sensitive_read", "write", "destructive", "external", "unknown"]}, "required_authority": {"type": ["string", "null"]}, "requested_operation": {"type": ["string", "null"]}, "environment": {"type": ["string", "null"]}},
|
|
"additionalProperties": false
|
|
},
|
|
"ResourceAccess": {
|
|
"type": "object", "required": ["resource", "operation", "side_effect_level", "environment"],
|
|
"properties": {"resource": {"type": "string"}, "operation": {"type": "string"}, "side_effect_level": {"type": "string"}, "required_authority": {"type": ["string", "null"]}, "environment": {"type": "string"}}, "additionalProperties": false
|
|
},
|
|
"PolicyDecision": {
|
|
"type": "object", "required": ["policy_id", "policy_version", "decision", "reason_codes", "effective_risk", "input_facts", "enforcement_point", "timestamp", "decision_engine_identity"],
|
|
"properties": {"policy_id": {"type": "string"}, "policy_version": {"type": "string"}, "decision": {"enum": ["allow", "deny", "quarantine", "require_approval", "transform", "observe_only"]}, "reason_codes": {"type": "array", "items": {"type": "string"}}, "effective_risk": {"enum": ["low", "medium", "high", "critical"]}, "input_facts": {"type": "object"}, "enforcement_point": {"type": "string"}, "timestamp": {"$ref": "#/$defs/Timestamp"}, "decision_engine_identity": {"type": "string"}, "evidence_ref": {"type": ["string", "null"]}}, "additionalProperties": false
|
|
},
|
|
"RuntimeConstraint": {
|
|
"type": "object", "required": ["constraint_id", "kind", "limit", "enforcement"],
|
|
"properties": {"constraint_id": {"type": "string"}, "kind": {"enum": ["iteration", "time", "cost", "token", "child_agent_count", "graph_depth", "retry", "repetition", "network", "filesystem", "tool", "environment"]}, "limit": {}, "enforcement": {"enum": ["hard", "soft", "observe"]}}, "additionalProperties": false
|
|
},
|
|
"RuntimeCapabilities": {
|
|
"type": "object",
|
|
"required": ["canCancel", "canPause", "canResume", "canRollback", "canReduceAuthority", "canQuarantine"],
|
|
"properties": {"canCancel": {"type": "boolean"}, "canPause": {"type": "boolean"}, "canResume": {"type": "boolean"}, "canRollback": {"type": "boolean"}, "canReduceAuthority": {"type": "boolean"}, "canQuarantine": {"type": "boolean"}},
|
|
"additionalProperties": false
|
|
},
|
|
"VerificationRequirement": {
|
|
"type": "object", "required": ["requirement_id", "validator", "expected_result", "independence_level", "failure_severity"],
|
|
"properties": {"requirement_id": {"type": "string"}, "validator": {"type": "string"}, "expected_result": {}, "independence_level": {"enum": ["same_runtime", "independent_process", "independent_service", "external_authority"]}, "failure_severity": {"enum": ["info", "warning", "error", "critical"]}}, "additionalProperties": false
|
|
},
|
|
"VerificationResult": {
|
|
"type": "object", "required": ["requirement_id", "validator", "expected_result", "actual_result", "status", "evidence_refs", "independence_level", "failure_severity"],
|
|
"properties": {"requirement_id": {"type": "string"}, "validator": {"type": "string"}, "expected_result": {}, "actual_result": {}, "status": {"enum": ["passed", "failed", "degraded", "not_run"]}, "evidence_refs": {"type": "array", "items": {"type": "string"}}, "independence_level": {"type": "string"}, "failure_severity": {"type": "string"}}, "additionalProperties": false
|
|
},
|
|
"Claim": {
|
|
"type": "object", "required": ["claim_id", "statement", "evidence_refs", "validation_status"],
|
|
"properties": {"claim_id": {"type": "string"}, "statement": {"type": "string"}, "evidence_refs": {"type": "array", "items": {"type": "string"}}, "validation_status": {"enum": ["validated", "rejected", "insufficient", "not_validated"]}}, "additionalProperties": false
|
|
},
|
|
"EvidenceItem": {
|
|
"type": "object", "required": ["evidence_id", "claim_refs", "integrity", "producer_identity", "timestamp", "artifact_ref", "validation_status", "retention_class"],
|
|
"properties": {"evidence_id": {"type": "string"}, "claim_refs": {"type": "array", "items": {"type": "string"}}, "integrity": {"type": "object", "required": ["algorithm", "digest"], "properties": {"algorithm": {"const": "sha256"}, "digest": {"type": "string", "pattern": "^[a-f0-9]{64}$"}, "source_content_hash": {"type": ["string", "null"]}}, "additionalProperties": false}, "producer_identity": {"type": "string"}, "timestamp": {"$ref": "#/$defs/Timestamp"}, "artifact_ref": {"type": "string"}, "validation_status": {"enum": ["valid", "invalid", "unverified", "unavailable"]}, "retention_class": {"type": "string"}, "category": {"enum": ["runtime_control", "readiness_check", "report_dimension", "certification_claim"]}}, "additionalProperties": false
|
|
},
|
|
"TraceLink": {
|
|
"type": "object", "required": ["type", "from", "to"],
|
|
"properties": {"type": {"enum": ["requirement_to_policy", "policy_to_decision", "decision_to_action", "action_to_artifact", "artifact_to_verification", "verification_to_evidence", "evidence_to_outcome", "parent_to_child_execution"]}, "from": {"type": "string"}, "to": {"type": "string"}}, "additionalProperties": false
|
|
},
|
|
"Approval": {
|
|
"type": "object", "required": ["approval_id", "decision", "approver_ref", "timestamp"],
|
|
"properties": {"approval_id": {"type": "string"}, "decision": {"enum": ["approve", "reject"]}, "approver_ref": {"type": "string"}, "reason": {"type": ["string", "null"]}, "timestamp": {"$ref": "#/$defs/Timestamp"}}, "additionalProperties": false
|
|
},
|
|
"Intervention": {
|
|
"type": "object", "required": ["intervention_id", "type", "requested_by", "status", "timestamp"],
|
|
"properties": {"intervention_id": {"type": "string"}, "type": {"enum": ["pause", "resume", "cancel", "quarantine", "reduce_authority", "redirect", "roll_back"]}, "requested_by": {"type": "string"}, "status": {"enum": ["applied", "rejected", "unsupported", "pending"]}, "timestamp": {"$ref": "#/$defs/Timestamp"}}, "additionalProperties": false
|
|
}
|
|
}
|
|
}
|