{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://pulp.audio/contracts/gpu-health-run-attestation-verification-v1.schema.json",
  "title": "Pulp GPU health run attestation verification v1",
  "description": "Records verification of a logical producer path and descriptor-read producer bytes by SHA-256. Platform build identifiers and OS code-signature metadata are not authenticated by v1.",
  "type": "object",
  "additionalProperties": false,
  "required": ["schema", "version", "status", "verified_at_utc", "max_age_seconds", "implementation_revision", "evidence_revision", "protected_ref_revision", "attestation", "health_result", "canonical_schemas", "selection", "host", "trusted_host", "producer", "verifier", "signature", "chronology"],
  "properties": {
    "schema": { "const": "pulp.gpu-health-run-attestation-verification.v1" },
    "version": { "const": 1 },
    "status": { "const": "verified" },
    "verified_at_utc": { "$ref": "#/$defs/utc" },
    "max_age_seconds": { "type": "integer", "minimum": 0 },
    "implementation_revision": { "$ref": "#/$defs/git_sha" },
    "evidence_revision": { "$ref": "#/$defs/git_sha" },
    "protected_ref_revision": { "$ref": "#/$defs/git_sha" },
    "attestation": {
      "type": "object", "additionalProperties": false,
      "required": ["revision", "path", "blob_sha1", "sha256"],
      "properties": {
        "revision": { "$ref": "#/$defs/git_sha" },
        "path": { "$ref": "#/$defs/repository_path" },
        "blob_sha1": { "$ref": "#/$defs/git_sha" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "health_result": {
      "type": "object", "additionalProperties": false,
      "required": ["path", "blob_sha1", "sha256", "schema", "run_id", "measured_at_utc"],
      "properties": {
        "path": { "$ref": "#/$defs/repository_path" },
        "blob_sha1": { "$ref": "#/$defs/git_sha" },
        "sha256": { "$ref": "#/$defs/sha256" },
        "schema": { "const": "pulp.gpu-health-result.v2" },
        "run_id": { "type": "string", "minLength": 1, "maxLength": 128 },
        "measured_at_utc": { "$ref": "#/$defs/utc" }
      }
    },
    "canonical_schemas": {
      "type": "object", "additionalProperties": false,
      "required": ["attestation", "health_result", "verification"],
      "properties": {
        "attestation": { "$ref": "#/$defs/attestation_schema_binding" },
        "health_result": { "$ref": "#/$defs/health_schema_binding" },
        "verification": { "$ref": "#/$defs/verification_schema_binding" }
      }
    },
    "selection": {
      "type": "object", "additionalProperties": false,
      "required": ["configuration", "probe_id", "adapter_name", "backend", "device"],
      "properties": {
        "configuration": { "$ref": "#/$defs/identity" },
        "probe_id": { "$ref": "#/$defs/identity" },
        "adapter_name": { "$ref": "#/$defs/identity" },
        "backend": { "$ref": "#/$defs/identity" },
        "device": { "$ref": "#/$defs/identity" }
      }
    },
    "host": {
      "type": "object", "additionalProperties": false,
      "required": ["host_id", "stable_machine_id_sha256"],
      "properties": {
        "host_id": { "$ref": "#/$defs/identity" },
        "stable_machine_id_sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "trusted_host": {
      "type": "object", "additionalProperties": false,
      "required": ["registry_path", "registry_sha256", "key_type", "matched_key_fingerprint"],
      "properties": {
        "registry_path": { "$ref": "#/$defs/local_path" },
        "registry_sha256": { "$ref": "#/$defs/sha256" },
        "key_type": { "const": "ssh-ed25519" },
        "matched_key_fingerprint": { "$ref": "#/$defs/fingerprint" }
      }
    },
    "producer": {
      "type": "object", "additionalProperties": false,
      "required": ["binary_path", "binary_sha256"],
      "properties": {
        "binary_path": {
          "$ref": "#/$defs/local_path",
          "description": "Signed logical producer path matched to explicit verifier policy; not the verifier's private local byte-source path."
        },
        "binary_sha256": {
          "$ref": "#/$defs/sha256",
          "description": "SHA-256 of the separately opened and unchanged local producer byte source, equal to the signed digest."
        }
      }
    },
    "verifier": {
      "type": "object", "additionalProperties": false,
      "required": ["contract_version", "entrypoint", "dependencies"],
      "properties": {
        "contract_version": { "const": 1 },
        "entrypoint": { "$ref": "#/$defs/verifier_entrypoint" },
        "dependencies": {
          "type": "array", "minItems": 2, "maxItems": 2,
          "prefixItems": [
            { "$ref": "#/$defs/gpu_health_contract_artifact" },
            { "$ref": "#/$defs/json_schema_lite_artifact" }
          ],
          "items": false
        }
      }
    },
    "signature": {
      "type": "object", "additionalProperties": false,
      "required": ["namespace", "signer_key_fingerprint", "result"],
      "properties": {
        "namespace": { "const": "pulp.gpu-health-run-attestation.v1" },
        "signer_key_fingerprint": { "$ref": "#/$defs/fingerprint" },
        "result": { "const": "verified" }
      }
    },
    "chronology": {
      "type": "object", "additionalProperties": false,
      "required": ["measured_at_utc", "attestation_created_at", "verified_at_utc", "measurement_to_attestation_seconds", "measurement_age_seconds", "attestation_age_seconds"],
      "properties": {
        "measured_at_utc": { "$ref": "#/$defs/utc" },
        "attestation_created_at": { "$ref": "#/$defs/utc" },
        "verified_at_utc": { "$ref": "#/$defs/utc" },
        "measurement_to_attestation_seconds": { "type": "integer", "minimum": 0 },
        "measurement_age_seconds": { "type": "integer", "minimum": 0 },
        "attestation_age_seconds": { "type": "integer", "minimum": 0 }
      }
    }
  },
  "$defs": {
    "git_sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
    "fingerprint": { "type": "string", "pattern": "^SHA256:[A-Za-z0-9+/]+$" },
    "utc": { "type": "string", "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]Z$" },
    "repository_path": { "type": "string", "minLength": 1, "maxLength": 1024, "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$" },
    "local_path": { "type": "string", "minLength": 1, "maxLength": 4096 },
    "identity": { "type": "string", "minLength": 1, "maxLength": 1024 },
    "attestation_schema_binding": {
      "type": "object", "additionalProperties": false,
      "required": ["path", "blob_sha1", "sha256"],
      "properties": {
        "path": { "const": "docs/contracts/gpu-health-run-attestation-v1.schema.json" },
        "blob_sha1": { "$ref": "#/$defs/git_sha" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "health_schema_binding": {
      "type": "object", "additionalProperties": false,
      "required": ["path", "blob_sha1", "sha256"],
      "properties": {
        "path": { "const": "docs/contracts/gpu-health-result-v2.schema.json" },
        "blob_sha1": { "$ref": "#/$defs/git_sha" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "verification_schema_binding": {
      "type": "object", "additionalProperties": false,
      "required": ["path", "blob_sha1", "sha256"],
      "properties": {
        "path": { "const": "docs/contracts/gpu-health-run-attestation-verification-v1.schema.json" },
        "blob_sha1": { "$ref": "#/$defs/git_sha" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "verifier_entrypoint": {
      "type": "object", "additionalProperties": false, "required": ["path", "sha256"],
      "properties": {
        "path": { "type": "string", "maxLength": 4096, "pattern": "(?:^|/)verify_gpu_health_run_attestation\\.py$" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "gpu_health_contract_artifact": {
      "type": "object", "additionalProperties": false, "required": ["path", "sha256"],
      "properties": {
        "path": { "type": "string", "maxLength": 4096, "pattern": "(?:^|/)gpu_health_contract\\.py$" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    },
    "json_schema_lite_artifact": {
      "type": "object", "additionalProperties": false, "required": ["path", "sha256"],
      "properties": {
        "path": { "type": "string", "maxLength": 4096, "pattern": "(?:^|/)json_schema_lite\\.py$" },
        "sha256": { "$ref": "#/$defs/sha256" }
      }
    }
  }
}