contextsafe-receipt-v0.1.schema.json

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://contextsafe.invalid/schemas/contextsafe-receipt-v0.1.schema.json",
  "title": "ContextSafe evaluation receipt document 0.1",
  "$comment": "Pre-1.0 shape of the contextsafe-receipt-v1.schema.json listed in docs/04-ARCHITECTURE.md section 8; the published payload is the iteration-4 claim-minimal payload, not a reviewed pilot receipt. The document root carries the untrusted envelope, the deterministic payload, and the payload hash. #/$defs/deterministic_payload is the standalone contract for the hashed payload. JSON Schema validates structure only; ContextSafe tests additionally verify payload_sha256 agreement and enum parity with the runtime status, reason, checkpoint, and concept types.",
  "x-contextsafe-semantic-constraints": [
    "payload_sha256 equals the SHA-256 of the canonical JSON encoding of payload",
    "the pinned limitations bound this document only; F-030 also requires every rendered report derived from it to present each disclosure, which no JSON Schema can check",
    "envelope fields are unauthenticated caller-declared metadata that never enter payload or payload_sha256",
    "a valid document proves structure and claim minimality only; it proves no signature, trusted time, clinical approval, or external validation"
  ],
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schema_version",
    "envelope",
    "payload",
    "payload_sha256"
  ],
  "properties": {
    "schema_version": {"const": "contextsafe.receipt-document/0.1.0"},
    "envelope": {"$ref": "#/$defs/untrusted_envelope"},
    "payload": {"$ref": "#/$defs/deterministic_payload"},
    "payload_sha256": {"$ref": "#/$defs/sha256"}
  },
  "$defs": {
    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
    "semver": {
      "type": "string",
      "pattern": "^(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)$"
    },
    "case_id": {"type": "string", "pattern": "^CTP-[A-Z0-9]{3,16}$"},
    "outcome_status": {
      "enum": ["pass", "fail", "indeterminate", "blocked", "not_applicable"]
    },
    "untrusted_envelope": {
      "$comment": "Every field here is caller-declared and unauthenticated. The constants pin this artifact as unsigned: a later signing layer must publish a new schema version rather than relabel these documents.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "claimed_generated_at",
        "signature_status",
        "trusted_time"
      ],
      "properties": {
        "claimed_generated_at": {
          "type": ["string", "null"],
          "format": "date-time",
          "pattern": "^(?:[0-9]{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12][0-9]|3[01])|(?:0[469]|11)-(?:0[1-9]|[12][0-9]|30)|02-(?:0[1-9]|1[0-9]|2[0-9])))T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]Z$"
        },
        "signature_status": {"const": "not_signed"},
        "trusted_time": {"const": false}
      }
    },
    "deterministic_payload": {
      "$comment": "Claim-minimal by construction: hashes, statuses, counts, and limitations only. No timestamp, signature, reviewer, run-environment, or semantic patient value may appear, and additionalProperties is false at every level so an added claim fails closed.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "schema_version",
        "case_id",
        "hashes",
        "limitations",
        "results",
        "runner_version",
        "scope",
        "summary"
      ],
      "properties": {
        "schema_version": {"const": "contextsafe.receipt/0.1.0"},
        "case_id": {"$ref": "#/$defs/case_id"},
        "hashes": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "input_sha256",
            "result_sha256",
            "rule_set_sha256"
          ],
          "properties": {
            "input_sha256": {"$ref": "#/$defs/sha256"},
            "result_sha256": {"$ref": "#/$defs/sha256"},
            "rule_set_sha256": {"$ref": "#/$defs/sha256"}
          }
        },
        "limitations": {
          "$comment": "The mandated disclosure set, pinned in publication order (F-030, docs/09-TEST-AND-EVALUATION.md section 4), and closed exactly like the compiled-plan and compiled-pack limitation sets. A report template may not drop, reword, reorder, or pad these disclosures, and this is the only free-text-shaped field in the payload, so closing it keeps the payload hash-and-count minimal: changing the disclosures requires a new contract version.",
          "type": "array",
          "minItems": 4,
          "maxItems": 4,
          "prefixItems": [
            {"const": "Synthetic reference fixture only; not an approved clinical oracle."},
            {"const": "A passing result does not establish safety, compliance, or certification."},
            {"const": "Patient data is prohibited; bounded checks cannot prove an input is synthetic."},
            {"const": "This iteration does not ingest FHIR or sign artifacts."}
          ],
          "items": false
        },
        "results": {
          "type": "array",
          "minItems": 1,
          "items": {"$ref": "#/$defs/outcome"}
        },
        "runner_version": {"$ref": "#/$defs/semver"},
        "scope": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "clinical_oracle_approved",
            "patient_data_allowed",
            "synthetic_fixture_only"
          ],
          "properties": {
            "clinical_oracle_approved": {"const": false},
            "patient_data_allowed": {"const": false},
            "synthetic_fixture_only": {"const": true}
          }
        },
        "summary": {
          "$comment": "One count per status in the published algebra; a status may not be silently dropped from or added to a receipt summary.",
          "type": "object",
          "additionalProperties": false,
          "required": [
            "pass",
            "fail",
            "indeterminate",
            "blocked",
            "not_applicable"
          ],
          "properties": {
            "pass": {"type": "integer", "minimum": 0},
            "fail": {"type": "integer", "minimum": 0},
            "indeterminate": {"type": "integer", "minimum": 0},
            "blocked": {"type": "integer", "minimum": 0},
            "not_applicable": {"type": "integer", "minimum": 0}
          }
        }
      }
    },
    "outcome": {
      "$comment": "Hashes stand in for every expected, observed, and source value; reason codes are a closed set so an unpublished reason cannot reach a receipt.",
      "type": "object",
      "additionalProperties": false,
      "required": [
        "case_id",
        "checkpoint",
        "concept",
        "evidence_sha256s",
        "expected_sha256",
        "observed_sha256s",
        "reason",
        "rule_id",
        "rule_version",
        "status"
      ],
      "properties": {
        "case_id": {"$ref": "#/$defs/case_id"},
        "checkpoint": {
          "enum": ["registration", "ehr", "interface", "lis_return"]
        },
        "concept": {
          "enum": [
            "gender_identity",
            "recorded_sex_or_gender",
            "sex_parameter_for_clinical_use",
            "name_to_use",
            "pronouns"
          ]
        },
        "evidence_sha256s": {
          "type": "array",
          "items": {"$ref": "#/$defs/sha256"}
        },
        "expected_sha256": {"$ref": "#/$defs/sha256"},
        "observed_sha256s": {
          "type": "array",
          "items": {"$ref": "#/$defs/sha256"}
        },
        "reason": {
          "enum": [
            "affirmative_evidence_match",
            "ambiguous_evidence",
            "missing_evidence",
            "predeclared_not_applicable",
            "semantic_mismatch"
          ]
        },
        "rule_id": {"type": "string", "pattern": "^A-I[0-9]{2}$"},
        "rule_version": {"$ref": "#/$defs/semver"},
        "status": {"$ref": "#/$defs/outcome_status"}
      }
    }
  }
}