{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paloframework.org/schemas/palo-agentic-evidence-envelope.schema.json",
  "title": "PALO Signed Agentic Evidence Envelope",
  "description": "Developer-preview evidence-envelope contract. Version 1 uses a shared HMAC secret; version 2 supports RFC 8785 canonicalization and externally verifiable Ed25519 signatures. Neither version is external timestamping, legal evidence, or certification of the claimed execution.",
  "type": "object",
  "required": ["format", "schemaVersion", "eventId", "caseId", "agentId", "claimId", "decisionId", "outcome", "recordedAt", "payloadDigest", "previousEventDigest", "keyId", "algorithm", "signature"],
  "properties": {
    "format": { "const": "palo-agentic-evidence-envelope" },
    "schemaVersion": { "enum": ["1.0.0", "2.0.0"] },
    "eventId": { "type": "string", "pattern": "^event-[a-f0-9-]{36}$" },
    "caseId": { "type": "string", "minLength": 1, "maxLength": 128 },
    "agentId": { "type": "string", "pattern": "^agent-[a-zA-Z0-9][a-zA-Z0-9-]{5,63}$" },
    "claimId": { "type": "string", "pattern": "^claim-[a-f0-9-]{36}$" },
    "decisionId": { "type": "string", "pattern": "^decision-[a-f0-9-]{36}$" },
    "approvalId": { "type": "string", "pattern": "^approval-[a-f0-9-]{36}$" },
    "executionId": { "type": "string", "pattern": "^execution-[a-f0-9-]{36}$" },
    "attestationId": { "type": "string", "pattern": "^attestation-[a-f0-9-]{36}$" },
    "incidentId": { "type": "string", "pattern": "^incident-[a-f0-9-]{36}$" },
    "taskId": { "type": "string", "pattern": "^task-[a-f0-9-]{36}$" },
    "traceId": { "type": "string", "pattern": "^[a-f0-9]{32}$" },
    "outcome": { "enum": ["allowed", "denied", "pending_approval", "executed", "failed", "execution_started", "execution_succeeded", "execution_failed", "execution_unknown", "outcome_verified", "outcome_mismatch", "outcome_inconclusive", "incident_opened", "incident_resolved"] },
    "recordedAt": { "type": "string", "format": "date-time" },
    "redactedPayload": { "type": "object", "additionalProperties": true },
    "payloadDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
    "previousEventDigest": { "type": ["string", "null"], "pattern": "^sha256:[a-f0-9]{64}$" },
    "keyId": { "type": "string", "pattern": "^key-[a-zA-Z0-9._-]{3,100}$" },
    "algorithm": { "enum": ["HMAC-SHA256", "Ed25519"] },
    "canonicalization": { "const": "RFC8785" },
    "verificationMethod": { "type": "string", "minLength": 1, "maxLength": 1000 },
    "signature": {
      "oneOf": [
        { "type": "string", "pattern": "^hmac-sha256:[a-f0-9]{64}$" },
        { "type": "string", "pattern": "^ed25519:[A-Za-z0-9_-]{86}$" }
      ]
    }
  },
  "allOf": [
    {
      "if": { "properties": { "schemaVersion": { "const": "1.0.0" } }, "required": ["schemaVersion"] },
      "then": { "properties": { "algorithm": { "const": "HMAC-SHA256" }, "canonicalization": false, "verificationMethod": false, "signature": { "type": "string", "pattern": "^hmac-sha256:[a-f0-9]{64}$" } } }
    },
    {
      "if": { "properties": { "schemaVersion": { "const": "2.0.0" } }, "required": ["schemaVersion"] },
      "then": { "properties": { "algorithm": { "const": "Ed25519" }, "canonicalization": { "const": "RFC8785" }, "verificationMethod": { "type": "string" }, "signature": { "type": "string", "pattern": "^ed25519:[A-Za-z0-9_-]{86}$" } }, "required": ["canonicalization", "verificationMethod"] }
    }
  ],
  "additionalProperties": false
}