{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/proofprotocol/PP-SPEC-083-PROOFID-101/schemas/identity-record.schema.json",
  "title": "ProofID 101 Identity Record",
  "description": "Defines one Identity in a run (PP-SPEC-083 Section 12). Identity ID per 12.2.",
  "type": "object",
  "required": [
    "spec",
    "identity_id",
    "kind",
    "name",
    "owner",
    "parent",
    "keyed",
    "scope",
    "arena",
    "created",
    "valid_through",
    "status",
    "signatures"
  ],
  "properties": {
    "spec": {
      "const": "PP-SPEC-083"
    },
    "identity_id": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$"
    },
    "kind": {
      "anyOf": [
        {
          "enum": [
            "arena",
            "interface",
            "ingress",
            "egress",
            "pipe",
            "target",
            "release_driver",
            "attacker_agent",
            "sensor",
            "witness",
            "issuer",
            "adjudicator",
            "signer",
            "registry",
            "time_anchor",
            "operator",
            "aut",
            "dut",
            "cut",
            "sut"
          ]
        },
        {
          "type": "string",
          "pattern": "^x-[a-z0-9_-]+$"
        }
      ]
    },
    "name": {
      "type": "string",
      "description": "Human-readable label; never used for authentication."
    },
    "owner": {
      "type": "object",
      "required": [
        "id",
        "root"
      ],
      "properties": {
        "id": {
          "type": "string",
          "description": "Stable identifier: ORCID, https URL, or organization identifier"
        },
        "root": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "The Owner's Root Identity ID"
        }
      },
      "additionalProperties": false
    },
    "parent": {
      "anyOf": [
        {
          "type": "null"
        },
        {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        }
      ],
      "description": "Certifying Identity ID; null for a Root Identity."
    },
    "keyed": {
      "type": "boolean"
    },
    "public_key": {
      "type": "object",
      "required": [
        "alg",
        "key"
      ],
      "properties": {
        "alg": {
          "type": "string"
        },
        "key": {
          "type": "string"
        }
      },
      "additionalProperties": false
    },
    "key_custody": {
      "anyOf": [
        {
          "enum": [
            "hsm",
            "kms",
            "signing_service"
          ]
        },
        {
          "type": "string",
          "pattern": "^x-"
        }
      ]
    },
    "fingerprint": {
      "type": "object",
      "required": [
        "hash",
        "covers",
        "captured_by"
      ],
      "properties": {
        "hash": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        },
        "covers": {
          "type": "string",
          "description": "What the hash is over (077 15.2)"
        },
        "captured_by": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        }
      },
      "additionalProperties": false
    },
    "asserted": {
      "type": "object",
      "description": "Subject only: the Provider's or Agent Provider's own claims, recorded, never trusted (11.2).",
      "properties": {
        "product": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "configuration_digest": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        }
      },
      "additionalProperties": false
    },
    "scope": {
      "type": "object",
      "required": [
        "integration_points",
        "record_kinds"
      ],
      "properties": {
        "integration_points": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^(IP-[0-9]+|IP-J[0-9]+|x-.+)$"
          }
        },
        "record_kinds": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "declared_policy_hash": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$",
          "description": "Delegated Credentials only (10.4)"
        },
        "actions": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "description": "Operators only (10.5)"
        }
      },
      "additionalProperties": false
    },
    "network": {
      "type": "object",
      "description": "Interfaces only. Either the identifiers or, when held holder_only, their digest (9.2).",
      "properties": {
        "addresses": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "hostnames": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "ports": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 0,
            "maximum": 65535
          }
        },
        "macs": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "digest": {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        },
        "disclosure": {
          "enum": [
            "public",
            "holder_only"
          ]
        }
      },
      "additionalProperties": false
    },
    "arena": {
      "anyOf": [
        {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        },
        {
          "const": "self"
        }
      ],
      "description": "Arena Identity ID, or self for the Arena Identity."
    },
    "created": {
      "type": "object",
      "required": [
        "at",
        "source",
        "pulse_index"
      ],
      "properties": {
        "at": {
          "type": "string",
          "format": "date-time"
        },
        "source": {
          "type": "string",
          "format": "uri"
        },
        "pulse_index": {
          "type": "integer",
          "minimum": 0
        }
      },
      "additionalProperties": false
    },
    "valid_through": {
      "type": "string",
      "format": "date-time"
    },
    "status": {
      "enum": [
        "active",
        "revoked",
        "compromised"
      ]
    },
    "revoked": {
      "type": "object",
      "required": [
        "at",
        "source",
        "pulse_index"
      ],
      "properties": {
        "at": {
          "type": "string",
          "format": "date-time"
        },
        "source": {
          "type": "string",
          "format": "uri"
        },
        "pulse_index": {
          "type": "integer",
          "minimum": 0
        }
      },
      "additionalProperties": false
    },
    "signatures": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": [
          "key_id",
          "alg",
          "sig"
        ],
        "properties": {
          "key_id": {
            "type": "string"
          },
          "alg": {
            "type": "string"
          },
          "sig": {
            "type": "string"
          }
        },
        "additionalProperties": false
      }
    },
    "proofregister_uri": {
      "type": "string",
      "format": "uri"
    },
    "registry_receipt": {
      "type": "object"
    },
    "extensions": {
      "type": "object"
    }
  },
  "additionalProperties": false,
  "allOf": [
    {
      "if": {
        "properties": {
          "keyed": {
            "const": true
          }
        }
      },
      "then": {
        "required": [
          "public_key",
          "key_custody"
        ],
        "not": {
          "required": [
            "fingerprint"
          ]
        }
      },
      "else": {
        "required": [
          "fingerprint"
        ],
        "not": {
          "required": [
            "public_key"
          ]
        }
      }
    },
    {
      "if": {
        "properties": {
          "kind": {
            "enum": [
              "aut",
              "dut",
              "cut",
              "sut",
              "pipe"
            ]
          }
        }
      },
      "then": {
        "properties": {
          "keyed": {
            "const": false
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "kind": {
            "const": "arena"
          }
        }
      },
      "then": {
        "properties": {
          "parent": {
            "type": "null"
          },
          "keyed": {
            "const": true
          },
          "arena": {
            "const": "self"
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "kind": {
            "enum": [
              "witness",
              "registry",
              "time_anchor"
            ]
          }
        }
      },
      "then": {
        "properties": {
          "keyed": {
            "const": true
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "status": {
            "enum": [
              "revoked",
              "compromised"
            ]
          }
        }
      },
      "then": {
        "required": [
          "revoked"
        ]
      }
    }
  ]
}