{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://getzero.dev/contracts/zero.audit_entry.v95.schema.json",
  "title": "ZERO v95 AuditEntry",
  "description": "Public-safe Runtime audit entry transport shape for mapping ZERO Runtime, Proof, replay, and journal events into lifecycle Trace objects.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schema_version",
    "entry_id",
    "trace_id",
    "state",
    "occurred_at",
    "created_at",
    "updated_at",
    "actor",
    "subject",
    "action",
    "permission_tier",
    "status",
    "runtime_refs",
    "proof_refs",
    "evidence_refs",
    "provenance_hash",
    "provenance_packet",
    "redaction"
  ],
  "properties": {
    "schema_version": { "const": "zero.audit_entry.v95" },
    "entry_id": {
      "type": "string",
      "minLength": 3,
      "maxLength": 160,
      "pattern": "^[a-zA-Z0-9_:.:-]+$"
    },
    "trace_id": {
      "type": "string",
      "minLength": 3,
      "maxLength": 160,
      "pattern": "^[a-zA-Z0-9_:.:-]+$"
    },
    "state": { "enum": ["observed", "complete", "archived"] },
    "occurred_at": { "type": "string", "format": "date-time" },
    "created_at": { "type": "string", "format": "date-time" },
    "updated_at": { "type": "string", "format": "date-time" },
    "actor": {
      "type": "object",
      "additionalProperties": false,
      "required": ["type", "id"],
      "properties": {
        "type": { "enum": ["operator", "runtime", "system", "proof"] },
        "id": { "type": "string", "minLength": 1, "maxLength": 160 },
        "handle": { "type": "string", "minLength": 1, "maxLength": 96 }
      }
    },
    "subject": {
      "type": "object",
      "additionalProperties": false,
      "required": ["type", "id"],
      "properties": {
        "type": {
          "enum": [
            "runtime_action",
            "evidence_bundle",
            "replay_frame",
            "journal_root",
            "lease",
            "agent"
          ]
        },
        "id": { "type": "string", "minLength": 1, "maxLength": 180 }
      }
    },
    "action": {
      "type": "object",
      "additionalProperties": false,
      "required": ["type", "name", "permission_tier"],
      "properties": {
        "type": { "enum": ["runtime", "proof", "journal", "replay", "operator"] },
        "name": { "type": "string", "minLength": 1, "maxLength": 120 },
        "permission_tier": { "$ref": "#/$defs/permission_tier" }
      }
    },
    "permission_tier": { "$ref": "#/$defs/permission_tier" },
    "status": { "enum": ["pending", "complete", "refused", "failed", "verified"] },
    "runtime_refs": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "action_id": { "type": "string", "minLength": 1 },
        "deployment_id": { "type": "string", "minLength": 1 },
        "lease_id": { "type": ["string", "null"], "minLength": 1 },
        "tool_name": { "type": "string", "minLength": 1 },
        "runtime_action_kind": { "type": "string", "minLength": 1 }
      }
    },
    "proof_refs": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "replay_id": { "type": "string", "minLength": 1 },
        "replay_url": { "type": "string", "format": "uri" },
        "evidence_bundle_id": { "type": "string", "minLength": 1 },
        "journal_root_hash": { "type": "string", "minLength": 8 },
        "journal_root_url": { "type": "string", "format": "uri" },
        "anchor_url": { "type": ["string", "null"], "format": "uri" },
        "public_chain": {
          "type": "object",
          "additionalProperties": false,
          "required": ["network", "status"],
          "properties": {
            "network": { "enum": ["bitcoin", "ots-calendar", "none"] },
            "status": { "enum": ["pending", "calendar_attested", "public_chain_confirmed", "not_applicable"] },
            "attestations": { "type": "integer", "minimum": 0 }
          }
        }
      }
    },
    "evidence_refs": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["kind"],
        "properties": {
          "kind": { "type": "string", "minLength": 1 },
          "hash": { "type": ["string", "null"], "minLength": 8 },
          "url": { "type": ["string", "null"], "format": "uri" },
          "schema_version": { "type": "string", "minLength": 1 }
        }
      }
    },
    "provenance_hash": {
      "type": "string",
      "pattern": "^[0-9a-f]{64}$",
      "description": "sha256 hash of the public-safe provenance_packet; maps directly to lifecycle Trace.provenance_hash."
    },
    "provenance_packet": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "producer",
        "runtime_build",
        "operator_handle",
        "agent_handle",
        "source_schema",
        "source_id",
        "input_hash",
        "output_hash",
        "journal_stream",
        "journal_entry_hash",
        "journal_root_hash"
      ],
      "properties": {
        "producer": { "type": "string", "minLength": 1 },
        "runtime_build": { "type": "string", "minLength": 1 },
        "operator_handle": { "type": "string", "minLength": 1 },
        "agent_handle": { "type": "string", "minLength": 1 },
        "source_schema": { "type": "string", "minLength": 1 },
        "source_id": { "type": "string", "minLength": 1 },
        "input_hash": { "type": "string", "minLength": 8 },
        "output_hash": { "type": "string", "minLength": 8 },
        "journal_stream": { "type": "string", "minLength": 1 },
        "journal_entry_hash": { "type": "string", "minLength": 8 },
        "journal_root_hash": { "type": "string", "minLength": 8 }
      }
    },
    "redaction": {
      "type": "object",
      "additionalProperties": false,
      "required": ["profile", "secret_material_included"],
      "properties": {
        "profile": { "enum": ["public", "internal-redacted"] },
        "secret_material_included": { "const": false }
      }
    }
  },
  "$defs": {
    "permission_tier": {
      "enum": [
        "read-only",
        "compute",
        "writes-drafts",
        "executes-actions",
        "financial-access",
        "manages-credentials"
      ]
    }
  }
}