{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://thehiveryiq.com/.well-known/schemas/usap-perimeter-v2.json","title":"Perimeter Bond v1","description":"Checks one supplied attempt against a declared perimeter. It does not prove full egress enforcement.","type":"object","required":["receipt_id","payload_sha256","sig_b64u","key_id","algorithm","ts","signed_body"],"additionalProperties":false,"properties":{"receipt_id":{"type":"string","pattern":"^r_usap\\.perimeter_[0-9]{10,}_[0-9a-f]{12}$"},"payload_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"sig_b64u":{"type":"string","pattern":"^[A-Za-z0-9_-]{86}$"},"key_id":{"type":"string","pattern":"^did:(hive|web|key):[A-Za-z0-9._:%-]+$"},"algorithm":{"type":"string","const":"Ed25519"},"ts":{"type":"integer","minimum":1000000000},"signed_body":{"type":"object","required":["receipt_type","schema","perimeter_id","evidence_digest_sha256","recorded_at","verdict","boundary","perimeter_policy_sha256","policy_committed_at","attempt_id","attempt_observed_at","declared_destinations","declared_protocols","declared_ports","declared_directions","observed_destination","observed_protocol","observed_port","observed_direction","destination_relation","protocol_relation","port_relation","direction_relation","elements","outcome"],"additionalProperties":false,"properties":{"receipt_type":{"type":"string","const":"usap.perimeter"},"schema":{"type":"string","const":"r2.0.0"},"perimeter_id":{"type":"string","minLength":1,"maxLength":256,"pattern":"^[A-Za-z0-9._:-]{1,256}$"},"evidence_digest_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$","description":"SHA-256 of the caller-held evidence bundle this receipt attests was recorded. The service never receives or inspects the underlying evidence, only its digest."},"recorded_at":{"type":"string","pattern":"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"},"verdict":{"type":"object","description":"Service-computed honesty boundary fields. Never caller overridable; recomputed and checked at verify time.","required":["outcome"],"additionalProperties":false,"properties":{"outcome":{"type":"string","enum":["within_declared_perimeter","outside_declared_perimeter","indeterminate"]}}},"boundary":{"type":"string","const":"Checks one supplied attempt against a declared perimeter. It does not prove full egress enforcement."},"perimeter_policy_sha256":{"type":"string","pattern":"^[0-9a-f]{64}$"},"policy_committed_at":{"type":"string","pattern":"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"},"attempt_id":{"type":"string","minLength":1,"maxLength":256},"attempt_observed_at":{"type":"string","pattern":"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}([.][0-9]{1,9})?Z$"},"declared_destinations":{"type":"array","items":{"type":"string","minLength":1,"maxLength":256},"minItems":1,"maxItems":128},"declared_protocols":{"type":"array","items":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9._:/]+$"},"minItems":1,"maxItems":128},"declared_ports":{"type":"array","items":{"type":"integer","minimum":0,"maximum":65535},"minItems":1,"maxItems":128},"declared_directions":{"type":"array","items":{"type":"string","enum":["inbound","outbound"]},"minItems":1,"maxItems":2},"observed_destination":{"type":"string","minLength":1,"maxLength":256},"observed_protocol":{"type":"string","minLength":1,"maxLength":128,"pattern":"^[A-Za-z0-9._:/]+$"},"observed_port":{"type":"integer","minimum":0,"maximum":65535},"observed_direction":{"type":"string","enum":["inbound","outbound"]},"destination_relation":{"type":"string","enum":["within_policy","outside_policy"]},"protocol_relation":{"type":"string","enum":["within_policy","outside_policy"]},"port_relation":{"type":"string","enum":["within_policy","outside_policy"]},"direction_relation":{"type":"string","enum":["within_policy","outside_policy"]},"elements":{"type":"array","items":{"type":"string","enum":["destination_outside_perimeter","protocol_outside_perimeter","port_outside_perimeter","direction_outside_perimeter"]},"minItems":0,"maxItems":4},"outcome":{"type":"string","enum":["within_declared_perimeter","outside_declared_perimeter","indeterminate"]}}}}}