{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "$schema", "schemaVersion", "status", "positiveReadinessAllowed",
    "canonicalImplementationPath", "candidateInterfaceId",
    "independentOracleId", "launcherPath", "launcherSha256",
    "isolation", "toolchain", "executionSigner", "blockedReason"
  ],
  "properties": {
    "$schema": {"const": "../schemas/privacy-execution-trust-policy.schema.json"},
    "schemaVersion": {"const": "1.0.0"},
    "status": {
      "enum": [
        "disabled-no-genuine-execution-authority",
        "reviewed-candidate-bound"
      ]
    },
    "positiveReadinessAllowed": {"type": "boolean"},
    "canonicalImplementationPath": {
      "const": "v3-src/privacy-portability/canonical_api.py"
    },
    "candidateInterfaceId": {
      "const": "vaultfire.privacy-portability.cli-v1"
    },
    "independentOracleId": {
      "const": "vaultfire.privacy-portability.oracle-v1"
    },
    "launcherPath": {
      "const": "pr10/partner-package/scripts/run_unlinkability_protocol.py"
    },
    "launcherSha256": {
      "type": ["string", "null"],
      "pattern": "^[0-9a-f]{64}$"
    },
    "isolation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "provider", "binaryPath", "binarySha256", "binaryVersion",
        "networkNamespaceRequired", "readOnlyFilesystemRequired",
        "childProcessLimit", "cpuSeconds", "addressSpaceBytes",
        "fileSizeBytes", "openFileLimit", "wallClockSeconds"
      ],
      "properties": {
        "provider": {"const": "bubblewrap-user-namespace-v1"},
        "binaryPath": {"type": ["string", "null"]},
        "binarySha256": {
          "type": ["string", "null"],
          "pattern": "^[0-9a-f]{64}$"
        },
        "binaryVersion": {"type": ["string", "null"], "minLength": 1},
        "networkNamespaceRequired": {"const": true},
        "readOnlyFilesystemRequired": {"const": true},
        "childProcessLimit": {"const": 1},
        "cpuSeconds": {"type": "integer", "minimum": 1, "maximum": 60},
        "addressSpaceBytes": {
          "type": "integer", "minimum": 134217728, "maximum": 1073741824
        },
        "fileSizeBytes": {
          "type": "integer", "minimum": 1048576, "maximum": 33554432
        },
        "openFileLimit": {"type": "integer", "minimum": 8, "maximum": 64},
        "wallClockSeconds": {"type": "integer", "minimum": 1, "maximum": 120}
      }
    },
    "toolchain": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "pythonPath", "pythonSha256", "pythonVersion", "stdlibPath",
        "stdlibTreeSha256", "stdlibMode", "rejectSymlinks", "dynamicLibraries"
      ],
      "properties": {
        "pythonPath": {"type": ["string", "null"]},
        "pythonSha256": {
          "type": ["string", "null"],
          "pattern": "^[0-9a-f]{64}$"
        },
        "pythonVersion": {"type": ["string", "null"], "minLength": 1},
        "stdlibPath": {"type": ["string", "null"]},
        "stdlibTreeSha256": {
          "type": ["string", "null"],
          "pattern": "^[0-9a-f]{64}$"
        },
        "stdlibMode": {"const": "source-only-no-bytecode-v1"},
        "rejectSymlinks": {"const": true},
        "dynamicLibraries": {
          "type": "array",
          "uniqueItems": true,
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["sourcePath", "mountPath", "sha256"],
            "properties": {
              "sourcePath": {"type": "string", "minLength": 1},
              "mountPath": {"type": "string", "minLength": 1},
              "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
            }
          }
        }
      }
    },
    "executionSigner": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "keyType", "publicKeyBase64", "publicKeySha256",
        "privateKeyLocationSha256"
      ],
      "properties": {
        "keyType": {"const": "Ed25519"},
        "publicKeyBase64": {"type": ["string", "null"]},
        "publicKeySha256": {
          "type": ["string", "null"],
          "pattern": "^[0-9a-f]{64}$"
        },
        "privateKeyLocationSha256": {
          "type": ["string", "null"],
          "pattern": "^[0-9a-f]{64}$"
        }
      }
    },
    "blockedReason": {"type": "string", "minLength": 80}
  }
}
