{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://cmmc20x.com/downloads/cmmc20x-evidence-profile-v0.1.schema.json",
  "title": "CMMC 20X Evidence Profile v0.1 Discussion Draft",
  "description": "Tool-neutral discussion-draft schema that keeps source evidence, checks, machine analysis, human disposition, and authorized decisions separate and traceable.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "profile",
    "scope",
    "responsibility_records",
    "claims",
    "source_evidence",
    "conflicts",
    "deterministic_checks",
    "machine_analysis",
    "human_dispositions",
    "authorized_decisions",
    "material_changes"
  ],
  "properties": {
    "profile": { "$ref": "#/$defs/profile" },
    "scope": { "$ref": "#/$defs/scope" },
    "responsibility_records": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/responsibility" }
    },
    "claims": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/claim" }
    },
    "source_evidence": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/evidence" }
    },
    "conflicts": {
      "type": "array",
      "items": { "$ref": "#/$defs/conflict" }
    },
    "deterministic_checks": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/check" }
    },
    "machine_analysis": {
      "type": "array",
      "items": { "$ref": "#/$defs/analysis" }
    },
    "human_dispositions": {
      "type": "array",
      "items": { "$ref": "#/$defs/disposition" }
    },
    "authorized_decisions": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/authorizedDecision" }
    },
    "material_changes": {
      "type": "array",
      "items": { "$ref": "#/$defs/materialChange" }
    }
  },
  "$defs": {
    "identifier": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9._:-]{2,127}$"
    },
    "nonEmptyString": {
      "type": "string",
      "minLength": 1,
      "maxLength": 2000
    },
    "stringList": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": { "$ref": "#/$defs/nonEmptyString" }
    },
    "idList": {
      "type": "array",
      "minItems": 1,
      "uniqueItems": true,
      "items": { "$ref": "#/$defs/identifier" }
    },
    "profile": {
      "type": "object",
      "additionalProperties": false,
      "required": ["name", "schema_version", "schema_uri", "package_id", "published_at", "status", "license", "synthetic", "notice"],
      "properties": {
        "name": { "const": "CMMC 20X evidence profile" },
        "schema_version": { "const": "0.1-discussion-draft" },
        "schema_uri": { "const": "https://cmmc20x.com/downloads/cmmc20x-evidence-profile-v0.1.schema.json" },
        "package_id": { "$ref": "#/$defs/identifier" },
        "published_at": { "type": "string", "format": "date-time" },
        "status": { "const": "synthetic-discussion-draft" },
        "license": { "const": "UNLICENSED" },
        "synthetic": { "const": true },
        "notice": { "$ref": "#/$defs/nonEmptyString" }
      }
    },
    "scope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["system_id", "name", "boundary_version", "environments", "cui_flows", "providers"],
      "properties": {
        "system_id": { "$ref": "#/$defs/identifier" },
        "name": { "$ref": "#/$defs/nonEmptyString" },
        "boundary_version": { "type": "string", "format": "date" },
        "environments": { "$ref": "#/$defs/stringList" },
        "cui_flows": { "$ref": "#/$defs/stringList" },
        "providers": {
          "type": "array",
          "items": { "$ref": "#/$defs/provider" }
        }
      }
    },
    "provider": {
      "type": "object",
      "additionalProperties": false,
      "required": ["provider_id", "function", "customer_responsibilities", "provider_responsibilities", "limitations"],
      "properties": {
        "provider_id": { "$ref": "#/$defs/identifier" },
        "function": { "$ref": "#/$defs/nonEmptyString" },
        "customer_responsibilities": { "$ref": "#/$defs/stringList" },
        "provider_responsibilities": { "$ref": "#/$defs/stringList" },
        "limitations": { "$ref": "#/$defs/stringList" }
      }
    },
    "responsibility": {
      "type": "object",
      "additionalProperties": false,
      "required": ["responsibility_id", "provider_id", "requirement_id", "allocation", "inherited", "consumer_duties", "valid_from", "valid_until", "limitations"],
      "properties": {
        "responsibility_id": { "$ref": "#/$defs/identifier" },
        "provider_id": { "$ref": "#/$defs/identifier" },
        "requirement_id": { "$ref": "#/$defs/nonEmptyString" },
        "allocation": { "enum": ["provider", "consumer", "shared"] },
        "inherited": { "type": "boolean" },
        "consumer_duties": { "$ref": "#/$defs/stringList" },
        "valid_from": { "type": "string", "format": "date-time" },
        "valid_until": { "type": "string", "format": "date-time" },
        "limitations": { "$ref": "#/$defs/stringList" }
      }
    },
    "claim": {
      "type": "object",
      "additionalProperties": false,
      "required": ["claim_id", "requirement_id", "assessment_objective_ids", "assertion", "owner_role", "support_status", "review_state", "evidence_ids", "responsibility_ids", "conflict_ids", "freshness", "change_triggers"],
      "properties": {
        "claim_id": { "$ref": "#/$defs/identifier" },
        "requirement_id": { "$ref": "#/$defs/nonEmptyString" },
        "assessment_objective_ids": { "$ref": "#/$defs/stringList" },
        "assertion": { "$ref": "#/$defs/nonEmptyString" },
        "owner_role": { "$ref": "#/$defs/identifier" },
        "support_status": { "enum": ["supported", "partially-supported", "unsupported", "uncertain", "stale"] },
        "review_state": { "enum": ["not-reviewed", "in-review", "returned", "accepted", "rejected", "superseded"] },
        "evidence_ids": { "$ref": "#/$defs/idList" },
        "responsibility_ids": { "$ref": "#/$defs/idList" },
        "conflict_ids": {
          "type": "array",
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/identifier" }
        },
        "freshness": {
          "type": "object",
          "additionalProperties": false,
          "required": ["maximum_age_days", "last_supported_at", "next_review_due"],
          "properties": {
            "maximum_age_days": { "type": "integer", "minimum": 1, "maximum": 3650 },
            "last_supported_at": { "type": "string", "format": "date-time" },
            "next_review_due": { "type": "string", "format": "date-time" }
          }
        },
        "change_triggers": { "$ref": "#/$defs/stringList" }
      }
    },
    "evidence": {
      "type": "object",
      "additionalProperties": false,
      "required": ["evidence_id", "type", "source_system", "collection_method", "collected_by_role", "observed_at", "scope", "coverage", "integrity", "provenance", "review_state", "limitations"],
      "properties": {
        "evidence_id": { "$ref": "#/$defs/identifier" },
        "type": { "$ref": "#/$defs/identifier" },
        "source_system": { "$ref": "#/$defs/identifier" },
        "collection_method": { "$ref": "#/$defs/identifier" },
        "collected_by_role": { "$ref": "#/$defs/identifier" },
        "observed_at": { "type": "string", "format": "date-time" },
        "scope": { "$ref": "#/$defs/stringList" },
        "coverage": {
          "type": "object",
          "additionalProperties": false,
          "required": ["population_description", "observed_count", "expected_count"],
          "properties": {
            "population_description": { "$ref": "#/$defs/nonEmptyString" },
            "observed_count": { "type": "integer", "minimum": 0 },
            "expected_count": { "type": "integer", "minimum": 0 }
          }
        },
        "integrity": {
          "type": "object",
          "additionalProperties": false,
          "required": ["algorithm", "digest", "digest_input"],
          "properties": {
            "algorithm": { "const": "sha-256" },
            "digest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
            "digest_input": { "$ref": "#/$defs/nonEmptyString" }
          }
        },
        "provenance": {
          "type": "object",
          "additionalProperties": false,
          "required": ["origin", "content_status", "transformations", "chain_of_custody"],
          "properties": {
            "origin": { "$ref": "#/$defs/nonEmptyString" },
            "content_status": { "enum": ["synthetic-placeholder", "embedded", "external-authorized-reference"] },
            "transformations": {
              "type": "array",
              "uniqueItems": true,
              "items": { "$ref": "#/$defs/nonEmptyString" }
            },
            "chain_of_custody": { "$ref": "#/$defs/stringList" }
          }
        },
        "review_state": { "enum": ["unreviewed", "machine-checked", "human-reviewed", "returned", "superseded"] },
        "limitations": { "$ref": "#/$defs/stringList" }
      }
    },
    "conflict": {
      "type": "object",
      "additionalProperties": false,
      "required": ["conflict_id", "status", "subject_ids", "description", "required_action"],
      "properties": {
        "conflict_id": { "$ref": "#/$defs/identifier" },
        "status": { "enum": ["open", "resolved", "accepted-with-limitation"] },
        "subject_ids": { "$ref": "#/$defs/idList" },
        "description": { "$ref": "#/$defs/nonEmptyString" },
        "required_action": { "$ref": "#/$defs/nonEmptyString" }
      }
    },
    "check": {
      "type": "object",
      "additionalProperties": false,
      "required": ["check_id", "rule_version", "input_ids", "executed_at", "result", "tested", "does_not_decide"],
      "properties": {
        "check_id": { "$ref": "#/$defs/identifier" },
        "rule_version": { "$ref": "#/$defs/identifier" },
        "input_ids": { "$ref": "#/$defs/idList" },
        "executed_at": { "type": "string", "format": "date-time" },
        "result": { "enum": ["pass", "pass-with-limitation", "fail", "not-run"] },
        "tested": { "$ref": "#/$defs/stringList" },
        "does_not_decide": { "$ref": "#/$defs/stringList" }
      }
    },
    "analysis": {
      "type": "object",
      "additionalProperties": false,
      "required": ["analysis_id", "status", "model_version", "input_ids", "created_at", "candidate_finding", "limitations"],
      "properties": {
        "analysis_id": { "$ref": "#/$defs/identifier" },
        "status": { "enum": ["candidate-for-human-review", "returned", "superseded"] },
        "model_version": { "$ref": "#/$defs/nonEmptyString" },
        "input_ids": { "$ref": "#/$defs/idList" },
        "created_at": { "type": "string", "format": "date-time" },
        "candidate_finding": { "$ref": "#/$defs/nonEmptyString" },
        "limitations": { "$ref": "#/$defs/stringList" }
      }
    },
    "disposition": {
      "type": "object",
      "additionalProperties": false,
      "required": ["disposition_id", "reviewer_role", "analysis_id", "decision", "rationale", "decided_at", "superseded_by_change_id"],
      "properties": {
        "disposition_id": { "$ref": "#/$defs/identifier" },
        "reviewer_role": { "$ref": "#/$defs/identifier" },
        "analysis_id": { "$ref": "#/$defs/identifier" },
        "decision": { "enum": ["accept", "change", "reject", "return-for-additional-evidence"] },
        "rationale": { "$ref": "#/$defs/nonEmptyString" },
        "decided_at": { "type": "string", "format": "date-time" },
        "superseded_by_change_id": {
          "oneOf": [
            { "$ref": "#/$defs/identifier" },
            { "type": "null" }
          ]
        }
      }
    },
    "authorizedDecision": {
      "type": "object",
      "additionalProperties": false,
      "required": ["decision_id", "status", "authority", "legal_or_program_effect"],
      "properties": {
        "decision_id": { "$ref": "#/$defs/identifier" },
        "status": { "enum": ["not-issued", "issued", "withdrawn", "superseded"] },
        "authority": { "$ref": "#/$defs/nonEmptyString" },
        "legal_or_program_effect": { "$ref": "#/$defs/nonEmptyString" }
      }
    },
    "materialChange": {
      "type": "object",
      "additionalProperties": false,
      "required": ["change_id", "event", "occurred_at", "affected_ids", "effect", "required_action", "recorded_by_role"],
      "properties": {
        "change_id": { "$ref": "#/$defs/identifier" },
        "event": { "$ref": "#/$defs/identifier" },
        "occurred_at": { "type": "string", "format": "date-time" },
        "affected_ids": { "$ref": "#/$defs/idList" },
        "effect": { "enum": ["support-status-uncertain", "support-status-stale", "scope-review-required", "responsibility-review-required"] },
        "required_action": { "$ref": "#/$defs/nonEmptyString" },
        "recorded_by_role": { "$ref": "#/$defs/identifier" }
      }
    }
  }
}