{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://developer.reits.tech/schemas/aws-validation-identity.v1.schema.json",
  "title": "D05-T02 independent AWS validation identity",
  "type": "object",
  "required": [
    "schemaVersion",
    "status",
    "evaluatedAt",
    "program",
    "task",
    "observation",
    "roleContract",
    "verificationFlow",
    "repositoryEvidence",
    "liveEvidence",
    "invariants",
    "officialReferences",
    "boundary"
  ],
  "properties": {
    "schemaVersion": { "const": "developer.reits.tech/aws-validation-identity/v1" },
    "status": { "const": "T02_REPOSITORY_IMPLEMENTED_LIVE_IDENTITY_REQUIRED" },
    "evaluatedAt": { "type": "string", "format": "date-time" },
    "program": {
      "type": "object",
      "required": ["acceptedKnives", "totalKnives", "currentOrdinal", "currentKnife", "remainingIncludingCurrent", "remainingAfterCurrentAcceptance"],
      "properties": {
        "acceptedKnives": { "const": 4 },
        "totalKnives": { "const": 36 },
        "currentOrdinal": { "const": 5 },
        "currentKnife": { "const": "D05" },
        "remainingIncludingCurrent": { "const": 32 },
        "remainingAfterCurrentAcceptance": { "const": 31 }
      },
      "additionalProperties": false
    },
    "task": {
      "type": "object",
      "required": ["id", "title", "repositoryImplementationComplete", "cloudOwnerProvisioningRequired", "liveIdentityObserved", "awsTemplateValidated", "productionAccepted", "nextTask", "nextTaskBlocked", "nextTaskTitle"],
      "properties": {
        "id": { "const": "D05-T02" },
        "repositoryImplementationComplete": { "const": true },
        "cloudOwnerProvisioningRequired": { "const": true },
        "liveIdentityObserved": { "const": false },
        "awsTemplateValidated": { "const": false },
        "productionAccepted": { "const": false },
        "nextTask": { "const": "D05-T03" },
        "nextTaskBlocked": { "const": true }
      }
    },
    "observation": {
      "type": "object",
      "required": ["workspace", "awsCli", "profilesDiscovered", "awsEnvironmentCredentialVariables", "callerIdentityExecuted", "currentPrincipal", "priorPrincipal", "priorObservation", "priorObservationFreshness", "productionHostAwsCli", "productionHostEligible", "reason"],
      "properties": {
        "awsCli": { "const": "ABSENT" },
        "profilesDiscovered": { "const": 0 },
        "awsEnvironmentCredentialVariables": { "const": 0 },
        "callerIdentityExecuted": { "const": false },
        "currentPrincipal": { "type": "null" },
        "priorObservationFreshness": { "const": "STALE_SUPERSEDED" },
        "productionHostAwsCli": { "const": "PRESENT_INELIGIBLE_NOT_INVOKED" },
        "productionHostEligible": { "const": false }
      }
    },
    "roleContract": {
      "type": "object",
      "required": ["roleName", "sessionType", "maximumSessionSeconds", "trustedPrincipal", "externalIdRequired", "sessionNamePattern", "permissionsBoundaryRequired", "allowedActions", "explicitDenyEveryOtherAction", "deploymentActionsAllowed", "longLivedAccessKeysAllowed", "instanceMetadataCredentialsAllowed", "containerCredentialsAllowed", "targetTemplate", "targetRegion"],
      "properties": {
        "roleName": { "const": "reits-cloudformation-validator" },
        "sessionType": { "const": "ASSUMED_ROLE_TEMPORARY" },
        "maximumSessionSeconds": { "const": 3600 },
        "allowedActions": {
          "type": "array",
          "prefixItems": [
            { "const": "cloudformation:ValidateTemplate" },
            { "const": "sts:GetCallerIdentity" }
          ],
          "minItems": 2,
          "maxItems": 2
        },
        "explicitDenyEveryOtherAction": { "const": true },
        "deploymentActionsAllowed": { "const": false },
        "longLivedAccessKeysAllowed": { "const": false },
        "instanceMetadataCredentialsAllowed": { "const": false },
        "containerCredentialsAllowed": { "const": false },
        "targetTemplate": { "const": "ops/gitea-runner/cloudformation.yaml" },
        "targetRegion": { "const": "ap-southeast-2" }
      }
    },
    "verificationFlow": { "type": "array", "minItems": 6, "maxItems": 6 },
    "repositoryEvidence": { "type": "object" },
    "liveEvidence": {
      "type": "object",
      "required": ["roleCreated", "assumedRoleObserved", "expectedAccountMatched", "validateTemplateSucceeded", "denyProbeSucceeded", "receiptObserved", "paidResourcesCreated", "productionChangesAuthorized", "gateG01Satisfied"],
      "properties": {
        "roleCreated": { "const": false },
        "assumedRoleObserved": { "const": false },
        "expectedAccountMatched": { "const": false },
        "validateTemplateSucceeded": { "const": false },
        "denyProbeSucceeded": { "const": false },
        "receiptObserved": { "const": false },
        "paidResourcesCreated": { "const": 0 },
        "productionChangesAuthorized": { "const": 0 },
        "gateG01Satisfied": { "const": false }
      },
      "additionalProperties": false
    },
    "invariants": {
      "type": "object",
      "required": ["validationIdentityDistinctFromDeploymentIdentity", "validationIdentityDistinctFromProductionHostIdentity", "staticAccessKeysAccepted", "instanceRoleCredentialsAccepted", "arbitraryTemplateAccepted", "cloudFormationMutationAllowed", "runnerProvisioningAllowed", "d05Accepted", "programAdvanced"],
      "properties": {
        "validationIdentityDistinctFromDeploymentIdentity": { "const": true },
        "validationIdentityDistinctFromProductionHostIdentity": { "const": true },
        "staticAccessKeysAccepted": { "const": false },
        "instanceRoleCredentialsAccepted": { "const": false },
        "arbitraryTemplateAccepted": { "const": false },
        "cloudFormationMutationAllowed": { "const": false },
        "runnerProvisioningAllowed": { "const": false },
        "d05Accepted": { "const": false },
        "programAdvanced": { "const": false }
      },
      "additionalProperties": false
    },
    "officialReferences": { "type": "object" },
    "boundary": { "type": "string", "minLength": 100 }
  },
  "additionalProperties": false
}