{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://developer.reits.tech/schemas/runner-credential-boundary.v1.schema.json",
  "title": "D05-T01 runner credential and task isolation boundary",
  "type": "object",
  "required": [
    "schemaVersion",
    "status",
    "evaluatedAt",
    "program",
    "task",
    "topology",
    "controls",
    "lifecycle",
    "repositoryEvidence",
    "liveEvidence",
    "invariants",
    "officialReference",
    "boundary"
  ],
  "properties": {
    "schemaVersion": { "const": "developer.reits.tech/runner-credential-boundary/v1" },
    "status": { "const": "T01_REPOSITORY_IMPLEMENTED_LIVE_QUALIFICATION_REQUIRED" },
    "evaluatedAt": { "type": "string", "format": "date-time" },
    "program": {
      "type": "object",
      "required": ["acceptedKnives", "totalKnives", "currentOrdinal", "currentKnife", "remainingIncludingCurrent", "remainingAfterCurrentAcceptance"],
      "properties": {
        "acceptedKnives": { "const": 4 },
        "totalKnives": { "const": 36 },
        "currentOrdinal": { "const": 5 },
        "currentKnife": { "const": "D05" },
        "remainingIncludingCurrent": { "const": 32 },
        "remainingAfterCurrentAcceptance": { "const": 31 }
      },
      "additionalProperties": false
    },
    "task": {
      "type": "object",
      "required": ["id", "title", "repositoryImplementationComplete", "liveQualified", "productionAccepted", "nextTask", "nextTaskTitle"],
      "properties": {
        "id": { "const": "D05-T01" },
        "repositoryImplementationComplete": { "const": true },
        "liveQualified": { "const": false },
        "productionAccepted": { "const": false },
        "nextTask": { "const": "D05-T02" }
      }
    },
    "topology": {
      "type": "object",
      "required": ["organization", "linuxRunners", "availabilityZones", "vpc", "ingressRules", "concurrencyPerRunner", "runnerMode", "taskMode", "replacementMode"]
    },
    "controls": { "type": "array", "minItems": 5, "maxItems": 5 },
    "lifecycle": { "type": "array", "minItems": 6, "maxItems": 6 },
    "repositoryEvidence": { "type": "object" },
    "liveEvidence": {
      "type": "object",
      "required": ["stackStatus", "organizationRunnersOnline", "adversarialJobsExecuted", "credentialReadAttemptsDenied", "metadataAttemptsDenied", "productionNetworkAttemptsDenied", "retirementReceiptsObserved", "replacementReceiptsObserved", "gateG01Satisfied"],
      "properties": {
        "stackStatus": { "const": "NOT_DEPLOYED" },
        "organizationRunnersOnline": { "const": 0 },
        "adversarialJobsExecuted": { "const": 0 },
        "gateG01Satisfied": { "const": false }
      }
    },
    "invariants": {
      "type": "object",
      "required": ["paidResourcesCreated", "productionChangesAuthorized", "organizationRunnerCredentialInRepository", "hostDockerSocketMountedIntoTask", "taskCanReadRunnerCredential", "taskCanReachImds", "runnerReusableAcrossJobs", "d05Accepted", "programAdvanced"],
      "properties": {
        "paidResourcesCreated": { "const": 0 },
        "productionChangesAuthorized": { "const": 0 },
        "organizationRunnerCredentialInRepository": { "const": false },
        "hostDockerSocketMountedIntoTask": { "const": false },
        "taskCanReadRunnerCredential": { "const": false },
        "taskCanReachImds": { "const": false },
        "runnerReusableAcrossJobs": { "const": false },
        "d05Accepted": { "const": false },
        "programAdvanced": { "const": false }
      },
      "additionalProperties": false
    },
    "officialReference": { "type": "string", "format": "uri" },
    "boundary": { "type": "string", "minLength": 80 }
  },
  "additionalProperties": false
}