org.governedcrossing.temp.defs

{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "crossingCompletion": {
      "description": "Instance extension for recordType crossing-completion (governanceEvent substrate-crossing). Must be emitted whenever the emitter observes that the crossing act succeeded, including after crossingTimeoutHorizon; the intent is referenced by the record's chainReference.",
      "properties": {
        "completedAt": {
          "format": "datetime",
          "type": "string"
        },
        "crossingOutcome": {
          "knownValues": [
            "completed"
          ],
          "maxLength": 32,
          "type": "string"
        },
        "crossingTargetCID": {
          "format": "cid",
          "type": "string"
        },
        "crossingTargetURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "relayIngestedAt": {
          "format": "datetime",
          "type": "string"
        },
        "targetAcceptedAt": {
          "description": "When the target service accepted the write (a PDS for AT Protocol).",
          "format": "datetime",
          "type": "string"
        }
      },
      "required": [
        "crossingTargetURI",
        "crossingTargetCID",
        "completedAt",
        "crossingOutcome"
      ],
      "type": "object"
    },
    "crossingIntent": {
      "description": "Instance extension for recordType crossing-intent (governanceEvent substrate-crossing). Emitted before the crossing act. Carries digests and references of what crosses, never the content.",
      "properties": {
        "authorizedContentDigest": {
          "description": "Digest of the content authorized to cross, bound at grant time.",
          "maxLength": 256,
          "type": "string"
        },
        "crossingGrantHorizon": {
          "description": "Optional not-before horizon.",
          "format": "datetime",
          "type": "string"
        },
        "crossingTimeoutHorizon": {
          "format": "datetime",
          "type": "string"
        },
        "crossingType": {
          "knownValues": [
            "publication"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "declaredBoundType": {
          "knownValues": [
            "exposure-unbounded",
            "exposure-upper-bound",
            "confirmation",
            "attestation"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "gateCheckedAt": {
          "format": "datetime",
          "type": "string"
        },
        "gateResult": {
          "description": "A record of a blocked gate check is never published in any form (no commitment, no projection); it stays on the party's substrate.",
          "knownValues": [
            "pass",
            "blocked"
          ],
          "maxLength": 32,
          "type": "string"
        },
        "grantReference": {
          "maxLength": 1024,
          "type": "string"
        },
        "grantorDID": {
          "format": "did",
          "type": "string"
        },
        "identityCustodyClass": {
          "knownValues": [
            "self-custodied",
            "mixed-custody",
            "provider-custodied"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "recallSemantics": {
          "knownValues": [
            "enforced-stream-close",
            "propagated-request",
            "none"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "regimeAcknowledgment": {
          "description": "Declared acknowledgment; the gate checks presence, not authorship.",
          "maxGraphemes": 1000,
          "maxLength": 3000,
          "type": "string"
        },
        "sourceDocumentCID": {
          "description": "Content address or heads of the source document at mint; backdating-detectability anchor, no verification claim.",
          "maxLength": 4096,
          "type": "string"
        },
        "sourceDocumentURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "sourceLineage": {
          "items": {
            "ref": "#sourceLineageEntry",
            "type": "ref"
          },
          "maxLength": 256,
          "type": "array"
        },
        "targetDID": {
          "format": "did",
          "type": "string"
        },
        "targetLexicon": {
          "description": "Schema of the record in the target regime (AT Protocol crossings).",
          "format": "nsid",
          "type": "string"
        },
        "targetService": {
          "description": "Service the crossing writes to (a PDS for AT Protocol).",
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "grantorDID",
        "targetDID",
        "identityCustodyClass",
        "sourceDocumentURI",
        "sourceDocumentCID",
        "authorizedContentDigest",
        "targetLexicon",
        "targetService",
        "crossingType",
        "regimeAcknowledgment",
        "declaredBoundType",
        "recallSemantics",
        "crossingTimeoutHorizon",
        "grantReference",
        "gateResult",
        "gateCheckedAt"
      ],
      "type": "object"
    },
    "recordRef": {
      "description": "Reference to another crossing record. `recordId` is the record's substrate-independent identifier. `cid` is its link CID: the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures`, every `$type` key at any depth, `provenanceStatus`, `provenanceStatusBasis` and `supersededBy` removed, and no `$sig` inserted. A content address, not a signature or proof.",
      "properties": {
        "cid": {
          "format": "cid",
          "type": "string"
        },
        "recordId": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "recordId",
        "cid"
      ],
      "type": "object"
    },
    "signature": {
      "description": "Inline signature per the ATProtocol Attestation Specification v1.0. Signs the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures` removed and a `$sig` object inserted, where `$sig` is this signature object minus `signature`, plus `repository` set to the record's `emittedBy` DID. Because `key` and `role` enter `$sig`, each signer's CID is distinct; every signer covers the same record content. ECDSA P-256 or K-256, low-S.",
      "properties": {
        "key": {
          "description": "Full DID verification method reference (did:...#fragment). A dedicated verification method is advised so key rotation does not orphan signatures.",
          "maxLength": 2048,
          "type": "string"
        },
        "role": {
          "description": "Signer's role in the crossing.",
          "knownValues": [
            "emitter",
            "counterparty",
            "institution"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "signature": {
          "description": "ECDSA signature over the CID bytes, low-S form.",
          "type": "bytes"
        }
      },
      "required": [
        "signature",
        "key"
      ],
      "type": "object"
    },
    "sourceLineageEntry": {
      "description": "One granted input the crossed content was assembled from. Informational lineage; the binding digest is crossingIntent.authorizedContentDigest.",
      "properties": {
        "contentDigest": {
          "maxLength": 256,
          "type": "string"
        },
        "documentCID": {
          "description": "Content address or heads of the input document at assembly.",
          "maxLength": 4096,
          "type": "string"
        },
        "documentURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "documentURI",
        "documentCID",
        "contentDigest"
      ],
      "type": "object"
    }
  },
  "description": "DRAFT in the temp namespace; may change without notice. Shared definitions for governed crossing records: the inline signature type, record references, and the substrate-crossing extensions. An AT Protocol binding of the seam:CrossingRecord vocabulary (https://jediwright.github.io/seam-stack/vocab/crossing-record/0.1#), which is the semantic contract.",
  "id": "org.governedcrossing.temp.defs",
  "lexicon": 1
}