{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://standards.rootblocks.com/schemas/security/security-scope-policy.v1.schema.json",
  "title": "RootBlocks Security Scope Policy v1",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schemaVersion",
    "policyId",
    "version",
    "operationScopes",
    "mcpScopes",
    "bundleTrust",
    "privateExtensionBoundaries"
  ],
  "properties": {
    "schemaVersion": {
      "const": "rootblocks.security-scope-policy/v1"
    },
    "policyId": {
      "$ref": "#/$defs/id"
    },
    "version": {
      "$ref": "#/$defs/semver"
    },
    "operationScopes": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/operationScope"
      }
    },
    "mcpScopes": {
      "type": "array",
      "minItems": 1,
      "items": {
        "$ref": "#/$defs/mcpScope"
      }
    },
    "bundleTrust": {
      "type": "object",
      "additionalProperties": false,
      "required": ["signedBundleRequired", "compatibilityDecisionRequired", "cacheLockRequired", "trustedSources"],
      "properties": {
        "signedBundleRequired": {
          "type": "boolean"
        },
        "compatibilityDecisionRequired": {
          "type": "boolean"
        },
        "cacheLockRequired": {
          "type": "boolean"
        },
        "trustedSources": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": ["bundle-signature", "compatibility-decision", "standard-cache-lock", "release-evidence", "audit-event"]
          },
          "uniqueItems": true
        }
      }
    },
    "privateExtensionBoundaries": {
      "type": "object",
      "additionalProperties": false,
      "required": ["componentsOnly", "globalMutationForbidden", "schemaRuleImportForbidden", "customerDataForbidden"],
      "properties": {
        "componentsOnly": {
          "type": "boolean"
        },
        "globalMutationForbidden": {
          "type": "boolean"
        },
        "schemaRuleImportForbidden": {
          "type": "boolean"
        },
        "customerDataForbidden": {
          "type": "boolean"
        }
      }
    }
  },
  "$defs": {
    "id": {
      "type": "string",
      "pattern": "^[a-z0-9][a-z0-9.-]{2,127}$"
    },
    "semver": {
      "type": "string",
      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(-[A-Za-z0-9.-]+)?(\\+[A-Za-z0-9.-]+)?$"
    },
    "operation": {
      "enum": ["compile", "run", "debug", "deploy", "trace", "evidence", "bundle"]
    },
    "operationScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["operation", "secretResolution", "redactionRequired", "evidenceRequired", "allowedMcpScopes"],
      "properties": {
        "operation": {
          "$ref": "#/$defs/operation"
        },
        "secretResolution": {
          "enum": ["none", "reference-only", "runtime-dev", "runtime-qa", "runtime-prod", "manual-approval-required"]
        },
        "redactionRequired": {
          "type": "boolean"
        },
        "evidenceRequired": {
          "type": "boolean"
        },
        "allowedMcpScopes": {
          "type": "array",
          "items": {
            "enum": ["none", "read-reference-only", "resolve-dev", "resolve-qa", "resolve-prod"]
          },
          "uniqueItems": true
        }
      }
    },
    "mcpScope": {
      "type": "object",
      "additionalProperties": false,
      "required": ["scope", "mayReadSecretValues", "mayWriteSecrets", "redactionRequired"],
      "properties": {
        "scope": {
          "enum": ["none", "read-reference-only", "resolve-dev", "resolve-qa", "resolve-prod"]
        },
        "mayReadSecretValues": {
          "type": "boolean"
        },
        "mayWriteSecrets": {
          "type": "boolean"
        },
        "redactionRequired": {
          "type": "boolean"
        }
      }
    }
  }
}