contracts/vectors/protocol-v1.json

{
  "schemaVersion": "1.0.0",
  "warning": "Public deterministic test vectors only. The fixed test keys carry no authority and must never be trusted in production.",
  "artifacts": {
    "request": {
      "schema": "opstruth.action-request",
      "schemaVersion": "1.0.0",
      "requestId": "urn:uuid:11111111-1111-4111-8111-111111111111",
      "createdAt": "2026-08-27T12:00:00Z",
      "expiresAt": "2026-08-27T13:00:00Z",
      "issuer": { "id": "urn:opstruth:service:public-verifier", "type": "service" },
      "subject": {
        "provider": "github",
        "repositoryId": "123456789",
        "repositoryName": "Example/project",
        "baselineCommitSha": "1111111111111111111111111111111111111111",
        "environment": "production"
      },
      "findingRefs": [{
        "id": "urn:opstruth:finding:missing-route",
        "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
      }],
      "requestedOutcome": {
        "description": "Add the declared health route and prove it is deployed from the requested commit.",
        "assertions": [{
          "assertionId": "route.health.exists",
          "description": "The health route exists in source and returns an allowed status from the bound deployment.",
          "target": { "nodeType": "runtime_observation", "field": "status", "match": { "path": "/health" } },
          "predicate": "status_in",
          "expected": [200, 204],
          "evidenceRequirements": ["commit", "deployment", "runtime_observation"]
        }]
      },
      "permittedOperations": ["modify_source", "run_declared_checks", "create_commit", "push_branch", "open_pull_request", "deploy"],
      "forbiddenOperations": ["update_configuration", "rotate_secret"],
      "constraints": {
        "allowedPaths": ["src/**", "test/**"],
        "deniedPaths": [".github/**", "wrangler.jsonc"],
        "allowedEnvironments": ["production"],
        "networkPolicy": "dependency_acquisition_only",
        "maxDurationSeconds": 1800,
        "maxOperations": 20
      },
      "approvalRequirement": {
        "required": true,
        "minimumApprovals": 1,
        "allowedApproverIds": ["urn:opstruth:human:repository-owner"]
      },
      "idempotencyKey": "request.11111111-1111-4111-8111-111111111111",
      "digest": "sha256:90b3198aa8f7af1ffc4d378bc520043b41caf88cc611e088b567894c162e6327"
    },
    "authorization": {
      "schema": "opstruth.action-authorization",
      "schemaVersion": "1.0.0",
      "authorizationId": "urn:uuid:22222222-2222-4222-8222-222222222222",
      "requestDigest": "sha256:90b3198aa8f7af1ffc4d378bc520043b41caf88cc611e088b567894c162e6327",
      "decision": "APPROVED",
      "issuedAt": "2026-08-27T12:05:00Z",
      "expiresAt": "2026-08-27T12:35:00Z",
      "nonce": "nonce.22222222-2222-4222-8222-222222222222",
      "approver": { "id": "urn:opstruth:human:repository-owner", "type": "human" },
      "grantedOperations": ["modify_source", "run_declared_checks", "create_commit", "push_branch", "open_pull_request"],
      "constraintsDigest": "sha256:b41d78a25b0f1ea7631a8af6e8cb6de69555d0f81d2452d6a844f2d556c8e6bd",
      "digest": "sha256:438a314a9852dc3a9517c967e2451037c6676dff8d9871d8a4dedd401f62c2f0",
      "proof": {
        "algorithm": "Ed25519",
        "signerFingerprint": "sha256:503d8ee46d581c649966569ae095e27041de83322e8e0480e5539e00d2d5d874",
        "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA0EqyMnQrtKs6E2i9RhXk5tAiSrcaAWuvhSCjMsl3hzc=\n-----END PUBLIC KEY-----",
        "signatureBase64": "oVKnPtsRkOOgF+ZamluKUJWmglLMEnsIUJS4RnPXjoCxcoagQNDv2Q/k74IA4FIcJdMGT3ERPVEbxtkoynrrCw=="
      }
    },
    "receipt": {
      "schema": "opstruth.execution-receipt",
      "schemaVersion": "1.0.0",
      "receiptId": "urn:uuid:33333333-3333-4333-8333-333333333333",
      "requestDigest": "sha256:90b3198aa8f7af1ffc4d378bc520043b41caf88cc611e088b567894c162e6327",
      "authorizationDigest": "sha256:438a314a9852dc3a9517c967e2451037c6676dff8d9871d8a4dedd401f62c2f0",
      "idempotencyKey": "request.11111111-1111-4111-8111-111111111111",
      "consumedAuthorizationNonce": "nonce.22222222-2222-4222-8222-222222222222",
      "executor": { "id": "urn:opstruth:runner:isolated-example", "type": "runner" },
      "startedAt": "2026-08-27T12:06:00Z",
      "completedAt": "2026-08-27T12:11:00Z",
      "executionState": "SUCCEEDED",
      "operations": [{
        "operationId": "operation.1",
        "sequence": 1,
        "type": "modify_source",
        "target": "urn:github:repository:123456789:path:src.worker.js",
        "state": "SUCCEEDED",
        "beforeDigest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
        "afterDigest": "sha256:7777777777777777777777777777777777777777777777777777777777777777",
        "evidenceRefs": [{
          "id": "urn:opstruth:evidence:patch-1",
          "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
        }]
      }],
      "affectedResources": [{
        "id": "urn:github:commit:2222222222222222222222222222222222222222",
        "type": "commit",
        "digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
      }],
      "artifacts": [],
      "claims": [{ "assertionId": "route.health.exists", "outcome": "SATISFIED", "observedValue": true, "evidenceRefs": [] }],
      "changedState": true,
      "errors": [],
      "warnings": [],
      "digest": "sha256:1d685623dc299d855d5d90204755ae30db4e80042d52e39ce789b27d491db6df",
      "proof": {
        "algorithm": "Ed25519",
        "signerFingerprint": "sha256:744f36cca67eb1912cb282e08e86bd2fe0d09004a28cf6e7c6bd56cdd6bf65aa",
        "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAoJql9HpnWYAv+VX43C0qFKXJnSO+l/hkEn/5ODRVpPA=\n-----END PUBLIC KEY-----",
        "signatureBase64": "N5LbTBvIuMaqdFq0Zb2X/o3EKN9C6QdoXTcTymokFdm4aFcuH7IIjsQO+FBXcuCSCvVX5GZph/JW4RxiRP3iDA=="
      }
    },
    "result": {
      "schema": "opstruth.verification-result",
      "schemaVersion": "1.0.0",
      "resultId": "urn:uuid:44444444-4444-4444-8444-444444444444",
      "requestDigest": "sha256:90b3198aa8f7af1ffc4d378bc520043b41caf88cc611e088b567894c162e6327",
      "authorizationDigest": "sha256:438a314a9852dc3a9517c967e2451037c6676dff8d9871d8a4dedd401f62c2f0",
      "receiptDigest": "sha256:1d685623dc299d855d5d90204755ae30db4e80042d52e39ce789b27d491db6df",
      "evidenceGraphDigest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
      "observedAt": "2026-08-27T12:15:00Z",
      "verifier": { "id": "urn:opstruth:service:public-verifier", "type": "verifier" },
      "subject": {
        "provider": "github",
        "repositoryId": "123456789",
        "repositoryName": "Example/project",
        "baselineCommitSha": "1111111111111111111111111111111111111111",
        "observedCommitSha": "2222222222222222222222222222222222222222",
        "environment": "production"
      },
      "verdict": "UNPROVEN",
      "assertionResults": [{
        "assertionId": "route.health.exists",
        "verdict": "UNPROVEN",
        "expected": [200, 204],
        "observed": 200,
        "evidenceNodeIds": ["urn:opstruth:evidence:runtime-probe-1"],
        "explanation": "The endpoint responded, but the deployment could not be bound to the claimed commit."
      }],
      "notVerified": ["The production deployment identity is not bound to commit 2222222222222222222222222222222222222222."],
      "errors": [],
      "warnings": ["A healthy endpoint does not prove deployment provenance."],
      "digest": "sha256:2db348d4709fe2cd705250b00f3761883b4fbde2f619327ff946db2f6887fe63",
      "proof": {
        "algorithm": "Ed25519",
        "signerFingerprint": "sha256:3532fb2b134488a2a18f2a07cd6db85b4c1b808ddb10972f0ad5526856177bd4",
        "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAF8t5+ytBIPKx7GXkGY1uCLKOgT/rAeSkAIObheGAgM4=\n-----END PUBLIC KEY-----",
        "signatureBase64": "LaY/vgHWJwKt9B6ymdntKmFvZSqXabmM4SXylHXU2a+OdNNxHWAvL0fF34/tIFCM9WjS9NuImTvZo2NsYOs5BA=="
      }
    }
  }
}