{ "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "properties": { "schemaVersion": { "type": "number", "const": 2 }, "minimumPosture": { "type": "string", "enum": [ "vibe", "enterprise" ] }, "references": { "type": "object", "properties": { "repoContract": { "type": "string", "minLength": 1 } }, "required": [ "repoContract" ] }, "command": { "type": "object", "properties": { "deny": { "type": "object", "properties": { "add": { "default": [], "type": "array", "items": { "type": "object", "properties": { "pattern": { "type": "string", "minLength": 1 }, "reason": { "type": "string" } }, "required": [ "pattern" ], "additionalProperties": false } }, "remove": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1 } } }, "additionalProperties": false }, "ask": { "type": "object", "properties": { "add": { "default": [], "type": "array", "items": { "type": "object", "properties": { "pattern": { "type": "string", "minLength": 1 }, "reason": { "type": "string" } }, "required": [ "pattern" ], "additionalProperties": false } }, "remove": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1 } } }, "additionalProperties": false } }, "additionalProperties": false }, "riskGates": { "type": "object", "properties": { "add": { "default": [], "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1 }, "description": { "type": "string", "minLength": 1 }, "pathPatterns": { "default": [], "type": "array", "items": { "type": "string" } }, "commandPatterns": { "default": [], "type": "array", "items": { "type": "string" } } }, "required": [ "name", "description" ], "additionalProperties": false } }, "override": { "default": {}, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "object", "properties": { "description": { "type": "string" }, "pathPatterns": { "type": "array", "items": { "type": "string" } }, "commandPatterns": { "type": "array", "items": { "type": "string" } } }, "additionalProperties": false } } }, "additionalProperties": false }, "licenses": { "type": "object", "properties": { "disposition": { "default": {}, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "auto-approve", "alert", "fail", "block" ] } } }, "additionalProperties": false }, "security": { "type": "object", "properties": { "strix": { "oneOf": [ { "type": "object", "properties": { "targetKind": { "type": "string", "const": "local-fixture" }, "mode": { "type": "string", "enum": [ "quick", "standard", "deep" ] }, "maxBudgetCents": { "type": "integer", "minimum": 1, "maximum": 1000 }, "maxTurns": { "type": "integer", "minimum": 1, "maximum": 20 }, "timeoutMs": { "type": "integer", "minimum": 1, "maximum": 300000 }, "telemetry": { "type": "string", "const": "off" }, "imageDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "allowLiveTargets": { "default": false, "type": "boolean", "const": false }, "allowMounts": { "default": false, "type": "boolean", "const": false }, "enabled": { "type": "boolean", "const": true }, "required": { "type": "boolean" } }, "required": [ "targetKind", "mode", "maxBudgetCents", "maxTurns", "timeoutMs", "telemetry", "imageDigest", "enabled", "required" ], "additionalProperties": false }, { "type": "object", "properties": { "targetKind": { "type": "string", "const": "local-fixture" }, "mode": { "type": "string", "enum": [ "quick", "standard", "deep" ] }, "maxBudgetCents": { "type": "integer", "minimum": 1, "maximum": 1000 }, "maxTurns": { "type": "integer", "minimum": 1, "maximum": 20 }, "timeoutMs": { "type": "integer", "minimum": 1, "maximum": 300000 }, "telemetry": { "type": "string", "const": "off" }, "imageDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "allowLiveTargets": { "default": false, "type": "boolean", "const": false }, "allowMounts": { "default": false, "type": "boolean", "const": false }, "enabled": { "type": "boolean", "const": false }, "required": { "type": "boolean", "const": false } }, "required": [ "targetKind", "mode", "maxBudgetCents", "maxTurns", "timeoutMs", "telemetry", "imageDigest", "enabled", "required" ], "additionalProperties": false } ] } }, "required": [ "strix" ], "additionalProperties": false }, "mcp": { "type": "object", "properties": { "allowedServers": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1 } }, "approvals": { "default": [], "type": "array", "items": { "type": "object", "properties": { "server": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "subject": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "acceptEgress": { "type": "boolean", "const": true }, "reason": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "reviewer": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "approvedAt": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T" } }, "required": [ "server", "acceptEgress", "reason", "approvedAt" ], "additionalProperties": false } }, "allowManagedOnly": { "default": false, "type": "boolean" }, "incumbentHosts": { "type": "array", "items": { "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" } }, "githubHost": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "disabledServers": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1 } } }, "additionalProperties": false }, "trust": { "type": "object", "properties": { "approvedSources": { "type": "array", "items": { "type": "object", "properties": { "owner": { "type": "string", "minLength": 1 }, "repo": { "type": "string", "minLength": 1 }, "pinnedSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "reason": { "type": "string" } }, "required": [ "owner", "repo" ], "additionalProperties": false } }, "requireSignedSource": { "default": false, "type": "boolean" }, "requiredDetectors": { "type": "array", "items": { "type": "string", "enum": [ "skillspector", "cisco", "mcp-scanner", "semgrep", "snyk-agent-scan" ] } }, "requiredChecks": { "type": "array", "items": { "type": "string", "minLength": 1 } }, "baselineOverrides": { "type": "array", "items": { "type": "object", "properties": { "catalog": { "type": "string", "enum": [ "ecc", "superpowers" ] }, "owner": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+$" }, "repo": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+$" }, "pinnedSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "bundle": { "type": "string", "minLength": 1 }, "signingRepository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "reason": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "reviewer": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "approvedAt": { "type": "string" } }, "required": [ "catalog", "owner", "repo", "pinnedSha", "bundle", "signingRepository", "reason", "reviewer", "approvedAt" ], "additionalProperties": false } }, "internalScopes": { "default": [], "type": "array", "items": { "type": "string" } }, "skillspector": { "type": "object", "properties": { "approvedDigests": { "default": [], "type": "array", "items": { "type": "object", "properties": { "imageTag": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "imageDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "sourceRevision": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "reason": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "reviewer": { "type": "string", "minLength": 1, "maxLength": 500, "pattern": "^(?=.*\\S)[^\\u0000-\\u001F\\u007F]+$" }, "approvedAt": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T" } }, "required": [ "imageTag", "imageDigest", "sourceRevision", "reason", "approvedAt" ], "additionalProperties": false } } }, "additionalProperties": false } }, "additionalProperties": false }, "capabilityPackages": { "type": "object", "properties": { "catalog": { "type": "object", "properties": { "provider": { "type": "string", "const": "github" }, "repository": { "type": "string", "minLength": 3, "maxLength": 160, "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*\\/[A-Za-z0-9][A-Za-z0-9._-]*$" } }, "required": [ "provider", "repository" ], "additionalProperties": false }, "roots": { "maxItems": 128, "type": "array", "items": { "type": "string", "minLength": 9, "maxLength": 160, "pattern": "^package:[a-z][a-z0-9-]*\\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?:\\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)*$" } } }, "required": [ "catalog", "roots" ], "additionalProperties": false }, "governance": { "anyOf": [ { "type": "object", "properties": { "supportedClis": { "minItems": 1, "maxItems": 11, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "cursor", "antigravity", "gemini", "copilot", "windsurf", "opencode", "zed", "kimi", "kiro" ] } } }, "required": [ "supportedClis" ], "additionalProperties": false }, { "type": "object", "properties": { "policyVersion": { "type": "string", "minLength": 1, "maxLength": 500 }, "catalog": { "type": "object", "properties": { "reviewed": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "kind": { "type": "string", "enum": [ "mcp", "hook", "framework" ] }, "description": { "type": "string", "minLength": 1, "maxLength": 500 }, "capabilities": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "risks": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "source": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "git" }, "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "tree": { "type": "string", "pattern": "^[0-9a-f]{40}$" } }, "required": [ "type", "repository", "commit", "tree" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "package" }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "command" }, "command": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9][A-Za-z0-9._@:+-]*$" }, "args": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "executableDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "command", "executableDigest" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "stdio" }, "resolver": { "type": "string", "enum": [ "npx", "uvx" ] }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "resolver", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "administrativeStatus": { "type": "string", "enum": [ "approved", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "administrativeStatus" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "toolSurfaceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "verdict": { "type": "string", "enum": [ "approved", "drifted", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "toolSurfaceDigest", "verdict" ], "additionalProperties": false } ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "mcp" }, "server": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "subject": { "type": "string", "pattern": "^mcp-server-sha256:[0-9a-f]{64}$" } }, "required": [ "type", "server", "subject" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "hook" }, "handler": { "type": "string", "const": "usage-metering" }, "scriptDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "handler", "scriptDigest" ], "additionalProperties": false } ] }, "targets": { "minItems": 1, "maxItems": 3, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "kiro" ] } }, "projector": { "type": "string", "enum": [ "mcp-managed-settings", "hook-managed-settings", "usage-hook", "framework-contract" ] }, "lifecycle": { "type": "string", "enum": [ "supported", "deprecated", "retired" ] }, "evidence": { "type": "object", "properties": { "record": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } }, "required": [ "record" ], "additionalProperties": false }, "findings": { "default": [], "type": "array", "items": { "type": "string", "enum": [ "malicious-code", "prompt-injection", "auto-executing-hook", "hidden-unicode", "secrets", "unpinned-source", "dependency-confusion", "mandatory-detector-failed", "evidence-identity-drift", "unsafe-path", "normalized-collision", "missing-projector", "unsupported-target", "ownership-conflict" ] } }, "autoExecute": { "default": false, "type": "boolean" }, "framework": { "type": "string", "enum": [ "ecc", "superpowers" ] }, "clarification": { "type": "string", "minLength": 1, "maxLength": 500 }, "annotation": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "id", "kind", "description", "source", "targets", "projector", "lifecycle", "evidence" ], "additionalProperties": false } }, "custom": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "kind": { "type": "string", "enum": [ "mcp", "hook", "framework" ] }, "description": { "type": "string", "minLength": 1, "maxLength": 500 }, "capabilities": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "risks": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "source": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "git" }, "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "tree": { "type": "string", "pattern": "^[0-9a-f]{40}$" } }, "required": [ "type", "repository", "commit", "tree" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "package" }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "command" }, "command": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9][A-Za-z0-9._@:+-]*$" }, "args": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "executableDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "command", "executableDigest" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "stdio" }, "resolver": { "type": "string", "enum": [ "npx", "uvx" ] }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "resolver", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "administrativeStatus": { "type": "string", "enum": [ "approved", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "administrativeStatus" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "toolSurfaceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "verdict": { "type": "string", "enum": [ "approved", "drifted", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "toolSurfaceDigest", "verdict" ], "additionalProperties": false } ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "mcp" }, "server": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "subject": { "type": "string", "pattern": "^mcp-server-sha256:[0-9a-f]{64}$" } }, "required": [ "type", "server", "subject" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "hook" }, "handler": { "type": "string", "const": "usage-metering" }, "scriptDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "handler", "scriptDigest" ], "additionalProperties": false } ] }, "targets": { "minItems": 1, "maxItems": 3, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "kiro" ] } }, "projector": { "type": "string", "enum": [ "mcp-managed-settings", "hook-managed-settings", "usage-hook", "framework-contract" ] }, "lifecycle": { "type": "string", "enum": [ "supported", "deprecated", "retired" ] }, "evidence": { "type": "object", "properties": { "record": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } }, "required": [ "record" ], "additionalProperties": false }, "findings": { "default": [], "type": "array", "items": { "type": "string", "enum": [ "malicious-code", "prompt-injection", "auto-executing-hook", "hidden-unicode", "secrets", "unpinned-source", "dependency-confusion", "mandatory-detector-failed", "evidence-identity-drift", "unsafe-path", "normalized-collision", "missing-projector", "unsupported-target", "ownership-conflict" ] } }, "autoExecute": { "default": false, "type": "boolean" }, "framework": { "type": "string", "enum": [ "ecc", "superpowers" ] }, "clarification": { "type": "string", "minLength": 1, "maxLength": 500 }, "annotation": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "id", "kind", "description", "source", "targets", "projector", "lifecycle", "evidence" ], "additionalProperties": false } } }, "additionalProperties": false }, "activations": { "default": [], "type": "array", "items": { "type": "object", "properties": { "candidate": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "state": { "type": "string", "enum": [ "active", "disabled" ] }, "targets": { "minItems": 1, "maxItems": 3, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "kiro" ] } }, "clarification": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "candidate", "state", "targets" ], "additionalProperties": false } }, "authority": { "type": "object", "properties": { "approvals": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "candidate": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "kind": { "type": "string", "enum": [ "mcp", "hook", "framework" ] }, "source": { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "git" }, "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "tree": { "type": "string", "pattern": "^[0-9a-f]{40}$" } }, "required": [ "type", "repository", "commit", "tree" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "package" }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "command" }, "command": { "type": "string", "minLength": 1, "maxLength": 200, "pattern": "^[A-Za-z0-9][A-Za-z0-9._@:+-]*$" }, "args": { "default": [], "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 500 } }, "executableDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "command", "executableDigest" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "stdio" }, "resolver": { "type": "string", "enum": [ "npx", "uvx" ] }, "registry": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "package": { "type": "string", "pattern": "^@?[A-Za-z0-9][A-Za-z0-9._/-]*$" }, "version": { "type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?$" }, "integrity": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "resolver", "registry", "package", "version", "integrity" ], "additionalProperties": false }, { "anyOf": [ { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "administrativeStatus": { "type": "string", "enum": [ "approved", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "administrativeStatus" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "remote" }, "origin": { "type": "string", "pattern": "^https:\\/\\/[A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?(?::(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$" }, "approval": { "type": "object", "properties": { "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false }, "contentScanned": { "type": "boolean", "const": false }, "toolSurfaceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "verdict": { "type": "string", "enum": [ "approved", "drifted", "revoked" ] } }, "required": [ "type", "origin", "approval", "contentScanned", "toolSurfaceDigest", "verdict" ], "additionalProperties": false } ] }, { "type": "object", "properties": { "type": { "type": "string", "const": "mcp" }, "server": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "subject": { "type": "string", "pattern": "^mcp-server-sha256:[0-9a-f]{64}$" } }, "required": [ "type", "server", "subject" ], "additionalProperties": false }, { "type": "object", "properties": { "type": { "type": "string", "const": "hook" }, "handler": { "type": "string", "const": "usage-metering" }, "scriptDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "type", "handler", "scriptDigest" ], "additionalProperties": false } ] }, "issuer": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "sourceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "evidenceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "projector": { "type": "string", "enum": [ "mcp-managed-settings", "hook-managed-settings", "usage-hook", "framework-contract" ] }, "policyVersion": { "type": "string", "minLength": 1, "maxLength": 500 }, "reason": { "type": "string", "minLength": 1, "maxLength": 500 }, "clarification": { "type": "string", "minLength": 1, "maxLength": 500 }, "scope": { "minItems": 1, "maxItems": 3, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "kiro" ] } }, "notBefore": { "type": "string" }, "expiresAt": { "type": "string" }, "github": { "type": "object", "properties": { "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "attestationId": { "type": "string", "minLength": 1, "maxLength": 500 }, "subjectDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "repository", "attestationId", "subjectDigest" ], "additionalProperties": false } }, "required": [ "id", "candidate", "kind", "source", "issuer", "sourceDigest", "evidenceDigest", "projector", "policyVersion", "reason", "scope", "notBefore", "expiresAt", "github" ], "additionalProperties": false } } }, "additionalProperties": false }, "externalCuration": { "default": [], "type": "array", "items": { "type": "object", "properties": { "framework": { "type": "string", "enum": [ "ecc", "superpowers" ] }, "items": { "default": [], "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "agent", "skill", "command" ] }, "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "source": { "type": "object", "properties": { "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "repository", "commit", "path" ], "additionalProperties": false }, "audit": { "type": "object", "properties": { "record": { "type": "string", "minLength": 1, "maxLength": 500 }, "digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "record", "digest" ], "additionalProperties": false }, "clarification": { "type": "string", "minLength": 1, "maxLength": 500 } }, "required": [ "kind", "id", "source", "audit" ], "additionalProperties": false } } }, "required": [ "framework" ], "additionalProperties": false } }, "externalSelections": { "default": [], "type": "array", "items": { "type": "object", "properties": { "framework": { "type": "string", "enum": [ "ecc", "superpowers" ] }, "items": { "default": [], "type": "array", "items": { "type": "object", "properties": { "kind": { "type": "string", "enum": [ "agent", "baseline", "capability", "framework", "lang", "mcp", "module", "runtime", "skill" ] }, "id": { "type": "string", "minLength": 1, "maxLength": 500 }, "source": { "type": "object", "properties": { "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "path": { "type": "string", "minLength": 1 } }, "required": [ "repository", "commit", "path" ], "additionalProperties": false } }, "required": [ "kind", "id", "source" ], "additionalProperties": false } } }, "required": [ "framework" ], "additionalProperties": false } }, "eccMcpApprovals": { "default": [], "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "enum": [ "nexus", "ito-compute", "jira", "firecrawl", "supabase", "ecc-memory-vault", "memory", "omega-memory", "longhand", "vercel", "railway", "cloudflare-docs", "cloudflare-workers-builds", "cloudflare-workers-bindings", "cloudflare-observability", "clickhouse", "exa-web-search", "parallel-search", "codescene", "magic", "memxus", "filesystem", "fal-ai", "browserbase", "browser-use", "devfleet", "token-optimizer", "laraplugins", "confluence", "evalview", "squish" ] }, "sourceContentSha256": { "type": "string", "const": "a4426254c55a5352db2672bc86a87f10b0029f5e4ae1b74817841e87d9ab1e57" }, "state": { "type": "string", "enum": [ "approved", "revoked" ] }, "approvedBy": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" }, "authenticationMode": { "type": "string", "minLength": 1, "maxLength": 500 }, "allowedDataClasses": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$" } } }, "required": [ "id", "sourceContentSha256", "state", "approvedBy", "authenticationMode", "allowedDataClasses" ], "additionalProperties": false } }, "eccHookControls": { "type": "object", "properties": { "profile": { "type": "string", "enum": [ "minimal", "standard", "strict" ] }, "disabledIds": { "maxItems": 40, "type": "array", "items": { "type": "string", "enum": [ "pre:write:doc-file-warning", "pre:edit-write:suggest-compact", "pre:observe", "pre:governance-capture", "pre:config-protection", "pre:mcp-health-check", "pre:edit-write:gateguard-fact-force", "pre:compact", "session:start", "session-start:plan-canvas-sessions", "post:dispatcher:sync", "post:dispatcher:async", "post:mcp-health-check", "stop:format-typecheck", "stop:check-console-log", "stop:session-end", "stop:evaluate-session", "stop:cost-tracker", "stop:desktop-notify", "session:end:marker", "pre:bash:block-no-verify", "pre:bash:auto-tmux-dev", "pre:bash:tmux-reminder", "pre:bash:git-push-reminder", "pre:bash:commit-quality", "pre:bash:gateguard-fact-force", "post:bash:command-log-audit", "post:bash:command-log-cost", "post:bash:pr-created", "post:bash:build-complete", "post:edit:design-quality-check", "post:edit:accumulator", "post:edit:console-warn", "post:governance-capture", "post:session-activity-tracker", "post:ecc-metrics-bridge", "post:ecc-context-monitor", "post:bash:dispatcher", "post:quality-gate", "post:observe:continuous-learning" ] } } }, "required": [ "profile" ], "additionalProperties": false }, "supportedClis": { "minItems": 1, "maxItems": 11, "type": "array", "items": { "type": "string", "enum": [ "claude", "codex", "cursor", "antigravity", "gemini", "copilot", "windsurf", "opencode", "zed", "kimi", "kiro" ] } }, "hookRegistrations": { "default": [], "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,119}$" }, "event": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9]{0,63}$" }, "command": { "type": "string", "minLength": 1, "maxLength": 8192 }, "functionTags": { "minItems": 1, "maxItems": 20, "type": "array", "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,119}$" } }, "spawns": { "type": "integer", "minimum": 1, "maximum": 64 }, "timeout": { "type": "integer", "minimum": 1, "maximum": 600 }, "sourceDisabled": { "default": false, "type": "boolean" }, "nativeGroup": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "nativeHook": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": {} }, "owner": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "aih" } }, "required": [ "kind" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "third-party" }, "framework": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._:-]{0,119}$" }, "declaredControls": { "default": [], "maxItems": 20, "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 120 } }, "pin": { "type": "object", "properties": { "repository": { "type": "string", "pattern": "^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$" }, "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" }, "path": { "type": "string", "minLength": 1, "maxLength": 1024 }, "launcherSha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" }, "runtimeVersion": { "type": "string", "minLength": 1, "maxLength": 120 } }, "required": [ "repository", "commit", "path", "launcherSha256", "runtimeVersion" ], "additionalProperties": false } }, "required": [ "kind", "framework", "pin" ], "additionalProperties": false }, { "type": "object", "properties": { "kind": { "type": "string", "const": "unknown" }, "launcherSha256": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$" } }, "required": [ "kind", "launcherSha256" ], "additionalProperties": false } ] } }, "required": [ "id", "event", "command", "functionTags", "spawns", "owner" ], "additionalProperties": false } } }, "required": [ "policyVersion", "catalog" ], "additionalProperties": false } ] } }, "required": [ "schemaVersion", "minimumPosture", "references" ], "additionalProperties": false, "title": "aih-org-policy.json", "allOf": [ { "if": { "properties": { "minimumPosture": { "const": "enterprise" } }, "required": [ "minimumPosture" ] }, "then": { "required": [ "governance" ], "properties": { "governance": { "required": [ "supportedClis" ] } } } } ] }