{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "provenancecode.change-set.v1",
  "title": "ProvenanceCode Governed Change Set (v1.0)",
  "description": "Schema for the immutable governed change set artifact produced when an ACT with STEP_UP decision is approved. The executor MUST recompute content_hash before executing to prevent substitution attacks.",
  "type": "object",
  "required": [
    "schema",
    "action_id",
    "artifact_id",
    "content_hash",
    "approved_by",
    "approved_at",
    "environment",
    "risk_level",
    "changes"
  ],
  "additionalProperties": true,
  "properties": {
    "schema": {
      "type": "string",
      "const": "provenancecode.change-set.v1"
    },
    "action_id": {
      "type": "string",
      "pattern": "^ACT-"
    },
    "artifact_id": {
      "type": "string",
      "minLength": 1
    },
    "content_hash": {
      "type": "string",
      "minLength": 1,
      "description": "sha256 of canonical({ changes, environment, risk_level }) — must be verified by executor before executing"
    },
    "approved_by": {
      "type": "string",
      "minLength": 1
    },
    "approved_at": {
      "type": "string",
      "format": "date-time"
    },
    "environment": {
      "type": "object",
      "required": ["branch"],
      "additionalProperties": true,
      "properties": {
        "branch": {
          "type": "string",
          "minLength": 1
        },
        "commit_sha": {
          "type": "string",
          "pattern": "^[0-9a-f]{7,40}$"
        }
      }
    },
    "risk_level": {
      "type": "string",
      "enum": ["low", "medium", "high", "critical"]
    },
    "changes": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": ["change_id", "type", "path"],
        "additionalProperties": true,
        "properties": {
          "change_id": {
            "type": "string",
            "minLength": 1
          },
          "type": {
            "type": "string",
            "enum": ["file_create", "file_modify", "file_delete", "dir_create", "dir_delete", "shell_command", "deploy"]
          },
          "path": {
            "type": "string",
            "minLength": 1
          },
          "description": {
            "type": "string"
          }
        }
      }
    }
  }
}