{
    "enabled": true,
    "mode": "offline-first",
    "prefetch": {
        "retries": 2,
        "backoffMs": 300,
        "timeoutMs": 15000
    },
    "retention": {
        "keepLast": 10
    },
    "security": {
        "requireAttestation": true,
        "requireSigstore": true,
        "requireTransparencyLog": true,
        "requireSignedGovernance": true,
        "governanceBundle": {
            "policyPath": ".workspai/governance-policy.json",
            "signaturePath": ".workspai/governance-policy.sig",
            "publicKeyPath": ".workspai/governance-public.pem",
            "algorithm": "sha256"
        },
        "evidenceExport": {
            "enabled": true,
            "target": "http",
            "endpoint": "https://siem.example.com/intake/rapidkit",
            "authTokenEnv": "RAPIDKIT_EVIDENCE_TOKEN",
            "timeoutMs": 10000,
            "retries": 3,
            "backoffMs": 500,
            "deadLetterPath": ".workspai/reports/evidence-export-dead-letter.ndjson",
            "signing": {
                "enabled": true,
                "hmacKeyEnv": "RAPIDKIT_EVIDENCE_HMAC_KEY",
                "algorithm": "sha256",
                "headerName": "x-rapidkit-evidence-signature"
            },
            "failOnError": true
        }
    },
    "artifacts": [
        {
            "id": "backend-release",
            "source": "mirror-source/release.bin",
            "target": "releases/release.bin",
            "sha256": "PUT_REAL_SHA256_HERE",
            "required": true,
            "attestation": {
                "signature": "BASE64_DETACHED_SIGNATURE",
                "publicKeyPath": ".workspai/mirror-public.pem",
                "sigstore": {
                    "signaturePath": ".workspai/release.sig",
                    "identity": "release@your-org.example",
                    "issuer": "https://token.actions.githubusercontent.com",
                    "rekorUrl": "https://rekor.sigstore.dev"
                }
            }
        }
    ]
}