{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://kxco.ai/.well-known/pqc-evidence.schema.json",
  "title": "KXCO post-quantum evidence document",
  "description": "Machine-readable statement of which post-quantum algorithms a vendor implements, what conformance evidence exists for them, and where that evidence can be fetched and re-run without contacting the vendor. Served at /.well-known/pqc-evidence.json.",
  "type": "object",
  "required": ["generated", "vendor", "product", "algorithms", "conformance", "supplyChain", "packages"],
  "additionalProperties": true,
  "properties": {
    "$schema": { "type": "string", "format": "uri" },
    "generated": {
      "type": "string",
      "format": "date-time",
      "description": "When this document was produced. A consumer should treat a stale document as unverified rather than as evidence."
    },
    "vendor": {
      "type": "object",
      "required": ["name", "url"],
      "properties": {
        "name": { "type": "string" },
        "url": { "type": "string", "format": "uri" }
      }
    },
    "product": {
      "type": "object",
      "required": ["name", "license"],
      "properties": {
        "name": { "type": "string" },
        "modality": { "type": "string" },
        "languages": { "type": "array", "items": { "type": "string" } },
        "runtime": { "type": "object" },
        "license": { "type": "string", "description": "SPDX identifier" }
      }
    },
    "algorithms": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": ["parameterSet", "standard", "family", "purpose"],
        "properties": {
          "parameterSet": { "type": "string", "examples": ["ML-DSA-65", "ML-KEM-768", "SLH-DSA-SHA2-192s"] },
          "standard": { "type": "string", "examples": ["FIPS 203", "FIPS 204", "FIPS 205"] },
          "nistSecurityCategory": { "type": "integer", "minimum": 1, "maximum": 5 },
          "family": { "type": "string" },
          "purpose": { "type": "string", "enum": ["digital signature", "key encapsulation", "key exchange"] }
        }
      }
    },
    "nistSecurityCategories": { "type": "array", "items": { "type": "integer", "minimum": 1, "maximum": 5 } },
    "hybrid": {
      "type": "array",
      "description": "Constructions pairing a post-quantum algorithm with a classical one.",
      "items": {
        "type": "object",
        "required": ["name", "purpose"],
        "properties": {
          "name": { "type": "string" },
          "purpose": { "type": "string" },
          "package": { "type": "string" }
        }
      }
    },
    "implementation": {
      "type": "object",
      "properties": {
        "backends": { "type": "array" },
        "note": { "type": "string" }
      }
    },
    "conformance": {
      "type": "object",
      "description": "Test results. Counts are stated separately rather than merged: a skipped or not-applicable case is not a pass.",
      "properties": {
        "acvp": {
          "type": "object",
          "required": ["total", "passed", "failed"],
          "properties": {
            "source": { "type": "string" },
            "total": { "type": "integer", "minimum": 0 },
            "passed": { "type": "integer", "minimum": 0 },
            "failed": { "type": "integer", "minimum": 0 },
            "skipped": { "type": "integer", "minimum": 0 },
            "skippedReason": { "type": "string" },
            "reproduce": { "type": "string", "description": "A command the reader can run" }
          }
        },
        "interoperability": {
          "type": "object",
          "required": ["checks", "failed"],
          "properties": {
            "checks": { "type": "integer", "minimum": 0 },
            "failed": { "type": "integer", "minimum": 0 },
            "notApplicable": { "type": "integer", "minimum": 0 },
            "rows": { "type": "integer", "minimum": 0 },
            "bothDirections": { "type": "boolean" },
            "negativeControls": {
              "type": "boolean",
              "description": "Whether the matrix includes controls that must fail. A suite without them cannot distinguish a working verifier from one that returns true."
            },
            "peers": {
              "type": "array",
              "items": {
                "type": "object",
                "required": ["name"],
                "properties": {
                  "name": { "type": "string" },
                  "version": { "type": "string" },
                  "language": { "type": "string" }
                }
              }
            },
            "reproduce": { "type": "string" }
          }
        },
        "protocol": { "type": "object" }
      }
    },
    "supplyChain": {
      "type": "object",
      "properties": {
        "provenance": { "type": "string" },
        "sbom": { "type": "object" },
        "reproducibleBuilds": { "type": "object" },
        "dependencyPolicy": { "type": "string", "format": "uri" },
        "dependencyAudit": { "type": "object" }
      }
    },
    "documentation": {
      "type": "object",
      "additionalProperties": { "type": "string", "format": "uri" }
    },
    "packages": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": ["name", "version", "license", "registry"],
        "properties": {
          "name": { "type": "string" },
          "version": { "type": "string" },
          "license": { "type": "string" },
          "registry": { "type": "string", "format": "uri" },
          "provenance": {
            "type": "string",
            "format": "uri",
            "description": "Attestation endpoint. Present only where an attestation exists."
          },
          "provenanceNote": {
            "type": "string",
            "description": "Why no attestation exists, where none does. Present instead of `provenance`, never alongside it."
          }
        },
        "not": { "required": ["provenance", "provenanceNote"] }
      }
    },
    "productionEvidence": { "type": "object" },
    "contact": { "type": "string" }
  }
}