Author a Casework policy

If you are writing the policy a Registry Casework deployment will run, you edit a project directory and check it offline, with no database and no network. You continue in tutorial-work/casework, the project from Decide your first ReviewRequest, with its development session still running.

Read the project files

casework.yaml is the policy. dev-clients.yaml names the local callers and teams for caseworkctl dev, fixtures/ holds the cases test proves, and runtime.example.yaml is a starting runtime configuration for a deployment. .casework/schemas/ holds the JSON Schemas your editor reads through each file’s first-line comment. Check the project as it stands:

caseworkctl check .

{
  "filesChecked": 3,
  "policyBindings": [
    {"digest": "sha256:<digest>", "id": "decision", "version": "1"}
  ]
}

Check reads casework.yaml, dev-clients.yaml, the development session’s state file while one exists, and any holiday-sets/, and prints one binding for each ReviewPolicy. When a file is wrong, it prints a refusal with a code such as casework.review-policy.unknown-queue, the file, line, and JSON pointer, and the next step to take.

Name the queue for its reviewers

Each access profile admits a token that carries its requiredScopes, takes the caller’s identity from principalClaim, and gives the caller one role: staff, supervisor, administrator, or requester. The project declares one of each:

casework.yaml

accessProfiles:
  staff:
    principalClaim: sub
    requiredScopes: [casework:staff]
    role: staff

A queue is where a stage’s ReviewTasks wait. Its label is what reviewers see, so give it the name your team uses:

casework.yaml

queues:
  decisions:
    label: Decisions awaiting review
    label: Licence decisions

Labels are excluded from the policy digest, so check still prints the same binding.

Read the review policy and its producer

casework.yaml

reviewPolicies:
  decision:
    version: "1"
    purpose: answer
    context: {mode: submitted}
    stages:
      - id: answer
        queue: decisions
        decidingProfiles: [staff]
        requiredApprovals: 1

A ReviewPolicy fixes the purpose, the stages in order, the profiles that decide each stage, the displaySchema reviewers see, and the outcomes a decision may record. Each outcome sets its settlement, whether a reason is required, and whether a public reason is required, optional, or none. A larger policy adds routing rules that send a task to another queue by its fields, and teams that state which profiles a queue’s staff must hold.

For an approval policy, you can start with caseworkctl init --template single-reviewer-approval, two-peer-approval, or technical-check-then-authorization. The two-peer pattern supplies two local people on one Staff profile. The technical pattern gives its first stage negativeDecisions: advise: each completed decision counts toward its threshold, including a rejection or request for changes, then a separate authorizer decides. The default, settle, retains the immediate negative veto. An advisory stage must have a later stage; check refuses an advisory final stage. explain reports the effective mode.

Earlier advisory reasons remain available to authorized reviewers in decision history. The producer receives only the settling outcome and its public reason. All three patterns exclude the initiator; the technical pattern also excludes earlier reviewers from authorization.

context: {mode: submitted} reviews the snapshot the producer sent. A policy whose reviewers must see the source’s current record sets mode: current-source and names a context provider, as Review a Proposal in Casework does. trustedProducers names each calling system: its access profile, issuer, subject, source namespaces, and the policies it may request.

The digest covers the policy’s behavior and everything it depends on: stages, context, outcomes, access profiles, queues, teams, producers, and the clocks and calendars it uses. A producer that names only the policy ID is bound to the active version and digest when Casework accepts its request. A producer that pins version and digest is refused with review.policy-mismatch once the active digest changes.

Give the stage a deadline

A clock measures a deadline, and a stage clock counts working days on a calendar. Add a calendar and a five-day review deadline to the end of casework.yaml:

casework.yaml

calendars:
  office:
    timezone: Asia/Bangkok
    workingWeekdays: [monday, tuesday, wednesday, thursday, friday]
    holidaySet: office-holidays
clocks:
  review-deadline:
    type: stage
    anchor: {type: stage-entered}
    calendar: office
    after: {workingDays: 5}
    dueTime: "17:00"
    atRisk: {before: {workingDays: 1}}
    reminders: {due-soon: {before: {workingDays: 1}}}

The task is due at 17:00 Bangkok time on the fifth working day after it enters the stage, and is at risk one working day before. A clock may also carry steps that move a due task to another queue; it never decides an outcome. Attach the clock to the policy:

casework.yaml

    requiredApprovals: 1
clocks: [review-deadline]
retention:

The calendar’s working days exclude the dates of its holiday set. Write one revision of it, so check validates it with the project:

mkdir -p holiday-sets

holiday-sets/office-holidays-7.yaml

apiVersion: id.registrystack.org/formats/casework/holiday-set/v1alpha1
kind: CaseworkHolidaySet
holidaySet: office-holidays
revision: 7
dates: [2026-09-07]

Check the project and prove its fixture again. The clock changed the policy’s behavior, so its digest changes:

caseworkctl check .
caseworkctl test .

{
  "filesChecked": 4,
  "policyBindings": [
    {"digest": "sha256:<digest>", "id": "decision", "version": "1"}
  ]
}

{"proofBoundary": "offline-synthetic", "productionClosure": false}

offline-synthetic means no PostgreSQL and no runtime decision took part.

Generate types and plan the package

A producer’s client code is written against typed bindings: the policy bindings and the TypeScript and Python types for its requests, tasks, and results. Generate them outside the project and hand them to the producer’s developers:

caseworkctl types . --output ../casework-types

{
  "files": ["casework.ts", "casework.py", "contexts.schema.json"],
  "output": "../casework-types"
}

Then plan the policy package without writing it:

caseworkctl package . --dry-run

{
  "dryRun": true,
  "files": ["casework.yaml"],
  "packageDigest": "sha256:<digest>"
}

The package digest covers the bytes of every packaged file, so any edit changes it. The holiday set is not packaged: an administrator publishes its revisions to the running service, and until one is published the stage clock cannot compute a due time. Deploy Registry Casework activates the package.

Restart the session on the edited project

The running session serves the package it built when it started, and it refuses to restart on edited files while it holds records, so discard it and start a fresh one. This deletes the ReviewRequest you decided earlier and the session’s credentials:

caseworkctl dev stop --remove
caseworkctl dev start

{"status": "complete", "outcome": "stopped", "directory": {"revision": 0, "teams": 0}}

{"status": "complete", "outcome": "ready", "directory": {"revision": 1, "teams": 1}}

The session keeps its ports. Its tokens are new, so run caseworkctl dev token again before your next call. Leave it running.

Configuration reference

Format and files	Check command
Casework project casework.yaml	caseworkctl check <project>
Casework runtime configuration runtime.yaml runtime.example.yaml	caseworkctl check <project> --runtime-config <file>
Casework fixture fixtures/*.yaml fixtures/*.yml	caseworkctl test <project>
Casework holiday set holiday-sets/*.yaml holiday-sets/*.yml	caseworkctl check <project>
Casework development clients dev-clients.yaml	caseworkctl check <project>

• casework.yaml Source preview, pre-1.0, 178 key paths
• fixtures/*.yaml Source preview, pre-1.0, 11 key paths
• dev-clients.yaml Source preview, pre-1.0, 50 key paths
• holiday-sets/*.yaml Source preview, pre-1.0, 6 key paths

casework.yaml

Source preview, pre-1.0

Generated from products/casework/generated/project/project.schema.json. 178 key paths. Explained in docs/site/src/content/docs/configure/casework.mdx.

Key path	Type	Required	Accepted values	Constraints
accessProfiles	object	Yes	Not specified	None specified
accessProfiles.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.principalClaim	string	Yes	Not specified	None specified
accessProfiles.*.requiredScopes	array	Yes	Not specified	minItems: 1 uniqueItems: true
accessProfiles.*.requiredScopes[]Array item	string	No	Not specified	None specified
accessProfiles.*.role	string	Yes	administrator requester staff supervisor	None specified
apiVersion	string	Yes	id.registrystack.org/formats/casework/project/v1alpha1	None specified
calendars	object	No	Not specifiedSchema default, where declared: {}	None specified
calendars.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
calendars.*.holidaySet	string	Yes	Not specified	None specified
calendars.*.timezone	string	Yes	Not specified	None specified
calendars.*.workingWeekdays	array	Yes	Not specified	uniqueItems: true
calendars.*.workingWeekdays[]Array item	string	No	friday monday saturday sunday thursday tuesday wednesday	None specified
clocks	object	No	Not specifiedSchema default, where declared: {}	None specified
clocks.*Map valueThe serialized form of [ClockPolicy]: the shape the serializer emits.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
clocks.*.afterFor subject: An elapsed budget in exactly one unit; a day is 24 elapsed hours. For stage: A number of working days: after: {workingDays: N}, and the lead time inside before.	object	Yes	Not specified	None specified
clocks.*.after.days	integer	Conditional	Not specified	format: uint32 maximum: 3650 minimum: 1
clocks.*.after.hours	integer	Conditional	Not specified	format: uint32 maximum: 87600 minimum: 1
clocks.*.after.minutes	integer	Conditional	Not specified	format: uint32 maximum: 5256000 minimum: 1
clocks.*.after.workingDays	integer	Conditional	Not specified	format: uint32 maximum: 3650 minimum: 1
clocks.*.anchorFor subject: The instant a subject clock counts from: anchor: {type: request-accepted}. For stage: The instant a stage clock counts from: anchor: {type: stage-entered}.	object	Yes	Not specified	None specified
clocks.*.anchor.type	string	Yes	request-accepted stage-entered	None specified
clocks.*.atRiskA lead time before a stage clock is due: {before: {workingDays: N}}.	object	Conditional	Not specified	None specified
clocks.*.atRisk.beforeA number of working days: after: {workingDays: N}, and the lead time inside before.	object	Conditional	Not specified	None specified
clocks.*.atRisk.before.workingDays	integer	Conditional	Not specified	format: uint32 maximum: 3650 minimum: 1
clocks.*.calendar	string	Conditional	Not specified	None specified
clocks.*.dueTime	string	Conditional	Not specified	None specified
clocks.*.reminders	object	Conditional	Not specified	None specified
clocks.*.reminders.*Map valueA named reminder, written reminders: {ID: {before: {workingDays: N}}}.	object	Conditional	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
clocks.*.reminders.*.beforeA number of working days: after: {workingDays: N}, and the lead time inside before.	object	Conditional	Not specified	None specified
clocks.*.reminders.*.before.workingDays	integer	Conditional	Not specified	format: uint32 maximum: 3650 minimum: 1
clocks.*.steps	array	Conditional	Not specified	None specified
clocks.*.steps[]Array item	object	Conditional	Not specified	None specified
clocks.*.steps[].action	object	Conditional	Not specified	None specified
clocks.*.steps[].action.reassign	object	Conditional	Not specified	None specified
clocks.*.steps[].action.reassign.queue	string	Conditional	Not specified	None specified
clocks.*.steps[].at	string	Conditional	due	None specified
clocks.*.steps[].becauseHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Conditional	Not specified	None specified
clocks.*.steps[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
clocks.*.type	string	Yes	stage subject	None specified
contextProviders	object	No	Not specifiedSchema default, where declared: {}	None specified
contextProviders.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
contextProviders.*.capabilities	array	Yes	Not specified	uniqueItems: true
contextProviders.*.capabilities[]Array item	string	No	human-display routing-context service-status task-grant-context	None specified
contextProviders.*.deploymentRef	string	Yes	Not specified	None specified
contextProviders.*.description	string	No	Not specified	None specified
contextProviders.*.serviceProfiles	object	No	Not specifiedSchema default, where declared: {}	None specified
contextProviders.*.serviceProfiles.human-display	string	No	Not specified	None specified
contextProviders.*.serviceProfiles.routing-context	string	No	Not specified	None specified
contextProviders.*.serviceProfiles.service-status	string	No	Not specified	None specified
contextProviders.*.serviceProfiles.task-grant-context	string	No	Not specified	None specified
contextProviders.*.sourceNamespace	string	Yes	Not specified	None specified
inbox	object	No	Not specifiedSchema default, where declared: {"defaultPageSize":25,"maximumCandidateScan":100,"maximumConcurrentSourceReads":4,"maximumSourceReads":25,"pageDeadlineMilliseconds":2000}	None specified
inbox.defaultPageSize	integer	No	Not specifiedSchema default, where declared: 25	format: uint32 maximum: 100 minimum: 1
inbox.maximumCandidateScan	integer	No	Not specifiedSchema default, where declared: 100	format: uint32 maximum: 10000 minimum: 1
inbox.maximumConcurrentSourceReads	integer	No	Not specifiedSchema default, where declared: 4	format: uint32 maximum: 32 minimum: 1
inbox.maximumSourceReads	integer	No	Not specifiedSchema default, where declared: 25	format: uint32 maximum: 10000 minimum: 1
inbox.pageDeadlineMilliseconds	integer	No	Not specifiedSchema default, where declared: 2000	format: uint64 maximum: 30000 minimum: 100
kind	string	Yes	CaseworkProject	None specified
projectThe members that name a project (CFG-ENV-6): a project's project block holds these, and may add project-wide members of the product's own. Schema name ProjectIdentity.	object	Yes	Not specified	None specified
project.idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
project.version	string	Yes	Not specified	None specified
queues	object	Yes	Not specified	None specified
queues.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
queues.*.labelHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
reviewPolicies	object	No	Not specifiedSchema default, where declared: {}	None specified
reviewPolicies.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
reviewPolicies.*.clocks	array	No	Not specified	None specified
reviewPolicies.*.clocks[]Array item	string	No	Not specified	None specified
reviewPolicies.*.context	object	Yes	Not specified	None specified
reviewPolicies.*.context.contract	object	Conditional	Not specified	None specified
reviewPolicies.*.context.contract.idThe producer-issued contract id, kept exactly as written: nonblank, no control characters, and at most 256 UTF-8 bytes. The byte ceiling is enforced by the Casework reader.	string	Conditional	Not specified	maxLength: 256 maxLength: 512 minLength: 1 pattern: \S pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
reviewPolicies.*.context.contract.revision	string	Conditional	Not specified	maxLength: 71 minLength: 71 pattern: ^sha256:[0-9a-f]{64}$
reviewPolicies.*.context.contract.schemaDigestA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	string	Conditional	Not specified	pattern: ^sha256:[0-9a-f]{64}$
reviewPolicies.*.context.mode	string	Yes	current-source submitted	None specified
reviewPolicies.*.context.provider	string	Conditional	Not specified	None specified
reviewPolicies.*.displaySchema	Not specified	Yes	Not specified	None specified
reviewPolicies.*.labelOptional presentation label. Stable references use id.	string	No	Not specified	None specified
reviewPolicies.*.outcomesWritten in configuration as a mapping from each outcome id; served as a list by id.	object	No	Not specified	None specified
reviewPolicies.*.outcomes.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
reviewPolicies.*.outcomes.*.labelHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
reviewPolicies.*.outcomes.*.publicReasonWhether a decision with this outcome gives text for release to the subject's owner. There is no default: the policy author decides what an applicant is told.	string	Yes	none optional required	None specified
reviewPolicies.*.outcomes.*.reasonRequired	boolean	Yes	Not specified	None specified
reviewPolicies.*.outcomes.*.resultRequired	boolean	No	Not specified	None specified
reviewPolicies.*.outcomes.*.settlement	string	Yes	answered approved changes-requested rejected	None specified
reviewPolicies.*.purpose	string	Yes	answer approval	None specified
reviewPolicies.*.resultSchema	Not specified	No	Not specified	None specified
reviewPolicies.*.retention	object	Yes	Not specified	None specified
reviewPolicies.*.retention.accountabilityRetentionDays	integer	Yes	Not specified	format: uint32 maximum: 3650 minimum: 1
reviewPolicies.*.retention.terminalRetentionDays	integer	Yes	Not specified	format: uint32 maximum: 3650 minimum: 1
reviewPolicies.*.routing	array	No	Not specified	None specified
reviewPolicies.*.routing[]Array item	object	No	Not specified	None specified
reviewPolicies.*.routing[].becauseHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
reviewPolicies.*.routing[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
reviewPolicies.*.routing[].labelOptional presentation label. Stable references use id.	string	No	Not specified	None specified
reviewPolicies.*.routing[].queue	string	Yes	Not specified	None specified
reviewPolicies.*.routing[].when	object	Yes	Not specified	None specified
reviewPolicies.*.routing[].when.fields	object	No	Not specified	None specified
reviewPolicies.*.routing[].when.fields.*Map valueThe written form of [RoutingPredicate], an externally tagged union the shared reader decodes with positions.	object	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
reviewPolicies.*.routing[].when.fields.*.equals	Not specified	Conditional	Not specified	None specified
reviewPolicies.*.routing[].when.fields.*.oneOf	array	Conditional	Not specified	None specified
reviewPolicies.*.routing[].when.stage	string	No	Not specified	None specified
reviewPolicies.*.stages	array	Yes	Not specified	None specified
reviewPolicies.*.stages[]Array item	object	No	Not specified	None specified
reviewPolicies.*.stages[].decidingProfiles	array	Yes	Not specified	None specified
reviewPolicies.*.stages[].decidingProfiles[]Array item	string	No	Not specified	None specified
reviewPolicies.*.stages[].excludeInitiator	boolean	No	Not specifiedSchema default, where declared: false	None specified
reviewPolicies.*.stages[].excludePreviousStageReviewers	boolean	No	Not specifiedSchema default, where declared: false	None specified
reviewPolicies.*.stages[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
reviewPolicies.*.stages[].labelOptional presentation label. Stable references use id.	string	No	Not specified	None specified
reviewPolicies.*.stages[].negativeDecisionsControls whether a rejection or change request settles the whole review. settle is the default; advise records and counts the decision toward this non-final stage without settling the review.	string	No	advise settle Schema default, where declared: "settle"	None specified
reviewPolicies.*.stages[].queue	string	Yes	Not specified	None specified
reviewPolicies.*.stages[].requiredApprovals	integer	Yes	Not specified	format: uint32 maximum: 32 minimum: 1
reviewPolicies.*.version	string	Yes	Not specified	None specified
taskTemplates	object	No	Not specifiedSchema default, where declared: {}	None specified
taskTemplates.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
taskTemplates.*.agentThe agent a template names, as casework.yaml writes it: the issuer is the URL of the token issuer that authenticates the agent (CFG-VAL-7).	object	Yes	Not specified	None specified
taskTemplates.*.agent.issuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
taskTemplates.*.agent.subject	string	Yes	Not specified	None specified
taskTemplates.*.authorizationModeImmediate authorizations last at most fifteen minutes. Deferred is an explicit governed window of at most seven days; assertion TTL stays sixty seconds.	string	No	deferred immediate	None specified
taskTemplates.*.boundsThe product-specific authority a task grant carries, chosen by its type member. The shared reader's union helper decodes it so every error inside a variant keeps its position (CFG-SCHEMA-8); the wire form is unchanged.	object	Yes	Not specified	None specified
taskTemplates.*.bounds.permissions	array	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[]Array itemExact Scheduling commitment authority copied into a task grant. This duplicates the public wire shape deliberately: Casework is an authority for governed templates, not a dependency on Scheduling's runtime or model crate.	object	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].actions	array	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].actions[]Array item	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].collection	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].location	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].operations	array	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].operations[]Array item	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.permissions[].service	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.requirement	string	Conditional	Not specified	None specified
taskTemplates.*.bounds.type	string	Yes	breg evidence scheduling	None specified
taskTemplates.*.client	string	Yes	Not specified	None specified
taskTemplates.*.eligibleProfiles	array	Yes	Not specified	None specified
taskTemplates.*.eligibleProfiles[]Array item	string	No	Not specified	None specified
taskTemplates.*.eligibleTeams	array	Yes	Not specified	None specified
taskTemplates.*.eligibleTeams[]Array item	string	No	Not specified	None specified
taskTemplates.*.evidenceContextEvidence-only requester context signed into the authority assertion. Other products derive neither requester admission nor relying-party audience from these fields and therefore forbid the block entirely.	object	No	Not specified	None specified
taskTemplates.*.evidenceContext.audience	string	Yes	Not specified	None specified
taskTemplates.*.evidenceContext.requesterTags	array	Yes	Not specified	None specified
taskTemplates.*.evidenceContext.requesterTags[]Array item	string	No	Not specified	None specified
taskTemplates.*.labelHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
taskTemplates.*.lifetimeSeconds	integer	Yes	Not specified	format: uint64 maximum: 604800 minimum: 1 and, where a rule elsewhere applies maximum: 604800 or maximum: 900
taskTemplates.*.purpose	string	Yes	Not specified	None specified
taskTemplates.*.resource	string	Yes	Not specified	None specified
taskTemplates.*.reviewPoliciesPolicies whose currently held ReviewTasks may issue this grant.	array	No	Not specified	None specified
taskTemplates.*.reviewPolicies[]Array item	string	No	Not specified	None specified
taskTemplates.*.scopes	array	Yes	Not specified	None specified
taskTemplates.*.scopes[]Array item	string	No	Not specified	None specified
taskTemplates.*.source	string	Yes	Not specified	None specified
taskTemplates.*.subjectsExact token identity keys mapped to governed source logical fields. Values are extracted from the approving caller's disclosed source read.	object	Yes	Not specified	None specified
taskTemplates.*.subjects.*Map value	string	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
taskTemplates.*.version	string	Yes	Not specified	None specified
teams	object	No	Not specifiedSchema default, where declared: {}	None specified
teams.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
teams.*.labelHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
teams.*.memberProfiles	array	Yes	Not specified	None specified
teams.*.memberProfiles[]Array item	string	No	Not specified	None specified
teams.*.serves	array	Yes	Not specified	None specified
teams.*.serves[]Array item	string	No	Not specified	None specified
teams.*.supervisorProfiles	array	Yes	Not specified	None specified
teams.*.supervisorProfiles[]Array item	string	No	Not specified	None specified
trustedProducers	object	No	Not specifiedSchema default, where declared: {}	None specified
trustedProducers.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
trustedProducers.*.completion	object	No	Not specified	None specified
trustedProducers.*.completion.destinationId	string	Yes	Not specified	None specified
trustedProducers.*.completion.recipientBinding	string	Yes	Not specified	None specified
trustedProducers.*.initiatorProfileThe requester profile a person named as this producer's initiator authenticates with to read the requester-visible history of their own requests. Absent, no initiator reads anything.	string	No	Not specified	None specified
trustedProducers.*.issuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
trustedProducers.*.profile	string	Yes	Not specified	None specified
trustedProducers.*.retentionHow long Casework keeps what a producer needs to recover a submission.	object	Yes	Not specified	None specified
trustedProducers.*.retention.receiptRetentionDaysDays a submission receipt stays readable for recovery, at most 365.	integer	Yes	Not specified	format: uint32 maximum: 365 minimum: 1
trustedProducers.*.reviewPolicies	array	Yes	Not specified	None specified
trustedProducers.*.reviewPolicies[]Array item	string	No	Not specified	None specified
trustedProducers.*.sourceNamespaces	array	Yes	Not specified	None specified
trustedProducers.*.sourceNamespaces[]Array item	string	No	Not specified	None specified
trustedProducers.*.subject	string	Yes	Not specified	None specified
trustedProducers.*.trustedInitiatorIssuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	No	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$

fixtures/*.yaml

Source preview, pre-1.0

Generated from products/casework/generated/fixture/fixture.schema.json. 11 key paths. Explained in docs/site/src/content/docs/configure/casework.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/casework/fixture/v1alpha1	None specified
expect	object	Yes	Not specified	minProperties: 1
expect.outcomes	array	No	Not specified	minItems: 1 uniqueItems: true
expect.outcomes[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
expect.queueA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
kind	string	Yes	CaseworkFixture	None specified
review	object	Yes	Not specified	None specified
review.displayBusiness values remain JSON; the selected policy owns their schema.	object	Yes	Not specified	None specified
review.display.*Map value	Not specified	No	Not specified	None specified
review.policyA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$

dev-clients.yaml

Source preview, pre-1.0

Generated from products/casework/generated/dev-clients/dev-clients.schema.json. 50 key paths. Explained in docs/site/src/content/docs/configure/casework.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/casework/dev-clients/v1alpha1	None specified
clientsLocal teaching clients bound to access profiles casework.yaml declares.	array	Yes	Not specified	None specified
clients[]Array item	object	No	Not specified	None specified
clients[].accessProfileThe access profile this client binds. Several clients may share a profile.	string	Yes	Not specified	None specified
clients[].claimsAt most 32 token claims; registered access-token claims are reserved.	object	No	Not specified	None specified
clients[].claims.*Map value	string	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
clients[].idissuer is reserved for the local token issuer.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
clients[].scopes1 to 32 distinct RFC 6749 scope-tokens of at most 256 bytes.	array	Yes	Not specified	None specified
clients[].scopes[]Array item	string	No	Not specified	None specified
directoryThe teams the first start seeds, one for each queue.	array	No	Not specified	None specified
directory[]Array item	object	No	Not specified	None specified
directory[].queueThe queue this team serves; one team serves each queue.	string	Yes	Not specified	None specified
directory[].staff1 to 32 clients bound to a Staff profile.	array	Yes	Not specified	None specified
directory[].staff[]Array item	string	No	Not specified	None specified
directory[].supervisorsAt most 32 clients bound to a Supervisor profile.	array	No	Not specified	None specified
directory[].supervisors[]Array item	string	No	Not specified	None specified
directory[].teamA lowercase letter, then at most 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	None specified
integrationsSource-backed development: source bindings, service clients, and the local task authority.	object	No	Not specified	None specified
integrations.browserClientsInteractive OAuth clients explicitly admitted from a borrowed issuer.	array	No	Not specified	None specified
integrations.browserClients[]Array item	string	No	Not specified	None specified
integrations.contextProvidersOptional provider connections keyed by their declared deploymentRef.	object	No	Not specified	None specified
integrations.contextProviders.*Map valueEnvironment-specific transport and reader identity. Human display always replaces it.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
integrations.contextProviders.*.baseUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
integrations.contextProviders.*.clientAssertionAudience	string	No	Not specified	None specified
integrations.contextProviders.*.clientAssertionKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
integrations.contextProviders.*.clientIdRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
integrations.contextProviders.*.resource	string	No	Not specified	None specified
integrations.contextProviders.*.scopes	array	No	Not specified	None specified
integrations.contextProviders.*.scopes[]Array item	string	No	Not specified	None specified
integrations.contextProviders.*.statusProfile	string	Yes	Not specified	None specified
integrations.contextProviders.*.taskGrantProfile	string	No	Not specified	None specified
integrations.contextProviders.*.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
integrations.resourceAudience accepted by this Casework session.	string	Yes	Not specified	None specified
integrations.secretFilesOwner-only files copied into the retained private secret root.	object	No	Not specified	None specified
integrations.secretFiles.*Map value	string	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
integrations.serviceClients	array	No	Not specified	None specified
integrations.serviceClients[]Array item	object	No	Not specified	None specified
integrations.serviceClients[].claimsToken claims of at most 256 bytes each, written as text.	object	No	Not specified	None specified
integrations.serviceClients[].claims.*Map value	string	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
integrations.serviceClients[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
integrations.serviceClients[].resourceOmission means this Casework session's generated audience.	string	No	Not specified	None specified
integrations.serviceClients[].scopes	array	Yes	Not specified	None specified
integrations.serviceClients[].scopes[]Array item	string	No	Not specified	None specified
integrations.serviceClients[].taskExchange	boolean	No	Not specifiedSchema default, where declared: false	None specified
integrations.taskAuthority	object	No	Not specified	None specified
integrations.taskAuthority.issuerLogical issuer, independent of the local API transport URL; an https URL.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
integrations.taskAuthority.jwksPortPublic-key-only listener, reachable from the stock issuer container.	integer	Yes	Not specified	format: uint32 maximum: 65535 minimum: 1
integrations.taskAuthority.statusClients	object	Yes	Not specified	None specified
integrations.taskAuthority.statusClients.*Map value	string	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
kind	string	Yes	CaseworkDevClients	None specified

holiday-sets/*.yaml

Source preview, pre-1.0

Generated from products/casework/generated/holiday-set/holiday-set.schema.json. 6 key paths. Explained in docs/site/src/content/docs/configure/casework.mdx.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/casework/holiday-set/v1alpha1	None specified
datesThe dates that are not working days, at most 3660.	array	Yes	Not specified	maxItems: 3660 uniqueItems: true
dates[]Array item	string	No	Not specified	format: date pattern: ^[0-9]{4}-[0-9]{2}-[0-9]{2}$
holidaySetThe holiday set a calendar names in holidaySet.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
kind	string	Yes	CaseworkHolidaySet	None specified
revision	integer	Yes	Not specified	format: uint64 maximum: 9223372036854775807 minimum: 1

Next

Staff the directory