Evidence Gateway configuration reference
This generated reference lists the schema-visible key paths in the two frozen Version 1 configuration grammars and in the authoring form an adopter writes before a deployment project exists.
Each entry reports only what the schema itself proves: the value type, whether the key is required, the fixed values it accepts, the bounds it enforces, and the schema’s own description of what the key decides. Read an entry to confirm a key exists, spell the key correctly, and stay inside its accepted values.
Contract status
Section titled “Contract status”Two kinds of schema are published here, and they carry different promises. Every section on this page states which it is.
| Schema | Status | Source |
|---|---|---|
bundle/evidence.yaml, runtime.yaml | Frozen Version 1 contract | products/evidence/contracts/bundle.schema.yaml and products/evidence/contracts/runtime.schema.yaml |
questions/<name>.yaml, evidence-project.yaml | Adopter tooling, not frozen | crates/registry-evidencectl/schemas/authoring/*.schema.json |
- Status: current, pre-1.0
- Reference format:
1.2 - Generator:
npm run generateindocs/site - Coverage gate:
products/evidence/scripts/check-config-key-paths.sh
The two frozen schemas are the published and editor-facing grammar. At startup, typed YAML decoding and Rust validation decide whether a deployment is accepted. JSON Schema validators are parity tools in tests, not a second production acceptance path. This page never adds a rule of its own and does not inspect a deployment, live configuration, environment variables, or secret stores.
The authoring schemas are generated from the registry-evidence-authoring model that
evidencectl and the language server share, so an editor’s idea of the form and the command
line’s idea of the form come from one place. They sit outside the frozen Version 1 contract set
and may change with the tooling that generates them. A question document these schemas accept
still has to compile, and compiling is where the frozen contract applies.
The coverage gate holds every schema’s key paths in exact parity with the product reference that explains it, so a key cannot reach one artifact and quietly skip the others.
Schema shape and accepted projects
Section titled “Schema shape and accepted projects”The authoring schemas describe the JSON-compatible shape that an editor and parser can read.
They do not contain every field bound, cross-field rule, filename check, referenced-file check, or
compiled-bundle invariant. The shared form validator, evidencectl compiler, and real evidence
bundle check apply those additional gates in order.
For example, the question schema describes subjects as an array without an item-count bound.
Nine structurally valid subjects can pass JSON Schema validation, but the shared form validator
rejects the question because the accepted form allows only 1 through 8 subjects. The
Evidence authoring form reference documents
the complete project rules, including local secret posture, signing-key handling, and access
policies.
Notation
Section titled “Notation”A property is written name, an item of an array name[], and a value of a map name.*. A
recursive definition, currently only nested adapter parameter values, appears once at the point
it re-enters itself.
Where a key is reachable through several alternative shapes, the entry shows the union of the types and values those alternatives accept. Accepted values is therefore the set the grammar accepts somewhere, not in every case; where a rule elsewhere fixes the value under a condition, the entry says so beneath the set.
Required reads Conditional when whether you may or must write the key depends on the rest of the document: some alternative does not declare it at all, only some alternatives require it, or a rule elsewhere in the contract requires it once a condition holds. It may be mandatory in one shape and rejected in another. Required reads Yes whenever some part of the contract requires the key outright, including where the requirement is stated away from the place the key is declared, and a rule that only tightens a required key’s bounds does not soften that to Conditional.
Constraints are grouped per alternative and separated by or, because satisfying every printed bound at once can describe a value no alternative accepts. A group reading No bound is an alternative the grammar leaves unbounded, and it is printed rather than dropped so the bounds beside it are not read as holding in every case. The groups are the bound sets the grammar offers, not an enumeration of every combination; consult the configuration guide for how one key’s shape constrains another’s.
Bounds under where a rule elsewhere applies are a second, independent reading. They do not
replace the per-alternative constraints: a rule elsewhere in the contract tightens whichever
alternative you took, once its condition holds. So sources.*.baseUrl always matches one of its
two origin patterns, and a source authenticating with none must further match the narrower
loopback pattern listed under where a rule elsewhere applies.
bundle/evidence.yaml
Frozen Version 1 contract
Generated from products/evidence/contracts/bundle.schema.yaml. 327 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
acquisitionCapabilitiesGated acquisition kinds and source-call optimizations this bundle opts in to. The original Version 1 forms are absent from the vocabulary on purpose, because every bundle already had them; omission and an explicit empty list both enable nothing. | array | Conditional | Not specified |
and, where a rule elsewhere applies
|
acquisitionCapabilities[]Array itemOne gated acquisition kind or source-call optimization this bundle declares, which is the bundle half of a two-sided gate. A requirement using an absent kind is rejected at startup; an absent optimization is never selected. | string | No |
| None specified |
assuranceProfileDeclares the governed assurance boundary of the whole bundle, and the value is visible in every assertion, so an authentic local assertion never satisfies a relying procedure expecting a deployable profile. local is an authoring profile that lets a requirement omit fixtures and disables no other runtime boundary; the deployable profiles require every requirement to reference a fixture suite with complete coverage before the bundle loads. | string | Yes |
| None specified |
auditGoverns audit pseudonymization and the fail-closed policy for the whole deployment; runtime.yaml contributes only the storage location. | object | Yes | Not specified | None specified |
audit.failClosedHolds every audit gate closed, so an authorization refusal, access attempt, or disclosure release whose record cannot be durably written stops the response instead of being served unaudited. | boolean | Yes |
| None specified |
audit.formatFixes the audit record form to the keyed JSONL chain, whose sealed segments an operator replays out of band to prove retained history. | string | Yes |
| None specified |
audit.hashKeyVersionStamped into every audit pseudonym as its version prefix, so pseudonyms produced under different audit key material stay distinguishable within one chain. | integer | Yes | Not specified |
|
audit.hashSecretRefPoints at the file secret Rust separates into the audit chain and identifier subkeys; the same reference cannot also serve subjectBinding.secretRef. | string | Yes | Not specified |
|
authenticationVerification policy for inbound bearer tokens: the runtime validates each token against these values itself and ignores upstream identity headers. | object | Yes | Not specified | None specified |
authentication.actorClaimNames the verified claim read as the actor alongside the principal, and omitting the key enables no fallback actor source. | string | No | Not specified |
|
authentication.algorithmsCloses the set of signature algorithms accepted on an inbound access token, and no algorithm fallback outside the set is permitted. | array | Yes | Not specified |
|
authentication.algorithms[]Array itemOne signature algorithm the token verifier accepts on an inbound access token. | string | No |
| None specified |
authentication.allowedClientsExplicit machine-client admission, matched against the verified token's client_id/azp; never sub. Omitting the key keeps the issuer-vouched-client behavior. Audience plus static issuer-governed attributes alone cannot establish that a client was granted this resource's permission, which is what requiredScopes closes. | array | No | Not specified |
|
authentication.allowedClients[]Array itemOne client identifier admitted to call this deployment. | string | No | Not specified |
|
authentication.assertionIssuersPer-client assertion-authority admission for a token that carries the platform verifier's registry_assertion_issuer claim, keyed by the client identifier the token's client_id/azp names and naming the issuers that client may present the claim as. Omitting the key applies no rule, so every exchanged token is admitted regardless of the claim. A token that carries no such claim is never affected by this admission. | object | No | Not specified |
|
authentication.assertionIssuers.*Map valueThe issuers one client may present the registry_assertion_issuer claim as. | array | No | Not specifiedSchema default, where declared: |
|
authentication.assertionIssuers.*[]Array itemOne issuer URL the client may present the claim as. | string | No | Not specified |
|
authentication.audiencesExact allowlist of audience values an inbound access token must carry to be accepted. | array | Yes | Not specified |
|
authentication.audiences[]Array itemOne exact audience value an inbound access token may carry. | string | No | Not specified |
|
authentication.claimsOptional direct claim-name mapping for the shared contextual-authorization profile. Omission uses the registry_* names defined by the profile. Names remain direct JWT members even when they contain a dot. | object | No | Not specified | None specified |
authentication.claims.actorKind | string | No | Not specifiedSchema default, where declared: "registry_actor_kind" |
|
authentication.claims.approver | string | No | Not specifiedSchema default, where declared: "registry_approver" |
|
authentication.claims.grantBounds | string | No | Not specifiedSchema default, where declared: "registry_grant_bounds" |
|
authentication.claims.grantClient | string | No | Not specifiedSchema default, where declared: "registry_grant_client" |
|
authentication.claims.grantExp | string | No | Not specifiedSchema default, where declared: "registry_grant_exp" |
|
authentication.claims.grantId | string | No | Not specifiedSchema default, where declared: "registry_grant_id" |
|
authentication.claims.grantResource | string | No | Not specifiedSchema default, where declared: "registry_grant_resource" |
|
authentication.claims.grantSourceIssuer | string | No | Not specifiedSchema default, where declared: "registry_grant_source_issuer" |
|
authentication.claims.purpose | string | No | Not specifiedSchema default, where declared: "registry_purpose" |
|
authentication.evidenceAudienceClaimNames the verified claim that fixes the audience an assertion is issued to, and the public request cannot choose another audience. | string | Yes | Not specified |
|
authentication.issuerExact token issuer an inbound access token must declare, with path-based issuers supported; deployable bundles require HTTPS. | string | Yes | Not specified |
and, where a rule elsewhere applies
or
|
authentication.jwksUriFixed endpoint the verifier fetches issuer signing keys from; the endpoint may resolve to a public or private address, so DNS is pinned for each fetch, ambient proxies are disabled, and cloud-metadata destinations remain prohibited. | string | Yes | Not specified |
and, where a rule elsewhere applies
or
|
authentication.kindSelects the inbound credential model, and Version 1 defines exactly one such profile. | string | Yes |
| None specified |
authentication.maximumTokenLifetimeSecondsCaps the accepted exp - iat interval, and its presence requires iat and an exp greater than iat. | integer | Yes | Not specified |
|
authentication.principalClaimThe only claim read as the principal, whose absence denies the request; client_id, azp, request data, and proxy headers are not fallbacks. | string | Yes | Not specified |
|
authentication.requesterTagsClaimNames the verified claim whose tag list selects which authority profile can match the request. | string | Yes | Not specified |
|
authentication.requiredScopesScopes every inbound token must carry, read from the verified token's scope set after signature verification and before any authority claim is read. Omitting the key keeps the no-scope-gate behavior; a missing scope is never inferred from tags, principal, roles, sub, or request fields. | array | No | Not specified |
|
authentication.requiredScopes[]Array itemOne RFC 6749 scope-token every inbound token must carry. | string | No | Not specified |
|
authentication.revokedKeyIdsEmergency denylist of issuer key identifiers, checked before cached JWKS key selection so a compromised key is refused even while the cache still holds the key. | array | Yes | Not specified |
|
authentication.revokedKeyIds[]Array itemOne issuer key identifier the verifier refuses, whatever the cached JWKS still holds. | string | No | Not specified |
|
authentication.tokenTypesAllowlist of the exact typ value an inbound token's protected JWT header must declare. | array | Yes | Not specified |
|
authentication.tokenTypes[]Array itemOne exact protected-header typ value accepted on an inbound access token. | string | No |
| None specified |
authorityProfilesNamed authority profiles deciding which requester class may obtain which assertion. Exactly one authority path may match a request, and two paths covering the same requirement, purpose, and subject tuple deny that request rather than failing startup. | object | Yes | Not specified |
|
authorityProfiles.*Map valueEverything one requester class may ask for. Access is per requester class rather than per client identity, so two clients carrying the same tags have identical access. | object | No | Not specifiedSchema default, where declared: |
|
authorityProfiles.*.actorKindRestrict this authority profile to the verified actor kind. An agent without a task grant must use a profile explicitly bound to agent. | string | No |
| None specified |
authorityProfiles.*.grantSourceIssuerExact trusted issuer that supplied the immutable task-grant context before token exchange. Required when any subject uses authenticated-grant. | string | No | Not specified |
|
authorityProfiles.*.grantsComplete set of authorized paths this requester class has. Permissions are never unioned across grants, so one grant must cover an entire request on its own. | array | Yes | Not specified |
|
authorityProfiles.*.grants[]Array itemOne authorized path, binding a single requirement, a single purpose, the audience origin, and the referenced requirement's complete subject-role set. | object | No | Not specified | None specified |
authorityProfiles.*.grants[].audienceFromBinds the assertion audience to the requester's verified evidence audience claim, so the public request cannot name another audience. | string | Yes |
| None specified |
authorityProfiles.*.grants[].purposeThe one purpose this path authorizes, matched exactly against the request purpose; a purpose the referenced requirement does not declare fails startup. | string | Yes | Not specified |
|
authorityProfiles.*.grants[].requirementThe one requirement this path authorizes, named by its exact requirement URI; a requirement no bundle entry declares fails startup. | string | Yes | Not specified |
|
authorityProfiles.*.grants[].responseFormatsSerializations this path permits, defaulting to signed JWS alone when omitted. Unsigned and SD-JWT VC output each require both the bundle-level responseFormats and the one matched grant to permit them. | array | No | Not specified |
|
authorityProfiles.*.grants[].responseFormats[]Array itemOne permitted serialization of the same assertion, which introduces no separate issuance protocol and no credential state; a format reaches a response only when the bundle and the one matched grant both permit that format. | string | No |
| None specified |
authorityProfiles.*.grants[].subjectBindingModesSubject-binding modes this path permits, defaulting to audience-scoped alone when omitted or empty. Permitting a serialization is not permitting a binding mode: a path widened to sd-jwt-vc gains no right to issue holder-bound assertions until that mode is named here. A path may name holder-bound alone, which permits nothing else. | array | No | Not specified |
|
authorityProfiles.*.grants[].subjectBindingModes[]Array itemOne binding mode this path permits, which is the operator half of a two-sided gate; a requirement declaring a mode no grant for it permits is unreachable and is rejected at startup. | string | No |
| None specified |
authorityProfiles.*.grants[].subjectsAuthorization for the referenced requirement's complete subject-role set; a grant that omits a declared role, or repeats one, fails startup. | array | Yes | Not specified |
|
authorityProfiles.*.grants[].subjects[]Array itemAuthorization for one subject role, fixing which selector profile identifies the subject and where that subject's selector values may originate. | object | No | Not specified | None specified |
authorityProfiles.*.grants[].subjects[].roleNames the requirement subject role this authorization covers; a role the requirement's subjectRoles does not declare fails startup, and no role may appear twice in one grant. | string | Yes | Not specified |
|
authorityProfiles.*.grants[].subjects[].selectorProfileThe selector profile whose field set identifies this role's subject; a profile the requirement's subjectRoles entry does not permit for the role fails startup. | string | Yes | Not specified |
|
authorityProfiles.*.grants[].subjects[].valueClaimsMaps every field of the named selector profile to the claim path in the verified access token that supplies that field's value. Missing, extra, duplicate-target, or invalid claim paths fail startup. | object | Conditional | Not specified |
|
authorityProfiles.*.grants[].subjects[].valueClaims.*Map valueClaim path resolved only from the strictly verified access token, so a caller-supplied selector, grant reference, or approval value cannot supply the field. | string | No | Not specifiedSchema default, where declared: |
|
authorityProfiles.*.grants[].subjects[].valueOriginFixes where this role's selector values originate. A request origin takes values from the closed public request and prohibits valueClaims; authenticated-context rejects caller values and reads the exact valueClaims map; authenticated-grant reads that same map and additionally requires a verified grant whose trusted source issuer, requester client, purpose, and Evidence requirement bound match exactly one authority profile. | string | Yes |
| None specified |
authorityProfiles.*.kindDeclared basis of authority for this profile's grants; a request whose verified token carries an actor claim matches only a delegated profile. | string | Yes |
| None specified |
authorityProfiles.*.requesterClientsExact verified OAuth clients allowed to exercise this profile's authenticated-grant paths. Required and nonempty when any subject uses authenticated-grant. | array | No | Not specified |
|
authorityProfiles.*.requesterClients[]Array item | string | No | Not specified |
|
authorityProfiles.*.requesterTagsComplete tag set the claim named by authentication.requesterTagsClaim must contain for this profile to match, so adding a tag narrows the profile rather than widening it. | array | Yes | Not specified |
|
authorityProfiles.*.requesterTags[]Array itemOne tag that must be present in the verified claim; differentiated requirements, purposes, or valueClaims are expressed by issuing different tags rather than by naming individual clients. | string | No | Not specified |
|
holderBoundBatchMaxSizeCeiling on how many assertions one holder-bound release may carry. Omission means one, so a bundle written before batch release cannot serve a batch; declaring a ceiling this deployment never reaches enables nothing on its own, because each requirement still needs its own holder-bound declaration and a grant that permits the mode. | integer | No | Not specified |
|
issuerCarries the legal issuer identity placed in every assertion, kept separate from the technical provider that operates the process and signs. | object | Yes | Not specified | None specified |
issuer.idLegal issuer URI placed in every assertion as issuedBy, and governance must authorize the provider named in service.providerId to act for that issuer. | string | Yes | Not specified |
|
publicationOptional provider-authored public facts that cannot be derived from the governed service, issuer, response-format, binding-mode, and Evidence Type inventory. When present, the runtime publishes one deterministic closed Registry Discovery description. | object | No | Not specified | None specified |
publication.description | string | Yes | Not specified |
|
publication.endpointUrl | string | Yes | Not specified |
|
publication.jurisdictions | array | Yes | Not specified |
|
publication.jurisdictions[]Array item | string | No | Not specified |
|
publication.operatorId | string | No | Not specified |
|
publication.publisherId | string | No | Not specified |
|
publication.serviceId | string | Yes | Not specified |
|
publication.title | string | Yes | Not specified |
|
rateLimitsGoverns the anti-enumeration budget for authenticated callers, counted against scoped pseudonyms of the principal and the authority rather than against any raw selector value. | object | Yes | Not specified | None specified |
rateLimits.burstPerPrincipalCapacity of one principal's request bucket, bounding how many requests may arrive back to back before requestsPerPrincipalPerMinute governs the pace. | integer | Yes | Not specified |
|
rateLimits.failedSelectorAttemptsPerPrincipalAuthorityPerMinuteBudget for selector-resolution failures, checked before source access and consumed only when selector validation itself fails, so repeated probing is refused before it reaches a source. | integer | Yes | Not specified |
|
rateLimits.requestsPerPrincipalPerMinuteRate at which one principal's request budget refills, spread continuously across the minute rather than granted in full at its start. | integer | Yes | Not specified |
|
requirementsRequirement identifiers and Evidence Type URIs must each be unique across every entry; a repeat of either rejects the whole bundle at startup. | array | Yes | Not specified |
|
requirements[]Array itemOne independently versioned evidence definition; its configuration revision spans only this requirement's own configuration and artifact closure, letting a relying party pin this requirement without depending on the rest of the deployment. | object | No | Not specified | None specified |
requirements[].acquisitionFixes this requirement's complete source-request shape to one call over a single source, or to a fixed sequence of calls named here; no response content chooses a different source or an additional call. | object | Yes | Not specified | None specified |
requirements[].acquisition.fetchRead when acquisition.kind is search-then-fetch or search-then-fetch-set; the fixed second-stage source, or the ordered array of member sources, invoked after the search resolves and never chosen from response content. | array | string | Conditional | Not specified |
or
|
requirements[].acquisition.fetch[]Array itemOne declared fetch member of a search-then-fetch-set acquisition, called in the order the array declares and reached only after the search resolves to a unique schema-valid match. Members must be distinct from each other and from the search source. | object | Conditional | Not specified | None specified |
requirements[].acquisition.fetch[].factInputsAllowlist of validated search facts this member receives, and the only search-derived data reaching it through any channel, including the body its preparation builds. | array | Conditional | Not specified |
|
requirements[].acquisition.fetch[].factInputs[]Array itemOne search fact name this member is permitted to read, which the search source's fact schema must require or the bundle is rejected at startup. | string | Conditional | Not specified |
|
requirements[].acquisition.fetch[].sourceThe one configured source this member calls, fixed by the bundle like every other acquisition source. | string | Conditional | Not specified |
|
requirements[].acquisition.kindSelects this requirement's closed acquisition shape, and therefore how many fixed source calls the runtime issues; a gated kind serves only where the bundle and the deployment both name it under acquisitionCapabilities. | string | Yes |
| None specified |
requirements[].acquisition.maximumAcquisitionMillisecondsCeiling on the whole acquisition, covering the search, every declared member, and the transitions between stages; exceeding it fails the requirement as a dependency failure and never cancels a durable audit append. | integer | Conditional | Not specified |
|
requirements[].acquisition.searchRead when acquisition.kind is search-then-fetch or search-then-fetch-set; names the first-stage source, and the runtime aborts before the fetch stage unless this call resolves to exactly one match. | string | Conditional | Not specified |
|
requirements[].acquisition.sourceRead only when acquisition.kind is single; the one configured source this requirement queries in its single fixed call. | string | Conditional | Not specified |
|
requirements[].conceptsDeclares the complete, closed set of values this requirement's assertion may disclose; a value the derivation produces under an identifier absent from this list fails evaluation instead of being disclosed. | array | Yes | Not specified |
|
requirements[].concepts[]Array itemOne value the requirement may disclose, corresponding to exactly one cccev:InformationConcept, and becoming one entry of the assertion's supported values when the derivation produces that value. | object | No | Not specified | None specified |
requirements[].concepts[].constraintsClosed, form-specific bounds a derived value must satisfy before it is accepted into evidence; which keys apply is fixed entirely by the concept's form. | object | Conditional | Not specified |
or No bound |
requirements[].concepts[].constraints.bucketSchemeURI naming the reviewed bucket scheme for a date-bucket or time-bucket concept; paired with schemeVersion, bucketScheme resolves to exactly one codelist artifact, so only the matched bucket code is disclosed and the underlying date, instant, or duration never appears in the assertion. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.categorySchemeURI naming the reviewed category vocabulary a controlled-category concept's value must belong to; matched against schemeVersion and codelist at startup, it enforces exact category membership and rejects any unreviewed category. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.codelistBundle-relative path to the closed codelist artifact whose entries fix exact membership for controlled-code, controlled-category, and controlled-code-list concepts, validated at startup. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.codelistVersionVersion tag paired with codelist for controlled-code and controlled-code-list concepts that must exactly equal the referenced codelist artifact's own declared version, or the bundle fails to load. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.maximumInclusive upper bound paired with minimum for bounded-integer and bounded-decimal concepts; a derived value over it fails evaluation instead of being disclosed. | integer | string | Conditional | Not specified |
or
|
requirements[].concepts[].constraints.maximumBytesCaps the disclosed byte length of a controlled-code, controlled-category, or audience-scoped-entity-reference concept's value; a value or projected reference longer than the cap fails validation instead of being truncated. | integer | Conditional | Not specified |
or
|
requirements[].concepts[].constraints.maximumItemsInclusive upper bound paired with minimumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a longer derived list fails validation. | integer | Conditional | Not specified |
|
requirements[].concepts[].constraints.maximumScaleUpper bound on the number of fractional digits accepted for a bounded-decimal concept's derived value; a finer scale fails validation instead of being rounded. | integer | Conditional | Not specified |
|
requirements[].concepts[].constraints.maximumSerializedBytesCaps the serialized JSON byte length of a reviewed-structured-value concept's entire disclosed object; an oversized derived value fails validation before signing. | integer | Conditional | Not specified |
|
requirements[].concepts[].constraints.minimumInclusive lower bound paired with maximum for bounded-integer and bounded-decimal concepts; a derived value under it fails evaluation instead of being disclosed. | integer | string | Conditional | Not specified |
or
|
requirements[].concepts[].constraints.minimumBytes | integer | Conditional | Not specified |
|
requirements[].concepts[].constraints.minimumItemsInclusive lower bound paired with maximumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a shorter derived list fails validation. | integer | Conditional | Not specified |
|
requirements[].concepts[].constraints.prefixExact ASCII prefix ending in a dot, underscore, hyphen, colon, slash, or hash. It may contain only ASCII letters, digits, and those six separators. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.schemaURI resolving to exactly one closed JSON Schema artifact in the immutable bundle that a reviewed-structured-value concept's fields are validated against; the schema closes every property, so unexpected or additional JSON in the derived value fails validation. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.schemeVersionVersion tag that must exactly equal a referenced codelist artifact's own declared version at startup; pairs with categoryScheme for controlled-category concepts and with bucketScheme for date-bucket and time-bucket concepts. | string | Conditional | Not specified |
|
requirements[].concepts[].constraints.uniqueRequires every item in a controlled-code-list or entity-reference-list concept's disclosed list to be pairwise distinct; a duplicate item fails validation instead of being deduplicated or disclosed twice. | boolean | Conditional |
| None specified |
requirements[].concepts[].formSelects the concept's closed value shape, which fixes the exact set of keys constraints must declare and no others. | string | Yes |
| None specified |
requirements[].concepts[].handleStable application-facing key for this output in typed client result maps. It is governed explicitly and is never inferred from the concept URI. | string | Yes | Not specified |
|
requirements[].concepts[].idStable identifier that names this concept as providesValueFor in the assertion and, unless an sdJwtVc.claim override is declared, is also the concept's claim name in the SD-JWT VC serialization. | string | Yes | Not specified |
|
requirements[].concepts[].requiredWhether the derivation must produce a value for this concept; a missing required concept fails the whole evaluation, and a missing optional concept is left out of the disclosed supported values. | boolean | Yes | Not specified | None specified |
requirements[].concepts[].sdJwtVcOptional per-concept projection that the concept declaration may set only for reviewed-structured-value concepts, selecting how that structured value's fields are exposed as SD-JWT VC disclosures. | object | No | Not specified | None specified |
requirements[].concepts[].sdJwtVc.claimPublic claim name substituted for the concept identifier in the SD-JWT VC response; it must be unique within the requirement and cannot collide with a profile-owned claim. | string | Yes | Not specified |
|
requirements[].concepts[].sdJwtVc.disclosureFixes where the structured value's field-level disclosures are exposed in the SD-JWT VC claim set: as an always-visible top-level object under sdJwtVc.claim. | string | Yes |
| None specified |
requirements[].derivationDetermines which Rhai script computes the requirement's concept values as derive/3, and what minimized selector inputs and closed typed parameters that script is allowed to see. | object | Yes | Not specified | None specified |
requirements[].derivation.parametersClosed set of adopter-named parameter values available to the requirement's derivation; the map cannot carry secrets or runtime authority. | object | Yes | Not specified |
|
requirements[].derivation.parameters.*Map valueOne named parameter's value, closed to a bounded string, a safe integer, a boolean, one typed canonical decimal, or a bounded array of decimal bucket boundaries whose own bounds reuse that same typed-decimal shape. | array | boolean | integer | object | string | No | Not specified |
or
or No bound or
|
requirements[].derivation.parameters.*.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| None specified |
requirements[].derivation.parameters.*.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | Not specified |
|
requirements[].derivation.parameters.*[]Array itemOne decimal bucket boundary in an ordered array parameter, evaluated by the bucket_number primitive to classify a derived decimal into the matching boundary's code; each lower bound must equal the previous boundary's upper bound, and a gap fails validation at startup. | object | Conditional | Not specified | None specified |
requirements[].derivation.parameters.*[].codeOutput code returned when a derived decimal falls inside this boundary's interval; duplicate codes across the array fail validation at startup. | string | Conditional | Not specified |
|
requirements[].derivation.parameters.*[].maximumExclusiveExclusive upper bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value. | object | Conditional | Not specified | None specified |
requirements[].derivation.parameters.*[].maximumExclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| None specified |
requirements[].derivation.parameters.*[].maximumExclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | Not specified |
|
requirements[].derivation.parameters.*[].minimumInclusiveInclusive lower bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value. | object | Conditional | Not specified | None specified |
requirements[].derivation.parameters.*[].minimumInclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| None specified |
requirements[].derivation.parameters.*[].minimumInclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | Not specified |
|
requirements[].derivation.scriptBundle-relative Rhai script compiled at startup to expose the requirement's derive/3 entry point before the runtime reaches readiness. | string | Yes | Not specified |
|
requirements[].derivation.selectorInputsOptional closed set of authorized selector roles the derivation may read; omission means derive/3 receives an empty selector map. | array | No | Not specified |
|
requirements[].derivation.selectorInputs[]Array itemDeclares one subject role the derivation may read, together with the closed profile alternatives permitted for that role; only the alternative matching the authorized request subject reaches derive/3. | object | No | Not specified | None specified |
requirements[].derivation.selectorInputs[].alternativesClosed set of profile and field combinations permitted for the role; the runtime materializes only the combination the matched authority grant carries, never the union of every alternative declared. | array | Yes | Not specified |
|
requirements[].derivation.selectorInputs[].alternatives[]Array itemOne permitted selector profile paired with the exact field subset that alternative exposes. | object | No | Not specified | None specified |
requirements[].derivation.selectorInputs[].alternatives[].fieldsExact subset of the named profile's declared fields this alternative exposes, which is how a consumer is handed less than the authorized selector carries. | array | Yes | Not specified |
|
requirements[].derivation.selectorInputs[].alternatives[].fields[]Array itemOne selector field name, which the named profile must declare or the bundle is rejected at startup. | string | No | Not specified |
|
requirements[].derivation.selectorInputs[].alternatives[].profileSelector profile this alternative admits for the role; a profile absent from selectorProfiles is rejected at startup. | string | Yes | Not specified |
|
requirements[].derivation.selectorInputs[].roleSubject role this selector input covers, unique across the declaration; the runtime resolves request subjects by role rather than by array position. | string | Yes | Not specified |
|
requirements[].disclosureGuardBinds this requirement's release to the reviewed disclosure families a human combined-disclosure review has already assessed. | object | Yes | Not specified | None specified |
requirements[].disclosureGuard.familiesNon-empty set of those reviewed family URIs; sharing even one family with another enabled requirement rejects the whole bundle at startup. | array | Yes | Not specified |
|
requirements[].disclosureGuard.families[]Array itemOne reviewed disclosure-family URI; this exact value, not what it represents, is what the startup check compares for reuse across requirements. | string | No | Not specified |
|
requirements[].evidenceTypeExact Evidence Type URI placed in every assertion issued for this requirement; it must be unique across the bundle, and a duplicate rejects the bundle at startup. | string | Yes | Not specified |
|
requirements[].existenceDisclosureGoverns the outward shape of an unresolved outcome: the runtime returns one identical public problem whether the subject was absent, ambiguous, or found with inconsistent derivation inputs, so a caller cannot distinguish the cause from the response. | string | Yes |
| None specified |
requirements[].fixturesBundle-relative path to this requirement's sanitized fixture suite; omitting it is accepted only under assuranceProfile: local, and production or evidence-grade refuse to load without it and its complete case coverage. | string | Conditional | Not specified |
|
requirements[].handleStable application-facing identifier for selecting this requirement's complete published definition. It is governed explicitly and is never inferred from the requirement URI. | string | Yes | Not specified |
|
requirements[].idStable requirement URI a public request names to select this requirement; the runtime looks up requirements by this exact value and no other. | string | Yes | Not specified |
|
requirements[].kindRequirement classification carried unchanged into every assertion issued for this requirement. | string | Yes |
| None specified |
requirements[].observationTimezoneIANA timezone resolving legal_local_date and legal_local_time from the runtime-supplied observed_at instant; an unrecognized name fails validation, and omitting the field resolves both values in UTC instead. | string | No | Not specified |
|
requirements[].purposesClosed set of purpose codes this requirement can be requested under; an authority-profile grant must bind one of them together with a role and selector profile, or that combination has no authority path and the bundle fails to load. | array | Yes | Not specified |
|
requirements[].purposes[]Array itemOne purpose code eligible for this requirement; an authority-profile grant must name this exact code before a request under it is authorized. | string | No | Not specified |
|
requirements[].referenceFrameworksGoverned legal or procedural framework URIs carried as a whole into every assertion issued for this requirement. | array | Yes | Not specified |
|
requirements[].referenceFrameworks[]Array itemOne governed framework URI in that set, copied unchanged into the assertion alongside its siblings; the runtime does not select or rank among them. | string | No | Not specified |
|
requirements[].subjectBindingWhat this requirement's subject bindings are derived under; omission means audience-scoped, which is what every requirement written before this key existed did. A holder-bound requirement is rejected at startup unless the bundle and at least one grant for it both permit a serialization the mode allows, which is sd-jwt-vc or sd-jwt-vc-batch, and unless none of its concepts uses an entity-reference value form, whose pointer only the audience it was scoped to could resolve. | string | No |
| None specified |
requirements[].subjectRolesComplete set of subject positions this requirement resolves; incoming request array order carries no meaning, and resolved subjects are always canonicalized to this array's declaration order before signing. | array | Yes | Not specified |
|
requirements[].subjectRoles[]Array itemOne subject position this requirement resolves; a request supplying a different number of subjects, a duplicate role, or a role this requirement does not declare is unauthorized. | object | No | Not specified | None specified |
requirements[].subjectRoles[].cardinalityFixes this subject position to a single resolved value; Evidence Version 1 defines no plural or list-valued role. | string | Yes |
| None specified |
requirements[].subjectRoles[].roleDeployment-chosen identifier distinguishing this subject position from the requirement's others; requests, grants, and derivation inputs all address the position by this exact value, never by array position. | string | Yes | Not specified |
|
requirements[].subjectRoles[].selectorProfilesSelector profiles permitted for this subject position; every one of them must be reachable by some authority-profile grant for every code in purposes, or the bundle fails to load. | array | Yes | Not specified |
|
requirements[].subjectRoles[].selectorProfiles[]Array itemOne selector profile id permitted for this position; it must name an entry in the bundle's selectorProfiles map, or the bundle fails to load. | string | No | Not specified |
|
requirements[].validitySecondsSets the assertion's validity window measured from issuedAt; the bundle fails to load if this exceeds signing.maximumAssertionValiditySeconds. | integer | Yes | Not specified |
|
responseFormatsSets the deployment-wide ceiling of response serializations, and omission means [signed-jws]. A bundle that drops signed JWS is rejected at startup, and every other listed format additionally requires the one matched grant's authorityProfiles.*.grants[].responseFormats to permit that format. | array | No | Not specified |
|
responseFormats[]Array itemOne permitted serialization of the same assertion, which introduces no separate issuance protocol and no credential state; a format reaches a response only when the bundle and the one matched grant both permit that format. | string | No |
| None specified |
selectorProfilesNamed registry of selector profiles that requirement subject roles and authority-grant subjects reference by id; an id absent from the map fails validation before startup. | object | Yes | Not specified |
|
selectorProfiles.*Map valueOne named, closed profile of deployment-defined fields and their combined byte bound; a profile is not an identity type, and possession of its field values does not by itself grant authority. | object | No | Not specifiedSchema default, where declared: |
|
selectorProfiles.*.fieldsClosed map of the profile's field declarations, keyed by adopter-chosen names that are opaque to Rust and carry no meaning of their own. | object | Yes | Not specified |
|
selectorProfiles.*.fields.*Map valueOne field's exact declaration: Rust matches a supplied value against it verbatim, performing no case folding, normalization, transliteration, tokenization, partial-date matching, or fuzzy scoring. | object | No | Not specifiedSchema default, where declared: |
|
selectorProfiles.*.fields.*.codelistPath to the bundled codelist artifact a controlled-code value must belong to; a missing referenced artifact fails bundle loading. | string | Conditional | Not specified |
|
selectorProfiles.*.fields.*.codelistVersionVersion this field's controlled-code values are pinned to; it must equal the referenced codelist artifact's own version or bundle loading fails. | string | Conditional | Not specified |
|
selectorProfiles.*.fields.*.maximumInclusive upper bound on this field's accepted integer selector value; a submitted value greater than this bound is rejected rather than clamped. | integer | Conditional | Not specified |
|
selectorProfiles.*.fields.*.maximumBytesInclusive upper bound, in UTF-8 bytes, on this field's accepted string or controlled-code value; it cannot exceed the profile's maximumAggregateBytes. | integer | Conditional | Not specified |
|
selectorProfiles.*.fields.*.minimumInclusive lower bound on this field's accepted integer selector value; a submitted value less than this bound is rejected rather than clamped. | integer | Conditional | Not specified |
|
selectorProfiles.*.fields.*.minimumBytesInclusive lower bound, in UTF-8 bytes, on this field's accepted string value; it cannot exceed the field's own maximumBytes. | integer | Conditional | Not specified |
|
selectorProfiles.*.fields.*.typeSelects the field's scalar kind, fixing which other declaration keys are required; a supplied value of a different kind is rejected. | string | Yes |
| None specified |
selectorProfiles.*.maximumAggregateBytesCaps the summed canonical byte size of every field value resolved for one authorized use of the profile; exceeding it denies the request. | integer | Yes | Not specified |
|
serviceCarries the identity this deployment asserts under: the technical Evidence provider identity placed in evidence and the operator-controlled trust domain of the process. | object | Yes | Not specified | None specified |
service.providerIdTechnical provider URI placed in every assertion as providedBy. Enabling sd-jwt-vc outside local assurance requires this value to be the stable HTTPS origin of the deployment, because issuer metadata and the published JWKS URI are derived from that origin. | string | Yes | Not specified |
and, where a rule elsewhere applies
|
service.publicOriginExact public origin of this Evidence protected resource. Production and evidence-grade deployments require a canonical HTTPS origin. The local assurance profile also permits canonical HTTP on numeric 127.0.0.1 with an explicit non-zero port for supervised tutorials. | string | Yes | Not specified |
|
service.trustDomainScopes the process to one operator-controlled trust domain, whose URI is bound into subject bindings and into requester pseudonym scope, so the same subject yields different pseudonyms under a different trust domain. | string | Yes | Not specified |
|
signingGoverns signature format, active and published key selection, key retirement, and assertion validity; missing signing material fails readiness and no unsigned fallback exists. | object | Yes | Not specified | None specified |
signing.activePublicJwkFileNames the bundle-held public JWK the runtime signer's key must equal exactly, proven by one sign-and-verify test before readiness. | string | Yes | Not specified |
|
signing.algorithmBinds assertion signatures to ES256 over P-256, and a verifier rejects any protected header alg that differs from the algorithm bound to the trusted key. | string | Yes |
| None specified |
signing.formatFixes the wire serialization of a signed assertion to flattened JWS JSON, returned as application/jose+json. | string | Yes |
| None specified |
signing.jwksPathRoute where the deployment serves its public key set; that route is not a trust anchor, because a verifier pins the provider identity and key location through its own governed configuration. | string | Yes |
| None specified |
signing.maximumAssertionValiditySecondsCeiling every requirements[].validitySeconds must stay within, and the base of the window a retired public key stays published. | integer | Yes | Not specified |
|
signing.publishedPublicJwkFilesRetains predecessor public keys in the served key set so assertions signed before a rollover still verify, for at least the maximum assertion validity plus the verifier clock skew. | array | Yes | Not specified |
|
signing.publishedPublicJwkFiles[]Array itemOne retained public key served beside the active key; an entry that repeats the active key or names a revoked identifier is rejected at startup. | string | No | Not specified |
|
signing.revokedKeyIdsEmergency denylist: a listed identifier is excluded from the active set, the published set, and the served key set, and a verifier rejects that identifier before selecting a pinned public key. | array | Yes | Not specified |
|
signing.revokedKeyIds[]Array itemOne denied service key, named by its RFC 7638 thumbprint rather than by a provider-assigned key name. | string | No | Not specified |
|
signing.verifierClockSkewSecondsSkew a relying party applies when checking current validity, and the margin added to the maximum assertion validity before a retired public key may be removed. | integer | Yes | Not specified |
|
sourceConnectionsOptional explicit process-local owners of HTTP destination, workload authentication, TLS trust and aggregate resource limits. Authored connection references are resolved at build time; startup requires every concrete source value to equal its named owner. Independent connection names are never deduplicated using secret bytes. | object | No | Not specified |
|
sourceConnections.*Map value | object | No | Not specifiedSchema default, where declared: |
|
sourceConnections.*.admissionTimeoutMillisecondsMaximum bounded wait for aggregate admission or OAuth single-flight refresh. | integer | No | Not specifiedSchema default, where declared: 5000 |
|
sourceConnections.*.authenticationComplete existing source authentication union, including both OAuth audiences. | object | Yes | Not specified | None specified |
sourceConnections.*.authentication.assumedLifetimeSecondsLifetime credited to an acquired token whose response omits expires_in, rather than inferring one from the token. Without this key such a response is a credential failure, and the cached lifetime is still clamped to maximumCacheSeconds. | integer | Conditional | Not specified |
|
sourceConnections.*.authentication.audienceFixed audience form parameter sent with the token request, for an authorization server that keys the issued token to an audience the scope cannot express and returns an unusable token without it. Sent as it stands with no fallback, so a blank value is refused here rather than by the authorization server at readiness. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.clientAssertionAudienceFixed aud claim of the signed client assertion, for an authorization server that expects an identifier it is not reached at, such as its issuer or a host in front of a proxy. Declared only beside clientAssertionKeyRef, and defaulting to tokenEndpoint. RFC 7523 section 3 has the server compare this by Simple String Comparison, so it is an opaque identifier rather than a URL and is signed byte for byte. It names who may accept the assertion, never where it is sent. A blank value is refused here rather than at the first token request, where signing rejects a whitespace-only audience as empty. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.clientAssertionKeyRefLogical file-secret reference for the private JWK the runtime signs an RFC 7523 section 2.2 client assertion with, which is the client authentication SMART on FHIR Backend Services requires. The assertion is audienced to clientAssertionAudience, or to tokenEndpoint when the bundle names none, and lives 60 seconds; no private key leaves the process. | string | Conditional | Not specified | No bound or
|
sourceConnections.*.authentication.clientIdRefLogical file-secret reference for the client identifier the runtime presents in the client-credentials exchange at tokenEndpoint. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.clientSecretRefLogical file-secret reference for the client secret the runtime presents at tokenEndpoint; the token URL, body, response, and debug output stay redacted, so the resolved value reaches no log. Declared with credentialPlacement and never beside clientAssertionKeyRef. | string | Conditional | Not specified | No bound or
|
sourceConnections.*.authentication.credentialPlacementSelects whether the client identifier and secret travel in the Authorization header or the form body of the token request; Version 1 offers no query-string placement, so neither value can reach an authorization-server, proxy, or ingress URL log. Declared with clientSecretRef and never beside clientAssertionKeyRef, whose assertion always travels in the form body. | string | Conditional |
| None specified |
sourceConnections.*.authentication.headerNameNames the header carrying this source's API-key value. The name is validated as an HTTP field name and rejected when it collides with authentication, routing, framing, cookie, forwarding, proxy, tracing, or hop-by-hop headers. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.kindSelects which credential the runtime presents to this source and closes the member set to that profile. none sends no credential and is admitted only by a local assurance bundle at a canonical numeric-loopback origin; production and evidence-grade bundles reject that kind. | string | Yes |
| None specified |
sourceConnections.*.authentication.maximumCacheSecondsBounds how long one acquired token is reused across evidence requests for this source; the cache lifetime is the smaller of this bound and the provider's reported expiry. | integer | Conditional | Not specified |
|
sourceConnections.*.authentication.passwordRefLogical file-secret reference for the password half of the HTTP Basic credential the runtime encodes into the Authorization header of every request to this source. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.resourceOptional RFC 8707 resource indicator sent as a token-request form parameter. It is one governed absolute URI without a fragment or user information and is transmitted exactly as configured. It names the intended resource server; it does not retarget the token endpoint or replace the separate audience parameter or signed client assertion audience. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.schemeAuthentication scheme the token is presented under; absent, the runtime sends Bearer. RFC 9110 section 11.1 makes the scheme an HTTP token chosen by the origin, and static-api-key cannot serve a source that wants another one because it refuses the Authorization header by name. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.scopeFixed scope requested in the client-credentials exchange; a token response reporting a scope other than this one is a credential failure. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.tokenEndpointFixed endpoint the runtime exchanges client credentials at before calling this source; the exchange is credential bootstrap, never an evidence-data request or a fact source. | string | Conditional | Not specified | No bound or
or
|
sourceConnections.*.authentication.tokenRefLogical file-secret reference for the static token the runtime places in the Authorization header of every request to this source. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.usernameRefLogical file-secret reference for the user name half of the HTTP Basic credential the runtime presents to this source. | string | Conditional | Not specified |
|
sourceConnections.*.authentication.valueRefLogical file-secret reference for the API-key value the runtime places in headerName; the resolved value is bounded and rejects control characters, CR, and LF. | string | Conditional | Not specified |
|
sourceConnections.*.baseUrlFixed source origin the runtime constrains exactly as it constrains an inline HTTP source: a canonical host, no user information, path, query or fragment, and a port inside the range a port can hold. When authentication.kind is none the origin narrows further, to one exact numeric-loopback HTTP spelling carrying an explicit in-range port. | string | Yes | Not specified |
or
and, where a rule elsewhere applies
|
sourceConnections.*.concurrencyLimitAggregate occupied source calls for this explicit connection in one process. | integer | No | Not specifiedSchema default, where declared: 4 |
|
sourceConnections.*.tlsTrustProfileLogical additive private-CA profile bound by the runtime document. It is rejected outright when authentication.kind is none. | string | No | Not specified |
|
sourceConnections.*.tokenTimeoutMillisecondsMaximum total duration of one OAuth token request and response body. | integer | No | Not specifiedSchema default, where declared: 5000 |
|
sourcesComplete map of fixed sources a requirement can reference by id in its acquisition field, fixed at startup and immune to override by runtime.yaml. | object | Yes | Not specified |
|
sources.*Map valueOne fixed source referenced by this map key from a requirement's acquisition field, combining a transport, the fixed request that transport carries, and a minimization posture with the extraction script and schemas that turn the source's response into facts. | object | No | Not specifiedSchema default, where declared: |
|
sources.*.authenticationOne closed credential profile the runtime presents on this source's outbound calls, distinct from the inbound caller policy at the bundle's top-level authentication. Reference members name secrets that resolve only after authorization, durable access audit, and request-parts validation, and no secret reaches a script. | object | Conditional | Not specified | None specified |
sources.*.authentication.assumedLifetimeSecondsLifetime credited to an acquired token whose response omits expires_in, rather than inferring one from the token. Without this key such a response is a credential failure, and the cached lifetime is still clamped to maximumCacheSeconds. | integer | Conditional | Not specified |
|
sources.*.authentication.audienceFixed audience form parameter sent with the token request, for an authorization server that keys the issued token to an audience the scope cannot express and returns an unusable token without it. Sent as it stands with no fallback, so a blank value is refused here rather than by the authorization server at readiness. | string | Conditional | Not specified |
|
sources.*.authentication.clientAssertionAudienceFixed aud claim of the signed client assertion, for an authorization server that expects an identifier it is not reached at, such as its issuer or a host in front of a proxy. Declared only beside clientAssertionKeyRef, and defaulting to tokenEndpoint. RFC 7523 section 3 has the server compare this by Simple String Comparison, so it is an opaque identifier rather than a URL and is signed byte for byte. It names who may accept the assertion, never where it is sent. A blank value is refused here rather than at the first token request, where signing rejects a whitespace-only audience as empty. | string | Conditional | Not specified |
|
sources.*.authentication.clientAssertionKeyRefLogical file-secret reference for the private JWK the runtime signs an RFC 7523 section 2.2 client assertion with, which is the client authentication SMART on FHIR Backend Services requires. The assertion is audienced to clientAssertionAudience, or to tokenEndpoint when the bundle names none, and lives 60 seconds; no private key leaves the process. | string | Conditional | Not specified | No bound or
|
sources.*.authentication.clientIdRefLogical file-secret reference for the client identifier the runtime presents in the client-credentials exchange at tokenEndpoint. | string | Conditional | Not specified |
|
sources.*.authentication.clientSecretRefLogical file-secret reference for the client secret the runtime presents at tokenEndpoint; the token URL, body, response, and debug output stay redacted, so the resolved value reaches no log. Declared with credentialPlacement and never beside clientAssertionKeyRef. | string | Conditional | Not specified | No bound or
|
sources.*.authentication.credentialPlacementSelects whether the client identifier and secret travel in the Authorization header or the form body of the token request; Version 1 offers no query-string placement, so neither value can reach an authorization-server, proxy, or ingress URL log. Declared with clientSecretRef and never beside clientAssertionKeyRef, whose assertion always travels in the form body. | string | Conditional |
| None specified |
sources.*.authentication.headerNameNames the header carrying this source's API-key value. The name is validated as an HTTP field name and rejected when it collides with authentication, routing, framing, cookie, forwarding, proxy, tracing, or hop-by-hop headers. | string | Conditional | Not specified |
|
sources.*.authentication.kindSelects which credential the runtime presents to this source and closes the member set to that profile. none sends no credential and is admitted only by a local assurance bundle at a canonical numeric-loopback origin; production and evidence-grade bundles reject that kind. | string | Conditional |
| None specified |
sources.*.authentication.maximumCacheSecondsBounds how long one acquired token is reused across evidence requests for this source; the cache lifetime is the smaller of this bound and the provider's reported expiry. | integer | Conditional | Not specified |
|
sources.*.authentication.passwordRefLogical file-secret reference for the password half of the HTTP Basic credential the runtime encodes into the Authorization header of every request to this source. | string | Conditional | Not specified |
|
sources.*.authentication.resourceOptional RFC 8707 resource indicator sent as a token-request form parameter. It is one governed absolute URI without a fragment or user information and is transmitted exactly as configured. It names the intended resource server; it does not retarget the token endpoint or replace the separate audience parameter or signed client assertion audience. | string | Conditional | Not specified |
|
sources.*.authentication.schemeAuthentication scheme the token is presented under; absent, the runtime sends Bearer. RFC 9110 section 11.1 makes the scheme an HTTP token chosen by the origin, and static-api-key cannot serve a source that wants another one because it refuses the Authorization header by name. | string | Conditional | Not specified |
|
sources.*.authentication.scopeFixed scope requested in the client-credentials exchange; a token response reporting a scope other than this one is a credential failure. | string | Conditional | Not specified |
|
sources.*.authentication.tokenEndpointFixed endpoint the runtime exchanges client credentials at before calling this source; the exchange is credential bootstrap, never an evidence-data request or a fact source. | string | Conditional | Not specified | No bound or
or
|
sources.*.authentication.tokenRefLogical file-secret reference for the static token the runtime places in the Authorization header of every request to this source. | string | Conditional | Not specified |
|
sources.*.authentication.usernameRefLogical file-secret reference for the user name half of the HTTP Basic credential the runtime presents to this source. | string | Conditional | Not specified |
|
sources.*.authentication.valueRefLogical file-secret reference for the API-key value the runtime places in headerName; the resolved value is bounded and rejects control characters, CR, and LF. | string | Conditional | Not specified |
|
sources.*.baseUrlFixed HTTPS origin the source's evidence-data requests target, with no path, query, fragment, user information, or runtime substitution. An HTTP numeric-loopback origin is accepted only when sources.*.authentication.kind is none. | string | Conditional | Not specified | No bound or
or
and, where a rule elsewhere applies
|
sources.*.batchOptional reviewed one-call optimization for the public multi-subject request batch. It is eligible only for a single acquisition using this HTTP source's fixed path, when the complete item set fits maximumItems, and when both bundle and runtime name source-batch under acquisitionCapabilities. Omission selects ordinary sequential execution. The block cannot change source, method, origin, path, authentication, headers, TLS, redirect, timeout, response-byte, concurrency, or preparation-limit authority. | object | Conditional | Not specified | None specified |
sources.*.batch.extractScriptBundle-relative Rhai script implementing extract_batch/2 over the projected, schema-validated response. Rust requires one closed lookup result for every opaque slot and rejects missing, duplicated, extra, negative, or out-of-range slots. | string | Conditional | Not specified |
|
sources.*.batch.maximumItemsLargest complete logical request batch this source accepts in one physical call. A larger outer batch uses sequential execution from the start and is never split into optimized sub-batches. | integer | Conditional | Not specified |
|
sources.*.batch.prepareScriptBundle-relative Rhai script implementing prepare_batch/2 over ordered opaque slots and minimized selectors. Its RequestParts output is checked under the ordinary source request's preparationLimits before credentials are resolved. | string | Conditional | Not specified |
|
sources.*.batch.projectionAllowlist of response leaves Rust retains for optimized batch extraction under the same extended JSON Pointer and projected-input bounds as ordinary extraction. | array | Conditional | Not specified |
|
sources.*.batch.projection[]Array item | string | Conditional | Not specified |
|
sources.*.batch.responseSchemaBundle-relative closed JSON Schema the batch projection must satisfy before extract_batch/2 runs. It governs only the optional optimized response and does not replace the ordinary source responseSchema used by sequential execution. | string | Conditional | Not specified |
|
sources.*.behaviorRevisionOptional digest of the provider's selected read behavior. It is a reached source dependency; unrelated export provenance stays outside requirement revisions. | string | Conditional | Not specified |
|
sources.*.connectionOptional explicit sourceConnections owner. Startup rejects differing resolved baseUrl, authentication, tlsTrustProfile or request.concurrencyLimit values. | string | Conditional | Not specified |
|
sources.*.extractProfileLogical name resolved to an exact extract file bound in runtime.yaml under sourceExtracts. The bundle never names a filesystem location, and startup refuses a profile no runtime binds as well as a bound profile no source reads. | string | Conditional | Not specified |
|
sources.*.extractScriptFor http-json: Bundle-relative Rhai script whose two-parameter extract function maps the schema-validated projected response and adapter context to a match, no-match, or ambiguous outcome. The script never selects a candidate among multiple records and never turns protocol inconsistency into a closed lookup outcome. For sqlite-extract: Bundle-relative Rhai script whose two-parameter extract function maps the schema-validated projected result and adapter context to a match, no-match, or ambiguous outcome. The script never selects a candidate among multiple rows and never turns protocol inconsistency into a closed lookup outcome. | string | Yes | Not specified |
|
sources.*.factSchemaFor http-json: Bundle-relative closed JSON Schema the extraction script's output facts must exactly satisfy on a match outcome. Unlike sources.*.responseSchema, this schema validates what the script returns, not what the source sent. For sqlite-extract: Bundle-relative closed JSON Schema the extraction script's output facts must exactly satisfy on a match outcome. Unlike sources.*.responseSchema, this schema validates what the script returns, not what the statement returned. | string | Yes | Not specified |
|
sources.*.maximumExtractAgeSecondsBounds how far the extract's published instant may lag the evaluation instant before the request fails as stale. Staleness tolerance belongs to the bundle because it is a property of the concept being asserted rather than of the deployment, and the runtime reads the published instant from the extract's reserved metadata table, never from the file's modification time. | integer | Conditional | Not specified |
|
sources.*.postureFor http-json: Describes how much of the underlying record crosses the source wire, weakest at record-transformed and strongest at source-derived. A chained search-then-fetch requirement can claim no stronger minimization than the weaker of its two sources' postures. For sqlite-extract: Describes how much of the underlying record crosses the source boundary, weakest at record-transformed and strongest at source-derived. A statement that aggregates in SQL claims source-derived honestly, because only the aggregate leaves the statement. | string | Yes |
| None specified |
sources.*.requestFor http-json: The one fixed evidence-data request plan for this source; a preparation script, a caller, and a source response hold no authority over method, path, headers, redirects, bounds, or request count. For sqlite-extract: The one fixed statement plan for this source; a preparation script, a caller, and the extract itself hold no authority over the statement text, the declared columns, the parameters, or the bounds. | object | Yes | Not specified | None specified |
sources.*.request.adapterParametersFor http-json: Closed non-secret constants supplied to both the preparation and the extraction script, rejected at bundle load when they fall outside adapterParametersSchema. For sqlite-extract: Closed non-secret constants supplied to the extraction script, and to the preparation script when one is declared, rejected at bundle load when they fall outside adapterParametersSchema. | object | Conditional | Not specified |
|
sources.*.request.adapterParameters.*Map valueFor http-json: One constant read by both the preparation and the extraction script, which may itself nest further parameter values. For sqlite-extract: One constant read by the scripts, which may itself nest further parameter values. | array | boolean | integer | object | string | No | Not specifiedSchema default, where declared: |
or No bound or
or
or
or
|
sources.*.request.adapterParameters.*.*Map valueOne member of a parameter object, which is a parameter value in turn, so the parameter shape nests rather than flattening. | Not specified | Conditional | Not specifiedSchema default, where declared: |
|
sources.*.request.adapterParameters.*[]Array itemOne element of a parameter array, which is a parameter value in turn, so the parameter shape nests rather than flattening. | Not specified | Conditional | Not specified | None specified |
sources.*.request.adapterParametersSchemaFor http-json: Bundle-relative closed JSON Schema for the parameter set, whose required-equals-properties rule turns an undeclared or missing parameter into a startup failure. For sqlite-extract: Bundle-relative closed JSON Schema for the parameter set, whose required-equals-properties rule turns an undeclared or missing parameter into a startup failure. A non-empty adapterParameters without it fails startup. | string | Conditional | Not specified |
|
sources.*.request.columnsCloses the result shape by naming every column the statement returns and the type each carries, in order. A result whose column count, names, or value types differ fails as a source-protocol error, so a statement edited without its declaration cannot silently change what the extraction script sees. | array | Conditional | Not specified |
|
sources.*.request.columns[]Array itemOne declared result column, whose name is unique across the declaration and opaque to Rust. | object | Conditional | Not specified | None specified |
sources.*.request.columns[].nameName this column carries into the result object, unique across the declaration and opaque to Rust; it need not equal the column's name in the extract. | string | Conditional | Not specified |
|
sources.*.request.columns[].typeExact value type Rust admits for this column. A null is admitted for any declared type, and any other mismatch fails as a source-protocol error rather than being coerced. | string | Conditional |
| None specified |
sources.*.request.concurrencyLimitFor http-json: Bounds how many evaluations may hold an outbound request to this source at once, and waiting for that admission is bounded by timeoutMilliseconds. For sqlite-extract: Bounds how many evaluations may hold a statement against this extract at once, and waiting for that admission is bounded by timeoutMilliseconds. | integer | Yes | Not specified |
|
sources.*.request.fixedHeadersOrdered non-secret header constants sent on every request to this source; a script cannot add, remove, or change a header. | array | Conditional | Not specified |
|
sources.*.request.fixedHeaders[]Array itemOne constant name and value pair added to every request to this source, in the order declared. | object | Conditional | Not specified | None specified |
sources.*.request.fixedHeaders[].nameHeader field name, rejected at startup when it falls in the authentication, host and routing, cookie, body framing, content length or type, connection, forwarding, proxy, or tracing families Rust owns. | string | Conditional | Not specified |
|
sources.*.request.fixedHeaders[].valueConstant value sent verbatim, with any control character rejected at startup, which closes header injection through configuration. | string | Conditional | Not specified |
|
sources.*.request.maximumCellBytesCaps one returned value, so a single oversized cell fails the request rather than entering the response. A cell far past this bound is refused by the engine, on the length recorded beside it, before its content is read at all. | integer | Conditional | Not specified |
|
sources.*.request.maximumResponseBytesFor http-json: Caps the response body read from this source before parsing and projection, so an oversized response fails as a transport failure rather than being parsed. For sqlite-extract: Caps the assembled result before projection, so an oversized result fails rather than being projected. | integer | Yes | Not specified |
|
sources.*.request.maximumRowsCaps the rows the statement may return before the request fails, so a statement that matches more broadly than intended fails rather than moving a bulk result into the runtime. | integer | Conditional | Not specified |
|
sources.*.request.maximumStatementStepsCaps the virtual-machine steps the statement may take, which bounds work the wall clock does not: a scan that is slow because it is large is stopped by this bound rather than by the timeout. | integer | Conditional | Not specified |
|
sources.*.request.methodFixes the HTTP method for every request to this source; a GET source must also set preparationLimits.jsonBody to forbidden. | string | Conditional |
| None specified |
sources.*.request.parameterBindingsStates where each named statement parameter's value comes from, so no value reaches the statement by string substitution. A parameter has one origin and exactly one: a selector parameter is filled from the authorized selector field it names and from nothing else, and a prepared parameter is filled by the preparation script and by nothing else. A parameter the statement uses and no binding supplies fails the request, as does a binding the statement never names. The reserved name evidence_now may not be bound, because Rust binds it. | object | Conditional | Not specified |
|
sources.*.request.parameterBindings.*Map valueOne parameter's tagged binding, filling exactly one named statement parameter from a value Rust has already validated. | object | Conditional | Not specifiedSchema default, where declared: |
or No bound |
sources.*.request.parameterBindings.*.fieldExact field of that profile whose resolved value Rust binds to the parameter. | string | Conditional | Not specified |
|
sources.*.request.parameterBindings.*.kindFor selector: Selects the binding origin. This parameter is filled from the authorized selector field named below and from nothing else, so the preparation script cannot stand in for it. For prepared: Selects the binding origin. This parameter is filled by the preparation script and by nothing else, which is how a value no selector holds, such as a normalized reference or a derived bound, reaches the statement. It names no selector, because naming one would give the parameter a second origin, and the request fails if the script returns no value for it. | string | Conditional |
| None specified |
sources.*.request.parameterBindings.*.profileSelector profile the value is taken from, which must be an alternative that role declares. | string | Conditional | Not specified |
|
sources.*.request.parameterBindings.*.roleSubject role the value is taken from, which must be one the request's selectorInputs declares. | string | Conditional | Not specified |
|
sources.*.request.pathFixed normalized absolute path used for every request to this source; a source declares this or pathTemplate and never both. | string | Conditional | Not specified | No bound or
|
sources.*.request.pathBindingsSupplies each pathTemplate placeholder with a Rust-resolved value, and a script chooses neither a binding origin nor a path value. | object | Conditional | Not specified | No bound or
|
sources.*.request.pathBindings.*Map valueOne placeholder's tagged binding, filling exactly one complete path segment from a value Rust has already validated. | object | Conditional | Not specifiedSchema default, where declared: |
or No bound |
sources.*.request.pathBindings.*.fieldNames the selector field or prior-fact property whose value fills the placeholder; a value carrying /, \, %, a control, ., or .. is rejected, which closes path traversal and segment injection. | string | Conditional | Not specified |
|
sources.*.request.pathBindings.*.fromChooses whether Rust reads the placeholder value from an already authorized selector or from a scalar prior fact, and a prior-fact binding is accepted only on a fetch source. | string | Conditional |
| None specified |
sources.*.request.pathBindings.*.profileSelector profile the bound field belongs to; the same role, profile, and field must also be declared in selectorInputs, or the source is rejected at startup. | string | Conditional | Not specified |
|
sources.*.request.pathBindings.*.roleSubject role whose authorized selector supplies the value; every selector set the request can activate must carry this role and profile, or plan compilation refuses the source. | string | Conditional | Not specified |
|
sources.*.request.pathTemplateFixed absolute path whose placeholders each occupy one complete segment and are expanded by Rust; a template carrying a scheme, authority, query, fragment, empty segment, or dot segment fails startup. | string | Conditional | Not specified | No bound or
|
sources.*.request.preparationLimitsFor http-json: Channel policy and output bounds Rust applies to the request parts a preparation script returns, all checked before credentials are resolved or the source is contacted. For sqlite-extract: Output bounds Rust applies to what a preparation script returns, declared with prepareScript and never alone. | object | Conditional | Not specified | None specified |
sources.*.request.preparationLimits.jsonBodyDecides whether a preparation script may, must, or must not return a JSON body, where JSON null counts as absent and an empty object or array counts as present. | string | Conditional |
| None specified |
sources.*.request.preparationLimits.maximumCollectionItemsCaps the entries in each array and object of the prepared JSON body; a body over the cap fails preparation and no request is made. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumJsonDepthCaps the nesting depth of the prepared JSON body; a deeper body fails preparation and no request is made. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumNormalizedBytesCaps the serialized size of the complete request parts, query pairs and body together, so the outbound request stays bounded whichever channel a script fills. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumParameterValueBytesCaps one returned parameter value. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumParametersCaps how many parameters a preparation script may return. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumQueryNameBytesCaps the length of each query-pair name a preparation script returns, applied before the pair is percent-encoded. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumQueryPairsCaps how many query pairs a preparation script may return, bounding the query string the source receives. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumQueryValueBytesCaps the length of each query-pair value a preparation script returns, applied before the pair is percent-encoded. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.maximumStringBytesCaps every string a preparation script returns, covering query names and values as well as JSON body strings and member names. | integer | Conditional | Not specified |
|
sources.*.request.preparationLimits.queryDecides whether a preparation script may, must, or must not return query pairs, where required means at least one pair. Setting this key and jsonBody both to forbidden fails startup, because one output channel must stay usable. | string | Conditional |
| None specified |
sources.*.request.prepareScriptFor http-json: Bundle-relative Rhai script implementing prepare/2, the only step that turns the minimized authorized selectors, closed parameters, and any prior facts into ordered query pairs and at most one JSON body. For sqlite-extract: Bundle-relative Rhai script implementing prepare/2. A statement source usually declares neither this nor preparationLimits, because most parameters name the selector field they come from; a source declares both together or neither, and only where it also declares a prepared parameter for the script to fill. | string | Conditional | Not specified |
or No bound |
sources.*.request.projectionFor http-json: Allowlist of response leaves Rust retains, alongside the containers needed to reach them, so an extraction script never observes a field the source returned but the bundle did not select. For sqlite-extract: Restates the statement result shape for the shared projection boundary. It must preserve every declared row column, either through /rows, /rows/*, or each /rows/*/<column> path, and may additionally retain reviewed extract metadata. | array | Yes | Not specified |
|
sources.*.request.projection[]Array itemOne extended JSON Pointer whose * segment visits every element of the current array, with no numeric index, recursive descent, filter, predicate, union, or script-computed path admitted. | string | No | Not specified |
|
sources.*.request.redirectsRefuses to follow a redirect, so a source response cannot move the request to a different origin; a redirect is classed as a transport failure. | string | Conditional |
| None specified |
sources.*.request.selectorInputsFor http-json: Closes the minimized authorized selector alternatives a preparation script can see; an empty array is accepted only on a fetch source. For sqlite-extract: Closes the minimized authorized selector alternatives this source's parameter bindings may draw on; an empty array is accepted only on a source that binds no selector. | array | Yes | Not specified |
|
sources.*.request.selectorInputs[]Array itemFor http-json: One subject role together with the alternative profiles and exact field sets a preparation script may receive for that role. For sqlite-extract: One subject role together with the alternative profiles and exact field sets a binding may name for that role. | object | No | Not specified | None specified |
sources.*.request.selectorInputs[].alternativesClosed set of profile and field combinations permitted for the role; the runtime materializes only the combination the matched authority grant carries, never the union of every alternative declared. | array | Yes | Not specified |
|
sources.*.request.selectorInputs[].alternatives[]Array itemOne permitted selector profile paired with the exact field subset that alternative exposes. | object | No | Not specified | None specified |
sources.*.request.selectorInputs[].alternatives[].fieldsExact subset of the named profile's declared fields this alternative exposes, which is how a consumer is handed less than the authorized selector carries. | array | Yes | Not specified |
|
sources.*.request.selectorInputs[].alternatives[].fields[]Array itemOne selector field name, which the named profile must declare or the bundle is rejected at startup. | string | No | Not specified |
|
sources.*.request.selectorInputs[].alternatives[].profileSelector profile this alternative admits for the role; a profile absent from selectorProfiles is rejected at startup. | string | Yes | Not specified |
|
sources.*.request.selectorInputs[].roleSubject role this selector input covers, unique across the declaration; the runtime resolves request subjects by role rather than by array position. | string | Yes | Not specified |
|
sources.*.request.statementBundle-relative SQL file holding exactly one statement, hash-identified like every other bundle artifact and reviewed with the bundle. A second statement in the file fails the request, and the statement text is fixed: no caller, script, or extract contributes to it. | string | Conditional | Not specified |
|
sources.*.request.timeoutMillisecondsFor http-json: Bounds each phase of one attempt at this source separately, carrying its whole value into every one: concurrency admission, any wait on the token single-flight boundary, and the HTTP exchange. It is not one deadline across the attempt, so an attempt that waits at one phase and then runs the next spends the bound again, and its worst-case wall clock is a multiple of this value rather than this value. For sqlite-extract: One absolute deadline for an attempt at this source, covering concurrency admission, blocking-worker queueing, and statement execution. Time spent in an earlier phase reduces what remains for every later phase. | integer | Yes | Not specified |
|
sources.*.responseSchemaFor http-json: Bundle-relative closed JSON Schema the projected source response must satisfy before sources.*.extractScript runs; a response outside this shape fails as a source-protocol error and no script runs. Unlike sources.*.factSchema, this schema may require fewer members than it declares and may mark a leaf nullable, because projection can legitimately drop or null a value the record did not carry. For sqlite-extract: Bundle-relative closed JSON Schema the projected statement result must satisfy before sources.*.extractScript runs; a result outside this shape fails as a source-protocol error and no script runs. Unlike sources.*.factSchema, this schema may require fewer members than it declares and may mark a leaf nullable, because a declared column may legitimately be null in the extract. | string | Yes | Not specified |
|
sources.*.tlsTrustProfileLogical name resolved to an exact private certificate authority file bound in runtime.yaml. Omission trusts only configured system roots, and the profile is rejected outright when sources.*.authentication.kind is none. | string | Conditional | Not specified |
|
sources.*.transportFor http-json: Selects the HTTP-plus-JSON transport, which reaches a fixed HTTPS origin over the network under one request and response contract for method, media type, and body shape. The tag chooses the shape of the whole source, so a key belonging to another transport is an unknown key here rather than an ignored one. For sqlite-extract: Selects the statement transport, which runs one reviewed SQL statement against a read-only SQLite extract file mounted beside the process. There is no origin, no credential, and no network hop, so the keys the HTTP transport needs for those are unknown keys here rather than ignored ones. | string | Yes |
| None specified |
sources.*.unresolvedProblemOptional exact source-neutral Problem Details tuple which declares one HTTP 404 response as an explicit unresolved lookup outcome. The runtime accepts it only with exactly one application/problem+json Content-Type and an exact duplicate-free six-member Problem Details object whose status, type, and code equal this tuple. Omission preserves the ordinary rule that every HTTP 404 is a dependency failure. This outcome is unavailable for an optimized physical source batch because one response cannot identify the unresolved logical item. | object | Conditional | Not specified | None specified |
sources.*.unresolvedProblem.code | string | Conditional | Not specified |
|
sources.*.unresolvedProblem.status | integer | Conditional |
| None specified |
sources.*.unresolvedProblem.type | string | Conditional | Not specified |
|
subjectBindingKeys the audience- and purpose-scoped subject bindings an assertion carries in place of selector values, derived over the complete canonical role, profile, and value set rather than as per-field hashes. | object | Yes | Not specified | None specified |
subjectBinding.keyVersionScopes each derived binding and appears in the binding value, so a new version changes every binding a relying party already retains as an expectation. | integer | Yes | Not specified |
|
subjectBinding.secretRefPoints at the file secret keying every subject binding; that reference and its resolved bytes must both differ from the audit master, and a match fails startup. | string | Yes | Not specified |
|
versionSelects the bundle grammar the rest of this document is read against, and a version the runtime does not implement is rejected at startup. | integer | Yes |
| None specified |
runtime.yaml
Frozen Version 1 contract
Generated from products/evidence/contracts/runtime.schema.yaml. 39 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
acquisitionCapabilitiesGated acquisition kinds and source-call optimizations this deployment enables, the operator half of the same two-sided gate the bundle declares. Omission and an explicit empty list both enable nothing.Runtime check: A bundle whose requirement needs a gated acquisition kind, or whose HTTP source carries a batch block, is refused at startup when the corresponding capability is absent from this list, before the deployment serves anything. | array | No | Not specified |
|
acquisitionCapabilities[]Array itemOne gated acquisition kind or source-call optimization this deployment permits. A bundle needing an acquisition kind absent here is refused before the listener binds; an absent optimization is never selected. | string | No |
| None specified |
auditStorageGroups the physical destination and size bound for the audit log this process writes; the log format, pseudonymization key, and fail-closed policy are governed by the bundle's audit section, not by this one. | object | Yes | Not specified | None specified |
auditStorage.maximumFileBytesCaps how large the active audit segment file may grow before the runtime seals it and starts a new one; a single audit record whose own size exceeds this bound can never be written, and the request that would have produced it fails rather than being audited incompletely. | integer | Yes | Not specified |
|
auditStorage.pathAbsolute path to the append-only keyed-JSONL audit file on durable, operator-owned storage; this physical destination is process-local and is not chosen by the bundle's governed audit policy. | string | Yes | Not specified |
|
bundleDirectorySelects the one governed bundle directory this process loads at startup; no alternate, overlay, or fallback bundle path exists for a running deployment. | string | Yes | Not specified |
|
listenerGroups the network binding and per-request admission limits for the process's evidence endpoint; metricsListener, when present, is an entirely separate binding with its own limits. | object | Yes | Not specified | None specified |
listener.bindHostNumeric listener address. The default private-address exposure accepts loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6. The explicit container-private exposure additionally accepts the unspecified IPv4 or IPv6 wildcard for a container network confined by the operator. Multicast, public, and hostname values are prohibited in both modes.Runtime check: Parsed as an IP address and checked together with listener.networkExposure. Wildcards require the explicit container-private value; public addresses remain prohibited. | string | Yes | Not specified |
|
listener.maximumConcurrentRequestsSizes the fixed admission semaphore for concurrent evidence requests; a request that cannot acquire a slot within listener.requestTimeoutMilliseconds receives a service-unavailable response instead of queuing without bound. | integer | Yes | Not specified |
|
listener.maximumRequestBytesCaps accepted request body size; a request whose declared or actual length exceeds this bound is rejected as malformed before evidence evaluation begins. | integer | Yes | Not specified |
|
listener.networkExposureDeclares the operator-owned network boundary around the listener. Absent preserves the private-address contract used by existing runtime files. container-private permits a wildcard bind only for a container network whose ingress and TLS termination are controlled by the operator; it does not enable public or direct-TLS serving. | string | No |
"private-address" | None specified |
listener.portTCP port the process binds for the evidence API alongside listener.bindHost; port 0, which would ask the kernel for an arbitrary ephemeral port instead of naming one, is refused. | integer | Yes | Not specified |
|
listener.requestTimeoutMillisecondsBounds admission-slot acquisition and request-body collection; once protected evaluation starts, this timer no longer cancels it, and source and OIDC boundaries carry their own separate limits. | integer | Yes | Not specified |
|
listener.shutdownGraceMillisecondsOperational target for graceful shutdown to finish within; it does not cancel a request already inside protected evaluation, so audit and signing invariants complete even if shutdown outlives this grace period. | integer | Yes | Not specified |
|
listener.tlsTerminationDeclares that TLS terminates at an operator-controlled upstream in front of this listener; the runtime accepts no other value and exposes no direct-TLS or insecure mode of its own. | string | Yes |
| None specified |
listener.trustProxyIdentityHeadersFixes the listener to ignore proxy-supplied identity headers; authenticated identity and authority always come from the verified access token, never from a header a network intermediary can set. | boolean | Yes |
| None specified |
metricsListenerOptional operator-only telemetry listener serving GET /metrics. Absent means the deployment serves no metrics endpoint, which is the default. This listener is a separate binding from the evidence listener and is not described by the public evidence contract.Runtime check: Rejected at startup when bindHost and port together repeat the evidence listener binding. | object | No | Not specified | None specified |
metricsListener.bindHostNumeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address. Unspecified, multicast, public, and hostname values are prohibited.Runtime check: Parsed as an IP address and accepted only when Rust classifies it as loopback, private IPv4, or unique-local IPv6. | string | Yes | Not specified |
|
metricsListener.portTCP port for the optional metrics listener; paired with metricsListener.bindHost, it must not repeat the evidence listener's exact host-and-port binding. | integer | Yes | Not specified |
|
outboundTlsGroups outbound TLS trust for calls to configured sources; it can add private certificate authorities through named trust profiles but carries no setting to weaken hostname verification or skip TLS. | object | Yes | Not specified | None specified |
outboundTls.systemRootsFixes the system certificate authority store as always trusted for outbound calls; because Version 1 has no way to disable it, a source's public certificate must still chain to a trusted root even when a private trust profile also applies. | boolean | Yes |
| None specified |
outboundTls.trustProfilesClosed map of private certificate-authority bundles a source may reference by logical id; the set of ids present here must exactly match the tlsTrustProfile names the bundle's sources declare, with no extra or missing profile. | object | Yes | Not specified |
|
outboundTls.trustProfiles.*Map valueOne named private trust profile, binding a logical id a source's tlsTrustProfile reference names to the certificate-authority bundle used only for that source's outbound connections. | object | No | Not specifiedSchema default, where declared: |
|
outboundTls.trustProfiles.*.caBundleFileAbsolute path to one bounded PEM file of trust anchors, loaded and validated at startup; changing its bytes requires a restart and changes the computed runtime digest. | string | Yes | Not specified |
|
secretProvidersConfigures how a secret:file/... reference resolves to bytes at startup; it supplies the storage location only, and which secret each governed field names is fixed by the bundle, not by this section. | object | Yes | Not specified | None specified |
secretProviders.fileDeclares the file-based secret provider and its root directory; Version 1 defines no other provider kind, so every secret:file/name reference resolves through this one path. | object | Yes | Not specified | None specified |
secretProviders.file.rootAbsolute base directory every secret:file/name reference resolves beneath; each name is one bounded path component opened relative to this root, and the opened file is checked for type, ownership, mode, and link count before its bytes are read. | string | Yes | Not specified |
|
signerBinds the process to the private-key transport that produces every signature over the bundle's governed active public key; it can select and configure that transport but cannot change the governed key set or signing algorithm. | object | Yes | Not specified | None specified |
signer.keyNameNames the specific key within signer.mount this signer calls; combined with signer.mount and signer.keyVersion, it reaches exactly one pinned Transit key. | string | Conditional | Not specified |
|
signer.keyVersionPins signing to one exact Transit key version rather than a latest alias, so a provider-side rotation cannot silently replace the key bytes behind an unchanged kid. | integer | Conditional | Not specified |
|
signer.kindSelects the signer transport for this deployment: local-jwk resolves a file-provider secret directly, transit calls a workload-local signing proxy over a Unix socket; only the kind matching the bundle's assurance profile is accepted at startup. | string | Yes |
| None specified |
signer.mountNames the Transit secrets-engine mount this signer calls; it is a path segment in the local Transit-proxy request URL, not a filesystem location. | string | Conditional | Not specified |
|
signer.privateKeyRefNames the file-provider secret holding the local signing private key material, read only when signer.kind is local-jwk; the value is a reference, and configuration never carries the key bytes themselves. | string | Conditional | Not specified |
|
signer.timeoutMillisecondsBounds how long the runtime waits on each call to the Transit signing proxy; because a transit signer keeps no local fallback key, a call that exceeds this bound fails the request rather than blocking it indefinitely. | integer | Conditional | Not specified |
|
signer.unixSocketPathAbsolute Unix socket path used to reach the workload-local Transit signing proxy; the runtime supplies no provider token over this connection, because token custody and renewal stay with the proxy. | string | Conditional | Not specified |
|
sourceExtractsClosed map of process-local extract files a source may read by logical name; the set of names present here must exactly match the extractProfile names the bundle's extract sources declare, with no extra or missing name. Omission binds none, which is what a runtime file for a bundle with no extract source says. | object | No | Not specified |
|
sourceExtracts.*Map valueOne named extract binding, joining a logical name a source's extractProfile reference declares to the process-local file that holds it, so the reviewed bundle names what it reads and the operator decides where that file sits. | object | No | Not specifiedSchema default, where declared: |
|
sourceExtracts.*.pathAbsolute path to one read-only regular file, validated at startup and digested without being read into memory; it must be neither a symbolic link nor writable, because the statement executor opens it as immutable, and its digest changes the computed runtime digest. | string | Yes | Not specified |
|
versionPins the runtime document to Version 1 of this grammar; the loader rejects any other value, so a future incompatible runtime shape is never read as if it were this one. | integer | Yes |
| None specified |
questions/<name>.yaml
Adopter tooling, not frozen
Generated from crates/registry-evidencectl/schemas/authoring/question.schema.json. 64 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
answers | array | Yes | Not specified | None specified |
answers[]Array itemOne governed concept a question answers, and the shape of that answer. | object | No | Not specified | None specified |
answers[].concept | string | Yes | Not specified | None specified |
answers[].id | null | string | No | Not specifiedSchema default, where declared: null | None specified |
answers[].maximum | integer | null | No | Not specified |
|
answers[].maximumBytes | integer | null | No | Not specified |
|
answers[].maximumSerializedBytes | integer | null | No | Not specified |
|
answers[].minimum | integer | null | No | Not specified |
|
answers[].minimumBytes | integer | null | No | Not specified |
|
answers[].prefix | null | string | No | Not specified | None specified |
answers[].schema | null | string | No | Not specified | None specified |
answers[].sdJwtVcHow an answer appears in the SD-JWT VC serialization of a response. | null | object | No | Not specified | None specified |
answers[].sdJwtVc.claim | string | Conditional | Not specified | None specified |
answers[].sdJwtVc.disclosureWhere a projected claim sits in the disclosure structure. | string | Conditional |
| None specified |
answers[].typeThe shape of one answer. | string | Yes |
| None specified |
answers[].values | array | No | Not specifiedSchema default, where declared: [] | None specified |
answers[].values[]Array item | string | No | Not specified | None specified |
derivation | string | Yes | Not specified | None specified |
disclosureWhich of a question's concepts a response may carry. | object | Yes | Not specified | None specified |
disclosure.allow | array | Yes | Not specified | None specified |
disclosure.allow[]Array item | string | No | Not specified | None specified |
governanceThe published description of what a question decides and under what rules. | null | object | No | Not specified | None specified |
governance.disclosureFamilies | array | Conditional | Not specified | None specified |
governance.disclosureFamilies[]Array item | string | Conditional | Not specified | None specified |
governance.evidenceType | string | Conditional | Not specified | None specified |
governance.fixtures | string | Conditional | Not specified | None specified |
governance.kindWhat kind of rule a question's requirement is. | string | Conditional |
| None specified |
governance.observationTimezone | string | Conditional | Not specified | None specified |
governance.referenceFrameworks | array | Conditional | Not specified | None specified |
governance.referenceFrameworks[]Array item | string | Conditional | Not specified | None specified |
governance.requirement | string | Conditional | Not specified | None specified |
governance.validitySeconds | integer | Conditional | Not specified |
|
id | string | Yes | Not specified | None specified |
purpose | string | Yes | Not specified | None specified |
question | string | Yes | Not specified | None specified |
responseFormats | array | No | Not specified | None specified |
responseFormats[]Array itemA serialization an answer may be returned in. | string | No |
| None specified |
sourceWhere a question reads from: a named source, or an operation of the
project's own OpenAPI description together with the facts it projects. | object | Yes | Not specified | None specified |
source.collectionBounds | object | No | Not specifiedSchema default, where declared: {} | None specified |
source.collectionBounds.*Map value | integer | No | Not specified |
|
source.facts | array | No | Not specified | None specified |
source.facts[]Array itemOne value projected out of a source response and handed to the derivation. | object | No | Not specified | None specified |
source.facts[].combineHow many values a fact's path is expected to reach. | string | Yes |
| None specified |
source.facts[].name | string | Yes | Not specified | None specified |
source.facts[].path | string | Yes | Not specified | None specified |
source.operation | null | string | No | Not specifiedSchema default, where declared: null | None specified |
source.ref | null | string | No | Not specified | None specified |
subjectOne party a question is asked about. | null | object | No | Not specified | None specified |
subject.derivation | boolean | Conditional | Not specifiedSchema default, where declared: false | None specified |
subject.profile | null | string | Conditional | Not specifiedSchema default, where declared: null | None specified |
subject.profilesExplicit alternative profiles from the project's selector definitions.
Each profile supplies its complete field set, including composite keys. | array | Conditional | Not specified |
|
subject.profiles[]Array item | string | Conditional | Not specified | None specified |
subject.role | string | Conditional | Not specified | None specified |
subject.selector | string | Conditional | Not specified | None specified |
subject.sourceWhether this role supplies an inline operation path selector.
Omission keeps the unambiguous single-role shorthand. An explicit
value is useful when multiple roles use the same selector field name. | boolean | null | Conditional | Not specifiedSchema default, where declared: null | None specified |
subjects | array | No | Not specified | None specified |
subjects[]Array itemOne party a question is asked about. | object | No | Not specified | None specified |
subjects[].derivation | boolean | No | Not specifiedSchema default, where declared: false | None specified |
subjects[].profile | null | string | No | Not specifiedSchema default, where declared: null | None specified |
subjects[].profilesExplicit alternative profiles from the project's selector definitions.
Each profile supplies its complete field set, including composite keys. | array | No | Not specified |
|
subjects[].profiles[]Array item | string | No | Not specified | None specified |
subjects[].role | string | Yes | Not specified | None specified |
subjects[].selector | string | No | Not specified | None specified |
subjects[].sourceWhether this role supplies an inline operation path selector.
Omission keeps the unambiguous single-role shorthand. An explicit
value is useful when multiple roles use the same selector field name. | boolean | null | No | Not specifiedSchema default, where declared: null | None specified |
evidence-project.yaml
Adopter tooling, not frozen
Generated from crates/registry-evidencectl/schemas/authoring/project-marker.schema.json. 2 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
projectThe one kind of project this crate's marker names today. | string | Yes |
| None specified |
version | integer | Yes | Not specified |
|
What this page does not carry
Section titled “What this page does not carry”Each description here states what one key decides, in the sentence the schema itself carries. It
cannot show you how the keys fit together, walk you through authoring a bundle, or explain why a
deployment is shaped the way it is. The deployment grammar is explained in
products/evidence/reference/request-adapter/deployment-projects/CONFIG.md. The published
Evidence authoring form reference documents
the authoring keys in the context of a whole project. Start with
Configure Evidence Gateway, or follow
Connect a published SQLite extract for that transport’s
complete authoring and deployment path.
A key path that this page lists is not a deployment that runs. evidence check is the authoritative
runtime acceptance gate. evidencectl artifact inspect <candidate> reports artifact custody, and
evidencectl doctor --runtime-config <absolute-file> performs the live startup dependency
preflight without opening the public listener or sending an Evidence request. evidencectl test
invokes the real Evidence checks before evaluating fixtures offline.