Evidence Gateway configuration reference
This generated reference lists the schema-visible key paths in the two frozen Version 1 configuration grammars and in the authoring form an adopter writes before a deployment project exists.
Each entry reports only what the schema itself proves: the value type, whether the key is required, the fixed values it accepts, the bounds it enforces, and the schema’s own description of what the key decides. Read an entry to confirm a key exists, spell the key correctly, and stay inside its accepted values.
Contract status
Section titled “Contract status”Two kinds of schema are published here, and they carry different promises. Every section on this page states which it is.
| Schema | Status | Source |
|---|---|---|
bundle/evidence.yaml, runtime.yaml | Frozen Version 1 contract | products/evidence/contracts/*.schema.yaml |
questions/<name>.yaml, evidence-project.yaml | Adopter tooling, not frozen | crates/registry-evidencectl/schemas/authoring/*.schema.json |
- Status: current, pre-1.0
- Reference format:
1.1 - Generator:
npm run generateindocs/site - Coverage gate:
products/evidence/scripts/check-config-key-paths.sh
The two frozen contracts are the authority for a deployment. JSON Schema validation and the runtime’s own checks decide whether a configuration is accepted; this page never adds a rule of its own, and it does not inspect a deployment, live configuration, environment variables, or secret stores.
The authoring schemas are generated from the registry-evidence-authoring model that
evidencectl and the language server share, so an editor’s idea of the form and the command
line’s idea of the form come from one place. They sit outside the frozen Version 1 contract set
and may change with the tooling that generates them. A question document these schemas accept
still has to compile, and compiling is where the frozen contract applies.
The coverage gate holds every schema’s key paths in exact parity with the product reference that explains it, so a key cannot reach one artifact and quietly skip the others.
Schema shape and accepted projects
Section titled “Schema shape and accepted projects”The authoring schemas describe the JSON-compatible shape that an editor and parser can read.
They do not contain every field bound, cross-field rule, filename check, referenced-file check, or
compiled-bundle invariant. The shared form validator, evidencectl compiler, and real evidence
bundle check apply those additional gates in order.
For example, the question schema describes subjects as an array without an item-count bound.
Nine structurally valid subjects can pass JSON Schema validation, but the shared form validator
rejects the question because the accepted form allows only 1 through 8 subjects. The
Evidence authoring form reference documents
the complete project rules, including local secret posture, signing-key handling, and access
policies.
Notation
Section titled “Notation”A property is written name, an item of an array name[], and a value of a map name.*. A
recursive definition, currently only nested adapter parameter values, appears once at the point
it re-enters itself.
Where a key is reachable through several alternative shapes, the entry shows the union of the types and values those alternatives accept. Accepted values is therefore the set the grammar accepts somewhere, not in every case; where a rule elsewhere fixes the value under a condition, the entry says so beneath the set.
Required reads Conditional when whether you may or must write the key depends on the rest of the document: some alternative does not declare it at all, only some alternatives require it, or a rule elsewhere in the contract requires it once a condition holds. It may be mandatory in one shape and rejected in another. Required reads Yes whenever some part of the contract requires the key outright, including where the requirement is stated away from the place the key is declared, and a rule that only tightens a required key’s bounds does not soften that to Conditional.
Constraints are grouped per alternative and separated by or, because satisfying every printed bound at once can describe a value no alternative accepts. A group reading No bound is an alternative the grammar leaves unbounded, and it is printed rather than dropped so the bounds beside it are not read as holding in every case. The groups are the bound sets the grammar offers, not an enumeration of every combination; consult the configuration guide for how one key’s shape constrains another’s.
Bounds under where a rule elsewhere applies are a second, independent reading. They do not
replace the alternatives above them: a rule elsewhere in the contract tightens whichever
alternative you took, once its condition holds. So sources.*.baseUrl always matches one of its
two origin patterns, and a source authenticating with none must further match the narrower
loopback pattern printed below them.
bundle/evidence.yaml
Frozen Version 1 contract
Generated from products/evidence/contracts/bundle.schema.yaml. 254 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
acquisitionCapabilitiesGated acquisition kinds this bundle opts in to. The Version 1 forms are absent from the vocabulary on purpose, because every bundle already had them; omission and an explicit empty list both enable nothing. | array | Conditional | — |
and, where a rule elsewhere applies
|
acquisitionCapabilities[]Array itemOne gated acquisition kind this bundle declares, which is the bundle half of a two-sided gate; a requirement using a kind absent here is rejected at startup. | string | No |
| — |
assuranceProfileDeclares the governed assurance boundary of the whole bundle, and the value is visible in every assertion, so an authentic local assertion never satisfies a relying procedure expecting a deployable profile. local is an authoring profile that lets a requirement omit fixtures and disables no other runtime boundary; the deployable profiles require every requirement to reference a fixture suite with complete coverage before the bundle loads. | string | Yes |
| — |
auditGoverns audit pseudonymization and the fail-closed policy for the whole deployment; runtime.yaml contributes only the storage location. | object | Yes | — | — |
audit.failClosedHolds every audit gate closed, so an authorization refusal, access attempt, or disclosure release whose record cannot be durably written stops the response instead of being served unaudited. | boolean | Yes |
| — |
audit.formatFixes the audit record form to the keyed JSONL chain, whose sealed segments an operator replays out of band to prove retained history. | string | Yes |
| — |
audit.hashKeyVersionStamped into every audit pseudonym as its version prefix, so pseudonyms produced under different audit key material stay distinguishable within one chain. | integer | Yes | — |
|
audit.hashSecretRefPoints at the file secret Rust separates into the audit chain and identifier subkeys; the same reference cannot also serve subjectBinding.secretRef. | string | Yes | — |
|
authenticationVerification policy for inbound bearer tokens: the runtime validates each token against these values itself and ignores upstream identity headers. | object | Yes | — | — |
authentication.actorClaimNames the verified claim read as the actor alongside the principal, and omitting the key enables no fallback actor source. | string | No | — |
|
authentication.algorithmsCloses the set of signature algorithms accepted on an inbound access token, and no algorithm fallback outside the set is permitted. | array | Yes | — |
|
authentication.algorithms[]Array itemOne signature algorithm the token verifier accepts on an inbound access token. | string | No |
| — |
authentication.audiencesExact allowlist of audience values an inbound access token must carry to be accepted. | array | Yes | — |
|
authentication.audiences[]Array itemOne exact audience value an inbound access token may carry. | string | No | — |
|
authentication.evidenceAudienceClaimNames the verified claim that fixes the audience an assertion is issued to, and the public request cannot choose another audience. | string | Yes | — |
|
authentication.grantAuthorityClaimNames the verified claim carrying the granting authority, read only when a subject's valueOrigin is authenticated-grant; the claim value must equal the matched authority-profile id. | string | Yes | — |
|
authentication.grantIdClaimNames the verified claim carrying the grant identifier, read only when a subject's valueOrigin is authenticated-grant. | string | Yes | — |
|
authentication.issuerExact token issuer an inbound access token must declare, with path-based issuers supported; deployable bundles require HTTPS. | string | Yes | — |
and, where a rule elsewhere applies
or
|
authentication.jwksUriFixed endpoint the verifier fetches issuer signing keys from; the endpoint may resolve to a public or private address, so DNS is pinned for each fetch, ambient proxies are disabled, and cloud-metadata destinations remain prohibited. | string | Yes | — |
and, where a rule elsewhere applies
or
|
authentication.kindSelects the inbound credential model, and Version 1 defines exactly one such profile. | string | Yes |
| — |
authentication.maximumTokenLifetimeSecondsCaps the accepted exp - iat interval, and its presence requires iat and an exp greater than iat. | integer | Yes | — |
|
authentication.principalClaimThe only claim read as the principal, whose absence denies the request; client_id, azp, request data, and proxy headers are not fallbacks. | string | Yes | — |
|
authentication.requesterTagsClaimNames the verified claim whose tag list selects which authority profile can match the request. | string | Yes | — |
|
authentication.revokedKeyIdsEmergency denylist of issuer key identifiers, checked before cached JWKS key selection so a compromised key is refused even while the cache still holds the key. | array | Yes | — |
|
authentication.revokedKeyIds[]Array itemOne issuer key identifier the verifier refuses, whatever the cached JWKS still holds. | string | No | — |
|
authentication.tokenTypesAllowlist of the exact typ value an inbound token's protected JWT header must declare. | array | Yes | — |
|
authentication.tokenTypes[]Array itemOne exact protected-header typ value accepted on an inbound access token. | string | No |
| — |
authorityProfilesNamed authority profiles deciding which requester class may obtain which assertion. Exactly one authority path may match a request, and two paths covering the same requirement, purpose, and subject tuple deny that request rather than failing startup. | object | Yes | — |
|
authorityProfiles.*Map valueEverything one requester class may ask for. Access is per requester class rather than per client identity, so two clients carrying the same tags have identical access. | object | No | — |
|
authorityProfiles.*.grantsComplete set of authorized paths this requester class has. Permissions are never unioned across grants, so one grant must cover an entire request on its own. | array | Yes | — |
|
authorityProfiles.*.grants[]Array itemOne authorized path, binding a single requirement, a single purpose, the audience origin, and the referenced requirement's complete subject-role set. | object | No | — | — |
authorityProfiles.*.grants[].audienceFromBinds the assertion audience to the requester's verified evidence audience claim, so the public request cannot name another audience. | string | Yes |
| — |
authorityProfiles.*.grants[].purposeThe one purpose this path authorizes, matched exactly against the request purpose; a purpose the referenced requirement does not declare fails startup. | string | Yes | — |
|
authorityProfiles.*.grants[].requirementThe one requirement this path authorizes, named by its exact requirement URI; a requirement no bundle entry declares fails startup. | string | Yes | — |
|
authorityProfiles.*.grants[].responseFormatsSerializations this path permits, defaulting to signed JWS alone when omitted. Unsigned and SD-JWT VC output each require both the bundle-level responseFormats and the one matched grant to permit them. | array | No | — |
|
authorityProfiles.*.grants[].responseFormats[]Array itemOne permitted serialization of the same assertion, which introduces no separate issuance protocol and no credential state; a format reaches a response only when the bundle and the one matched grant both permit that format. | string | No |
| — |
authorityProfiles.*.grants[].subjectBindingModesSubject-binding modes this path permits, defaulting to audience-scoped alone when omitted or empty. Permitting a serialization is not permitting a binding mode: a path widened to sd-jwt-vc gains no right to issue holder-bound assertions until that mode is named here. A path may name holder-bound alone, which permits nothing else. | array | No | — |
|
authorityProfiles.*.grants[].subjectBindingModes[]Array itemOne binding mode this path permits, which is the operator half of a two-sided gate; a requirement declaring a mode no grant for it permits is unreachable and is rejected at startup. | string | No |
| — |
authorityProfiles.*.grants[].subjectsAuthorization for the referenced requirement's complete subject-role set; a grant that omits a declared role, or repeats one, fails startup. | array | Yes | — |
|
authorityProfiles.*.grants[].subjects[]Array itemAuthorization for one subject role, fixing which selector profile identifies the subject and where that subject's selector values may originate. | object | No | — | — |
authorityProfiles.*.grants[].subjects[].roleNames the requirement subject role this authorization covers; a role the requirement's subjectRoles does not declare fails startup, and no role may appear twice in one grant. | string | Yes | — |
|
authorityProfiles.*.grants[].subjects[].selectorProfileThe selector profile whose field set identifies this role's subject; a profile the requirement's subjectRoles entry does not permit for the role fails startup. | string | Yes | — |
|
authorityProfiles.*.grants[].subjects[].valueClaimsMaps every field of the named selector profile to the claim path in the verified access token that supplies that field's value. Missing, extra, duplicate-target, or invalid claim paths fail startup. | object | Conditional | — |
|
authorityProfiles.*.grants[].subjects[].valueClaims.*Map valueClaim path resolved only from the strictly verified access token, so a caller-supplied selector, grant reference, or approval value cannot supply the field. | string | No | — |
|
authorityProfiles.*.grants[].subjects[].valueOriginFixes where this role's selector values originate. A request origin takes values from the closed public request and prohibits valueClaims; authenticated-context rejects caller values and reads the exact valueClaims map; authenticated-grant reads that same map and additionally requires a verified grant id and a grant authority equal to the matched authority-profile id. | string | Yes |
| — |
authorityProfiles.*.kindDeclared basis of authority for this profile's grants; a request whose verified token carries an actor claim matches only a delegated profile. | string | Yes |
| — |
authorityProfiles.*.requesterTagsComplete tag set the claim named by authentication.requesterTagsClaim must contain for this profile to match, so adding a tag narrows the profile rather than widening it. | array | Yes | — |
|
authorityProfiles.*.requesterTags[]Array itemOne tag that must be present in the verified claim; differentiated requirements, purposes, or valueClaims are expressed by issuing different tags rather than by naming individual clients. | string | No | — |
|
holderBoundBatchMaxSizeCeiling on how many assertions one holder-bound release may carry. Omission means one, so a bundle written before batch release cannot serve a batch; declaring a ceiling this deployment never reaches enables nothing on its own, because each requirement still needs its own holder-bound declaration and a grant that permits the mode. | integer | No | — |
|
issuerCarries the legal issuer identity placed in every assertion, kept separate from the technical provider that operates the process and signs. | object | Yes | — | — |
issuer.idLegal issuer URI placed in every assertion as issuedBy, and governance must authorize the provider named in service.providerId to act for that issuer. | string | Yes | — |
|
rateLimitsGoverns the anti-enumeration budget for authenticated callers, counted against scoped pseudonyms of the principal and the authority rather than against any raw selector value. | object | Yes | — | — |
rateLimits.burstPerPrincipalCapacity of one principal's request bucket, bounding how many requests may arrive back to back before requestsPerPrincipalPerMinute governs the pace. | integer | Yes | — |
|
rateLimits.failedSelectorAttemptsPerPrincipalAuthorityPerMinuteBudget for selector-resolution failures, checked before source access and consumed only when selector validation itself fails, so repeated probing is refused before it reaches a source. | integer | Yes | — |
|
rateLimits.requestsPerPrincipalPerMinuteRate at which one principal's request budget refills, spread continuously across the minute rather than granted in full at its start. | integer | Yes | — |
|
requirementsRequirement identifiers and Evidence Type URIs must each be unique across every entry; a repeat of either rejects the whole bundle at startup. | array | Yes | — |
|
requirements[]Array itemOne independently versioned evidence definition; its configuration revision spans only this requirement's own configuration and artifact closure, letting a relying party pin this requirement without depending on the rest of the deployment. | object | No | — | — |
requirements[].acquisitionFixes this requirement's complete source-request shape to one call over a single source, or to a fixed sequence of calls named here; no response content chooses a different source or an additional call. | object | Yes | — | — |
requirements[].acquisition.fetchRead when acquisition.kind is search-then-fetch or search-then-fetch-set; the fixed second-stage source, or the ordered array of member sources, invoked after the search resolves and never chosen from response content. | array | string | Conditional | — |
or
|
requirements[].acquisition.fetch[]Array itemOne declared fetch member of a search-then-fetch-set acquisition, called in the order the array declares and reached only after the search resolves to a unique schema-valid match. Members must be distinct from each other and from the search source. | object | Conditional | — | — |
requirements[].acquisition.fetch[].factInputsAllowlist of validated search facts this member receives, and the only search-derived data reaching it through any channel, including the body its preparation builds. | array | Conditional | — |
|
requirements[].acquisition.fetch[].factInputs[]Array itemOne search fact name this member is permitted to read, which the search source's fact schema must require or the bundle is rejected at startup. | string | Conditional | — |
|
requirements[].acquisition.fetch[].sourceThe one configured source this member calls, fixed by the bundle like every other acquisition source. | string | Conditional | — |
|
requirements[].acquisition.kindSelects this requirement's closed acquisition shape, and therefore how many fixed source calls the runtime issues; a gated kind serves only where the bundle and the deployment both name it under acquisitionCapabilities. | string | Yes |
| — |
requirements[].acquisition.maximumAcquisitionMillisecondsCeiling on the whole acquisition, covering the search, every declared member, and the transitions between stages; exceeding it fails the requirement as a dependency failure and never cancels a durable audit append. | integer | Conditional | — |
|
requirements[].acquisition.searchRead when acquisition.kind is search-then-fetch or search-then-fetch-set; names the first-stage source, and the runtime aborts before the fetch stage unless this call resolves to exactly one match. | string | Conditional | — |
|
requirements[].acquisition.sourceRead only when acquisition.kind is single; the one configured source this requirement queries in its single fixed call. | string | Conditional | — |
|
requirements[].conceptsDeclares the complete, closed set of values this requirement's assertion may disclose; a value the derivation produces under an identifier absent from this list fails evaluation instead of being disclosed. | array | Yes | — |
|
requirements[].concepts[]Array itemOne value the requirement may disclose, corresponding to exactly one cccev:InformationConcept, and becoming one entry of the assertion's supported values when the derivation produces that value. | object | No | — | — |
requirements[].concepts[].constraintsClosed, form-specific bounds a derived value must satisfy before it is accepted into evidence; which keys apply is fixed entirely by the concept's form. | object | Conditional | — |
or No bound |
requirements[].concepts[].constraints.bucketSchemeURI naming the reviewed bucket scheme for a date-bucket or time-bucket concept; paired with schemeVersion, bucketScheme resolves to exactly one codelist artifact, so only the matched bucket code is disclosed and the underlying date, instant, or duration never appears in the assertion. | string | Conditional | — |
|
requirements[].concepts[].constraints.categorySchemeURI naming the reviewed category vocabulary a controlled-category concept's value must belong to; matched against schemeVersion and codelist at startup, it enforces exact category membership and rejects any unreviewed category. | string | Conditional | — |
|
requirements[].concepts[].constraints.codelistBundle-relative path to the closed codelist artifact whose entries fix exact membership for controlled-code, controlled-category, and controlled-code-list concepts, validated at startup. | string | Conditional | — |
|
requirements[].concepts[].constraints.codelistVersionVersion tag paired with codelist for controlled-code and controlled-code-list concepts that must exactly equal the referenced codelist artifact's own declared version, or the bundle fails to load. | string | Conditional | — |
|
requirements[].concepts[].constraints.maximumInclusive upper bound paired with minimum for bounded-integer and bounded-decimal concepts; a derived value over it fails evaluation instead of being disclosed. | integer | string | Conditional | — |
or
|
requirements[].concepts[].constraints.maximumBytesCaps the disclosed byte length of a controlled-code, controlled-category, or audience-scoped-entity-reference concept's value; a value or projected reference longer than the cap fails validation instead of being truncated. | integer | Conditional | — |
|
requirements[].concepts[].constraints.maximumItemsInclusive upper bound paired with minimumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a longer derived list fails validation. | integer | Conditional | — |
|
requirements[].concepts[].constraints.maximumScaleUpper bound on the number of fractional digits accepted for a bounded-decimal concept's derived value; a finer scale fails validation instead of being rounded. | integer | Conditional | — |
|
requirements[].concepts[].constraints.maximumSerializedBytesCaps the serialized JSON byte length of a reviewed-structured-value concept's entire disclosed object; an oversized derived value fails validation before signing. | integer | Conditional | — |
|
requirements[].concepts[].constraints.minimumInclusive lower bound paired with maximum for bounded-integer and bounded-decimal concepts; a derived value under it fails evaluation instead of being disclosed. | integer | string | Conditional | — |
or
|
requirements[].concepts[].constraints.minimumItemsInclusive lower bound paired with maximumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a shorter derived list fails validation. | integer | Conditional | — |
|
requirements[].concepts[].constraints.schemaURI resolving to exactly one closed JSON Schema artifact in the immutable bundle that a reviewed-structured-value concept's fields are validated against; the schema closes every property, so unexpected or additional JSON in the derived value fails validation. | string | Conditional | — |
|
requirements[].concepts[].constraints.schemeVersionVersion tag that must exactly equal a referenced codelist artifact's own declared version at startup; pairs with categoryScheme for controlled-category concepts and with bucketScheme for date-bucket and time-bucket concepts. | string | Conditional | — |
|
requirements[].concepts[].constraints.uniqueRequires every item in a controlled-code-list or entity-reference-list concept's disclosed list to be pairwise distinct; a duplicate item fails validation instead of being deduplicated or disclosed twice. | boolean | Conditional |
| — |
requirements[].concepts[].formSelects the concept's closed value shape, which fixes the exact set of keys constraints must declare and no others. | string | Yes |
| — |
requirements[].concepts[].idStable identifier that names this concept as providesValueFor in the assertion and, unless an sdJwtVc.claim override is declared, is also the concept's claim name in the SD-JWT VC serialization. | string | Yes | — |
|
requirements[].concepts[].requiredWhether the derivation must produce a value for this concept; a missing required concept fails the whole evaluation, and a missing optional concept is left out of the disclosed supported values. | boolean | Yes | — | — |
requirements[].concepts[].sdJwtVcOptional per-concept projection that the concept declaration may set only for reviewed-structured-value concepts, selecting how that structured value's fields are exposed as SD-JWT VC disclosures. | object | No | — | — |
requirements[].concepts[].sdJwtVc.claimPublic claim name substituted for the concept identifier in the SD-JWT VC response; it must be unique within the requirement and cannot collide with a profile-owned claim. | string | Yes | — |
|
requirements[].concepts[].sdJwtVc.disclosureFixes where the structured value's field-level disclosures are exposed in the SD-JWT VC claim set: as an always-visible top-level object under sdJwtVc.claim. | string | Yes |
| — |
requirements[].derivationDetermines which Rhai script computes the requirement's concept values as derive/3, and what minimized selector inputs and closed typed parameters that script is allowed to see. | object | Yes | — | — |
requirements[].derivation.parametersClosed set of adopter-named parameter values available to the requirement's derivation; the map cannot carry secrets or runtime authority. | object | Yes | — |
|
requirements[].derivation.parameters.*Map valueOne named parameter's value, closed to a bounded string, a safe integer, a boolean, one typed canonical decimal, or a bounded array of decimal bucket boundaries whose own bounds reuse that same typed-decimal shape. | array | boolean | integer | object | string | No | — |
or
or No bound or
|
requirements[].derivation.parameters.*.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| — |
requirements[].derivation.parameters.*.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | — |
|
requirements[].derivation.parameters.*[]Array itemOne decimal bucket boundary in an ordered array parameter, evaluated by the bucket_number primitive to classify a derived decimal into the matching boundary's code; each lower bound must equal the previous boundary's upper bound, and a gap fails validation at startup. | object | Conditional | — | — |
requirements[].derivation.parameters.*[].codeOutput code returned when a derived decimal falls inside this boundary's interval; duplicate codes across the array fail validation at startup. | string | Conditional | — |
|
requirements[].derivation.parameters.*[].maximumExclusiveExclusive upper bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value. | object | Conditional | — | — |
requirements[].derivation.parameters.*[].maximumExclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| — |
requirements[].derivation.parameters.*[].maximumExclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | — |
|
requirements[].derivation.parameters.*[].minimumInclusiveInclusive lower bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value. | object | Conditional | — | — |
requirements[].derivation.parameters.*[].minimumInclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value. | string | Conditional |
| — |
requirements[].derivation.parameters.*[].minimumInclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero. | string | Conditional | — |
|
requirements[].derivation.scriptBundle-relative Rhai script compiled at startup to expose the requirement's derive/3 entry point before the runtime reaches readiness. | string | Yes | — |
|
requirements[].derivation.selectorInputsOptional closed set of authorized selector roles the derivation may read; omission means derive/3 receives an empty selector map. | array | No | — |
|
requirements[].derivation.selectorInputs[]Array itemDeclares one subject role the derivation may read, together with the closed profile alternatives permitted for that role; only the alternative matching the authorized request subject reaches derive/3. | object | No | — | — |
requirements[].derivation.selectorInputs[].alternativesClosed set of profile and field combinations permitted for the role; the runtime materializes only the combination the matched authority grant carries, never the union of every alternative declared. | array | Yes | — |
|
requirements[].derivation.selectorInputs[].alternatives[]Array itemOne permitted selector profile paired with the exact field subset that alternative exposes. | object | No | — | — |
requirements[].derivation.selectorInputs[].alternatives[].fieldsExact subset of the named profile's declared fields this alternative exposes, which is how a consumer is handed less than the authorized selector carries. | array | Yes | — |
|
requirements[].derivation.selectorInputs[].alternatives[].fields[]Array itemOne selector field name, which the named profile must declare or the bundle is rejected at startup. | string | No | — |
|
requirements[].derivation.selectorInputs[].alternatives[].profileSelector profile this alternative admits for the role; a profile absent from selectorProfiles is rejected at startup. | string | Yes | — |
|
requirements[].derivation.selectorInputs[].roleSubject role this selector input covers, unique across the declaration; the runtime resolves request subjects by role rather than by array position. | string | Yes | — |
|
requirements[].disclosureGuardBinds this requirement's release to the reviewed disclosure families a human combined-disclosure review has already assessed. | object | Yes | — | — |
requirements[].disclosureGuard.familiesNon-empty set of those reviewed family URIs; sharing even one family with another enabled requirement rejects the whole bundle at startup. | array | Yes | — |
|
requirements[].disclosureGuard.families[]Array itemOne reviewed disclosure-family URI; this exact value, not what it represents, is what the startup check compares for reuse across requirements. | string | No | — |
|
requirements[].evidenceTypeExact Evidence Type URI placed in every assertion issued for this requirement; it must be unique across the bundle, and a duplicate rejects the bundle at startup. | string | Yes | — |
|
requirements[].existenceDisclosureGoverns the outward shape of an unresolved outcome: the runtime returns one identical public problem whether the subject was absent, ambiguous, or found with inconsistent derivation inputs, so a caller cannot distinguish the cause from the response. | string | Yes |
| — |
requirements[].fixturesBundle-relative path to this requirement's sanitized fixture suite; omitting it is accepted only under assuranceProfile: local, and production or evidence-grade refuse to load without it and its complete case coverage. | string | Conditional | — |
|
requirements[].idStable requirement URI a public request names to select this requirement; the runtime looks up requirements by this exact value and no other. | string | Yes | — |
|
requirements[].kindRequirement classification carried unchanged into every assertion issued for this requirement. | string | Yes |
| — |
requirements[].observationTimezoneIANA timezone resolving legal_local_date and legal_local_time from the runtime-supplied observed_at instant; an unrecognized name fails validation, and omitting the field resolves both values in UTC instead. | string | No | — |
|
requirements[].purposesClosed set of purpose codes this requirement can be requested under; an authority-profile grant must bind one of them together with a role and selector profile, or that combination has no authority path and the bundle fails to load. | array | Yes | — |
|
requirements[].purposes[]Array itemOne purpose code eligible for this requirement; an authority-profile grant must name this exact code before a request under it is authorized. | string | No | — |
|
requirements[].referenceFrameworksGoverned legal or procedural framework URIs carried as a whole into every assertion issued for this requirement. | array | Yes | — |
|
requirements[].referenceFrameworks[]Array itemOne governed framework URI in that set, copied unchanged into the assertion alongside its siblings; the runtime does not select or rank among them. | string | No | — |
|
requirements[].subjectBindingWhat this requirement's subject bindings are derived under; omission means audience-scoped, which is what every requirement written before this key existed did. A holder-bound requirement is rejected at startup unless the bundle and at least one grant for it both permit a serialization the mode allows, which is sd-jwt-vc or sd-jwt-vc-batch, and unless none of its concepts uses an entity-reference value form, whose pointer only the audience it was scoped to could resolve. | string | No |
| — |
requirements[].subjectRolesComplete set of subject positions this requirement resolves; incoming request array order carries no meaning, and resolved subjects are always canonicalized to this array's declaration order before signing. | array | Yes | — |
|
requirements[].subjectRoles[]Array itemOne subject position this requirement resolves; a request supplying a different number of subjects, a duplicate role, or a role this requirement does not declare is unauthorized. | object | No | — | — |
requirements[].subjectRoles[].cardinalityFixes this subject position to a single resolved value; Evidence Version 1 defines no plural or list-valued role. | string | Yes |
| — |
requirements[].subjectRoles[].roleDeployment-chosen identifier distinguishing this subject position from the requirement's others; requests, grants, and derivation inputs all address the position by this exact value, never by array position. | string | Yes | — |
|
requirements[].subjectRoles[].selectorProfilesSelector profiles permitted for this subject position; every one of them must be reachable by some authority-profile grant for every code in purposes, or the bundle fails to load. | array | Yes | — |
|
requirements[].subjectRoles[].selectorProfiles[]Array itemOne selector profile id permitted for this position; it must name an entry in the bundle's selectorProfiles map, or the bundle fails to load. | string | No | — |
|
requirements[].validitySecondsSets the assertion's validity window measured from issuedAt; the bundle fails to load if this exceeds signing.maximumAssertionValiditySeconds. | integer | Yes | — |
|
responseFormatsSets the deployment-wide ceiling of response serializations, and omission means [signed-jws]. A bundle that drops signed JWS is rejected at startup, and every other listed format additionally requires the one matched grant's authorityProfiles.*.grants[].responseFormats to permit that format. | array | No | — |
|
responseFormats[]Array itemOne permitted serialization of the same assertion, which introduces no separate issuance protocol and no credential state; a format reaches a response only when the bundle and the one matched grant both permit that format. | string | No |
| — |
selectorProfilesNamed registry of selector profiles that requirement subject roles and authority-grant subjects reference by id; an id absent from the map fails validation before startup. | object | Yes | — |
|
selectorProfiles.*Map valueOne named, closed profile of deployment-defined fields and their combined byte bound; a profile is not an identity type, and possession of its field values does not by itself grant authority. | object | No | — |
|
selectorProfiles.*.fieldsClosed map of the profile's field declarations, keyed by adopter-chosen names that are opaque to Rust and carry no meaning of their own. | object | Yes | — |
|
selectorProfiles.*.fields.*Map valueOne field's exact declaration: Rust matches a supplied value against it verbatim, performing no case folding, normalization, transliteration, tokenization, partial-date matching, or fuzzy scoring. | object | No | — |
|
selectorProfiles.*.fields.*.codelistPath to the bundled codelist artifact a controlled-code value must belong to; a missing referenced artifact fails bundle loading. | string | Conditional | — |
|
selectorProfiles.*.fields.*.codelistVersionVersion this field's controlled-code values are pinned to; it must equal the referenced codelist artifact's own version or bundle loading fails. | string | Conditional | — |
|
selectorProfiles.*.fields.*.maximumInclusive upper bound on this field's accepted integer selector value; a submitted value greater than this bound is rejected rather than clamped. | integer | Conditional | — |
|
selectorProfiles.*.fields.*.maximumBytesInclusive upper bound, in UTF-8 bytes, on this field's accepted string or controlled-code value; it cannot exceed the profile's maximumAggregateBytes. | integer | Conditional | — |
|
selectorProfiles.*.fields.*.minimumInclusive lower bound on this field's accepted integer selector value; a submitted value less than this bound is rejected rather than clamped. | integer | Conditional | — |
|
selectorProfiles.*.fields.*.minimumBytesInclusive lower bound, in UTF-8 bytes, on this field's accepted string value; it cannot exceed the field's own maximumBytes. | integer | Conditional | — |
|
selectorProfiles.*.fields.*.typeSelects the field's scalar kind, fixing which other declaration keys are required; a supplied value of a different kind is rejected. | string | Yes |
| — |
selectorProfiles.*.maximumAggregateBytesCaps the summed canonical byte size of every field value resolved for one authorized use of the profile; exceeding it denies the request. | integer | Yes | — |
|
serviceCarries the identity this deployment asserts under: the technical Evidence provider identity placed in evidence and the operator-controlled trust domain of the process. | object | Yes | — | — |
service.providerIdTechnical provider URI placed in every assertion as providedBy. Enabling sd-jwt-vc outside local assurance requires this value to be the stable HTTPS origin of the deployment, because issuer metadata and the published JWKS URI are derived from that origin. | string | Yes | — |
and, where a rule elsewhere applies
|
service.trustDomainScopes the process to one operator-controlled trust domain, whose URI is bound into subject bindings and into requester pseudonym scope, so the same subject yields different pseudonyms under a different trust domain. | string | Yes | — |
|
signingGoverns signature format, active and published key selection, key retirement, and assertion validity; missing signing material fails readiness and no unsigned fallback exists. | object | Yes | — | — |
signing.activePublicJwkFileNames the bundle-held public JWK the runtime signer's key must equal exactly, proven by one sign-and-verify test before readiness. | string | Yes | — |
|
signing.algorithmBinds assertion signatures to ES256 over P-256, and a verifier rejects any protected header alg that differs from the algorithm bound to the trusted key. | string | Yes |
| — |
signing.formatFixes the wire serialization of a signed assertion to flattened JWS JSON, returned as application/jose+json. | string | Yes |
| — |
signing.jwksPathRoute where the deployment serves its public key set; that route is not a trust anchor, because a verifier pins the provider identity and key location through its own governed configuration. | string | Yes |
| — |
signing.maximumAssertionValiditySecondsCeiling every requirements[].validitySeconds must stay within, and the base of the window a retired public key stays published. | integer | Yes | — |
|
signing.publishedPublicJwkFilesRetains predecessor public keys in the served key set so assertions signed before a rollover still verify, for at least the maximum assertion validity plus the verifier clock skew. | array | Yes | — |
|
signing.publishedPublicJwkFiles[]Array itemOne retained public key served beside the active key; an entry that repeats the active key or names a revoked identifier is rejected at startup. | string | No | — |
|
signing.revokedKeyIdsEmergency denylist: a listed identifier is excluded from the active set, the published set, and the served key set, and a verifier rejects that identifier before selecting a pinned public key. | array | Yes | — |
|
signing.revokedKeyIds[]Array itemOne denied service key, named by its RFC 7638 thumbprint rather than by a provider-assigned key name. | string | No | — |
|
signing.verifierClockSkewSecondsSkew a relying party applies when checking current validity, and the margin added to the maximum assertion validity before a retired public key may be removed. | integer | Yes | — |
|
sourcesComplete map of fixed sources a requirement can reference by id in its acquisition field, fixed at startup and immune to override by runtime.yaml. | object | Yes | — |
|
sources.*Map valueOne fixed source referenced by this map key from a requirement's acquisition field, combining a transport, the fixed request that transport carries, and a minimization posture with the extraction script and schemas that turn the source's response into facts. | object | No | — |
|
sources.*.authenticationOne closed credential profile the runtime presents on this source's outbound calls, distinct from the inbound caller policy at the bundle's top-level authentication. Reference members name secrets that resolve only after authorization, durable access audit, and request-parts validation, and no secret reaches a script. | object | Conditional | — | — |
sources.*.authentication.assumedLifetimeSecondsLifetime credited to an acquired token whose response omits expires_in, rather than inferring one from the token. Without this key such a response is a credential failure, and the cached lifetime is still clamped to maximumCacheSeconds. | integer | Conditional | — |
|
sources.*.authentication.audienceFixed audience form parameter sent with the token request, for an authorization server that keys the issued token to an audience the scope cannot express and returns an unusable token without it. Sent as it stands with no fallback, so a blank value is refused here rather than by the authorization server at readiness. | string | Conditional | — |
|
sources.*.authentication.clientAssertionAudienceFixed aud claim of the signed client assertion, for an authorization server that expects an identifier it is not reached at, such as its issuer or a host in front of a proxy. Declared only beside clientAssertionKeyRef, and defaulting to tokenEndpoint. RFC 7523 section 3 has the server compare this by Simple String Comparison, so it is an opaque identifier rather than a URL and is signed byte for byte. It names who may accept the assertion, never where it is sent. A blank value is refused here rather than at the first token request, where signing rejects a whitespace-only audience as empty. | string | Conditional | — |
|
sources.*.authentication.clientAssertionKeyRefLogical file-secret reference for the private JWK the runtime signs an RFC 7523 section 2.2 client assertion with, which is the client authentication SMART on FHIR Backend Services requires. The assertion is audienced to clientAssertionAudience, or to tokenEndpoint when the bundle names none, and lives 60 seconds; no private key leaves the process. | string | Conditional | — | No bound or
|
sources.*.authentication.clientIdRefLogical file-secret reference for the client identifier the runtime presents in the client-credentials exchange at tokenEndpoint. | string | Conditional | — |
|
sources.*.authentication.clientSecretRefLogical file-secret reference for the client secret the runtime presents at tokenEndpoint; the token URL, body, response, and debug output stay redacted, so the resolved value reaches no log. Declared with credentialPlacement and never beside clientAssertionKeyRef. | string | Conditional | — | No bound or
|
sources.*.authentication.credentialPlacementSelects whether the client identifier and secret travel in the Authorization header or the form body of the token request; Version 1 offers no query-string placement, so neither value can reach an authorization-server, proxy, or ingress URL log. Declared with clientSecretRef and never beside clientAssertionKeyRef, whose assertion always travels in the form body. | string | Conditional |
| — |
sources.*.authentication.headerNameNames the header carrying this source's API-key value. The name is validated as an HTTP field name and rejected when it collides with authentication, routing, framing, cookie, forwarding, proxy, tracing, or hop-by-hop headers. | string | Conditional | — |
|
sources.*.authentication.kindSelects which credential the runtime presents to this source and closes the member set to that profile. none sends no credential and is admitted only by a local assurance bundle at a canonical numeric-loopback origin; production and evidence-grade bundles reject that kind. | string | Conditional |
| — |
sources.*.authentication.maximumCacheSecondsBounds how long one acquired token is reused across evidence requests for this source; the cache lifetime is the smaller of this bound and the provider's reported expiry. | integer | Conditional | — |
|
sources.*.authentication.passwordRefLogical file-secret reference for the password half of the HTTP Basic credential the runtime encodes into the Authorization header of every request to this source. | string | Conditional | — |
|
sources.*.authentication.schemeAuthentication scheme the token is presented under; absent, the runtime sends Bearer. RFC 9110 section 11.1 makes the scheme an HTTP token chosen by the origin, and static-api-key cannot serve a source that wants another one because it refuses the Authorization header by name. | string | Conditional | — |
|
sources.*.authentication.scopeFixed scope requested in the client-credentials exchange; a token response reporting a scope other than this one is a credential failure. | string | Conditional | — |
|
sources.*.authentication.tokenEndpointFixed endpoint the runtime exchanges client credentials at before calling this source; the exchange is credential bootstrap, never an evidence-data request or a fact source. | string | Conditional | — | No bound or
or
|
sources.*.authentication.tokenRefLogical file-secret reference for the static token the runtime places in the Authorization header of every request to this source. | string | Conditional | — |
|
sources.*.authentication.usernameRefLogical file-secret reference for the user name half of the HTTP Basic credential the runtime presents to this source. | string | Conditional | — |
|
sources.*.authentication.valueRefLogical file-secret reference for the API-key value the runtime places in headerName; the resolved value is bounded and rejects control characters, CR, and LF. | string | Conditional | — |
|
sources.*.baseUrlFixed HTTPS origin the source's evidence-data requests target, with no path, query, fragment, user information, or runtime substitution. An HTTP numeric-loopback origin is accepted only when sources.*.authentication.kind is none. | string | Conditional | — | No bound or
or
and, where a rule elsewhere applies
|
sources.*.extractProfileLogical name resolved to an exact extract file bound in runtime.yaml under sourceExtracts. The bundle never names a filesystem location, and startup refuses a profile no runtime binds as well as a bound profile no source reads. | string | Conditional | — |
|
sources.*.extractScriptFor http-json: Bundle-relative Rhai script whose two-parameter extract function maps the schema-validated projected response and adapter context to a match, no-match, or ambiguous outcome. The script never selects a candidate among multiple records and never turns protocol inconsistency into a closed lookup outcome. For sqlite-extract: Bundle-relative Rhai script whose two-parameter extract function maps the schema-validated projected result and adapter context to a match, no-match, or ambiguous outcome. The script never selects a candidate among multiple rows and never turns protocol inconsistency into a closed lookup outcome. | string | Yes | — |
|
sources.*.factSchemaFor http-json: Bundle-relative closed JSON Schema the extraction script's output facts must exactly satisfy on a match outcome. Unlike sources.*.responseSchema, this schema validates what the script returns, not what the source sent. For sqlite-extract: Bundle-relative closed JSON Schema the extraction script's output facts must exactly satisfy on a match outcome. Unlike sources.*.responseSchema, this schema validates what the script returns, not what the statement returned. | string | Yes | — |
|
sources.*.maximumExtractAgeSecondsBounds how far the extract's published instant may lag the evaluation instant before the request fails as stale. Staleness tolerance belongs to the bundle because it is a property of the concept being asserted rather than of the deployment, and the runtime reads the published instant from the extract's reserved metadata table, never from the file's modification time. | integer | Conditional | — |
|
sources.*.postureFor http-json: Describes how much of the underlying record crosses the source wire, weakest at record-transformed and strongest at source-derived. A chained search-then-fetch requirement can claim no stronger minimization than the weaker of its two sources' postures. For sqlite-extract: Describes how much of the underlying record crosses the source boundary, weakest at record-transformed and strongest at source-derived. A statement that aggregates in SQL claims source-derived honestly, because only the aggregate leaves the statement. | string | Yes |
| — |
sources.*.requestFor http-json: The one fixed evidence-data request plan for this source; a preparation script, a caller, and a source response hold no authority over method, path, headers, redirects, bounds, or request count. For sqlite-extract: The one fixed statement plan for this source; a preparation script, a caller, and the extract itself hold no authority over the statement text, the declared columns, the parameters, or the bounds. | object | Yes | — | — |
sources.*.request.adapterParametersFor http-json: Closed non-secret constants supplied to both the preparation and the extraction script, rejected at bundle load when they fall outside adapterParametersSchema. For sqlite-extract: Closed non-secret constants supplied to the extraction script, and to the preparation script when one is declared, rejected at bundle load when they fall outside adapterParametersSchema. | object | Conditional | — |
|
sources.*.request.adapterParameters.*Map valueFor http-json: One constant read by both the preparation and the extraction script, which may itself nest further parameter values. For sqlite-extract: One constant read by the scripts, which may itself nest further parameter values. | array | boolean | integer | object | string | No | — |
or No bound or
or
or
or
|
sources.*.request.adapterParameters.*.*Map valueOne member of a parameter object, which is a parameter value in turn, so the parameter shape nests rather than flattening. | — | Conditional | — |
|
sources.*.request.adapterParameters.*[]Array itemOne element of a parameter array, which is a parameter value in turn, so the parameter shape nests rather than flattening. | — | Conditional | — | — |
sources.*.request.adapterParametersSchemaFor http-json: Bundle-relative closed JSON Schema for the parameter set, whose required-equals-properties rule turns an undeclared or missing parameter into a startup failure. For sqlite-extract: Bundle-relative closed JSON Schema for the parameter set, whose required-equals-properties rule turns an undeclared or missing parameter into a startup failure. A non-empty adapterParameters without it fails startup. | string | Conditional | — |
|
sources.*.request.columnsCloses the result shape by naming every column the statement returns and the type each carries, in order. A result whose column count, names, or value types differ fails as a source-protocol error, so a statement edited without its declaration cannot silently change what the extraction script sees. | array | Conditional | — |
|
sources.*.request.columns[]Array itemOne declared result column, whose name is unique across the declaration and opaque to Rust. | object | Conditional | — | — |
sources.*.request.columns[].nameName this column carries into the result object, unique across the declaration and opaque to Rust; it need not equal the column's name in the extract. | string | Conditional | — |
|
sources.*.request.columns[].typeExact value type Rust admits for this column. A null is admitted for any declared type, and any other mismatch fails as a source-protocol error rather than being coerced. | string | Conditional |
| — |
sources.*.request.concurrencyLimitFor http-json: Bounds how many evaluations may hold an outbound request to this source at once, and waiting for that admission is bounded by timeoutMilliseconds. For sqlite-extract: Bounds how many evaluations may hold a statement against this extract at once, and waiting for that admission is bounded by timeoutMilliseconds. | integer | Yes | — |
|
sources.*.request.fixedHeadersOrdered non-secret header constants sent on every request to this source; a script cannot add, remove, or change a header. | array | Conditional | — |
|
sources.*.request.fixedHeaders[]Array itemOne constant name and value pair added to every request to this source, in the order declared. | object | Conditional | — | — |
sources.*.request.fixedHeaders[].nameHeader field name, rejected at startup when it falls in the authentication, host and routing, cookie, body framing, content length or type, connection, forwarding, proxy, or tracing families Rust owns. | string | Conditional | — |
|
sources.*.request.fixedHeaders[].valueConstant value sent verbatim, with any control character rejected at startup, which closes header injection through configuration. | string | Conditional | — |
|
sources.*.request.maximumCellBytesCaps one returned value, so a single oversized cell fails the request rather than entering the response. A cell far past this bound is refused by the engine, on the length recorded beside it, before its content is read at all. | integer | Conditional | — |
|
sources.*.request.maximumResponseBytesFor http-json: Caps the response body read from this source before parsing and projection, so an oversized response fails as a transport failure rather than being parsed. For sqlite-extract: Caps the assembled result before projection, so an oversized result fails rather than being projected. | integer | Yes | — |
|
sources.*.request.maximumRowsCaps the rows the statement may return before the request fails, so a statement that matches more broadly than intended fails rather than moving a bulk result into the runtime. | integer | Conditional | — |
|
sources.*.request.maximumStatementStepsCaps the virtual-machine steps the statement may take, which bounds work the wall clock does not: a scan that is slow because it is large is stopped by this bound rather than by the timeout. | integer | Conditional | — |
|
sources.*.request.methodFixes the HTTP method for every request to this source; a GET source must also set preparationLimits.jsonBody to forbidden. | string | Conditional |
| — |
sources.*.request.parameterBindingsStates where each named statement parameter's value comes from, so no value reaches the statement by string substitution. A parameter has one origin and exactly one: a selector parameter is filled from the authorized selector field it names and from nothing else, and a prepared parameter is filled by the preparation script and by nothing else. A parameter the statement uses and no binding supplies fails the request, as does a binding the statement never names. The reserved name evidence_now may not be bound, because Rust binds it. | object | Conditional | — |
|
sources.*.request.parameterBindings.*Map valueOne parameter's tagged binding, filling exactly one named statement parameter from a value Rust has already validated. | object | Conditional | — |
or No bound |
sources.*.request.parameterBindings.*.fieldExact field of that profile whose resolved value Rust binds to the parameter. | string | Conditional | — |
|
sources.*.request.parameterBindings.*.kindFor selector: Selects the binding origin. This parameter is filled from the authorized selector field named below and from nothing else, so the preparation script cannot stand in for it. For prepared: Selects the binding origin. This parameter is filled by the preparation script and by nothing else, which is how a value no selector holds, such as a normalized reference or a derived bound, reaches the statement. It names no selector, because naming one would give the parameter a second origin, and the request fails if the script returns no value for it. | string | Conditional |
| — |
sources.*.request.parameterBindings.*.profileSelector profile the value is taken from, which must be an alternative that role declares. | string | Conditional | — |
|
sources.*.request.parameterBindings.*.roleSubject role the value is taken from, which must be one the request's selectorInputs declares. | string | Conditional | — |
|
sources.*.request.pathFixed normalized absolute path used for every request to this source; a source declares this or pathTemplate and never both. | string | Conditional | — | No bound or
|
sources.*.request.pathBindingsSupplies each pathTemplate placeholder with a Rust-resolved value, and a script chooses neither a binding origin nor a path value. | object | Conditional | — | No bound or
|
sources.*.request.pathBindings.*Map valueOne placeholder's tagged binding, filling exactly one complete path segment from a value Rust has already validated. | object | Conditional | — |
or No bound |
sources.*.request.pathBindings.*.fieldNames the selector field or prior-fact property whose value fills the placeholder; a value carrying /, \, %, a control, ., or .. is rejected, which closes path traversal and segment injection. | string | Conditional | — |
|
sources.*.request.pathBindings.*.fromChooses whether Rust reads the placeholder value from an already authorized selector or from a scalar prior fact, and a prior-fact binding is accepted only on a fetch source. | string | Conditional |
| — |
sources.*.request.pathBindings.*.profileSelector profile the bound field belongs to; the same role, profile, and field must also be declared in selectorInputs, or the source is rejected at startup. | string | Conditional | — |
|
sources.*.request.pathBindings.*.roleSubject role whose authorized selector supplies the value; every selector set the request can activate must carry this role and profile, or plan compilation refuses the source. | string | Conditional | — |
|
sources.*.request.pathTemplateFixed absolute path whose placeholders each occupy one complete segment and are expanded by Rust; a template carrying a scheme, authority, query, fragment, empty segment, or dot segment fails startup. | string | Conditional | — | No bound or
|
sources.*.request.preparationLimitsFor http-json: Channel policy and output bounds Rust applies to the request parts a preparation script returns, all checked before credentials are resolved or the source is contacted. For sqlite-extract: Output bounds Rust applies to what a preparation script returns, declared with prepareScript and never alone. | object | Conditional | — | — |
sources.*.request.preparationLimits.jsonBodyDecides whether a preparation script may, must, or must not return a JSON body, where JSON null counts as absent and an empty object or array counts as present. | string | Conditional |
| — |
sources.*.request.preparationLimits.maximumCollectionItemsCaps the entries in each array and object of the prepared JSON body; a body over the cap fails preparation and no request is made. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumJsonDepthCaps the nesting depth of the prepared JSON body; a deeper body fails preparation and no request is made. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumNormalizedBytesCaps the serialized size of the complete request parts, query pairs and body together, so the outbound request stays bounded whichever channel a script fills. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumParameterValueBytesCaps one returned parameter value. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumParametersCaps how many parameters a preparation script may return. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumQueryNameBytesCaps the length of each query-pair name a preparation script returns, applied before the pair is percent-encoded. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumQueryPairsCaps how many query pairs a preparation script may return, bounding the query string the source receives. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumQueryValueBytesCaps the length of each query-pair value a preparation script returns, applied before the pair is percent-encoded. | integer | Conditional | — |
|
sources.*.request.preparationLimits.maximumStringBytesCaps every string a preparation script returns, covering query names and values as well as JSON body strings and member names. | integer | Conditional | — |
|
sources.*.request.preparationLimits.queryDecides whether a preparation script may, must, or must not return query pairs, where required means at least one pair. Setting this key and jsonBody both to forbidden fails startup, because one output channel must stay usable. | string | Conditional |
| — |
sources.*.request.prepareScriptFor http-json: Bundle-relative Rhai script implementing prepare/2, the only step that turns the minimized authorized selectors, closed parameters, and any prior facts into ordered query pairs and at most one JSON body. For sqlite-extract: Bundle-relative Rhai script implementing prepare/2. A statement source usually declares neither this nor preparationLimits, because most parameters name the selector field they come from; a source declares both together or neither, and only where it also declares a prepared parameter for the script to fill. | string | Conditional | — |
or No bound |
sources.*.request.projectionFor http-json: Allowlist of response leaves Rust retains, alongside the containers needed to reach them, so an extraction script never observes a field the source returned but the bundle did not select. For sqlite-extract: Restates the statement result shape for the shared projection boundary. It must preserve every declared row column, either through /rows, /rows/*, or each /rows/*/<column> path, and may additionally retain reviewed extract metadata. | array | Yes | — |
|
sources.*.request.projection[]Array itemOne extended JSON Pointer whose * segment visits every element of the current array, with no numeric index, recursive descent, filter, predicate, union, or script-computed path admitted. | string | No | — |
|
sources.*.request.redirectsRefuses to follow a redirect, so a source response cannot move the request to a different origin; a redirect is classed as a transport failure. | string | Conditional |
| — |
sources.*.request.selectorInputsFor http-json: Closes the minimized authorized selector alternatives a preparation script can see; an empty array is accepted only on a fetch source. For sqlite-extract: Closes the minimized authorized selector alternatives this source's parameter bindings may draw on; an empty array is accepted only on a source that binds no selector. | array | Yes | — |
|
sources.*.request.selectorInputs[]Array itemFor http-json: One subject role together with the alternative profiles and exact field sets a preparation script may receive for that role. For sqlite-extract: One subject role together with the alternative profiles and exact field sets a binding may name for that role. | object | No | — | — |
sources.*.request.selectorInputs[].alternativesClosed set of profile and field combinations permitted for the role; the runtime materializes only the combination the matched authority grant carries, never the union of every alternative declared. | array | Yes | — |
|
sources.*.request.selectorInputs[].alternatives[]Array itemOne permitted selector profile paired with the exact field subset that alternative exposes. | object | No | — | — |
sources.*.request.selectorInputs[].alternatives[].fieldsExact subset of the named profile's declared fields this alternative exposes, which is how a consumer is handed less than the authorized selector carries. | array | Yes | — |
|
sources.*.request.selectorInputs[].alternatives[].fields[]Array itemOne selector field name, which the named profile must declare or the bundle is rejected at startup. | string | No | — |
|
sources.*.request.selectorInputs[].alternatives[].profileSelector profile this alternative admits for the role; a profile absent from selectorProfiles is rejected at startup. | string | Yes | — |
|
sources.*.request.selectorInputs[].roleSubject role this selector input covers, unique across the declaration; the runtime resolves request subjects by role rather than by array position. | string | Yes | — |
|
sources.*.request.statementBundle-relative SQL file holding exactly one statement, hash-identified like every other bundle artifact and reviewed with the bundle. A second statement in the file fails the request, and the statement text is fixed: no caller, script, or extract contributes to it. | string | Conditional | — |
|
sources.*.request.timeoutMillisecondsFor http-json: Bounds each phase of one attempt at this source separately, carrying its whole value into every one: concurrency admission, any wait on the token single-flight boundary, and the HTTP exchange. It is not one deadline across the attempt, so an attempt that waits at one phase and then runs the next spends the bound again, and its worst-case wall clock is a multiple of this value rather than this value. For sqlite-extract: One absolute deadline for an attempt at this source, covering concurrency admission, blocking-worker queueing, and statement execution. Time spent in an earlier phase reduces what remains for every later phase. | integer | Yes | — |
|
sources.*.responseSchemaFor http-json: Bundle-relative closed JSON Schema the projected source response must satisfy before sources.*.extractScript runs; a response outside this shape fails as a source-protocol error and no script runs. Unlike sources.*.factSchema, this schema may require fewer members than it declares and may mark a leaf nullable, because projection can legitimately drop or null a value the record did not carry. For sqlite-extract: Bundle-relative closed JSON Schema the projected statement result must satisfy before sources.*.extractScript runs; a result outside this shape fails as a source-protocol error and no script runs. Unlike sources.*.factSchema, this schema may require fewer members than it declares and may mark a leaf nullable, because a declared column may legitimately be null in the extract. | string | Yes | — |
|
sources.*.tlsTrustProfileLogical name resolved to an exact private certificate authority file bound in runtime.yaml. Omission trusts only configured system roots, and the profile is rejected outright when sources.*.authentication.kind is none. | string | Conditional | — |
|
sources.*.transportFor http-json: Selects the HTTP-plus-JSON transport, which reaches a fixed HTTPS origin over the network under one request and response contract for method, media type, and body shape. The tag chooses the shape of the whole source, so a key belonging to another transport is an unknown key here rather than an ignored one. For sqlite-extract: Selects the statement transport, which runs one reviewed SQL statement against a read-only SQLite extract file mounted beside the process. There is no origin, no credential, and no network hop, so the keys the HTTP transport needs for those are unknown keys here rather than ignored ones. | string | Yes |
| — |
subjectBindingKeys the audience- and purpose-scoped subject bindings an assertion carries in place of selector values, derived over the complete canonical role, profile, and value set rather than as per-field hashes. | object | Yes | — | — |
subjectBinding.keyVersionScopes each derived binding and appears in the binding value, so a new version changes every binding a relying party already retains as an expectation. | integer | Yes | — |
|
subjectBinding.secretRefPoints at the file secret keying every subject binding; that reference and its resolved bytes must both differ from the audit master, and a match fails startup. | string | Yes | — |
|
versionSelects the bundle grammar the rest of this document is read against, and a version the runtime does not implement is rejected at startup. | integer | Yes |
| — |
runtime.yaml
Frozen Version 1 contract
Generated from products/evidence/contracts/runtime.schema.yaml. 38 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
acquisitionCapabilitiesGated acquisition kinds this deployment enables, the operator half of the same two-sided gate the bundle declares. Omission and an explicit empty list both enable nothing.Runtime check: A bundle whose requirement needs a gated acquisition kind absent from this list is refused at startup, before the deployment serves anything. | array | No | — |
|
acquisitionCapabilities[]Array itemOne gated acquisition kind this deployment permits; a bundle needing a kind absent here is refused before the listener binds. | string | No |
| — |
auditStorageGroups the physical destination and size bound for the audit log this process writes; the log format, pseudonymization key, and fail-closed policy are governed by the bundle's audit section, not by this one. | object | Yes | — | — |
auditStorage.maximumFileBytesCaps how large the active audit segment file may grow before the runtime seals it and starts a new one; a single audit record whose own size exceeds this bound can never be written, and the request that would have produced it fails rather than being audited incompletely. | integer | Yes | — |
|
auditStorage.pathAbsolute path to the append-only keyed-JSONL audit file on durable, operator-owned storage; this physical destination is process-local and is not chosen by the bundle's governed audit policy. | string | Yes | — |
|
bundleDirectorySelects the one governed bundle directory this process loads at startup; no alternate, overlay, or fallback bundle path exists for a running deployment. | string | Yes | — |
|
listenerGroups the network binding and per-request admission limits for the process's evidence endpoint; metricsListener, when present, is an entirely separate binding with its own limits. | object | Yes | — | — |
listener.bindHostNumeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address. Unspecified, multicast, public, and hostname values are prohibited.Runtime check: Parsed as an IP address and accepted only when Rust classifies it as loopback, private IPv4, or unique-local IPv6. | string | Yes | — |
|
listener.maximumConcurrentRequestsSizes the fixed admission semaphore for concurrent evidence requests; a request that cannot acquire a slot within listener.requestTimeoutMilliseconds receives a service-unavailable response instead of queuing without bound. | integer | Yes | — |
|
listener.maximumRequestBytesCaps accepted request body size; a request whose declared or actual length exceeds this bound is rejected as malformed before evidence evaluation begins. | integer | Yes | — |
|
listener.portTCP port the process binds for the evidence API alongside listener.bindHost; port 0, which would ask the kernel for an arbitrary ephemeral port instead of naming one, is refused. | integer | Yes | — |
|
listener.requestTimeoutMillisecondsBounds admission-slot acquisition and request-body collection; once protected evaluation starts, this timer no longer cancels it, and source and OIDC boundaries carry their own separate limits. | integer | Yes | — |
|
listener.shutdownGraceMillisecondsOperational target for graceful shutdown to finish within; it does not cancel a request already inside protected evaluation, so audit and signing invariants complete even if shutdown outlives this grace period. | integer | Yes | — |
|
listener.tlsTerminationDeclares that TLS terminates at an operator-controlled upstream in front of this listener; the runtime accepts no other value and exposes no direct-TLS or insecure mode of its own. | string | Yes |
| — |
listener.trustProxyIdentityHeadersFixes the listener to ignore proxy-supplied identity headers; authenticated identity and authority always come from the verified access token, never from a header a network intermediary can set. | boolean | Yes |
| — |
metricsListenerOptional operator-only telemetry listener serving GET /metrics. Absent means the deployment serves no metrics endpoint, which is the default. This listener is a separate binding from the evidence listener and is not described by the public evidence contract.Runtime check: Rejected at startup when bindHost and port together repeat the evidence listener binding. | object | No | — | — |
metricsListener.bindHostNumeric loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address. Unspecified, multicast, public, and hostname values are prohibited.Runtime check: Parsed as an IP address and accepted only when Rust classifies it as loopback, private IPv4, or unique-local IPv6. | string | Yes | — |
|
metricsListener.portTCP port for the optional metrics listener; paired with metricsListener.bindHost, it must not repeat the evidence listener's exact host-and-port binding. | integer | Yes | — |
|
outboundTlsGroups outbound TLS trust for calls to configured sources; it can add private certificate authorities through named trust profiles but carries no setting to weaken hostname verification or skip TLS. | object | Yes | — | — |
outboundTls.systemRootsFixes the system certificate authority store as always trusted for outbound calls; because Version 1 has no way to disable it, a source's public certificate must still chain to a trusted root even when a private trust profile also applies. | boolean | Yes |
| — |
outboundTls.trustProfilesClosed map of private certificate-authority bundles a source may reference by logical id; the set of ids present here must exactly match the tlsTrustProfile names the bundle's sources declare, with no extra or missing profile. | object | Yes | — |
|
outboundTls.trustProfiles.*Map valueOne named private trust profile, binding a logical id a source's tlsTrustProfile reference names to the certificate-authority bundle used only for that source's outbound connections. | object | No | — |
|
outboundTls.trustProfiles.*.caBundleFileAbsolute path to one bounded PEM file of trust anchors, loaded and validated at startup; changing its bytes requires a restart and changes the computed runtime digest. | string | Yes | — |
|
secretProvidersConfigures how a secret:file/... reference resolves to bytes at startup; it supplies the storage location only, and which secret each governed field names is fixed by the bundle, not by this section. | object | Yes | — | — |
secretProviders.fileDeclares the file-based secret provider and its root directory; Version 1 defines no other provider kind, so every secret:file/name reference resolves through this one path. | object | Yes | — | — |
secretProviders.file.rootAbsolute base directory every secret:file/name reference resolves beneath; each name is one bounded path component opened relative to this root, and the opened file is checked for type, ownership, mode, and link count before its bytes are read. | string | Yes | — |
|
signerBinds the process to the private-key transport that produces every signature over the bundle's governed active public key; it can select and configure that transport but cannot change the governed key set or signing algorithm. | object | Yes | — | — |
signer.keyNameNames the specific key within signer.mount this signer calls; combined with signer.mount and signer.keyVersion, it reaches exactly one pinned Transit key. | string | Conditional | — |
|
signer.keyVersionPins signing to one exact Transit key version rather than a latest alias, so a provider-side rotation cannot silently replace the key bytes behind an unchanged kid. | integer | Conditional | — |
|
signer.kindSelects the signer transport for this deployment: local-jwk resolves a file-provider secret directly, transit calls a workload-local signing proxy over a Unix socket; only the kind matching the bundle's assurance profile is accepted at startup. | string | Yes |
| — |
signer.mountNames the Transit secrets-engine mount this signer calls; it is a path segment in the local Transit-proxy request URL, not a filesystem location. | string | Conditional | — |
|
signer.privateKeyRefNames the file-provider secret holding the local signing private key material, read only when signer.kind is local-jwk; the value is a reference, and configuration never carries the key bytes themselves. | string | Conditional | — |
|
signer.timeoutMillisecondsBounds how long the runtime waits on each call to the Transit signing proxy; because a transit signer keeps no local fallback key, a call that exceeds this bound fails the request rather than blocking it indefinitely. | integer | Conditional | — |
|
signer.unixSocketPathAbsolute Unix socket path used to reach the workload-local Transit signing proxy; the runtime supplies no provider token over this connection, because token custody and renewal stay with the proxy. | string | Conditional | — |
|
sourceExtractsClosed map of process-local extract files a source may read by logical name; the set of names present here must exactly match the extractProfile names the bundle's extract sources declare, with no extra or missing name. Omission binds none, which is what a runtime file for a bundle with no extract source says. | object | No | — |
|
sourceExtracts.*Map valueOne named extract binding, joining a logical name a source's extractProfile reference declares to the process-local file that holds it, so the reviewed bundle names what it reads and the operator decides where that file sits. | object | No | — |
|
sourceExtracts.*.pathAbsolute path to one read-only regular file, validated at startup and digested without being read into memory; it must be neither a symbolic link nor writable, because the statement executor opens it as immutable, and its digest changes the computed runtime digest. | string | Yes | — |
|
versionPins the runtime document to Version 1 of this grammar; the loader rejects any other value, so a future incompatible runtime shape is never read as if it were this one. | integer | Yes |
| — |
questions/<name>.yaml
Adopter tooling, not frozen
Generated from crates/registry-evidencectl/schemas/authoring/question.schema.json. 55 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
answers | array | Yes | — | — |
answers[]Array itemOne governed concept a question answers, and the shape of that answer. | object | No | — | — |
answers[].concept | string | Yes | — | — |
answers[].id | null | string | No | — | — |
answers[].maximum | integer | null | No | — |
|
answers[].maximumSerializedBytes | integer | null | No | — |
|
answers[].minimum | integer | null | No | — |
|
answers[].schema | null | string | No | — | — |
answers[].sdJwtVcHow an answer appears in the SD-JWT VC serialization of a response. | null | object | No | — | — |
answers[].sdJwtVc.claim | string | Conditional | — | — |
answers[].sdJwtVc.disclosureWhere a projected claim sits in the disclosure structure. | string | Conditional |
| — |
answers[].typeThe shape of one answer. | string | Yes |
| — |
answers[].values | array | No | — | — |
answers[].values[]Array item | string | No | — | — |
derivation | string | Yes | — | — |
disclosureWhich of a question's concepts a response may carry. | object | Yes | — | — |
disclosure.allow | array | Yes | — | — |
disclosure.allow[]Array item | string | No | — | — |
governanceThe published description of what a question decides and under what rules. | null | object | No | — | — |
governance.disclosureFamilies | array | Conditional | — | — |
governance.disclosureFamilies[]Array item | string | Conditional | — | — |
governance.evidenceType | string | Conditional | — | — |
governance.fixtures | string | Conditional | — | — |
governance.kindWhat kind of rule a question's requirement is. | string | Conditional |
| — |
governance.observationTimezone | string | Conditional | — | — |
governance.referenceFrameworks | array | Conditional | — | — |
governance.referenceFrameworks[]Array item | string | Conditional | — | — |
governance.requirement | string | Conditional | — | — |
governance.validitySeconds | integer | Conditional | — |
|
id | string | Yes | — | — |
purpose | string | Yes | — | — |
question | string | Yes | — | — |
responseFormats | array | No | — | — |
responseFormats[]Array itemA serialization an answer may be returned in. | string | No |
| — |
sourceWhere a question reads from: a named source, or an operation of the
project's own OpenAPI description together with the facts it projects. | object | Yes | — | — |
source.collectionBounds | object | No | — | — |
source.collectionBounds.*Map value | integer | No | — |
|
source.facts | array | No | — | — |
source.facts[]Array itemOne value projected out of a source response and handed to the derivation. | object | No | — | — |
source.facts[].combineHow many values a fact's path is expected to reach. | string | Yes |
| — |
source.facts[].name | string | Yes | — | — |
source.facts[].path | string | Yes | — | — |
source.operation | null | string | No | — | — |
source.ref | null | string | No | — | — |
subjectOne party a question is asked about. | null | object | No | — | — |
subject.derivation | boolean | Conditional | — | — |
subject.profile | null | string | Conditional | — | — |
subject.role | string | Conditional | — | — |
subject.selector | string | Conditional | — | — |
subjects | array | No | — | — |
subjects[]Array itemOne party a question is asked about. | object | No | — | — |
subjects[].derivation | boolean | No | — | — |
subjects[].profile | null | string | No | — | — |
subjects[].role | string | Yes | — | — |
subjects[].selector | string | Yes | — | — |
evidence-project.yaml
Adopter tooling, not frozen
Generated from crates/registry-evidencectl/schemas/authoring/project-marker.schema.json. 2 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
projectThe one kind of project this crate's marker names today. | string | Yes |
| — |
version | integer | Yes | — |
|
What this page does not carry
Section titled “What this page does not carry”Each description here states what one key decides, in the sentence the schema itself carries. It
cannot show you how the keys fit together, walk you through authoring a bundle, or explain why a
deployment is shaped the way it is. The deployment grammar is explained in
products/evidence/reference/request-adapter/deployment-projects/CONFIG.md. The published
Evidence authoring form reference documents
the authoring keys in the context of a whole project. Start with
Configure Evidence Gateway, or follow
Connect a published SQLite extract for that transport’s
complete authoring and deployment path.
A key path that this page lists is not a deployment that runs. Schema validity is one gate.
Runtime, bundle, secret, and audit posture is a separate gate that evidencectl doctor reports,
and fixture results are a third that evidencectl fixtures run reports.