Registry Evidence configuration reference

Look up any key of a file Registry Evidence (Evidence) reads: the deployment bundle and runtime.yaml, and the evidence.yaml, target, and target authority documents you write. Each entry gives the key’s type, whether it is required, its accepted values and bounds, and the schema’s own sentence on what the key decides.

Contract status

Schema	Status	Source
bundle/evidence.yaml, runtime.yaml	Frozen Version 1 contract	bundle.schema.yaml and runtime.schema.yaml
evidence.yaml, target, target authority and local tooling documents	Adopter tooling, not frozen	Authoring schemas

JSON Schema is not the acceptance path: a document these schemas accept still has to pass evidencectl check, which applies the cross-field, file, and grant rules no schema can express (Build and deploy a Registry Evidence project).

How to read the tables

A property is written name, an array item name[], and a map entry whose name you choose name.*, as in assertionDefinitions.*.acquisition.fetch[]. A recursive definition appears once, where it re-enters itself. Where a key has several alternative shapes, Accepted values is the union of what they accept, and constraints joined by or are alternatives. Required reads Conditional when the rest of the document decides whether you may or must write the key. Bounds under where a rule elsewhere applies tighten whichever alternative you took once the rule’s condition holds: in the bundle, the sources.*.baseUrl of a source authenticating with none must also match the loopback pattern listed there.

• bundle/evidence.yaml Frozen Version 1 contract, 250 key paths
• runtime.yaml Frozen Version 1 contract, 87 key paths
• evidence.yaml Adopter tooling, not frozen, 131 key paths
• access/clients/<id>.yaml Adopter tooling, not frozen, 15 key paths
• mocks/source.yaml Adopter tooling, not frozen, 25 key paths
• source import resolution file Adopter tooling, not frozen, 6 key paths
• <target>.yaml Adopter tooling, not frozen, 144 key paths
• <target>-authority.yaml Adopter tooling, not frozen, 32 key paths

bundle/evidence.yaml

Frozen Version 1 contract

Generated from products/evidence/contracts/bundle.schema.yaml. 250 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
acquisitionCapabilitiesRetired. An empty list is accepted, and ignored, for one release so a file written for 0.44 still loads; any capability is refused. Delete the member: a Source binds a reviewed Adapter pack route, and the pack declares how it reads.	array	No	Not specified	maxItems: 0
apiVersionNames the package configuration grammar the rest of this document is read against; the runtime refuses any other value at startup, so a future incompatible grammar is never read as if it were this one.	string	Yes	id.registrystack.org/formats/evidence/bundle/v1	None specified
assuranceProfileDeclares the governed assurance boundary of the whole package, and the value is visible in every assertion, so an authentic local assertion never satisfies a relying procedure expecting a deployable profile. local is an authoring profile that lets a requirement omit fixtures and disables no other runtime boundary; the deployable profiles require every requirement to reference a fixture suite with complete coverage before the package loads.	string	Yes	evidence-grade local production	None specified
auditGoverns audit pseudonymization for the whole deployment; runtime.yaml contributes only the audit destination.	object	Yes	Not specified	None specified
audit.hashKeyRefPoints at the secret Rust derives the audit pseudonym key from; the same reference cannot also serve subjectBinding.secretRef. Every audit gate is fail closed whatever this section says, so an authorization refusal, access attempt, or disclosure release whose entry cannot be written stops the response instead of being served unaudited.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
audit.hashKeyVersionStamped into every audit pseudonym as its version prefix, so pseudonyms produced under different audit key material stay distinguishable within one audit log.	integer	Yes	Not specified	maximum: 2147483647 minimum: 1
authenticationVerification policy for inbound bearer tokens: the runtime validates each token against these values itself and ignores upstream identity headers.	object	Yes	Not specified	None specified
authentication.oidcThe one OpenID Connect issuer whose access tokens this deployment accepts, and the rules a token from it must satisfy.	object	Yes	Not specified	None specified
authentication.oidc.actorClaimNames the verified claim read as the actor alongside the principal, and omitting the key enables no fallback actor source.	string	No	Not specified	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.algorithmsCloses the set of signature algorithms accepted on an inbound access token, and no algorithm fallback outside the set is permitted.	array	Yes	Not specified	maxItems: 3 minItems: 1 uniqueItems: true
authentication.oidc.algorithms[]Array itemOne signature algorithm the token verifier accepts on an inbound access token.	string	No	ES256 EdDSA RS256	None specified
authentication.oidc.allowInsecureHttpPermits plain HTTP to the issuer and JWKS URI beyond loopback under the local assurance profile only. Deployable bundles require HTTPS for both even when it is set, and a production or evidence-grade bundle that sets it to true is refused. Omission is false.	boolean	No	Not specifiedSchema default, where declared: false	None specified
authentication.oidc.allowedClientsMachine-client admission every bundle decides, matched against the verified token's client_id/azp; never sub. The keyword unrestricted admits every client the issuer vouched for; a list admits exactly the clients it names. An omitted key and an empty list are refused. Audience plus static issuer-governed attributes alone cannot establish that a client was granted this resource's permission, which is what requiredScopes closes.	array | string	Yes	unrestricted	No bound or maxItems: 32 minItems: 1 uniqueItems: true
authentication.oidc.allowedClients[]Array itemOne client identifier admitted to call this deployment.	string	Conditional	Not specified	maxLength: 128 minLength: 1
authentication.oidc.assertionIssuersPer-client assertion-authority admission for a token that carries the platform verifier's registry_assertion_issuer claim, keyed by the client identifier the token's client_id/azp names and naming the issuers that client may present the claim as. Omitting the key applies no rule, so every exchanged token is admitted regardless of the claim. A token that carries no such claim is never affected by this admission.	object	No	Not specified	maxProperties: 32 minProperties: 1
authentication.oidc.assertionIssuers.*Map valueThe issuers one client may present the registry_assertion_issuer claim as.	array	No	Not specified	maxItems: 8 minItems: 1 propertyNames.maxLength: 128 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$ uniqueItems: true
authentication.oidc.assertionIssuers.*[]Array itemOne issuer URL the client may present the claim as.	string	No	Not specified	maxLength: 512 minLength: 1
authentication.oidc.audienceThe one exact audience value an inbound access token must carry to be accepted; it is also the resource this deployment advertises in its protected-resource metadata.	string	Yes	Not specified	maxLength: 512 minLength: 1
authentication.oidc.claimsOptional direct claim-name mapping for the shared contextual-authorization profile. Omission uses the registry_* names defined by the profile. Names remain direct JWT members even when they contain a dot.	object	No	Not specified	None specified
authentication.oidc.claims.actorKind	string	No	Not specifiedSchema default, where declared: "registry_actor_kind"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.approver	string	No	Not specifiedSchema default, where declared: "registry_approver"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantBounds	string	No	Not specifiedSchema default, where declared: "registry_grant_bounds"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantClient	string	No	Not specifiedSchema default, where declared: "registry_grant_client"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantExp	string	No	Not specifiedSchema default, where declared: "registry_grant_exp"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantId	string	No	Not specifiedSchema default, where declared: "registry_grant_id"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantResource	string	No	Not specifiedSchema default, where declared: "registry_grant_resource"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.grantSourceIssuer	string	No	Not specifiedSchema default, where declared: "registry_grant_source_issuer"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.claims.purpose	string	No	Not specifiedSchema default, where declared: "registry_purpose"	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.evidenceAudienceClaimNames the verified claim that fixes the audience an assertion is issued to, and the public request cannot choose another audience.	string	Yes	Not specified	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.issuerExact token issuer an inbound access token must declare, with path-based issuers supported; deployable bundles require HTTPS.	string	Yes	Not specified	format: uri maxLength: 2048 maxLength: 512 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ pattern: ^https?:// and, where a rule elsewhere applies pattern: ^(?:https://.*|http://127\.0\.0\.1:[1-9][0-9]{0,4})$ or pattern: ^https://
authentication.oidc.jwksSourceWhere the verifier fetches issuer signing keys. Evidence accepts only type: uri, a fixed endpoint named in the governed bundle; discovery and static key sets are refused.	object	Yes	Not specified	None specified
authentication.oidc.jwksSource.typeSelects the fixed-endpoint key source, the only one Evidence accepts.	string	Yes	uri	None specified
authentication.oidc.jwksSource.uriFixed endpoint the verifier fetches issuer signing keys from. As an endpoint the operator declares, it inherits the declared issuer's allowance on any origin: it may resolve to a public, private, or loopback address, while cloud-metadata and link-local destinations remain prohibited, DNS is pinned for each fetch, and ambient proxies and redirects are disabled. It requires HTTPS; the local assurance profile also permits HTTP on the exact numeric 127.0.0.1 loopback origin with an explicit port, or elsewhere under allowInsecureHttp.	string	Yes	Not specified	format: uri maxLength: 2048 maxLength: 512 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ pattern: ^https?:// and, where a rule elsewhere applies pattern: ^(?:https://.*|http://127\.0\.0\.1:[1-9][0-9]{0,4}/[^\s?#]*)$ or pattern: ^https://
authentication.oidc.maximumTokenLifetimeSecondsCaps the accepted exp - iat interval, and its presence requires iat and an exp greater than iat.	integer	Yes	Not specified	maximum: 86400 minimum: 1
authentication.oidc.principalClaimThe only claim read as the principal, whose absence denies the request; client_id, azp, request data, and proxy headers are not fallbacks.	string	Yes	Not specified	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.requesterTagsClaimNames the verified claim whose tag list selects which authority profile can match the request.	string	Yes	Not specified	pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$
authentication.oidc.requiredScopesScope gate every bundle decides, read from the verified token's scope set after signature verification and before any authority claim is read. The keyword unrestricted applies no scope gate; a list names the scopes every inbound token must carry. An omitted key and an empty list are refused; a missing scope is never inferred from tags, principal, roles, sub, or request fields.	array | string	Yes	unrestricted	No bound or maxItems: 32 minItems: 1 uniqueItems: true
authentication.oidc.requiredScopes[]Array itemOne RFC 6749 scope-token every inbound token must carry.	string	Conditional	Not specified	maxLength: 256 minLength: 1 pattern: ^[\x21\x23-\x5B\x5D-\x7E]+$
authentication.oidc.revokedKeyIdsEmergency denylist of issuer key identifiers, checked before cached JWKS key selection so a compromised key is refused even while the cache still holds the key.	array	Yes	Not specified	maxItems: 32 uniqueItems: true
authentication.oidc.revokedKeyIds[]Array itemOne issuer key identifier the verifier refuses, whatever the cached JWKS still holds.	string	No	Not specified	maxLength: 256 minLength: 1 pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
authentication.oidc.tlsTrustProfileLogical name resolved to an exact private certificate authority file bound in runtime.yaml, trusted beside the system roots for the jwksSource.uri connection alone. Omission trusts only the system roots, and the profile is rejected outright when jwksSource.uri is a local HTTP origin.	string	No	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
authentication.oidc.tokenTypesAllowlist of the exact typ value an inbound token's protected JWT header must declare.	array	Yes	Not specified	maxItems: 4 minItems: 1 uniqueItems: true
authentication.oidc.tokenTypes[]Array itemOne exact protected-header typ value accepted on an inbound access token.	string	No	application/at+jwt at+jwt	None specified
authorityProfilesComplete authority profiles for a legacy compiled bundle. A normalized project package carries an empty map, and the runtime installs only the separately activated target snapshot after package validation. Exactly one complete authority path may match; overlapping paths deny rather than combining their permissions.	object	Yes	Not specified	maxProperties: 128 minProperties: 0 and, where a rule elsewhere applies maxProperties: 0 or minProperties: 1
authorityProfiles.*Map valueEverything one requester class may ask for. Access is per requester class rather than per client identity, so two clients carrying the same tags have identical access.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
authorityProfiles.*.actorKindRestrict this authority profile to the verified actor kind. An agent without a task grant must use a profile explicitly bound to agent. Normalized target authority must explicitly name a kind inside the definition's actor ceiling; omission cannot turn that ceiling into wildcard authority.	string	No	agent human service	None specified
authorityProfiles.*.grantSourceIssuerExact trusted issuer that supplied the immutable task-grant context before token exchange. Required when any subject uses authenticated-grant.	string	No	Not specified	format: uri maxLength: 512
authorityProfiles.*.grantsComplete set of authorized paths this requester class has. Permissions are never unioned across grants, so one grant must cover an entire request on its own.	array	Yes	Not specified	maxItems: 128 minItems: 1
authorityProfiles.*.grants[]Array itemOne authorized path, binding a single requirement, a single purpose, the audience origin, and the referenced requirement's complete subject-role set.	object	No	Not specified	None specified
authorityProfiles.*.grants[].audienceFromBinds the assertion audience to the requester's verified evidence audience claim, so the public request cannot name another audience. For a normalized definition the resolved audience must also fit its authored audience ceiling before selector values, credentials or sources are accessed.	string	Yes	authenticated-requester	None specified
authorityProfiles.*.grants[].purposeThe one purpose this path authorizes, matched exactly against the request purpose; a purpose the referenced requirement does not declare fails startup.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._:-]{0,127}$
authorityProfiles.*.grants[].requirementThe one requirement this path authorizes, named by its exact requirement URI; a requirement no bundle entry declares fails startup.	string	Yes	Not specified	format: uri maxLength: 512
authorityProfiles.*.grants[].responseFormatsSerializations this path permits, defaulting to signed JWS alone when omitted. Unsigned and SD-JWT VC output each require both the bundle-level responseFormats and the one matched grant to permit them. Holder-bound grants may name only SD-JWT forms; the mandatory signed-JWS package format does not widen this grant.	array	No	Not specified	maxItems: 4 minItems: 1 uniqueItems: true
authorityProfiles.*.grants[].responseFormats[]Array item	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
authorityProfiles.*.grants[].subjectBindingModesSubject-binding modes this path permits, defaulting to audience-scoped alone when omitted or empty. Permitting a serialization is not permitting a binding mode: a path widened to sd-jwt-vc gains no right to issue holder-bound assertions until that mode is named here. A path may name holder-bound alone, which permits nothing else.	array	No	Not specified	maxItems: 2 uniqueItems: true
authorityProfiles.*.grants[].subjectBindingModes[]Array itemOne binding mode this path permits, which is the operator half of a two-sided gate; a requirement declaring a mode no grant for it permits is unreachable and is rejected at startup.	string	No	audience-scoped holder-bound	None specified
authorityProfiles.*.grants[].subjectsAuthorization for the referenced requirement's complete subject-role set; a grant that omits a declared role, or repeats one, fails startup.	array	Yes	Not specified	maxItems: 8 minItems: 1
authorityProfiles.*.grants[].subjects[]Array itemAuthorization for one subject role, fixing which selector profile identifies the subject and where that subject's selector values may originate.	object	No	Not specified	None specified
authorityProfiles.*.grants[].subjects[].roleNames the requirement subject role this authorization covers; a role the requirement's subjectRoles does not declare fails startup, and no role may appear twice in one grant.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
authorityProfiles.*.grants[].subjects[].selectorProfileThe selector profile whose field set identifies this role's subject; a profile the requirement's subjectRoles entry does not permit for the role fails startup.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
authorityProfiles.*.grants[].subjects[].valueClaimsMaps every field of the named selector profile to the claim path in the verified access token that supplies that field's value. Missing, extra, duplicate-target, or invalid claim paths fail startup.	object	Conditional	Not specified	maxProperties: 16 minProperties: 1
authorityProfiles.*.grants[].subjects[].valueClaims.*Map valueClaim path resolved only from the strictly verified access token, so a caller-supplied selector, grant reference, or approval value cannot supply the field.	string	No	Not specified	pattern: ^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*)*$ propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
authorityProfiles.*.grants[].subjects[].valueOriginFixes where this role's selector values originate. A request origin takes values from the closed public request and prohibits valueClaims; authenticated-context rejects caller values and reads the exact valueClaims map; authenticated-grant reads that same map and additionally requires a verified grant whose trusted source issuer, requester client, purpose, and Evidence requirement bound match exactly one authority profile.	string	Yes	authenticated-context authenticated-grant request	None specified
authorityProfiles.*.kindDeclared basis of authority for this profile's grants; a request whose verified token carries an actor claim matches only a delegated profile.	string	Yes	consent delegated explicit-request organizational statutory	None specified
authorityProfiles.*.requesterClientsExact verified OAuth clients allowed to exercise this profile's authenticated-grant paths. Required and nonempty when any subject uses authenticated-grant.	array	No	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
authorityProfiles.*.requesterClients[]Array item	string	No	Not specified	maxLength: 128 minLength: 1
authorityProfiles.*.requesterTagsComplete tag set the claim named by authentication.requesterTagsClaim must contain for this profile to match, so adding a tag narrows the profile rather than widening it.	array	Yes	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
authorityProfiles.*.requesterTags[]Array itemOne tag that must be present in the verified claim; differentiated requirements, purposes, or valueClaims are expressed by issuing different tags rather than by naming individual clients.	string	No	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
issuerCarries the legal issuer identity placed in every assertion, kept separate from the technical provider that operates the process and signs.	object	Yes	Not specified	None specified
issuer.uriLegal issuer URI placed in every assertion as issuedBy, and governance must authorize the provider named in service.providerId to act for that issuer.	string	Yes	Not specified	format: uri maxLength: 512
kindNames the document type; together with apiVersion it tells a governed package configuration apart from every other Registry Stack file.	string	Yes	EvidenceBundle	None specified
maximumHolderBoundBatchSizeCeiling on how many assertions one holder-bound release may carry. Omission means one, so a bundle written before batch release cannot serve a batch; declaring a ceiling this deployment never reaches enables nothing on its own, because each requirement still needs its own holder-bound declaration and a grant that permits the mode.	integer	No	Not specified	maximum: 16 minimum: 1
projectStable normalized EvidenceProject identifier. A package carrying this identifier contains no authority profiles; startup captures a separately activated target authority for this project and exact package digest. Each definition declares all grant-ceiling dimensions and its representation ceiling.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
publicationOptional provider-authored public facts that cannot be derived from the governed service, issuer, response-format, binding-mode, and Evidence Type inventory. When present, the runtime publishes one deterministic closed Registry Discovery description.	object	No	Not specified	None specified
publication.description	string	Yes	Not specified	maxLength: 4096 minLength: 1 pattern: ^[^\s\u0000-\u001F\u007F-\u009F](?:[^\u0000-\u001F\u007F-\u009F]*[^\s\u0000-\u001F\u007F-\u009F])?$
publication.endpointUrlPublic URL Registry Discovery advertises for this Evidence service, with no query or fragment. It requires HTTPS; the local assurance profile also permits HTTP on localhost, 127.0.0.1, or [::1].	string	Yes	Not specified	format: uri maxLength: 2048 maxLength: 512 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
publication.jurisdictions	array	Yes	Not specified	maxItems: 128 minItems: 1 uniqueItems: true
publication.jurisdictions[]Array item	string	No	Not specified	format: uri maxLength: 512
publication.operatorId	string	No	Not specified	format: uri maxLength: 512
publication.publisherId	string	No	Not specified	format: uri maxLength: 512
publication.serviceId	string	Yes	Not specified	format: uri maxLength: 512
publication.title	string	Yes	Not specified	maxLength: 4096 minLength: 1 pattern: ^[^\s\u0000-\u001F\u007F-\u009F](?:[^\u0000-\u001F\u007F-\u009F]*[^\s\u0000-\u001F\u007F-\u009F])?$
rateLimitsGoverns the anti-enumeration budget for authenticated callers, counted against scoped pseudonyms of the principal and the authority rather than against any raw selector value.	object	Yes	Not specified	None specified
rateLimits.burstPerPrincipalCapacity of one principal's request bucket, bounding how many requests may arrive back to back before requestsPerPrincipalPerMinute governs the pace.	integer	Yes	Not specified	maximum: 100000 minimum: 1
rateLimits.failedSelectorAttemptsPerPrincipalAuthorityPerMinuteBudget for selector-resolution failures, checked before source access and consumed only when selector validation itself fails, so repeated probing is refused before it reaches a source.	integer	Yes	Not specified	maximum: 100000 minimum: 1
rateLimits.requestsPerPrincipalPerMinuteRate at which one principal's request budget refills, spread continuously across the minute rather than granted in full at its start.	integer	Yes	Not specified	maximum: 1000000 minimum: 1
requirementsRequirement identifiers and Evidence Type URIs must each be unique across every entry; a repeat of either rejects the whole bundle at startup.	array	Yes	Not specified	maxItems: 128 minItems: 1
requirements[]Array itemOne independently versioned evidence definition; its configuration revision spans only this requirement's own configuration and artifact closure, letting a relying party pin this requirement without depending on the rest of the deployment.	object	No	Not specified	None specified
requirements[].acquisitionFixes this requirement's complete source-request shape to one call over a single source, or to a fixed sequence of calls named here; no response content chooses a different source or an additional call.	object	Yes	Not specified	None specified
requirements[].acquisition.holderPresentedThe holder-presented channel. The definition offers only the signed JWS representation, because a holder-presented assertion answers as a signed flattened JWS.	object	Conditional	Not specified	None specified
requirements[].acquisition.holderPresented.selectorProfilesSelector profiles that select this channel. Each is a profile one of the definition's subject roles allows.	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
requirements[].acquisition.holderPresented.selectorProfiles[]Array item	string	No	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].acquisition.holderPresented.source	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].acquisition.source	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].conceptsDeclares the complete, closed set of values this requirement's assertion may disclose; a value the derivation produces under an identifier absent from this list fails evaluation instead of being disclosed.	array	Yes	Not specified	maxItems: 16 minItems: 1
requirements[].concepts[]Array itemOne value the requirement may disclose, corresponding to exactly one cccev:InformationConcept, and becoming one entry of the assertion's supported values when the derivation produces that value.	object	No	Not specified	None specified
requirements[].concepts[].constraintsClosed bounds a derived value must satisfy before it is accepted into evidence; the allOf branch below that matches the concept's type fixes their exact shape.	object	Conditional	Not specified	maxProperties: 0 or No bound
requirements[].concepts[].constraints.bucketSchemeURI naming the reviewed bucket scheme for a date-bucket or time-bucket concept; paired with schemeVersion, bucketScheme resolves to exactly one codelist artifact, so only the matched bucket code is disclosed and the underlying date, instant, or duration never appears in the assertion.	string	Conditional	Not specified	format: uri maxLength: 512
requirements[].concepts[].constraints.categorySchemeURI naming the reviewed category vocabulary a controlled-category concept's value must belong to; matched against schemeVersion and codelist at startup, it enforces exact category membership and rejects any unreviewed category.	string	Conditional	Not specified	format: uri maxLength: 512
requirements[].concepts[].constraints.codelistBundle-relative path to the closed codelist artifact whose entries fix exact membership for controlled-code, controlled-category, and controlled-code-list concepts, validated at startup.	string	Conditional	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$
requirements[].concepts[].constraints.codelistVersionVersion tag paired with codelist for controlled-code and controlled-code-list concepts that must exactly equal the referenced codelist artifact's own declared version, or the bundle fails to load.	string	Conditional	Not specified	maxLength: 128 minLength: 1
requirements[].concepts[].constraints.maximumInclusive upper bound paired with minimum for bounded-integer and bounded-decimal concepts; a derived value over it fails evaluation instead of being disclosed.	integer | string	Conditional	Not specified	maximum: 9007199254740991 minimum: -9007199254740991 or pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$
requirements[].concepts[].constraints.maximumBytesCaps the disclosed byte length of a controlled-code, controlled-category, or audience-scoped-entity-reference concept's value; a value or projected reference longer than the cap fails validation instead of being truncated.	integer	Conditional	Not specified	maximum: 8192 minimum: 1 or maximum: 1024 minimum: 1
requirements[].concepts[].constraints.maximumItemsInclusive upper bound paired with minimumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a longer derived list fails validation.	integer	Conditional	Not specified	maximum: 64 minimum: 1
requirements[].concepts[].constraints.maximumScaleUpper bound on the number of fractional digits accepted for a bounded-decimal concept's derived value; a finer scale fails validation instead of being rounded.	integer	Conditional	Not specified	maximum: 9 minimum: 0
requirements[].concepts[].constraints.maximumSerializedBytesCaps the serialized JSON byte length of a reviewed-structured-value concept's entire disclosed object; an oversized derived value fails validation before signing.	integer	Conditional	Not specified	maximum: 65536 minimum: 1
requirements[].concepts[].constraints.minimumInclusive lower bound paired with maximum for bounded-integer and bounded-decimal concepts; a derived value under it fails evaluation instead of being disclosed.	integer | string	Conditional	Not specified	maximum: 9007199254740991 minimum: -9007199254740991 or pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$
requirements[].concepts[].constraints.minimumBytes	integer	Conditional	Not specified	maximum: 1024 minimum: 1
requirements[].concepts[].constraints.minimumItemsInclusive lower bound paired with maximumItems on how many items a controlled-code-list or entity-reference-list concept discloses; a shorter derived list fails validation.	integer	Conditional	Not specified	maximum: 64 minimum: 1
requirements[].concepts[].constraints.prefixExact ASCII prefix ending in a dot, underscore, hyphen, colon, slash, or hash. It may contain only ASCII letters, digits, and those six separators.	string	Conditional	Not specified	maxLength: 512 minLength: 1 pattern: ^[A-Za-z0-9._:/#-]*[._:/#-]$
requirements[].concepts[].constraints.schemaURI resolving to exactly one closed JSON Schema artifact in the immutable bundle that a reviewed-structured-value concept's fields are validated against; the schema closes every property, so unexpected or additional JSON in the derived value fails validation.	string	Conditional	Not specified	format: uri maxLength: 512
requirements[].concepts[].constraints.schemeVersionVersion tag that must exactly equal a referenced codelist artifact's own declared version at startup; pairs with categoryScheme for controlled-category concepts and with bucketScheme for date-bucket and time-bucket concepts.	string	Conditional	Not specified	maxLength: 128 minLength: 1
requirements[].concepts[].constraints.uniqueRequires every item in a controlled-code-list or entity-reference-list concept's disclosed list to be pairwise distinct; a duplicate item fails validation instead of being deduplicated or disclosed twice.	boolean	Conditional	true	None specified
requirements[].concepts[].handleStable application-facing key for this output in typed client result maps. It is governed explicitly and is never inferred from the concept URI.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].concepts[].requiredWhether the derivation must produce a value for this concept; a missing required concept fails the whole evaluation, and a missing optional concept is left out of the disclosed supported values.	boolean	Yes	Not specified	None specified
requirements[].concepts[].sdJwtVcOptional per-concept projection that the concept declaration may set only for reviewed-structured-value concepts, selecting how that structured value's fields are exposed as SD-JWT VC disclosures.	object	No	Not specified	None specified
requirements[].concepts[].sdJwtVc.claimPublic claim name substituted for the concept identifier in the SD-JWT VC response; it must be unique within the requirement and cannot collide with a profile-owned claim.	string	Yes	Not specified	pattern: ^[A-Za-z][A-Za-z0-9_]{0,63}$
requirements[].concepts[].sdJwtVc.disclosureFixes where the structured value's field-level disclosures are exposed in the SD-JWT VC claim set: as an always-visible top-level object under sdJwtVc.claim.	string	Yes	top-level	None specified
requirements[].concepts[].typeSelects the concept's closed value shape, which fixes the exact set of keys constraints must declare and no others.	string	Yes	audience-scoped-entity-reference boolean bounded-decimal bounded-identifier bounded-integer controlled-category controlled-code controlled-code-list date-bucket entity-reference-list reviewed-structured-value time-bucket A rule elsewhere fixes this value in some cases.	None specified
requirements[].concepts[].uriStable identifier that names this concept as providesValueFor in the assertion and, unless an sdJwtVc.claim override is declared, is also the concept's claim name in the SD-JWT VC serialization.	string	Yes	Not specified	format: uri maxLength: 512
requirements[].derivationDetermines which Rhai script computes the requirement's concept values as derive/3, and what minimized selector inputs and closed typed parameters that script is allowed to see.	object	Yes	Not specified	None specified
requirements[].derivation.parametersClosed set of adopter-named parameter values available to the requirement's derivation; the map cannot carry secrets or runtime authority.	object	Yes	Not specified	maxProperties: 32
requirements[].derivation.parameters.*Map valueOne named parameter's value, closed to a bounded string, a safe integer, a boolean, one typed canonical decimal, or a bounded array of decimal bucket boundaries whose own bounds reuse that same typed-decimal shape.	array | boolean | integer | object | string	No	Not specified	maxLength: 1024 propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$ or maximum: 9007199254740991 minimum: -9007199254740991 propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$ or propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$ or maxItems: 64 minItems: 1 propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
requirements[].derivation.parameters.*.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value.	string	Conditional	decimal	None specified
requirements[].derivation.parameters.*.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero.	string	Conditional	Not specified	pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$
requirements[].derivation.parameters.*[]Array itemOne decimal bucket boundary in an ordered array parameter, evaluated by the bucket_number primitive to classify a derived decimal into the matching boundary's code; each lower bound must equal the previous boundary's upper bound, and a gap fails validation at startup.	object	Conditional	Not specified	None specified
requirements[].derivation.parameters.*[].codeOutput code returned when a derived decimal falls inside this boundary's interval; duplicate codes across the array fail validation at startup.	string	Conditional	Not specified	pattern: ^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$
requirements[].derivation.parameters.*[].maximumExclusiveExclusive upper bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value.	object	Conditional	Not specified	None specified
requirements[].derivation.parameters.*[].maximumExclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value.	string	Conditional	decimal	None specified
requirements[].derivation.parameters.*[].maximumExclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero.	string	Conditional	Not specified	pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$
requirements[].derivation.parameters.*[].minimumInclusiveInclusive lower bound of this boundary's half-open interval, expressed with the same typed-decimal shape as a scalar parameter value.	object	Conditional	Not specified	None specified
requirements[].derivation.parameters.*[].minimumInclusive.typeLiteral decimal discriminator marking the typed-decimal form, required wherever that form appears and present only alongside value.	string	Conditional	decimal	None specified
requirements[].derivation.parameters.*[].minimumInclusive.valueCanonical decimal text of the typed-decimal form, restricted to exact finite decimal text with no exponent, no leading zero, and no trailing fractional zero.	string	Conditional	Not specified	pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$
requirements[].derivation.scriptBundle-relative Rhai script compiled at startup to expose the requirement's derive/3 entry point before the runtime reaches readiness.	string	Yes	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$
requirements[].derivation.selectorInputsOptional closed set of authorized selector roles the derivation may read; omission means derive/3 receives an empty selector map.	array	No	Not specified	maxItems: 8
requirements[].derivation.selectorInputs[]Array itemDeclares one subject role the derivation may read, together with the closed profile alternatives permitted for that role; only the alternative matching the authorized request subject reaches derive/3.	object	No	Not specified	None specified
requirements[].derivation.selectorInputs[].alternativesClosed set of profile and field combinations permitted for the role; the runtime materializes only the combination the matched authority grant carries, never the union of every alternative declared.	array	Yes	Not specified	maxItems: 16 minItems: 1
requirements[].derivation.selectorInputs[].alternatives[]Array itemOne permitted selector profile paired with the exact field subset that alternative exposes.	object	No	Not specified	None specified
requirements[].derivation.selectorInputs[].alternatives[].fieldsExact subset of the named profile's declared fields this alternative exposes, which is how a consumer is handed less than the authorized selector carries.	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
requirements[].derivation.selectorInputs[].alternatives[].fields[]Array itemOne selector field name, which the named profile must declare or the bundle is rejected at startup.	string	No	Not specified	pattern: ^[a-z][a-z0-9._-]{0,63}$
requirements[].derivation.selectorInputs[].alternatives[].profileSelector profile this alternative admits for the role; a profile absent from selectorProfiles is rejected at startup.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].derivation.selectorInputs[].roleSubject role this selector input covers, unique across the declaration; the runtime resolves request subjects by role rather than by array position.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].disclosureGuardBinds this requirement's release to the reviewed disclosure families a human combined-disclosure review has already assessed.	object	Yes	Not specified	None specified
requirements[].disclosureGuard.familiesNon-empty set of those reviewed family URIs; sharing even one family with another enabled requirement rejects the whole bundle at startup.	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
requirements[].disclosureGuard.families[]Array itemOne reviewed disclosure-family URI; this exact value, not what it represents, is what the startup check compares for reuse across requirements.	string	No	Not specified	format: uri maxLength: 512
requirements[].evidenceTypeExact Evidence Type URI placed in every assertion issued for this requirement; it must be unique across the bundle, and a duplicate rejects the bundle at startup.	string	Yes	Not specified	format: uri maxLength: 512
requirements[].existenceDisclosureGoverns the outward shape of an unresolved outcome: the runtime returns one identical public problem whether the subject was absent, ambiguous, or found with inconsistent derivation inputs, so a caller cannot distinguish the cause from the response.	string	Yes	collapse-unresolved	None specified
requirements[].fixturesBundle-relative path to this requirement's sanitized fixture suite; omitting it is accepted only under assuranceProfile: local, and production or evidence-grade refuse to load without it and its complete case coverage.	string	Conditional	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$
requirements[].grantCeilingPackage-owned authority, actor, value-origin and audience ceilings. The definition's purposes, subject-role selector profiles, representations and subjectBinding supply the remaining dimensions. A target grant can narrow the complete tuple only.	object	Conditional	Not specified	None specified
requirements[].grantCeiling.actorKinds	array	Yes	Not specified	maxItems: 3 minItems: 1 uniqueItems: true
requirements[].grantCeiling.actorKinds[]Array item	string	No	agent human service	None specified
requirements[].grantCeiling.audiences	array	Yes	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
requirements[].grantCeiling.audiences[]Array item	string	No	Not specified	format: uri maxLength: 512
requirements[].grantCeiling.authorities	array	Yes	Not specified	maxItems: 5 minItems: 1 uniqueItems: true
requirements[].grantCeiling.authorities[]Array item	string	No	consent delegated explicit-request organizational statutory	None specified
requirements[].grantCeiling.valueOrigins	array	Yes	Not specified	maxItems: 3 minItems: 1 uniqueItems: true
requirements[].grantCeiling.valueOrigins[]Array item	string	No	authenticated-context authenticated-grant request	None specified
requirements[].handleStable local authoring, inspection and generated-code identifier for this definition. Public requests select its exact Requirement URI; this handle is not a substitute wire identity and is never inferred from that URI.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].kindRequirement classification carried unchanged into every assertion issued for this requirement.	string	Yes	constraint criterion information-requirement	None specified
requirements[].observationTimezoneIANA timezone resolving legal_local_date and legal_local_time from the runtime-supplied observed_at instant; an unrecognized name fails validation, and omitting the field resolves both values in UTC instead.	string	No	Not specified	maxLength: 128 minLength: 1
requirements[].publicCheckExperimental (v1alpha1). Declares that this requirement can answer an unauthenticated certificate check once a target authority activates it. Names the Source fact that carries the check code and the two concepts that form the public answer; the status concept is a controlled category and the fields concept is a reviewed structured value, and they are different concepts. The requirement has one subject role with one selector profile of one field, acquires through one Source, and declares no holder-presented channel. Omitted when the requirement declares no public check, so existing configuration revisions do not change.	object	No	Not specified	None specified
requirements[].publicCheck.checkCodeFactName of the Source fact that carries the check code the caller must present.	string	Yes	Not specified	maxLength: 128 minLength: 1
requirements[].publicCheck.fieldsOutputHandle of the reviewed-structured-value concept that carries the public fields.	string	Yes	Not specified	None specified
requirements[].publicCheck.statusOutputHandle of the controlled-category concept that carries the public status.	string	Yes	Not specified	None specified
requirements[].purposesClosed set of purpose codes this definition can be requested under. One complete target grant must bind an allowed purpose with every declared subject role, selector profile and value origin. Package validity does not itself create target authority.	array	Yes	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
requirements[].purposes[]Array itemOne purpose code eligible for this requirement; an authority-profile grant must name this exact code before a request under it is authorized.	string	No	Not specified	pattern: ^[a-z][a-z0-9._:-]{0,127}$
requirements[].questionHuman-facing presentation; excluded from the definition behavior revision.	string	No	Not specified	maxLength: 2048 minLength: 1
requirements[].referenceFrameworksGoverned legal or procedural framework URIs carried as a whole into every assertion issued for this requirement.	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
requirements[].referenceFrameworks[]Array itemOne governed framework URI in that set, copied unchanged into the assertion alongside its siblings; the runtime does not select or rank among them.	string	No	Not specified	format: uri maxLength: 512
requirements[].representationsDefinition-specific serialization ceiling inside the package responseFormats. The one complete target grant and binding mode must also permit the selected format.Runtime check: Each format must be permitted by the definition binding mode.	array	Conditional	Not specified	maxItems: 4 minItems: 1 uniqueItems: true
requirements[].representations[]Array item	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
requirements[].subjectBindingWhat this requirement's subject bindings are derived under; omission means audience-scoped, which is what every requirement written before this key existed did. A holder-bound requirement is rejected at startup unless the bundle and at least one grant for it both permit a serialization the mode allows, which is sd-jwt-vc or sd-jwt-vc-batch, and unless none of its concepts uses an entity-reference value form, whose pointer only the audience it was scoped to could resolve.	string	No	audience-scoped holder-bound	None specified
requirements[].subjectRolesComplete set of subject positions this requirement resolves; incoming request array order carries no meaning, and resolved subjects are always canonicalized to this array's declaration order before signing.	array	Yes	Not specified	maxItems: 8 minItems: 1
requirements[].subjectRoles[]Array itemOne subject position this requirement resolves; a request supplying a different number of subjects, a duplicate role, or a role this requirement does not declare is unauthorized.	object	No	Not specified	None specified
requirements[].subjectRoles[].cardinalityFixes this subject position to a single resolved value; Evidence Version 1 defines no plural or list-valued role.	string	Yes	one	None specified
requirements[].subjectRoles[].roleDeployment-chosen identifier distinguishing this subject position from the requirement's others; requests, grants, and derivation inputs all address the position by this exact value, never by array position.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9._-]{0,63}$
requirements[].subjectRoles[].selectorProfilesSelector profiles permitted for this subject position; every one of them must be reachable by some authority-profile grant for every code in purposes, or the bundle fails to load.	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
requirements[].subjectRoles[].selectorProfiles[]Array itemOne selector profile id permitted for this position; it must name an entry in the bundle's selectorProfiles map, or the bundle fails to load.	string	No	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
requirements[].uriStable requirement URI a public request names to select this requirement; the runtime looks up requirements by this exact value and no other.	string	Yes	Not specified	format: uri maxLength: 512
requirements[].validitySecondsSets the assertion's validity window measured from issuedAt; the bundle fails to load if this exceeds signing.maximumAssertionValiditySeconds.	integer	Yes	Not specified	maximum: 31536000 minimum: 1
responseFormatsSets the deployment-wide ceiling of response serializations, and omission means [signed-jws]. A bundle that drops signed JWS is rejected at startup, and every other listed format additionally requires the one matched grant's authorityProfiles.*.grants[].responseFormats to permit that format.	array	No	Not specified	contains: signed-jws maxItems: 4 minItems: 1 uniqueItems: true
responseFormats[]Array itemOne permitted serialization of the same assertion, which introduces no separate issuance protocol and no credential state; a format reaches a response only when the bundle and the one matched grant both permit that format.	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
selectorProfilesNamed registry of selector profiles that requirement subject roles and authority-grant subjects reference by id; an id absent from the map fails validation before startup.	object	Yes	Not specified	maxProperties: 128 minProperties: 1
selectorProfiles.*Map valueOne named, closed profile of deployment-defined fields and their combined byte bound; a profile is not an identity type, and possession of its field values does not by itself grant authority.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
selectorProfiles.*.fieldsClosed map of the profile's field declarations, keyed by adopter-chosen names that are opaque to Rust and carry no meaning of their own.	object	Yes	Not specified	maxProperties: 16 minProperties: 1
selectorProfiles.*.fields.*Map valueOne field's exact declaration: Rust matches a supplied value against it verbatim, performing no case folding, normalization, transliteration, tokenization, partial-date matching, or fuzzy scoring.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
selectorProfiles.*.fields.*.codelistPath to the bundled codelist artifact a controlled-code value must belong to; a missing referenced artifact fails bundle loading.	string	Conditional	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$
selectorProfiles.*.fields.*.codelistVersionVersion this field's controlled-code values are pinned to; it must equal the referenced codelist artifact's own version or bundle loading fails.	string	Conditional	Not specified	maxLength: 128 minLength: 1
selectorProfiles.*.fields.*.maximumInclusive upper bound on this field's accepted integer selector value; a submitted value greater than this bound is rejected rather than clamped.	integer	Conditional	Not specified	maximum: 9007199254740991 minimum: -9007199254740991
selectorProfiles.*.fields.*.maximumBytesInclusive upper bound, in UTF-8 bytes, on this field's accepted string or controlled-code value; it cannot exceed the profile's maximumAggregateBytes.	integer	Conditional	Not specified	maximum: 8192 minimum: 1
selectorProfiles.*.fields.*.minimumInclusive lower bound on this field's accepted integer selector value; a submitted value less than this bound is rejected rather than clamped.	integer	Conditional	Not specified	maximum: 9007199254740991 minimum: -9007199254740991
selectorProfiles.*.fields.*.minimumBytesInclusive lower bound, in UTF-8 bytes, on this field's accepted string value; it cannot exceed the field's own maximumBytes.	integer	Conditional	Not specified	maximum: 8192 minimum: 1
selectorProfiles.*.fields.*.typeSelects the field's scalar kind, fixing which other declaration keys are required; a supplied value of a different kind is rejected.	string	Yes	boolean controlled-code date integer string uuid	None specified
selectorProfiles.*.maximumAggregateBytesCaps the summed canonical byte size of every field value resolved for one authorized use of the profile; exceeding it denies the request.	integer	Yes	Not specified	maximum: 8192 minimum: 1
serviceCarries the identity this deployment asserts under: the technical Evidence provider identity placed in evidence and the operator-controlled trust domain of the process.	object	Yes	Not specified	None specified
service.providerIdTechnical provider URI placed in every assertion as providedBy. Enabling sd-jwt-vc outside local assurance requires this value to be the stable HTTPS origin of the deployment, because issuer metadata and the published JWKS URI are derived from that origin.	string	Yes	Not specified	format: uri maxLength: 512 and, where a rule elsewhere applies pattern: ^https://(?:[A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\])(?::[1-9][0-9]{0,4})?$
service.publicOriginExact public origin of this Evidence protected resource. Production and evidence-grade deployments require a canonical HTTPS origin. The local assurance profile also permits canonical HTTP on numeric 127.0.0.1 with an explicit non-zero port for supervised tutorials.	string	Yes	Not specified	format: uri maxLength: 2048 maxLength: 512 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
service.trustDomainScopes the process to one operator-controlled trust domain, whose URI is bound into subject bindings and into requester pseudonym scope, so the same subject yields different pseudonyms under a different trust domain.	string	Yes	Not specified	format: uri maxLength: 512
signingGoverns signature format, active and published key selection, key retirement, and assertion validity; missing signing material fails readiness and no unsigned fallback exists.	object	Yes	Not specified	None specified
signing.activePublicJwkFileNames the bundle-held public JWK the runtime signer's key must equal exactly, proven by one sign-and-verify test before readiness.	string	Yes	Not specified	pattern: ^public-keys/[A-Za-z0-9._-]+\.jwk\.json$
signing.algorithmBinds assertion signatures to ES256 over P-256, and a verifier rejects any protected header alg that differs from the algorithm bound to the trusted key.	string	Yes	ES256	None specified
signing.certificateChainFileOptional PEM certificate chain, leaf first, certifying the active signing key; omission means credentials and the served key set carry no x5c. The file is public material named public-keys/<kid>.chain.pem for the active key's thumbprint, so a rotated or revoked key's chain is never reused. Startup refuses a chain that does not parse, is longer than the platform chain policy allows, has a leaf for a different key, or has a certificate that is not valid at startup. Relying parties validate the chain to their own trust anchors; Evidence's verifier only compares the leaf with a pinned key.	string	No	Not specified	pattern: ^public-keys/[A-Za-z0-9._-]+\.chain\.pem$
signing.formatFixes the wire serialization of a signed assertion to flattened JWS JSON, returned as application/jose+json.	string	Yes	flattened-jws-json	None specified
signing.jwksPathRoute where the deployment serves its public key set; that route is not a trust anchor, because a verifier pins the provider identity and key location through its own governed configuration.	string	Yes	/.well-known/evidence/jwks.json	None specified
signing.maximumAssertionValiditySecondsCeiling every requirements[].validitySeconds must stay within, and the base of the window a retired public key stays published.	integer	Yes	Not specified	maximum: 31536000 minimum: 1
signing.publishedPublicJwkFilesRetains predecessor public keys in the served key set so assertions signed before a rollover still verify, for at least the maximum assertion validity plus the verifier clock skew.	array	Yes	Not specified	maxItems: 32 uniqueItems: true
signing.publishedPublicJwkFiles[]Array itemOne retained public key served beside the active key; an entry that repeats the active key or names a revoked identifier is rejected at startup.	string	No	Not specified	pattern: ^public-keys/[A-Za-z0-9._-]+\.jwk\.json$
signing.revokedKeyIdsEmergency denylist: a listed identifier is excluded from the active set, the published set, and the served key set, and a verifier rejects that identifier before selecting a pinned public key.	array	Yes	Not specified	maxItems: 33 uniqueItems: true
signing.revokedKeyIds[]Array itemOne denied service key, named by its RFC 7638 thumbprint rather than by a provider-assigned key name.	string	No	Not specified	pattern: ^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$
signing.verifierClockSkewSecondsSkew a relying party applies when checking current validity, and the margin added to the maximum assertion validity before a retired public key may be removed.	integer	Yes	Not specified	maximum: 300 minimum: 0
sourceConnectionsReviewed non-secret destination, authentication-authority and trust policy for each named source connection. Runtime material supplies matching credentials, endpoint bindings and trust-anchor files without changing this governed authority.	object	Yes	Not specified	maxProperties: 128 minProperties: 1
sourceConnections.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.endpointsReviewed endpoint policies, one per distinct endpoint name; empty grants no network authority.	array	Yes	Not specified	None specified
sourceConnections.*.endpoints[]Array item	object	No	Not specified	None specified
sourceConnections.*.endpoints[].authentication	object	Yes	Not specified	None specified
sourceConnections.*.endpoints[].authentication.audience	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].authentication.clientAssertionAudience	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].authentication.credentialPlacement	string	Conditional	basic-header form-body	None specified
sourceConnections.*.endpoints[].authentication.resource	string	Conditional	Not specified	format: uri maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].authentication.scope	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].authentication.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
sourceConnections.*.endpoints[].authentication.type	string	Yes	basic none oauth2-client-credentials oauth2-private-key-jwt static-api-key static-authorization	None specified
sourceConnections.*.endpoints[].baseUrlExact reviewed origin and base path, without a query or fragment. The shared engine additionally checks canonical path segments at startup. Deployable assurance profiles require HTTPS. Only local fixtures may use canonical numeric-loopback HTTP; unauthenticated local sources additionally require an origin with an explicit non-zero port.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]://[^?#]+$ pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ or format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ pattern: ^http://(?:127\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|\[::1\])(?::(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:/[^?#]*)?$ and, where a rule elsewhere applies pattern: ^[Hh][Tt][Tt][Pp][Ss]:// or pattern: ^http://(?:127\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.(?:0|[1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])|\[::1\]):(?:[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$
sourceConnections.*.endpoints[].clientIdentity	string	Yes	forbidden required	None specified
sourceConnections.*.endpoints[].endpointA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.endpoints[].tlsTrustProfileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sourcesComplete map of pack-route bindings a requirement can reference by id in its acquisition field, fixed at startup and immune to override by runtime.yaml.	object	Yes	Not specified	maxProperties: 128 minProperties: 1
sources.*Map valueOne digest-pinned Adapter pack and route, the reviewed named connection it uses, and the exact authorized selector fields projected into the route's named inputs.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.connectionNamed governed policy and matching runtime resource owner.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.factSchemaFinal facts schema, equal to the pinned source schema unless a governed projection is selected.	string	Yes	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$ pattern: ^schemas/
sources.*.inputsNamed route inputs projected only from authorized selectors.	object	No	Not specified	None specified
sources.*.inputs.*Map value	object	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
sources.*.inputs.*.selector	object	Yes	Not specified	None specified
sources.*.inputs.*.selector.fieldA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.inputs.*.selector.profileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.inputs.*.selector.roleA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.packExact Adapter pack identity and package-relative captured closure.	object	Yes	Not specified	None specified
sources.*.pack.artifactPrefix	string	Yes	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$ pattern: ^adapter-packs/[a-z][a-z0-9_-]{0,63}/[0-9a-f]{64}$
sources.*.pack.digestA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	string	Yes	Not specified	pattern: ^sha256:[0-9a-f]{64}$
sources.*.pack.idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.pack.version	string	Yes	Not specified	maxLength: 128 minLength: 1 pattern: ^\S+$
sources.*.postureReviewed minimization posture, equal to the pinned route contract.	string	Yes	field-projected record-transformed source-derived A rule elsewhere fixes this value in some cases.	None specified
sources.*.projectionPackage-owned projection of matched native facts under the acquisition deadline.	object	No	Not specified	None specified
sources.*.projection.digestA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	string	Yes	Not specified	pattern: ^sha256:[0-9a-f]{64}$
sources.*.projection.entrypoint	string	Yes	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_]*$
sources.*.projection.script	string	Yes	Not specified	pattern: ^(adapter-packs|adapters|derivations|schemas|codelists|fixtures|queries)/[A-Za-z0-9._/-]+$ pattern: ^derivations/.*\.rhai$
sources.*.routeNamed Evidence source route compiled from the pinned pack.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
subjectBindingKeys the audience- and purpose-scoped subject bindings an assertion carries in place of selector values, derived over the complete canonical role, profile, and value set rather than as per-field hashes.	object	Yes	Not specified	None specified
subjectBinding.keyVersionScopes each derived binding and appears in the binding value, so a new version changes every binding a relying party already retains as an expectation.	integer	Yes	Not specified	maximum: 2147483647 minimum: 1
subjectBinding.secretRefPoints at the secret keying every subject binding; that reference and its resolved bytes must both differ from the audit master, and a match fails startup.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$

runtime.yaml

Frozen Version 1 contract

Generated from products/evidence/contracts/runtime.schema.yaml. 87 key paths. Explained in products/evidence/reference/request-adapter/deployment-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
acquisitionCapabilitiesRetired. An empty list is accepted, and ignored, for one release so a file written for 0.44 still loads; any capability is refused. Delete the member: a Source binds a reviewed Adapter pack route, and the pack declares how it reads.	array	No	Not specified	maxItems: 0
apiVersionNames the grammar this runtime document is written in; the loader refuses any other value, so a future incompatible runtime shape is never read as if it were this one.	string	Yes	id.registrystack.org/formats/evidence/runtime/v1alpha1	None specified
auditChooses where this process writes its audit entries through the shared platform audit writer; the pseudonymization key and its version are governed by the bundle's audit section, not by this one. Every audit gate is fail closed on either destination.	object	Yes	Not specified	None specified
audit.destinationfile, the default, appends each entry durably to path under a single-writer lock and rotates the active file and prunes rotated files; stdout writes each entry as one line on standard output for a collector that owns durability, rotation, and retention.	string	No	file stdout	None specified
audit.pathAbsolute path to the active append-only JSON Lines audit file on durable, operator-owned storage; required for the file destination and refused for stdout. This physical destination is process-local and is not chosen by the bundle.	string	Conditional	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
audit.retentionDaysAge in days after which a rotated file is deleted when the writer opens or rotates; defaults to 90. The active file is never deleted. File destination only.	integer	No	Not specified	maximum: 36500 minimum: 1
audit.rotateBytesSize at which the active file is rotated and a fresh one opened; defaults to 104857600 (100 MiB). File destination only.	integer	No	Not specified	maximum: 4294967295 minimum: 1048576
authoritySelects the separately governed target authority store captured at startup. Required for a normalized project package and forbidden as an authority override of a legacy package. Activation commits one validated snapshot and durable history atomically; the running process keeps its captured authority until a controlled restart.	object	No	Not specified	None specified
authority.rootAbsolute owned directory containing the committed authority-state.json.	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
authority.targetExact governed target identifier matched by the activated authority document.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
kindNames the document type; together with apiVersion it tells an Evidence runtime file apart from any other product's runtime configuration.	string	Yes	EvidenceRuntimeConfig	None specified
listenerGroups the network binding and per-request admission limits for the process's evidence endpoint; metricsListener, when present, is an entirely separate binding with its own limits.	object	Yes	Not specified	None specified
listener.bindNumeric socket address the evidence API listens on, written host:port, with an IPv6 host in brackets ([addr]:port). The default private-address exposure accepts a loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 host. The explicit container-private exposure additionally accepts the unspecified IPv4 or IPv6 wildcard for a container network confined by the operator. Multicast, public, and hostname values are prohibited in both modes, and port 0, which would ask the kernel for an arbitrary ephemeral port instead of naming one, is refused.Runtime check: Parsed as a socket address and its host checked together with listener.networkExposure. Wildcards require the explicit container-private value; public addresses remain prohibited.	string	Yes	Not specified	maxLength: 128 minLength: 1 pattern: ^(?:[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[[0-9A-Fa-f:.]+\]):(?!0+$)[0-9]{1,5}$
listener.maximumConcurrentRequestsSizes the fixed admission semaphore for concurrent evidence requests; a request that cannot acquire a slot within listener.requestTimeoutMilliseconds receives a service-unavailable response instead of queuing without bound.	integer	Yes	Not specified	maximum: 4096 minimum: 1
listener.maximumRequestBytesCaps accepted request body size; a request whose declared or actual length exceeds this bound is rejected as malformed before evidence evaluation begins.	integer	Yes	Not specified	maximum: 1048576 minimum: 1024
listener.networkExposureDeclares the operator-owned network boundary around the listener. Absent preserves the private-address contract used by existing runtime files. container-private permits a wildcard bind only for a container network whose ingress and TLS termination are controlled by the operator; it does not enable public or direct-TLS serving.	string	No	container-private private-address Schema default, where declared: "private-address"	None specified
listener.requestTimeoutMillisecondsBounds admission-slot acquisition and request-body collection; once protected evaluation starts, this timer no longer cancels it, and source and OIDC boundaries carry their own separate limits.	integer	Yes	Not specified	maximum: 30000 minimum: 1
listener.shutdownGraceMillisecondsOperational target for graceful shutdown to finish within; it does not cancel a request already inside protected evaluation, so audit and signing invariants complete even if shutdown outlives this grace period.	integer	Yes	Not specified	maximum: 120000 minimum: 1
listener.tlsTerminationDeclares that TLS terminates at an operator-controlled upstream in front of this listener; the runtime accepts no other value and exposes no direct-TLS or insecure mode of its own.	string	Yes	operator-controlled-upstream	None specified
listener.trustProxyIdentityHeadersFixes the listener to ignore proxy-supplied identity headers; authenticated identity and authority always come from the verified access token, never from a header a network intermediary can set.	boolean	Yes	false	None specified
metricsListenerOptional operator-only telemetry listener serving GET /metrics. Absent means the deployment serves no metrics endpoint, which is the default. This listener is a separate binding from the evidence listener and is not described by the public evidence contract.Runtime check: Rejected at startup when the bind address repeats the evidence listener binding.	object	No	Not specified	None specified
metricsListener.bindNumeric socket address for the optional metrics listener, written host:port. The host must be a loopback, RFC 1918 private IPv4, or RFC 4193 unique-local IPv6 address; unspecified, multicast, public, and hostname values are prohibited, port 0 is refused, and the address must not repeat the evidence listener's binding.Runtime check: Parsed as a socket address and accepted only when Rust classifies its host as loopback, private IPv4, or unique-local IPv6.	string	Yes	Not specified	maxLength: 128 minLength: 1 pattern: ^(?:[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[[0-9A-Fa-f:.]+\]):(?!0+$)[0-9]{1,5}$
outboundTlsGroups outbound TLS trust for calls to configured sources; it can add private certificate authorities through named trust profiles but carries no setting to weaken hostname verification or skip TLS.	object	Yes	Not specified	None specified
outboundTls.systemRootsFixes the system certificate authority store as always trusted for outbound calls; because Version 1 has no way to disable it, a source's or the access-token issuer's public certificate must still chain to a trusted root even when a private trust profile also applies.	boolean	Yes	true	None specified
outboundTls.trustProfilesClosed map of private certificate-authority bundles a source or the access-token issuer may reference by logical id; the set of ids present here must exactly match the tlsTrustProfile names the bundle's sources and authentication declare, with no extra or missing profile.	object	Yes	Not specified	maxProperties: 64
outboundTls.trustProfiles.*Map valueOne named private trust profile, binding a logical id a tlsTrustProfile reference names to the certificate-authority bundle used only for the outbound connections of the source or access-token issuer that names it.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
outboundTls.trustProfiles.*.caBundleFileAbsolute path to one bounded PEM file of trust anchors, loaded and validated at startup; changing its bytes requires a restart before the new trust anchors can be used.	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
packageSelects the one governed package this process verifies and loads at startup; no alternate, overlay, or fallback package path exists for a running deployment.	object	Yes	Not specified	None specified
package.expectedDigestOptional sha256: digest of the package's SHA256SUMS file. When set, startup is refused unless the verified package found at package.root has exactly this digest.	string	No	Not specified	pattern: ^sha256:[0-9a-f]{64}$
package.rootAbsolute path of the governed package directory this process verifies and loads.	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
secretProvidersEnables the providers a secret reference may resolve through; it supplies storage locations only, and which secret each governed field names is fixed by the bundle, not by this section. At least one provider is declared, and a bundle reference naming a provider this section does not enable is refused at startup.	object	Yes	Not specified	minProperties: 1
secretProviders.environmentEnables secret:env/NAME references, read from the process environment when a request needs them. It takes no settings and is written environment: {}; absent means no reference may name the environment.	object	No	Not specified	maxProperties: 0
secretProviders.fileEnables the file-based secret provider and names its root directory; every secret:file/name reference resolves beneath this one path.	object	No	Not specified	None specified
secretProviders.file.rootAbsolute base directory every secret:file/name reference resolves beneath; each name is one bounded path component opened relative to this root, and the opened file is checked for type, ownership, mode, and link count before its bytes are read.	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
signerBinds the process to the private-key transport that produces every signature over the bundle's governed active public key; it can select and configure that transport but cannot change the governed key set or signing algorithm.	object	Yes	Not specified	None specified
signer.attemptTimeoutMillisecondsBounds how long the runtime waits on each call to the Transit signing proxy; because a transit signer keeps no local fallback key, a call that exceeds this bound fails the request rather than blocking it indefinitely.	integer	Conditional	Not specified	maximum: 30000 minimum: 1
signer.keyNameNames the specific key within signer.mount this signer calls; combined with signer.mount and signer.keyVersion, it reaches exactly one pinned Transit key.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
signer.keyVersionPins signing to one exact Transit key version rather than a latest alias, so a provider-side rotation cannot silently replace the key bytes behind an unchanged kid.	integer	Conditional	Not specified	maximum: 4294967295 minimum: 1
signer.mountNames the Transit secrets-engine mount this signer calls; it is a path segment in the local Transit-proxy request URL, not a filesystem location.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9._-]{0,127}$
signer.privateKeyRefNames the file-provider secret holding the local signing private key material, read only when signer.type is local-jwk; the value is a reference, and configuration never carries the key bytes themselves.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
signer.typeSelects the signer transport for this deployment: local-jwk resolves a file-provider secret directly, transit calls a workload-local signing proxy over a Unix socket; only the kind matching the bundle's assurance profile is accepted at startup.	string	Yes	local-jwk transit	None specified
signer.unixSocketPathAbsolute Unix socket path used to reach the workload-local Transit signing proxy; the runtime supplies no provider token over this connection, because token custody and renewal stay with the proxy.	string	Conditional	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
sourceAcquisitionFinite operational budget shared by every pack-route call in one acquisition. Omission uses 5 data operations, 30000 milliseconds and 1048576 response bytes.	object	No	Not specified	None specified
sourceAcquisition.acquisitionDeadlineMilliseconds	integer	Yes	Not specified	maximum: 18446744073709551615 minimum: 1
sourceAcquisition.maximumDataOperations	integer	Yes	Not specified	maximum: 18446744073709551615 minimum: 1
sourceAcquisition.maximumResponseBytes	integer	Yes	Not specified	maximum: 18446744073709551615 minimum: 1
sourceConnectionsProcess-local endpoint, credential and private-network material for each governed source connection. Each mapping key must equal the value's id; startup requires the selected endpoint values to match the governed connection policy exactly.	object	No	Not specified	None specified
sourceConnections.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.allowedPrivateCidrs	array	No	Not specified	uniqueItems: true
sourceConnections.*.allowedPrivateCidrs[]Array item	string	No	Not specified	pattern: ^[0-9a-fA-F.:]+/[0-9]{1,3}$
sourceConnections.*.endpointsOne binding per distinct endpoint name.	array	Yes	Not specified	None specified
sourceConnections.*.endpoints[]Array item	object	No	Not specified	None specified
sourceConnections.*.endpoints[].anonymousHttps	string	No	operator-approved	None specified
sourceConnections.*.endpoints[].attemptTimeoutMilliseconds	integer	No	Not specified	maximum: 18446744073709551615 minimum: 1
sourceConnections.*.endpoints[].baseUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
sourceConnections.*.endpoints[].credential	object	No	Not specified	None specified
sourceConnections.*.endpoints[].credential.assumedLifetimeSeconds	integer	Conditional	Not specified	maximum: 86400 minimum: 1
sourceConnections.*.endpoints[].credential.audience	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].credential.clientAssertionAudience	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].credential.clientAssertionKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.clientIdRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.clientSecretRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.credentialPlacement	string	Conditional	basic-header form-body	None specified
sourceConnections.*.endpoints[].credential.maximumCacheSeconds	integer	Conditional	Not specified	maximum: 86400 minimum: 0
sourceConnections.*.endpoints[].credential.passwordRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.resource	string	Conditional	Not specified	format: uri maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].credential.scope	string	Conditional	Not specified	maxLength: 512 minLength: 1
sourceConnections.*.endpoints[].credential.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
sourceConnections.*.endpoints[].credential.tokenRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.type	string	Yes	basic none oauth2-client-credentials oauth2-private-key-jwt static-api-key static-authorization	None specified
sourceConnections.*.endpoints[].credential.usernameRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].credential.valueRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].endpointAn identifier another system issues, written exactly as its issuer gives it.	string	Yes	Not specified	maxLength: 512 minLength: 1 pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
sourceConnections.*.endpoints[].maximumConcurrency	integer	No	Not specifiedSchema default, where declared: 8	maximum: 256 minimum: 1
sourceConnections.*.endpoints[].maximumResponseBytes	integer	No	Not specified	maximum: 16777216 minimum: 1
sourceConnections.*.endpoints[].mtlsIdentity	object	No	Not specified	None specified
sourceConnections.*.endpoints[].mtlsIdentity.certificateRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].mtlsIdentity.keyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
sourceConnections.*.endpoints[].tlsTrustProfileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.outboundTls	object	No	Not specified	None specified
sourceConnections.*.outboundTls.trustProfiles	object	No	Not specified	None specified
sourceConnections.*.outboundTls.trustProfiles.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceConnections.*.outboundTls.trustProfiles.*.caBundleFile	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$
sourceExtractsClosed map of process-local extract files a source may read by logical name; the set of names present here must exactly match the extractProfile names the bundle's extract sources declare, with no extra or missing name. Omission binds none, which is what a runtime file for a bundle with no extract source says.	object	No	Not specified	maxProperties: 64
sourceExtracts.*Map valueOne named extract binding, joining a logical name a source's extractProfile reference declares to the process-local file that holds it, so the reviewed bundle names what it reads and the operator decides where that file sits.	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sourceExtracts.*.pathAbsolute path to one read-only regular file, validated at startup and digested without being read into memory; it must be neither a symbolic link nor writable, because the statement executor opens it as immutable. Startup binds the exact file identity and content digest for the process lifetime.	string	Yes	Not specified	maxLength: 512 minLength: 2 pattern: ^/(?!/)(?!.*(?:^|/)\.\.?(?:/|$))[^\\\u0000]+$

evidence.yaml

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/project.schema.json. 131 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/evidence/project/v1alpha1	None specified
assertionDefinitions	object	Yes	Not specified	None specified
assertionDefinitions.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.acquisition	object	Yes	Not specified	None specified
assertionDefinitions.*.acquisition.holderPresentedA wallet presentation Source for the selector profiles it lists. A request on one of those profiles acquires only through this Source.	null | object	No	Not specified	None specified
assertionDefinitions.*.acquisition.holderPresented.selectorProfiles	array	Conditional	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
assertionDefinitions.*.acquisition.holderPresented.selectorProfiles[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.acquisition.holderPresented.sourceA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.acquisition.sourceOne reviewed route owns the complete bounded provider interaction for the selector profiles that holderPresented does not claim. Optional only when holderPresented lists every profile the subject roles allow.	null | string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$ or No bound
assertionDefinitions.*.derive	object	Yes	Not specified	None specified
assertionDefinitions.*.derive.functionA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.derive.parameters	object	No	Not specified	None specified
assertionDefinitions.*.derive.selectorInputs	array	No	Not specified	None specified
assertionDefinitions.*.derive.selectorInputs[]Array item	object	No	Not specified	None specified
assertionDefinitions.*.derive.selectorInputs[].alternatives	array	Yes	Not specified	maxItems: 8 minItems: 1
assertionDefinitions.*.derive.selectorInputs[].alternatives[]Array item	object	No	Not specified	None specified
assertionDefinitions.*.derive.selectorInputs[].alternatives[].fields	array	Yes	Not specified	maxItems: 16 minItems: 1 uniqueItems: true
assertionDefinitions.*.derive.selectorInputs[].alternatives[].fields[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.derive.selectorInputs[].alternatives[].profileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.derive.selectorInputs[].roleA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
assertionDefinitions.*.disclosureGuard	Not specified	No	Not specified	None specified
assertionDefinitions.*.existenceDisclosure	string	No	Not specifiedSchema default, where declared: "collapse-unresolved"	None specified
assertionDefinitions.*.fixtures	null | string	No	Not specified	None specified
assertionDefinitions.*.grantCeiling	object	Yes	Not specified	None specified
assertionDefinitions.*.grantCeiling.actorKinds	array	Yes	Not specified	minItems: 1 uniqueItems: true
assertionDefinitions.*.grantCeiling.actorKinds[]Array item	string	No	agent human service	None specified
assertionDefinitions.*.grantCeiling.audiences	array	Yes	Not specified	minItems: 1 uniqueItems: true
assertionDefinitions.*.grantCeiling.audiences[]Array item	string	No	Not specified	None specified
assertionDefinitions.*.grantCeiling.authorities	array	Yes	Not specified	minItems: 1 uniqueItems: true
assertionDefinitions.*.grantCeiling.authorities[]Array item	string	No	consent delegated explicit-request organizational statutory	None specified
assertionDefinitions.*.grantCeiling.valueOrigins	array	Yes	Not specified	minItems: 1 uniqueItems: true
assertionDefinitions.*.grantCeiling.valueOrigins[]Array item	string	No	authenticated-context authenticated-grant request	None specified
assertionDefinitions.*.labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
assertionDefinitions.*.observationTimezone	string	No	Not specifiedSchema default, where declared: "UTC"	None specified
assertionDefinitions.*.outputs	object	Yes	Not specified	maxProperties: 16 minProperties: 1
assertionDefinitions.*.outputs.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.outputs.*.bucketScheme	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.categoryScheme	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.codelist	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.codelistVersion	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.concept	string	Yes	Not specified	None specified
assertionDefinitions.*.outputs.*.descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.maximum	integer | null | string	No	Not specified	maximum: 9007199254740991 minimum: -9007199254740991 or maxLength: 30 minLength: 1 pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$ or No bound
assertionDefinitions.*.outputs.*.maximumBytes	integer | null	No	Not specified	format: uint64 maximum: 8192 minimum: 1
assertionDefinitions.*.outputs.*.maximumItems	integer | null	No	Not specified	format: uint64 maximum: 64 minimum: 1
assertionDefinitions.*.outputs.*.maximumScale	integer | null	No	Not specified	format: uint64 maximum: 9 minimum: 0
assertionDefinitions.*.outputs.*.maximumSerializedBytes	integer | null	No	Not specified	format: uint64 maximum: 65536 minimum: 1
assertionDefinitions.*.outputs.*.minimum	integer | null | string	No	Not specified	maximum: 9007199254740991 minimum: -9007199254740991 or maxLength: 30 minLength: 1 pattern: ^-?(0|[1-9][0-9]*)(\.[0-9]*[1-9])?$ or No bound
assertionDefinitions.*.outputs.*.minimumBytes	integer | null	No	Not specified	format: uint64 maximum: 1024 minimum: 1
assertionDefinitions.*.outputs.*.minimumItems	integer | null	No	Not specified	format: uint64 maximum: 64 minimum: 1
assertionDefinitions.*.outputs.*.prefix	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.schema	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.schemeVersion	null | string	No	Not specified	None specified
assertionDefinitions.*.outputs.*.sdJwtVc	null | object	No	Not specified	None specified
assertionDefinitions.*.outputs.*.sdJwtVc.claim	string	Conditional	Not specified	maxLength: 64 minLength: 1 pattern: ^[A-Za-z][A-Za-z0-9_]{0,63}$
assertionDefinitions.*.outputs.*.sdJwtVc.disclosure	string	Conditional	top-level	None specified
assertionDefinitions.*.outputs.*.type	string	Yes	audience-scoped-entity-reference boolean bounded-decimal bounded-identifier bounded-integer controlled-category controlled-code controlled-code-list date-bucket entity-reference-list reviewed-structured-value time-bucket	None specified
assertionDefinitions.*.outputs.*.unique	boolean | null	No	Not specified	None specified
assertionDefinitions.*.outputs.*.values	array	No	Not specified	None specified
assertionDefinitions.*.outputs.*.values[]Array item	string	No	Not specified	None specified
assertionDefinitions.*.publicCheckExperimental (v1alpha1). Declares that this definition may answer the unauthenticated public certificate check once a target authority activates it. Declaring it grants nothing by itself.	null | object	No	Not specified	None specified
assertionDefinitions.*.publicCheck.checkCodeFactName of a string fact of the acquiring Source holding the stored check code. The code is compared and then removed; no Output can carry it.	string	Conditional	Not specified	maxLength: 128 minLength: 1
assertionDefinitions.*.publicCheck.fieldsOutputOutput id of a reviewed structured value whose fields object is the printed content of the answer.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.publicCheck.statusOutputOutput id of a controlled category whose values lie within valid, suspended, revoked and expired.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.purpose	string	Yes	Not specified	None specified
assertionDefinitions.*.questionHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Yes	Not specified	None specified
assertionDefinitions.*.representations	array	Yes	Not specified	minItems: 1 uniqueItems: true
assertionDefinitions.*.representations[]Array item	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
assertionDefinitions.*.semantics	object	Yes	Not specified	None specified
assertionDefinitions.*.semantics.evidenceType	string	Yes	Not specified	None specified
assertionDefinitions.*.semantics.kind	string	Yes	Not specified	None specified
assertionDefinitions.*.semantics.referenceFrameworks	array	Yes	Not specified	uniqueItems: true
assertionDefinitions.*.semantics.referenceFrameworks[]Array item	string	No	Not specified	None specified
assertionDefinitions.*.semantics.requirement	string	Yes	Not specified	None specified
assertionDefinitions.*.subjectBinding	string	Yes	audience-scoped holder-bound	None specified
assertionDefinitions.*.subjects	array	Yes	Not specified	None specified
assertionDefinitions.*.subjects[]Array item	object	No	Not specified	None specified
assertionDefinitions.*.subjects[].roleA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.subjects[].selectors	array	Yes	Not specified	uniqueItems: true
assertionDefinitions.*.subjects[].selectors[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	No	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
assertionDefinitions.*.validitySeconds	integer	Yes	Not specified	format: uint64 maximum: 31536000 minimum: 1
descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
functions	array	Yes	Not specified	None specified
functions[]Array item	object	No	Not specified	None specified
functions[].descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
functions[].idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
functions[].interface	string	Yes	assertion-derive/v1	None specified
functions[].labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
functions[].source	string	Yes	Not specified	None specified
idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
kind	string	Yes	EvidenceProject	None specified
labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
maximumHolderBoundBatchSizeMaximum assertions released together in one holder-bound batch; omission means one.	integer | null	No	Not specified	format: uint64 maximum: 16 minimum: 1
selectorProfiles	object	Yes	Not specified	None specified
selectorProfiles.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
selectorProfiles.*.descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
selectorProfiles.*.fields	object	Yes	Not specified	None specified
selectorProfiles.*.fields.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
selectorProfiles.*.fields.*.codelist	string	Conditional	Not specified	None specified
selectorProfiles.*.fields.*.codelistVersion	string	Conditional	Not specified	None specified
selectorProfiles.*.fields.*.descriptionHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	null | string	No	Not specified	None specified
selectorProfiles.*.fields.*.labelHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	null | string	No	Not specified	None specified
selectorProfiles.*.fields.*.maximum	integer	Conditional	Not specified	format: int64 maximum: 9007199254740991 minimum: -9007199254740991
selectorProfiles.*.fields.*.maximumBytes	integer	Conditional	Not specified	format: uint64 maximum: 8192 minimum: 1
selectorProfiles.*.fields.*.minimum	integer	Conditional	Not specified	format: int64 maximum: 9007199254740991 minimum: -9007199254740991
selectorProfiles.*.fields.*.minimumBytes	integer	Conditional	Not specified	format: uint64 maximum: 8192 minimum: 1
selectorProfiles.*.fields.*.type	string	Yes	boolean controlled-code date integer string uuid	None specified
selectorProfiles.*.labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
selectorProfiles.*.maximumAggregateBytes	integer	Yes	Not specified	format: uint64 maximum: 8192 minimum: 1
sources	object	Yes	Not specified	None specified
sources.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.acquisitionPosture	string	Yes	field-projected record-transformed source-derived	None specified
sources.*.connectionA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.descriptionHuman explanation for authors and reviewers; excluded from behavior revisions.	null | string	No	Not specified	None specified
sources.*.inputs	object	No	Not specified	None specified
sources.*.inputs.*Map value	object	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
sources.*.inputs.*.selector	object	Yes	Not specified	None specified
sources.*.inputs.*.selector.fieldA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.inputs.*.selector.profileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.inputs.*.selector.roleA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.labelOptional presentation label. Stable references use the identifier.	null | string	No	Not specified	None specified
sources.*.pack	object	Yes	Not specified	None specified
sources.*.pack.idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
sources.*.pack.version	string	Yes	Not specified	None specified
sources.*.projectionOptional project-owned projection of matched native facts. Acquisition and lookup classification remain in the reusable pack.	null | object	No	Not specified	None specified
sources.*.projection.entrypoint	string	Conditional	Not specified	None specified
sources.*.projection.schema	string	Conditional	Not specified	None specified
sources.*.projection.source	string	Conditional	Not specified	None specified
sources.*.routeA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$

access/clients/<id>.yaml

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/access-client.schema.json. 15 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
accessProfiles	array	Yes	Not specified	None specified
accessProfiles[]Array item	string	No	Not specified	None specified
actorKind	null | string	No	agent human service	None specified
apiVersion	string	Yes	id.registrystack.org/formats/evidence/access-client/v1alpha1	None specified
clientId	string	Yes	Not specified	None specified
evidenceAudience	string	Yes	Not specified	None specified
exchangeLocal issuer wiring for a client whose Evidence authority comes from a task assertion. This does not grant access or change the governed task profile.	null | object	No	Not specified	None specified
exchange.bootstrapResourceNone means the issuer owner's default resource, not the Evidence resource.	null | string	Conditional	Not specified	None specified
exchange.bootstrapScope	string	Conditional	Not specified	None specified
exchange.kind	string	Conditional	first-party institutional-grant	None specified
exchange.sourceIssuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	null | string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ or No bound
keys	array	Yes	Not specified	None specified
kind	string	Yes	EvidenceAccessClient	None specified
principal	string	Yes	Not specified	None specified
status	string	Yes	active revoked	None specified

mocks/source.yaml

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/mock-plan.schema.json. 25 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/evidence/mock-plan/v1alpha1	None specified
generationSettings retained solely so generate --config can create missing bodies.	null | object	No	Not specified	None specified
generation.asOf	string	Conditional	Not specified	None specified
generation.contract	string	Conditional	Not specified	None specified
generation.datasets	object	Conditional	Not specified	None specified
generation.datasets.*Map valueA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	string	Conditional	Not specified	pattern: ^sha256:[0-9a-f]{64}$ propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
generation.seed	integer	Conditional	Not specified	format: uint64 maximum: 9007199254740991 minimum: 0
kind	string	Yes	EvidenceMockPlan	None specified
openapi	string	Yes	Not specified	None specified
openapiDigestA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	null | string	No	Not specified	pattern: ^sha256:[0-9a-f]{64}$ or No bound
operations	array	Yes	Not specified	None specified
operations[]Array itemOne configured GET operation. Method plus templated path is its identity.	object	No	Not specified	None specified
operations[].cases	array	Yes	Not specified	None specified
operations[].cases[]Array item	object	No	Not specified	None specified
operations[].cases[].body	string	Yes	Not specified	None specified
operations[].cases[].name	string	Yes	Not specified	None specified
operations[].cases[].request	object	Yes	Not specified	None specified
operations[].cases[].request.pathParameters	object	Yes	Not specified	maxProperties: 16
operations[].cases[].request.pathParameters.*Map value	boolean | number | string	No	Not specified	maxLength: 4096 propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$ or propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
operations[].method	string	Yes	Not specified	None specified
operations[].operationId	null | string	No	Not specified	None specified
operations[].path	string	Yes	Not specified	None specified
operations[].response	object	Yes	Not specified	None specified
operations[].response.mediaType	string	Yes	Not specified	None specified
operations[].response.status	integer	Yes	Not specified	format: uint32 maximum: 200 minimum: 200

source import resolution file

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/source-resolution.schema.json. 6 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/evidence/source-resolution/v1alpha1	None specified
artifacts	object	Yes	Not specified	maxProperties: 256
artifacts.*Map valueWhat to do with one artifact the three-way comparison could not decide.	object	No	Not specified	propertyNames.maxLength: 512 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$
artifacts.*.path	string	Conditional	Not specified	None specified
artifacts.*.type	string	Yes	adopt file keep	None specified
kind	string	Yes	EvidenceSourceResolution	None specified

<target>.yaml

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/target.schema.json. 144 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
apiVersion	string	Yes	id.registrystack.org/formats/evidence/target/v1alpha1	None specified
assuranceProfile	null | string	No	evidence-grade local production	None specified
audit	object	Yes	Not specified	None specified
audit.destination	null | string	No	file stdout	None specified
audit.hashKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
audit.hashKeyVersion	integer	Yes	Not specified	format: uint32 maximum: 2147483647 minimum: 1
audit.path	null | string	No	Not specified	None specified
audit.retentionDays	integer | null	No	Not specified	format: uint32 maximum: 36500 minimum: 1
audit.rotateBytes	integer | null	No	Not specified	format: uint64 maximum: 4294967295 minimum: 1048576
authentication	object	Yes	Not specified	None specified
authentication.oidc	object	Yes	Not specified	None specified
authentication.oidc.actorClaim	null | string	No	Not specified	None specified
authentication.oidc.algorithms	array	Yes	Not specified	uniqueItems: true
authentication.oidc.algorithms[]Array item	string	No	ES256 EdDSA RS256	None specified
authentication.oidc.allowedClients	array | null | string	No	unrestricted	No bound or minItems: 1 uniqueItems: true
authentication.oidc.allowedClients[]Array item	string	Conditional	Not specified	None specified
authentication.oidc.assertionIssuersExternal client identifiers mapped to the exact issuer strings they may assert. Omit to apply no assertion-issuer rule. A present map has one to 32 clients, each within 128 bytes, with one to eight distinct nonempty issuers within 512 bytes.	object	No	Not specified	maxProperties: 32 minProperties: 1
authentication.oidc.assertionIssuers.*Map value	array	No	Not specified	maxItems: 8 minItems: 1 propertyNames.maxLength: 128 propertyNames.minLength: 1 propertyNames.pattern: ^[^\u0000-\u001F\u007F-\u009F]+$ uniqueItems: true
authentication.oidc.assertionIssuers.*[]Array item	string	No	Not specified	maxLength: 512 minLength: 1
authentication.oidc.audience	string	Yes	Not specified	None specified
authentication.oidc.claims	null | object	No	Not specified	None specified
authentication.oidc.claims.actorKindThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.approverThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantBoundsThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantClientThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantExpThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantIdThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantResourceThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.grantSourceIssuerThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.claims.purposeThe name of one direct JWT claim, within 128 ASCII bytes. Dots are literal characters. Omit to retain the governed runtime's default claim name; claim-role uniqueness and reserved names are revalidated with the complete authentication configuration.	null | string	Conditional	Not specified	maxLength: 128 minLength: 1 pattern: ^[A-Za-z_][A-Za-z0-9_.-]{0,127}$ or No bound
authentication.oidc.evidenceAudienceClaim	string	Yes	Not specified	None specified
authentication.oidc.issuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
authentication.oidc.jwksSource	object	Yes	Not specified	None specified
authentication.oidc.jwksSource.type	string	Yes	uri	None specified
authentication.oidc.jwksSource.uriAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
authentication.oidc.maximumTokenLifetimeSeconds	integer	Yes	Not specified	format: uint64 maximum: 86400 minimum: 1
authentication.oidc.principalClaim	string	Yes	Not specified	None specified
authentication.oidc.requesterTagsClaim	string	Yes	Not specified	None specified
authentication.oidc.requiredScopes	array | string	Yes	unrestricted	No bound or minItems: 1 uniqueItems: true
authentication.oidc.requiredScopes[]Array item	string	Conditional	Not specified	None specified
authentication.oidc.revokedKeyIds	array	No	Not specified	uniqueItems: true
authentication.oidc.revokedKeyIds[]Array item	string	No	Not specified	None specified
authentication.oidc.tlsTrustProfile	null | string	No	Not specified	None specified
authentication.oidc.tokenTypes	array	Yes	Not specified	uniqueItems: true
authentication.oidc.tokenTypes[]Array item	string	No	application/at+jwt at+jwt	None specified
authority	string	Yes	Not specified	None specified
connectionsExplicit endpoint bindings and their reviewed connection policies. An empty mapping grants no outbound endpoint authority.	object	Yes	Not specified	None specified
connections.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
connections.*.allowedPrivateCidrs	array	No	Not specified	None specified
connections.*.allowedPrivateCidrs[]Array item	string	No	Not specified	None specified
connections.*.endpoints	object	Yes	Not specified	None specified
connections.*.endpoints.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
connections.*.endpoints.*.attemptTimeoutMilliseconds	integer | null	No	Not specified	format: uint64 maximum: 18446744073709551615 minimum: 1
connections.*.endpoints.*.authentication	object	Yes	Not specified	None specified
connections.*.endpoints.*.authentication.assumedLifetimeSeconds	integer | null	Conditional	Not specified	format: uint64 maximum: 86400 minimum: 1
connections.*.endpoints.*.authentication.audience	null | string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.clientAssertionAudience	null | string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.clientAssertionKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.clientIdRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.clientSecretRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.credentialPlacement	string	Conditional	basic-header form-body	None specified
connections.*.endpoints.*.authentication.headerName	string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.maximumCacheSeconds	integer	Conditional	Not specified	format: uint64 maximum: 86400 minimum: 0
connections.*.endpoints.*.authentication.passwordRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.resource	null | string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.scheme	null | string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.scope	null | string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.tokenEndpoint	string	Conditional	Not specified	None specified
connections.*.endpoints.*.authentication.tokenRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.type	string	Yes	basic bearer none oauth2-client-credentials oauth2-private-key-jwt static-api-key static-authorization	None specified
connections.*.endpoints.*.authentication.usernameRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.authentication.valueRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.maximumResponseBytes	integer | null	No	Not specified	format: uint64 maximum: 1048576 minimum: 1
connections.*.endpoints.*.mtlsIdentity	null | object	No	Not specified	None specified
connections.*.endpoints.*.mtlsIdentity.certificateRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.mtlsIdentity.keyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
connections.*.endpoints.*.originAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
connections.*.endpoints.*.tlsTrustProfile	null | string	No	Not specified	None specified
extracts	null | object	No	Not specified	None specified
extracts.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
extracts.*.path	string	Yes	Not specified	None specified
idA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
kind	string	Yes	EvidenceTarget	None specified
listener	object	Yes	Not specified	None specified
listener.bind	string	Yes	Not specified	None specified
listener.maximumConcurrentRequests	integer | null	No	Not specified	format: uint32 maximum: 4096 minimum: 1
listener.maximumRequestBytes	integer | null	No	Not specified	format: uint64 maximum: 1048576 minimum: 1024
listener.networkExposure	null | string	No	container-private private-address	None specified
listener.requestTimeoutMilliseconds	integer | null	No	Not specified	format: uint64 maximum: 30000 minimum: 1
listener.shutdownGraceMilliseconds	integer | null	No	Not specified	format: uint64 maximum: 120000 minimum: 1
listener.tlsTermination	null | string	No	operator-controlled-upstream	None specified
listener.trustProxyIdentityHeaders	boolean	Yes	Not specified	None specified
outboundTls	null | object	No	Not specified	None specified
outboundTls.systemRoots	boolean	Conditional	Not specified	None specified
outboundTls.trustProfiles	object	Conditional	Not specified	None specified
outboundTls.trustProfiles.*Map value	object	Conditional	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
outboundTls.trustProfiles.*.caBundleFile	string	Conditional	Not specified	None specified
package	object	Yes	Not specified	None specified
package.expectedDigestA SHA-256 digest: sha256: followed by 64 lowercase hex digits.	null | string	No	Not specified	pattern: ^sha256:[0-9a-f]{64}$ or No bound
package.root	string	Yes	Not specified	None specified
projectA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
publication	null | object	No	Not specified	None specified
publication.descriptionHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Conditional	Not specified	None specified
publication.endpointUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Conditional	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
publication.jurisdictions	array	Conditional	Not specified	None specified
publication.jurisdictions[]Array item	string	Conditional	Not specified	None specified
publication.operatorId	null | string	Conditional	Not specified	None specified
publication.publisherId	null | string	Conditional	Not specified	None specified
publication.serviceId	string	Conditional	Not specified	None specified
publication.titleHuman-readable display text. Bidirectional embedding, override, and isolate controls, byte-order marks, line and paragraph separators, and Unicode noncharacters are refused; multilingual joiners and direction marks remain valid.	string	Conditional	Not specified	None specified
rateLimits	object	Yes	Not specified	None specified
rateLimits.burstPerPrincipal	integer | null	No	Not specified	format: uint32 maximum: 100000 minimum: 1
rateLimits.failedSelectorAttemptsPerPrincipalAuthorityPerMinute	integer	Yes	Not specified	format: uint32 maximum: 100000 minimum: 1
rateLimits.requestsPerPrincipalPerMinute	integer	Yes	Not specified	format: uint32 maximum: 1000000 minimum: 1
responseFormats	array | null	No	Not specified	uniqueItems: true
responseFormats[]Array item	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
secretProviders	object	Yes	Not specified	None specified
secretProviders.environment	null | object	No	Not specified	None specified
secretProviders.file	null | object	No	Not specified	None specified
secretProviders.file.root	string	Conditional	Not specified	None specified
service	object	Yes	Not specified	None specified
service.issuerAn absolute Evidence issuer URI identifier, including URNs, within 512 Unicode characters and without whitespace or control characters. It names the signer and is never fetched; it is not an OIDC issuer or a network origin.	string	Yes	Not specified	format: uri maxLength: 512 minLength: 1 pattern: ^[A-Za-z][A-Za-z0-9+.-]*:[^\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*$
service.providerId	string	Yes	Not specified	None specified
service.publicOriginAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	string	Yes	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$
service.trustDomain	string	Yes	Not specified	None specified
signer	object	Yes	Not specified	None specified
signer.algorithm	string	Yes	ES256	None specified
signer.attemptTimeoutMilliseconds	integer	Conditional	Not specified	format: uint64 maximum: 30000 minimum: 1
signer.keyName	string	Conditional	Not specified	None specified
signer.keyVersion	integer	Conditional	Not specified	format: uint32 maximum: 4294967295 minimum: 1
signer.mount	string	Conditional	Not specified	None specified
signer.privateKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Conditional	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$
signer.publicJwkFile	string	Yes	Not specified	None specified
signer.type	string	Yes	local-jwk transit	None specified
signer.unixSocketPath	string	Conditional	Not specified	None specified
signingWhat the target may sign, beyond the signer binding. When the target omits this block, it signs for at most 300 seconds.	null | object	No	Not specified	None specified
signing.maximumAssertionValiditySecondsThe longest validity, in seconds, any definition on this target may sign an assertion for.	integer	Conditional	Not specified	format: uint64 maximum: 31536000 minimum: 1
sourceAcquisitionOptional operational acquisition budget projected only into runtime configuration. Omission uses the Evidence engine defaults.	null | object	No	Not specified	None specified
sourceAcquisition.acquisitionDeadlineMilliseconds	integer	Conditional	Not specified	format: uint64 maximum: 18446744073709551615 minimum: 1
sourceAcquisition.maximumDataOperations	integer	Conditional	Not specified	format: uint64 maximum: 18446744073709551615 minimum: 1
sourceAcquisition.maximumResponseBytes	integer	Conditional	Not specified	format: uint64 maximum: 18446744073709551615 minimum: 1
subjectBinding	object	Yes	Not specified	None specified
subjectBinding.keyVersion	integer	Yes	Not specified	format: uint32 maximum: 2147483647 minimum: 1
subjectBinding.secretRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared.	string	Yes	Not specified	pattern: ^(?:secret:env/[A-Z][A-Z0-9_]{0,127}|secret:file/[a-z][a-z0-9._-]{0,127})$

<target>-authority.yaml

Adopter tooling, not frozen

Generated from crates/registry-evidencectl/schemas/authoring/target-authority.schema.json. 32 key paths. Explained in products/evidence/reference/authoring-projects/CONFIG.md.

Key path	Type	Required	Accepted values	Constraints
accessProfiles	object	Yes	Not specified	None specified
accessProfiles.*Map value	object	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.actorKind	null | string	No	agent human service	None specified
accessProfiles.*.authority	string	Yes	consent delegated explicit-request organizational statutory	None specified
accessProfiles.*.descriptionWhat the profile is for, accepted for authoring and tooling; never matched against a caller.	null | string	No	Not specified	None specified
accessProfiles.*.grantSourceIssuerAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted.	null | string	No	Not specified	format: uri maxLength: 2048 pattern: ^[Hh][Tt][Tt][Pp][Ss]?://[^/?#@\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]+([/?#][^\u005C\u0000-\u0020\u007F-\u00A0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]*)?$ or No bound
accessProfiles.*.grants	array	Yes	Not specified	maxItems: 128 minItems: 1
accessProfiles.*.grants[]Array item	object	No	Not specified	None specified
accessProfiles.*.grants[].audienceFrom	string	Yes	authenticated-requester	None specified
accessProfiles.*.grants[].definitionA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.grants[].purpose	string	Yes	Not specified	None specified
accessProfiles.*.grants[].representations	array	Yes	Not specified	maxItems: 4 minItems: 1 uniqueItems: true
accessProfiles.*.grants[].representations[]Array item	string	No	sd-jwt-vc sd-jwt-vc-batch signed-jws unsigned-json	None specified
accessProfiles.*.grants[].subjectBinding	string	Yes	audience-scoped holder-bound	None specified
accessProfiles.*.grants[].subjects	array	Yes	Not specified	maxItems: 8 minItems: 1
accessProfiles.*.grants[].subjects[]Array item	object	No	Not specified	None specified
accessProfiles.*.grants[].subjects[].roleA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.grants[].subjects[].selectorProfileA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.grants[].subjects[].valueClaims	null | object	No	Not specified	None specified
accessProfiles.*.grants[].subjects[].valueClaims.*Map value	string	No	Not specified	propertyNames.pattern: ^[a-z][a-z0-9_-]{0,63}$
accessProfiles.*.grants[].subjects[].valueOrigin	string	Yes	authenticated-context authenticated-grant request	None specified
accessProfiles.*.labelA name for the profile, accepted for authoring and tooling; never matched against a caller.	null | string	No	Not specified	None specified
accessProfiles.*.requesterClients	array | null	No	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
accessProfiles.*.requesterClients[]Array item	string	No	Not specified	None specified
accessProfiles.*.requesterTags	array	Yes	Not specified	maxItems: 32 minItems: 1 uniqueItems: true
accessProfiles.*.requesterTags[]Array item	string	No	Not specified	None specified
apiVersion	string	Yes	id.registrystack.org/formats/evidence/target-authority/v1alpha1	None specified
kind	string	Yes	EvidenceTargetAuthority	None specified
projectA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
publicCheckExperimental (v1alpha1). Activates the unauthenticated public certificate check for one definition that declares publicCheck. A check-only instance leaves accessProfiles empty.	null | object	No	Not specified	None specified
publicCheck.definitionThe definition whose publicCheck declaration this target serves.	string	Conditional	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$
targetA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -.	string	Yes	Not specified	pattern: ^[a-z][a-z0-9_-]{0,63}$

How the keys fit together

An entry states what one key decides, not how keys combine. The deployment grammar is explained in deployment-projects/CONFIG.md and the authoring keys in authoring-projects/CONFIG.md. Configuration files gives the YAML and environment substitution rules every product shares.

Check commands

Every file Evidence reads has a command that checks it offline, with no service running. Each prints the diagnostics, JSON output, and exit codes that Check a file before you deploy it describes.

Format and files	Check command
Evidence bundle evidence.yaml	evidence check --runtime-config <runtime>
Evidence runtime configuration runtime.yaml	evidence check --runtime-config <file>
Evidence code list codelists/*.yaml	evidence check --runtime-config <runtime>
Evidence fixture set fixtures/*.yaml	evidencectl test <project>
Evidence project evidence.yaml	evidencectl check <project>
Evidence target *-target.yaml	evidencectl check <project> --target <file>
Evidence target authority *-authority.yaml	evidencectl check <project> --target <project>/local-target.yaml
Retained source OpenAPI description source.openapi.yaml	None
Evidence access client access/clients/*.yaml	evidencectl check --file <file>
Evidence source mock plan mocks/source.yaml	evidencectl source mock check <project>
Evidence relying-procedure verification policy verification*.policy.yaml	evidence check-policy --verification-policy <file>
Evidence holder-bound presentation verification policy holder-bound*.policy.yaml	evidence check-policy --holder-bound-policy <file>
OID4VCI delivery runtime configuration runtime.yaml	evidence-oid4vci check --runtime-config <file>
OpenID4VP verifier runtime configuration runtime.yaml	evidence-oid4vp check --runtime-config <file>
Evidence relying-party client profile client-profile.json *.profile.json	evidencectl check --file <file>
Evidence source import resolution file source-resolutions.json *.resolutions.json	evidencectl check --file <file>

Next

Registry Evidence errors and problems reference