{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:awoooi:package-supply-chain-inventory-v1",
  "title": "AWOOOI 套件 / 供應鏈盤點 v1",
  "description": "由 repo 內 manifest、lockfile 與 Dockerfile 產生的只讀套件 / 供應鏈盤點。此 schema 不授權安裝 SDK、升級套件、寫 lockfile、查外部 CVE、重建 image 或改生產路由。",
  "type": "object",
  "required": [
    "schema_version",
    "generated_at",
    "program_status",
    "source_refs",
    "rollups",
    "surfaces",
    "drift_findings",
    "operation_boundaries",
    "approval_boundaries"
  ],
  "properties": {
    "schema_version": {
      "type": "string",
      "const": "package_supply_chain_inventory_v1"
    },
    "generated_at": {
      "type": "string",
      "minLength": 1
    },
    "program_status": {
      "type": "object",
      "required": [
        "overall_completion_percent",
        "current_priority",
        "current_task_id",
        "next_task_id",
        "read_only_mode"
      ],
      "properties": {
        "overall_completion_percent": {
          "type": "integer",
          "minimum": 0,
          "maximum": 100
        },
        "current_priority": {
          "type": "string",
          "enum": ["P0", "P1", "P2", "P3"]
        },
        "current_task_id": {
          "type": "string",
          "minLength": 1
        },
        "next_task_id": {
          "type": "string",
          "minLength": 1
        },
        "read_only_mode": {
          "type": "boolean",
          "const": true
        }
      },
      "additionalProperties": false
    },
    "source_refs": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "string",
        "minLength": 1
      }
    },
    "rollups": {
      "type": "object",
      "required": [
        "total_surfaces",
        "by_ecosystem",
        "by_status",
        "python_manifest_count",
        "javascript_manifest_count",
        "docker_surface_count",
        "action_required_surface_ids",
        "planned_next_surface_ids"
      ],
      "properties": {
        "total_surfaces": {
          "type": "integer",
          "minimum": 0
        },
        "by_ecosystem": {
          "type": "object",
          "additionalProperties": {
            "type": "integer",
            "minimum": 0
          }
        },
        "by_status": {
          "type": "object",
          "additionalProperties": {
            "type": "integer",
            "minimum": 0
          }
        },
        "python_manifest_count": {
          "type": "integer",
          "minimum": 0
        },
        "javascript_manifest_count": {
          "type": "integer",
          "minimum": 0
        },
        "docker_surface_count": {
          "type": "integer",
          "minimum": 0
        },
        "action_required_surface_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1
          }
        },
        "planned_next_surface_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 1
          }
        }
      },
      "additionalProperties": false
    },
    "surfaces": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "surface_id",
          "display_name",
          "ecosystem",
          "status",
          "risk_level",
          "manifest_ref",
          "lockfile_ref",
          "direct_dependency_count",
          "optional_dependency_group_count",
          "pinning_policy",
          "runtime_ref",
          "gate_status",
          "evidence_refs",
          "next_action"
        ],
        "properties": {
          "surface_id": {
            "type": "string",
            "minLength": 1
          },
          "display_name": {
            "type": "string",
            "minLength": 1
          },
          "ecosystem": {
            "type": "string",
            "enum": ["python", "javascript", "docker", "system"]
          },
          "status": {
            "type": "string",
            "enum": ["ready", "action_required", "planned_next", "blocked", "deferred"]
          },
          "risk_level": {
            "type": "string",
            "enum": ["low", "medium", "high", "critical"]
          },
          "manifest_ref": {
            "type": "string",
            "minLength": 1
          },
          "lockfile_ref": {
            "type": "string",
            "minLength": 1
          },
          "direct_dependency_count": {
            "type": "integer",
            "minimum": 0
          },
          "optional_dependency_group_count": {
            "type": "integer",
            "minimum": 0
          },
          "pinning_policy": {
            "type": "string",
            "minLength": 1
          },
          "runtime_ref": {
            "type": "string",
            "minLength": 1
          },
          "gate_status": {
            "type": "string",
            "enum": [
              "read_only_allowed",
              "dependency_approval_required",
              "lockfile_write_blocked",
              "external_cve_lookup_blocked",
              "image_rebuild_blocked"
            ]
          },
          "evidence_refs": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "string",
              "minLength": 1
            }
          },
          "next_action": {
            "type": "string",
            "minLength": 1
          }
        },
        "additionalProperties": false
      }
    },
    "drift_findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "finding_id",
          "severity",
          "status",
          "summary",
          "evidence_refs",
          "next_action"
        ],
        "properties": {
          "finding_id": {
            "type": "string",
            "minLength": 1
          },
          "severity": {
            "type": "string",
            "enum": ["low", "medium", "high", "critical"]
          },
          "status": {
            "type": "string",
            "enum": ["action_required", "planned_next", "blocked", "accepted"]
          },
          "summary": {
            "type": "string",
            "minLength": 1
          },
          "evidence_refs": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "string",
              "minLength": 1
            }
          },
          "next_action": {
            "type": "string",
            "minLength": 1
          }
        },
        "additionalProperties": false
      }
    },
    "operation_boundaries": {
      "type": "object",
      "required": [
        "read_only_api_allowed",
        "dependency_installation_allowed",
        "package_upgrade_allowed",
        "lockfile_write_allowed",
        "external_cve_lookup_allowed",
        "image_rebuild_allowed",
        "production_routing_allowed"
      ],
      "properties": {
        "read_only_api_allowed": {
          "type": "boolean",
          "const": true
        },
        "dependency_installation_allowed": {
          "type": "boolean",
          "const": false
        },
        "package_upgrade_allowed": {
          "type": "boolean",
          "const": false
        },
        "lockfile_write_allowed": {
          "type": "boolean",
          "const": false
        },
        "external_cve_lookup_allowed": {
          "type": "boolean",
          "const": false
        },
        "image_rebuild_allowed": {
          "type": "boolean",
          "const": false
        },
        "production_routing_allowed": {
          "type": "boolean",
          "const": false
        }
      },
      "additionalProperties": false
    },
    "approval_boundaries": {
      "type": "object",
      "required": [
        "sdk_installation_allowed",
        "paid_api_call_allowed",
        "shadow_or_canary_allowed",
        "production_routing_allowed",
        "destructive_operation_allowed"
      ],
      "properties": {
        "sdk_installation_allowed": {
          "type": "boolean",
          "const": false
        },
        "paid_api_call_allowed": {
          "type": "boolean",
          "const": false
        },
        "shadow_or_canary_allowed": {
          "type": "boolean",
          "const": false
        },
        "production_routing_allowed": {
          "type": "boolean",
          "const": false
        },
        "destructive_operation_allowed": {
          "type": "boolean",
          "const": false
        }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}