$schema: "https://json-schema.org/draft/2020-12/schema"
$id: "https://railiance.local/fabric/schemas/accountability-root-manifest.schema.yaml"
title: "AccountabilityRootManifest"
type: object
additionalProperties: false
required:
  - apiVersion
  - kind
  - metadata
  - netkingdom
  - actors
  - fabrics
  - discovery_roots
  - refresh
properties:
  apiVersion:
    type: string
    const: "railiance.fabric/v1alpha2"
  kind:
    type: string
    const: AccountabilityRootManifest
  metadata:
    type: object
    additionalProperties: false
    required:
      - id
      - name
    properties:
      id:
        $ref: "#/$defs/stableId"
      name:
        type: string
        minLength: 1
      description:
        type: string
      source_links:
        type: array
        items:
          $ref: "#/$defs/sourceLink"
  netkingdom:
    $ref: "#/$defs/netkingdom"
  actors:
    type: array
    minItems: 1
    items:
      $ref: "#/$defs/actor"
  fabrics:
    type: array
    minItems: 1
    items:
      $ref: "#/$defs/fabric"
  discovery_roots:
    type: array
    minItems: 1
    items:
      $ref: "#/$defs/discoveryRoot"
  refresh:
    $ref: "#/$defs/refreshPolicy"
  templates:
    type: object
    additionalProperties: false
    properties:
      future_subfabric:
        $ref: "#/$defs/futureSubfabricTemplate"

$defs:
  stableId:
    type: string
    minLength: 3
    maxLength: 180
    pattern: "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"

  pathString:
    type: string
    minLength: 1

  sourceLink:
    type: object
    additionalProperties: false
    required:
      - label
    properties:
      label:
        type: string
        minLength: 1
      path:
        type: string
        minLength: 1
      url:
        type: string
        minLength: 1
      ref:
        type: string
        minLength: 1
    anyOf:
      - required: [path]
      - required: [url]
      - required: [ref]

  netkingdom:
    type: object
    additionalProperties: false
    required:
      - id
      - name
      - king_actor_id
    properties:
      id:
        $ref: "#/$defs/stableId"
      name:
        type: string
        minLength: 1
      king_actor_id:
        $ref: "#/$defs/stableId"
      baseline_ref:
        $ref: "#/$defs/sourceLink"

  actor:
    type: object
    additionalProperties: false
    required:
      - id
      - role
      - name
    properties:
      id:
        $ref: "#/$defs/stableId"
      role:
        type: string
        enum:
          - king
          - lord
          - tenant
          - operator
          - steward
      name:
        type: string
        minLength: 1
      description:
        type: string
      authority:
        type: object
        additionalProperties: false
        properties:
          recovery_authority:
            type: boolean
          secrets_authority:
            type: boolean
          backup_authority:
            type: boolean
          termination_authority:
            type: boolean
      evidence_refs:
        type: array
        items:
          $ref: "#/$defs/sourceLink"

  fabric:
    type: object
    additionalProperties: false
    required:
      - id
      - kind
      - name
      - netkingdom_id
      - status
      - boundary
    properties:
      id:
        $ref: "#/$defs/stableId"
      kind:
        type: string
        enum:
          - Fabric
          - Subfabric
      name:
        type: string
        minLength: 1
      netkingdom_id:
        $ref: "#/$defs/stableId"
      lord_actor_id:
        $ref: "#/$defs/stableId"
      tenant_actor_id:
        $ref: "#/$defs/stableId"
      parent_fabric_id:
        oneOf:
          - $ref: "#/$defs/stableId"
          - type: "null"
      status:
        type: string
        enum:
          - active
          - planned
          - retired
      boundary:
        type: object
        additionalProperties: false
        required:
          - boundary_type
          - criterion
        properties:
          boundary_type:
            type: string
            enum:
              - fabric
              - subfabric
          criterion:
            type: string
            minLength: 1
          payment_responsibility:
            $ref: "#/$defs/stableId"
          operational_responsibility:
            $ref: "#/$defs/stableId"
          recovery_responsibility:
            $ref: "#/$defs/stableId"
      evidence_refs:
        type: array
        items:
          $ref: "#/$defs/sourceLink"
    allOf:
      - if:
          properties:
            kind:
              const: Fabric
        then:
          required:
            - lord_actor_id
      - if:
          properties:
            kind:
              const: Subfabric
        then:
          required:
            - parent_fabric_id
            - tenant_actor_id

  discoveryRoot:
    type: object
    additionalProperties: false
    required:
      - id
      - type
      - status
      - fabric_id
      - owner_actor_id
      - source
      - evidence_scope
    properties:
      id:
        $ref: "#/$defs/stableId"
      type:
        type: string
        enum:
          - state_hub_repo_inventory
          - gitea_organization
          - gitea_repository
          - registry_manifest
          - repository_checkout
          - host_path
          - deployment_automation
          - infrastructure_manifest
          - service_config
          - endpoint_contract
          - backup_recovery
          - secret_root
          - manual_review_queue
      status:
        type: string
        enum:
          - active
          - planned
          - disabled
      fabric_id:
        $ref: "#/$defs/stableId"
      subfabric_id:
        $ref: "#/$defs/stableId"
      owner_actor_id:
        $ref: "#/$defs/stableId"
      source:
        type: object
        additionalProperties: false
        properties:
          base_url:
            type: string
            minLength: 1
          url:
            type: string
            minLength: 1
          organization:
            type: string
            minLength: 1
          repo_slug:
            type: string
            minLength: 1
          path:
            $ref: "#/$defs/pathString"
          remote_url:
            type: string
            minLength: 1
          manifest_path:
            $ref: "#/$defs/pathString"
          api_paths:
            type: array
            items:
              type: string
              minLength: 1
          patterns:
            type: array
            items:
              type: string
              minLength: 1
          safe_discovery:
            type: string
            enum:
              - metadata_only
              - local_files
              - content_hash
              - explicit_review
      evidence_scope:
        type: array
        minItems: 1
        uniqueItems: true
        items:
          type: string
          enum:
            - repo_inventory
            - repository_identity
            - local_checkout
            - deployment_topology
            - service_configuration
            - infrastructure
            - endpoint_contract
            - backup_recovery
            - secret_metadata
            - fabric_boundary
            - tenant_boundary
            - accounting_boundary
            - manual_review
      refresh:
        $ref: "#/$defs/refreshPolicy"
      evidence_refs:
        type: array
        items:
          $ref: "#/$defs/sourceLink"
      notes:
        type: string

  refreshPolicy:
    type: object
    additionalProperties: false
    required:
      - cadence
      - triggers
    properties:
      cadence:
        type: string
        enum:
          - manual
          - hourly
          - daily
          - weekly
          - on_change
      triggers:
        type: array
        uniqueItems: true
        items:
          type: string
          enum:
            - operator_request
            - state_hub_repo_inventory_change
            - git_commit
            - deployment_manifest_change
            - infrastructure_manifest_change
            - endpoint_contract_change
            - secret_root_change
            - backup_recovery_change
            - lord_or_tenant_change
            - scheduled_rebuild
      notes:
        type: string

  futureSubfabricTemplate:
    type: object
    additionalProperties: false
    required:
      - parent_fabric_id
      - tenant_actor_role
      - required_updates
    properties:
      parent_fabric_id:
        $ref: "#/$defs/stableId"
      tenant_actor_role:
        type: string
        const: tenant
      required_updates:
        type: array
        minItems: 1
        items:
          type: string
          minLength: 1
      note:
        type: string