Makoto
Menu
Schema reference

handoff.schema.json

The completeness anchor: roots, heads, statement set, required profiles, final artifacts, and named recipients.

Title
Makoto v0.2 Handoff Manifest
Identifier
https://usemakoto.dev/schema/v0.2/handoff.schema.json
Digest
sha256:762746d6636a9521382c58d6861f7ac87fd11fea990845d70389b68b4977f0d6
Raw
/schema/v0.2/handoff.schema.json
Carried in
The decoded payload of manifest.dsse.json, payload type application/vnd.makoto.handoff.v0.2+json.
Responsibility
Exact roots, heads, statement set, final artifacts, required profiles, recipient, and nonce.

All schemas§13.2FieldsRaw JSON

A real instance. Read from demos/end-to-end/artifacts/positive-bundle/manifest.dsse.json, which validates against this schema.
{
  "artifacts": [
    {
      "digest": {
        "sha256": "ecd821dbe6f4204c4aad64878643d7954cb8c94abbf8d0b28f9c2bfc272f781e"
      },
      "head": {
        "sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"
      },
      "mediaType": "application/json",
      "name": "customers.public.json"
    }
  ],
  "bundleId": "urn:uuid:55555555-5555-4555-8555-555555555555",
  "heads": [
    {
      "sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"
    }
  ],
  "issuedAt": "2026-09-16T16:00:00Z",
  "recipient": "example:downstream-team",
  "requiredProfiles": [
    {
      "closureDigest": {
        "sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794"
      },
      "digest": {
        "sha256": "68169d043c628fda5435cbd7845b02ea3e0d850b7a509c0b35fd304463fffacb"
      },
      "head": {
        "sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"
      },
      "id": "https://schemas.example.internal/makoto/customer-public-v1.schema.json",
      "mediaType": "application/json",
      "scope": "eachMatchingFinalArtifact",
      "subjectName": "customers.public.json",
      "target": "artifact"
    }
  ],
  "roots": [
    {
      "sha256": "56b7be4394fe09c62ec7a3d5763cecc251e9696f267f35b2acc717b0d170a27a"
    }
  ],
  "statements": [
    {
      "sha256": "1f28b72bcd4c1e9b7df71403ac6bb1670c2f2b09628ca6d76a2fa384db9a0848"
    },
    {
      "sha256": "56b7be4394fe09c62ec7a3d5763cecc251e9696f267f35b2acc717b0d170a27a"
    },
    {
      "sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"
    }
  ],
  "version": "0.2"
}

Fields

Top leveldigesttimestampaudiencemediaTypenonemptyDigestsartifactrequiredProfile

Top level#

Shape object
  • closed object
FieldTypeConstraints, rules, and a real value
version
required		string constant
  • = "0.2"
Exact string 0.2.
"0.2"
bundleId
required		string
  • min length 1
  • max length 4096
Section 10.4 canonical lowercase UUID grammar or absolute URI, nonempty and at most 4096 UTF-8 bytes; no additional version/variant-bit rule, nil UUID allowed, correlation only.
"urn:uuid:55555555-5555-4555-8555-555555555555"
issuedAt
required		timestamp
Section 10.4 timestamp; signer asserted unless age policy applies.
"2026-09-16T16:00:00Z"
recipient
optional		audience
Optional bounded audience string under the lexical rule below.
"example:downstream-team"
roots
required		nonemptyDigests
Nonempty sorted unique statement-digest objects.
[{"sha256": "56b7be4394fe09c62ec7a3d5763cecc251e9696f267f35b2acc717b0d170a27a"}]
heads
required		nonemptyDigests
Nonempty sorted unique statement-digest objects.
[{"sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"}]
statements
required		nonemptyDigests
Nonempty sorted unique statement-digest objects.
[{"sha256": "1f28b72bcd4c1e9b7df71403ac6bb1670c2f2b09628ca6d76a2fa384db9a0848"}, {"sha256": "56…
artifacts
required		array of artifact
  • min items 1
Nonempty sorted unique final-artifact entries; each requires name, digest, and head, with optional mediaType.
[{"digest": {"sha256": "ecd821dbe6f4204c4aad64878643d7954cb8c94abbf8d0b28f9c2bfc272f781e"}, "he…
requiredProfiles
required		array of requiredProfile
Sorted unique artifact-only requirements; may be empty.
[{"closureDigest": {"sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794…
nonce
optional		audience
Optional bounded replay-challenge string under the lexical rule below.

digest#

Shape object
  • closed object

Appears at artifacts[].digest, artifacts[].head, heads[], requiredProfiles[].closureDigest, requiredProfiles[].digest, requiredProfiles[].head, roots[], statements[]

FieldTypeConstraints, rules, and a real value
sha256
required		string
  • min length 64
  • max length 64
"56b7be4394fe09c62ec7a3d5763cecc251e9696f267f35b2acc717b0d170a27a"

timestamp#

Shape string
  • min length 20
  • max length 30

Appears at issuedAt

audience#

Shape string
  • min length 1
  • max length 4096

Appears at nonce, recipient

mediaType#

Shape string
  • max length 255

Appears at artifacts[].mediaType, requiredProfiles[].mediaType

nonemptyDigests#

Shape array of digest
  • min items 1

Appears at heads, roots, statements

artifact#

Shape object
  • closed object

Appears at artifacts[]

FieldTypeConstraints, rules, and a real value
name
required		string
  • min length 1
  • max length 4096
"customers.public.json"
digest
required		digest
{"sha256": "ecd821dbe6f4204c4aad64878643d7954cb8c94abbf8d0b28f9c2bfc272f781e"}
mediaType
optional		mediaType
"application/json"
head
required		digest
{"sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"}

requiredProfile#

Shape object
  • closed object

Appears at requiredProfiles[]

FieldTypeConstraints, rules, and a real value
head
required		digest
{"sha256": "99aee76db46a720405da6d0015d427c791b0d4e02367b9e2bc36ce82ae812bce"}
id
required		string
  • min length 1
  • max length 4096
"https://schemas.example.internal/makoto/customer-public-v1.schema.json"
digest
required		digest
{"sha256": "68169d043c628fda5435cbd7845b02ea3e0d850b7a509c0b35fd304463fffacb"}
closureDigest
required		digest
{"sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794"}
target
required		string constant
  • = "artifact"
"artifact"
subjectName
required		string
  • min length 1
  • max length 4096
"customers.public.json"
mediaType
required		mediaType
"application/json"
scope
required		string constant
  • = "eachMatchingFinalArtifact"
"eachMatchingFinalArtifact"

Real documents that validate

  • demos/end-to-end/artifacts/positive-bundle/manifest.dsse.json

Raw JSON

The published document (2,672 bytes)
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://usemakoto.dev/schema/v0.2/handoff.schema.json",
  "title": "Makoto v0.2 Handoff Manifest",
  "type": "object",
  "required": ["version", "bundleId", "issuedAt", "roots", "heads", "statements", "artifacts", "requiredProfiles"],
  "properties": {
    "version": { "const": "0.2" },
    "bundleId": { "type": "string", "minLength": 1, "maxLength": 4096 },
    "issuedAt": { "$ref": "#/$defs/timestamp" },
    "recipient": { "$ref": "#/$defs/audience" },
    "roots": { "$ref": "#/$defs/nonemptyDigests" },
    "heads": { "$ref": "#/$defs/nonemptyDigests" },
    "statements": { "$ref": "#/$defs/nonemptyDigests" },
    "artifacts": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/artifact" }
    },
    "requiredProfiles": {
      "type": "array",
      "items": { "$ref": "#/$defs/requiredProfile" }
    },
    "nonce": { "$ref": "#/$defs/audience" }
  },
  "$defs": {
    "digest": {
      "type": "object",
      "required": ["sha256"],
      "properties": { "sha256": { "type": "string", "minLength": 64, "maxLength": 64 } },
      "additionalProperties": false
    },
    "timestamp": {
      "type": "string",
      "minLength": 20,
      "maxLength": 30
    },
    "audience": {
      "type": "string",
      "minLength": 1,
      "maxLength": 4096
    },
    "mediaType": {
      "type": "string",
      "maxLength": 255
    },
    "nonemptyDigests": {
      "type": "array",
      "minItems": 1,
      "items": { "$ref": "#/$defs/digest" }
    },
    "artifact": {
      "type": "object",
      "required": ["name", "digest", "head"],
      "properties": {
        "name": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "mediaType": { "$ref": "#/$defs/mediaType" },
        "head": { "$ref": "#/$defs/digest" }
      },
      "additionalProperties": false
    },
    "requiredProfile": {
      "type": "object",
      "required": ["head", "id", "digest", "closureDigest", "target", "subjectName", "mediaType", "scope"],
      "properties": {
        "head": { "$ref": "#/$defs/digest" },
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "const": "artifact" },
        "subjectName": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "mediaType": { "$ref": "#/$defs/mediaType" },
        "scope": { "const": "eachMatchingFinalArtifact" }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

The published bytes, unmodified.