Schema reference

`trust-policy.schema.json`

The receiver-owned policy: which keys may make which claims, under which thresholds and resource limits.

Title: Makoto v0.2 Consumer Trust Policy
Identifier: https://usemakoto.dev/schema/v0.2/trust-policy.schema.json
Digest: sha256:5f18360abc901e175a16ec3a0ed1a4fa47626b34af08d64f6adb33c78fe9d6ac
Raw: /schema/v0.2/trust-policy.schema.json
Carried in: The receiver-owned policy passed to makoto verify bundle --policy.
Responsibility: Verification keys, authorization rules, digest-pinned required profiles, handoff/replay rules, evaluation-time behavior, and resource limits.

A real instance. Read from demos/end-to-end/artifacts/receiver/policy.json, which validates against this schema.

{
  "handoff": {
    "allowReplayableHandoff": false,
    "authorizedKeyIds": [
      "sha256:d016df3d83373617c06b5e1d6359caa06eeba8b3af2c7077234f109f2194516c"
    ],
    "minimumSignatures": 1,
    "requireExpectedArtifacts": true,
    "requireExpectedHead": true,
    "requireExpectedManifest": true,
    "requireNonce": false,
    "requireRecipient": false
  },
  "keys": {
    "sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059": {
      "label": "insecure demo-only normalize key",
      "publicKey": "MCowBQYDK2VwAyEAgTl3Dqh9F19Wo1Rmw0x+zMuNipG07jeiXfYPW4/Js5Q=",
      "type": "ed25519"
    },
    "sha256:8cef065b7af83669150b7d32704d3d3e75c3e9aee0d4f6740544c68e81b377aa": {
      "label": "insecure demo-only public key",
      "publicKey": "MCowBQYDK2VwAyEA7UkoxijRwsbq6QM4kFmVYSlZJzpcY/k2NsFGFKyHN9E=",
      "type": "ed25519"
    },
    "sha256:d016df3d83373617c06b5e1d6359caa06eeba8b3af2c7077234f109f2194516c": {
      "label": "insecure demo-only handoff key",
      "publicKey": "MCowBQYDK2VwAyEAypOsFwUYcHHWe4PH/w7+gQjo7EUwV113JoeTM9vavnw=",
      "type": "ed25519"
    },
    "sha256:fd110d301d2f077de1414b8f99f441b1403fab207b2052fbd2c065e4ee8e7dc2": {
      "label": "insecure demo-only origin key",
      "publicKey": "MCowBQYDK2VwAyEAiojj3XQJ8ZX9UtstPLpdcspnCb8dlBIb83SIAbQPb1w=",
      "type": "ed25519"
    }
  },
  "limits": {
    "maxAggregateArtifactBytes": 53687091200,
    "maxArtifactBytesPerFile": 10737418240,
    "maxArtifactValidationBytes": 104857600,
    "maxBundleFiles": 10000,
    "maxDiagnostics": 10000,
    "maxJsonDepth": 128,
    "maxJsonExponentMagnitude": 10000,
    "maxJsonNumberChars": 1024,
    "maxMetadataBytes": 104857600,
    "maxNdjsonLineBytes": 1048576,
    "maxProfileEvaluations": 10000,
    "maxRegexLength": 4096,
    "maxReportBytes": 67108864,
    "maxReportRecords": 20000,
    "maxSchemaBytes": 2097152,
    "maxSchemaEvaluationDepth": 256,
    "maxSchemaOperations": 10000000,
    "maxSchemaResources": 256,
    "maxSignaturesTotal": 10000,
    "maxSnapshotBytes": 53687091200,
    "profileEvaluationTimeoutSeconds": 5,
    "profileWorkerMemoryBytes": 536870912
  },
  "requiredProfiles": [
    {
      "closureDigest": {
        "sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794"
      },
      "digest": {
        "sha256": "68169d043c628fda5435cbd7845b02ea3e0d850b7a509c0b35fd304463fffacb"
      },
      "id": "https://schemas.example.internal/makoto/customer-public-v1.schema.json",
      "mediaType": "application/json",
      "scope": "eachMatchingFinalArtifact",
      "subjectName": "customers.public.json",
      "target": "artifact"
    }
  ],
  "rules": [
    {
      "authorizedKeyIds": [
        "sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059"
      ],
      "id": "urn:makoto:demo:rule:normalize",
      "minimumSignatures": 1,
      "operationTypes": [
        "urn:makoto:demo:operation:normalize"
      ],
      "predicateTypes": [
        "https://usemakoto.dev/predicate/v0.2/transform"
      ]
    },
    {
      "authorizedKeyIds": [
        "sha256:fd110d301d2f077de1414b8f99f441b1403fab207b2052fbd2c065e4ee8e7dc2"
      ],
      "id": "urn:makoto:demo:rule:origin",
      "minimumSignatures": 1,
      "predicateTypes": [
        "https://usemakoto.dev/predicate/v0.2/origin"
      ],
      "sourceKinds": [
        "urn:makoto:demo:source:synthetic-file"
      ],
      "sourceUris": [
        "urn:makoto:demo:v0.2:source:customers-raw"
      ]
    },
    {
      "authorizedKeyIds": [
        "sha256:8cef065b7af83669150b7d32704d3d3e75c3e9aee0d4f6740544c68e81b377aa"
      ],
      "id": "urn:makoto:demo:rule:public-safe",
      "minimumSignatures": 1,
      "operationTypes": [
        "urn:makoto:demo:operation:public-safe"
      ],
      "predicateTypes": [
        "https://usemakoto.dev/predicate/v0.2/transform"
      ],
      "profileConstraints": [
        {
          "closureDigest": {
            "sha256": "8c13490145ccdfe6958163ef0c578afb57da07772c2071932f8a4d98870e776e"
          },
          "digest": {
            "sha256": "31934d2cf8fa7b5af2f8e4cf591d96278c4f59ddb6bb190afccb93701244f9eb"
          },
          "id": "https://schemas.example.internal/makoto/public-transform-metadata-v1.schema.json",
          "target": "predicate"
        }
      ]
    }
  ],
  "version": "0.2"
}

Fields

Top level digest timestamp mediaType keyIds uris key profileConstraint rule handoffRule requiredProfile resourceDescriptor assessmentProfile vsaVerifier verificationSummary positiveInteger limits

Top level#

Shape object

closed object

Field	Type	Constraints, rules, and a real value
version required	string constant	= "0.2" `"0.2"`
keys required	map of key	keys: min length 71; max length 71 `{"sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059": {"label": "insecure…`
rules required	array of rule	max items 1024 `[{"authorizedKeyIds": ["sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059…`
handoff required	handoffRule	`{"allowReplayableHandoff": false, "authorizedKeyIds": ["sha256:d016df3d83373617c06b5e1d6359caa0…`
requiredProfiles required	array of requiredProfile	`[{"closureDigest": {"sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794…`
verificationSummary optional	verificationSummary
limits required	limits	`{"maxAggregateArtifactBytes": 53687091200, "maxArtifactBytesPerFile": 10737418240, "maxArtifact…`

digest#

Shape object

closed object

Appears at requiredProfiles[].closureDigest, requiredProfiles[].digest, rules[].profileConstraints[].closureDigest, rules[].profileConstraints[].digest, verificationSummary.summaryPolicy.digest, verificationSummary.verifiers[].policy.digest, verificationSummary.verifiers[].requiredControlEvidence[].digest, verificationSummary.verifiers[].requiredProfiles[].closureDigest…

Field	Type	Constraints, rules, and a real value
sha256 required	string	min length 64 max length 64 `"31934d2cf8fa7b5af2f8e4cf591d96278c4f59ddb6bb190afccb93701244f9eb"`

timestamp#

Shape string

min length 20
max length 30

Appears at keys.*.validFrom, keys.*.validUntil

mediaType#

Shape string

max length 255

Appears at requiredProfiles[].mediaType

keyIds#

Shape array of string

min items 1
each: min length 71
each: max length 71

Appears at handoff.authorizedKeyIds, rules[].authorizedKeyIds, verificationSummary.verifiers[].authorizedKeyIds

uris#

Shape array of string

min items 1
each: min length 1
each: max length 4096

Appears at rules[].operationTypes, rules[].predicateTypes, rules[].sourceKinds, rules[].sourceUris

key#

Shape object

closed object

Appears at keys.*

Field	Type	Constraints, rules, and a real value
type required	string constant	= "ed25519" `"ed25519"`
publicKey required	string	min length 60 max length 60 `"MCowBQYDK2VwAyEAgTl3Dqh9F19Wo1Rmw0x+zMuNipG07jeiXfYPW4/Js5Q="`
label optional	string	max length 4096 `"insecure demo-only normalize key"`
validFrom optional	timestamp
validUntil optional	timestamp

profileConstraint#

Shape object, one of 2 variants

closed object

Appears at rules[].profileConstraints[]

Field	Type	Constraints, rules, and a real value
id required	string	min length 1 max length 4096 `"https://schemas.example.internal/makoto/public-transform-metadata-v1.schema.json"`
digest optional	digest	`{"sha256": "31934d2cf8fa7b5af2f8e4cf591d96278c4f59ddb6bb190afccb93701244f9eb"}`
closureDigest optional	digest	`{"sha256": "8c13490145ccdfe6958163ef0c578afb57da07772c2071932f8a4d98870e776e"}`
target required	enum	one of: "statement", "predicate" `"predicate"`

Variants (2)

Exactly one of these shapes must match.

#	Base
1	any
2	any

rule#

Shape object

closed object

Appears at rules[]

Field	Type	Constraints, rules, and a real value
id required	string	min length 1 max length 4096 `"urn:makoto:demo:rule:normalize"`
predicateTypes required	uris	`["https://usemakoto.dev/predicate/v0.2/transform"]`
authorizedKeyIds required	keyIds	`["sha256:47dea58ea00fae9417ee19d76755bfef690899021132effb04fe1f9e4f0c8059"]`
minimumSignatures required	integer	≥ 1 `1`
sourceKinds optional	uris	`["urn:makoto:demo:source:synthetic-file"]`
sourceUris optional	uris	`["urn:makoto:demo:v0.2:source:customers-raw"]`
operationTypes optional	uris	`["urn:makoto:demo:operation:normalize"]`
profileConstraints optional	array of profileConstraint	min items 1 `[{"closureDigest": {"sha256": "8c13490145ccdfe6958163ef0c578afb57da07772c2071932f8a4d98870e776e…`

handoffRule#

Shape object, one of 2 variants

closed object

Appears at handoff

Field	Type	Constraints, rules, and a real value
authorizedKeyIds required	keyIds	`["sha256:d016df3d83373617c06b5e1d6359caa06eeba8b3af2c7077234f109f2194516c"]`
minimumSignatures required	integer	≥ 1 `1`
requireExpectedManifest required	boolean	`true`
requireExpectedHead required	boolean	`true`
requireExpectedArtifacts required	boolean	`true`
requireRecipient required	boolean	`false`
requireNonce required	boolean	`false`
allowReplayableHandoff required	boolean	`false`
maxAgeSeconds optional	integer	≥ 0 ≤ 315576000
maxFutureSkewSeconds optional	integer	≥ 0 ≤ 315576000

Variants (2)

Exactly one of these shapes must match.

#	Base
1	any
2	any

requiredProfile#

Shape object

closed object

Appears at requiredProfiles[]

Field	Type	Constraints, rules, and a real value
id required	string	min length 1 max length 4096 `"https://schemas.example.internal/makoto/customer-public-v1.schema.json"`
digest required	digest	`{"sha256": "68169d043c628fda5435cbd7845b02ea3e0d850b7a509c0b35fd304463fffacb"}`
closureDigest required	digest	`{"sha256": "57eec614be9b2141ad536f486ff4400b514d79b8b1cc9642a839cf1a39b10794"}`
target required	string constant	= "artifact" `"artifact"`
subjectName required	string	min length 1 max length 4096 `"customers.public.json"`
mediaType required	mediaType	`"application/json"`
scope required	string constant	= "eachMatchingFinalArtifact" `"eachMatchingFinalArtifact"`

resourceDescriptor#

Shape object

closed object

Appears at verificationSummary.summaryPolicy, verificationSummary.verifiers[].policy, verificationSummary.verifiers[].requiredControlEvidence[]

Field	Type	Constraints, rules, and a real value
uri required	string	min length 1 max length 4096
digest required	digest

assessmentProfile#

Shape object

closed object

Appears at verificationSummary.verifiers[].requiredProfiles[]

Field	Type	Constraints, rules, and a real value
id required	string	min length 1 max length 4096
digest required	digest
closureDigest required	digest
target required	enum	one of: "statement", "predicate"

vsaVerifier#

Shape object

closed object

Appears at verificationSummary.verifiers[]

Field	Type	Constraints, rules, and a real value
id required	string	min length 1 max length 4096
verifierId required	string	min length 1 max length 4096
authorizedKeyIds required	keyIds
minimumSignatures required	integer	≥ 1
policy required	resourceDescriptor
resourceUri required	string	min length 1 max length 4096
allowedVerifiedLevels required	array of enum	min items 1 each: one of: "MAKOTO_ORIGIN_LEVEL_2", "MAKOTO_ORIGIN_LEVEL_3", "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
independenceGroup required	string	min length 1 max length 4096
requiredProfiles optional	array of assessmentProfile	min items 1
requiredControlEvidence optional	array of resourceDescriptor	min items 1

verificationSummary#

Shape object

closed object

Appears at verificationSummary

Field	Type	Constraints, rules, and a real value
resourceUri required	string	min length 1 max length 4096
summaryPolicy required	resourceDescriptor
requiredVerifiedLevels required	array of enum	each: one of: "MAKOTO_ORIGIN_LEVEL_1", "MAKOTO_ORIGIN_LEVEL_2", "MAKOTO_ORIGIN_LEVEL_3", "MAKOTO_TRANSFORM_LEVEL_1", "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
requiredProperties required	array of enum	each: one of: "MAKOTO_AUTHORIZED", "MAKOTO_GRAPH_COMPLETE", "MAKOTO_FRESHNESS_ANCHORED", "MAKOTO_SCHEMA_CONFORMANT", "MAKOTO_REPRODUCED"
verifiers required	array of vsaVerifier

positiveInteger#

Shape integer

≥ 1

limits#

Shape object

closed object

Appears at limits

Field	Type	Constraints, rules, and a real value
maxBundleFiles required	integer	≥ 1 ≤ 20000 `10000`
maxMetadataBytes required	integer	≥ 1 ≤ 268435456 `104857600`
maxArtifactBytesPerFile required	integer	≥ 1 ≤ 1099511627776 `10737418240`
maxAggregateArtifactBytes required	integer	≥ 1 ≤ 2199023255552 `53687091200`
maxSnapshotBytes required	integer	≥ 1 ≤ 2199023255552 `53687091200`
maxArtifactValidationBytes required	integer	≥ 1 ≤ 1073741824 `104857600`
maxJsonDepth required	integer	≥ 8 ≤ 256 `128`
maxJsonNumberChars required	integer	≥ 1 ≤ 4096 `1024`
maxJsonExponentMagnitude required	integer	≥ 1 ≤ 100000 `10000`
maxSchemaBytes required	integer	≥ 1 ≤ 268435456 `2097152`
maxSchemaResources required	integer	≥ 1 ≤ 4096 `256`
maxSchemaEvaluationDepth required	integer	≥ 1 ≤ 1024 `256`
maxSchemaOperations required	integer	≥ 1 ≤ 1000000000 `10000000`
maxRegexLength required	integer	≥ 1 ≤ 65536 `4096`
profileEvaluationTimeoutSeconds required	integer	≥ 1 ≤ 60 `5`
profileWorkerMemoryBytes required	integer	≥ 1 ≤ 4294967296 `536870912`
maxNdjsonLineBytes required	integer	≥ 1 ≤ 67108864 `1048576`
maxSignaturesTotal required	integer	≥ 1 ≤ 100000 `10000`
maxProfileEvaluations required	integer	≥ 1 ≤ 100000 `10000`
maxDiagnostics required	integer	≥ 1 ≤ 100000 `10000`
maxReportRecords required	integer	≥ 64 ≤ 200000 `20000`
maxReportBytes required	integer	≥ 65536 ≤ 268435456 `67108864`

Real documents that validate

demos/end-to-end/artifacts/receiver/policy.json
demos/end-to-end/artifacts/receiver/attacker-known-policy.json

Raw JSON

The published document (11,253 bytes)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://usemakoto.dev/schema/v0.2/trust-policy.schema.json",
  "title": "Makoto v0.2 Consumer Trust Policy",
  "type": "object",
  "required": ["version", "keys", "rules", "handoff", "requiredProfiles", "limits"],
  "properties": {
    "version": { "const": "0.2" },
    "keys": {
      "type": "object",
      "propertyNames": { "type": "string", "minLength": 71, "maxLength": 71 },
      "additionalProperties": { "$ref": "#/$defs/key" }
    },
    "rules": {
      "type": "array",
      "maxItems": 1024,
      "items": { "$ref": "#/$defs/rule" }
    },
    "handoff": { "$ref": "#/$defs/handoffRule" },
    "requiredProfiles": {
      "type": "array",
      "items": { "$ref": "#/$defs/requiredProfile" }
    },
    "verificationSummary": { "$ref": "#/$defs/verificationSummary" },
    "limits": { "$ref": "#/$defs/limits" }
  },
  "$defs": {
    "digest": {
      "type": "object",
      "required": ["sha256"],
      "properties": { "sha256": { "type": "string", "minLength": 64, "maxLength": 64 } },
      "additionalProperties": false
    },
    "timestamp": {
      "type": "string",
      "minLength": 20,
      "maxLength": 30
    },
    "mediaType": {
      "type": "string",
      "maxLength": 255
    },
    "keyIds": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "minLength": 71, "maxLength": 71 }
    },
    "uris": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "minLength": 1, "maxLength": 4096 }
    },
    "key": {
      "type": "object",
      "required": ["type", "publicKey"],
      "properties": {
        "type": { "const": "ed25519" },
        "publicKey": { "type": "string", "minLength": 60, "maxLength": 60 },
        "label": { "type": "string", "maxLength": 4096 },
        "validFrom": { "$ref": "#/$defs/timestamp" },
        "validUntil": { "$ref": "#/$defs/timestamp" }
      },
      "additionalProperties": false
    },
    "profileConstraint": {
      "type": "object",
      "required": ["id", "target"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "enum": ["statement", "predicate"] }
      },
      "oneOf": [
        { "required": ["digest", "closureDigest"] },
        {
          "properties": {
            "digest": false,
            "closureDigest": false
          }
        }
      ],
      "additionalProperties": false
    },
    "rule": {
      "type": "object",
      "required": ["id", "predicateTypes", "authorizedKeyIds", "minimumSignatures"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "predicateTypes": { "$ref": "#/$defs/uris" },
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "sourceKinds": { "$ref": "#/$defs/uris" },
        "sourceUris": { "$ref": "#/$defs/uris" },
        "operationTypes": { "$ref": "#/$defs/uris" },
        "profileConstraints": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/profileConstraint" }
        }
      },
      "additionalProperties": false
    },
    "handoffRule": {
      "type": "object",
      "required": [
        "authorizedKeyIds",
        "minimumSignatures",
        "requireExpectedManifest",
        "requireExpectedHead",
        "requireExpectedArtifacts",
        "requireRecipient",
        "requireNonce",
        "allowReplayableHandoff"
      ],
      "properties": {
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "requireExpectedManifest": { "type": "boolean" },
        "requireExpectedHead": { "type": "boolean" },
        "requireExpectedArtifacts": { "type": "boolean" },
        "requireRecipient": { "type": "boolean" },
        "requireNonce": { "type": "boolean" },
        "allowReplayableHandoff": { "type": "boolean" },
        "maxAgeSeconds": { "type": "integer", "minimum": 0, "maximum": 315576000 },
        "maxFutureSkewSeconds": { "type": "integer", "minimum": 0, "maximum": 315576000 }
      },
      "oneOf": [
        { "required": ["maxAgeSeconds", "maxFutureSkewSeconds"] },
        {
          "properties": {
            "maxAgeSeconds": false,
            "maxFutureSkewSeconds": false
          }
        }
      ],
      "additionalProperties": false
    },
    "requiredProfile": {
      "type": "object",
      "required": ["id", "digest", "closureDigest", "target", "subjectName", "mediaType", "scope"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "const": "artifact" },
        "subjectName": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "mediaType": { "$ref": "#/$defs/mediaType" },
        "scope": { "const": "eachMatchingFinalArtifact" }
      },
      "additionalProperties": false
    },
    "resourceDescriptor": {
      "type": "object",
      "required": ["uri", "digest"],
      "properties": {
        "uri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" }
      },
      "additionalProperties": false
    },
    "assessmentProfile": {
      "type": "object",
      "required": ["id", "digest", "closureDigest", "target"],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "digest": { "$ref": "#/$defs/digest" },
        "closureDigest": { "$ref": "#/$defs/digest" },
        "target": { "enum": ["statement", "predicate"] }
      },
      "additionalProperties": false
    },
    "vsaVerifier": {
      "type": "object",
      "required": [
        "id", "verifierId", "authorizedKeyIds", "minimumSignatures", "policy", "resourceUri",
        "allowedVerifiedLevels", "independenceGroup"
      ],
      "properties": {
        "id": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "verifierId": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "authorizedKeyIds": { "$ref": "#/$defs/keyIds" },
        "minimumSignatures": { "type": "integer", "minimum": 1 },
        "policy": { "$ref": "#/$defs/resourceDescriptor" },
        "resourceUri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "allowedVerifiedLevels": {
          "type": "array",
          "minItems": 1,
          "items": {
            "enum": [
              "MAKOTO_ORIGIN_LEVEL_2", "MAKOTO_ORIGIN_LEVEL_3",
              "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
            ]
          }
        },
        "independenceGroup": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "requiredProfiles": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/assessmentProfile" }
        },
        "requiredControlEvidence": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/resourceDescriptor" }
        }
      },
      "additionalProperties": false
    },
    "verificationSummary": {
      "type": "object",
      "required": [
        "resourceUri", "summaryPolicy", "requiredVerifiedLevels",
        "requiredProperties", "verifiers"
      ],
      "properties": {
        "resourceUri": { "type": "string", "minLength": 1, "maxLength": 4096 },
        "summaryPolicy": { "$ref": "#/$defs/resourceDescriptor" },
        "requiredVerifiedLevels": {
          "type": "array",
          "items": {
            "enum": [
              "MAKOTO_ORIGIN_LEVEL_1", "MAKOTO_ORIGIN_LEVEL_2",
              "MAKOTO_ORIGIN_LEVEL_3", "MAKOTO_TRANSFORM_LEVEL_1",
              "MAKOTO_TRANSFORM_LEVEL_2", "MAKOTO_TRANSFORM_LEVEL_3"
            ]
          }
        },
        "requiredProperties": {
          "type": "array",
          "items": {
            "enum": [
              "MAKOTO_AUTHORIZED", "MAKOTO_GRAPH_COMPLETE",
              "MAKOTO_FRESHNESS_ANCHORED", "MAKOTO_SCHEMA_CONFORMANT",
              "MAKOTO_REPRODUCED"
            ]
          }
        },
        "verifiers": {
          "type": "array",
          "items": { "$ref": "#/$defs/vsaVerifier" }
        }
      },
      "additionalProperties": false
    },
    "positiveInteger": { "type": "integer", "minimum": 1 },
    "limits": {
      "type": "object",
      "required": [
        "maxBundleFiles", "maxMetadataBytes", "maxArtifactBytesPerFile",
        "maxAggregateArtifactBytes", "maxSnapshotBytes", "maxArtifactValidationBytes",
        "maxJsonDepth", "maxJsonNumberChars", "maxJsonExponentMagnitude",
        "maxSchemaBytes", "maxSchemaResources", "maxSchemaEvaluationDepth",
        "maxSchemaOperations", "maxRegexLength", "profileEvaluationTimeoutSeconds",
        "profileWorkerMemoryBytes", "maxNdjsonLineBytes", "maxSignaturesTotal",
        "maxProfileEvaluations", "maxDiagnostics", "maxReportRecords", "maxReportBytes"
      ],
      "properties": {
        "maxBundleFiles": { "type": "integer", "minimum": 1, "maximum": 20000 },
        "maxMetadataBytes": { "type": "integer", "minimum": 1, "maximum": 268435456 },
        "maxArtifactBytesPerFile": { "type": "integer", "minimum": 1, "maximum": 1099511627776 },
        "maxAggregateArtifactBytes": { "type": "integer", "minimum": 1, "maximum": 2199023255552 },
        "maxSnapshotBytes": { "type": "integer", "minimum": 1, "maximum": 2199023255552 },
        "maxArtifactValidationBytes": { "type": "integer", "minimum": 1, "maximum": 1073741824 },
        "maxJsonDepth": { "type": "integer", "minimum": 8, "maximum": 256 },
        "maxJsonNumberChars": { "type": "integer", "minimum": 1, "maximum": 4096 },
        "maxJsonExponentMagnitude": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxSchemaBytes": { "type": "integer", "minimum": 1, "maximum": 268435456 },
        "maxSchemaResources": { "type": "integer", "minimum": 1, "maximum": 4096 },
        "maxSchemaEvaluationDepth": { "type": "integer", "minimum": 1, "maximum": 1024 },
        "maxSchemaOperations": { "type": "integer", "minimum": 1, "maximum": 1000000000 },
        "maxRegexLength": { "type": "integer", "minimum": 1, "maximum": 65536 },
        "profileEvaluationTimeoutSeconds": { "type": "integer", "minimum": 1, "maximum": 60 },
        "profileWorkerMemoryBytes": { "type": "integer", "minimum": 1, "maximum": 4294967296 },
        "maxNdjsonLineBytes": { "type": "integer", "minimum": 1, "maximum": 67108864 },
        "maxSignaturesTotal": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxProfileEvaluations": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxDiagnostics": { "type": "integer", "minimum": 1, "maximum": 100000 },
        "maxReportRecords": { "type": "integer", "minimum": 64, "maximum": 200000 },
        "maxReportBytes": { "type": "integer", "minimum": 65536, "maximum": 268435456 }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

The published bytes, unmodified.