{
  "GovernedCapability": {
    "fields": [
      "capability_type",
      "name",
      "version",
      "artifact_digest",
      "implementation_digest",
      "owner_principal",
      "publisher_principal",
      "provenance",
      "capability_id",
      "semantic_version",
      "manifest_digest",
      "dependency_set",
      "capability_scope",
      "input_schema",
      "output_schema",
      "required_permissions",
      "data_access_scope",
      "network_scope",
      "filesystem_scope",
      "credential_requirements",
      "execution_environment",
      "side_effect_class",
      "reversibility",
      "consequence_class",
      "risk_class",
      "trust_requirements",
      "authority_requirements",
      "policy_requirements",
      "supported_protocols",
      "supported_agent_types",
      "expiration",
      "revocation_state",
      "lifecycle_state",
      "attestation",
      "evidence_refs",
      "extensions",
      "created_at",
      "updated_at"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CAPABILITY-MANIFEST/v1"
  },
  "CapabilityPassport": {
    "fields": [
      "capability_id",
      "manifest_digest",
      "artifact_digest",
      "dependency_digest",
      "publisher_principal",
      "version",
      "provenance",
      "dependency_provenance",
      "permissions",
      "trust_state",
      "policy_bindings",
      "authority_requirements",
      "execution_conditions",
      "attestation_digest",
      "version_history",
      "mutations",
      "revocations",
      "evidence",
      "security_metadata",
      "issued_at",
      "issuer",
      "issuer_public_key_b64",
      "signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CAPABILITY-PASSPORT/v1"
  },
  "CapabilityGrant": {
    "fields": [
      "grant_id",
      "issuer",
      "subject_agent",
      "tenant",
      "capability_id",
      "capability_manifest_digest",
      "scope",
      "trajectory_id",
      "task_id",
      "policy_digest",
      "authority_digest",
      "provenance_digest",
      "issued_at",
      "expires_at",
      "max_invocations",
      "max_financial",
      "risk_ceiling",
      "parent_grant_id",
      "delegation_depth",
      "issuer_public_key_b64",
      "signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CAPABILITY-GRANT/v1"
  },
  "CapabilityLease": {
    "fields": [
      "lease_id",
      "capability_id",
      "capability_manifest_digest",
      "grant_id",
      "agent_id",
      "tenant",
      "trajectory_id",
      "decision_id",
      "authority_digest",
      "policy_digest",
      "risk_digest",
      "evidence_digest",
      "sandbox_profile_digest",
      "credential_binding_digest",
      "scope",
      "issued_at",
      "expiration",
      "nonce",
      "sequence",
      "renewal_of",
      "issuer_public_key_b64",
      "signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CAPABILITY-LEASE/v1"
  },
  "CapabilitySandboxProfile": {
    "fields": [
      "profile_id",
      "cpu_quota_pct",
      "memory_bytes",
      "filesystem_read",
      "filesystem_write",
      "network_egress",
      "subprocess",
      "environment",
      "secrets",
      "credentials",
      "devices",
      "ipc",
      "browser",
      "gui",
      "cloud_apis",
      "databases",
      "external_services"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-SANDBOX-PROFILE/v1"
  },
  "CapabilityCredentialBinding": {
    "fields": [
      "binding_id",
      "credential_ref",
      "capability_id",
      "agent_id",
      "trajectory_id",
      "tenant",
      "purpose",
      "scope",
      "issued_at",
      "expires_at",
      "issuer_public_key_b64",
      "signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CREDENTIAL-BINDING/v1"
  },
  "CapabilityDecisionBinding": {
    "fields": [
      "decision_digest",
      "capability_digest",
      "capability_manifest_digest",
      "authority_digest",
      "policy_digest",
      "risk_digest",
      "intent_digest",
      "evidence_digest",
      "lease_digest",
      "action_hash",
      "issuer_public_key_b64",
      "signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-CAPABILITY-DECISION-BINDING/v1"
  },
  "CapabilityConsequenceVector": {
    "fields": [
      "affected_systems",
      "affected_identities",
      "affected_data",
      "affected_resources",
      "financial_exposure",
      "operational_exposure",
      "reversibility",
      "persistence",
      "propagation_potential",
      "delegation_potential",
      "privilege_escalation_potential",
      "cross_tenant_exposure",
      "downstream_automation_exposure"
    ],
    "canonical": true,
    "domain": ""
  },
  "ArtifactProvenance": {
    "fields": [
      "publisher_principal",
      "name",
      "version",
      "artifact_digest",
      "source_uri",
      "repository",
      "source_commit",
      "build_id",
      "builder",
      "build_metadata_digest",
      "package_digest",
      "publisher_key_b64",
      "publisher_signature_b64"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-PUBLISHER-ARTIFACT-SIGNATURE/v1"
  },
  "DependencySpec": {
    "fields": [
      "name",
      "version",
      "digest",
      "publisher",
      "required_permissions"
    ],
    "canonical": true,
    "domain": "CAIN42/E14-DEPENDENCY-SET/v1"
  },
  "ToolManifest": {
    "fields": [
      "protocol",
      "endpoint",
      "provider",
      "data_classes",
      "rate_limit_per_minute",
      "resource_limits"
    ],
    "canonical": true,
    "domain": ""
  },
  "CapabilityProposal": {
    "fields": [
      "proposer",
      "proposer_kind",
      "capability_id",
      "requested_scope",
      "justification_digest",
      "status"
    ],
    "canonical": true,
    "domain": ""
  },
  "_lifecycle": {
    "states": [
      "DISCOVERED",
      "IDENTIFIED",
      "PROVENANCE_CHECKED",
      "ATTESTED",
      "EVALUATED",
      "ADMITTED",
      "GRANTED",
      "LEASED",
      "INVOKED",
      "OBSERVED",
      "REVALIDATED",
      "RENEWED",
      "REJECTED",
      "SUSPENDED",
      "EXPIRED",
      "REVOKED",
      "DRIFTED",
      "COMPROMISED",
      "UNKNOWN"
    ],
    "transitions": {
      "DISCOVERED": [
        "IDENTIFIED",
        "REJECTED",
        "UNKNOWN"
      ],
      "IDENTIFIED": [
        "PROVENANCE_CHECKED",
        "REJECTED",
        "UNKNOWN"
      ],
      "PROVENANCE_CHECKED": [
        "ATTESTED",
        "REJECTED",
        "UNKNOWN"
      ],
      "ATTESTED": [
        "EVALUATED",
        "REJECTED",
        "UNKNOWN"
      ],
      "EVALUATED": [
        "ADMITTED",
        "REJECTED",
        "SUSPENDED"
      ],
      "ADMITTED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "GRANTED",
        "REVOKED",
        "SUSPENDED"
      ],
      "GRANTED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "LEASED",
        "REVOKED",
        "SUSPENDED"
      ],
      "LEASED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "INVOKED",
        "REVOKED",
        "SUSPENDED"
      ],
      "INVOKED": [
        "COMPROMISED",
        "OBSERVED",
        "UNKNOWN"
      ],
      "OBSERVED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "REVALIDATED",
        "REVOKED",
        "SUSPENDED"
      ],
      "REVALIDATED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "LEASED",
        "RENEWED",
        "REVOKED",
        "SUSPENDED"
      ],
      "RENEWED": [
        "COMPROMISED",
        "DRIFTED",
        "EXPIRED",
        "INVOKED",
        "LEASED",
        "REVOKED",
        "SUSPENDED"
      ],
      "SUSPENDED": [
        "EVALUATED",
        "REVOKED"
      ],
      "DRIFTED": [
        "DISCOVERED",
        "REVOKED"
      ],
      "EXPIRED": [
        "EVALUATED",
        "REVOKED"
      ],
      "COMPROMISED": [
        "REVOKED"
      ],
      "REJECTED": [],
      "REVOKED": [],
      "UNKNOWN": [
        "DISCOVERED",
        "REJECTED"
      ]
    },
    "invokable": [
      "ADMITTED",
      "GRANTED",
      "INVOKED",
      "LEASED",
      "OBSERVED",
      "RENEWED",
      "REVALIDATED"
    ]
  },
  "_powers": [
    "READ_DATA",
    "WRITE_DATA",
    "READ_SECRET",
    "NETWORK_ACCESS",
    "WRITE_DATABASE",
    "FINANCIAL_API",
    "CODE_EXECUTION",
    "CREDENTIAL_ACCESS",
    "BROWSER_CONTROL",
    "PAYMENT",
    "DEPLOYMENT",
    "PRODUCTION_ACCESS",
    "SUBAGENT_CREATION",
    "DELEGATION",
    "MEMORY_WRITE",
    "POLICY_WRITE",
    "IDENTITY_MUTATION",
    "AUTHORITY_GRANT",
    "FILESYSTEM_READ",
    "FILESYSTEM_WRITE",
    "MODEL_INFERENCE",
    "CALL_MCP_TOOL"
  ],
  "_commit_checks": [
    "agent_identity",
    "decision",
    "intent",
    "policy",
    "authority",
    "capability",
    "capability_version",
    "artifact_digest",
    "capability_lease",
    "sandbox_profile",
    "credential_binding",
    "risk",
    "consequence",
    "trajectory",
    "revocation_status",
    "expiration",
    "nonce_replay",
    "canonical_action"
  ],
  "_e8_token_capability_fields": [
    "capability_digest",
    "capability_manifest_digest",
    "capability_lease_digest",
    "sandbox_profile_digest",
    "credential_binding_digest",
    "capability_binding_digest"
  ]
}