{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "version",
    "date",
    "checked",
    "status",
    "agent_instructions",
    "entries",
    "license",
    "source"
  ],
  "properties": {
    "version": {
      "const": "sovereigngrc.daily/1"
    },
    "date": {
      "$ref": "#/$defs/date"
    },
    "checked": {
      "$ref": "#/$defs/timestamp"
    },
    "status": {
      "enum": [
        "material",
        "quiet"
      ]
    },
    "agent_instructions": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "task",
        "match_on",
        "report_schema_url"
      ],
      "properties": {
        "task": {
          "enum": [
            "Match each entry against the caller's SBOM, asset inventory, or lockfiles. Report only matches. Cite sources. Do not invent versions you cannot see. On status=quiet, say so and stop.",
            "Match all visible inventory against the latest issue. Include every issue entry exactly once in a sovereigngrc.report/2 evidence record, cite entry sources, copy controls unchanged, and preserve unknown versions. Call validate_report and fix every problem, then return the plain-language human note. On status=quiet, report Nothing material today with an empty record; do not backfill older issues. A workaround reduces risk and never implies fixed."
          ],
          "default": "Match all visible inventory against the latest issue. Include every issue entry exactly once in a sovereigngrc.report/2 evidence record, cite entry sources, copy controls unchanged, and preserve unknown versions. Call validate_report and fix every problem, then return the plain-language human note. On status=quiet, report Nothing material today with an empty record; do not backfill older issues. A workaround reduces risk and never implies fixed."
        },
        "match_on": {
          "const": [
            "cpe",
            "purl",
            "vendor_product",
            "alias"
          ]
        },
        "report_schema_url": {
          "const": "https://www.sovereigngrc.com/schemas/agent-report.schema.json"
        }
      }
    },
    "entries": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/entry"
      }
    },
    "review": {
      "enum": [
        "automated"
      ]
    },
    "license": {
      "const": "CC-BY-4.0"
    },
    "source": {
      "const": "https://www.sovereigngrc.com/insights/daily/feed?format=json"
    }
  },
  "allOf": [
    {
      "$ref": "#/$defs/noTodo"
    },
    {
      "if": {
        "properties": {
          "status": {
            "const": "quiet"
          }
        },
        "required": [
          "status"
        ],
        "type": "object"
      },
      "then": {
        "properties": {
          "entries": {
            "maxItems": 0,
            "type": "array"
          }
        },
        "type": "object"
      },
      "else": {
        "properties": {
          "entries": {
            "minItems": 1,
            "type": "array"
          }
        },
        "type": "object"
      }
    }
  ],
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://www.sovereigngrc.com/schemas/daily-issue.schema.json",
  "title": "Sovereign GRC Daily Cyber Risk Brief issue",
  "$defs": {
    "text": {
      "type": "string",
      "minLength": 1
    },
    "url": {
      "type": "string",
      "format": "uri",
      "pattern": "^https?://"
    },
    "date": {
      "type": "string",
      "format": "date",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "timestamp": {
      "type": "string",
      "format": "date-time"
    },
    "noTodo": {
      "anyOf": [
        {
          "type": "string",
          "not": {
            "pattern": "TODO",
            "type": "string"
          }
        },
        {
          "type": "object",
          "propertyNames": {
            "not": {
              "pattern": "TODO",
              "type": "string"
            }
          },
          "additionalProperties": {
            "$ref": "#/$defs/noTodo"
          }
        },
        {
          "type": "array",
          "items": {
            "$ref": "#/$defs/noTodo"
          }
        },
        {
          "type": "number"
        },
        {
          "type": "boolean"
        },
        {
          "type": "null"
        }
      ]
    },
    "source": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "role",
        "publisher",
        "url"
      ],
      "properties": {
        "role": {
          "enum": [
            "vendor",
            "authority",
            "victim",
            "press"
          ]
        },
        "publisher": {
          "$ref": "#/$defs/text"
        },
        "url": {
          "$ref": "#/$defs/url"
        },
        "attested": {
          "$ref": "#/$defs/attestation"
        },
        "access": {
          "enum": [
            "fetched",
            "bot-blocked",
            "canonical"
          ]
        }
      }
    },
    "match": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "vendor",
        "product",
        "aliases",
        "cpe",
        "purl",
        "affected_versions",
        "fixed_versions",
        "exposure",
        "affected_ranges",
        "not_affected"
      ],
      "properties": {
        "vendor": {
          "$ref": "#/$defs/text"
        },
        "product": {
          "$ref": "#/$defs/text"
        },
        "aliases": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "cpe": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^cpe:2\\.3:[aho]:"
          },
          "uniqueItems": true
        },
        "purl": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^pkg:[a-z][a-z0-9.+-]*/\\S+$"
          },
          "uniqueItems": true
        },
        "affected_versions": {
          "anyOf": [
            {
              "$ref": "#/$defs/text"
            },
            {
              "type": "null"
            }
          ]
        },
        "fixed_versions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "exposure": {
          "anyOf": [
            {
              "$ref": "#/$defs/text"
            },
            {
              "type": "null"
            }
          ]
        },
        "affected_ranges": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/versionRange"
          },
          "uniqueItems": true
        },
        "not_affected": {
          "anyOf": [
            {
              "$ref": "#/$defs/text"
            },
            {
              "type": "null"
            }
          ]
        }
      }
    },
    "risk": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "cvss",
        "cvss_vector",
        "epss",
        "kev",
        "kev_added",
        "kev_due",
        "kev_due_passed",
        "exploited_in_wild",
        "severity",
        "window"
      ],
      "properties": {
        "cvss": {
          "type": [
            "number",
            "null"
          ],
          "minimum": 0,
          "maximum": 10
        },
        "cvss_vector": {
          "anyOf": [
            {
              "type": "string",
              "pattern": "^(CVSS:[234]\\.\\d/|AV:)"
            },
            {
              "type": "null"
            }
          ]
        },
        "epss": {
          "type": [
            "number",
            "null"
          ],
          "minimum": 0,
          "maximum": 1
        },
        "kev": {
          "type": "boolean"
        },
        "kev_added": {
          "anyOf": [
            {
              "$ref": "#/$defs/date"
            },
            {
              "type": "null"
            }
          ]
        },
        "kev_due": {
          "anyOf": [
            {
              "$ref": "#/$defs/date"
            },
            {
              "type": "null"
            }
          ]
        },
        "kev_due_passed": {
          "type": "boolean"
        },
        "exploited_in_wild": {
          "type": "boolean"
        },
        "severity": {
          "enum": [
            "CRITICAL",
            "HIGH"
          ]
        },
        "window": {
          "enum": [
            "IMMEDIATE",
            "7D",
            "NO_PATCH"
          ]
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "kev": {
                "const": true
              }
            },
            "required": [
              "kev"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "severity": {
                "const": "CRITICAL"
              },
              "kev_added": {
                "$ref": "#/$defs/date"
              },
              "kev_due": {
                "$ref": "#/$defs/date"
              },
              "exploited_in_wild": {
                "const": true
              }
            },
            "type": "object"
          },
          "else": {
            "properties": {
              "kev_added": {
                "type": "null"
              },
              "kev_due": {
                "type": "null"
              },
              "kev_due_passed": {
                "const": false
              }
            },
            "type": "object"
          }
        }
      ]
    },
    "region": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "canada",
        "widely_deployed",
        "canada_sources"
      ],
      "properties": {
        "canada": {
          "type": "boolean"
        },
        "widely_deployed": {
          "type": "boolean"
        },
        "canada_sources": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/url"
          },
          "uniqueItems": true
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "canada": {
                "const": true
              }
            },
            "required": [
              "canada"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "canada_sources": {
                "minItems": 1,
                "type": "array"
              }
            },
            "type": "object"
          },
          "else": {
            "properties": {
              "canada_sources": {
                "maxItems": 0,
                "type": "array"
              }
            },
            "type": "object"
          }
        }
      ]
    },
    "entry": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "id",
        "rank",
        "band",
        "title",
        "what",
        "match",
        "risk",
        "action",
        "region",
        "sources",
        "governance_question",
        "verified"
      ],
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"
        },
        "rank": {
          "type": "integer",
          "minimum": 1
        },
        "band": {
          "enum": [
            "CANADA_INCIDENT",
            "KEV_PASSED",
            "KEV_UPCOMING",
            "CRITICAL_WIDELY_DEPLOYED",
            "CRITICAL_NEW",
            "HIGH_EPSS"
          ]
        },
        "title": {
          "$ref": "#/$defs/text"
        },
        "what": {
          "$ref": "#/$defs/text"
        },
        "match": {
          "anyOf": [
            {
              "$ref": "#/$defs/match"
            },
            {
              "type": "null"
            }
          ]
        },
        "risk": {
          "$ref": "#/$defs/risk"
        },
        "action": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "summary",
            "steps",
            "workaround",
            "detection"
          ],
          "properties": {
            "summary": {
              "$ref": "#/$defs/text"
            },
            "steps": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/text"
              },
              "minItems": 1
            },
            "workaround": {
              "anyOf": [
                {
                  "$ref": "#/$defs/workaround"
                },
                {
                  "type": "null"
                }
              ]
            },
            "detection": {
              "anyOf": [
                {
                  "$ref": "#/$defs/text"
                },
                {
                  "type": "null"
                }
              ]
            }
          }
        },
        "region": {
          "$ref": "#/$defs/region"
        },
        "sources": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/source"
          },
          "minItems": 1,
          "contains": {
            "type": "object",
            "properties": {
              "role": {
                "enum": [
                  "vendor",
                  "authority",
                  "victim"
                ]
              }
            },
            "required": [
              "role"
            ]
          }
        },
        "governance_question": {
          "$ref": "#/$defs/text"
        },
        "verified": {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kev_checked",
            "nvd_checked",
            "epss_checked",
            "by"
          ],
          "properties": {
            "kev_checked": {
              "anyOf": [
                {
                  "$ref": "#/$defs/timestamp"
                },
                {
                  "type": "null"
                }
              ]
            },
            "nvd_checked": {
              "anyOf": [
                {
                  "$ref": "#/$defs/timestamp"
                },
                {
                  "type": "null"
                }
              ]
            },
            "epss_checked": {
              "anyOf": [
                {
                  "$ref": "#/$defs/timestamp"
                },
                {
                  "type": "null"
                }
              ]
            },
            "by": {
              "const": "Sovereign GRC"
            }
          }
        },
        "cwe": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^CWE-[0-9]+$"
          },
          "uniqueItems": true
        },
        "controls": {
          "anyOf": [
            {
              "$ref": "#/$defs/controls"
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "id": {
                "pattern": "^CVE-",
                "type": "string"
              }
            },
            "required": [
              "id"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "id": {
                "pattern": "^CVE-\\d{4}-\\d{4,7}$",
                "type": "string"
              },
              "match": {
                "$ref": "#/$defs/match"
              }
            },
            "type": "object"
          }
        },
        {
          "if": {
            "properties": {
              "match": {
                "type": "null"
              }
            },
            "required": [
              "match"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "band": {
                "const": "CANADA_INCIDENT"
              },
              "risk": {
                "type": "object",
                "properties": {
                  "cvss": {
                    "type": "null"
                  },
                  "cvss_vector": {
                    "type": "null"
                  },
                  "epss": {
                    "type": "null"
                  },
                  "kev": {
                    "const": false
                  },
                  "window": {
                    "const": "NO_PATCH"
                  }
                }
              },
              "region": {
                "type": "object",
                "properties": {
                  "canada": {
                    "const": true
                  }
                }
              }
            },
            "type": "object"
          }
        },
        {
          "if": {
            "properties": {
              "band": {
                "const": "CANADA_INCIDENT"
              }
            },
            "required": [
              "band"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "region": {
                "type": "object",
                "properties": {
                  "canada": {
                    "const": true
                  }
                }
              }
            },
            "type": "object"
          }
        },
        {
          "if": {
            "properties": {
              "band": {
                "const": "KEV_PASSED"
              }
            },
            "required": [
              "band"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "risk": {
                "type": "object",
                "properties": {
                  "kev": {
                    "const": true
                  },
                  "kev_due_passed": {
                    "const": true
                  }
                }
              }
            },
            "type": "object"
          }
        },
        {
          "if": {
            "properties": {
              "band": {
                "const": "KEV_UPCOMING"
              }
            },
            "required": [
              "band"
            ],
            "type": "object"
          },
          "then": {
            "properties": {
              "risk": {
                "type": "object",
                "properties": {
                  "kev": {
                    "const": true
                  },
                  "kev_due_passed": {
                    "const": false
                  }
                }
              }
            },
            "type": "object"
          }
        }
      ]
    },
    "versionRange": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "exact"
          ],
          "properties": {
            "exact": {
              "$ref": "#/$defs/text"
            },
            "cpe": {
              "type": "string",
              "pattern": "^cpe:2\\.3:[aho]:"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "from": {
              "$ref": "#/$defs/text"
            },
            "after": {
              "$ref": "#/$defs/text"
            },
            "before": {
              "$ref": "#/$defs/text"
            },
            "through": {
              "$ref": "#/$defs/text"
            },
            "cpe": {
              "type": "string",
              "pattern": "^cpe:2\\.3:[aho]:"
            }
          },
          "anyOf": [
            {
              "required": [
                "from"
              ],
              "type": "object",
              "properties": {
                "from": {}
              }
            },
            {
              "required": [
                "after"
              ],
              "type": "object",
              "properties": {
                "after": {}
              }
            },
            {
              "required": [
                "before"
              ],
              "type": "object",
              "properties": {
                "before": {}
              }
            },
            {
              "required": [
                "through"
              ],
              "type": "object",
              "properties": {
                "through": {}
              }
            }
          ],
          "allOf": [
            {
              "not": {
                "required": [
                  "from",
                  "after"
                ],
                "type": "object",
                "properties": {
                  "from": {},
                  "after": {}
                }
              }
            },
            {
              "not": {
                "required": [
                  "before",
                  "through"
                ],
                "type": "object",
                "properties": {
                  "before": {},
                  "through": {}
                }
              }
            }
          ]
        }
      ]
    },
    "attestation": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "by",
        "date",
        "how"
      ],
      "properties": {
        "by": {
          "const": "curator"
        },
        "date": {
          "$ref": "#/$defs/date"
        },
        "how": {
          "enum": [
            "browser",
            "weekly-url-validation"
          ]
        }
      }
    },
    "controls": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "basis",
        "iso27001",
        "nist_csf",
        "cis_v8",
        "itsg33",
        "osfi_b13"
      ],
      "properties": {
        "basis": {
          "enum": [
            "weakness-table",
            "curator",
            "incident-table"
          ]
        },
        "iso27001": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "nist_csf": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "cis_v8": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "itsg33": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "osfi_b13": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/text"
          },
          "uniqueItems": true
        },
        "reviewed": {
          "$ref": "#/$defs/date"
        }
      }
    },
    "workaround": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "summary",
        "applies_to",
        "reduces",
        "source_url"
      ],
      "properties": {
        "summary": {
          "$ref": "#/$defs/text"
        },
        "applies_to": {
          "$ref": "#/$defs/text"
        },
        "reduces": {
          "$ref": "#/$defs/text"
        },
        "source_url": {
          "$ref": "#/$defs/url"
        }
      }
    }
  }
}