{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "urn:synkro:policy:v4:rule",
  "title": "Synkro policy rule v4",
  "description": "Schema for one rule under a policy package rules directory.",
  "type": "object",
  "additionalProperties": false,
  "allOf": [
    {
      "$comment": "mode `fix` denies and hands the model its remediation to retry with, so the guidance is mandatory rather than optional.",
      "if": {
        "properties": {
          "mode": {
            "const": "fix"
          }
        },
        "required": [
          "mode"
        ]
      },
      "then": {
        "required": [
          "remediation"
        ]
      }
    }
  ],
  "required": [
    "schema_version",
    "id",
    "title",
    "description",
    "mode",
    "severity",
    "evaluation",
    "examples"
  ],
  "properties": {
    "schema_version": {
      "const": 4
    },
    "id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 64,
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$"
    },
    "title": {
      "type": "string",
      "pattern": "\\S"
    },
    "description": {
      "type": "string",
      "pattern": "\\S"
    },
    "mode": {
      "enum": [
        "allow",
        "flag",
        "fix",
        "ask",
        "block"
      ]
    },
    "severity": {
      "enum": [
        "low",
        "medium",
        "high",
        "critical"
      ]
    },
    "remediation": {
      "type": "string",
      "pattern": "\\S"
    },
    "evaluation": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind"
          ],
          "properties": {
            "kind": {
              "const": "semantic"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "predicate"
          ],
          "properties": {
            "kind": {
              "const": "deterministic"
            },
            "predicate": {
              "$ref": "#/$defs/predicate"
            }
          }
        }
      ]
    },
    "examples": {
      "type": "array",
      "minItems": 2,
      "maxItems": 8,
      "items": {
        "$ref": "#/$defs/example"
      },
      "allOf": [
        {
          "contains": {
            "type": "object",
            "required": [
              "expected"
            ],
            "properties": {
              "expected": {
                "const": "violation"
              }
            }
          },
          "minContains": 1
        },
        {
          "contains": {
            "type": "object",
            "required": [
              "expected"
            ],
            "properties": {
              "expected": {
                "const": "ok"
              }
            }
          },
          "minContains": 1
        }
      ]
    },
    "metadata": {
      "type": "object",
      "description": "Optional descriptive taxonomy and integration labels. The `cwe` key convention names a weakness class; metadata never controls matching.",
      "properties": {
        "cwe": {
          "type": "string",
          "pattern": "^CWE-[1-9][0-9]{0,4}$"
        }
      },
      "additionalProperties": {
        "type": "string"
      }
    }
  },
  "$defs": {
    "predicate": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "pattern"
          ],
          "properties": {
            "kind": {
              "const": "command_regex"
            },
            "pattern": {
              "type": "string"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "pattern"
          ],
          "properties": {
            "kind": {
              "const": "command_invocation_regex"
            },
            "pattern": {
              "type": "string",
              "pattern": "^\\^"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind"
          ],
          "anyOf": [
            {
              "required": [
                "exact"
              ]
            },
            {
              "required": [
                "prefix"
              ]
            }
          ],
          "properties": {
            "kind": {
              "const": "tool_name"
            },
            "exact": {
              "type": "string",
              "minLength": 1
            },
            "prefix": {
              "type": "string",
              "minLength": 1
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "pattern"
          ],
          "properties": {
            "kind": {
              "const": "path_glob"
            },
            "pattern": {
              "type": "string"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "path_glob",
            "pattern"
          ],
          "properties": {
            "kind": {
              "const": "content_regex"
            },
            "path_glob": {
              "type": "string"
            },
            "pattern": {
              "type": "string"
            },
            "requires_full_content": {
              "type": "boolean"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "server",
            "tool"
          ],
          "properties": {
            "kind": {
              "const": "mcp_tool"
            },
            "server": {
              "type": "string",
              "minLength": 1
            },
            "tool": {
              "type": "string",
              "minLength": 1
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "skill"
          ],
          "properties": {
            "kind": {
              "const": "skill_invocation"
            },
            "skill": {
              "type": "string",
              "minLength": 1
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "agent"
          ],
          "properties": {
            "kind": {
              "const": "agent_invocation"
            },
            "agent": {
              "type": "string",
              "minLength": 1
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "max"
          ],
          "properties": {
            "kind": {
              "const": "max_payload_bytes"
            },
            "max": {
              "type": "integer",
              "minimum": 0
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "key_path",
            "value"
          ],
          "properties": {
            "kind": {
              "const": "argument_value"
            },
            "key_path": {
              "type": "string",
              "minLength": 1,
              "maxLength": 4096
            },
            "value": {
              "type": [
                "string",
                "number",
                "boolean",
                "null"
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "fact"
          ],
          "properties": {
            "kind": {
              "const": "session_fact"
            },
            "fact": {
              "oneOf": [
                {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "field",
                    "equals"
                  ],
                  "properties": {
                    "field": {
                      "const": "model"
                    },
                    "equals": {
                      "type": "string"
                    }
                  }
                },
                {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "field",
                    "equals"
                  ],
                  "properties": {
                    "field": {
                      "const": "agent_type"
                    },
                    "equals": {
                      "type": "string"
                    }
                  }
                },
                {
                  "type": "object",
                  "additionalProperties": false,
                  "required": [
                    "field",
                    "equals"
                  ],
                  "properties": {
                    "field": {
                      "const": "background"
                    },
                    "equals": {
                      "type": "boolean"
                    }
                  }
                }
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "requested"
          ],
          "properties": {
            "kind": {
              "const": "host_access_requested"
            },
            "requested": {
              "type": "boolean"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind"
          ],
          "properties": {
            "kind": {
              "const": "workspace_boundary"
            },
            "access": {
              "enum": [
                "read",
                "write",
                "unknown",
                null
              ]
            }
          }
        }
      ]
    },
    "example": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "input",
        "expected"
      ],
      "properties": {
        "input": {
          "$ref": "#/$defs/example-input"
        },
        "expected": {
          "enum": [
            "violation",
            "ok"
          ]
        },
        "note": {
          "type": "string"
        }
      }
    },
    "example-input": {
      "oneOf": [
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "command"
          ],
          "properties": {
            "kind": {
              "const": "command"
            },
            "command": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "tool_name"
          ],
          "properties": {
            "kind": {
              "const": "tool_name"
            },
            "tool_name": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "path"
          ],
          "properties": {
            "kind": {
              "const": "path"
            },
            "path": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "path",
            "content",
            "coverage"
          ],
          "properties": {
            "kind": {
              "const": "content"
            },
            "path": {
              "type": "string",
              "pattern": "\\S"
            },
            "content": {
              "type": "string",
              "pattern": "\\S"
            },
            "coverage": {
              "enum": [
                "full",
                "fragment",
                "unavailable"
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "server",
            "tool"
          ],
          "properties": {
            "kind": {
              "const": "mcp_tool"
            },
            "server": {
              "type": "string",
              "pattern": "\\S"
            },
            "tool": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "skill"
          ],
          "properties": {
            "kind": {
              "const": "skill"
            },
            "skill": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "agent"
          ],
          "properties": {
            "kind": {
              "const": "agent"
            },
            "agent": {
              "type": "string",
              "pattern": "\\S"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "bytes"
          ],
          "properties": {
            "kind": {
              "const": "payload_bytes"
            },
            "bytes": {
              "type": "integer",
              "minimum": 0
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "key_path",
            "value"
          ],
          "properties": {
            "kind": {
              "const": "argument"
            },
            "key_path": {
              "type": "string",
              "minLength": 1,
              "maxLength": 4096
            },
            "value": {
              "type": [
                "string",
                "number",
                "boolean",
                "null"
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind"
          ],
          "properties": {
            "kind": {
              "const": "session"
            },
            "model": {
              "type": [
                "string",
                "null"
              ]
            },
            "agent_type": {
              "type": [
                "string",
                "null"
              ]
            },
            "is_background_agent": {
              "type": [
                "boolean",
                "null"
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind"
          ],
          "properties": {
            "kind": {
              "const": "host_access"
            },
            "requested": {
              "type": [
                "boolean",
                "null"
              ]
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "path",
            "access",
            "outside_workspace"
          ],
          "properties": {
            "kind": {
              "const": "workspace_path"
            },
            "path": {
              "type": "string",
              "minLength": 1
            },
            "access": {
              "enum": [
                "read",
                "write",
                "unknown"
              ]
            },
            "outside_workspace": {
              "type": "boolean"
            }
          }
        },
        {
          "type": "object",
          "additionalProperties": false,
          "required": [
            "kind",
            "server",
            "tool",
            "arguments"
          ],
          "properties": {
            "kind": {
              "const": "mcp_call"
            },
            "server": {
              "type": "string",
              "pattern": "\\S"
            },
            "tool": {
              "type": "string",
              "pattern": "\\S"
            },
            "arguments": {
              "type": "object",
              "description": "Complete authored MCP argument object; normalized using the same execution-fact projection as a native call."
            }
          }
        }
      ]
    }
  }
}