{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://schemas.kxm.dev/permission-diff.schema.json",
  "title": "KXM permission-diff trust report",
  "description": "Structured, deterministic diff of authority-bearing fields between a trusted base bundle and a candidate bundle.",
  "type": "object",
  "required": ["schema", "baseRevision", "candidateRevision", "changes", "expansions", "narrowings", "neutralChanges", "requiresReview"],
  "properties": {
    "schema": { "const": "kxm.permission-diff.v1" },
    "baseRevision": { "$ref": "common.schema.json#/$defs/sha256" },
    "candidateRevision": { "$ref": "common.schema.json#/$defs/sha256" },
    "changes": {
      "type": "array",
      "items": { "$ref": "#/$defs/change" },
      "maxItems": 4096
    },
    "expansions": { "type": "array", "items": { "$ref": "#/$defs/change" }, "maxItems": 4096 },
    "narrowings": { "type": "array", "items": { "$ref": "#/$defs/change" }, "maxItems": 4096 },
    "neutralChanges": { "type": "array", "items": { "$ref": "#/$defs/change" }, "maxItems": 4096 },
    "requiresReview": { "type": "boolean" }
  },
  "additionalProperties": false,
  "$defs": {
    "change": {
      "type": "object",
      "required": ["resource", "path", "field", "direction", "summary"],
      "properties": {
        "resource": { "$ref": "common.schema.json#/$defs/relativePath" },
        "path": { "type": "string", "pattern": "^/", "maxLength": 1024 },
        "field": {
          "enum": [
            "repository-access",
            "tools",
            "secrets",
            "executor",
            "network",
            "model",
            "sync-policy",
            "snapshot-policy",
            "evidence-quorum",
            "transition",
            "budget",
            "resource-shape",
            "environment",
            "gate",
            "delivery"
          ]
        },
        "direction": { "enum": ["expansion", "narrowing", "neutral"] },
        "summary": { "type": "string", "minLength": 1, "maxLength": 2000 },
        "baseValueSha256": { "$ref": "common.schema.json#/$defs/sha256" },
        "candidateValueSha256": { "$ref": "common.schema.json#/$defs/sha256" }
      },
      "additionalProperties": false
    }
  }
}