{"contextKind":"public_baseline","language":"en","id":"review-exchange","version":"1.0.0","contractDigest":"sha256:6b39cae0c6af595c7b3764919e5e7d327271961b0a0b7a3acefbd7f9bb87c68d","title":"Review Exchange","kind":"repository-contract","files":[{"path":"docs/architecture/review-exchange-contract-v1.md","digest":"sha256:805963613d3221b8cdec93effe9ad293b123d72001e302258a28af172ecac54a","mediaType":"text/markdown","content":"---\nrole: authority\nlifecycle: frozen\nversion: \"1\"\nlanguage: en\n---\n# Review Exchange contract v1\n\n## Canonical aggregate and identity\n\nUI and file exchange feed one aggregate: **Review Package → Review Items → Responses, Decisions, Verification, and Audit Events**. Comments, clarifications, evidence, proposals, change evidence, verification notes, and decision notes are response types. Review Packages are the only grouping model.\n\nEvery installation has an immutable RFC 4122 UUID and `productId: orivelaiq`, mutable optional alias/environment metadata, and created/updated timestamps. Every review entity has an internal database ID (`rvp_`, `rvi_`, and related prefixes) and a separate UUID public ID. Only public IDs occur in exchange artifacts and `ExchangeEntityRef`; internal IDs never cross the installation boundary.\n\n## Status and transition contract\n\nPackage statuses are exactly:\n\n`draft | open | in_review | completed | completed_with_open_items | deferred | out_of_scope | archived`\n\nItem statuses are exactly:\n\n`open | in_review | needs_clarification | response_received | decision_pending | change_required | change_applied | verification_pending | verified | resolved | deferred | out_of_scope | parking_lot | archived`\n\nEvery allowed non-idempotent edge has a named manual gate and evaluable preconditions. There is no `open → completed` shortcut. Completion with open items uses the distinct `completed_with_open_items` state and requires policy permission plus explicit risk acceptance for every open mandatory item. Deferred mandatory items require owner and due date. Finding rejection and parking-lot disposition require reasons. Conflicting responses require a decision. Stale responses are rejected or manually reviewed according to policy. `change_required → change_applied → verification_pending` keeps implementation evidence distinct from verification.\n\n## Origin, authorship, and based-on\n\nOrigin is exactly `orivelaiq_ui | review_exchange | migration | system` and identifies the responsible installation and optional source reference. Authorship is independently and explicitly `human | ai | ai_assisted | tool | system | unknown`. AI-assisted authorship requires a human reviewer, AI authorship records a model, and tool authorship records a tool. These are provenance claims, never authentication or authorization.\n\nEvery response, decision, verification, and report has `basedOn`: package public ID/revision, optional item public ID/revision, optional context revision/hash, and export timestamp. Stale imports cannot silently re-anchor or overwrite current work.\n\nContext hashes use canonical JSON with sorted keys, Unicode NFC for keys and values, CRLF/CR normalized to LF, then SHA-256 over UTF-8. Revision and transport metadata are not hashed.\n\n## Normative exchange layout\n\n```text\ninstallations/<installationId>/\n  installation.yaml\n  review-packages/<packagePublicId>/\n    package.yaml\n    items/<itemPublicId>/\n      item.yaml\n      context.md\n      evidence.md\n      responses/<responsePublicId>/\n        response.yaml\n        response.md\n      attachments/**\n    reports/\n      current-status.md\n      result-report.md\n      result-report.json\n    attachments/**  # optional package-level compatibility extension\n    execution-results/**\n    sync/\n      state.yaml\n      import-report.json\n      violations.json\n```\n\nYAML files carry structured metadata validated against the JSON Schemas after safe YAML parsing. Markdown uses YAML front matter where structured fields are required; `response-frontmatter.schema.json` validates response front matter. Markdown bodies remain passive content and are never executed.\n\n## Fail-closed write authority\n\nEvery path is classified into exactly one category:\n\n| Classification | Artifacts | Rule |\n|---|---|---|\n| `orivelaiq-managed` | `installation.yaml`, `package.yaml`, `item.yaml`, `context.md`, `evidence.md`, all three report files, `sync/**` | package/installation owner writes with optimistic revision |\n| `external-managed` | the complete `responses/**` surface (`response.yaml` and `response.md`), normative item `attachments/**`, optional package `attachments/**` | writer must be resolved from validated response authorship or attachment metadata; unresolved means deny |\n| `mixed-managed` | `execution-results/**` | tool writer must be resolved from authoritative execution ownership; unresolved means deny |\n| `unknown` | unrecognized but non-malicious path | no read-to-domain or write permission |\n| `forbidden` | traversal, absolute/NUL/backslash paths, secret/credential areas | reject before adapter I/O |\n\nBoth files in a response directory use the same author resolved from validated response authorship; the package owner has no implicit response write permission. Item-level `items/<itemPublicId>/attachments/**` is normative. Package-level `attachments/**` is supported only as an explicit compatibility extension.\n\n`unknown` and `forbidden` always fail closed. Authority is evaluated again at runtime; TypeScript types are not a security boundary. Immutable response metadata/bodies, attachments, and execution results are create-only. Managed metadata and reports use compare-and-swap. Workspace source artifacts remain outside exchange write authority.\n\n## Adapter boundary\n\nAdapter `kind` is a closed union: `local-directory | github-repository | file-share | azure-devops-repository`. The source-neutral interface provides `readFile`, `listFiles`, `listChanges`, `getRevision`, `writeFile`, and `deleteFile`. Change listings return added/modified/deleted entries and a continuation revision. Writes/deletes require classified paths and optimistic revisions. Implementations normalize paths, prevent root/symlink escape, enforce size/count limits, and perform atomic writes where the source permits.\n\n## Policy, violations, and reports\n\nThe package policy controls stale responses, forces conflicting responses into decision, allows or forbids completion with open items, and mandates risk acceptance, finding-rejection reasons, deferred owner/due date, and parking-lot reasons. `evaluateReviewPolicy` returns stable violation codes rather than booleans. Violations carry severity, rule ID, safe message, and optional entity reference.\n\nImport reports record source/target installations, counts, terminal status, and violations. Result reports are immutable reviewer-authored YAML artifacts based on exact public IDs/revisions. Reports communicate results; they do not bypass the package owner's transition gates.\n\nValidation order is: path/authority and limits; UTF-8/YAML-front-matter parsing with duplicate-key rejection; installation/version/schema; public-ID/reference consistency; attachment digests; `basedOn` and context; authorship mapping; local authorization; transition/policy evaluation; transactional persistence and audit; report emission. Schema validity is never authorization.\n\n## Schema inventory and compatibility\n\n`contracts/review-exchange/v1/manifest.json` lists installation, package, item, response front matter, decision, verification, result report, import report, and audit schemas. Schemas use JSON Schema 2020-12 and reject unknown fields. Producers emit `1.0.0`; breaking changes require another major directory.\n"},{"path":"contracts/review-exchange/v1/manifest.json","digest":"sha256:15c8721c5ae28decb32b3945363a7735c0994f4b7bf25efcb6b59dc5e2dfb81b","mediaType":"application/json","content":"{\n  \"contract\": \"orivelaiq-review-exchange\",\n  \"version\": \"1.0.0\",\n  \"jsonSchemaDraft\": \"2020-12\",\n  \"installation\": \"installation.schema.json\",\n  \"importReport\": \"import-report.schema.json\",\n  \"entities\": {\n    \"package\": \"review-package.schema.json\",\n    \"item\": \"review-item.schema.json\",\n    \"contribution\": \"review-contribution.schema.json\",\n    \"response\": \"review-response.schema.json\",\n    \"decision\": \"review-decision.schema.json\",\n    \"verification\": \"review-verification.schema.json\",\n    \"result_report\": \"result-report.schema.json\",\n    \"audit_event\": \"review-audit_event.schema.json\"\n  },\n  \"responseFrontmatter\": \"response-frontmatter.schema.json\"\n}\n"},{"path":"contracts/review-exchange/v1/installation.schema.json","digest":"sha256:88377f5377097f4631533d4be662f0ef7e5c59dae49738d2f82ea6857c22867c","mediaType":"application/json","content":"{\"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\"$id\":\"https://schemas.orivelaiq.dev/review-exchange/v1/installation.schema.json\",\"title\":\"OrivelaIQ Installation Identity\",\"type\":\"object\",\"additionalProperties\":false,\"required\":[\"schemaVersion\",\"productId\",\"installationId\",\"createdAt\",\"updatedAt\"],\"properties\":{\"schemaVersion\":{\"const\":\"1.0.0\"},\"productId\":{\"const\":\"orivelaiq\"},\"installationId\":{\"$ref\":\"review-shared.schema.json#/$defs/installationId\"},\"installationAlias\":{\"type\":\"string\",\"minLength\":1,\"maxLength\":128},\"environmentId\":{\"type\":\"string\",\"minLength\":1,\"maxLength\":128},\"createdAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"},\"updatedAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"}}}\n"},{"path":"contracts/review-exchange/v1/import-report.schema.json","digest":"sha256:9158c2cdb1cd805c43726bc2097301118eb7dcc986de6563a2652e22aa9d827c","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/import-report.schema.json\",\n  \"title\": \"OrivelaIQ Review Import Report\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"publicId\",\n    \"sourceInstallationId\",\n    \"targetInstallationId\",\n    \"startedAt\",\n    \"completedAt\",\n    \"status\",\n    \"discovered\",\n    \"imported\",\n    \"skipped\",\n    \"rejected\",\n    \"violations\"\n  ],\n  \"properties\": {\n    \"sourceInstallationId\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"targetInstallationId\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"startedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"completedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"status\": {\n      \"enum\": [\n        \"accepted\",\n        \"partially_accepted\",\n        \"rejected\"\n      ]\n    },\n    \"discovered\": {\n      \"type\": \"integer\",\n      \"minimum\": 0\n    },\n    \"imported\": {\n      \"type\": \"integer\",\n      \"minimum\": 0\n    },\n    \"skipped\": {\n      \"type\": \"integer\",\n      \"minimum\": 0\n    },\n    \"rejected\": {\n      \"type\": \"integer\",\n      \"minimum\": 0\n    },\n    \"violations\": {\n      \"type\": \"array\",\n      \"items\": {\n        \"$ref\": \"review-shared.schema.json#/$defs/violation\"\n      }\n    },\n    \"publicId\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-package.schema.json","digest":"sha256:25134e24edfd0df771cf2867a4cfc1e7222a7dfa11a33c15cc8ebb0a64a336ac","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-package.schema.json\",\n  \"title\": \"OrivelaIQ Review Package Exchange Envelope\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"exportedAt\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"workspaceId\",\n        \"title\",\n        \"status\",\n        \"revision\",\n        \"origin\",\n        \"itemPublicIds\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"policy\"\n      ],\n      \"properties\": {\n        \"workspaceId\": {\n          \"type\": \"string\",\n          \"minLength\": 1\n        },\n        \"title\": {\n          \"type\": \"string\",\n          \"minLength\": 1\n        },\n        \"description\": {\n          \"type\": \"string\"\n        },\n        \"status\": {\n          \"enum\": [\n            \"draft\",\n            \"open\",\n            \"in_review\",\n            \"completed\",\n            \"completed_with_open_items\",\n            \"deferred\",\n            \"out_of_scope\",\n            \"archived\"\n          ]\n        },\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"policy\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/policy\"\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"itemPublicIds\": {\n          \"type\": \"array\",\n          \"uniqueItems\": true,\n          \"items\": {\n            \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n          }\n        }\n      },\n      \"unevaluatedProperties\": false\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entityType\": {\n      \"const\": \"package\"\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-item.schema.json","digest":"sha256:5d8bd50554478d0f363a16b2b851bf935ffcae7d52cda6519332e00de7f4f0f4","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-item.schema.json\",\n  \"title\": \"OrivelaIQ Review Item Exchange Envelope\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"exportedAt\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"packagePublicId\",\n        \"title\",\n        \"status\",\n        \"revision\",\n        \"origin\",\n        \"context\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"priority\",\n        \"mandatory\"\n      ],\n      \"properties\": {\n        \"title\": {\n          \"type\": \"string\",\n          \"minLength\": 1\n        },\n        \"question\": {\n          \"type\": \"string\"\n        },\n        \"status\": {\n          \"enum\": [\n            \"open\",\n            \"in_review\",\n            \"needs_clarification\",\n            \"response_received\",\n            \"decision_pending\",\n            \"change_required\",\n            \"change_applied\",\n            \"verification_pending\",\n            \"verified\",\n            \"resolved\",\n            \"deferred\",\n            \"out_of_scope\",\n            \"parking_lot\",\n            \"archived\"\n          ]\n        },\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"context\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/context\"\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"priority\": {\n          \"enum\": [\n            \"low\",\n            \"medium\",\n            \"high\"\n          ]\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"packagePublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"mandatory\": {\n          \"type\": \"boolean\"\n        },\n        \"owner\": {\n          \"type\": \"string\",\n          \"maxLength\": 512\n        },\n        \"dueDate\": {\n          \"type\": \"string\",\n          \"format\": \"date\"\n        },\n        \"dispositionReason\": {\n          \"type\": \"string\",\n          \"maxLength\": 4096\n        }\n      },\n      \"unevaluatedProperties\": false\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entityType\": {\n      \"const\": \"item\"\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-contribution.schema.json","digest":"sha256:1a424a689650a390d7cd1809cfe5dedceb527595ac59df1190ff253007bf8d82","mediaType":"application/json","content":"{\n  \"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\":\"https://schemas.orivelaiq.dev/review-exchange/v1/review-contribution.schema.json\",\n  \"type\":\"object\",\"additionalProperties\":false,\n  \"required\":[\"schemaVersion\",\"entityType\",\"exportedAt\",\"exporter\",\"entity\"],\n  \"properties\":{\"schemaVersion\":{\"const\":\"1.0.0\"},\"entityType\":{\"const\":\"contribution\"},\"exportedAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"},\"exporter\":{\"$ref\":\"review-shared.schema.json#/$defs/installationId\"},\"entity\":{\"type\":\"object\",\"additionalProperties\":false,\"required\":[\"publicId\",\"revision\",\"createdAt\",\"updatedAt\",\"origin\",\"packagePublicId\",\"itemPublicId\",\"contributionKind\",\"summary\",\"bodyDigest\",\"authorship\",\"sourceResponsePublicIds\",\"basedOn\",\"status\"],\"properties\":{\"publicId\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"},\"revision\":{\"type\":\"integer\",\"minimum\":1},\"createdAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"},\"updatedAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"},\"origin\":{\"$ref\":\"review-shared.schema.json#/$defs/origin\"},\"packagePublicId\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"},\"itemPublicId\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"},\"contributionKind\":{\"enum\":[\"request_clarification\",\"request_updated_response\",\"request_more_evidence\"]},\"summary\":{\"type\":\"string\",\"minLength\":1,\"maxLength\":4096},\"bodyDigest\":{\"$ref\":\"review-shared.schema.json#/$defs/digest\"},\"authorship\":{\"$ref\":\"review-shared.schema.json#/$defs/authorship\"},\"sourceResponsePublicIds\":{\"type\":\"array\",\"uniqueItems\":true,\"maxItems\":100,\"items\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"}},\"basedOn\":{\"$ref\":\"review-shared.schema.json#/$defs/basedOn\"},\"status\":{\"enum\":[\"ready\",\"exported\",\"answered\",\"superseded\",\"cancelled\"]}}}}}\n"},{"path":"contracts/review-exchange/v1/review-response.schema.json","digest":"sha256:a97320521f43efde65b5cc1487546c77ee88252a59bb1ad7034f5013bdbf0100","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-response.schema.json\",\n  \"title\": \"OrivelaIQ Review Response Exchange Envelope\",\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"entityType\": {\n      \"const\": \"response\"\n    },\n    \"exportedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\",\n        \"packagePublicId\",\n        \"itemPublicId\",\n        \"responseType\",\n        \"authorship\",\n        \"basedOn\"\n      ],\n      \"properties\": {\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"text\": {\n          \"type\": \"string\",\n          \"maxLength\": 100000\n        },\n        \"selectedOptions\": {\n          \"type\": \"array\",\n          \"uniqueItems\": true,\n          \"items\": {\n            \"type\": \"string\",\n            \"maxLength\": 1024\n          }\n        },\n        \"authorship\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/authorship\"\n        },\n        \"basedOn\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/basedOn\"\n        },\n        \"inReplyTo\": {\n          \"allOf\": [\n            { \"$ref\": \"review-shared.schema.json#/$defs/entityRef\" },\n            { \"type\": \"object\", \"properties\": { \"entityType\": { \"const\": \"contribution\" } } }\n          ]\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"itemPublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"packagePublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"responseType\": {\n          \"enum\": [\"comment\", \"clarification\", \"evidence\", \"change_proposal\", \"change_evidence\", \"verification_note\", \"decision_note\"]\n        },\n        \"bodyDigest\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/digest\"\n        },\n        \"contentDigest\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/digest\"\n        },\n        \"summary\": {\n          \"type\": \"string\",\n          \"maxLength\": 4096\n        },\n        \"decisionPoint\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 512\n        },\n        \"assertedOutcome\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 128\n        },\n        \"decisionPublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        }\n      },\n      \"unevaluatedProperties\": false\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-decision.schema.json","digest":"sha256:47c65a9df9f47377c23587881167aa997fc1841b30085c226cef9c6223871dfd","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-decision.schema.json\",\n  \"title\": \"OrivelaIQ Review Decision Exchange Envelope\",\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"entityType\": {\n      \"const\": \"decision\"\n    },\n    \"exportedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\",\n        \"itemPublicId\",\n        \"outcome\",\n        \"summary\",\n        \"authorship\",\n        \"decidedAt\",\n        \"basedOn\"\n      ],\n      \"properties\": {\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"outcome\": {\n          \"enum\": [\n            \"accepted\",\n            \"changed\",\n            \"deferred\",\n            \"rejected\",\n            \"out_of_scope\"\n          ]\n        },\n        \"summary\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 100000\n        },\n        \"decidedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"owner\": {\n          \"type\": \"string\",\n          \"maxLength\": 512\n        },\n        \"dueDate\": {\n          \"type\": \"string\",\n          \"format\": \"date\"\n        },\n        \"authorship\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/authorship\"\n        },\n        \"basedOn\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/basedOn\"\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"itemPublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        }\n      },\n      \"unevaluatedProperties\": false\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-verification.schema.json","digest":"sha256:ce0fbff83fa9b6ff5eba1ce654dc089e21de6e54a709ac5ca9fb92a2cdf8e127","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-verification.schema.json\",\n  \"title\": \"OrivelaIQ Review Verification Exchange Envelope\",\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"entityType\": {\n      \"const\": \"verification\"\n    },\n    \"exportedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\",\n        \"itemPublicId\",\n        \"result\",\n        \"summary\",\n        \"authorship\",\n        \"basedOn\"\n      ],\n      \"properties\": {\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"result\": {\n          \"enum\": [\n            \"pending\",\n            \"passed\",\n            \"failed\",\n            \"not_applicable\"\n          ]\n        },\n        \"summary\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 100000\n        },\n        \"verifiedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"authorship\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/authorship\"\n        },\n        \"basedOn\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/basedOn\"\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"itemPublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        }\n      },\n      \"unevaluatedProperties\": false\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/result-report.schema.json","digest":"sha256:b84df0ddf56e4726074dcdd363e2c2d8aba395787861184738941af60fa60603","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/result-report.schema.json\",\n  \"title\": \"OrivelaIQ Review Result Report Envelope\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"entityType\": {\n      \"const\": \"result_report\"\n    },\n    \"exportedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"publicId\",\n        \"packageRef\",\n        \"generatedBy\",\n        \"basedOn\",\n        \"outcome\",\n        \"summary\",\n        \"itemResults\",\n        \"violations\",\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\"\n      ],\n      \"properties\": {\n        \"packageRef\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/entityRef\"\n        },\n        \"generatedBy\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n        },\n        \"basedOn\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/basedOn\"\n        },\n        \"outcome\": {\n          \"enum\": [\n            \"accepted\",\n            \"changes_required\",\n            \"rejected\"\n          ]\n        },\n        \"summary\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 100000\n        },\n        \"itemResults\": {\n          \"type\": \"array\",\n          \"items\": {\n            \"type\": \"object\",\n            \"additionalProperties\": false,\n            \"required\": [\n              \"itemRef\",\n              \"outcome\",\n              \"contributionRefs\"\n            ],\n            \"properties\": {\n              \"itemRef\": {\n                \"$ref\": \"review-shared.schema.json#/$defs/entityRef\"\n              },\n              \"outcome\": {\n                \"enum\": [\n                  \"accepted\",\n                  \"changes_required\",\n                  \"rejected\"\n                ]\n              },\n              \"contributionRefs\": {\n                \"type\": \"array\",\n                \"items\": {\n                  \"$ref\": \"review-shared.schema.json#/$defs/entityRef\"\n                }\n              }\n            }\n          }\n        },\n        \"violations\": {\n          \"type\": \"array\",\n          \"items\": {\n            \"$ref\": \"review-shared.schema.json#/$defs/violation\"\n          }\n        },\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        }\n      }\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/review-audit_event.schema.json","digest":"sha256:df9b14ce63ed7dc6eef77e88c5a2327a708c2b1b6e8daa2111b3058919bc825d","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"type\": \"object\",\n  \"additionalProperties\": false,\n  \"required\": [\n    \"schemaVersion\",\n    \"entityType\",\n    \"exportedAt\",\n    \"exporter\",\n    \"entity\"\n  ],\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-audit_event.schema.json\",\n  \"title\": \"OrivelaIQ Review Audit_Event Exchange Envelope\",\n  \"properties\": {\n    \"schemaVersion\": {\n      \"const\": \"1.0.0\"\n    },\n    \"entityType\": {\n      \"const\": \"audit_event\"\n    },\n    \"exportedAt\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n    },\n    \"exporter\": {\n      \"$ref\": \"review-shared.schema.json#/$defs/installationId\"\n    },\n    \"entity\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"publicId\",\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\",\n        \"packagePublicId\",\n        \"entityRef\",\n        \"eventType\",\n        \"authorship\",\n        \"occurredAt\"\n      ],\n      \"properties\": {\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/origin\"\n        },\n        \"entityRef\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/entityRef\"\n        },\n        \"eventType\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 128\n        },\n        \"occurredAt\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/timestamp\"\n        },\n        \"previousRevision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"resultingRevision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"payloadDigest\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/digest\"\n        },\n        \"authorship\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/authorship\"\n        },\n        \"publicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        },\n        \"packagePublicId\": {\n          \"$ref\": \"review-shared.schema.json#/$defs/publicId\"\n        }\n      },\n      \"unevaluatedProperties\": false\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/response-frontmatter.schema.json","digest":"sha256:019feb86e0092ffd64cb21103dda201631e8d2b335f2ee69685f49481cab1d09","mediaType":"application/json","content":"{\"$schema\":\"https://json-schema.org/draft/2020-12/schema\",\"$id\":\"https://schemas.orivelaiq.dev/review-exchange/v1/response-frontmatter.schema.json\",\"title\":\"Review response Markdown front matter\",\"type\":\"object\",\"additionalProperties\":false,\"required\":[\"schemaVersion\",\"publicId\",\"itemPublicId\",\"responseType\",\"status\",\"authorship\",\"basedOn\",\"createdAt\"],\"properties\":{\"schemaVersion\":{\"const\":\"1.0.0\"},\"publicId\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"},\"itemPublicId\":{\"$ref\":\"review-shared.schema.json#/$defs/publicId\"},\"responseType\":{\"enum\":[\"comment\",\"clarification\",\"evidence\",\"change_proposal\",\"change_evidence\",\"verification_note\",\"decision_note\"]},\"status\":{\"enum\":[\"submitted\",\"accepted\",\"rejected\",\"superseded\",\"stale\",\"conflicting\"]},\"authorship\":{\"$ref\":\"review-shared.schema.json#/$defs/authorship\"},\"basedOn\":{\"$ref\":\"review-shared.schema.json#/$defs/basedOn\"},\"createdAt\":{\"$ref\":\"review-shared.schema.json#/$defs/timestamp\"}}}\n"},{"path":"contracts/review-exchange/v1/review-shared.schema.json","digest":"sha256:3b0d4ac332b3cd6f5c3d6d9621e055ac0d05ffa4904b38b5a1d3fc5258da36d9","mediaType":"application/json","content":"{\n  \"$schema\": \"https://json-schema.org/draft/2020-12/schema\",\n  \"$id\": \"https://schemas.orivelaiq.dev/review-exchange/v1/review-shared.schema.json\",\n  \"title\": \"OrivelaIQ Review Exchange shared definitions\",\n  \"$defs\": {\n    \"installationId\": {\n      \"type\": \"string\",\n      \"format\": \"uuid\"\n    },\n    \"timestamp\": {\n      \"type\": \"string\",\n      \"format\": \"date-time\"\n    },\n    \"digest\": {\n      \"type\": \"string\",\n      \"pattern\": \"^sha256:[0-9a-f]{64}$\"\n    },\n    \"entityRef\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"installationId\",\n        \"entityType\",\n        \"publicId\"\n      ],\n      \"properties\": {\n        \"installationId\": {\n          \"$ref\": \"#/$defs/installationId\"\n        },\n        \"entityType\": {\n          \"enum\": [\n            \"package\",\n            \"item\",\n            \"contribution\",\n            \"response\",\n            \"decision\",\n            \"verification\",\n            \"result_report\",\n            \"audit_event\"\n          ]\n        },\n        \"publicId\": {\n          \"$ref\": \"#/$defs/publicId\"\n        }\n      }\n    },\n    \"origin\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"type\",\n        \"installationId\"\n      ],\n      \"properties\": {\n        \"type\": {\n          \"enum\": [\n            \"orivelaiq_ui\",\n            \"review_exchange\",\n            \"migration\",\n            \"system\"\n          ]\n        },\n        \"installationId\": {\n          \"$ref\": \"#/$defs/installationId\"\n        },\n        \"source\": {\n          \"$ref\": \"#/$defs/entityRef\"\n        },\n        \"importedAt\": {\n          \"$ref\": \"#/$defs/timestamp\"\n        }\n      }\n    },\n    \"context\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"artifactPath\",\n        \"revision\",\n        \"contextHash\"\n      ],\n      \"properties\": {\n        \"artifactId\": {\n          \"type\": \"string\",\n          \"maxLength\": 256\n        },\n        \"artifactPath\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 4096\n        },\n        \"headingId\": {\n          \"type\": \"string\",\n          \"maxLength\": 512\n        },\n        \"sectionTitle\": {\n          \"type\": \"string\",\n          \"maxLength\": 1024\n        },\n        \"excerpt\": {\n          \"type\": \"string\",\n          \"maxLength\": 16384\n        },\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"contextHash\": {\n          \"$ref\": \"#/$defs/digest\"\n        }\n      }\n    },\n    \"metadata\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"revision\",\n        \"createdAt\",\n        \"updatedAt\",\n        \"origin\"\n      ],\n      \"properties\": {\n        \"revision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"createdAt\": {\n          \"$ref\": \"#/$defs/timestamp\"\n        },\n        \"updatedAt\": {\n          \"$ref\": \"#/$defs/timestamp\"\n        },\n        \"origin\": {\n          \"$ref\": \"#/$defs/origin\"\n        }\n      }\n    },\n    \"attachment\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"name\",\n        \"mediaType\",\n        \"digest\"\n      ],\n      \"oneOf\": [\n        {\n          \"required\": [\n            \"relativePath\"\n          ]\n        },\n        {\n          \"required\": [\n            \"uri\"\n          ]\n        }\n      ],\n      \"properties\": {\n        \"name\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 256\n        },\n        \"mediaType\": {\n          \"type\": \"string\",\n          \"pattern\": \"^[^/ ]+/[^/ ]+$\"\n        },\n        \"digest\": {\n          \"$ref\": \"#/$defs/digest\"\n        },\n        \"relativePath\": {\n          \"type\": \"string\",\n          \"pattern\": \"^(?!/)(?!.*(?:^|/)\\\\.\\\\.(?:/|$)).+$\",\n          \"maxLength\": 4096\n        },\n        \"uri\": {\n          \"type\": \"string\",\n          \"format\": \"uri\",\n          \"maxLength\": 4096\n        }\n      }\n    },\n    \"envelope\": {\n      \"type\": \"object\",\n      \"required\": [\n        \"schemaVersion\",\n        \"entityType\",\n        \"exportedAt\",\n        \"exporter\",\n        \"entity\"\n      ],\n      \"properties\": {\n        \"schemaVersion\": {\n          \"const\": \"1.0.0\"\n        },\n        \"entityType\": {\n          \"enum\": [\n            \"installation\",\n            \"package\",\n            \"item\",\n            \"contribution\",\n            \"response\",\n            \"decision\",\n            \"verification\",\n            \"result_report\",\n            \"audit_event\"\n          ]\n        },\n        \"exportedAt\": {\n          \"$ref\": \"#/$defs/timestamp\"\n        },\n        \"exporter\": {\n          \"$ref\": \"#/$defs/installationId\"\n        }\n      }\n    },\n    \"authorship\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"type\"\n      ],\n      \"properties\": {\n        \"type\": {\n          \"enum\": [\n            \"human\",\n            \"ai\",\n            \"ai_assisted\",\n            \"tool\",\n            \"system\",\n            \"unknown\"\n          ]\n        },\n        \"installationId\": {\n          \"$ref\": \"#/$defs/installationId\"\n        },\n        \"subjectId\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 512\n        },\n        \"displayName\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 256\n        },\n        \"toolName\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 256\n        },\n        \"modelName\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 256\n        },\n        \"humanReviewerId\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 512\n        }\n      },\n      \"allOf\": [\n        {\n          \"if\": {\n            \"properties\": {\n              \"type\": {\n                \"const\": \"ai_assisted\"\n              }\n            }\n          },\n          \"then\": {\n            \"required\": [\n              \"humanReviewerId\"\n            ]\n          }\n        },\n        {\n          \"if\": {\n            \"properties\": {\n              \"type\": {\n                \"enum\": [\n                  \"ai\",\n                  \"ai_assisted\"\n                ]\n              }\n            }\n          },\n          \"then\": {\n            \"required\": [\n              \"modelName\"\n            ]\n          }\n        },\n        {\n          \"if\": {\n            \"properties\": {\n              \"type\": {\n                \"const\": \"tool\"\n              }\n            }\n          },\n          \"then\": {\n            \"required\": [\n              \"toolName\"\n            ]\n          }\n        }\n      ]\n    },\n    \"basedOn\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"packagePublicId\",\n        \"packageRevision\",\n        \"exportedAt\"\n      ],\n      \"properties\": {\n        \"packagePublicId\": {\n          \"$ref\": \"#/$defs/publicId\"\n        },\n        \"packageRevision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"itemPublicId\": {\n          \"$ref\": \"#/$defs/publicId\"\n        },\n        \"itemRevision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"contextRevision\": {\n          \"type\": \"integer\",\n          \"minimum\": 1\n        },\n        \"contextHash\": {\n          \"$ref\": \"#/$defs/digest\"\n        },\n        \"exportedAt\": {\n          \"$ref\": \"#/$defs/timestamp\"\n        }\n      }\n    },\n    \"violation\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"code\",\n        \"severity\",\n        \"message\"\n      ],\n      \"properties\": {\n        \"code\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 128,\n          \"enum\": [\n            \"OPEN_MANDATORY_ITEMS\",\n            \"RISK_ACCEPTANCE_REQUIRED\",\n            \"FINDING_REJECTION_REASON_REQUIRED\",\n            \"DEFERRED_OWNER_REQUIRED\",\n            \"DEFERRED_DUE_DATE_REQUIRED\",\n            \"PARKING_LOT_REASON_REQUIRED\",\n            \"CONFLICTING_RESPONSES\",\n            \"STALE_RESPONSE\",\n            \"INVALID_TRANSITION\"\n          ]\n        },\n        \"severity\": {\n          \"enum\": [\n            \"error\",\n            \"warning\",\n            \"info\"\n          ]\n        },\n        \"message\": {\n          \"type\": \"string\",\n          \"minLength\": 1,\n          \"maxLength\": 4096\n        },\n        \"entityRef\": {\n          \"$ref\": \"#/$defs/entityRef\"\n        },\n        \"jsonPointer\": {\n          \"type\": \"string\",\n          \"maxLength\": 2048\n        },\n        \"ruleId\": {\n          \"type\": \"string\",\n          \"maxLength\": 256\n        }\n      }\n    },\n    \"policy\": {\n      \"type\": \"object\",\n      \"additionalProperties\": false,\n      \"required\": [\n        \"policyVersion\",\n        \"staleResponseHandling\",\n        \"conflictingResponseHandling\",\n        \"allowCompletionWithOpenItems\",\n        \"requireRiskAcceptanceForOpenMandatoryItems\",\n        \"requireReasonForFindingRejection\",\n        \"requireOwnerAndDueDateForDeferredMandatoryItems\",\n        \"requireReasonForParkingLot\"\n      ],\n      \"properties\": {\n        \"policyVersion\": {\n          \"const\": \"1.0\"\n        },\n        \"staleResponseHandling\": {\n          \"enum\": [\n            \"manual_review\",\n            \"reject\"\n          ]\n        },\n        \"conflictingResponseHandling\": {\n          \"const\": \"decision_required\"\n        },\n        \"allowCompletionWithOpenItems\": {\n          \"type\": \"boolean\"\n        },\n        \"requireRiskAcceptanceForOpenMandatoryItems\": {\n          \"const\": true\n        },\n        \"requireReasonForFindingRejection\": {\n          \"const\": true\n        },\n        \"requireOwnerAndDueDateForDeferredMandatoryItems\": {\n          \"const\": true\n        },\n        \"requireReasonForParkingLot\": {\n          \"const\": true\n        }\n      }\n    },\n    \"publicId\": {\n      \"type\": \"string\",\n      \"format\": \"uuid\"\n    }\n  }\n}\n"},{"path":"contracts/review-exchange/v1/README.md","digest":"sha256:2bc4187b53f9fc71725b8106866018976b1c5fdbf4035699c97de281bb418832","mediaType":"text/markdown","content":"---\nrole: authority\nlifecycle: frozen\nversion: \"1.0.0\"\nlanguage: en\n---\n# OrivelaIQ Review Exchange 1.0.0\n\n`manifest.json` is the normative schema inventory. Structured artifacts are YAML documents validated against the listed JSON Schema 2020-12 schemas after safe parsing. Response Markdown uses YAML front matter validated by `response-frontmatter.schema.json`; `context.md`, `evidence.md`, and response bodies are passive Markdown.\n\nThe normative tree begins at `installations/<installationId>/installation.yaml`, with packages below `review-packages/<packagePublicId>/`. Package and item metadata use `package.yaml` and `items/<itemPublicId>/item.yaml`; context/evidence are adjacent managed Markdown; each externally authored response contains `response.yaml` and `response.md` under one shared author authority; item attachments use `items/<itemPublicId>/attachments/**`; reports are exactly `current-status.md`, `result-report.md`, and `result-report.json`. Package-level `attachments/**` is an optional compatibility extension; `execution-results/**` and `sync/**` are governed package paths. Exchange IDs are UUID public IDs—never internal `rv*_` database IDs.\n\nConsumers must enforce path authority and byte/file limits before parsing, reject duplicate YAML keys and unknown fields, validate Unicode and references, and then apply local authorization and transition policy. Schema validity and authorship metadata are not authorization. Compatibility follows semantic versioning; producers emit exactly `1.0.0` for this slice.\n"}]}