{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://techtalks.itsumarfarooq.com/schemas/kit-security-checks.schema.json",
  "title": "TechTalks Kit Security Manifest",
  "description": "Canonical security control manifest for a stack kit. One flat list of controls, each mapped to OWASP Top 10:2025 and backed by an evidence pointer into the kit.",
  "type": "object",
  "required": ["schema_version", "kit_slug", "updated_at", "checks"],
  "additionalProperties": false,
  "properties": {
    "$schema": {
      "type": "string",
      "description": "Relative path to this schema, for editor autocompletion."
    },
    "schema_version": {
      "const": "2.0.0"
    },
    "kit_slug": {
      "type": "string",
      "pattern": "^[a-z0-9]+(-[a-z0-9]+)*$",
      "description": "Must match the kit's directory name and kit.yaml slug."
    },
    "updated_at": {
      "type": "string",
      "format": "date",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$"
    },
    "owasp_edition": {
      "const": "2025",
      "description": "OWASP Top 10 edition the owasp fields reference."
    },
    "summary": {
      "type": "object",
      "description": "Derived totals. Regenerated by tools/validate_checks.py --fix; never hand-edit.",
      "required": ["total", "by_severity", "owasp_covered"],
      "additionalProperties": false,
      "properties": {
        "total": { "type": "integer", "minimum": 12 },
        "categories": { "type": "integer", "minimum": 1 },
        "by_status": {
          "type": "object",
          "additionalProperties": { "type": "integer", "minimum": 0 }
        },
        "by_severity": {
          "type": "object",
          "additionalProperties": { "type": "integer", "minimum": 0 }
        },
        "owasp_covered": {
          "type": "array",
          "items": { "$ref": "#/$defs/owaspId" },
          "uniqueItems": true
        }
      }
    },
    "checks": {
      "type": "array",
      "minItems": 12,
      "description": "At least 12 controls per kit, enforced by tools/audit_kit.py.",
      "items": { "$ref": "#/$defs/check" }
    }
  },
  "$defs": {
    "owaspId": {
      "type": "string",
      "pattern": "^A(0[1-9]|10):2025$",
      "description": "OWASP Top 10:2025 category identifier."
    },
    "check": {
      "type": "object",
      "required": ["id", "category", "name", "status", "severity", "owasp"],
      "additionalProperties": false,
      "properties": {
        "id": {
          "type": "string",
          "pattern": "^[A-Z][A-Z0-9]{1,11}-[0-9]{2}$",
          "description": "Stable identifier, unique within the kit. Example: AUTH-01."
        },
        "category": {
          "type": "string",
          "minLength": 3,
          "maxLength": 80,
          "description": "Human-readable grouping used for rendering, e.g. 'Authentication & Session Security'."
        },
        "name": {
          "type": "string",
          "minLength": 8,
          "maxLength": 160,
          "description": "What the control guarantees, stated as an assertion."
        },
        "description": {
          "type": "string",
          "maxLength": 400,
          "description": "Optional detail on how the guarantee is achieved."
        },
        "status": {
          "enum": ["enforced", "advisory", "not-applicable"],
          "description": "enforced = CI or code fails without it; advisory = documented guidance; not-applicable = deliberately out of scope for this stack."
        },
        "severity": {
          "enum": ["critical", "high", "medium", "low"]
        },
        "owasp": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/owaspId" }
        },
        "cwe": {
          "type": "array",
          "uniqueItems": true,
          "items": {
            "type": "string",
            "pattern": "^CWE-[0-9]{1,4}$"
          }
        },
        "evidence": {
          "$ref": "#/$defs/evidence"
        }
      }
    },
    "evidence": {
      "type": "object",
      "description": "Where the control is demonstrably enforced inside the kit.",
      "required": ["kind", "path"],
      "additionalProperties": false,
      "properties": {
        "kind": {
          "enum": ["test", "workflow", "rule", "docker", "migration", "config", "source", "tool", "endpoint", "docs"]
        },
        "path": {
          "type": "string",
          "minLength": 3,
          "maxLength": 200,
          "description": "Kit-relative path, or a tool/endpoint identifier when kind is tool or endpoint."
        }
      }
    }
  }
}