{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "id": "https://api.vnaidentity.com/v1/schemas/ai.json",
  "title": "VNA Identity V10.x Technical Schema Manifest",
  "description": "The machine-readable dictionary outlining Zero-Knowledge Biometric (ZKB) parameters, OBSIDA API hard assertions, and Edge Privacy Consent Shield schemas.",
  "metadata": {
    "version": "10.1.0",
    "updatedAt": "2026-07-24T00:00:00Z",
    "environment": "Sovereign-Grid-Alpha"
  },
  "required": [
    "zero_knowledge_biometrics",
    "obsida_api_hardening",
    "edge_privacy_consent_shield",
    "compliance_kernels"
  ],
  "properties": {
    "zero_knowledge_biometrics": {
      "type": "object",
      "description": "Technical parameters for You Control™ Edge-based Zero-Knowledge Proof biometrics.",
      "properties": {
        "proof_size_kb": {
          "type": "integer",
          "const": 108,
          "description": "Succinct zk-SNARK proof size (pi) generated locally."
        },
        "proving_time_ms_target": {
          "type": "integer",
          "const": 92,
          "description": "Target client-side proving latency on commodity hardware."
        },
        "verification_time_ms_target": {
          "type": "integer",
          "const": 23,
          "description": "Target backend verification latency."
        },
        "biological_data_retention_bytes": {
          "type": "integer",
          "const": 0,
          "description": "Strict zero-retention mandate for central databases to bypass BIPA/GDPR liabilities."
        },
        "shamir_secret_sharing": {
          "type": "object",
          "properties": {
            "shares_n": {
              "type": "integer",
              "const": 3
            },
            "threshold_k": {
              "type": "integer",
              "const": 2
            },
            "shard_allocation": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "default": [
                "Local Hardware Secure Enclave",
                "Operating System Cloud Backup",
                "Offline Blind Escrow Vault"
              ]
            }
          },
          "required": ["shares_n", "threshold_k", "shard_allocation"]
        }
      },
      "required": [
        "proof_size_kb",
        "proving_time_ms_target",
        "verification_time_ms_target",
        "biological_data_retention_bytes",
        "shamir_secret_sharing"
      ]
    },
    "obsida_api_hardening": {
      "type": "object",
      "description": "Cryptographic verification parameters for K.Y.A. (Know Your Agent) and DPoP integrations.",
      "properties": {
        "asymmetric_kya_shield": {
          "type": "object",
          "properties": {
            "signature_header_required": {
              "type": "string",
              "const": "Signature-Input"
            },
            "verification_algorithms": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "default": ["ES256"]
            },
            "serialization_law_middleware": {
              "type": "string",
              "const": "app.use(express.json({ verify: (req, res, buf) => { req.rawBody = buf; } }));"
            },
            "hash_algorithm": {
              "type": "string",
              "const": "SHA256"
            }
          },
          "required": [
            "signature_header_required",
            "verification_algorithms",
            "serialization_law_middleware",
            "hash_algorithm"
          ]
        },
        "dpop_token_binding": {
          "type": "object",
          "properties": {
            "rfc_standard": {
              "type": "string",
              "const": "RFC 9449"
            },
            "algorithm": {
              "type": "string",
              "const": "ES256"
            },
            "key_type": {
              "type": "string",
              "const": "P-256"
            },
            "extractable": {
              "type": "boolean",
              "const": false
            }
          },
          "required": ["rfc_standard", "algorithm", "key_type", "extractable"]
        }
      },
      "required": ["asymmetric_kya_shield", "dpop_token_binding"]
    },
    "edge_privacy_consent_shield": {
      "type": "object",
      "description": "Configuration boundaries for the client-side CIPA Consent Shield.",
      "properties": {
        "client_interceptor_wrapper": {
          "type": "string",
          "const": "cipa-consent-wrapper.js"
        },
        "blocked_domains": {
          "type": "array",
          "items": {
            "type": "string"
          },
          "default": [
            "connect.facebook.net",
            "googletagmanager.com",
            "google-analytics.com",
            "hotjar.com",
            "fullstory.com"
          ]
        },
        "server_side_capi_routing": {
          "type": "boolean",
          "const": true,
          "description": "Enforces backend server-to-server Conversions API routing to render client-side web traffic invisible."
        }
      },
      "required": ["client_interceptor_wrapper", "blocked_domains", "server_side_capi_routing"]
    },
    "compliance_kernels": {
      "type": "object",
      "description": "Global compliance equations, time constants, and economic limits.",
      "properties": {
        "pqc_latency_shield": {
          "type": "object",
          "properties": {
            "supported_algorithms": {
              "type": "array",
              "items": {
                "type": "string"
              },
              "default": ["ML-KEM-768", "ML-DSA-65"]
            },
            "initial_congestion_window": {
              "type": "string",
              "const": "My_IW20",
              "description": "Hardcoded CDN/edge window optimized to fit hybrid 22KB certificates in a single network flight (preserving 1-RTT)."
            }
          },
          "required": ["supported_algorithms", "initial_congestion_window"]
        },
        "idempotency_deep_lock": {
          "type": "object",
          "properties": {
            "hash_equation": {
              "type": "string",
              "const": "SHA256(Order_Reference + PUF_Hash + Amount + Intent)"
            },
            "lock_prefix": {
              "type": "string",
              "const": "concurrency_lock:"
            },
            "ttl_seconds": {
              "type": "integer",
              "const": 300
            }
          },
          "required": ["hash_equation", "lock_prefix", "ttl_seconds"]
        },
        "decay_threshold": {
          "type": "object",
          "properties": {
            "protocol_code": {
              "type": "string",
              "const": "Protocol 42"
            },
            "polling_silence_limit_seconds": {
              "type": "integer",
              "const": 14400,
              "description": "4-hour absolute mathematical limit for O2C polling silence before Latency Fracture alert."
            }
          },
          "required": ["protocol_code", "polling_silence_limit_seconds"]
        },
        "project_delay_probability": {
          "type": "object",
          "properties": {
            "equation_p_d": {
              "type": "string",
              "const": "P(D) = 1 - e^(-lambda * T_risk)"
            },
            "equation_t_risk": {
              "type": "string",
              "const": "T_risk = w1 * max(0, (C - 0.30)/0.30) + w2 * max(0, W - 2) + w3 * max(0, (H - 48)/48)"
            }
          },
          "required": ["equation_p_d", "equation_t_risk"]
        },
        "stateless_pisp_mandate": {
          "type": "boolean",
          "const": true,
          "description": "Enforces total decoupling from PAN custody, removing PCI DSS Requirements 6.4.3 and 11.6.1 of applicability."
        }
      },
      "required": [
        "pqc_latency_shield",
        "idempotency_deep_lock",
        "decay_threshold",
        "project_delay_probability",
        "stateless_pisp_mandate"
      ]
    }
  }
}