{
	"lexicon": 1,
	"id": "com.publicdomainrelay.temp.market.evaluatePolicy",
	"defs": {
		"main": {
			"type": "procedure",
			"description": "A socialweb.computer market policy's verdict on a counterparty (kcp parity). A hook contract: a module declares it in module.json hooks (the requester), a policy-* module implements it with its evaluate entry, and a composition routes one to the other. Input is kcp participant.PolicyInput (the gha-lite workflow inputs, camelCase); output is kcp executor.Verdict. An error is a deny (fail closed).",
			"input": {
				"encoding": "application/json",
				"schema": {
					"type": "object",
					"required": ["selfDid"],
					"properties": {
						"selfDid": { "type": "string", "format": "did", "description": "The evaluating party (the requester's market DID, or its operator DID in scope mode)." },
						"perspective": { "type": "string", "knownValues": ["requester", "bidder"], "description": "Default: the policy's side." },
						"mode": { "type": "string", "knownValues": ["scope", "full"], "description": "scope: the counterparty only (each bid); full: with the rfp and bid refs (the chosen winner, before the accept)." },
						"counterpartyDid": { "type": "string", "format": "did", "description": "Required in scope mode; default the subject." },
						"subjectDid": { "type": "string", "format": "did" },
						"rootRequesterDid": { "type": "string", "format": "did" },
						"rfp": { "type": "ref", "ref": "#record" },
						"bid": { "type": "ref", "ref": "#record" },
						"accept": { "type": "ref", "ref": "#record" },
						"args": { "type": "unknown", "description": "The policy record's args (kcp policy-args), e.g. { maxCpus } or { allowedPayloadNsids }." },
						"snapshot": { "type": "ref", "ref": "#snapshot" }
					}
				}
			},
			"output": {
				"encoding": "application/json",
				"schema": { "type": "ref", "ref": "#verdict" }
			}
		},
		"record": {
			"type": "object",
			"description": "A strong ref, with the record's value when the caller already has it (saves the policy a read).",
			"required": ["uri"],
			"properties": {
				"uri": { "type": "string", "format": "at-uri" },
				"cid": { "type": "string", "format": "cid" },
				"value": { "type": "unknown" }
			}
		},
		"snapshot": {
			"type": "object",
			"description": "The kcp trust snapshot (trust.BuildSnapshotWith); a trust policy given one makes no reads.",
			"properties": {
				"operatorOf": { "type": "unknown", "description": "DID -> verified operator DID." },
				"vouchedBy": { "type": "unknown", "description": "subject DID -> voucher DIDs." }
			}
		},
		"verdict": {
			"type": "object",
			"description": "kcp executor.Verdict. Anything but allow: true is a deny.",
			"required": ["allow", "violations"],
			"properties": {
				"allow": { "type": "boolean" },
				"violations": { "type": "array", "items": { "type": "ref", "ref": "#violation" } }
			}
		},
		"violation": {
			"type": "object",
			"required": ["msg"],
			"properties": {
				"msg": { "type": "string" },
				"policyId": { "type": "string", "description": "The policy (kcp workflow name, or the composition instance / handler a failed route names)." }
			}
		}
	}
}