Documentation
¶
Overview ¶
Package evidencetypes holds the in-tree evidence-type schemas (JSON Schema documents) and exposes the loader that registers them into the orchestrator's EvidenceType registry at bootstrap.
Evidence types are the contract that decouples policies from sources: a policy declares a slot Accepts a list of type IDs, a source plugin declares it Emits a list of type IDs, and the registry mediates. Two sources that both emit `user_record` are substitutable for any policy whose slot accepts `user_record` — no policy change required.
Schemas live as JSON files under `schemas/`, embedded into the binary via go:embed. Each file is a JSON Schema draft-07 document with a `title` (the type ID) and `version` (a monotonic integer). Schemas are append-only: a breaking change requires a new ID (`user_record.v2`), never a mutation of an existing one.
Project-local types under `.sigcomply/evidence_types/<id>.json` are compiled in by `sigcomply build` (M16) alongside the in-tree set. There is no runtime loading.
Schema-conformance validation of collected payloads is performed by the collector (L4) using the Validator in this package; a missing or invalid payload surfaces as a configuration error (exit code 3).
See docs/architecture/04a-evidence-type-registry.md.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CompileSchema ¶ added in v0.34.3
func CompileSchema(schema json.RawMessage) error
CompileSchema validates that a schema document is itself a well-formed JSON Schema (draft-07) — independent of any payload. Loaders use it to fail fast at bootstrap when a project-local evidence-type schema has a valid header but a structurally-invalid body (e.g. "minimum":"abc"), rather than deferring the error to collection time where it would tag only the consuming policies. Returns nil for a compilable schema.
func Register ¶
Register loads every embedded schema and inserts it into the EvidenceType registry. Intended to be called once at orchestrator bootstrap, before frameworks register policies (so the planner can later validate that slot.Accepts entries are known type IDs).
Duplicates and parse errors short-circuit and return a configuration error (exit code 3).
func Validate ¶
func Validate(schema, payload json.RawMessage) error
Validate checks that a JSON payload conforms to a schema document.
Unlike the earlier hand-rolled checker (which only enforced "type":"object", "required", and the primitive type of top-level properties), this is a full JSON Schema draft-07 validation via gojsonschema. Every constraint a schema declares is now enforced: enum, format, pattern, minimum/maximum, additionalProperties, and — critically — nested object `properties` and array `items` are validated recursively. A schema that declares a constraint can now rely on it being checked, instead of it being silently decorative.
Validation enforces the contract between a slot's `accepts:` list and the records bound sources emit: a payload that omits a required field, names a type wrong, or carries an out-of-enum value can never reach the evaluator. The collector calls Validate before signing; a failure surfaces as a configuration error (exit code 3).
func VerifyRegistrations ¶ added in v0.23.0
VerifyRegistrations enforces the evidence-type-registry-as-sole-mediator invariant (CLAUDE.md §Sacred Invariant #4) at bootstrap. Two checks:
Source coverage — every type ID a registered source plugin emits must have a registered EvidenceType (with schema). A plugin that emits an unregistered type would otherwise sail through to signing because schema validation has no schema to consult.
Policy coverage — every type ID a registered policy lists in slot.Accepts must have a registered EvidenceType. A typo or a reference to a deleted type would otherwise produce empty-set plan failures at run time rather than a clear startup error.
Both failures are configuration errors; the orchestrator turns them into exit code 3. Call after both Sources and Policies are populated.
Types ¶
This section is empty.
Source Files