{
  "$id": "https://schemas.ump.dev/v1/log-entry.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "Spec \u00a718 log entry: the record appended under a domain tag. The leaf is\n``SHA-256(0x00 || domain_tag || 0x0A || JCS(log_entry))``; the record itself is bound by ``content_hash``.",
  "properties": {
    "content_hash": {
      "description": "sha256 of the RFC 8785 bytes of the complete stored record, governance members included (differs from the \u00a76 artifact content hash).",
      "pattern": "^sha256:[0-9a-f]{64}$",
      "title": "Content Hash",
      "type": "string"
    },
    "key_version": {
      "description": "Version of the key that signed the record.",
      "minLength": 1,
      "title": "Key Version",
      "type": "string"
    },
    "kind": {
      "description": "Kind of the sealed record.",
      "minLength": 1,
      "title": "Kind",
      "type": "string"
    },
    "record_id": {
      "description": "Id of the sealed record (approval, decision, override, ...).",
      "minLength": 1,
      "title": "Record Id",
      "type": "string"
    },
    "signed_at": {
      "description": "Instant the record was sealed (RFC 3339, UTC, Z, milliseconds).",
      "format": "date-time",
      "title": "Signed At",
      "type": "string"
    },
    "subject_ref": {
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "null"
        }
      ],
      "default": null,
      "description": "HMAC-SHA-256(k_subject, person_ref), only when the record relates to a person (\u00a718 Erasure).",
      "title": "Subject Ref"
    }
  },
  "required": [
    "record_id",
    "kind",
    "content_hash",
    "key_version",
    "signed_at"
  ],
  "title": "LogEntry",
  "type": "object"
}