{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://getzero.dev/contracts/zero.capital_operation.v1.schema.json",
  "title": "ZERO CapitalOperation v1",
  "description": "The envelope for anything that can touch money, authority, payment, task settlement, or proof. Agents never call rails directly; they create and advance CapitalOperations. Policy-checked, simulated, signed under scoped authority, executed through a rail, replayable from receipts. The runtime validator (zero.protocol.capital_operation) additionally enforces per-kind consequence-class floors under the rule: class = worst reachable consequence, not stated intent.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "schema",
    "op_id",
    "created_at",
    "idempotency_key",
    "expires_at",
    "created_by",
    "principal",
    "intent",
    "operation_kind",
    "consequence_class",
    "rail",
    "actions",
    "authority",
    "policy",
    "simulation",
    "budget",
    "signatures",
    "expected_receipts",
    "status",
    "receipts"
  ],
  "properties": {
    "schema": { "const": "zero.capital_operation.v1" },
    "op_id": { "type": "string", "pattern": "^op_[A-Za-z0-9_-]+$" },
    "created_at": { "type": "string", "format": "date-time" },
    "idempotency_key": { "type": "string", "minLength": 1 },
    "expires_at": { "type": "string", "format": "date-time" },
    "created_by": {
      "type": "object",
      "additionalProperties": false,
      "required": ["actor_type", "actor_id"],
      "properties": {
        "actor_type": { "enum": ["human", "agent", "service", "system"] },
        "actor_id": { "type": "string", "minLength": 1 }
      }
    },
    "principal": {
      "type": "object",
      "additionalProperties": false,
      "required": ["owner_id", "capital_account_id"],
      "properties": {
        "owner_id": { "type": "string", "minLength": 1 },
        "capital_account_id": { "type": "string", "minLength": 1 }
      }
    },
    "intent": {
      "type": "object",
      "additionalProperties": true,
      "required": ["natural_language", "normalized", "source"],
      "properties": {
        "natural_language": { "type": "string", "minLength": 1 },
        "normalized": { "type": "string", "minLength": 1 },
        "source": { "enum": ["mcp", "api", "composer", "cli", "schedule", "webhook"] }
      }
    },
    "operation_kind": {
      "enum": [
        "READ",
        "QUOTE",
        "PAUSE",
        "KILL",
        "CANCEL",
        "FLATTEN",
        "REVOKE",
        "REVOKE_SCOPE",
        "DISPUTE_OPEN",
        "PAY_X402",
        "PAY_MODEL",
        "PAY_DATA",
        "REFUEL",
        "CREATE_TASK",
        "BID_TASK",
        "ACCEPT_TASK",
        "EVALUATOR_VOTE",
        "SEND",
        "SWAP",
        "TRADE",
        "SIGN",
        "PAY_AGENT",
        "ESCROW_CREATE",
        "ESCROW_RELEASE",
        "ESCROW_REFUND",
        "APPROVE",
        "BRIDGE",
        "ROTATE_SIGNER",
        "DELEGATE_SCOPE"
      ]
    },
    "consequence_class": {
      "type": "integer",
      "minimum": 0,
      "maximum": 5,
      "description": "0 read-only · 1 reversible/risk-reducing · 2 bounded spend · 3 capital move · 4 authority/cross-domain · 5 irreversible (never delegable, ceremony required)"
    },
    "rail": {
      "enum": ["evm", "hyperliquid", "okx", "x402", "a2a", "bnb", "xlayer", "solana", "bank", "internal"]
    },
    "actions": {
      "type": "array",
      "items": { "type": "object" },
      "description": "Rail-specific action payloads. Typed per adapter; never executed directly by agents."
    },
    "authority": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "scope_id",
        "scope_epoch",
        "class_ceiling",
        "fresh_signature_required",
        "quorum_required",
        "human_ceremony_required"
      ],
      "properties": {
        "scope_id": { "type": "string", "minLength": 1 },
        "scope_epoch": { "type": "integer", "minimum": 0 },
        "class_ceiling": { "type": "integer", "minimum": 0, "maximum": 5 },
        "fresh_signature_required": { "type": "boolean" },
        "quorum_required": { "type": "boolean" },
        "human_ceremony_required": { "type": "boolean" }
      }
    },
    "policy": {
      "type": "object",
      "additionalProperties": false,
      "required": ["policy_id", "policy_hash", "compiler_version"],
      "properties": {
        "policy_id": { "type": "string", "minLength": 1 },
        "policy_hash": { "type": "string", "minLength": 1 },
        "compiler_version": { "type": "string", "minLength": 1 }
      }
    },
    "simulation": {
      "type": "object",
      "additionalProperties": true,
      "properties": {
        "simulation_hash": { "type": "string" },
        "state_snapshot_hash": { "type": "string" },
        "risk_delta": { "type": "string" },
        "quote_hash": { "type": "string" },
        "quote_expires_at": { "type": "string", "format": "date-time" },
        "max_drift_bps": { "type": "number", "minimum": 0 }
      },
      "description": "Bound to the signature challenge. Deterministic rails bind exact state hashes; CLOB rails bind a quote hash with expiry plus a policy-declared drift tolerance."
    },
    "budget": {
      "type": "object",
      "additionalProperties": true,
      "properties": {
        "budget_id": { "type": "string" },
        "cap": { "type": ["string", "number"] },
        "used": { "type": ["string", "number"] },
        "remaining": { "type": ["string", "number"] },
        "window": { "enum": ["daily", "weekly", "monthly", "session"] }
      }
    },
    "signatures": { "type": "array", "items": { "type": "object" } },
    "expected_receipts": {
      "type": "array",
      "items": { "$ref": "#/$defs/receiptKind" }
    },
    "status": {
      "enum": [
        "DRAFT",
        "QUOTED",
        "SIMULATED",
        "AUTHORIZED",
        "SUBMITTED",
        "SETTLED",
        "CONFIRMED",
        "RECONCILED",
        "REFUSED",
        "EXPIRED",
        "DISPUTED",
        "CANCELLED",
        "COMPENSATED"
      ]
    },
    "receipts": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "required": ["receipt_id", "kind"],
        "properties": {
          "receipt_id": { "type": "string", "minLength": 1 },
          "kind": { "$ref": "#/$defs/receiptKind" }
        }
      }
    }
  },
  "allOf": [
    {
      "if": { "properties": { "consequence_class": { "minimum": 2 } } },
      "then": {
        "properties": {
          "budget": {
            "required": ["budget_id", "cap", "used", "remaining", "window"],
            "properties": { "budget_id": { "type": "string", "minLength": 1 } }
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "consequence_class": { "minimum": 2 },
          "status": {
            "enum": [
              "SIMULATED",
              "AUTHORIZED",
              "SUBMITTED",
              "SETTLED",
              "CONFIRMED",
              "RECONCILED",
              "DISPUTED",
              "COMPENSATED"
            ]
          }
        },
        "required": ["consequence_class", "status"]
      },
      "then": {
        "properties": {
          "simulation": {
            "required": ["simulation_hash", "state_snapshot_hash"],
            "properties": {
              "simulation_hash": { "type": "string", "minLength": 1 },
              "state_snapshot_hash": { "type": "string", "minLength": 1 }
            }
          }
        }
      }
    },
    {
      "if": { "properties": { "consequence_class": { "minimum": 4 } } },
      "then": {
        "properties": {
          "authority": { "properties": { "fresh_signature_required": { "const": true } } }
        }
      }
    },
    {
      "if": { "properties": { "consequence_class": { "const": 5 } } },
      "then": {
        "properties": {
          "authority": {
            "properties": {
              "fresh_signature_required": { "const": true },
              "human_ceremony_required": { "const": true }
            }
          }
        }
      }
    },
    {
      "if": {
        "properties": {
          "consequence_class": { "minimum": 2 },
          "rail": { "enum": ["hyperliquid", "okx"] },
          "status": {
            "enum": [
              "SIMULATED",
              "AUTHORIZED",
              "SUBMITTED",
              "SETTLED",
              "CONFIRMED",
              "RECONCILED",
              "DISPUTED",
              "COMPENSATED"
            ]
          }
        },
        "required": ["consequence_class", "rail", "status"]
      },
      "then": {
        "properties": {
          "simulation": {
            "required": ["quote_hash", "quote_expires_at", "max_drift_bps"],
            "properties": {
              "quote_hash": { "type": "string", "minLength": 1 },
              "quote_expires_at": { "type": "string", "minLength": 1 }
            }
          }
        }
      }
    },
    {
      "if": { "properties": { "status": { "enum": ["SETTLED", "CONFIRMED", "RECONCILED"] } } },
      "then": {
        "properties": { "receipts": { "minItems": 1 } }
      }
    },
    {
      "if": { "properties": { "status": { "const": "REFUSED" } } },
      "then": {
        "properties": {
          "receipts": {
            "contains": { "properties": { "kind": { "const": "refusal" } }, "required": ["kind"] }
          }
        }
      }
    }
  ],
  "$defs": {
    "receiptKind": {
      "enum": [
        "intent",
        "policy",
        "simulation",
        "authorization",
        "execution",
        "settlement",
        "service",
        "work",
        "dispute",
        "refusal",
        "revocation",
        "reconciliation",
        "proof_packet"
      ]
    }
  }
}