# sow/laws-schema.ncl — standing-law contract for the provisioning catalog.
# Frozen design: provisioning/.coder/2026-07-03_laws-catalogo-provisioning.plan.md §3.
# Ratified rulings this schema encodes: R1 (wrks/ out of scope), R2 (in-container
# interpreters legitimate), R3 (evidence-only admission), R4 (declarative apply vs
# imperative get-decide-patch), J1 (minisign signing), J2 (L2 deferred).
#
# Signing is deliberately OUT-OF-BAND: the signature covers laws.ncl's bytes as a
# detached minisig sidecar (laws.ncl.minisig) verified against a known public key
# (~/.minisign/witness.pub). A `signature` field embedded in this record would be
# self-referential — pointing to a signature that must be computed over content
# that doesn't yet include the pointer, and invalidated by adding it after the fact.
# There is nothing to reference in-band; verification is a witness.nu convention
# (file exists + `minisign -V` against the known pubkey), not schema data.

let Status = [| 'Active, 'Deferred |] in

{
  Exemption = {
    path | String,
    why  | String,
  },

  Candidate = {
    path        | String,
    pattern     | String,
    remediation | String,
  },

  Law = {
    id         | String,
    status     | Status,
    why        | String,
    kind       | [| 'static, 'runtime, 'lock |],
    scope      | Array String,
    exclude    | Array String,
    check      | String,
    baseline   | String,
    exempt     | Array Exemption,
    candidates | Array Candidate | default = [],
  },

  Laws = {
    laws | Array Law,
  },
}