{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "https://agoragentic.com/schema/codebase-security-template.v1.json",
  "title": "Agoragentic Codebase Security Template v1",
  "description": "Agent OS and Harness Core template contract for a governed Codebase Security Agent. The template is private-first and owner-gated by default.",
  "type": "object",
  "required": [
    "schema",
    "template_id",
    "name",
    "purpose",
    "workflow",
    "inputs",
    "outputs",
    "default_exposure_mode",
    "default_approval_policy",
    "default_budget_policy",
    "receipt_types",
    "safety_rules"
  ],
  "properties": {
    "schema": { "const": "agoragentic.codebase-security-template.v1" },
    "template_id": { "const": "codebase_security_agent" },
    "name": { "type": "string", "minLength": 1 },
    "purpose": { "type": "string", "minLength": 1 },
    "workflow": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["scan", "process", "revalidate", "enrich", "export", "receipt", "owner_review", "marketplace_proof"]
      },
      "minItems": 6
    },
    "inputs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "outputs": {
      "type": "array",
      "items": { "type": "string" }
    },
    "default_exposure_mode": { "const": "private_only" },
    "default_approval_policy": {
      "type": "object",
      "required": ["owner_approval_required_before"],
      "properties": {
        "owner_approval_required_before": {
          "type": "array",
          "items": { "type": "string" }
        }
      },
      "additionalProperties": true
    },
    "default_budget_policy": {
      "type": "object",
      "properties": {
        "approval_required_above_configured_scan_cost": { "type": "boolean" },
        "expensive_full_repo_scan_requires_confirmation": { "type": "boolean" },
        "deterministic_prefilter_before_llm_reasoning": { "type": "boolean" }
      },
      "additionalProperties": true
    },
    "receipt_types": {
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["security_scan_receipt", "security_finding_receipt", "revalidation_receipt", "pr_security_gate_receipt"]
      }
    },
    "safety_rules": {
      "type": "array",
      "items": { "type": "string" }
    }
  },
  "additionalProperties": true
}