{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://openguardrails.com/schema/0.4/guard-event.schema.json",
  "title": "GuardEvent",
  "description": "A unit observed at an OGR interception point.",
  "type": "object",
  "required": ["ogr_version", "event_id", "guard_id", "timestamp", "observation_point", "kind", "subject", "payload"],
  "additionalProperties": false,
  "properties": {
    "ogr_version": { "type": "string", "const": "0.4" },
    "event_id": { "type": "string", "minLength": 1 },
    "guard_id": { "type": "string", "minLength": 1 },
    "session_id": { "type": "string" },
    "timestamp": { "type": "string", "format": "date-time" },
    "observation_point": { "enum": ["conversation", "invocation", "execution"] },
    "sensor": {
      "type": "object",
      "description": "WHICH integration observed this — the mechanism axis, orthogonal to observation_point's altitude.",
      "required": ["id"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string", "minLength": 1 },
        "class": { "enum": ["in_process", "wrapper", "proxy", "kernel"] },
        "version": { "type": "string" }
      }
    },
    "kind": {
      "enum": ["user_input", "model_output", "tool_register", "mcp_connect", "skill_load", "tool_call", "tool_result", "exec", "network", "file", "agent_spawn", "config_change"]
    },
    "llm_protocol": { "enum": ["openai.chat", "openai.responses", "anthropic.messages", null] },
    "subject": {
      "type": "object",
      "required": ["agent_id"],
      "properties": {
        "agent_id": { "type": "string" },
        "agent_type": { "type": "string" },
        "principal": { "type": "string" },
        "principal_group": { "type": "string" },
        "sandbox_id": { "type": "string" },
        "parent_agent_id": { "type": "string" },
        "delegation_chain": { "type": "array", "items": { "type": "string" } }
      }
    },
    "payload": { "type": "object" },
    "content_encoding": { "enum": ["raw", "redacted", "hashed", "metadata_only"], "default": "raw" },
    "redactions": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["path", "start", "end"],
        "additionalProperties": false,
        "properties": {
          "path":     { "type": "string" },
          "start":    { "type": "integer", "minimum": 0 },
          "end":      { "type": "integer", "minimum": 0 },
          "category": { "type": "string", "pattern": "^(safety|security|privacy|x)\\.[a-z0-9_.]+$" },
          "operator": { "enum": ["replace", "mask", "hash", "encrypt"] },
          "ref":      { "type": "string" }
        }
      }
    },
    "context_refs": { "type": "array", "items": { "type": "string" } },
    "provenance": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["source", "trust"],
        "additionalProperties": false,
        "properties": {
          "source": { "enum": ["system", "user", "model", "tool_result", "web", "mcp", "file", "retrieved"] },
          "trust": { "enum": ["trusted", "untrusted", "unverified"] },
          "ref": { "type": "string" },
          "taint_tags": { "type": "array", "items": { "type": "string" } }
        }
      }
    }
  }
}