{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://genai-security-project.github.io/agent-control-standard/schema/v0.1.0/provenance-summary.json",
  "title": "ACS Provenance Summary",
  "description": "Condensed view of provenance facts for cumulative or session-level policy decisions. Computed by Guardian framework code from the Provenance objects observed at a step (entry-level summary) or across the session to date (session-level summary). All fields are OPTIONAL — Guardians populate the fields their policies actually consume. Used by paradigms that reason over accumulated context (AARM cumulative-context, FIDES session-level integrity); paradigms that don't (e.g., pure IBAC) can omit the entire object. v0.1 summaries carry origin-derived aggregates only; trust-derived aggregates (e.g., lowest_trust, earliest_untrusted_step_id) are Guardian-internal in v0.1 because trust classification is computed in policy from origin/source_id, not carried on the wire (§7.1).",
  "type": "object",
  "properties": {
    "origins_seen": {
      "type": "array",
      "uniqueItems": true,
      "items": {
        "type": "string",
        "enum": [
          "user_input",
          "system",
          "tool_output",
          "retrieved",
          "agent_generated",
          "a2a_inbound",
          "external"
        ]
      },
      "description": "Distinct origins observed in the scope of this summary. The primary v0.1 signal for cumulative-context and session-integrity policies — Guardians map origins (and source_ids) to trust internally per local policy."
    },
    "entry_count": {
      "type": "integer",
      "minimum": 0,
      "description": "Total number of Provenance objects (entry-level) or ContextEntries (session-level) summarized."
    },
    "entry_count_by_origin": {
      "type": "object",
      "additionalProperties": { "type": "integer", "minimum": 0 },
      "description": "Map of origin => count of Provenance objects with that origin in scope. Keys MUST be drawn from the origin enum. Optional; used by policies that distinguish, e.g., a single tool_output from many."
    },
    "earliest_step_id_by_origin": {
      "type": "object",
      "additionalProperties": { "type": "string" },
      "description": "Map of origin => step_id of the earliest step at which data of that origin entered the scope. Optional; used by policies expressed as 'deny if <origin classified as untrusted in policy> entered within the last N turns' to compute lookback distance from the current step. Replaces the trust-derived earliest_untrusted_step_id from earlier drafts: v0.1 carries origin facts, the Guardian projects them onto its trust classification in policy."
    },
    "max_lineage_depth": {
      "type": "integer",
      "minimum": 0,
      "description": "Longest derived_from chain depth observed. Optional; used by policies that constrain lineage depth (e.g., 'deny if data is more than K hops from a policy-trusted source')."
    }
  }
}