JSON schemas & media types¶

The consolidated index of every normative JSON Schema in the Agent Cartridge standard (SPEC §13) and the provisional RFC 6838 vendor-tree media names used for each artifact on the wire.

All schemas use JSON Schema draft 2020-12. The $id is the stable, canonical identifier a validator resolves — it is a URL namespace, not a fetch target. The physical files ship in the repo under schemas/.

Schema index¶

Each row maps a format block to its schema title, canonical $id, and the file you validate against. Follow the block link for the field-by-field format page.

Top-level required and $defs¶

The nested $defs are the reusable sub-schemas the standard reuses across the envelope, trust registry, and harness handshake.

Media-type registry¶

Media types live in the RFC 6838 vendor tree (application/vnd.acx.*) plus three borrowed types from adjacent standards: in-toto, DSSE, and W3C Verifiable Credentials. Each names one concrete artifact.

How the signing types compose¶

Cartridges, workflows, and Agent Graphs use the same standards-shaped stack: a JCS-addressed subject, an in-toto Statement, and a DSSE envelope with payloadType = application/vnd.in-toto+json. For a cartridge, the predicate carries the ROM manifest and the subject digest is manifest_hash; for a workflow, the predicate binds its canonical digest, id, version, publisher, and signing time. Agent Graphs bind the same identity fields under their distinct acx.agent-graph-signature/1 integrity profile.

flowchart TD
  A["ROM bytes (live)"] -->|"recompute, content-addressed"| B["ROM manifest<br/>application/vnd.acx.rom-manifest.v1+json"]
  B -->|"predicate"| C["in-toto Statement v1<br/>subject.digest = manifest_hash"]
  C -->|"payload, payloadType = application/vnd.in-toto+json"| D["DSSE envelope<br/>{payloadType, payload, signatures}"]
  D -->|"ed25519, keyid = ed25519:hex(sha256(DER SPKI))"| E["signature"]

flowchart TD
  W["Workflow JSON without integrity"] -->|"RFC 8785 / JCS + sha256"| H["workflow digest"]
  H --> S["in-toto Statement<br/>id · version · publisher · signedAt"]
  S --> D["DSSE envelope + Ed25519 signature"]
  D --> I["integrity block<br/>acx.workflow-signature/1"]

flowchart TD
  G["Agent Graph JSON without integrity"] -->|"RFC 8785 / JCS + sha256"| H["graph digest"]
  H --> S["in-toto Statement<br/>id · version · publisher · signedAt"]
  S --> D["DSSE envelope + Ed25519 signature"]
  D --> I["integrity block<br/>acx.agent-graph-signature/1"]

The manifest hash is recomputed from live bytes, never self-declared. From the proof transcript:

rom_manifest_hash: sha256:1726cf1e6025c166e06dc839a5cbae6c900f0ffa3e0b1235be8b78e88ee09943
cartridge ROM digest: sha256:1726cf1e6025c166e06dc839a5cbae6c900f0ffa3e0b1235be8b78e88ee09943
keyid:          ed25519:17bb8c9290fd2a3d0c3a434ad0e99544d809dbff1540d64be0bab2274df14f66

strip-to-ROM proves the ROM was never mutated by hash equality across a re-export:

rom hash before strip: sha256:f479be021b8ea2e55cc6e3e33b95df9d151196548dfc854dedbe578be7120642
rom hash after  strip: sha256:f479be021b8ea2e55cc6e3e33b95df9d151196548dfc854dedbe578be7120642

Resolved contradictions¶

The block specs were reconciled during the §13 appendix pass. The load-bearing resolutions:

See also¶

• CLI reference — the commands that emit and verify these artifacts.
• Conformance — the numbered §12.x assertions each schema must satisfy.
• Proofs — the verbatim transcript the hashes above come from.