# description
A FedRAMP 20x-style KSI validation signal extended with normalized component identifiers, as proposed in https://samaydlette.com/pages/article-27.html. The signal names the components a system is composed of using global identifiers that compose across CSPs (PURL for software, native cloud resource IDs for infrastructure, content hashes for static artifacts), and attaches each validation result to the specific components it evaluated. The intent is portfolio-level reasoning across CSPs without a separate inventory deliverable.

# properties.$schema.description
URL of the schema this signal conforms to. Optional; informational only.

# properties.signal_version.description
Semantic version of this signal's schema. Increments on breaking changes to the schema itself.

# properties.signal_id.description
Unique identifier for this emission. Two signals with the same signal_id are the same observation; different signal_ids are different observations of the same system.

# properties.emitted_at.description
ISO 8601 timestamp at which this signal was emitted.

# properties.emitter.description
What produced this signal. 'deploy' = the CI/CD pipeline emitting at deploy time. 'runtime' = a continuously-running validator emitting on a schedule against the live system.

# properties.csp.description
The cloud service provider hosting the system this signal describes. Free-form to allow future CSPs without schema changes; recommended values are 'aws', 'azure', 'gcp', 'oracle', 'ibm', 'alibaba'.

# properties.system_id.description
Stable identifier for the system this signal describes. URN form is recommended so identifiers compose across CSPs without collision.

# properties.provenance.description
How and from what this system was built. The article-27 proposal is that KSI signals carry SLSA-style provenance so consumers can verify what's running came from a known source.

# properties.provenance.properties.builder.description
The build system that produced the deployed artifacts.

# properties.provenance.properties.builder.properties.id.description
Identifier for the builder. For GitHub Actions: 'https://github.com/<owner>/<repo>/.github/workflows/<workflow>'.

# properties.provenance.properties.builder.properties.run_id.description
Builder-specific identifier for this build run. For GitHub Actions: the workflow run ID.

# properties.provenance.properties.builder.properties.version.description
Version of the builder software, if known.

# properties.provenance.properties.source.description
The source code from which the deployed artifacts were built.

# properties.provenance.properties.source.properties.ref.description
Git ref (branch or tag) the commit was reached from, if known.

# properties.provenance.properties.attestation.description
Reserved for cryptographic attestation of this signal (e.g., a Sigstore bundle or an in-toto attestation). Present only when the signal is signed.

# properties.components.description
Every component of this system that the emitter is aware of, named with at least one global identifier where one exists. The set of types is intentionally normalized across CSPs: an AWS EC2 instance, an Azure VM, a GCP Compute Engine VM, and a bare-metal Kubernetes node all project into 'compute_instance' so they compose across portfolios.

# properties.validations.description
The validation results this signal carries. Each result names the specific components it evaluated via component_refs, so a portfolio consumer can answer 'which validations covered component X' and 'which components were covered by validation Y' without inventory reconciliation.

# properties.disclosure.description
Operator-asserted disclosure about the authorization status of this signal and the system it describes. Present so a consumer of the signal cannot mistake a self-attested PoC for a FedRAMP-authorized system. Optional in the schema (older signals may not carry it); recommended in all new signals.

# properties.disclosure.properties.fedramp_certified.description
Whether the system has a FedRAMP authorization in place. Set false for self-attested artifacts.

# properties.disclosure.properties.remarks.description
Free-form prose disclosure for human readers.

# properties.disclosure.properties.related_artifacts.description
URLs to companion artifacts published alongside this signal. Lets a consumer of any one artifact find the rest without out-of-band knowledge.

# properties.ownership.description
System-level ownership information, present so the canonical inventory can project into FedRAMP Integrated Inventory Workbook (IIW) shape without external lookups. Maps to the System Administrator/Owner and Application Administrator/Owner columns in the IIW template (Appendix M).

# properties.ownership.properties.system_owner.description
Name of the system administrator / owner. IIW field: System Administrator/Owner.

# properties.ownership.properties.application_owner.description
Name of the application administrator / owner. IIW field: Application Administrator/Owner.

# properties.ownership.properties.operator_contact.description
Operator contact (email or other channel) for inquiries about the system inventory.

# $defs.component.properties.component_id.description
Identifier for this component within this signal. Used as the join key for validations[].component_refs. Stable across emissions where possible.

# $defs.component.properties.type.description
Normalized component type. The type vocabulary is the cross-CSP normalization the article calls for: each CSP's native shape projects into one of these types so portfolio queries compose.

# $defs.component.properties.native_id.description
The CSP's native identifier for this component (e.g., an AWS ARN, an Azure resource ID, a GCP resource name). Required for cloud resources; absent for software components that don't have one.

# $defs.component.properties.global_id.description
Cross-CSP identifiers. At least one is required; the choice depends on type. PURL for software ecosystems, image_digest for container images, sha256 for content-addressable static artifacts, hbom_ref for hardware components named in a CycloneDX HBOM.

# $defs.component.properties.global_id.properties.image_digest.description
OCI image digest of the form 'sha256:<hex>'. Used for container images.

# $defs.component.properties.global_id.properties.sha256.description
Hex-encoded SHA-256 of the component's content. Used for static artifacts (HTML files, configuration blobs).

# $defs.component.properties.global_id.properties.hbom_ref.description
Reference into a CycloneDX HBOM document, of the form '<bom-ref>@<bom-uri>'. Used for hardware components per https://cyclonedx.org/capabilities/hbom/.

# $defs.component.properties.attributes.description
Component-specific attributes the emitter wants to make available to consumers. Free-form by design; consumers should treat unknown keys as opaque. Common keys: 'name', 'region', 'tls_min_version', 'encryption_algorithm', 'public_access_blocked', 'runtime'.

# $defs.component.properties.security_category.description
FIPS 199 security categorization for this component, per the FedRAMP 20x Minimum Assessment Scope rule MAS-CSO-FLO. Each impact dimension is independently rated; the high-water mark across all components determines the system's overall categorization. For components that do not handle data directly (e.g., software libraries), use 'not-applicable'. For components fully inherited from an authorized provider, use 'inherited'.

# $defs.component.properties.information_flow.description
How information enters, traverses, and exits this component, per the FedRAMP 20x Minimum Assessment Scope rule MAS-CSO-FLO. Each entry names a direction and a counterparty so a portfolio consumer can build a flow graph across components. Empty array is valid for components that do not handle data directly (e.g., npm packages bundled into a function).

# $defs.component.properties.information_flow.items.properties.counterparty.description
What this component sends to or receives from. Either a component_id within this signal or an external reference like 'public-internet', 'aws-service-api', 'github-actions', 'eventbridge', 'fulcio', 'rekor'.

# $defs.component.properties.information_flow.items.properties.channel.description
How the data moves. Recommended values: 'tls-1.2', 'tls-1.3', 'aws-internal-tls', 'no-network'.

# $defs.component.properties.information_flow.items.properties.data_class.description
The classification of data on this channel. Recommended values: 'public-content', 'configuration', 'logs', 'audit', 'no-data'.

# $defs.validation.properties.validation_id.description
Identifier for this validation result within this signal.

# $defs.validation.properties.policy.description
Identifies the policy that produced this result.

# $defs.validation.properties.policy.properties.id.description
Stable identifier for the policy (e.g., 'terraform.compliance' for the OPA package).

# $defs.validation.properties.result.description
Whether the policy passed or failed for the referenced components.

# $defs.validation.properties.component_refs.description
component_id values from this signal's components[] that this validation evaluated. This is the field that makes the signal compose across CSPs: a portfolio consumer joins on these refs to answer cross-system queries.

# $defs.validation.properties.violations.description
Specific findings when result is 'fail'. Same shape as the OPA compliance_report.violations entries the existing pipeline already produces.