{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://company-cloudflare-agent-mcp-guide.pages.dev/agent-bootstrap.schema.json",
  "title": "Company Cloudflare Publisher Agent bootstrap contract",
  "description": "Schema for the product-defined MCP client onboarding manifest. The manifest contains no resolved access code or claimed credential.",
  "type": "object",
  "required": [
    "$schema",
    "mediaType",
    "schemaVersion",
    "contractVersion",
    "product",
    "standardization",
    "agentDirective",
    "onboardingUrl",
    "trust",
    "credentials",
    "servers",
    "supportedClients",
    "credentialInput",
    "recovery",
    "topologyEvidence",
    "rollback",
    "installationWorkflow",
    "operationWorkflow",
    "confirmationGate",
    "successCriteria",
    "limitations",
    "resources"
  ],
  "properties": {
    "$schema": { "const": "https://company-cloudflare-agent-mcp-guide.pages.dev/agent-bootstrap.schema.json" },
    "mediaType": { "const": "application/vnd.company-cloudflare-publisher.mcp-bootstrap+json" },
    "schemaVersion": { "const": "4.0.0" },
    "contractVersion": { "const": "7.0.0" },
    "product": {
      "type": "object",
      "required": ["name", "release"],
      "properties": {
        "name": { "const": "Company Cloudflare Publisher MCP" },
        "release": { "const": "0.11.0" }
      },
      "additionalProperties": false
    },
    "standardization": {
      "type": "object",
      "required": ["kind", "isMcpStandard", "note"],
      "properties": {
        "kind": { "const": "product-defined-discovery-contract" },
        "isMcpStandard": { "const": false },
        "note": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "agentDirective": { "type": "string", "minLength": 200 },
    "onboardingUrl": { "$ref": "#/$defs/onboardingUrl" },
    "trust": { "$ref": "#/$defs/trust" },
    "credentials": { "$ref": "#/$defs/credentials" },
    "servers": {
      "type": "array",
      "minItems": 2,
      "maxItems": 2,
      "prefixItems": [
        {
          "allOf": [
            { "$ref": "#/$defs/server" },
            {
              "type": "object",
              "properties": {
                "name": { "const": "company-cloudflare-validator" },
                "role": { "const": "validator" },
                "endpointPairKey": { "const": "validator" },
                "authCredential": { "const": "validatorAccessToken" },
                "firstCall": { "const": "get_site_requirements" }
              }
            }
          ]
        },
        {
          "allOf": [
            { "$ref": "#/$defs/server" },
            {
              "type": "object",
              "properties": {
                "name": { "const": "company-cloudflare-deployer" },
                "role": { "const": "deployer" },
                "endpointPairKey": { "const": "deployer" },
                "authCredential": { "const": "deployerAccessToken" },
                "firstCall": { "const": "get_deployment_requirements" }
              }
            }
          ]
        }
      ],
      "items": false
    },
    "supportedClients": {
      "type": "array",
      "minItems": 4,
      "maxItems": 4,
      "prefixItems": [
        {
          "allOf": [
            { "$ref": "#/$defs/client" },
            { "type": "object", "properties": { "id": { "const": "codex" } } }
          ]
        },
        {
          "allOf": [
            { "$ref": "#/$defs/client" },
            { "type": "object", "properties": { "id": { "const": "claude" } } }
          ]
        },
        {
          "allOf": [
            { "$ref": "#/$defs/client" },
            { "type": "object", "properties": { "id": { "const": "hermes" } } }
          ]
        },
        {
          "allOf": [
            { "$ref": "#/$defs/client" },
            { "type": "object", "properties": { "id": { "const": "openclaw" } } }
          ]
        }
      ],
      "items": false
    },
    "credentialInput": { "$ref": "#/$defs/credentialInput" },
    "recovery": { "$ref": "#/$defs/recovery" },
    "topologyEvidence": { "$ref": "#/$defs/topologyEvidence" },
    "rollback": { "$ref": "#/$defs/rollback" },
    "installationWorkflow": {
      "type": "array",
      "minItems": 7,
      "items": { "$ref": "#/$defs/workflowStep" }
    },
    "operationWorkflow": {
      "type": "object",
      "required": ["validator", "deployer", "finalRule"],
      "properties": {
        "validator": { "$ref": "#/$defs/nonEmptyStrings" },
        "deployer": { "$ref": "#/$defs/nonEmptyStrings" },
        "finalRule": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "confirmationGate": {
      "type": "object",
      "required": ["required", "neverSatisfiedByInstallRequest", "neverSatisfiedByUrgencyWords", "scope", "invalidatedBy"],
      "properties": {
        "required": { "const": true },
        "neverSatisfiedByInstallRequest": { "const": true },
        "neverSatisfiedByUrgencyWords": { "const": true },
        "scope": { "$ref": "#/$defs/nonEmptyStrings" },
        "invalidatedBy": { "$ref": "#/$defs/nonEmptyStrings" }
      },
      "additionalProperties": false
    },
    "successCriteria": { "$ref": "#/$defs/nonEmptyStrings" },
    "limitations": { "$ref": "#/$defs/nonEmptyStrings" },
    "resources": {
      "type": "object",
      "required": ["humanGuide", "machineManifest", "schema", "agentInstructions", "intentContract", "llmsText"],
      "properties": {
        "humanGuide": { "type": "string", "pattern": "^/" },
        "machineManifest": { "type": "string", "pattern": "^/" },
        "schema": { "type": "string", "pattern": "^/" },
        "agentInstructions": { "type": "string", "pattern": "^/" },
        "intentContract": { "type": "string", "pattern": "^/" },
        "llmsText": { "type": "string", "pattern": "^/" }
      },
      "additionalProperties": false
    }
  },
  "$defs": {
    "nonEmptyStrings": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "minLength": 1 }
    },
    "argv": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string" }
    },
    "onboardingUrl": {
      "type": "object",
      "required": ["canonicalBaseUrl", "explicitInstallFragment", "template", "parametersAllowed", "credentialParametersAllowed", "endpointSource", "fragmentRationale"],
      "properties": {
        "canonicalBaseUrl": { "const": "https://company-cloudflare-agent-mcp-guide.pages.dev/" },
        "explicitInstallFragment": { "const": "#install" },
        "template": { "const": "https://company-cloudflare-agent-mcp-guide.pages.dev/#install" },
        "parametersAllowed": { "const": false },
        "credentialParametersAllowed": { "const": false },
        "endpointSource": { "const": "same-origin-manifest-single-allowed-pair" },
        "fragmentRationale": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "trust": {
      "type": "object",
      "required": ["allowedGuideOrigins", "manifestPath", "sameOriginManifestRequired", "httpsRequired", "redirectPolicy", "duplicateParameterPolicy", "endpointPolicy", "untrustedOriginPolicy"],
      "properties": {
        "allowedGuideOrigins": {
          "const": ["https://company-cloudflare-agent-mcp-guide.pages.dev"]
        },
        "manifestPath": { "const": "/.well-known/mcp-install.json" },
        "sameOriginManifestRequired": { "const": true },
        "httpsRequired": { "const": true },
        "redirectPolicy": { "const": "same-origin-only" },
        "duplicateParameterPolicy": { "const": "reject" },
        "endpointPolicy": { "$ref": "#/$defs/endpointPolicy" },
        "untrustedOriginPolicy": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "endpointPolicy": {
      "type": "object",
      "required": ["mode", "allowedEndpointPairs", "productionPairCardinality", "productionPairId", "pairMatch", "unlistedEndpointPolicy", "allowLoopbackDevelopment", "loopbackGuideRequirement", "loopbackEndpointRequirement", "productionGuideMayUseLoopbackException"],
      "properties": {
        "mode": { "const": "exact-pair-allowlist" },
        "allowedEndpointPairs": {
          "type": "array",
          "maxItems": 1,
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/trustedEndpointPair" }
        },
        "productionPairCardinality": { "const": "exactly-one" },
        "productionPairId": { "const": "production" },
        "pairMatch": { "const": "normalized-exact-validator-and-deployer" },
        "unlistedEndpointPolicy": { "const": "stop-before-code-use-config-change-or-mcp-initialization" },
        "allowLoopbackDevelopment": { "const": true },
        "loopbackGuideRequirement": { "const": "http-loopback-only" },
        "loopbackEndpointRequirement": { "const": "single-configured-loopback-pair" },
        "productionGuideMayUseLoopbackException": { "const": false }
      },
      "additionalProperties": false
    },
    "trustedEndpointPair": {
      "type": "object",
      "required": ["id", "validator", "deployer"],
      "properties": {
        "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" },
        "validator": { "$ref": "#/$defs/trustedMcpEndpoint" },
        "deployer": { "$ref": "#/$defs/trustedMcpEndpoint" }
      },
      "additionalProperties": false
    },
    "trustedMcpEndpoint": {
      "type": "string",
      "format": "uri",
      "maxLength": 2048,
      "anyOf": [
        { "pattern": "^https://[^/?#]+/mcp$" },
        { "pattern": "^http://(?:localhost|127\\.0\\.0\\.1|\\[::1\\])(?::[0-9]+)?/mcp$" }
      ],
      "not": { "pattern": "^https://[^/]*@" }
    },
    "credentials": {
      "type": "object",
      "required": ["mode", "delivery", "inputName", "codePattern", "codeDisplayForm", "oneUse", "expiresInSeconds", "neverUseCodeAsBearer", "neverPlaceInUrl", "neverSendToGuide", "neverEchoOrLog", "claim", "successResponse", "outputs", "failurePolicy", "persistence", "requiredConfigProtection", "missingInputPolicy", "operatorStaticCredentialsSuppliedToAgent", "migrationRequiresReOnboarding", "oauthMigration"],
      "properties": {
        "mode": { "const": "one-time-code-claim" },
        "delivery": { "const": "explicit-user-install-input" },
        "inputName": { "const": "accessCode" },
        "codePattern": { "const": "^ccpc_[a-f0-9]{32}$" },
        "codeDisplayForm": { "const": "ccpc_<32-lowercase-hex>" },
        "oneUse": { "const": true },
        "expiresInSeconds": { "const": 1800 },
        "neverUseCodeAsBearer": { "const": true },
        "neverPlaceInUrl": { "const": true },
        "neverSendToGuide": { "const": true },
        "neverEchoOrLog": { "const": true },
        "claim": { "$ref": "#/$defs/credentialClaim" },
        "successResponse": { "$ref": "#/$defs/claimSuccessResponse" },
        "outputs": {
          "type": "array",
          "minItems": 2,
          "maxItems": 2,
          "prefixItems": [
            {
              "allOf": [
                { "$ref": "#/$defs/credentialOutput" },
                {
                  "type": "object",
                  "properties": {
                    "role": { "const": "validator" },
                    "responseField": { "const": "validator_access_token" },
                    "templatePlaceholder": { "const": "{{validatorAccessToken}}" },
                    "requiredPrefix": { "const": "ccpv_" },
                    "requiredPattern": { "const": "^ccpv_[a-f0-9]{48}$" }
                  }
                }
              ]
            },
            {
              "allOf": [
                { "$ref": "#/$defs/credentialOutput" },
                {
                  "type": "object",
                  "properties": {
                    "role": { "const": "deployer" },
                    "responseField": { "const": "deployer_access_token" },
                    "templatePlaceholder": { "const": "{{deployerAccessToken}}" },
                    "requiredPrefix": { "const": "ccpd_" },
                    "requiredPattern": { "const": "^ccpd_[a-f0-9]{48}$" }
                  }
                }
              ]
            }
          ],
          "items": false
        },
        "failurePolicy": { "$ref": "#/$defs/claimFailurePolicy" },
        "persistence": { "const": "owner-private-client-config-only" },
        "requiredConfigProtection": { "const": "0600-on-posix-or-user-only-equivalent" },
        "missingInputPolicy": { "type": "string", "minLength": 1 },
        "operatorStaticCredentialsSuppliedToAgent": { "const": false },
        "migrationRequiresReOnboarding": { "const": true },
        "oauthMigration": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "credentialClaim": {
      "type": "object",
      "required": ["urlDerivation", "path", "method", "contentType", "redirectPolicy", "bodyFields", "contractVersion", "additionalBodyFieldsAllowed"],
      "properties": {
        "urlDerivation": { "const": "trusted-deployer-origin-plus-path" },
        "path": { "const": "/agent/claim" },
        "method": { "const": "POST" },
        "contentType": { "const": "application/json" },
        "redirectPolicy": { "const": "reject-all" },
        "bodyFields": { "type": "array", "const": ["code", "client_id", "contract_version", "endpoint_pair_id"] },
        "contractVersion": { "const": "7.0.0" },
        "additionalBodyFieldsAllowed": { "const": false }
      },
      "additionalProperties": false
    },
    "claimSuccessResponse": {
      "type": "object",
      "required": ["status", "requiredFields", "additionalFieldsAllowed", "installIdOpaque", "installIdPattern", "validatorTokenPrefix", "deployerTokenPrefix", "validatorTokenPattern", "deployerTokenPattern", "tokenLifetimeSeconds", "roleScoped", "revocable", "cacheControl"],
      "properties": {
        "status": { "const": 200 },
        "requiredFields": { "type": "array", "const": ["install_id", "validator_access_token", "deployer_access_token"] },
        "additionalFieldsAllowed": { "const": false },
        "installIdOpaque": { "const": true },
        "installIdPattern": { "const": "^[a-f0-9]{32}$" },
        "validatorTokenPrefix": { "const": "ccpv_" },
        "deployerTokenPrefix": { "const": "ccpd_" },
        "validatorTokenPattern": { "const": "^ccpv_[a-f0-9]{48}$" },
        "deployerTokenPattern": { "const": "^ccpd_[a-f0-9]{48}$" },
        "tokenLifetimeSeconds": { "const": 7776000 },
        "roleScoped": { "const": true },
        "revocable": { "const": true },
        "cacheControl": { "const": "no-store" }
      },
      "additionalProperties": false
    },
    "credentialOutput": {
      "type": "object",
      "required": ["role", "responseField", "templatePlaceholder", "requiredPrefix", "requiredPattern"],
      "properties": {
        "role": { "enum": ["validator", "deployer"] },
        "responseField": { "enum": ["validator_access_token", "deployer_access_token"] },
        "templatePlaceholder": { "enum": ["{{validatorAccessToken}}", "{{deployerAccessToken}}"] },
        "requiredPrefix": { "enum": ["ccpv_", "ccpd_"] },
        "requiredPattern": { "enum": ["^ccpv_[a-f0-9]{48}$", "^ccpd_[a-f0-9]{48}$"] }
      },
      "additionalProperties": false
    },
    "claimFailurePolicy": {
      "type": "object",
      "required": ["ambiguousOutcome", "invalidOrExpiredCode", "unexpectedUsedCode", "sameCodeRetryAllowed", "directBearerFallbackAllowed"],
      "properties": {
        "ambiguousOutcome": { "const": "treat-code-as-consumed-stop-and-request-new-code" },
        "invalidOrExpiredCode": { "const": "stop-and-request-new-code" },
        "unexpectedUsedCode": { "const": "stop-revoke-associated-install-if-identifiable-and-escalate" },
        "sameCodeRetryAllowed": { "const": false },
        "directBearerFallbackAllowed": { "const": false }
      },
      "additionalProperties": false
    },
    "credentialInput": {
      "type": "object",
      "required": ["mode", "createTool", "createArguments", "statusTool", "statusArguments", "requiredStatus", "pageUrl", "reference", "privacy"],
      "properties": {
        "mode": { "const": "trusted-deployer-origin-url" },
        "createTool": { "const": "create_credential_input" },
        "createArguments": { "type": "array", "const": ["projectName"] },
        "statusTool": { "const": "get_credential_input_status" },
        "statusArguments": { "type": "array", "const": ["projectName", "credentialRef"] },
        "requiredStatus": { "const": "captured" },
        "pageUrl": {
          "type": "object",
          "required": ["originRule", "path", "queryAllowed", "fragmentRequired", "exactFragmentParameters", "credentialsEnteredOnlyOnPage"],
          "properties": {
            "originRule": { "const": "exact-configured-deployer-endpoint-origin" },
            "path": { "const": "/credential-input/" },
            "queryAllowed": { "const": false },
            "fragmentRequired": { "const": true },
            "exactFragmentParameters": { "type": "array", "const": ["projectName", "credentialRef", "submissionToken"] },
            "credentialsEnteredOnlyOnPage": { "const": true }
          },
          "additionalProperties": false
        },
        "reference": {
          "type": "object",
          "required": ["opaque", "requiredBy", "neverReplaceWithRawCredentialFields"],
          "properties": {
            "opaque": { "const": true },
            "requiredBy": { "type": "array", "const": ["get_credential_input_status", "check_deployment_readiness", "plan_deployment", "deploy_proposal"] },
            "neverReplaceWithRawCredentialFields": { "const": true }
          },
          "additionalProperties": false
        },
        "privacy": {
          "type": "object",
          "required": ["neverAskForCredentialsInChat", "neverSendCredentialsInMcpArguments", "neverReadOrLogSubmissionToken", "passwordReturnedByMcp"],
          "properties": {
            "neverAskForCredentialsInChat": { "const": true },
            "neverSendCredentialsInMcpArguments": { "const": true },
            "neverReadOrLogSubmissionToken": { "const": true },
            "passwordReturnedByMcp": { "const": false }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "recovery": {
      "type": "object",
      "required": ["statusProbe", "beforeDeployerNonterminal", "afterDeployerNonterminal", "unsafeStatus", "statusError", "recoveryModeGate"],
      "properties": {
        "statusProbe": {
          "type": "object",
          "required": ["tool", "arguments", "requiredBeforeValidatorRenewal", "purpose", "receiptReturned", "outcomes"],
          "properties": {
            "tool": { "const": "get_deployment_status" },
            "arguments": { "type": "array", "const": ["projectName"] },
            "requiredBeforeValidatorRenewal": { "const": true },
            "purpose": { "const": "branch-selection-only" },
            "receiptReturned": { "const": false },
            "outcomes": {
              "type": "object",
              "required": ["STATUS_NOT_FOUND", "matchingNonterminalExactReceipt", "operatorRequired", "missingOrInvalidRecoveryMode", "SERVICE_UNAVAILABLE", "otherError", "stable", "mismatched", "malformed"],
              "properties": {
                "STATUS_NOT_FOUND": { "const": "allow-same-finalized-claim-and-artifact-receipt-renewal" },
                "matchingNonterminalExactReceipt": { "const": "use-retained-original-accepted-receipt" },
                "operatorRequired": { "const": "stop-and-escalate-to-operator" },
                "missingOrInvalidRecoveryMode": { "const": "stop-and-escalate-to-operator" },
                "SERVICE_UNAVAILABLE": { "const": "retry-status-later-or-escalate-no-renewal" },
                "otherError": { "const": "retry-status-later-or-escalate-no-renewal" },
                "stable": { "const": "stop-and-escalate-to-operator" },
                "mismatched": { "const": "stop-and-escalate-to-operator" },
                "malformed": { "const": "stop-and-escalate-to-operator" }
              },
              "additionalProperties": false
            }
          },
          "additionalProperties": false
        },
        "beforeDeployerNonterminal": {
          "type": "object",
          "required": ["condition", "retainExact", "renewReceipt", "newCredentialInput", "then", "newUploadAllowed", "newProjectNameAllowed"],
          "properties": {
            "condition": { "const": "status-not-found-and-credential-page-or-receipt-expired" },
            "retainExact": { "type": "array", "const": ["projectName", "inputRef", "finalizedClaim", "artifact"] },
            "renewReceipt": {
              "type": "object",
              "required": ["tool", "arguments", "sameFinalizedClaimOnly", "sameArtifactOnly"],
              "properties": {
                "tool": { "const": "validate_site" },
                "arguments": { "type": "array", "const": ["projectName", "inputRef"] },
                "sameFinalizedClaimOnly": { "const": true },
                "sameArtifactOnly": { "const": true }
              },
              "additionalProperties": false
            },
            "newCredentialInput": {
              "type": "object",
              "required": ["tool", "arguments"],
              "properties": {
                "tool": { "const": "create_credential_input" },
                "arguments": { "type": "array", "const": ["projectName"] }
              },
              "additionalProperties": false
            },
            "then": { "type": "array", "const": ["capture-new-credential-ref", "repeat-readiness", "repeat-plan", "display-changes", "obtain-new-explicit-confirmation"] },
            "newUploadAllowed": { "const": false },
            "newProjectNameAllowed": { "const": false }
          },
          "additionalProperties": false
        },
        "afterDeployerNonterminal": {
          "type": "object",
          "required": ["condition", "requiredRecoveryMode", "exactProjectMatchRequired", "exactArtifactMatchRequired", "ambiguousConfirmationResponseMayBeLost", "receiptSource", "receiptRetainedBy", "persistedReceiptRequired", "replaceReceiptAllowed", "validatorRenewalAllowed", "newCredentialRefOnlyIfNeeded", "then", "newUploadAllowed", "newProjectNameAllowed"],
          "properties": {
            "condition": { "const": "matching-project-and-artifact-nonterminal-with-recovery-mode-exact-receipt" },
            "requiredRecoveryMode": { "const": "exact-receipt" },
            "exactProjectMatchRequired": { "const": true },
            "exactArtifactMatchRequired": { "const": true },
            "ambiguousConfirmationResponseMayBeLost": { "const": true },
            "receiptSource": { "const": "retained-original-accepted-receipt" },
            "receiptRetainedBy": { "const": "agent-workflow" },
            "persistedReceiptRequired": { "const": true },
            "replaceReceiptAllowed": { "const": false },
            "validatorRenewalAllowed": { "const": false },
            "newCredentialRefOnlyIfNeeded": { "const": true },
            "then": { "type": "array", "const": ["repeat-readiness", "repeat-plan", "display-changes", "obtain-new-explicit-confirmation"] },
            "newUploadAllowed": { "const": false },
            "newProjectNameAllowed": { "const": false }
          },
          "additionalProperties": false
        },
        "unsafeStatus": {
          "type": "object",
          "required": ["states", "action"],
          "properties": {
            "states": { "type": "array", "const": ["stable", "mismatched", "malformed"] },
            "action": { "const": "stop-and-escalate-to-operator" }
          },
          "additionalProperties": false
        },
        "statusError": {
          "type": "object",
          "required": ["states", "renewalAllowed", "credentialInputAllowed", "action"],
          "properties": {
            "states": { "type": "array", "const": ["SERVICE_UNAVAILABLE", "otherError"] },
            "renewalAllowed": { "const": false },
            "credentialInputAllowed": { "const": false },
            "action": { "const": "retry-status-later-or-escalate-to-operator" }
          },
          "additionalProperties": false
        },
        "recoveryModeGate": {
          "type": "object",
          "required": ["receiptReuseMode", "exactProjectMatchRequired", "exactArtifactMatchRequired", "blockedValues", "blockedAction"],
          "properties": {
            "receiptReuseMode": { "const": "exact-receipt" },
            "exactProjectMatchRequired": { "const": true },
            "exactArtifactMatchRequired": { "const": true },
            "blockedValues": { "type": "array", "const": ["operator-required", "missing", "invalid"] },
            "blockedAction": { "const": "stop-and-escalate-to-operator" }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "topologyEvidence": {
      "type": "object",
      "required": ["customDomainAbsenceVerifiedByRuntime", "workerRoutesEnumeratedByRuntime", "workerRouteAbsence", "reasonRoutesAreNotEnumerated", "agentMustNotClaimWorkerRouteAbsenceWasVerified"],
      "properties": {
        "customDomainAbsenceVerifiedByRuntime": { "const": true },
        "workerRoutesEnumeratedByRuntime": { "const": false },
        "workerRouteAbsence": { "const": "administrator-controlled-assumption" },
        "reasonRoutesAreNotEnumerated": { "const": "Deployer intentionally has no Zone permission" },
        "agentMustNotClaimWorkerRouteAbsenceWasVerified": { "const": true }
      },
      "additionalProperties": false
    },
    "rollback": {
      "type": "object",
      "required": ["planTool", "planArguments", "planReadOnly", "planResult", "selection", "confirmation", "executeTool", "executeArguments"],
      "properties": {
        "planTool": { "const": "plan_rollback" },
        "planArguments": { "type": "array", "const": ["projectName"] },
        "planReadOnly": { "const": true },
        "planResult": {
          "type": "object",
          "required": ["currentRequired", "displayExactCurrentArtifactAndDeploymentState", "candidatesRecordedOnly", "candidateRequiredFields"],
          "properties": {
            "currentRequired": { "const": true },
            "displayExactCurrentArtifactAndDeploymentState": { "const": true },
            "candidatesRecordedOnly": { "const": true },
            "candidateRequiredFields": { "type": "array", "const": ["rollbackTargetId", "artifactId", "deployedAt", "confirmationId"] }
          },
          "additionalProperties": false
        },
        "selection": {
          "type": "object",
          "required": ["userSelectsExactCandidate", "autoSelectAllowed", "omittedTargetAllowed"],
          "properties": {
            "userSelectsExactCandidate": { "const": true },
            "autoSelectAllowed": { "const": false },
            "omittedTargetAllowed": { "const": false }
          },
          "additionalProperties": false
        },
        "confirmation": {
          "type": "object",
          "required": ["separateExplicitConfirmationRequired", "displayBeforeConfirmation", "invalidatedBy"],
          "properties": {
            "separateExplicitConfirmationRequired": { "const": true },
            "displayBeforeConfirmation": { "type": "array", "const": ["current", "selectedCandidate"] },
            "invalidatedBy": { "type": "array", "const": ["project_change", "current_state_change", "selected_candidate_change", "confirmation_id_change"] }
          },
          "additionalProperties": false
        },
        "executeTool": { "const": "rollback_proposal" },
        "executeArguments": { "type": "array", "const": ["projectName", "rollbackTargetId", "confirmationId"] }
      },
      "additionalProperties": false
    },
    "server": {
      "type": "object",
      "required": ["name", "role", "endpointPairKey", "transport", "authCredential", "required", "toolTimeoutSeconds", "firstCall", "expectedTools"],
      "properties": {
        "name": { "enum": ["company-cloudflare-validator", "company-cloudflare-deployer"] },
        "role": { "enum": ["validator", "deployer"] },
        "endpointPairKey": { "enum": ["validator", "deployer"] },
        "transport": { "const": "streamable-http" },
        "authCredential": { "enum": ["validatorAccessToken", "deployerAccessToken"] },
        "required": { "const": true },
        "toolTimeoutSeconds": { "type": "integer", "minimum": 1 },
        "firstCall": { "enum": ["get_site_requirements", "get_deployment_requirements"] },
        "expectedTools": { "$ref": "#/$defs/nonEmptyStrings" }
      },
      "additionalProperties": false
    },
    "client": {
      "type": "object",
      "required": ["id", "label", "detectionCommands", "configLocations", "installStrategy", "installArgv", "credentialPersistence", "configTemplate", "verifyArgv", "reload"],
      "properties": {
        "id": { "enum": ["codex", "claude", "hermes", "openclaw"] },
        "label": { "type": "string", "minLength": 1 },
        "detectionCommands": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/argv" } },
        "configLocations": { "$ref": "#/$defs/nonEmptyStrings" },
        "installStrategy": { "type": "string", "minLength": 1 },
        "installArgv": { "type": "array", "items": { "$ref": "#/$defs/argv" } },
        "credentialPersistence": { "$ref": "#/$defs/credentialPersistence" },
        "configTemplate": {
          "type": "object",
          "required": ["format", "content"],
          "properties": {
            "format": { "enum": ["toml", "json", "yaml", "json5"] },
            "content": { "type": "string", "minLength": 1 }
          },
          "additionalProperties": false
        },
        "verifyArgv": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/argv" } },
        "reload": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    },
    "credentialPersistence": {
      "type": "object",
      "required": ["strategy", "requiredProtection", "nativeOAuthStoreUsed", "limitation"],
      "properties": {
        "strategy": { "const": "owner-private-static-header" },
        "requiredProtection": { "const": "0600-on-posix-or-user-only-equivalent" },
        "nativeOAuthStoreUsed": { "const": false },
        "limitation": { "type": "string", "minLength": 40 }
      },
      "additionalProperties": false
    },
    "workflowStep": {
      "type": "object",
      "required": ["step", "action", "rule"],
      "properties": {
        "step": { "type": "integer", "minimum": 1 },
        "action": { "type": "string", "minLength": 1 },
        "rule": { "type": "string", "minLength": 1 }
      },
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}