{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/devlollc/gladiator/schemas/data_protection_packet.v1.json",
  "title": "GLADIATOR data protection packet, v1",
  "description": "Required by `gladiator preflight` for any run whose frozen dataset contains personal data. Vocabulary taken verbatim from lane L3's EMAILFIND-001 packet (GDPR/nLPD three-seat debate in docs/decisions/L3-001-contact-set-truth-metrics.md). Field names match L3's authoritative implementation exactly.",
  "type": "object",
  "required": [
    "schema",
    "run_id",
    "controller",
    "legal_basis",
    "information",
    "opposition",
    "minimization",
    "retention",
    "pseudonymisation",
    "recipients",
    "no_real_person_contacted",
    "prepared_at"
  ],
  "properties": {
    "schema": { "const": "data_protection_packet.v1" },
    "run_id": { "type": "string", "minLength": 1 },
    "controller": { "type": "string", "minLength": 1 },
    "legal_basis": {
      "type": "string",
      "minLength": 1,
      "description": "Article relied on and where the balancing test is recorded, in plain language."
    },
    "information": {
      "type": "string",
      "minLength": 1,
      "description": "How data subjects are informed of the processing (collective notice for non-contact runs)."
    },
    "opposition": {
      "type": "string",
      "minLength": 1,
      "description": "Objection and erasure channel: how a subject requests removal and how the score is replayed without them."
    },
    "suppression_list": {
      "type": "string",
      "description": "Shared suppression list across all participants. Required once a run may contact anyone; phase 1 runs note 'sans objet' here."
    },
    "minimization": {
      "type": "string",
      "minLength": 1,
      "description": "Fields frozen per contact; which fields are transmitted to tools; what is explicitly disabled."
    },
    "retention": {
      "type": "string",
      "minLength": 1,
      "description": "Where cleartext lives (audit vault, outside any git repository) and for how long."
    },
    "pseudonymisation": {
      "type": "string",
      "minLength": 1,
      "description": "Method and where the salt lives. The salt never enters the repository."
    },
    "recipients": {
      "type": "array",
      "minItems": 1,
      "description": "Every third party the data reaches, with its role and exactly which fields it receives.",
      "items": {
        "type": "object",
        "required": ["name", "role", "data_sent"],
        "properties": {
          "name": { "type": "string", "minLength": 1 },
          "role": { "type": "string", "minLength": 1 },
          "data_sent": { "type": "string", "minLength": 1 },
          "dpa": { "type": "string" }
        }
      }
    },
    "no_real_person_contacted": {
      "const": true,
      "description": "Phase 1 invariant: measurement never contacts a data subject. A run that would contact anyone cannot use this packet."
    },
    "verified_by": {
      "type": "string",
      "description": "Reference to the legal preflight artifact that reviewed each tool."
    },
    "prepared_at": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}"
    },
    "canonical_detail": {
      "type": "string",
      "description": "Pointer to the long-form version of this packet (e.g. the category-level file)."
    }
  }
}