{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://acdl.cloudinit.dev/schemas/environment.schema.json",
  "title": "ACDL Platform-Managed Environment",
  "description": "A named environment the platform owns (an AWS account or scoped partition, a network, a state backend, an IAM role surfaced to the consumer via ABAC). Selected by name in the contract's 'environment' field. The environment onboarding check (core/environment_check.py) loads the matching <name>.json; the contract resolver (core/contract_resolver.py) uses it as the 'env' context for ${env.<field>} interpolation.",
  "type": "object",
  "required": ["name", "account_id", "region", "state_backend", "network", "runner_role_arn", "autonomy", "confidence_threshold"],
  "properties": {
    "name": {
      "type": "string",
      "description": "The environment name (matches the filename without .json)."
    },
    "description": {
      "type": "string",
      "description": "Human-readable description."
    },
    "account_id": {
      "type": "string",
      "pattern": "^[0-9]{12}$",
      "description": "The AWS account id (12 digits). The placeholder 000000000000 is allowed for unbound environments; environment_check emits a stderr warning when it appears for env != dev."
    },
    "region": {
      "type": "string",
      "description": "The AWS region (e.g. us-east-1)."
    },
    "state_backend": {
      "type": "object",
      "required": ["bucket", "lock_table"],
      "properties": {
        "bucket": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", "description": "S3 state bucket name (lowercase, 3-63 chars, dots/hyphens)."},
        "lock_table": {"type": "string", "description": "DynamoDB lock table name."}
      },
      "additionalProperties": false
    },
    "network": {
      "type": "object",
      "required": ["vpc_cidr", "azs"],
      "properties": {
        "vpc_cidr": {"type": "string", "pattern": "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/[0-9]{1,2}$", "description": "VPC CIDR block (e.g. 10.0.0.0/16)."},
        "azs": {"type": "array", "items": {"type": "string"}, "maxItems": 6, "description": "Availability zones (max 6)."}
      },
      "additionalProperties": false
    },
    "runner_role_arn": {
      "type": "string",
      "pattern": "^arn:aws:iam::[0-9]{12}:role/.+$",
      "description": "The IAM role ARN surfaced to the consumer's repo via ABAC."
    },
    "autonomy": {
      "type": "string",
      "enum": ["full", "attested"],
      "description": "full = autonomous (dev); attested = HITL gates (qa/prod/dr)."
    },
    "confidence_threshold": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "description": "The confidence gate threshold for this environment (dev 0.50, qa 0.75, prod 0.90, dr 0.95)."
    }
  },
  "additionalProperties": false
}