{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://plenaverify.com/vrx1-human-review-receipt.schema.json", "title": "PLENA VRX-1 Human Review Receipt v1", "description": "Schema for VRX-1 Receipt Type 3, the Human Review Receipt. Records that a named human reviewer considered specific evidence and reached a decision. The receipt is self-attested by its creator and tamper-evident via SHA-256 over the canonical JSON; it is not signed by an issuer key, not externally anchored to a public timestamp, and not certified by PLENA or any third party. Acceptance is decided by the receiving party. PLENA does not certify AI systems or guarantee regulatory compliance. The schema is the canonical contract for VRX-1 Human Review Receipts produced by the d19.81 reference implementation at vrx1-human-review-receipt.html.", "type": "object", "additionalProperties": false, "required": [ "vrx1_version", "schema_version", "receipt_id", "receipt_type", "created_at", "reviewer_name_or_role", "review_scope", "subject_of_review", "review_datetime", "evidence_reviewed", "decision", "decision_reason", "reviewer_role_relative_to_decider", "appeal_or_correction_path", "ai_assistance", "privacy_level", "verification_url", "integrity_note", "hash" ], "properties": { "vrx1_version": { "type": "string", "const": "1.0-d19.81-human-review-receipt-reference", "description": "VRX-1 reference-implementation version string. Bound to the d19.81 reference implementation; future implementations should bump this string and the corresponding schema_version together." }, "schema_version": { "type": "string", "const": "vrx1.human-review-receipt.v1", "description": "Stable schema identifier for VRX-1 Human Review Receipt v1. A later major revision would publish a v2 schema at a distinct identifier." }, "receipt_id": { "type": "string", "pattern": "^PLENA-HRR-[0-9]{8}-[A-F0-9]{4}$", "description": "Unique identifier for this receipt. Format: PLENA-HRR--<4 uppercase hex>. The date segment uses UTC at receipt creation. The hex suffix is generated by the creating device." }, "receipt_type": { "type": "string", "const": "HUMAN_REVIEW_RECEIPT", "description": "Receipt type discriminator. Always HUMAN_REVIEW_RECEIPT for this schema." }, "created_at": { "type": "string", "format": "date-time", "description": "ISO-8601 date-time string from the device that built the receipt. The timestamp is not anchored to an external clock or registry." }, "reviewer_name_or_role": { "type": "string", "minLength": 1, "description": "Name or role title of the human reviewer. A role title may be used in place of a personal name when the public receipt should not name the reviewer directly." }, "reviewer_org_or_context": { "type": ["string", "null"], "description": "Reviewer's institution or role context. Optional. May be set to null when no organisational context applies (for example, a personal-capacity review)." }, "review_scope": { "type": "string", "minLength": 1, "description": "Free-text description of what was reviewed. Example: 'Application for admission to the 2026 Master's intake.' or 'AI-assisted screening output for candidate file 2026-04-887.'" }, "subject_of_review": { "type": "string", "minLength": 1, "description": "Free-text identifier for the person, case, file, or decision under review. May be a pseudonymous reference when the public receipt should not name the subject directly." }, "review_datetime": { "type": "string", "minLength": 1, "description": "ISO-8601 date or date-time string for when the review occurred. May be a date-only string (YYYY-MM-DD) or a date-time string with seconds (YYYY-MM-DDTHH:MM:SS)." }, "evidence_reviewed": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1 }, "description": "Ordered list of evidence items considered by the reviewer. Each item is a free-text description. At least one item is required." }, "decision": { "type": "string", "enum": ["accept", "refuse", "escalate", "correct", "defer"], "description": "The decision reached by the reviewer. A 'refuse' decision should typically be paired with a Refusal Receipt (linked via the optional linked_human_review_receipt_id field on that receipt)." }, "decision_reason": { "type": "string", "minLength": 1, "description": "Free-text reason for the decision. The receipt does not assert that the reason is sound; it only records what the reviewer attested." }, "reviewer_role_relative_to_decider": { "type": "string", "enum": [ "independent_of_decider", "same_as_decider", "supervisor_of_decider", "external_to_institution", "not_applicable" ], "description": "Records the relationship between the reviewer and the original decision-maker. Independence is a self-attestation by the creator; the receipt does not externally confirm independence." }, "appeal_or_correction_path": { "type": "string", "minLength": 1, "description": "Free-text description of how the reviewed party can appeal the decision or seek correction. Should include a contact address, deadline window, or process step where applicable." }, "ai_assistance": { "type": "string", "enum": [ "no", "partial_input", "initial_screening", "recommendation_overridden", "recommendation_accepted", "other" ], "description": "Records whether and how AI was used during this review. 'no' means no AI was used. 'recommendation_overridden' means an AI recommendation was considered then overridden by the reviewer. 'recommendation_accepted' means an AI recommendation was considered then accepted by the reviewer." }, "ai_system_named": { "type": ["string", "null"], "description": "Optional vendor name or internal system identifier for the AI system used. May be set to null when no AI was used or when the AI system is not named on the receipt." }, "linked_submission_receipt_id": { "type": ["string", "null"], "description": "Optional cross-reference to a prior VRX-1 Submission Receipt that this review traces back to. Format: PLENA-SUB--<4 hex> when present." }, "linked_external_decision_id": { "type": ["string", "null"], "description": "Optional cross-reference to an internal ticket, file reference, or external decision record. Free-text format." }, "reviewer_notes": { "type": ["string", "null"], "description": "Optional free-text notes from the reviewer." }, "privacy_level": { "type": "string", "enum": ["restricted", "private", "public"], "description": "Privacy classification of the receipt body. 'restricted' = share by link, not publicly listed. 'private' = for personal/institutional records only. 'public' = safe for a public log when no private data is inside." }, "supersedes": { "type": ["string", "null"], "description": "Optional receipt_id of a prior receipt that this one corrects or replaces." }, "verification_url": { "type": "string", "minLength": 1, "description": "URL where the receipt can be opened in the VRX-1 Human Review Receipt reference implementation Verify panel. Typically ends with vrx1-human-review-receipt.html#verify." }, "integrity_note": { "type": "string", "minLength": 1, "description": "Plain-language statement of the receipt's truth boundary. Asserts that the receipt is self-attested by its creator and tamper-evident via SHA-256, and explicitly denies signing, external anchoring, or third-party certification." }, "hash": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "SHA-256 hex digest, prefixed with 'sha256:', computed over the canonical JSON of all receipt fields except the 'hash' field itself. Canonicalisation: object keys are recursively sorted; no whitespace; strings are JSON-encoded; numbers use JSON number form; null is rendered as the literal null; non-finite numbers are rendered as null." } } }