{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://cbomprofile.org/schema/appliedquantum-cbom-profile-v1.0-rc.schema.json",
  "title": "Applied Quantum CBOM Profile - property value constraints (v1.0-RC, corrected edition 9 September 2026)",
  "description": "Validates any CycloneDX 'properties' array (an array of name/value string pairs) against the Applied Quantum CBOM Profile taxonomy. Properties outside the appliedquantum namespace pass through unexamined. Structural BOM validation belongs to the CycloneDX schema (ECMA-424); this schema constrains only the Profile's property names and values. Taxonomy: github.com/appliedquantum/cyclonedx-property-taxonomy. Namespace registration: CycloneDX/cyclonedx-property-taxonomy issue 189. Versioned with the Profile; enumeration additions are minor, removals and semantic changes are major, per Profile section 11. Corrected edition of 9 September 2026: deflected added to lineage:disclosureStatus; trustAnchorOperator, observationWindow, discoveryCoverage, regulatoryMapping and crossSignedBy constraints pinned to the Profile text; no name change.",
  "type": "array",
  "items": {
    "$ref": "#/$defs/property"
  },
  "$defs": {
    "property": {
      "type": "object",
      "required": [
        "name",
        "value"
      ],
      "properties": {
        "name": {
          "type": "string"
        },
        "value": {
          "type": "string"
        }
      },
      "allOf": [
        {
          "if": {
            "properties": {
              "name": {
                "pattern": "^appliedquantum:"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "name": {
                "enum": [
                  "appliedquantum:conc:assessmentDate",
                  "appliedquantum:conc:criticalityAuthorizesIrreversible",
                  "appliedquantum:conc:criticalityDerivesKeys",
                  "appliedquantum:conc:criticalityNoEquivalent",
                  "appliedquantum:conc:criticalityNotRevocable",
                  "appliedquantum:conc:criticalityPastHorizon",
                  "appliedquantum:conc:discoveryCoverage",
                  "appliedquantum:conc:discoveryMethod",
                  "appliedquantum:conc:evidenceTier",
                  "appliedquantum:conc:serviceRef",
                  "appliedquantum:custody:certificate",
                  "appliedquantum:custody:firmwareFamily",
                  "appliedquantum:custody:oemOrigin",
                  "appliedquantum:custody:platform",
                  "appliedquantum:entropy:drbgSpecification",
                  "appliedquantum:entropy:esvCertificate",
                  "appliedquantum:entropy:evidence",
                  "appliedquantum:entropy:generationDesign",
                  "appliedquantum:entropy:sourceDesign",
                  "appliedquantum:fs:crossBorder",
                  "appliedquantum:fs:interopConstraint",
                  "appliedquantum:fs:paymentContext",
                  "appliedquantum:lineage:cmvpCertificate",
                  "appliedquantum:lineage:disclosureStatus",
                  "appliedquantum:lineage:evidence",
                  "appliedquantum:path:counterpartyClass",
                  "appliedquantum:path:counterpartyRef",
                  "appliedquantum:path:counterpartyStateReason",
                  "appliedquantum:path:counterpartyTargetState",
                  "appliedquantum:path:negotiatedOutcome",
                  "appliedquantum:path:observationWindow",
                  "appliedquantum:path:pathId",
                  "appliedquantum:path:populationTargetPct",
                  "appliedquantum:pki:crossSignedBy",
                  "appliedquantum:pki:trustAnchorOperator",
                  "appliedquantum:pki:trustAnchorRef",
                  "appliedquantum:pqc:cmdbRef",
                  "appliedquantum:pqc:compensatoryControls",
                  "appliedquantum:pqc:dataClassification",
                  "appliedquantum:pqc:dataRetentionPeriod",
                  "appliedquantum:pqc:disallowedAfter",
                  "appliedquantum:pqc:hndlExposure",
                  "appliedquantum:pqc:horizonSource",
                  "appliedquantum:pqc:migrationStatus",
                  "appliedquantum:pqc:regulatoryMapping",
                  "appliedquantum:pqc:systemOwner",
                  "appliedquantum:pqc:vendorDependency",
                  "appliedquantum:pqc:vendorReadinessDate",
                  "appliedquantum:pqc:vendorReadinessStatus",
                  "appliedquantum:pqc:vulnerabilityStatus"
                ]
              }
            },
            "$comment": "Closed name set: any appliedquantum:* name not defined by the Profile is invalid."
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:assessmentDate"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
                "$comment": "ISO 8601 date"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:criticalityAuthorizesIrreversible"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:criticalityDerivesKeys"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:criticalityNoEquivalent"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:criticalityNotRevocable"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:criticalityPastHorizon"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:discoveryCoverage"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^(0(\\.\\d+)?|1(\\.0+)?)$",
                "$comment": "Decimal fraction 0-1, per Profile section 7.5."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:discoveryMethod"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:evidenceTier"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^E[1-5]$"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:conc:serviceRef"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Multi-valued: one property per service; duplicate identical values are invalid (enforced by the validator)."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:custody:certificate"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "FIPS 140-3 or PCI HSM certificate reference."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:custody:firmwareFamily"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Supplier-issued canonical family identifier; never derived from marketing names."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:custody:oemOrigin"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:custody:platform"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:entropy:drbgSpecification"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:entropy:esvCertificate"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:entropy:evidence"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^E[1-5]$"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:entropy:generationDesign"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Implementation-defined pending the controlled registry; normalise within an assessment as for sourceDesign."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:entropy:sourceDesign"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Implementation-defined pending the controlled registry; normalise to one label per design within an assessment."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:fs:crossBorder"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:fs:interopConstraint"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:fs:paymentContext"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "swift",
                  "card-network",
                  "rtgs",
                  "ach",
                  "instant",
                  "correspondent",
                  "securities",
                  "none"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:lineage:cmvpCertificate"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:lineage:disclosureStatus"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "disclosed",
                  "declined",
                  "deflected",
                  "pending",
                  "no-response",
                  "not-requested"
                ],
                "$comment": "deflected added in the corrected edition of 9 September 2026 (enumeration addition, minor per Profile section 11)."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:lineage:evidence"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^E[1-5]$"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:counterpartyClass"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "blocking",
                  "contractual",
                  "peer",
                  "population"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:counterpartyRef"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "LEI where one exists; otherwise a scoped identifier with its issuer stated."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:counterpartyStateReason"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:counterpartyTargetState"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:negotiatedOutcome"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Observed protocol, version and key-establishment group."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:observationWindow"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})/\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$",
                "$comment": "ISO 8601 time interval, start/end form, each end a timestamp with a timezone designator, per Profile section 7.3."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:pathId"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:path:populationTargetPct"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^(100(\\.0+)?|\\d{1,2}(\\.\\d+)?)$",
                "$comment": "0-100; required where counterpartyClass is population (enforced by the validator, not expressible here)."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pki:crossSignedBy"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Repeated property: one trust-anchor reference per occurrence, per Profile section 3."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pki:trustAnchorOperator"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "institution-operated",
                  "third-party"
                ],
                "$comment": "Profile section 7.2. The operator's name is carried in native organisation records, not here."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pki:trustAnchorRef"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "bom-ref to the terminating root."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:cmdbRef"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:compensatoryControls"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:dataClassification"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Institution-defined; values extensible by definition."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:dataRetentionPeriod"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^P(?!$)(\\d+Y)?(\\d+M)?(\\d+W)?(\\d+D)?(T(?=\\d)(\\d+H)?(\\d+M)?(\\d+(\\.\\d+)?S)?)?$",
                "$comment": "ISO 8601 duration"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:disallowedAfter"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
                "$comment": "ISO 8601 date"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:hndlExposure"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "yes",
                  "no",
                  "unknown",
                  "not-applicable"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:horizonSource"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "nist-ir-8547",
                  "cnsa-2.0",
                  "us-eo-14412",
                  "uk-ncsc",
                  "eu-roadmap",
                  "sector",
                  "internal"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:migrationStatus"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "not-started",
                  "planned",
                  "in-progress",
                  "hybrid-deployed",
                  "pqc-only",
                  "not-applicable"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:regulatoryMapping"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1,
                "$comment": "Repeated property: one requirement identifier per occurrence, per Profile section 3."
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:systemOwner"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "minLength": 1
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:vendorDependency"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "true",
                  "false"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:vendorReadinessDate"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "type": "string",
                "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
                "$comment": "ISO 8601 date"
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:vendorReadinessStatus"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "committed",
                  "forecast",
                  "announced",
                  "unknown"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        },
        {
          "if": {
            "properties": {
              "name": {
                "const": "appliedquantum:pqc:vulnerabilityStatus"
              }
            },
            "required": [
              "name"
            ]
          },
          "then": {
            "properties": {
              "value": {
                "enum": [
                  "vulnerable-shor",
                  "weakened-grover",
                  "not-known-quantum-vulnerable",
                  "unknown"
                ]
              }
            },
            "required": [
              "value"
            ]
          }
        }
      ]
    },
    "repeatableNames": {
      "$comment": "Names that may occur more than once per properties array, one value per occurrence. All other Profile names are single-valued; the validator enforces this.",
      "enum": [
        "appliedquantum:conc:serviceRef",
        "appliedquantum:pki:crossSignedBy",
        "appliedquantum:pqc:regulatoryMapping"
      ]
    }
  }
}