{
  "contract_version": "aux-source-attestation-0.1",
  "trust_document": {
    "url_template": "https://{source_domain}/.well-known/aux-evidence-source.json",
    "schema": {
      "schema": "aux-evidence-source-0.1",
      "issuer": "https://source.example",
      "audience": "https://api.aux.prdictionedge.ai",
      "evidence_types": [
        "legal_entity_status",
        "domain_identity",
        "invoice_source_integrity",
        "vendor_history",
        "bank_destination",
        "agent_authority",
        "clinical_record_provenance",
        "diagnostic_evidence_provenance",
        "clinical_reference_basis",
        "clinician_authority"
      ],
      "keys": [
        {
          "kty": "EC",
          "crv": "P-256",
          "alg": "ES256",
          "use": "sig",
          "kid": "source-key-1",
          "x": "...",
          "y": "..."
        }
      ]
    }
  },
  "attestation_payload": {
    "schema": "aux-source-attestation-0.1",
    "issuer": "https://source.example",
    "audience": "https://api.aux.prdictionedge.ai",
    "evidence_type": "legal_entity_status | domain_identity | invoice_source_integrity | vendor_history | bank_destination | agent_authority | clinical_record_provenance | diagnostic_evidence_provenance | clinical_reference_basis | clinician_authority",
    "issued_at": "ISO-8601",
    "expires_at": "ISO-8601 (maximum 24 hours after issued_at)",
    "subject": "object bound to the transaction/vendor/agent",
    "claims": "evidence-type-specific claims"
  },
  "accepted_evidence_types": {
    "legal_entity_status": {
      "required_subject": [
        "vendor_name or lei"
      ],
      "required_claims": [
        "entity_status",
        "registered_address"
      ],
      "caller_binding": [
        "proposal.vendor.name or proposal.vendor.lei",
        "proposal.vendor.registered_address"
      ]
    },
    "domain_identity": {
      "required_subject": [
        "domain"
      ],
      "required_claims": [
        "controlled",
        "legal_name or lei"
      ],
      "caller_binding": [
        "proposal.vendor.domain",
        "proposal.vendor.name or proposal.vendor.lei"
      ]
    },
    "invoice_source_integrity": {
      "required_subject": [
        "transaction_id"
      ],
      "required_claims": [
        "invoice_number",
        "invoice_amount",
        "document_sha256"
      ],
      "caller_binding": [
        "proposal.transaction_id",
        "proposal.invoice.number",
        "proposal.invoice.amount",
        "proposal.invoice.artifact_sha256"
      ]
    },
    "vendor_history": {
      "required_subject": [
        "vendor_id"
      ],
      "required_claims": [
        "transaction_history_sha256"
      ],
      "caller_binding": [
        "proposal.vendor.id",
        "sha256(transaction_history)"
      ]
    },
    "bank_destination": {
      "required_subject": [
        "vendor_id"
      ],
      "required_claims": [
        "bank_fingerprint"
      ],
      "caller_binding": [
        "proposal.vendor.id",
        "proposal.payment.bank_fingerprint"
      ]
    },
    "agent_authority": {
      "required_subject": [
        "transaction_id",
        "agent_id"
      ],
      "required_claims": [
        "requested_action",
        "authorized",
        "max_amount_usd"
      ],
      "caller_binding": [
        "proposal.transaction_id",
        "proposal.agent.id",
        "proposal.requested_action",
        "proposal.invoice.amount"
      ]
    },
    "clinical_record_provenance": {
      "required_subject": [
        "case_id"
      ],
      "required_claims": [
        "clinical_record_set_sha256",
        "evidence_contract_id",
        "complete_under_contract",
        "complete_through"
      ],
      "caller_binding": [
        "proposal.case.case_id",
        "proposal.case.clinical_record_set_sha256",
        "proposal.case.evidence_contract_id",
        "proposal.case.review_cutoff_at"
      ],
      "data_policy": "synthetic_or_deidentified_only"
    },
    "diagnostic_evidence_provenance": {
      "required_subject": [
        "case_id"
      ],
      "required_claims": [
        "diagnostic_artifact_set_sha256",
        "evidence_contract_id",
        "complete_under_contract",
        "complete_through"
      ],
      "caller_binding": [
        "proposal.case.case_id",
        "proposal.case.diagnostic_artifact_set_sha256",
        "proposal.case.evidence_contract_id",
        "proposal.case.review_cutoff_at"
      ],
      "data_policy": "synthetic_or_deidentified_only"
    },
    "clinical_reference_basis": {
      "required_subject": [
        "case_id"
      ],
      "required_claims": [
        "reference_document_set_sha256",
        "evidence_contract_id",
        "complete_under_contract",
        "complete_through"
      ],
      "caller_binding": [
        "proposal.case.case_id",
        "proposal.case.reference_document_set_sha256",
        "proposal.case.evidence_contract_id",
        "proposal.case.review_cutoff_at"
      ],
      "data_policy": "synthetic_or_deidentified_only"
    },
    "clinician_authority": {
      "required_subject": [
        "case_id",
        "clinician_id"
      ],
      "required_claims": [
        "requested_action",
        "authorized",
        "evidence_contract_id"
      ],
      "caller_binding": [
        "proposal.case.case_id",
        "proposal.case.evidence_contract_id",
        "proposal.clinician.id",
        "proposal.requested_action"
      ],
      "data_policy": "synthetic_or_deidentified_only"
    }
  },
  "rule": "The caller may transport the attestation, but cannot establish trust in it. AUX independently resolves the source-domain trust document and key before accepting the claim."
}