{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://semblance.studio/schemas/likeness-license/v0.1.2.json",
  "title": "Semblance Likeness License v0.1.2",
  "description": "Open, machine-readable license for the authorized use of a verified person's, estate's, or owned fictional character's likeness (face, voice, motion, persona) in AI-generated media. Merged canonical schema uniting three design lenses: legal completeness (consent specificity per Cal. Lab. Code 927 / AB 2602 is structurally forced; NO FAKES draft 10-year cap for living humans; BIPA-safe biometric handling; non-waivable prohibited-use baseline; union rider as first-class data; court-applicable revocation semantics), machine executability (closed enums, integer minor-unit money, ISO 8601/3166/4217 types, fail-closed auto-approval, normative x-state-machine and x-invariants, consent cryptographically bound to the grant), and deal realism (composable hybrid fee components, escrow state machine, kill fees, options, exclusivity attached to the end brand, two approval surfaces). Anything not machine-decidable fails closed to manual approval. Cross-field rules JSON Schema cannot express are normative and enumerated in x-invariants.",
  "$comment": "v0.1.2 draft (revision of v0.1.1 applying the two adversarial reviews — legal completeness and implementability — see SPEC.md changelog and 'Known limitations / v0.2 candidates'). Headline 0.1.2 changes: embodied human performers are first-class sub-parties (own age attestation, KYC, BIPA release, consent, payout role) and the INV-001 10-year cap covers them; structured age attestation for every verified natural person; term caps measured from the earliest of consent/execution to inclusive end-of-day end_date; advance authorizations hash-bind the licensor's full standing terms (licensor_terms_ref, INV-029); BIPA release-before-collection ordering (INV-030); closed verify_license outcome vocabulary (INV-008); executed->expired and expired->terminated transitions; raw-release/fine-tune auto-execution requires an explicit envelope opt-in (INV-004(m)). Resolution rules applied in the merge: legal draft wins on consent/revocation/union/compliance structures; agent draft wins on types, enums, identifiers, machine-evaluability; commercial draft wins on pricing/deal structures. Blocks required at EXECUTION time but not while drafting: consent, execution (see root allOf and SPEC.md).",
  "type": "object",
  "additionalProperties": false,
  "x-state-machine": {
    "description": "Normative license status machine. These are the ONLY legal transitions; engines MUST reject any other status change. Every applied transition MUST be appended to /lifecycle/status_history and MUST emit the listed webhook event exactly once (webhook delivery is at-least-once; consumers deduplicate on webhook_event_id).",
    "states": ["draft", "quoted", "pending_approval", "executed", "active", "expired", "revoked", "terminated", "declined", "cancelled"],
    "initial": "draft",
    "terminal": ["revoked", "terminated", "declined", "cancelled"],
    "note": "'expired' is quasi-terminal: its ONLY exit is expired -> terminated (post_term_breach_terminated), the for-cause lever against abuse of a post_term_runoff_days window or an embedded-products survival election. No transition may ever re-enter an active or pre-execution state.",
    "transitions": [
      { "from": "draft", "to": "quoted", "trigger": "quote_issued", "emits": "license.quoted", "note": "request_quote produced binding pricing; quotes are immutable snapshots with a TTL." },
      { "from": "draft", "to": "cancelled", "trigger": "draft_abandoned", "emits": "license.cancelled" },
      { "from": "quoted", "to": "pending_approval", "trigger": "booking_created_manual", "emits": "license.pending_approval", "note": "approval.mode == manual, or any fail-closed condition (INV-004) routed an auto request to manual review." },
      { "from": "quoted", "to": "executed", "trigger": "booking_auto_executed", "emits": "license.executed", "note": "approval.mode in [auto_approve_within_parameters, standing_offer] and every step of x-auto-approval-algorithm passed; payment captured to escrow atomically; idempotent on /integration/execution_idempotency_key. The licensor-side instrument executed is the pre-signed advance authorization (INV-023, terms equality per INV-029); the transition actor is the initiating licensee/licensee_agent." },
      { "from": "quoted", "to": "cancelled", "trigger": "quote_expired_or_withdrawn", "emits": "license.cancelled" },
      { "from": "pending_approval", "to": "executed", "trigger": "licensor_approved", "emits": "license.executed", "note": "Manual approval by licensor (or their agent of record), then execute_license; payment captured to escrow. Booking-approval SLA timeout NEVER auto-approves (approval.booking_approval_sla.on_timeout)." },
      { "from": "pending_approval", "to": "declined", "trigger": "licensor_declined", "emits": "license.declined" },
      { "from": "pending_approval", "to": "declined", "trigger": "sla_timeout_declined", "emits": "license.declined", "note": "System-applied (actor type 'system') when approval.booking_approval_sla.on_timeout == 'auto_decline' and the SLA lapses without licensor action. Silence never approves; this is the matching machine transition for the auto_decline timeout election." },
      { "from": "pending_approval", "to": "cancelled", "trigger": "licensee_withdrew_or_approval_ttl_elapsed", "emits": "license.cancelled" },
      { "from": "executed", "to": "active", "trigger": "term_started_and_escrow_funded", "emits": "license.activated", "note": "Whichever is latest of grant.term.start_date, escrow funding (INV-015), and the ACTIVATION EVENT. Activation event, normatively: for file deliverables, the first watermarked delivery; for service-enablement deliverables (kind 'persona_endpoint_access' or 'live_stream_session'), the platform's endpoint/session provisioning event (recorded in execution.delivery.delivered_at) — such licenses need never produce a watermarked file to activate." },
      { "from": "executed", "to": "expired", "trigger": "term_end_reached_before_activation", "emits": "license.expired", "note": "Deterministic clock event (actor type 'system'): grant.term.end_date passed while the license was still 'executed' (escrow never funded, delivery/provisioning never occurred, or a postdated start never arrived). Escrowed funds are disposed per pricing.escrow and refund rules; no license may sit in 'executed' past its own end_date." },
      { "from": "executed", "to": "terminated", "trigger": "payment_failed_or_pre_activation_breach", "emits": "license.terminated" },
      { "from": "executed", "to": "revoked", "trigger": "licensor_revoked", "emits": "license.revoked" },
      { "from": "active", "to": "expired", "trigger": "term_end_reached", "emits": "license.expired", "note": "Deterministic clock event at grant.term.end_date (23:59:59Z). Renewal is a NEW license document referencing this one via amends_license_id (INV-021)." },
      { "from": "active", "to": "revoked", "trigger": "licensor_revoked", "emits": "license.revoked", "note": "Effects per /revocation: new generations cease immediately on all platforms; delivered outputs per delivered_outputs_treatment." },
      { "from": "active", "to": "terminated", "trigger": "breach_or_mutual_termination", "emits": "license.terminated", "note": "Kill-fee schedule (pricing.kill_fee) applies when the licensee cancels." },
      { "from": "expired", "to": "terminated", "trigger": "post_term_breach_terminated", "emits": "license.terminated", "note": "For-cause action during a post-term window: breach of the post_term_runoff_days runoff or abuse of an embedded_products_survive election (new SKUs, new marketing placements, out-of-scope distribution). Extinguishes the runoff/survival rights for cause (INV-022/INV-024); verify_license thereafter reports the content per the 'terminated' row of the INV-008 outcome table." }
    ]
  },
  "x-invariants": [
    { "id": "INV-001", "rule": "LIVING-PERSON TERM CAP (NO FAKES Act draft). Applies whenever a living natural person's likeness is encumbered: /parties/licensor/identity_type == 'human', OR /parties/licensor/character_provenance/embodied_human_performer == true (a character wrapper never launders a living performer's voice/face past the cap). MEASUREMENT, normative and date-inclusive: the encumbrance ANCHOR is the EARLIEST of consent.captured_at (UTC date part), execution.executed_at (UTC date part), and grant.term.start_date — a living person is encumbered from the moment they sign, not from a postdated flight start. end_date is INCLUSIVE (exercisable through end-of-day 23:59:59Z), so the cap check is ((end_date + 1 day) - anchor) <= P10Y computed in date space (start 2026-07-01 with end 2036-07-01 spans 10 years + 1 day and FAILS; end 2036-06-30 passes when anchored at 2026-07-01). Pre-execution (no consent/execution yet), anchor falls back to start_date and the check re-runs at execution with the true anchor. Engines MUST compute this in date space; JSON Schema cannot.", "fields": ["/parties/licensor/identity_type", "/parties/licensor/character_provenance/embodied_human_performer", "/grant/term/start_date", "/grant/term/end_date", "/consent/captured_at", "/execution/executed_at"] },
    { "id": "INV-002", "rule": "If /parties/licensor/identity_type == 'estate' then grant.term.end_date MUST NOT exceed /parties/licensor/estate_authority/post_mortem_rights_expire_at (post-mortem right-of-publicity window in the governing jurisdiction). RE-VERIFICATION, normative: post_mortem_rights_expire_at MUST be re-verified against the governing regime at EVERY execution and every renewal (amends_license_id chain) — renewal-contingent regimes (e.g. the NO FAKES draft's 10-year + 5-year renewals, representative mandates with re-verification dates) can shorten or extend the recorded bound between documents, and a stale recorded date is not a defense. The inclusive end-of-day reading of end_date from INV-001 applies here too.", "fields": ["/grant/term/end_date", "/parties/licensor/estate_authority/post_mortem_rights_expire_at"] },
    { "id": "INV-003", "rule": "Every money.currency in this document MUST equal /pricing/currency. Auto-approval never converts FX; a currency mismatch routes to manual.", "fields": ["/pricing/currency"] },
    { "id": "INV-004", "rule": "Fail-closed auto-approval. The request MUST route to manual approval (pending_approval) if ANY of the following hold: (a) grant.content_exclusions.custom_exclusions contains an entry with enforcement 'booking_match', or an entry with enforcement 'deliverable_review' while approval.deliverable_approval.required is not true or its scope omits 'generated_outputs' (deliverable-review-enforced customs never gate booking matching when output review is retained); (b) union_rider.covered is true; (c) grant.exclusivity.mode != 'none'; (d) grant.exclusivity.named_competitor_blocks is non-empty (free text is never machine-matched); (e) grant.exclusivity.competitor_blocks is non-empty and either approval.auto_approval_parameters.naics_competitor_blocks_permitted is not true or the deterministic block-ledger conflict check of INV-016 does not pass; (f) grant.term.delivered_outputs_survival == 'embedded_products_survive'; (g) grant.platform_allowlist.self_hosted_generation_permitted is true; (h) grant.use_categories contains 'interactive_persona'; (i) grant.use_persistence == 'persistent_synthetic_performance'; (j) any pricing fee component has model 'revenue_share'; (k) /content_declaration is absent (INV-026); (l) the request contains any field/value the evaluator does not recognize; or (m) asset_handling.raw_biometric_reference_released is true OR asset_handling.derived_models.fine_tuning_permitted is true, UNLESS approval.auto_approval_parameters.reference_release_permitted is true AND asset_handling.released_asset_classes is a subset of auto_approval_parameters.reference_release_allowed_asset_classes — releasing raw reference material or authorizing fine-tuning is never an implicit side effect of an auto-executed booking; the licensor opts in per asset class or a human reviews. Licensee_blocklist hits REJECT instead. Auto-execution is only lawful over fully machine-decidable terms.", "fields": ["/grant/content_exclusions/custom_exclusions", "/union_rider/covered", "/grant/exclusivity", "/grant/term/delivered_outputs_survival", "/grant/platform_allowlist/self_hosted_generation_permitted", "/grant/use_categories", "/grant/use_persistence", "/pricing/fee_components", "/content_declaration", "/asset_handling/raw_biometric_reference_released", "/asset_handling/derived_models/fine_tuning_permitted", "/approval/auto_approval_parameters/reference_release_permitted"] },
    { "id": "INV-005", "rule": "If any fee component has model 'per_impression' then usage_reporting.required MUST be true and metrics MUST include 'impressions'. If any has model 'revenue_share' then usage_reporting.required MUST be true and metrics MUST include 'revenue_gross' (and 'revenue_net' when basis == 'net_revenue_defined_costs').", "fields": ["/pricing/fee_components", "/usage_reporting/required", "/usage_reporting/metrics"] },
    { "id": "INV-006", "rule": "If grant.use_categories contains 'interactive_persona': licensee verification_tier >= 'tier_3_business_verified', approval.mode == 'manual', pricing contains a revenue_share component, and use_persistence == 'persistent_synthetic_performance' (all four also enforced by schema conditionals).", "fields": ["/grant/use_categories", "/parties/licensee/verification_tier", "/approval/mode", "/pricing/fee_components", "/grant/use_persistence"] },
    { "id": "INV-007", "rule": "At the transition into 'executed', /consent/grant_hash/value MUST equal the SHA-256 of the RFC 8785 (JCS) canonicalization of the /grant object. This binds the consent record to the exact terms consented to (AB 2602 'reasonably specific description' + tamper evidence). Any later change to /grant requires license_version+1 and a fresh consent record.", "fields": ["/consent/grant_hash", "/grant"] },
    { "id": "INV-008", "rule": "Generation and delivery may only occur on platform/model pairs in /grant/platform_allowlist/platforms (including registered self-hosted pipelines when permitted, INV-025). VERIFY OUTCOME VOCABULARY, closed and normative — verify_license MUST report every queried content hash with exactly one of these statuses, computed as a function of (license status x delivered_outputs_treatment x window); content not traceable to any license's delivery or embedded-use manifest is 'unlicensed': (1) 'licensed_active' — status 'active', content within scope; (2) 'licensed_pre_activation' — status 'executed', content in the delivery manifest, delivered under a generation_may_precede_start election before activation (the normal pre-flight window; distribution remains prohibited until start_date); (3) 'licensed_runoff' — status 'expired', within post_term_runoff_days of end_date; (4) 'licensed_post_term_survival' — status 'expired' with delivered_outputs_survival == 'embedded_products_survive', content in the delivery or embedded-use manifest (INV-024); (5) 'licensed_revoked_retention' — status 'revoked' NOT for cause, delivered_outputs_treatment == 'licensee_retains_through_term', before the original end_date; (6) 'licensed_wind_down_until' — status 'revoked' NOT for cause, delivered_outputs_treatment == 'wind_down_then_cease', within wind_down_days of the revocation effective time (response includes the wind-down deadline); (7) 'licensed_terminated_retention' — status 'terminated' by licensee cancellation (kill-fee schedule applies) with delivered outputs contractually retained through the original term, before end_date; a for-cause or post_term_breach termination NEVER yields this status; (8) 'unlicensed' — everything else, expressly including all delivered content of a FOR-CAUSE revocation after its effective time (INV-022) and any content outside its window above. Reporting lawfully retained post-revocation/post-termination content as 'unlicensed' is itself a conformance failure — wrongful-takedown protection is part of the spec.", "fields": ["/grant/platform_allowlist/platforms", "/execution/delivery/asset_manifest", "/grant/term/delivered_outputs_survival", "/revocation/delivered_outputs_treatment", "/status"] },
    { "id": "INV-009", "rule": "Territory subset math: 'worldwide' expands to the full ISO 3166-1 alpha-2 set; 'exclude' means (world minus country_codes). A requested territory is approvable iff its expanded set is a subset of the expanded allowed territory.", "fields": ["/grant/territory", "/approval/auto_approval_parameters/allowed_territory"] },
    { "id": "INV-010", "rule": "Idempotency: create_booking retried with the same /integration/booking_idempotency_key, and execute_license retried with the same /integration/execution_idempotency_key, MUST return the previously created record and MUST NOT re-capture payment or re-emit webhooks. The two operations use SEPARATE keys (a retry of execute_license is never confused with the booking that preceded it). SCOPING, normative: keys are scoped to the tuple (licensee_id, operation) — a key collision across licensees MUST NOT return another tenant's record; caller-supplied keys are namespaced per authenticated licensee account. RETENTION: the platform MUST retain each key-to-record mapping for at least 24 months after last use; a retry after the retention window is treated as a new request and MUST be rejected if it would double-execute.", "fields": ["/integration/booking_idempotency_key", "/integration/execution_idempotency_key"] },
    { "id": "INV-011", "rule": "/lifecycle/status_history is append-only and MUST replay to /status through transitions listed in x-state-machine only.", "fields": ["/status", "/lifecycle/status_history"] },
    { "id": "INV-012", "rule": "Minors are categorically excluded from the registry. /parties/licensor/adult_verified is const true and MUST be backed by a STRUCTURED AGE ATTESTATION (date_of_birth_verified + age_verification_ref + verified_at, $defs.age_attestation) for EVERY verified natural person the document touches: the human licensor (licensor.age_attestation), the estate representative (estate_authority.representative.age_attestation), the character-owner signatory (character_provenance.owner_signatory.age_attestation), and any embodied human performer (character_provenance.embodied_performer.age_attestation). The attestation names the specific KYC artifact that verified date of birth >= 18 years before verified_at — an auditor or court can trace the 18+ assertion to evidence, not to a schema constant. The registry MUST re-verify on document challenge.", "fields": ["/parties/licensor/adult_verified", "/parties/licensor/age_attestation", "/parties/licensor/human_verification", "/parties/licensor/estate_authority/representative", "/parties/licensor/character_provenance/owner_signatory", "/parties/licensor/character_provenance/embodied_performer"] },
    { "id": "INV-013", "rule": "/parties/licensor/payout_split[].share_bps MUST sum to exactly 10000 when payout_split is present. When character_provenance.embodied_human_performer is true, payout_split MUST be present and MUST contain an entry with role 'embodied_performer' — performer compensation is a visible, first-class term, never an off-platform side deal. Minor-unit remainders divide per INV-032.", "fields": ["/parties/licensor/payout_split", "/parties/licensor/character_provenance/embodied_human_performer"] },
    { "id": "INV-014", "rule": "/pricing/payment_schedule/milestones[].share_of_fixed_fees_bps MUST sum to exactly 10000 when any flat_fee component exists and a payment_schedule is present.", "fields": ["/pricing/payment_schedule/milestones", "/pricing/fee_components"] },
    { "id": "INV-015", "rule": "When pricing.escrow.required is true, the license MUST NOT transition executed -> active until pricing.escrow.state == 'funded'. 'disputed' freezes releases pending the human-review dispute process.", "fields": ["/pricing/escrow", "/status"] },
    { "id": "INV-016", "rule": "Exclusivity and competitor-block conflict check, evaluated against the END brand (parties.licensee.brand.industry_naics / end_client_legal_name), never the booking agency. Two distinct regimes: (1) EXCLUSIVITY MODES (category_exclusive / full_exclusive) can never be granted by a machine — auto_approval_parameters.exclusivity_permitted is const false and any exclusivity.mode != 'none' routes to manual (INV-004); at execution the platform MUST verify no other active license for this licensor grants exclusivity overlapping the requested categories/NAICS prefixes. (2) NAICS COMPETITOR BLOCKS under mode 'none' (non-exclusive with a category block — the standard ad-deal shape) ARE machine-decidable and MAY auto-execute when auto_approval_parameters.naics_competitor_blocks_permitted is true AND the registry block ledger shows no conflict. LEDGER SCOPE, normative: the conflict comparison set is every license for this licensor in status 'executed' OR 'active' (an executed-not-yet-active license already binds), PLUS every 'expired' license whose exclusivity.holdback_days_post_term window is still running — no requested block prefix may match the industry_naics of the end brand of any license in that set, and this licensor may hold no in-scope block whose prefix matches the requesting end brand's industry_naics. COMMIT DISCIPLINE: the ledger check and the ledger write commit atomically and SERIALIZED per licensor at the final execution step — two conflicting auto-executions the same morning cannot both pass; the second observes the first's committed block. Any indeterminacy (missing industry_naics anywhere in the comparison set) routes to manual. Free-text named_competitor_blocks are always human-reviewed.", "fields": ["/grant/exclusivity", "/parties/licensee/brand", "/parties/licensee/end_client_legal_name", "/approval/auto_approval_parameters/naics_competitor_blocks_permitted"] },
    { "id": "INV-017", "rule": "Content-declaration matching: the licensee's request-time declaration is the /content_declaration block (INV-026). A request is denied when content_declaration.declared_codes ∩ (grant.content_exclusions.excluded_codes MINUS grant.content_exclusions.affirmative_permissions) is non-empty. affirmative_permissions MUST be disjoint from excluded_codes (a code cannot be both), and a declared code listed in affirmative_permissions never denies — this is how 'energy drinks expressly permitted' is machine-readable rather than mere absence-of-exclusion. Declarations are warranties: a false or incomplete declaration is a content_exclusion_breach / use_outside_granted_scope for-cause ground. DERIVED-CODE RULE: when the requested outputs script the likeness personally endorsing the product (first-person testimonial framing under endorsement_restrictions.first_person_endorsement_permitted), 'first_person_endorsement_phrasing' MUST appear in declared_codes — evaluators MUST auto-derive and require this code whenever the booking's campaign/deliverable metadata indicates spokesperson or endorsement framing; its absence in that posture is an incomplete declaration.", "fields": ["/content_declaration/declared_codes", "/grant/content_exclusions/excluded_codes", "/grant/content_exclusions/affirmative_permissions", "/grant/content_exclusions/endorsement_restrictions"] },
    { "id": "INV-018", "rule": "If the expanded grant territory includes any EU/EEA member state, grant.ai_disclosure.eu_ai_act_art50_labeling MUST be true. The schema structurally forces only the worldwide case; country-list EU detection is this validator rule.", "fields": ["/grant/territory", "/grant/ai_disclosure/eu_ai_act_art50_labeling"] },
    { "id": "INV-019", "rule": "Every consent.intended_use.deliverables[].media_type MUST be a member of grant.media_types, every deliverables[].spec.languages entry (in /deliverables) MUST match a grant.languages entry under RFC 4647 BASIC FILTERING (extended-range matching at hyphen-delimited subtag boundaries: 'en' matches 'en' and 'en-US'; 'es' does NOT match 'est'; comparison is case-insensitive after canonicalization — primary subtags are schema-required lowercase), and the executed consent instrument (consent.instrument_ref) MUST contain the intended_use narrative and deliverables verbatim (for advance authorizations, the instrument additionally reproduces the auto_approval_parameters and any standing_offer verbatim, INV-023).", "fields": ["/consent/intended_use", "/grant/media_types", "/grant/languages"] },
    { "id": "INV-020", "rule": "If any per_impression component has measurement_source == 'licensee_attested', usage_reporting.audit.rights_granted MUST be true.", "fields": ["/pricing/fee_components", "/usage_reporting/audit"] },
    { "id": "INV-021", "rule": "Renewals and extensions are NEW license documents referencing the prior one via amends_license_id — never in-place term edits. Statutory caps (INV-001/INV-002) are re-checked per document, per renewal, so the NO FAKES cap cannot be laundered through chained amendments; each new document requires a fresh consent record.", "fields": ["/amends_license_id", "/license_version", "/consent"] },
    { "id": "INV-022", "rule": "For-cause revocation (revocation.for_cause_grounds) always permits immediate cessation and takedown demands notwithstanding the negotiated delivered_outputs_treatment (revocation.for_cause_overrides_to_immediate is const true), with no refund and biometric/derived-model destruction per asset_handling.", "fields": ["/revocation/for_cause_grounds", "/revocation/delivered_outputs_treatment", "/asset_handling"] },
    { "id": "INV-023", "rule": "Advance execution authorization: when approval.mode != 'manual', no natural person acts for the licensor at execution — the instrument executed is the licensor's PRE-SIGNED advance authorization. From 'executed' onward, consent.advance_authorization is required; consent.instrument_ref MUST reference the signed advance instrument (which reproduces the intended-use narrative, the auto_approval_parameters, and any standing_offer verbatim); advance_authorization.approval_hash.value MUST equal the SHA-256 of the RFC 8785 (JCS) canonicalization of the /approval object (any change to the envelope requires a fresh advance instrument); consent.captured_at == advance_authorization.envelope_signed_at and MUST precede the auto-executed transition; advance_authorization.licensor_terms_ref MUST resolve to the licensor's published, hash-fixed standing-terms document and the byte-equality rule of INV-029 MUST hold; and execution.licensor_signature_ref MUST resolve to the advance instrument. Per-execution specifics (licensee identity, /campaign — required from 'executed' onward for non-manual modes with product_or_service stated, root allOf — and /content_declaration) are disclosed to the licensor at execution via dashboard and webhook — recorded by intended_use.licensee_identity_disclosure == 'disclosed_at_execution_per_advance_authorization'.", "fields": ["/consent/advance_authorization", "/consent/captured_at", "/approval", "/execution/licensor_signature_ref", "/consent/intended_use/licensee_identity_disclosure", "/campaign"] },
    { "id": "INV-024", "rule": "Post-term survival: when grant.term.delivered_outputs_survival == 'embedded_products_survive', outputs generated during the term and embedded in products distributed to end users during the term (shipped game builds, pressed media, published works) remain licensed for continued distribution and use WITHIN THE ORIGINAL SCOPE after end_date. verify_license MUST report content traceable to this license's delivery manifest or embedded-use manifest as 'licensed_post_term_survival' after expiry — never as unlicensed. New generation, new product SKUs, and new marketing placements after end_date are always unlicensed. Survival is continued distribution of lawfully made copies; it never extends the generation term measured by INV-001/INV-002. SURVIVAL REVOCATION: abuse of the survival election (or of a runoff window) is remediable for cause via the expired -> terminated transition (post_term_breach_terminated), which extinguishes the survival/runoff rights prospectively; verify_license then stops reporting 'licensed_post_term_survival'/'licensed_runoff' for this license (INV-008 row 7/8).", "fields": ["/grant/term/delivered_outputs_survival", "/execution/delivery/asset_manifest", "/provenance/embedded_use_manifest"] },
    { "id": "INV-025", "rule": "Self-hosted generation: when grant.platform_allowlist.self_hosted_generation_permitted is true, every licensee-operated pipeline MUST be registered in the Semblance Platform Registry and enumerated in platform_allowlist.platforms (a registered self-hosted pipeline is a first-class allowlist entry, typically api_enforced false); usage_reporting.required MUST be true with metrics including 'outputs_generated' and 'output_hashes' (the enforcement substitute for platform-side certificate checks); asset_handling.destruction_obligations MUST be present when reference material is released to the pipeline; and the license can never auto-approve (INV-004(g)).", "fields": ["/grant/platform_allowlist/self_hosted_generation_permitted", "/grant/platform_allowlist/platforms", "/usage_reporting", "/asset_handling"] },
    { "id": "INV-026", "rule": "Request-time content declaration: every auto_approve_within_parameters or standing_offer execution MUST carry /content_declaration (its absence routes to manual, INV-004(k)); INV-017 matching runs on declared_codes. For manual approvals the block is optional but, when present, is still matched and still binds the licensee as a warranty.", "fields": ["/content_declaration", "/approval/mode"] },
    { "id": "INV-027", "rule": "Metered commitments vs caps: when output_caps.mode == 'capped', any per_output committed_units MUST be <= output_caps.max_outputs and any per_impression committed_impressions MUST be <= output_caps.max_impressions. Units beyond the committed block but within the cap bill per the component's billing mode at rate_per_unit; units beyond the cap are governed exclusively by output_caps.overage. The committed block and the cap are distinct numbers with distinct jobs (prepayment vs ceiling).", "fields": ["/pricing/fee_components", "/grant/output_caps"] },
    { "id": "INV-028", "rule": "Destruction certificates are owed severally by the licensee AND by every allowlisted platform or registered self-hosted pipeline that received released reference material or hosts a derived model (asset_handling.destruction_obligations.applies_to_recipients is const). Semblance collects each recipient's certificate against the license record; a missing certificate from any recipient is non-compliance by the licensee, who warrants procurement.", "fields": ["/asset_handling/destruction_obligations/applies_to_recipients", "/grant/platform_allowlist/platforms"] },
    { "id": "INV-029", "rule": "Advance-authorization standing-terms binding. When approval.mode != 'manual', consent.advance_authorization.licensor_terms_ref MUST reference the licensor's published, hash-fixed standing-terms document (the profile terms the licensor actually signed), and at every auto/standing execution the platform MUST verify BYTE-EQUALITY (after RFC 8785 JCS canonicalization) of every talent-fixed block in the assembled license against that document: /grant/content_exclusions, /grant/platform_allowlist, /grant/ai_disclosure, /revocation, /asset_handling, /usage_reporting, and /parties/licensor/payout_split. A booking assembler cannot drop an excluded code, flip a revocation election, or release reference material the licensor never authorized — grant_hash computed at execution proves what was executed; licensor_terms_ref + this equality check prove it is what the licensor SIGNED. Any inequality fails execution closed (route to manual with the diff surfaced).", "fields": ["/consent/advance_authorization/licensor_terms_ref", "/grant/content_exclusions", "/grant/platform_allowlist", "/grant/ai_disclosure", "/revocation", "/asset_handling", "/usage_reporting", "/parties/licensor/payout_split"] },
    { "id": "INV-030", "rule": "Biometric release-before-collection ordering (BIPA 15(b)). When asset_handling.biometric_data_present is true: asset_handling.written_release_ref.captured_at MUST be <= asset_handling.reference_materials_collected_at AND <= every biometric-collection timestamp the document records for the data subject (including human_verification.liveness_verified_at and embodied_performer.verification.liveness_verified_at when the liveness check itself collects a biometric of that subject). The written release is executed BEFORE any collection — collect-first-paper-later is unrepresentable in a conformant document. The release MUST be executed by the data SUBJECT (written_release_signatory; for embodied performers, the performer, per embodied_performer.bipa_written_release_ref).", "fields": ["/asset_handling/written_release_ref", "/asset_handling/reference_materials_collected_at", "/asset_handling/written_release_signatory", "/parties/licensor/human_verification/liveness_verified_at", "/parties/licensor/character_provenance/embodied_performer"] },
    { "id": "INV-031", "rule": "Territory-driven statutory-bases coverage. consent.statutory_bases MUST cover the licensed TERRITORY's principal likeness/biometric regimes for the licensed modalities, validator-linted as follows: expanded territory includes any US state => at least one US basis (and 'tn_elvis_act' whenever a living person's voice is synthesized for US distribution; 'il_bipa_740_ilcs_14' whenever biometric_data_present is true and the territory includes the US); includes any EU/EEA state => at least one EU basis ('eu_ai_act_art50' and, for living persons, 'eu_gdpr_art9_explicit_consent'); 'worldwide' => both of the above minimum sets. Failing the lint blocks execution (fail closed to manual legal review). This is a floor, not full conflict-of-laws analysis (fifty-state matrix is a v0.2 work item).", "fields": ["/consent/statutory_bases", "/grant/territory", "/asset_handling/biometric_data_present", "/grant/media_types"] },
    { "id": "INV-032", "rule": "Basis-point money math — rounding and remainder, normative for every bps computation in this document (payout_split INV-013, milestones INV-014, platform_fee_bps, revenue_share settlement, kill-fee schedule, exclusivity uplift_bps, late-payment interest): each line's amount is floor(base_amount_minor * share_bps / 10000) in integer minor units; the residual remainder (base minus the sum of floored lines) is allocated in full to the LAST entry of the ordered list (last milestone, last payout-split entry) or, for single-payee computations (platform fee, kill fee, interest, uplift), remains with the computed line's floor (the payer keeps the sub-minor-unit residue). UPLIFT BASE: exclusivity_premium.uplift_bps applies to the machine-computed guaranteed total of the OTHER components (flat fees + committed per-output/per-impression minimums + minimum guarantees for the initial period), EXCLUDING the premium itself and excluding uncommitted metered/share upside.", "fields": ["/parties/licensor/payout_split", "/pricing/payment_schedule/milestones", "/pricing/platform_fee_bps", "/pricing/fee_components", "/pricing/kill_fee"] },
    { "id": "INV-033", "rule": "pricing.total_guaranteed_fee MUST equal the machine-computed guaranteed sum over fee_components: sum of flat_fee fees + per_output committed_units x rate_per_unit + per_impression (committed_impressions / 1000) x rate_per_1000_impressions + revenue_share minimum_guarantee fee for the initial period + exclusivity_premium fee (and uplift per INV-032). A free-standing total that disagrees with its components is invalid — kill fees, confirmation thresholds, and fee-envelope checks all compute from this number.", "fields": ["/pricing/total_guaranteed_fee", "/pricing/fee_components"] },
    { "id": "INV-034", "rule": "Agent-channel integrity: booked_via is verified platform-side, never merely caller-asserted. Any OAuth client / API credential registered in the Semblance agent registry as an autonomous agent MUST be forced to booked_via 'mcp_agent' with the agent_delegation block (and its principal-set human_confirmation_required_above threshold) — an agent presenting itself as 'api' or 'web' to skip delegation and HITL thresholds is a platform-enforcement failure, and the platform MUST reject the booking.", "fields": ["/parties/licensee/booked_via", "/parties/licensee/agent_delegation"] },
    { "id": "INV-035", "rule": "Licensee-side human-confirmation artifact: when the computed fee exceeds approval.human_confirmation_threshold or parties.licensee.agent_delegation.human_confirmation_required_above, the license MUST NOT execute until a natural person at the licensee/principal confirms, and execution.human_confirmation (confirmed_by, confirmed_at, method_ref) MUST be present in the executed document recording who confirmed, when, and under what evidence — the artifact an agentic-payment dispute needs. When neither threshold is crossed the block is absent.", "fields": ["/execution/human_confirmation", "/approval/human_confirmation_threshold", "/parties/licensee/agent_delegation/human_confirmation_required_above"] },
    { "id": "INV-036", "rule": "Reference-data pinning: territory expansion (INV-009), EU/EEA membership detection (INV-018), ISO 4217 minor-unit exponents, and NAICS 2022 prefix tables MUST be evaluated against the date-versioned Semblance Reference Registry snapshot named in /integration/reference_registry_snapshot (published alongside the Platform Registry). Two conformant implementations evaluating the same document use the same country set, EU list, and currency exponents; codes not in the snapshot (e.g. 'ZZ') fail closed to manual.", "fields": ["/integration/reference_registry_snapshot", "/grant/territory", "/pricing/currency"] }
  ],
  "x-auto-approval-algorithm": {
    "description": "Normative, ordered, deny-fast evaluation an engine runs when approval.mode is 'auto_approve_within_parameters' or 'standing_offer'. 'params' means /approval/auto_approval_parameters. Optional param dimensions, when absent, impose no constraint beyond the grant itself; required param dimensions always evaluate. OUTCOME SEMANTICS: 'route_manual' preserves the human retry channel (the booking enters pending_approval); 'reject' is a terminal denial with no human retry — reserved for blocklist hits, content-exclusion denials, and execution-integrity failures.",
    "steps": [
      { "step": 1, "check": "approval.mode is 'auto_approve_within_parameters' or 'standing_offer'; if 'standing_offer', now() <= approval.standing_offer.valid_until and executions used < max_total_executions.", "on_fail": "route_manual" },
      { "step": 2, "check": "Fail-closed scan per INV-004: booking-match custom exclusions (or deliverable-review customs without retained output review); union coverage; exclusivity.mode != 'none'; named competitor blocks; NAICS competitor blocks unless params.naics_competitor_blocks_permitted is true AND the INV-016 block-ledger check passes (ledger over executed+active states plus live holdback windows); embedded-products post-term survival; self-hosted generation; interactive_persona; persistent use; revenue_share components; missing /content_declaration; unrecognized fields; raw reference release or fine-tuning without the params.reference_release_permitted opt-in covering every released asset class (INV-004(m)). Verify INV-029 standing-terms byte-equality (talent-fixed blocks equal the licensor_terms_ref document).", "on_fail": "route_manual" },
      { "step": 3, "check": "parties.licensee.verification_tier >= params.min_licensee_verification_tier (tier enum is lexicographically ordered by design).", "on_fail": "route_manual" },
      { "step": 4, "check": "parties.licensee.licensee_id is NOT in params.licensee_blocklist. A blocklist hit is a terminal denial — a blocked buyer gets no human retry channel.", "on_fail": "reject" },
      { "step": 5, "check": "If params.licensee_allowlist is present: licensee_id is in it. An allowlist miss is NOT a denial — the buyer simply is not pre-authorized for machine execution and retains the manual/human review channel.", "on_fail": "route_manual" },
      { "step": 6, "check": "grant.use_categories is a subset of params.allowed_use_categories.", "on_fail": "route_manual" },
      { "step": 7, "check": "content_declaration.declared_codes ∩ (grant.content_exclusions.excluded_codes \\ affirmative_permissions) is empty (INV-017/INV-026). A non-empty intersection is a DENY — the licensor has excluded this content; there is nothing for a human to reconsider.", "on_fail": "reject" },
      { "step": 8, "check": "If params.allowed_media_types present: grant.media_types is a subset of it. If params.allowed_channels present: grant.channels is a subset of it. If params.allowed_languages present: every grant.languages entry matches an entry in it under RFC 4647 basic filtering at subtag boundaries (granted 'en' is covered by allowed 'en'; requested 'en-US' is covered by granted/allowed 'en'; 'es' never covers 'est'). If params.allowed_distribution_platform_ids present: grant.distribution_platforms is present with mode 'listed_only' and its platform_ids are a subset.", "on_fail": "route_manual" },
      { "step": 9, "check": "Territory subset per INV-009 against the pinned registry snapshot (INV-036): grant.territory within params.allowed_territory.", "on_fail": "route_manual" },
      { "step": 10, "check": "((grant.term.end_date + 1 day) - grant.term.start_date) <= params.max_term_duration AND the INV-001/INV-002 statutory caps hold (INV-001 anchored at the earliest of consent capture, execution, and start_date; end_date inclusive).", "on_fail": "route_manual" },
      { "step": 11, "check": "If grant.output_caps.mode == 'uncapped': params.max_outputs, params.max_impressions, and params.max_interactive_sessions must all be absent. Else, for EACH of (max_outputs, max_impressions, max_interactive_sessions): where the param ceiling is present, the requested cap ceiling MUST be present AND <= the param — a request that is 'capped' but omits a ceiling the envelope bounds is indeterminate and routes to manual (never a vacuous pass).", "on_fail": "route_manual" },
      { "step": 12, "check": "Every requested platform/model pair is in grant.platform_allowlist.platforms and, if params.allowed_platform_ids present, every platform_id is in it (INV-008).", "on_fail": "route_manual" },
      { "step": 13, "check": "Every fee component's model is in params.allowed_fee_structures (revenue_share is not expressible there — never auto-approved in v0.1; 'exclusivity_premium' is auto-approvable only as the priced consideration for auto-granted NAICS competitor blocks per INV-016(2)). Currency equality per INV-003; computed guaranteed total per INV-033 (with INV-032 rounding) satisfies params.min_total_fee <= fee <= params.max_total_fee and equals pricing.total_guaranteed_fee.", "on_fail": "route_manual" },
      { "step": 14, "check": "params.rate_limit: auto-executions for this licensor in the trailing period < max_executions (circuit breaker against runaway agents).", "on_fail": "route_manual" },
      { "step": 15, "check": "If fee > approval.human_confirmation_threshold (or > parties.licensee.agent_delegation.human_confirmation_required_above), require licensee-side human confirmation (agentic-payments human-in-the-loop) before step 16 and record it in execution.human_confirmation (INV-035); the licensor side remains auto.", "on_fail": "route_manual" },
      { "step": 16, "check": "All passed: atomically and SERIALIZED per licensor — capture payment to escrow, re-run and commit the INV-016 block-ledger check transactionally (check and write in one serialized commit), verify INV-007 grant hash and INV-029 terms equality, transition quoted->executed under /integration/execution_idempotency_key (INV-010), emit license.executed. If params.deliverable_review_retained is true, deliverables still require licensor sign-off per approval.deliverable_approval before release.", "on_fail": "reject" }
    ]
  },
  "required": [
    "schema_version",
    "license_id",
    "license_version",
    "status",
    "lifecycle",
    "audit",
    "parties",
    "grant",
    "approval",
    "pricing",
    "usage_reporting",
    "union_rider",
    "asset_handling",
    "revocation",
    "provenance",
    "warranties"
  ],
  "properties": {
    "schema_version": {
      "const": "0.1.2",
      "description": "Version of the Likeness License schema this document conforms to. Semver; pre-publication 0.1.x drafts revise in place (0.1.1 closed the three pressure-test gap reports; 0.1.2 applied the legal and implementability adversarial reviews); from first public release, breaking changes bump minor while pre-1.0. Evaluators MUST refuse documents whose schema_version they do not implement (fail closed)."
    },
    "license_id": {
      "type": "string",
      "pattern": "^lic_[0-9A-HJKMNP-TV-Z]{26}$",
      "description": "Globally unique, immutable license identifier: 'lic_' + Crockford-base32 ULID. Stable across versions of this license; the delivered-asset watermark and the public certificate are keyed to this value."
    },
    "license_version": {
      "type": "integer",
      "minimum": 1,
      "description": "Monotonically increasing version of THIS license's terms. Any amendment to /grant, /pricing, or /revocation increments it and requires a fresh consent record (INV-007) — with ONE express exemption: /pricing/escrow/state is operational, platform-managed payment state (unfunded -> funded -> ... transitions), not a negotiated term; escrow-state transitions never increment license_version and never require re-consent (they are recorded via audit.updated_at). Prior versions are retained immutably as the evidentiary record."
    },
    "amends_license_id": {
      "type": "string",
      "pattern": "^lic_[0-9A-HJKMNP-TV-Z]{26}$",
      "description": "Optional pointer to a prior license this one renews or supersedes. Renewals are new documents, never in-place term extension — this keeps the state machine deterministic and re-checks the NO FAKES 10-year human cap per renewal (INV-021)."
    },
    "status": {
      "$ref": "#/$defs/status",
      "description": "Current lifecycle state. MUST equal the 'to' state of the last entry in /lifecycle/status_history (INV-011). Legal transitions are defined exclusively in x-state-machine."
    },
    "lifecycle": {
      "type": "object",
      "additionalProperties": false,
      "required": ["status_history"],
      "description": "Append-only record of every status transition, forming the auditable authorization history that courts, unions, and NO FAKES-style takedown regimes reward.",
      "properties": {
        "status_history": {
          "type": "array",
          "minItems": 0,
          "description": "Ordered list of applied transitions (oldest first). Empty only while status == 'draft'. Each entry corresponds to exactly one x-state-machine transition and one emitted webhook event.",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["from", "to", "occurred_at", "trigger", "actor"],
            "description": "One applied status transition.",
            "properties": {
              "from": { "$ref": "#/$defs/status", "description": "State before the transition; must match the previous entry's 'to' (or 'draft' for the first entry)." },
              "to": { "$ref": "#/$defs/status", "description": "State after the transition." },
              "occurred_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp (ISO 8601 date-time) at which the transition was committed." },
              "trigger": { "type": "string", "description": "Trigger name; MUST be one of the trigger values in x-state-machine for this (from, to) pair." },
              "actor": {
                "type": "object",
                "additionalProperties": false,
                "required": ["type", "id"],
                "description": "Who caused the transition — critical for disputes and for distinguishing agentic from human actions (e.g. whether a human ever approved).",
                "properties": {
                  "type": { "enum": ["licensor", "licensor_agent", "licensee", "licensee_agent", "platform", "system"], "description": "Actor class. 'licensor_agent' marks the talent's agent of record; 'licensee_agent' marks an AI agent acting under delegation (see parties.licensee.agent_delegation); 'system' marks clock-driven transitions. NORMATIVE for auto-executed transitions (booking_auto_executed): the actor is the INITIATOR of the request — 'licensee_agent' for MCP/agent-initiated executions, 'licensee' for web/API-initiated ones; the licensor side needs no actor entry because their authorization is the pre-signed advance instrument (INV-023). 'system' is reserved for platform-initiated transitions (clock events, escrow activation)." },
                  "id": { "type": "string", "minLength": 1, "description": "Stable identifier of the actor (talent id, licensee id, agent id, or 'semblance')." }
                }
              },
              "reason": { "type": "string", "description": "Optional human-readable reason (decline rationale, revocation grounds cited, breach description). Free text; never used for machine matching. Expected in practice for revoked/terminated/declined transitions." },
              "webhook_event_id": { "type": "string", "pattern": "^evt_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Identifier of the webhook event emitted for this transition; consumers deduplicate at-least-once delivery on this value." }
            }
          }
        }
      }
    },
    "integration": {
      "type": "object",
      "additionalProperties": false,
      "description": "Machine-to-machine bookkeeping linking this license to the API/MCP transaction that created it, plus webhook fan-out configuration. Required (with quote_id) once status reaches 'quoted' (see root allOf).",
      "properties": {
        "booking_idempotency_key": { "type": "string", "minLength": 8, "maxLength": 128, "description": "Caller-supplied idempotency key for the create_booking call. Scoped to (licensee_id, 'create_booking') — never global; retries with the same key return this same record without side effects (INV-010, which also fixes the retention window). Distinct from execution_idempotency_key so a retried execution is never confused with the booking that preceded it." },
        "execution_idempotency_key": { "type": "string", "minLength": 8, "maxLength": 128, "description": "Caller-supplied idempotency key for the execute_license call. Scoped to (licensee_id, 'execute_license'); retries with the same key MUST return this same record and MUST NOT re-capture payment or re-emit webhooks (INV-010). Required once the license is executed." },
        "quote_id": { "type": "string", "pattern": "^quo_[0-9A-HJKMNP-TV-Z]{26}$", "description": "The quote (request_quote result) whose priced terms this license was executed from. Quotes are immutable snapshots with a TTL (see quote_expires_at)." },
        "quote_expires_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC expiry instant of the quote identified by quote_id — the TTL made machine-decidable in this document: create_booking/execute_license after this instant against this quote MUST be refused as 'quote expired' (the quoted -> cancelled transition on trigger quote_expired_or_withdrawn). The full quote schema is a v0.2 deliverable; this field is the minimal in-document expiry an evaluator needs now." },
        "reference_registry_snapshot": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$", "description": "Date version (YYYY-MM-DD) of the published Semblance Reference Registry snapshot this document is evaluated against: the ISO 3166-1 country set, EU/EEA membership list, ISO 4217 minor-unit exponents, and NAICS 2022 tables (INV-036). Pinning the tables keeps territory expansion and money math identical across independent implementations." },
        "booking_id": { "type": "string", "pattern": "^bkg_[0-9A-HJKMNP-TV-Z]{26}$", "description": "The booking (create_booking result) that carried this license through approval." },
        "webhook_subscriptions": {
          "type": "array",
          "uniqueItems": true,
          "description": "Endpoints subscribed to this license's lifecycle events (talent apps, licensee agents, platform integrations). Event names are exactly the 'emits' values in x-state-machine plus 'license.usage_report_due' and 'license.cap_threshold_reached'.",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["endpoint_url", "events"],
            "description": "One webhook subscription.",
            "properties": {
              "endpoint_url": { "type": "string", "format": "uri", "description": "HTTPS endpoint receiving signed event payloads." },
              "events": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["license.quoted", "license.pending_approval", "license.executed", "license.activated", "license.expired", "license.revoked", "license.terminated", "license.declined", "license.cancelled", "license.usage_report_due", "license.cap_threshold_reached"], "description": "Subscribed event name from the closed event set." }, "description": "Closed set of event names this endpoint receives." },
              "signing_secret_ref": { "type": "string", "description": "Reference (never the secret itself) to the HMAC secret used to sign deliveries to this endpoint." }
            }
          }
        }
      }
    },
    "audit": {
      "type": "object",
      "additionalProperties": false,
      "required": ["created_at", "updated_at"],
      "description": "Record-keeping metadata for the license document itself.",
      "properties": {
        "created_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp this license document (this license_version) was created (status 'draft')." },
        "updated_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the last mutation to platform-managed fields (status, lifecycle, execution, escrow state). Grant/pricing/revocation are immutable per version." },
        "created_by_actor": { "type": "string", "description": "Identifier of the actor (user, agent, or system process) that created this document version." }
      }
    },
    "parties": {
      "type": "object",
      "additionalProperties": false,
      "required": ["licensor", "licensee"],
      "description": "The two parties to the license plus their representation. Semblance is the verifying registry, broker of record, and escrow agent — not a party to the grant.",
      "properties": {
        "licensor": { "$ref": "#/$defs/licensor", "description": "The rights holder granting the license: a verified living human, an estate acting under a post-mortem right-of-publicity regime, or the verified owner of a fictional character." },
        "licensee": { "$ref": "#/$defs/licensee", "description": "The verified party acquiring usage rights, or the principal on whose behalf an AI agent transacts." }
      }
    },
    "consent": {
      "$ref": "#/$defs/consent",
      "description": "The structured consent instrument backing this license, cryptographically bound to the exact /grant terms. Required once status reaches 'executed' (execution-time block); a draft or quote may exist before consent is captured, but nothing executes without it."
    },
    "grant": {
      "type": "object",
      "additionalProperties": false,
      "required": ["use_categories", "media_types", "channels", "languages", "territory", "term", "use_persistence", "exclusivity", "output_caps", "platform_allowlist", "ai_disclosure", "content_exclusions", "sublicensing_allowed"],
      "description": "The rights actually granted — the machine-matched core of the license and the exact object hashed into consent.grant_hash (INV-007); immutable once executed. Everything not expressly granted here is reserved to the licensor (talent-protective default construction). Every dimension has a mirror in auto_approval_parameters so evaluation is dimension-wise subset/threshold checks.",
      "properties": {
        "use_categories": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/use_category" },
          "description": "Licensed use categories (closed 7-value taxonomy — the primary matching dimension). A request outside these categories can never match. 'interactive_persona' triggers the strictest gating (manual approval, tier-3+ licensee, revenue-share pricing, persistent classification)."
        },
        "media_types": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/media_type" },
          "description": "Closed list of output media modalities the likeness may be generated into. Voice and visual likeness are separately enumerable because statutes (and the NO FAKES draft) treat them as distinct rights; 'music' (singing) is separately consented from 'audio_voice' (speech) — different union and moral-rights posture. Each additional modality is an affirmative grant, never bundled silently. NORMATIVE PAIRING RULE: any output in which the likeness SPEAKS with a synthesized voice requires 'audio_voice' in addition to the visual modality — a talking spokesperson video is ['video','audio_voice']; 'video' alone grants silent or third-party-voiced visuals only."
        },
        "channels": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "$ref": "#/$defs/channel" },
          "description": "Closed list of distribution channels where outputs may appear. There is deliberately NO 'all channels' value — every channel must be enumerated (AB 2602 specificity by construction). Paid social is distinct from organic because ad-platform provenance policies and union rates differ. Channel boundary definitions are normative in the $defs.channel description."
        },
        "languages": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "type": "string", "pattern": "^[a-z]{2,3}(-[a-zA-Z0-9]{2,8})*$", "description": "One BCP 47 language tag, primary subtag REQUIRED lowercase-canonical ('en', 'en-US'; 'EN' is schema-invalid so case never defeats string matching)." },
          "description": "Languages the likeness may be made to perform in — a GRANT dimension, not a delivery detail (localized voice in a new language is a new rights question; see SPEC). MATCHING, normative: RFC 4647 basic filtering at hyphen-delimited subtag boundaries — a grant of 'en' covers 'en' and 'en-US'; a grant of 'en-US' covers only en-US; 'es' NEVER covers 'est' and 'zh' never covers 'zho' (naive string-prefix matching is non-conformant). Tags compare case-insensitively after canonicalization; the schema forces lowercase primary subtags. An output in a language not covered here is outside the grant. Mirrored by auto_approval_parameters.allowed_languages; deliverables.spec.languages must be within this set (INV-019)."
        },
        "territory": { "$ref": "#/$defs/territory", "description": "Where outputs may be distributed, as explicit ISO 3166-1 country sets. Evaluated by set expansion per INV-009. Territory drives jurisdiction-specific obligations (e.g. EU AI Act labeling, INV-018)." },
        "distribution_platforms": {
          "type": "object",
          "additionalProperties": false,
          "required": ["mode"],
          "description": "Optional hard allowlist of DISTRIBUTION platforms (where outputs may be published), distinct from platform_allowlist (where outputs may be GENERATED). 'Meta, TikTok, and YouTube only' is a machine term here, not contract prose. Absent = any platform within the granted channels. Mirrored by auto_approval_parameters.allowed_distribution_platform_ids.",
          "properties": {
            "mode": { "enum": ["any_platform_within_channels", "listed_only"], "description": "'any_platform_within_channels' states the default explicitly; 'listed_only' restricts publication to the enumerated distribution platforms (publication elsewhere is use_outside_granted_scope, a for-cause ground)." },
            "platform_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$", "description": "Stable reverse-DNS-style distribution-platform identifier from the Semblance Distribution Registry (e.g. 'meta.instagram', 'tiktok.feed', 'google.youtube')." }, "description": "Exact distribution-platform allowlist. Required when mode == 'listed_only'." }
          },
          "allOf": [
            { "if": { "properties": { "mode": { "const": "listed_only" } }, "required": ["mode"] }, "then": { "required": ["platform_ids"] } }
          ]
        },
        "term": {
          "type": "object",
          "additionalProperties": false,
          "required": ["start_date", "end_date", "auto_renew"],
          "description": "License term as explicit calendar dates — no open-ended or perpetual terms exist in v0.1, so 'active -> expired' is a deterministic clock transition. Living humans capped at 10 years (INV-001, NO FAKES draft); estates bounded by the post-mortem window (INV-002); characters uncapped but still date-bounded. Long relationships are built from renewals/options (pricing.options), each a new, freshly consented document.",
          "properties": {
            "start_date": { "type": "string", "format": "date", "description": "First day (UTC, ISO 8601 date) outputs may be PUBLISHED/DISTRIBUTED. Never earlier than execution; may postdate it (e.g. campaign flight start) — but the STATUTORY term caps do not run from this date: INV-001 anchors at the earliest of consent capture, execution, and start_date, so postdating the flight never extends a living person's encumbrance past the cap. Whether GENERATION may begin between execution and start_date is the explicit generation_may_precede_start election — start-date semantics are never inferred." },
            "end_date": { "type": "string", "format": "date", "description": "Last day (UTC, INCLUSIVE — exercisable through end-of-day 23:59:59Z) the license is exercisable. MUST be >= start_date. Term-length math is therefore date-inclusive: the licensed span is ((end_date + 1 day) - anchor), checked against statutory caps (INV-001/002, anchored at the earliest of consent capture / execution / start_date) and against auto-approval max_term_duration (anchored at start_date). A start 2026-07-01 grant capped at P10Y must end by 2036-06-30 — 2036-07-01 is 10 years + 1 day and fails." },
            "auto_renew": { "const": false, "description": "Fixed false in v0.1: renewal is always a new license document (new consent, new hash, new statutory-cap check) referencing this one via amends_license_id. Auto-renewal of a living human's likeness license is inexpressible by design." },
            "generation_may_precede_start": { "type": "boolean", "default": false, "description": "Whether licensed generation (and pre-flight delivery for review) may occur between execution and start_date. True is the standard ad-deal shape (ads are generated before the flight); distribution before start_date remains a breach either way. Default false: generation begins at start_date." },
            "delivered_outputs_survival": { "enum": ["expires_with_term", "embedded_products_survive"], "default": "expires_with_term", "description": "What happens at term EXPIRY to outputs already generated, delivered, and embedded in products distributed to end users during the term (the delivered-vs-new-generation split at expiry, mirroring /revocation's split at revocation). 'expires_with_term': all use ends at end_date plus any post_term_runoff_days. 'embedded_products_survive': copies embedded in products distributed during the term (shipped game builds, published works) remain licensed for continued distribution in the original scope indefinitely — new generation, new SKUs, and new marketing placements still cease at end_date (INV-024; verify_license reports surviving content as licensed, not infringing). The survival election is a major grant: it always routes to manual approval (INV-004(f)) and does not extend the INV-001/002 generation-term caps." },
            "post_term_runoff_days": { "type": "integer", "minimum": 0, "maximum": 180, "description": "Sell-off/runoff window: days after end_date during which already-published outputs may remain in market (no new placements, no new generations). Standard ad-deal mechanic; 0 or absent means hard stop. Redundant when delivered_outputs_survival == 'embedded_products_survive'." },
            "persistent_service_wind_down_days": { "type": "integer", "minimum": 0, "maximum": 90, "description": "For persistent uses (interactive personas, always-on avatars): days allowed after term end to decommission the service and notify end users. Distinct from runoff — the service must be actively wound down." }
          }
        },
        "use_persistence": {
          "enum": ["one_time_outputs", "persistent_synthetic_performance"],
          "description": "The single most consequential structural split in likeness deals. 'one_time_outputs': a bounded set of deliverables generated, approved, delivered, published (ads, film scenes, game lines). 'persistent_synthetic_performance': the likeness runs as an ongoing service (interactive persona, always-on avatar, dynamic ad generation) — requires ongoing economics (revenue share or periodic fees), usage reporting, and wind-down terms. interactive_persona use forces this to persistent by root conditional; persistent classification always routes to manual approval (INV-004)."
        },
        "exclusivity": {
          "type": "object",
          "additionalProperties": false,
          "required": ["mode"],
          "description": "What the licensor gives up elsewhere. Two distinct instruments live here, with distinct machine semantics (INV-016): (1) EXCLUSIVITY MODES — any mode other than 'none' always routes to manual approval (INV-004(c)); (2) NAICS competitor_blocks — expressly VALID alongside mode 'none' ('non-exclusive with a competitor-category block', the standard ad-deal shape) and machine-grantable when the licensor pre-authorizes via auto_approval_parameters.naics_competitor_blocks_permitted, because the conflict check is deterministic prefix matching against the registry block ledger. Both are priced, never free — pair with an exclusivity_premium fee component. Conflicts are evaluated against the END brand (parties.licensee.brand / end_client_legal_name), not the booking agency.",
          "properties": {
            "mode": { "enum": ["none", "category_exclusive", "full_exclusive"], "description": "'none' = non-exclusive (platform default; talent keeps all other channels) — competitor_blocks MAY still apply and do not change the mode. 'category_exclusive' = licensor will not license to competitors in the listed categories during the term. 'full_exclusive' = licensor licenses to no one else in the licensed use categories/territory — rare, expensive, disfavored for living humans, and should be short." },
            "exclusive_use_categories": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/use_category" }, "description": "Use categories covered by the exclusivity. Required when mode == 'category_exclusive'." },
            "competitor_blocks": {
              "type": "array",
              "uniqueItems": true,
              "description": "Industry-level competitor blocks: during the term the licensor will not appear for other brands in these industries. Uses NAICS 2022 codes so conflict checks are deterministic code-prefix matches, not brand-name similarity. Valid under ANY mode, including 'none'. Auto-approvable only when auto_approval_parameters.naics_competitor_blocks_permitted is true and the INV-016 block-ledger check passes; otherwise routes to manual (INV-004(e)). Price the block via an exclusivity_premium component (or state its inclusion in a flat fee's 'covers').",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["industry_scheme", "industry_code"],
                "description": "One blocked industry.",
                "properties": {
                  "industry_scheme": { "const": "naics_2022", "description": "Industry classification scheme. Fixed to NAICS 2022 in v0.1 for deterministic prefix matching." },
                  "industry_code": { "type": "string", "pattern": "^[0-9]{2,6}$", "description": "NAICS 2022 code at 2-6 digit granularity; the block applies to any code sharing this prefix." },
                  "label": { "type": "string", "description": "Human-readable label for the contract (e.g. 'Soft drink manufacturing'). Display only, never matched." }
                }
              }
            },
            "named_competitor_blocks": {
              "type": "array",
              "uniqueItems": true,
              "items": { "type": "string", "minLength": 2, "description": "Legal or trading name of a blocked competitor brand." },
              "description": "Specific named brands the licensor may not work with during the term, layered on top of category blocks (brands insist on naming their top rivals explicitly). Free text — presence routes to manual approval (INV-004) and conflict checks against these names are human-reviewed."
            },
            "scope": {
              "type": "object",
              "additionalProperties": false,
              "description": "Limits on the exclusivity itself — exclusivity can be scoped narrower than the grant (e.g. exclusive in US paid social only) to keep price down.",
              "properties": {
                "territories": { "type": "array", "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Z]{2}$", "description": "ISO 3166-1 alpha-2 country code." }, "description": "Countries where exclusivity applies; omit to match the grant territory." },
                "use_categories": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/use_category" }, "description": "Use categories where exclusivity applies; omit to match the granted categories." },
                "channels": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/channel" }, "description": "Channels where exclusivity applies; omit to match the granted channels." }
              }
            },
            "holdback_days_post_term": { "type": "integer", "minimum": 0, "maximum": 365, "description": "Days after term end during which the licensor still may not sign competitors in the blocked categories. Holdbacks are compensated time — price them into the exclusivity premium." },
            "carve_outs": { "type": "array", "items": { "type": "string", "minLength": 3, "description": "One described carve-out." }, "description": "Pre-existing commitments of the licensor expressly excepted from the exclusivity (prior endorsements, agency deals, the licensor's own channels)." }
          },
          "allOf": [
            { "if": { "properties": { "mode": { "const": "category_exclusive" } }, "required": ["mode"] }, "then": { "required": ["exclusive_use_categories"] } }
          ]
        },
        "output_caps": {
          "type": "object",
          "additionalProperties": false,
          "required": ["mode"],
          "description": "Volume limits on generated outputs and their reach. Cap status is an explicit election — 'uncapped' must be stated, never inferred from silence, because it changes pricing and revocation exposure. Enforced against usage_reporting data; the 'license.cap_threshold_reached' webhook fires at 80% and 100%.",
          "properties": {
            "mode": { "enum": ["uncapped", "capped"], "description": "Explicit cap mode. If 'capped', at least one ceiling plus cap_scope, measurement_source, and overage are required." },
            "max_outputs": { "type": "integer", "minimum": 1, "description": "Maximum number of distinct generated deliverables (videos, images, audio files, renders) over the cap scope." },
            "max_impressions": { "type": "integer", "minimum": 1, "description": "Maximum cumulative impressions/views/listens across all outputs over the cap scope, as reported via usage reporting." },
            "max_interactive_sessions": { "type": "integer", "minimum": 1, "description": "For interactive personas: maximum end-user sessions over the cap scope." },
            "cap_scope": { "enum": ["total_term", "per_period"], "description": "Whether caps apply to the whole term or reset each period." },
            "period": { "$ref": "#/$defs/iso_duration", "description": "Reset period for per_period caps (e.g. 'P1M'). Required when cap_scope == 'per_period'." },
            "measurement_source": { "enum": ["platform_reported", "ad_platform_reported", "third_party_measurement", "licensee_attested", "semblance_watermark_index"], "description": "Authoritative source for cap measurement. 'semblance_watermark_index' means the platform's license-keyed fingerprint index is the tiebreaker in disputes; 'licensee_attested' requires audit rights (INV-020)." },
            "overage": {
              "type": "object",
              "additionalProperties": false,
              "required": ["policy"],
              "description": "What happens at the cap. Negotiating this up front is the difference between a renewal conversation and a breach claim — success gets a price instead of a fight.",
              "properties": {
                "policy": { "enum": ["hard_block", "bill_overage", "requires_new_approval"], "description": "'hard_block': the platform refuses further generation/delivery at the cap. 'bill_overage': usage continues at the stated overage rates. 'requires_new_approval': overage triggers a fresh approval request to the licensor at pre-agreed rates." },
                "overage_rate_per_output": { "$ref": "#/$defs/money", "description": "Fee per output beyond max_outputs (used with bill_overage / requires_new_approval)." },
                "overage_rate_per_1000_impressions": { "$ref": "#/$defs/money", "description": "Fee per 1,000 impressions beyond max_impressions (integer minor units; per-1000 basis avoids fractional cents)." }
              }
            }
          },
          "allOf": [
            { "if": { "properties": { "mode": { "const": "capped" } }, "required": ["mode"] }, "then": { "required": ["cap_scope", "measurement_source", "overage"], "anyOf": [ { "required": ["max_outputs"] }, { "required": ["max_impressions"] }, { "required": ["max_interactive_sessions"] } ] } },
            { "if": { "properties": { "cap_scope": { "const": "per_period" } }, "required": ["cap_scope"] }, "then": { "required": ["period"] } },
            { "$comment": "Billable overage on an output cap requires its pre-agreed rate — a bill_overage/requires_new_approval policy with no rate is undecidable at runtime.", "if": { "properties": { "overage": { "properties": { "policy": { "enum": ["bill_overage", "requires_new_approval"] } }, "required": ["policy"] } }, "required": ["max_outputs", "overage"] }, "then": { "properties": { "overage": { "required": ["overage_rate_per_output"] } } } },
            { "if": { "properties": { "overage": { "properties": { "policy": { "enum": ["bill_overage", "requires_new_approval"] } }, "required": ["policy"] } }, "required": ["max_impressions", "overage"] }, "then": { "properties": { "overage": { "required": ["overage_rate_per_1000_impressions"] } } } }
          ]
        },
        "platform_allowlist": {
          "type": "object",
          "additionalProperties": false,
          "required": ["platforms", "unlisted_platforms_prohibited", "self_hosted_generation_permitted"],
          "description": "Closed allowlist of generation platforms and models where the licensed assets may be used — how licenses stay portable but controlled (INV-008), and how revocation propagates (each listed platform receives cease signals keyed to license_id). Generation anywhere not listed is a material breach and a for-cause revocation ground.",
          "properties": {
            "platforms": {
              "type": "array",
              "minItems": 1,
              "uniqueItems": true,
              "description": "Approved generation platforms and, per platform, the approved model scope. Identifiers come from the published Semblance Platform Registry so matching is exact-string, never fuzzy.",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["platform_id", "model_scope"],
                "description": "One approved platform entry.",
                "properties": {
                  "platform_id": { "type": "string", "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$", "description": "Stable reverse-DNS-style platform identifier from the Semblance Platform Registry (e.g. 'openai.sora', 'heygen.studio', 'elevenlabs.speech')." },
                  "model_scope": { "enum": ["all_models", "listed_models"], "description": "'all_models' approves current and future production models on the platform (an explicit, disclosed election recorded in the consent narrative — never a wildcard default); 'listed_models' restricts to model_ids exactly. Wildcard strings like '*' are unrepresentable: scope is this enum, and model_ids entries must match the registry-id pattern." },
                  "model_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]*$", "description": "Registry model identifier (e.g. 'sora-2', 'veo-3')." }, "description": "Exact model allowlist. Required when model_scope == 'listed_models'." },
                  "model_version_policy": { "enum": ["pinned_versions_only", "successor_versions_allowed"], "description": "For listed_models scope: whether point-successor versions of a listed model (e.g. v3 -> v3.1) are covered ('successor_versions_allowed') or moving to any new version requires relicensing ('pinned_versions_only', the default reading when absent)." },
                  "api_enforced": { "type": "boolean", "description": "Whether this platform programmatically checks Semblance license certificates before generating (true = revocation is technically enforced, not merely contractual)." }
                },
                "allOf": [
                  { "if": { "properties": { "model_scope": { "const": "listed_models" } }, "required": ["model_scope"] }, "then": { "required": ["model_ids"] } }
                ]
              }
            },
            "unlisted_platforms_prohibited": { "const": true, "description": "Constant true: generation on any platform or model not enumerated above is prohibited. Non-negotiable structural term." },
            "self_hosted_generation_permitted": { "type": "boolean", "default": false, "description": "Whether the licensee may run generation on a licensee-operated (self-hosted) pipeline — e.g. a game studio's internal voice pipeline fine-tuned on released reference audio. Default and strong recommendation: false (self-hosting weakens platform-side certificate checks and revocation propagation). When true: the pipeline MUST itself be registered in the Semblance Platform Registry and enumerated in platforms[] above (typically api_enforced false) so allowlist, revocation, and destruction semantics attach to it; usage reporting with output_hashes becomes mandatory (INV-025); and the license always routes to manual approval (INV-004(g)). A platforms[] entry for a registered self-hosted pipeline is the CORRECT encoding — not a fudge — but only in combination with this flag being true." }
          }
        },
        "ai_disclosure": {
          "type": "object",
          "additionalProperties": false,
          "required": ["required", "methods"],
          "description": "Mandatory AI-disclosure obligations attached to every output. Non-waivable platform floor (aligned with platform norms, FTC endorsement guidance, and EU AI Act Article 50): outputs must be identifiable as AI-generated licensed media.",
          "properties": {
            "required": { "const": true, "description": "Constant true: AI disclosure is never waivable under this schema." },
            "methods": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["c2pa_manifest", "visible_label", "audible_disclosure", "caption_or_description_text", "platform_native_disclosure_tag", "in_product_ai_notice"], "description": "One required disclosure mechanism." }, "description": "Required disclosure mechanisms; 'c2pa_manifest' is effectively always present because provenance requires it. At least one human-perceptible method should accompany it for consumer-facing channels; methods stack (e.g. visible label for paid social)." },
            "label_text": { "type": "string", "maxLength": 300, "description": "Exact required disclosure wording when the licensor or a jurisdiction mandates specific text (e.g. 'This video features an AI-generated performance licensed from <display_name>'). Display obligation, not a matching field." },
            "placement_requirements": { "type": "string", "description": "Free-text specification of where/how disclosures must appear (e.g. 'label legible for full duration on video under 15s'), generated into the human-readable contract." },
            "eu_ai_act_art50_labeling": { "type": "boolean", "description": "Whether EU AI Act Article 50 transparency labeling is required for this license's deliveries. MUST be true whenever the territory includes any EU/EEA member state or is worldwide (worldwide case enforced by root conditional; country-level detection per INV-018)." },
            "persona_session_disclosure": { "type": "string", "description": "For interactive personas: the disclosure end users must see/hear at session start (e.g. 'You are chatting with an AI character licensed from ...'). Session-start disclosure itself is separately const-required in interactive_persona_terms." }
          }
        },
        "content_exclusions": {
          "type": "object",
          "additionalProperties": false,
          "required": ["baseline_version", "baseline_prohibited_uses", "excluded_codes"],
          "description": "What the licensee may never do with the likeness. Composed of (1) the platform-wide non-waivable baseline, embedded as a constant so every executed license carries verbatim the full text it agreed to, and (2) talent-set exclusions layered on top. Talent red lines override everything else: no approval mode, price, or exclusivity can authorize excluded content.",
          "properties": {
            "baseline_version": { "const": "0.1.0", "description": "Version of the Semblance prohibited-use baseline incorporated by reference and reproduced below." },
            "baseline_prohibited_uses": {
              "const": [
                "sexually_explicit_or_intimate_depiction",
                "non_consensual_intimate_imagery",
                "any_sexualization_or_depiction_of_minors",
                "political_advertising_or_electoral_deception",
                "news_journalism_or_documentary_simulation",
                "medical_professional_impersonation_or_advice",
                "financial_professional_impersonation_or_advice",
                "fraud_scam_or_phishing_content",
                "hate_speech_harassment_or_defamation",
                "depiction_of_criminal_conduct_by_the_likeness",
                "biometric_spoofing_or_identity_authentication_bypass",
                "undisclosed_synthetic_media",
                "training_of_general_purpose_models_on_reference_data"
              ],
              "description": "Non-waivable prohibited uses, aligned with the TAKE IT DOWN Act, NO FAKES exclusions, and platform norms. Declared as a constant array: an instance omitting or altering any entry is schema-invalid, so the baseline literally cannot be negotiated away. Evaluators never treat these as per-license options — absence is never permission."
            },
            "excluded_codes": {
              "type": "array",
              "uniqueItems": true,
              "items": { "$ref": "#/$defs/content_code", "description": "One exclusion code from the closed taxonomy ($defs.content_code — single source of truth since 0.1.2, so a future code addition cannot desynchronize the three matching surfaces)." },
              "description": "Machine-matched talent exclusions beyond the baseline. Licensees declare their content against the same taxonomy at request time via /content_declaration; a non-empty intersection with (excluded_codes minus affirmative_permissions) denies the request (INV-017). Empty array is a valid, explicit election of 'no additional exclusions' — the field is always required so silence is impossible."
            },
            "affirmative_permissions": {
              "type": "array",
              "uniqueItems": true,
              "items": { "$ref": "#/$defs/content_code", "description": "One expressly permitted taxonomy code ($defs.content_code)." },
              "description": "Taxonomy codes the licensor EXPRESSLY permits (e.g. 'energy drinks explicitly welcome'). Machine effect (INV-017): a declared code listed here never denies, resolving category-mapping ambiguity in the licensee's favor for exactly these codes. MUST be disjoint from excluded_codes. This makes affirmative permission a recordable term instead of mere absence-of-exclusion. Baseline prohibited uses can never be permitted by this field."
            },
            "custom_exclusions": {
              "type": "array",
              "uniqueItems": true,
              "description": "Licensor-authored exclusions that have no closed code yet (e.g. 'no depiction of me driving', 'character never breaks the fourth wall'). Each entry ELECTS its enforcement surface: 'booking_match' customs are booking-scope terms free text cannot machine-match, so their presence disables auto-approval (fail closed, INV-004(a)); 'deliverable_review' customs are enforced by human review of scripts/outputs (like prohibited_phrasings) and do NOT gate booking matching, provided deliverable_approval.required is true with 'generated_outputs' in scope. Recurring customs graduate into the closed taxonomy in later schema versions.",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["code", "description", "enforcement"],
                "description": "One custom exclusion.",
                "properties": {
                  "code": { "type": "string", "pattern": "^x-[a-z0-9][a-z0-9-]*$", "description": "Namespaced slug ('x-' prefix marks it as outside the closed taxonomy)." },
                  "description": { "type": "string", "minLength": 10, "maxLength": 500, "description": "Precise, enforceable statement of the exclusion for contracts and manual review. Minimum 10 characters so vague one-word customs cannot validate." },
                  "enforcement": { "enum": ["booking_match", "deliverable_review"], "description": "Where this exclusion is enforced. 'booking_match': it constrains WHICH deals may be booked — cannot be machine-evaluated, so it fail-closes auto-approval. 'deliverable_review': it constrains WHAT the pixels/audio may contain — enforced at mandatory human deliverable review, so it coexists with auto-approved bookings. Required: the licensor makes the routing consequence explicit." }
                }
              }
            },
            "endorsement_restrictions": {
              "type": "object",
              "additionalProperties": false,
              "description": "Controls on first-person endorsement — the difference between 'appears in the ad' and 'personally recommends the product' is a real price, consent, and FTC line.",
              "properties": {
                "first_person_endorsement_permitted": { "type": "boolean", "description": "Whether outputs may script the likeness personally endorsing the product ('I use X every day'). False allows appearance/performance without personal-testimonial framing." },
                "prohibited_phrasings": { "type": "array", "items": { "type": "string", "description": "One banned claim pattern." }, "description": "Specific claim patterns the talent bans (e.g. 'medical efficacy claims', 'guaranteed results', 'financial returns'). Free text — enforced at deliverable review, exactly like custom_exclusions with enforcement 'deliverable_review'; never a booking-match input and never a fail-close trigger." }
              }
            },
            "script_approval_required": { "type": "boolean", "description": "If true, all scripts/copy the likeness will speak require licensor approval before generation, regardless of approval.mode (folds into approval.deliverable_approval scope)." }
          }
        },
        "style_guide_refs": {
          "type": "array",
          "minItems": 1,
          "items": { "$ref": "#/$defs/evidence_ref" },
          "description": "Hash-fixed references to character bibles, style guides, or brand-safety documents whose terms the outputs MUST adhere to (design, palette, speech register, catchphrases, lore). Because this array lives inside /grant, the exact documents are bound into consent.grant_hash — 'consistent with Character Bible v3.2' becomes a machine-verifiable, hash-pinned term. Adherence is enforced at deliverable review (pair with deliverable_approval covering generated_outputs), so presence does NOT disable auto-approval — the schema-native encoding of character-bible adherence for agent-executed character deals."
        },
        "interactive_persona_terms": {
          "type": "object",
          "additionalProperties": false,
          "required": ["session_disclosure_required", "max_concurrent_deployments", "transcript_retention"],
          "description": "Extra constraints for persistent interactive personas/chatbots — the highest-risk category (always manual approval, tier-3+ licensees, revenue-share pricing; INV-006). Required whenever use_categories contains 'interactive_persona'.",
          "properties": {
            "session_disclosure_required": { "const": true, "description": "Constant true: every conversational session must disclose the persona is AI at session start. Non-waivable." },
            "max_concurrent_deployments": { "type": "integer", "minimum": 1, "description": "Maximum number of distinct products/surfaces the persona may be deployed in simultaneously." },
            "transcript_retention": { "enum": ["none", "aggregate_metrics_only", "full_with_licensor_access"], "description": "What conversation data the licensee may retain; 'full_with_licensor_access' gives the licensor audit access to transcripts." },
            "realtime_content_filter_required": { "type": "boolean", "default": true, "description": "Whether the deployment must run a runtime content filter enforcing content_exclusions during generation, not just at review time." }
          }
        },
        "credit": {
          "type": "object",
          "additionalProperties": false,
          "required": ["mode"],
          "description": "Attribution terms. Some talent require credit; others — notably VTuber operators and body doubles — require the opposite. mode governs the LICENSED IDENTITY's credit; performer_anonymity_required independently protects any embodied human performer, because character deals routinely need BOTH ('credit the character, never identify the performer').",
          "properties": {
            "mode": { "enum": ["credit_required", "credit_optional", "anonymity_required"], "description": "'credit_required': licensee must attribute the licensed identity per credit_text/placement. 'credit_optional': licensee may credit using approved text. 'anonymity_required': licensee must NOT identify the licensed identity's underlying person at all." },
            "performer_anonymity_required": { "type": "boolean", "description": "Orthogonal to mode: if true, the licensee must never identify, name, or depict the human performer embodied in the licensed character (character_provenance.embodied_human_performer), even while crediting the character itself. The standard VTuber shape is mode 'credit_required' + performer_anonymity_required true." },
            "credit_text": { "type": "string", "description": "Approved attribution string (e.g. 'Featuring the licensed digital likeness of <name>'). Required when mode == 'credit_required'." },
            "placement": { "type": "array", "uniqueItems": true, "items": { "enum": ["on_screen_end_card", "caption_description", "credits_roll", "metadata_only", "campaign_landing_page"], "description": "One approved/required credit placement." }, "description": "Where the credit must or may appear." }
          },
          "allOf": [
            { "if": { "properties": { "mode": { "const": "credit_required" } }, "required": ["mode"] }, "then": { "required": ["credit_text"] } }
          ]
        },
        "sublicensing_allowed": { "const": false, "description": "Fixed false in v0.1: rights are personal to the verified licensee; production partners must be named as the licensee or obtain their own license. Keeps the consent chain one hop long, machine-verifiable, and NO FAKES-defensible. Agency-to-end-client flow is NOT sublicensing — it is the parties.licensee.is_agency_of_record structure. Structured sublicense programs (fan content, creator whitelisting, localization) are the first v0.2 candidate." }
      },
      "allOf": [
        { "if": { "properties": { "use_categories": { "contains": { "const": "interactive_persona" } } }, "required": ["use_categories"] }, "then": { "required": ["interactive_persona_terms"], "properties": { "use_persistence": { "const": "persistent_synthetic_performance" } } } }
      ]
    },
    "campaign": {
      "type": "object",
      "additionalProperties": false,
      "description": "The specific production/campaign this license serves. Deliberately OUTSIDE /grant (and therefore outside consent.grant_hash) so that per-execution campaign metadata — essential for advance-consented auto-approval and standing offers, where the campaign is unknown when the licensor pre-signs — can be recorded without mutating the consented grant (INV-007/INV-023). The consented scope lives in consent.intended_use and the hashed /grant; this block is the execution-time record of what the license was actually used for, shown to the licensor at execution.",
      "properties": {
        "name": { "type": "string", "description": "Internal or public campaign/production title (e.g. 'Acme Sparkling Water — Summer 2026 social flight')." },
        "product_or_service": { "type": "string", "description": "The specific product or service the likeness promotes or is embedded in." },
        "synopsis": { "type": "string", "description": "Short description of the creative concept, sufficient for the licensor to understand what their likeness will do or say." }
      }
    },
    "content_declaration": {
      "type": "object",
      "additionalProperties": false,
      "required": ["declared_codes", "declared_at", "declarant"],
      "description": "The licensee's request-time declaration of the content categories the outputs will contain, against the SAME closed taxonomy as content_exclusions.excluded_codes — the input INV-017 exclusion matching runs on. Required for every auto/standing execution (INV-026); a false or incomplete declaration is a for-cause breach. Outside /grant: it is the licensee's warranty, not the licensor's grant.",
      "properties": {
        "declared_codes": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/content_code", "description": "One declared content code from the closed taxonomy ($defs.content_code)." }, "description": "Every taxonomy category the requested outputs will touch. An empty array is the explicit declaration that none apply. Declare the most specific applicable code; where a product genuinely fits no code, the platform's category mapping governs and ambiguity is declared (over-declaration is safe: affirmative_permissions un-denies expressly permitted codes). DERIVED CODES (INV-017): outputs scripting the likeness in first-person endorsement/testimonial framing MUST declare 'first_person_endorsement_phrasing' — evaluators auto-derive this code from spokesperson/endorsement campaign posture; omitting it there is an incomplete declaration and a for-cause breach." },
        "declared_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the declaration (at request/booking time)." },
        "declarant": { "enum": ["licensee", "licensee_agent"], "description": "Who made the declaration — the principal is bound either way (agent declarations bind under agent_delegation)." },
        "declaration_ref": { "$ref": "#/$defs/evidence_ref", "description": "Optional evidence reference to a fuller content brief backing the declaration." }
      }
    },
    "x_notes": {
      "type": "array",
      "items": { "type": "string" },
      "description": "Optional free-text annotations on the document (reviewer comments, migration notes). NEVER machine-matched, never part of any hash-bound object, no legal effect — the sanctioned annotation slot in an otherwise additionalProperties:false document."
    },
    "approval": {
      "type": "object",
      "additionalProperties": false,
      "required": ["mode"],
      "description": "How bookings against this licensor's terms get approved (the deal), and how generated deliverables get signed off (the pixels) — two distinct surfaces. Approval latency kills conversion, so SLAs and timeout behavior are explicit deal terms. Auto paths are governed by the machine-evaluable parameter envelope and x-auto-approval-algorithm; silence NEVER auto-approves.",
      "properties": {
        "mode": { "enum": ["manual", "auto_approve_within_parameters", "standing_offer"], "description": "'manual' = licensor (or agent-of-record role holder) approves each booking. 'auto_approve_within_parameters' = requests fully inside auto_approval_parameters execute without human review (actor 'system' in status_history). 'standing_offer' = a pre-priced, pre-consented published offer any qualifying verified licensee (including an AI agent) can execute instantly until it expires or its execution budget is spent." },
        "human_confirmation_threshold": { "$ref": "#/$defs/money", "description": "Licensor-set fee level above which even an in-parameters auto approval requires a licensee-side human confirmation step before payment capture (the human-in-the-loop pattern ACP/AP2/Visa TAP-class agentic payment protocols expect). Absent = no threshold." },
        "booking_approval_sla": {
          "type": "object",
          "additionalProperties": false,
          "required": ["respond_within_hours", "on_timeout"],
          "description": "Response-time commitment for manual approvals. Quotes are perishable; buyers need to know when silence means no.",
          "properties": {
            "respond_within_hours": { "type": "integer", "minimum": 1, "maximum": 720, "description": "Hours the licensor/agent has to approve, decline, or counter after a booking enters pending_approval." },
            "on_timeout": { "enum": ["auto_decline", "quote_expires", "escalate_to_agent_of_record"], "description": "What happens if the SLA lapses. There is deliberately no auto-approve option — consent must be affirmative; silence is never consent." }
          }
        },
        "auto_approval_parameters": {
          "type": "object",
          "additionalProperties": false,
          "required": ["allowed_use_categories", "allowed_territory", "max_term_duration", "max_total_fee", "min_licensee_verification_tier", "exclusivity_permitted"],
          "description": "The licensor's machine-evaluable envelope: a request auto-executes iff every granted dimension is a subset of / under the threshold of the corresponding parameter here (evaluation order in x-auto-approval-algorithm). Required when mode != 'manual'. Every field is a hard constraint, never a hint; optional dimensions omitted impose no extra constraint. The envelope can never expand scope beyond what the consent record describes, never grant exclusivity, and always honors content exclusions.",
          "properties": {
            "allowed_use_categories": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["advertising", "film_tv", "games", "social_ugc", "corporate_training", "music_audio"], "description": "One auto-approvable use category." }, "description": "Use categories eligible for auto-approval; requested use_categories must be a subset. 'interactive_persona' is deliberately absent from this enum: persistent persona uses are structurally impossible to auto-approve." },
            "allowed_media_types": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/media_type" }, "description": "If present, requested media_types must be a subset." },
            "allowed_channels": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/channel" }, "description": "If present, requested channels must be a subset." },
            "allowed_languages": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z]{2,3}(-[a-zA-Z0-9]{2,8})*$", "description": "One BCP 47 language tag, lowercase-canonical primary subtag." }, "description": "If present, every requested grant.languages entry must match an entry here under RFC 4647 basic filtering at subtag boundaries (allowed 'en' covers requested 'en-US'; 'es' never covers 'est')." },
            "allowed_distribution_platform_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$", "description": "One distribution-platform registry id." }, "description": "If present, the request must carry grant.distribution_platforms with mode 'listed_only' and platform_ids a subset of this list (an unrestricted distribution request against a restricted envelope routes to manual)." },
            "allowed_territory": { "$ref": "#/$defs/territory", "description": "Territory envelope; the requested territory's expanded country set must be a subset (INV-009)." },
            "max_term_duration": { "$ref": "#/$defs/iso_duration", "description": "Maximum term length auto-approvable (e.g. 'P6M'). Compared against the date-inclusive span ((end_date + 1 day) - start_date) in date space (algorithm step 10); statutory caps (INV-001/002, anchored at consent/execution) still apply on top and are always <= P10Y for living persons." },
            "max_total_fee": { "$ref": "#/$defs/money", "description": "Ceiling on the machine-computed total fee for auto approval — big deals deserve human eyes even when everything else fits. Currency must equal /pricing/currency (INV-003)." },
            "min_total_fee": { "$ref": "#/$defs/money", "description": "Floor: requests computing below this fee are not auto-approved (protects against underpriced agentic spam, not just overpriced risk). Absent = no floor." },
            "max_outputs": { "type": "integer", "minimum": 1, "description": "Maximum requestable output count for auto approval. When present, a 'capped' request MUST state its own max_outputs <= this value; omitting it routes to manual (algorithm step 11 — never a vacuous pass)." },
            "max_impressions": { "type": "integer", "minimum": 1, "description": "Maximum requestable impression cap for auto approval. Same absent-ceiling rule as max_outputs (step 11)." },
            "max_interactive_sessions": { "type": "integer", "minimum": 1, "description": "Envelope mirror of output_caps.max_interactive_sessions (step 11). NOTE: interactive_persona uses can never auto-approve (INV-004(h)/INV-006), so this ceiling only bounds session-metered caps on non-persona service deliverables; in practice it is rarely set and sessions effectively never auto-approve without it." },
            "allowed_platform_ids": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9]+(\\.[a-z0-9-]+)+$", "description": "One auto-approvable platform registry id." }, "description": "Generation platforms permitted under auto-approval; requests naming any other platform go to manual review." },
            "allowed_fee_structures": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["flat_fee", "per_output", "per_impression", "exclusivity_premium"], "description": "One permitted pricing component model." }, "description": "Which pricing structures can auto-approve. 'revenue_share' is deliberately absent: rev-share deals need human review of the revenue-base definition. 'exclusivity_premium' is meaningful only alongside naics_competitor_blocks_permitted (it prices auto-granted NAICS blocks; every other exclusivity shape routes to manual anyway). Absent field = the three machine-computable base structures allowed (flat_fee, per_output, per_impression)." },
            "exclusivity_permitted": { "const": false, "description": "Constant false: exclusivity MODES (category_exclusive / full_exclusive) can never be granted by a machine — they always require manual licensor approval (INV-016(1)). NAICS competitor blocks are governed separately by naics_competitor_blocks_permitted." },
            "naics_competitor_blocks_permitted": { "type": "boolean", "default": false, "description": "Whether requests carrying NAICS competitor_blocks (under exclusivity.mode 'none') may auto-execute. Machine-safe because the conflict check is deterministic (INV-016(2): prefix match against the registry block ledger and the licensor's other active end-brand NAICS codes); any indeterminacy still routes to manual. Default false — the licensor opts in to machine-granted category blocks." },
            "min_licensee_verification_tier": { "$ref": "#/$defs/verification_tier", "description": "Minimum verification tier a licensee must hold, compared lexicographically (the tier enum is ordered by construction). tier_0/tier_1 values here are legal but pointless; recommended floor is tier_2_id_verified — no identity, no automatic license." },
            "licensee_allowlist": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^lce_[0-9A-HJKMNP-TV-Z]{26}$", "description": "One licensee id." }, "description": "If present, ONLY these licensee ids may auto-execute (e.g. a standing offer to named repeat buyers)." },
            "licensee_blocklist": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^lce_[0-9A-HJKMNP-TV-Z]{26}$", "description": "One licensee id." }, "description": "Licensee ids that must never auto-execute against this profile; their requests are REJECTED outright, not routed to manual — a blocked buyer does not get a human retry channel." },
            "rate_limit": {
              "type": "object",
              "additionalProperties": false,
              "required": ["max_executions", "period"],
              "description": "Circuit breaker on auto-execution velocity, protecting talent from runaway agentic booking.",
              "properties": {
                "max_executions": { "type": "integer", "minimum": 1, "description": "Maximum auto-executed licenses within the trailing period." },
                "period": { "$ref": "#/$defs/iso_duration", "description": "Trailing window for the rate limit (e.g. 'P7D')." }
              }
            },
            "reference_release_permitted": { "type": "boolean", "default": false, "description": "Whether bookings that RELEASE raw reference material (asset_handling.raw_biometric_reference_released) or permit FINE-TUNING (derived_models.fine_tuning_permitted) may auto/standing-execute. Default false: releasing biometric-bearing reference data or authorizing model training is never an implicit side effect of machine execution — without this opt-in, any such request routes to manual (INV-004(m)). When true, reference_release_allowed_asset_classes is required and released_asset_classes must be a subset of it." },
            "reference_release_allowed_asset_classes": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["calibrated_face_capture_set", "voice_sample_set", "motion_capture_data", "trained_voice_model", "character_lora_or_checkpoint", "character_model_files"], "description": "One asset class the licensor pre-authorizes for machine-executed release." }, "description": "The exact asset classes releasable under auto/standing execution. asset_handling.released_asset_classes must be a subset or the request routes to manual (INV-004(m)). Required when reference_release_permitted is true." },
            "require_escrow": { "type": "boolean", "default": true, "description": "If true, only escrow-funded bookings can auto-approve." },
            "deliverable_review_retained": { "type": "boolean", "default": true, "description": "If true, auto-approval executes the license but the licensor still reviews generated outputs before release per deliverable_approval — approval of the deal, not the pixels. Recommended default true." }
          },
          "allOf": [
            { "if": { "properties": { "reference_release_permitted": { "const": true } }, "required": ["reference_release_permitted"] }, "then": { "required": ["reference_release_allowed_asset_classes"] } }
          ]
        },
        "standing_offer": {
          "type": "object",
          "additionalProperties": false,
          "required": ["offer_id", "published_at", "valid_until", "max_total_executions"],
          "description": "Pre-consented offer metadata. Required when mode == 'standing_offer'. The offer's terms are exactly this document's grant + pricing; agents execute it as-is with zero negotiation. The narrowest, most commoditized shape (e.g. 'social ad, 1 video, 3 months, US, $800').",
          "properties": {
            "offer_id": { "type": "string", "pattern": "^off_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Stable identifier of the published standing offer (discoverable via get_license_options)." },
            "published_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp the offer went live." },
            "valid_until": { "$ref": "#/$defs/utc_datetime", "description": "UTC expiry of the offer; executions after this instant are rejected and the licensor's advance consent lapses." },
            "max_total_executions": { "type": "integer", "minimum": 1, "description": "Total number of licenses that may be executed from this offer across all licensees; the execution counter is platform state, checked atomically at step 1 of the algorithm." }
          }
        },
        "deliverable_approval": {
          "type": "object",
          "additionalProperties": false,
          "description": "Sign-off on the actual generated content before the licensee may publish. Distinct from booking approval — this is where SAG-style creative approval lives, and where brand producers need predictable turnarounds.",
          "properties": {
            "required": { "type": "boolean", "description": "Whether licensor review of generated content is required before publication." },
            "scope": { "type": "array", "uniqueItems": true, "items": { "enum": ["scripts_copy", "prompts", "generated_outputs", "final_cut_media"], "description": "One artifact class requiring approval." }, "description": "Which artifacts the licensor reviews (scripts before generation, prompts, raw outputs, final edits)." },
            "rounds_included": { "type": "integer", "minimum": 1, "description": "Review/revision rounds included in the fee; additional rounds bill per pricing or trigger renegotiation." },
            "respond_within_hours_per_round": { "type": "integer", "minimum": 1, "maximum": 720, "description": "Licensor SLA per review round. Producers schedule media buys around this number." },
            "deemed_approved_on_timeout": { "type": "boolean", "default": false, "description": "Whether silence past the per-round SLA counts as approval. Default false (talent-protective). Brands may negotiate true for time-critical flights — the trade is explicit in the paper, never implicit." },
            "post_approval_edit_rules": { "enum": ["no_changes_after_approval", "cutdowns_and_reformat_allowed", "resize_reformat_only"], "description": "What the licensee may change after approval without re-approval (standard: cutdowns/aspect-ratio versions of an approved master are fine; new creative is not)." }
          }
        }
      },
      "allOf": [
        { "if": { "properties": { "mode": { "enum": ["auto_approve_within_parameters", "standing_offer"] } }, "required": ["mode"] }, "then": { "required": ["auto_approval_parameters"] } },
        { "if": { "properties": { "mode": { "const": "standing_offer" } }, "required": ["mode"] }, "then": { "required": ["standing_offer"] } }
      ]
    },
    "pricing": {
      "type": "object",
      "additionalProperties": false,
      "required": ["currency", "fee_components", "escrow"],
      "description": "The economics. Real deals are hybrids — a flat session fee plus per-output rates plus a rev-share with a minimum guarantee is one license, expressed as composable typed fee components in one currency. All money is integer minor units; all percentages are integer basis points; floats never appear in this schema.",
      "properties": {
        "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "ISO 4217 alphabetic currency code for every monetary amount in this license (single currency per license, INV-003; FX risk sits with the payer; no FX conversion happens inside license evaluation)." },
        "total_guaranteed_fee": { "$ref": "#/$defs/money", "description": "Sum of all guaranteed compensation (flat fees + option fees + committed metered minimums + minimum guarantees for the initial period + exclusivity premium). NOT free-standing: MUST equal the machine-computed guaranteed sum over fee_components (INV-033, rounding per INV-032). Used for take-rate calculation, human-confirmation thresholds, and kill-fee bases." },
        "platform_fee_bps": { "$ref": "#/$defs/basis_points", "description": "Semblance transaction take rate applied to this license, in basis points (e.g. 1500 = 15%), recorded for transparency to both parties." },
        "fee_components": {
          "type": "array",
          "minItems": 1,
          "description": "The deal's pricing building blocks, each a discriminated union on 'model'. Combine freely: flat_fee (session/buyout) + per_output (extra assets) + revenue_share with minimum_guarantee (persona) + exclusivity_premium. Total machine-computable fee = flat fees + committed per-output/per-impression minimums + exclusivity premium; revenue_share components are never auto-approvable in v0.1 (INV-004). Components present in this array are IN FORCE: a component negotiated as optional and taken at execution carries an 'election' marker; an option not taken simply does not appear (its offer terms live in the immutable quote).",
          "items": {
            "type": "object",
            "description": "One fee component; shape depends on 'model'.",
            "oneOf": [
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["model", "fee"],
                "description": "One-time fixed fee for a defined scope (session fee, campaign buyout).",
                "properties": {
                  "model": { "const": "flat_fee", "description": "Discriminator: a fixed fee." },
                  "fee": { "$ref": "#/$defs/money", "description": "The fixed amount, captured to escrow at execution (or per payment_schedule milestones)." },
                  "covers": { "type": "string", "description": "Plain-language statement of what this fee buys (e.g. 'up to 5 videos, 12-month US paid-social term') — prevents scope disputes; carried into the contract." },
                  "election": { "$ref": "#/$defs/fee_election" }
                }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["model", "rate_per_unit", "unit"],
                "description": "Metered fee per generated output — pay-per-video/image/voice-line economics, portable across platforms.",
                "properties": {
                  "model": { "const": "per_output", "description": "Discriminator: priced per generated output unit." },
                  "rate_per_unit": { "$ref": "#/$defs/money", "description": "Fee per metered unit." },
                  "unit": { "enum": ["video_asset", "image_asset", "audio_minute", "voice_line", "render", "stream_hour", "interactive_session"], "description": "The metered unit." },
                  "committed_units": { "type": "integer", "minimum": 1, "description": "Units pre-purchased at execution (committed_units x rate is escrowed up front and counts toward the machine-computed total fee). MUST be <= output_caps.max_outputs when capped (INV-027). Units beyond the committed block but WITHIN the cap bill at rate_per_unit per 'billing'; units beyond the cap are governed exclusively by output_caps.overage — commitment (prepayment) and cap (ceiling) are distinct numbers." },
                  "billing": { "enum": ["prepaid_blocks", "monthly_arrears"], "description": "How metered charges beyond the committed block but within the output cap are invoiced (over-cap usage is output_caps.overage territory, not billing)." },
                  "election": { "$ref": "#/$defs/fee_election" }
                }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["model", "rate_per_1000_impressions", "measurement_source"],
                "description": "Media-style pricing per thousand impressions (CPM), settled against usage reports. Whose numbers govern is the fight, not the CPM — measurement_source is therefore required.",
                "properties": {
                  "model": { "const": "per_impression", "description": "Discriminator: priced per impression (CPM)." },
                  "rate_per_1000_impressions": { "$ref": "#/$defs/money", "description": "Fee per 1,000 measured impressions, in integer minor units (per-1000 basis avoids fractional-cent arithmetic)." },
                  "measurement_source": { "enum": ["ad_platform_reported", "third_party_measurement", "licensee_attested"], "description": "Whose numbers govern settlement. 'licensee_attested' requires usage_reporting.audit.rights_granted == true (INV-020) and is discouraged above small deal sizes." },
                  "committed_impressions": { "type": "integer", "minimum": 1000, "multipleOf": 1000, "description": "Impressions pre-purchased at execution (must be a multiple of 1000); counts toward the machine-computed total fee. MUST be <= output_caps.max_impressions when capped (INV-027)." },
                  "billing": { "enum": ["monthly_arrears", "quarterly_arrears"], "description": "Invoicing cadence for impression charges beyond the committed block but within the impression cap (over-cap usage is output_caps.overage territory)." },
                  "election": { "$ref": "#/$defs/fee_election" }
                }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["model", "share_basis_points", "basis", "basis_definition", "payout_cadence"],
                "description": "Ongoing revenue share — the right structure for persistent uses (interactive personas, catalog integrations) where value accrues over time. Requires usage reporting of revenue (INV-005); never auto-approved in v0.1.",
                "properties": {
                  "model": { "const": "revenue_share", "description": "Discriminator: percentage of a defined revenue base." },
                  "share_basis_points": { "type": "integer", "minimum": 1, "maximum": 10000, "description": "Licensor's share in integer basis points (100 bps = 1%) — deterministic settlement math, no float percentages." },
                  "basis": { "enum": ["gross_revenue_attributable", "net_revenue_defined_costs", "subscription_revenue_allocated"], "description": "The revenue-base class the share applies to." },
                  "basis_definition": { "type": "string", "minLength": 20, "description": "Plain-language contractual definition of the revenue base, deductible costs, and attribution method (e.g. 'gross end-user payments to the persona product, less refunds and app-store fees'). Always required — 'net' without a cost definition is how talent gets zero; the undefined-royalty-base dispute is precluded at the schema layer." },
                  "minimum_guarantee": {
                    "type": "object",
                    "additionalProperties": false,
                    "required": ["fee", "period"],
                    "description": "Guaranteed floor per period — the standard protection that makes rev-share acceptable to talent; no agent accepts naked rev-share.",
                    "properties": {
                      "fee": { "$ref": "#/$defs/money", "description": "Guaranteed minimum payment per period, escrowed for the initial period at execution." },
                      "period": { "enum": ["month", "quarter", "year", "full_term"], "description": "Period the guarantee applies to." },
                      "recoupable": { "type": "boolean", "description": "Whether share payments recoup against the guarantee (true) or stack on top of it (false)." }
                    }
                  },
                  "payout_cadence": { "enum": ["monthly", "quarterly"], "description": "How often the share is calculated and remitted from usage reports; must match the usage_reporting cadence." },
                  "election": { "$ref": "#/$defs/fee_election", "description": "Rev-share tiers offered as an OPTION in negotiation and taken at execution are recorded with an election marker — the schema-native encoding of elective pricing (the untaken alternative lives in the quote record, not here)." }
                }
              },
              {
                "type": "object",
                "additionalProperties": false,
                "required": ["model"],
                "description": "Separately stated price of exclusivity/holdback — never buried in the flat fee, so renewals and scope changes can reprice exclusivity without reopening the whole deal. At least one of fee / uplift_bps must be present.",
                "properties": {
                  "model": { "const": "exclusivity_premium", "description": "Discriminator: compensation specifically for exclusivity modes, NAICS competitor blocks (including blocks under mode 'none'), and holdback — the consideration for a category block is stated here, never left implicit." },
                  "fee": { "$ref": "#/$defs/money", "description": "Fixed premium for the exclusivity/block period." },
                  "uplift_bps": { "$ref": "#/$defs/basis_points", "description": "Premium expressed as a basis-point uplift on the other guaranteed fees (e.g. 2500 = +25%). BASE, normative (INV-032): the machine-computed guaranteed total of the OTHER components (flat fees + committed metered minimums + initial-period minimum guarantees), excluding this premium itself and uncommitted metered/share upside; amount = floor(base x uplift_bps / 10000)." },
                  "election": { "$ref": "#/$defs/fee_election" }
                },
                "anyOf": [ { "required": ["fee"] }, { "required": ["uplift_bps"] } ]
              }
            ]
          }
        },
        "payment_schedule": {
          "type": "object",
          "additionalProperties": false,
          "required": ["milestones"],
          "description": "When money moves. Milestone shares apply to fixed fees; metered/share components bill per their own cadence. Typical ad deal: 50% on execution, 50% on licensor approval of deliverables.",
          "properties": {
            "milestones": {
              "type": "array",
              "minItems": 1,
              "description": "Ordered payment milestones for fixed fees; share_of_fixed_fees_bps must sum to 10000 (INV-014).",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["trigger", "share_of_fixed_fees_bps"],
                "description": "One payment milestone.",
                "properties": {
                  "trigger": { "enum": ["on_execution", "on_generation_start", "on_delivery", "on_licensor_approval", "on_licensee_acceptance", "on_campaign_launch", "net_days_after_invoice"], "description": "Event that makes this milestone payable." },
                  "share_of_fixed_fees_bps": { "$ref": "#/$defs/basis_points", "description": "Share of total fixed fees due at this milestone, in basis points (5000 = 50%)." },
                  "net_days": { "type": "integer", "minimum": 0, "description": "Payment terms in days after the trigger (0 = immediate; 30/45/60 are common brand terms — escrow neutralizes them for talent). Required when trigger == 'net_days_after_invoice' (a net-days trigger with no day count is undecidable)." }
                },
                "allOf": [
                  { "if": { "properties": { "trigger": { "const": "net_days_after_invoice" } }, "required": ["trigger"] }, "then": { "required": ["net_days"] } }
                ]
              }
            },
            "late_payment_interest_bps_monthly": { "$ref": "#/$defs/basis_points", "description": "Monthly interest on overdue non-escrowed amounts (metered/share invoices), in basis points (150 = 1.5%/month; rounding per INV-032)." }
          }
        },
        "escrow": {
          "type": "object",
          "additionalProperties": false,
          "required": ["required", "provider", "capture_at", "state", "release_trigger"],
          "description": "Platform escrow: funds captured at execution, released per trigger. Escrow is what lets strangers transact — talent never chases net-60 invoices; brands never prepay unknowns. The escrow state machine is what gates executed -> active (INV-015).",
          "properties": {
            "required": { "type": "boolean", "description": "Whether guaranteed fees must be escrowed at execution. Strong default true; tier_4 enterprise licensees under a master agreement may negotiate invoice terms." },
            "provider": { "enum": ["stripe_connect"], "description": "Escrow/payment rails. Closed to Stripe Connect in v0.1; ACP/UCP/AP2/x402 land as new enum values in later versions." },
            "capture_at": { "const": "execution", "description": "Fixed: when escrow is used, payment is captured when the license transitions to 'executed' — atomically with the transition (x-auto-approval-algorithm step 16)." },
            "state": { "enum": ["unfunded", "funded", "partially_released", "released", "refunded", "disputed"], "description": "Current escrow state: unfunded -> funded -> partially_released -> (released | refunded | disputed). A license cannot move executed -> active until funded (INV-015); 'disputed' freezes releases pending the human-review dispute process. EXPRESSLY EXEMPT from the license_version amendment rule: this is operational, platform-managed payment state living inside /pricing for single-source-of-truth reasons — its transitions never increment license_version and never require re-consent (see license_version)." },
            "release_trigger": { "enum": ["on_licensor_approval_of_deliverables", "on_delivery", "on_licensee_acceptance", "milestone_schedule"], "description": "What releases escrowed funds to the licensor payout split." }
          }
        },
        "kill_fee": {
          "type": "object",
          "additionalProperties": false,
          "required": ["schedule"],
          "description": "Compensation if the licensee cancels before completion, stepping up with deal progress — talent's calendar and exclusivity were committed even if no pixel shipped, and brands cancel campaigns constantly. Waived when revocation is licensor-initiated at will (revocation.licensee_kill_fee_waived_on_at_will).",
          "properties": {
            "schedule": {
              "type": "array",
              "minItems": 1,
              "description": "Staged cancellation fees as basis-point shares of total_guaranteed_fee (typical ladder: 2500/5000/10000/10000).",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["if_cancelled_during", "licensee_owes_bps"],
                "description": "One kill-fee stage.",
                "properties": {
                  "if_cancelled_during": { "enum": ["after_execution_before_generation", "after_generation_before_delivery", "after_delivery_before_launch", "after_launch"], "description": "Deal stage at cancellation." },
                  "licensee_owes_bps": { "$ref": "#/$defs/basis_points", "description": "Share of total_guaranteed_fee owed at this stage, in basis points." }
                }
              }
            },
            "exclusivity_kill_addon": { "$ref": "#/$defs/money", "description": "Additional amount owed if cancellation occurs after an exclusivity period began — blocked categories were real opportunity cost." }
          }
        },
        "options": {
          "type": "array",
          "description": "Pre-negotiated future rights: renewals, extensions, expansions. Options are how 12-month deals become multi-year relationships without violating the 10-year human cap — each exercise papers a NEW license document (amends_license_id) at pre-agreed pricing with a fresh consent record (INV-021).",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["option_type", "exercise_window", "pricing_method", "licensor_can_decline"],
            "description": "One pre-negotiated option.",
            "properties": {
              "option_type": { "enum": ["term_renewal", "territory_expansion", "category_expansion", "media_expansion", "exclusivity_upgrade", "right_of_first_refusal"], "description": "What the option lets the licensee acquire. 'right_of_first_refusal': licensee may match any competing offer in scope before the licensor accepts it." },
              "exercise_window": {
                "type": "object",
                "additionalProperties": false,
                "required": ["opens_days_before_expiry", "closes_days_before_expiry"],
                "description": "When the option can be exercised, keyed to term expiry so both sides can plan.",
                "properties": {
                  "opens_days_before_expiry": { "type": "integer", "minimum": 0, "description": "Days before term end when the option window opens." },
                  "closes_days_before_expiry": { "type": "integer", "minimum": 0, "description": "Days before term end when the window closes (0 = exercisable through the last day)." }
                }
              },
              "pricing_method": { "enum": ["fixed_fee", "uplift_bps_on_current", "then_current_rate_card", "match_competing_offer"], "description": "How the option price is determined at exercise." },
              "fixed_fee": { "$ref": "#/$defs/money", "description": "Pre-agreed price when pricing_method == 'fixed_fee'." },
              "uplift_bps": { "$ref": "#/$defs/basis_points", "description": "Basis-point uplift on current-term guaranteed fees when pricing_method == 'uplift_bps_on_current' (1000-2000 typical)." },
              "option_fee": { "$ref": "#/$defs/money", "description": "Amount paid NOW to hold the option open (non-refundable, typically creditable against the exercise price)." },
              "licensor_can_decline": { "type": "boolean", "description": "Whether exercise still requires licensor consent (true = a soft option / negotiation right) or is binding at the pre-agreed price (false = a true option — priced higher for the certainty). Note: even a binding option papers a new document with a fresh consent record for humans/estates; 'binding' means the price and scope are locked, not that consent formalities are skipped." }
            }
          }
        }
      }
    },
    "deliverables": {
      "type": "object",
      "additionalProperties": false,
      "required": ["items"],
      "description": "The concrete outputs and/or service access being purchased — the statement of work for one_time_outputs deals; the enabled service endpoints for persistent uses. Optional at draft; expected by execution for any deal with defined deliverables. Mirrors (in production detail) the consent record's enumerated deliverables (INV-019).",
      "properties": {
        "items": {
          "type": "array",
          "minItems": 1,
          "description": "Each distinct deliverable or enabled service.",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["deliverable_id", "kind", "quantity"],
            "description": "One deliverable line item.",
            "properties": {
              "deliverable_id": { "type": "string", "minLength": 1, "description": "Stable identifier for tracking approval, delivery, and watermark registration per deliverable." },
              "kind": { "enum": ["video_asset", "image_asset", "audio_spot", "voice_line_set", "song_vocal", "avatar_appearance", "game_asset_integration", "persona_endpoint_access", "live_stream_session"], "description": "The deliverable type. 'persona_endpoint_access' and 'live_stream_session' are service enablements, not files." },
              "quantity": { "type": "integer", "minimum": 1, "description": "Number of units of this deliverable (e.g. 3 hero videos; 500 voice lines)." },
              "spec": {
                "type": "object",
                "additionalProperties": false,
                "description": "Technical/creative specifications the delivered outputs must meet — cutdown planning belongs in the spec, not in email threads.",
                "properties": {
                  "max_duration_seconds": { "type": "integer", "minimum": 1, "description": "Maximum duration per video/audio unit, in whole seconds." },
                  "resolutions": { "type": "array", "uniqueItems": true, "items": { "type": "string", "description": "One required resolution (e.g. '1080x1920')." }, "description": "Required output resolutions." },
                  "aspect_ratios": { "type": "array", "uniqueItems": true, "items": { "type": "string", "description": "One required aspect ratio (e.g. '9:16')." }, "description": "Required aspect-ratio versions." },
                  "languages": { "type": "array", "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z]{2,3}(-[a-zA-Z0-9]{2,8})*$", "description": "One BCP 47 language tag, lowercase-canonical primary subtag." }, "description": "Languages/locales of the performance. Every entry MUST match an entry in grant.languages under RFC 4647 basic filtering (INV-019) — the grant dimension governs; this is the per-deliverable production detail." },
                  "file_formats": { "type": "array", "uniqueItems": true, "items": { "type": "string", "description": "One required format/codec (e.g. 'mp4/h264')." }, "description": "Required delivery formats/codecs." }
                }
              },
              "due_at": { "type": "string", "format": "date", "description": "Delivery deadline for this item; drives payment milestones and kill-fee stages." }
            }
          }
        },
        "acceptance_window_days": { "type": "integer", "minimum": 1, "maximum": 60, "description": "Days after delivery for the licensee to reject non-conforming deliverables (spec failures only, not taste); silence past the window is acceptance and releases milestone payments." }
      }
    },
    "usage_reporting": {
      "type": "object",
      "additionalProperties": false,
      "required": ["required"],
      "description": "The licensee's reporting obligations, feeding cap enforcement, CPM settlement, revenue-share payouts, and the talent dashboard. Anything metered, capped, shared, or exclusive needs numbers flowing back. Failure to report is a material breach and a for-cause revocation ground.",
      "properties": {
        "required": { "type": "boolean", "description": "Whether periodic usage reporting is contractually required. MUST be true when caps are per_period or pricing includes per_impression or revenue_share components (INV-005)." },
        "interval": { "$ref": "#/$defs/iso_duration", "description": "Reporting cadence (e.g. 'P1M'). Required when required == true. The 'license.usage_report_due' webhook fires at each interval boundary." },
        "due_within": { "$ref": "#/$defs/iso_duration", "description": "Grace window after each interval boundary in which the report must be filed (e.g. 'P7D')." },
        "metrics": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "enum": ["outputs_generated", "output_hashes", "impressions", "impressions_by_channel", "media_spend", "revenue_gross", "revenue_net", "active_deployments", "session_count", "session_minutes", "territories_served", "platforms_and_models_used"], "description": "One required metric. 'output_hashes' feed the provenance/enforcement index." }, "description": "Closed list of metrics each report must contain; must cover every metric the pricing components and caps depend on (INV-005)." },
        "delivery_method": { "const": "report_usage_api", "description": "Fixed: reports are filed through the platform's report_usage endpoint (machine-ingestible), not email or spreadsheets." },
        "late_report_policy": { "enum": ["none", "grace_then_suspend_generation", "suspend_generation_immediately"], "description": "Machine-enforceable consequence of a missed report: suspension cuts platform generation access until the report is filed (an access control, not a status transition)." },
        "audit": {
          "type": "object",
          "additionalProperties": false,
          "description": "Licensor-side audit rights over self-reported numbers — standard royalty-deal hygiene, mandatory when any measurement is licensee_attested (INV-020).",
          "properties": {
            "rights_granted": { "type": "boolean", "description": "Whether the licensor (via platform or accountant) may audit the licensee's relevant records on notice." },
            "notice_days": { "type": "integer", "minimum": 1, "description": "Advance written notice required before an audit." },
            "max_audits_per_year": { "type": "integer", "minimum": 1, "description": "Frequency limit on audits absent discovered discrepancy." },
            "cost_shift_threshold_bps": { "$ref": "#/$defs/basis_points", "description": "If underreporting exceeds this share (e.g. 500 = 5%), the licensee bears the audit cost and pays the shortfall plus late interest." }
          }
        },
        "records_retention_months": { "type": "integer", "minimum": 12, "maximum": 84, "description": "Months the licensee must retain underlying usage records for audit after the license ends. Does NOT extend biometric retention, which is governed exclusively by asset_handling." }
      },
      "allOf": [
        { "if": { "properties": { "required": { "const": true } }, "required": ["required"] }, "then": { "required": ["interval", "due_within", "metrics", "late_report_policy"] } }
      ]
    },
    "union_rider": {
      "type": "object",
      "additionalProperties": false,
      "required": ["covered"],
      "description": "Union/guild interface block — always present so evaluators never guess: covered=false is an explicit assertion made at onboarding, not a default. When the performer is union-covered, the license must travel with a CBA-consistent rider so producers can hire union talent through the platform without breaching their agreements; covered=true disables auto-approval (INV-004). Semblance never induces breach of a CBA, by construction.",
      "properties": {
        "covered": { "type": "boolean", "description": "Whether the licensor (or the human performer embodied in a character) performs this work under a union CBA. If true, the rider fields below are required." },
        "union": { "enum": ["sag_aftra", "actra", "equity_uk", "other"], "description": "The union whose CBA governs." },
        "agreement": { "enum": ["sag_aftra_tv_theatrical_2023", "sag_aftra_commercials_2025_digital_replica_rider", "sag_aftra_interactive_media_2025", "actra_national_commercial_2024", "equity_uk_av_2024", "other"], "description": "The specific CBA/rider framework this license is papered under. The 2025 SAG-AFTRA Interactive Media Agreement expressly permits independently created digital replicas supplied by a third-party platform authorized by the performer — the provision under which Semblance-brokered union interactive work proceeds." },
        "replica_classification": { "enum": ["employment_based_digital_replica", "independently_created_digital_replica"], "description": "CBA classification of the replica: 'employment_based_digital_replica' (created in connection with covered union employment) vs 'independently_created_digital_replica' (created outside employment, e.g. via Semblance's own capture — the pre-approved category for platform-brokered licenses). Classification selects which CBA consent and compensation rules apply." },
        "rider_ref": { "$ref": "#/$defs/evidence_ref", "description": "Evidence reference to the generated, executed digital-replica rider attached to the human-readable contract." },
        "union_notice_given": { "type": "boolean", "description": "Whether required notice of digital-replica use has been provided to the union per the governing agreement." },
        "scale_minimums_compliance": { "const": true, "description": "Constant true when covered: the consideration in /pricing meets or exceeds applicable CBA scale minimums for the use. A below-scale union license is schema-invalid — it cannot be expressed." },
        "scale_rate_evidence_ref": { "$ref": "#/$defs/evidence_ref", "description": "Evidence reference to the rate computation backing scale_minimums_compliance (the applicable CBA rate schedule and the deal's computation against it) — turns the bare compliance assertion into an auditable record." },
        "contributions_handled_by": { "enum": ["licensee_producer", "platform"], "description": "Which party remits pension & health (or equivalent benefit) contributions due under the CBA for this use. 'licensee_producer': the producer pays P&H ON TOP of /pricing fees directly to the plans (the normal shape — P&H is never a deduction from the talent's fee). 'platform': Semblance remits, routed via the licensor payout_split role 'union_trust' ONLY where the CBA computes contributions out of gross compensation; producer-paid P&H must NOT be encoded as a payout_split carve-out." },
        "ph_contribution_rate_bps": { "$ref": "#/$defs/basis_points", "description": "Pension & health (or equivalent) contribution rate due under the governing CBA, in basis points of the covered compensation base (e.g. 2050 = 20.5%). Recorded so the economic obligation is machine-readable and auditable, whoever remits." },
        "ph_contribution_amount": { "$ref": "#/$defs/money", "description": "Computed P&H contribution amount for this license, where fixed at execution (rate x covered compensation base). Optional for metered/share economics where the base accrues over time." },
        "producer_signatory_id": { "type": "string", "description": "The licensee-side signatory-of-record identifier with the union, when the licensee is a signatory producer." }
      },
      "allOf": [
        { "if": { "properties": { "covered": { "const": true } }, "required": ["covered"] }, "then": { "required": ["union", "agreement", "replica_classification", "rider_ref", "union_notice_given", "scale_minimums_compliance", "contributions_handled_by"] } }
      ]
    },
    "asset_handling": {
      "type": "object",
      "additionalProperties": false,
      "required": ["biometric_data_present", "raw_biometric_reference_released", "no_sale_of_biometric_data", "derived_models"],
      "description": "Handling of sensitive reference materials — biometric (face captures, voice samples, motion data of a living human) AND non-biometric character IP (Live2D/model files) — and derived models. Default posture: raw reference data never leaves the Rights Vault; the licensee receives outputs and usage rights only. Any release of raw reference data triggers a mandatory destruction regime regardless of biometric status. The BIPA §15(b) written release is required exactly when biometric data of a living human is present — a pure character-IP release is contract/copyright territory, not biometrics. Two distinct instruments by design: the written release covers the DATA (BIPA 15(b)); the consent record covers the USE — conflating them is the classic BIPA pleading error.",
      "properties": {
        "biometric_data_present": { "type": "boolean", "description": "Whether the reference materials backing this license include biometric identifiers/information of a living human (face geometry, voiceprint-bearing samples, motion capture; for characters, an embodied performer's voice or performance data counts). False is the pure character-IP case (e.g. Live2D model files with no performer-derived data). Governs whether the BIPA-grade written_release_ref is required (sibling conditional)." },
        "written_release_ref": { "$ref": "#/$defs/evidence_ref", "description": "Evidence reference to the written release authorizing collection, storage, and this specific disclosure of biometric identifiers/information, as required by 740 ILCS 14/15(b) (BIPA) and analogous statutes. MUST be executed by the DATA SUBJECT (the person whose biometrics are collected — for characters with an embodied performer, the PERFORMER, whose own copy is bound at embodied_performer.bipa_written_release_ref; an entity-level onboarding document signed by the character owner is NOT a 15(b) release for the performer's voiceprint), identified in written_release_signatory. Its captured_at MUST precede every biometric collection recorded in this document (INV-030 — release before collection, never paper-after). Captured at onboarding; distinct from the consent record. Required when biometric_data_present is true; inapplicable (and not required) for pure character-IP releases." },
        "written_release_signatory": {
          "type": "object",
          "additionalProperties": false,
          "required": ["legal_name", "capacity"],
          "description": "Who executed the 15(b) written release — binds the release to its signatory so a court can see the release was signed by the SUBJECT of the biometric identifiers, not by an owning entity. Required whenever written_release_ref is required (biometric_data_present true). Confidential contract data, not public certificate data: recording the performer's legal name here does not breach a credit.performer_anonymity_required election, which governs public identification.",
          "properties": {
            "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the natural person who signed the release." },
            "capacity": { "enum": ["licensor_self", "embodied_performer"], "description": "Capacity in which the signatory signed: the human licensor themself, or the living performer embodied in a character licensor. Deliberately NO entity/representative capacities — a 15(b) release is personal to the data subject and cannot be signed for them by an owner or estate (deceased subjects set biometric_data_present false; BIPA protects living individuals)." },
            "performer_id": { "type": "string", "pattern": "^per_[0-9A-HJKMNP-TV-Z]{26}$", "description": "When capacity == 'embodied_performer': the performer's registry id, matching character_provenance.embodied_performer.performer_id." }
          },
          "allOf": [
            { "if": { "properties": { "capacity": { "const": "embodied_performer" } }, "required": ["capacity"] }, "then": { "required": ["performer_id"] } }
          ]
        },
        "reference_materials_collected_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp when collection of the biometric reference materials backing this license (face captures, voice samples, motion data — including capture sessions that trained a voice model) was FIRST performed for the data subject. MUST be >= written_release_ref.captured_at (INV-030): the schema records release-then-collect, and a document showing collection before release is non-conformant — the textbook per-violation BIPA pleading pattern is unrepresentable. Required when biometric_data_present is true." },
        "raw_biometric_reference_released": { "type": "boolean", "description": "Whether any raw reference material (biometric or character-IP, as opposed to generated outputs) is released to the licensee or a platform under this license. If true, released_asset_classes and destruction_obligations become required." },
        "released_asset_classes": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["calibrated_face_capture_set", "voice_sample_set", "motion_capture_data", "trained_voice_model", "character_lora_or_checkpoint", "character_model_files"], "description": "One released asset class." },
          "description": "Classes of sensitive reference material released, each individually enumerated. Required when raw_biometric_reference_released is true."
        },
        "destruction_obligations": {
          "type": "object",
          "additionalProperties": false,
          "required": ["destroy_on", "max_retention_days", "destruction_method", "destruction_certificate_required", "applies_to_recipients", "audit_right"],
          "description": "Contractual destruction regime for released reference material — the BIPA 15(a)-style retention schedule made bilateral. Required whenever raw_biometric_reference_released is true. Applies to REFERENCE MATERIALS and DERIVED MODELS only — never to delivered outputs or outputs embedded in distributed products, which are governed by term/revocation delivered-outputs treatments.",
          "properties": {
            "destroy_on": { "const": "earliest_of_purpose_satisfied_expiry_revocation_termination", "description": "Constant: destruction is triggered by the EARLIEST of purpose satisfaction, term expiry, revocation, or termination — whichever comes first. Non-negotiable." },
            "purpose_satisfied_definition": { "type": "string", "minLength": 10, "description": "Contractual definition of when the purpose is 'satisfied' for the destroy_on trigger (e.g. 'completion of all dialogue generation for the base game and its patches/DLC'). Who declares it, and when, should be unambiguous. Absent = purpose is satisfied no later than the earlier of final delivery acceptance or term end." },
            "max_retention_days": { "type": "integer", "minimum": 1, "maximum": 30, "description": "Absolute outer bound in days after the destruction trigger by which all copies in OPERATIONAL systems must be destroyed. Schema ceiling of 30 days — longer operational retention is inexpressible. Immutable cold backups are governed by cold_backup_purge_days." },
            "cold_backup_purge_days": { "type": "integer", "minimum": 1, "maximum": 90, "description": "Outer bound in days for purging or cryptographically erasing copies held ONLY in immutable cold backups, disaster-recovery archives, or VCS history, where in-place deletion within max_retention_days is technically infeasible. Schema ceiling of 90 days (0.1.2, down from 365 — BIPA 15(a) recognizes no backup exception, so this window is exposure, not entitlement). Any value above 30 additionally requires backup_purge_infeasibility_ref: a documented technical-infeasibility statement with counsel sign-off (sibling conditional). Access to such copies must be technically restricted in the interim and restoration is prohibited. Absent = backups are held to max_retention_days like everything else." },
            "backup_purge_infeasibility_ref": { "$ref": "#/$defs/evidence_ref", "description": "Hash-fixed reference to the documented technical-infeasibility analysis AND counsel sign-off justifying a cold_backup_purge_days value above 30 (e.g. immutable-archive rotation schedules with cryptographic-erasure key destruction plans). Required when cold_backup_purge_days > 30." },
            "destruction_method": { "enum": ["cryptographic_erasure", "secure_deletion_nist_800_88", "certified_media_destruction"], "description": "Required destruction method for released materials and all copies." },
            "destruction_certificate_required": { "const": true, "description": "Constant true: a signed certificate of destruction identifying every system from which the material was purged must be delivered. Non-negotiable." },
            "applies_to_recipients": { "const": "licensee_and_each_receiving_platform", "description": "Constant: the destruction obligations (and certificates, INV-028) bind the licensee AND every allowlisted generation platform or registered self-hosted pipeline that received the released material or hosts a derived model. Each recipient delivers its own certificate; the licensee warrants procurement of all of them." },
            "audit_right": { "type": "boolean", "description": "Whether the licensor/Semblance holds a contractual right to audit compliance with the destruction obligations." }
          }
        },
        "no_sale_of_biometric_data": { "const": true, "description": "Constant true: neither party may sell, lease, trade, or otherwise profit from raw biometric identifiers or biometric information as such (BIPA 15(c) alignment). Licensing outputs and usage rights is not a sale of biometric data." },
        "derived_models": {
          "type": "object",
          "additionalProperties": false,
          "required": ["fine_tuning_permitted"],
          "description": "Rules for models fine-tuned or otherwise derived from the licensor's reference data (LoRAs, voice clones, avatar checkpoints) in the course of this license — closes the fine-tune loophole. CLASSIFICATION RULE: a 'derived model' is an asset capable of generating NEW likeness content (voice models, LoRAs, checkpoints, riggable source models). Rendered or compiled assets embedded in delivered outputs — a game's baked face rig, compiled animations, dialogue portraits, final media — are DELIVERED OUTPUTS governed by term/revocation delivered-outputs treatments and any post-term survival election, NOT by this block's destruction regime. A derived model that survives the license is a vastly bigger grant than API generation and is not expressible in v0.1.",
          "properties": {
            "fine_tuning_permitted": { "type": "boolean", "description": "Whether the licensee/platform may fine-tune or train a model on the reference data for the purpose of fulfilling this license. If true, scope and post-term disposition become required. The prohibited-use baseline separately bans training general-purpose models on reference data." },
            "scope": { "const": "this_license_only", "description": "Constant: any derived model may be used solely to generate outputs under this license — never for other clients, other licenses, or general model improvement. A persistent surviving derived-model grant is a v0.2 open question, not a v0.1 option." },
            "post_term_disposition": { "enum": ["destroy_with_certification", "return_to_rights_vault"], "description": "What happens to derived models at expiry/revocation/termination: certified destruction, or return of custody to the Semblance Rights Vault for the licensor's benefit." },
            "destruction_certificate_required": { "type": "boolean", "description": "Whether a destruction certificate is required for derived models. Must be true when post_term_disposition == 'destroy_with_certification'." }
          },
          "allOf": [
            { "if": { "properties": { "fine_tuning_permitted": { "const": true } }, "required": ["fine_tuning_permitted"] }, "then": { "required": ["scope", "post_term_disposition", "destruction_certificate_required"] } },
            { "if": { "properties": { "post_term_disposition": { "const": "destroy_with_certification" } }, "required": ["post_term_disposition"] }, "then": { "properties": { "destruction_certificate_required": { "const": true } } } }
          ]
        }
      },
      "allOf": [
        { "if": { "properties": { "raw_biometric_reference_released": { "const": true } }, "required": ["raw_biometric_reference_released"] }, "then": { "required": ["released_asset_classes", "destruction_obligations"] } },
        { "if": { "properties": { "biometric_data_present": { "const": true } }, "required": ["biometric_data_present"] }, "then": { "required": ["written_release_ref", "written_release_signatory", "reference_materials_collected_at"] } },
        { "if": { "properties": { "destruction_obligations": { "properties": { "cold_backup_purge_days": { "minimum": 31 } }, "required": ["cold_backup_purge_days"] } }, "required": ["destruction_obligations"] }, "then": { "properties": { "destruction_obligations": { "required": ["backup_purge_infeasibility_ref"] } } } }
      ]
    },
    "revocation": {
      "type": "object",
      "additionalProperties": false,
      "required": ["at_will_permitted", "new_generations", "for_cause_grounds", "delivered_outputs_treatment", "for_cause_overrides_to_immediate", "biometric_destruction_on_revocation", "statutory_rights_non_waivable", "surviving_obligations"],
      "description": "Revocation semantics drafted for judicial application AND machine execution. The crisp split: (1) at the revocation effective time, all NEW generation ceases immediately on every allowlisted platform (constant, non-negotiable — propagated by license_id via certificate checks and vault key revocation); (2) ALREADY-DELIVERED outputs are governed by the three-way election recorded here at execution — a court applies the election, not a reasonableness standard. Revocation stays real (talent trust) while its cost is priced, not litigated.",
      "properties": {
        "at_will_permitted": { "type": "boolean", "description": "Whether the licensor may revoke without cause during the term. Priced honestly: an at-will-revocable license is worth less than for-cause-only, and buyers pay for certainty — both shapes must be expressible. If false, revocation still lies for cause and as provided by non-waivable statute, and notice_days/refund_treatment are required only if the parties choose to pre-agree terms for statutory (non-waivable) withdrawal scenarios." },
        "notice_days": { "type": "integer", "minimum": 0, "maximum": 90, "description": "Days between at-will revocation notice and the revocation effective time (0 = immediate). Generation access is suspended at notice regardless. For-cause revocation for safety-critical breaches (baseline prohibited uses) is always immediate regardless of this value. Required when at_will_permitted is true; when at_will_permitted is false this field, if present, governs statutorily mandated consent-withdrawal only." },
        "for_cause_grounds": {
          "type": "array",
          "minItems": 3,
          "uniqueItems": true,
          "items": { "enum": ["content_exclusion_breach", "use_outside_granted_scope", "unapproved_platform_or_model", "disclosure_obligation_violation", "cap_exceeded_without_overage", "sublicensing_violation", "payment_default", "reporting_default", "reputational_harm_material_breach"], "description": "One ground for for-cause revocation." },
          "allOf": [
            { "contains": { "const": "content_exclusion_breach" } },
            { "contains": { "const": "use_outside_granted_scope" } },
            { "contains": { "const": "unapproved_platform_or_model" } }
          ],
          "description": "Breaches that let the licensor revoke immediately with no refund, immediate takedown rights (INV-022), and destruction obligations triggered. REQUIRED with a non-negotiable minimum set — 'content_exclusion_breach', 'use_outside_granted_scope', and 'unapproved_platform_or_model' must always be present (a license with no defined for-cause trigger would leave INV-022's immediate-takedown override with nothing to fire on); further grounds are elective."
        },
        "new_generations": { "const": "cease_immediately_all_platforms", "description": "Constant: at the revocation effective time, all new generation, re-rendering, and derivative production stops immediately across every allowlisted platform, propagated by Semblance via license_id. Non-negotiable — a hard-coded platform guarantee, not a term." },
        "delivered_outputs_treatment": { "enum": ["licensee_retains_through_term", "wind_down_then_cease", "immediate_cessation"], "description": "The contractual election, made at execution, governing outputs already delivered before the revocation effective time. 'licensee_retains_through_term': existing outputs may continue in use for the remainder of the original term within scope (the brand-safe default — campaigns in flight are safe). 'wind_down_then_cease': existing uses must be withdrawn within wind_down_days. 'immediate_cessation': all use of all outputs stops at the effective time (premium-priced election; also the forced outcome of for-cause revocation per INV-022)." },
        "wind_down_days": { "type": "integer", "minimum": 1, "maximum": 180, "description": "Days after the revocation effective time within which already-published uses must be withdrawn. Required when delivered_outputs_treatment == 'wind_down_then_cease'." },
        "persistent_service_wind_down_days": { "type": "integer", "minimum": 0, "maximum": 30, "description": "For persistent personas/services: maximum days to disable the service after revocation (deliberately short — the ongoing use IS the harm surface; end-user notice is the licensee's problem)." },
        "refund_treatment": { "enum": ["pro_rata_refund_of_unearned_fees", "no_refund", "per_component_schedule"], "description": "Financial consequence of at-will revocation: pro-rata refund of unearned fees (makes at-will revocation economically fair to the buyer), no refund (licensee bears revocation risk, priced in), or per-component treatment defined in the human-readable contract. For-cause revocation is always no-refund. Required when at_will_permitted is true; when at_will_permitted is false this field, if present, governs statutorily mandated withdrawal only." },
        "licensee_kill_fee_waived_on_at_will": { "type": "boolean", "description": "Whether the licensee's kill-fee obligations are extinguished when revocation is licensor-initiated at will (they should be)." },
        "revocation_fee": { "$ref": "#/$defs/money", "description": "Optional fee the licensor owes (or forfeits from escrow) for revoking at will before term end — the price of making revocation real while keeping licensees whole." },
        "for_cause_overrides_to_immediate": { "const": true, "description": "Constant true: for-cause revocation always permits immediate cessation and takedown demands regardless of the negotiated delivered-outputs treatment (INV-022)." },
        "biometric_destruction_on_revocation": { "const": true, "description": "Constant true: revocation is always a destruction trigger for released biometric reference material and derived models per asset_handling.destruction_obligations." },
        "statutory_rights_non_waivable": { "const": true, "description": "Constant true: nothing in this license waives revocation or consent-withdrawal rights that applicable statute (state digital-replica law, BIPA, GDPR, or an enacted NO FAKES Act) makes non-waivable; where such a statute grants broader revocation rights, the statute controls." },
        "surviving_obligations": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["final_usage_report", "destruction_obligations", "confidentiality", "indemnification", "payment_of_accrued_fees", "audit_rights"], "description": "One surviving obligation." },
          "description": "Obligations that survive revocation, expiry, or termination. Should include at minimum the final usage report, destruction obligations, confidentiality, and indemnities."
        }
      },
      "allOf": [
        { "if": { "properties": { "delivered_outputs_treatment": { "const": "wind_down_then_cease" } }, "required": ["delivered_outputs_treatment"] }, "then": { "required": ["wind_down_days"] } },
        { "if": { "properties": { "at_will_permitted": { "const": true } }, "required": ["at_will_permitted"] }, "then": { "required": ["notice_days", "refund_treatment"] } }
      ]
    },
    "provenance": {
      "type": "object",
      "additionalProperties": false,
      "required": ["c2pa_required", "watermark", "verify_endpoint"],
      "description": "Provenance and delivery requirements ensuring every output is traceable to this license — the evidentiary backbone for enforcement, the public verify_license endpoint, and NO FAKES-style notice-and-takedown. Platform floors, not negotiable deal points: the schema is public, and competitors adopting it inherit the ethics floor.",
      "properties": {
        "c2pa_required": { "const": true, "description": "Constant true: every delivered asset embeds C2PA Content Credentials identifying it as licensed synthetic media and referencing the license certificate. Where outputs are compiled into container formats that cannot carry credentials (engine assets, runtime-rendered media), the credential attaches to the delivered asset package and the product carries an embedded_use_manifest instead — the obligation follows the deliverable, not the pixel." },
        "watermark": {
          "type": "object",
          "additionalProperties": false,
          "required": ["required", "keyed_to"],
          "description": "Invisible watermark/fingerprint requirements for delivered assets.",
          "properties": {
            "required": { "const": true, "description": "Constant true: all delivered assets are watermarked/fingerprinted before release." },
            "keyed_to": { "const": "license_id", "description": "Constant: the watermark payload resolves to this document's license_id, so any asset found in the wild traces to its authorization in a single lookup — or exposes itself as unlicensed." }
          }
        },
        "verify_endpoint": { "type": "string", "format": "uri", "description": "Public, free, unauthenticated URL where anyone (platforms, ad networks, regulators, courts) can verify this license by certificate_id or content hash — deliberately open; platform adoption of this check is the long-term enforcement moat." },
        "output_hash_registration": {
          "type": "object",
          "additionalProperties": false,
          "description": "Registration of final published outputs into the fingerprint index — matters when the licensee edits/cuts approved masters after delivery. For product-embedded outputs (game builds), registration operates at asset-package level via embedded_use_manifest, not per published file.",
          "properties": {
            "required": { "type": "boolean", "description": "Whether the licensee must register perceptual hashes of final published versions." },
            "within_hours_of_publication": { "type": "integer", "minimum": 1, "description": "Deadline for registering each published version." }
          }
        },
        "embedded_use_manifest": {
          "type": "object",
          "additionalProperties": false,
          "required": ["required"],
          "description": "For licenses whose outputs are embedded in a shipped product (games, apps) rather than published as standalone media: a per-release manifest the licensee files listing the licensed assets embedded in each product build/patch/DLC release, keyed to license_id. This — not per-output C2PA — is how embedded and runtime-rendered uses stay traceable (INV-024): verify_license resolves product-embedded content through this manifest. Deeper build-level provenance is a v0.2 candidate.",
          "properties": {
            "required": { "type": "boolean", "description": "Whether an embedded-use manifest must be filed for every product release containing licensed assets." },
            "per_release_within_days": { "type": "integer", "minimum": 1, "maximum": 30, "description": "Deadline in days after each public release (build, patch, DLC) to file its manifest." }
          }
        },
        "delivery_method": { "enum": ["semblance_signed_urls", "platform_direct_with_certificate_check"], "description": "How assets are delivered: watermarked assets via expiring signed URLs (download_assets), or provisioned inside an allowlisted generation platform under certificate check (licensed-cast catalog model). Off-platform delivery is not offered — it breaks provenance." }
      }
    },
    "warranties": {
      "type": "object",
      "additionalProperties": false,
      "required": ["licensor_warrants_rights_ownership", "platform_warrants_chain_of_consent", "licensee_warrants_use_compliance"],
      "description": "Reciprocal warranty and indemnity skeleton generated into the human-readable contract. The allocation: licensor warrants rights ownership; the platform warrants the chain of consent; the licensee warrants compliance with every use term.",
      "properties": {
        "licensor_warrants_rights_ownership": { "const": true, "description": "Constant true: the licensor warrants they own or control all rights granted (for characters: complete chain of title, no unlicensed third-party elements in models or rigs)." },
        "platform_warrants_chain_of_consent": { "const": true, "description": "Constant true: Semblance warrants the identity verification and consent records backing this license were collected and are maintained as described." },
        "licensee_warrants_use_compliance": { "const": true, "description": "Constant true: the licensee warrants all use will comply with the grant, content exclusions, AI disclosure, platform allowlist, caps, and applicable law, and indemnifies for breach." },
        "e_and_o_insurance_ref": { "$ref": "#/$defs/evidence_ref", "description": "Optional evidence reference to errors-and-omissions coverage applicable to this license." }
      }
    },
    "governing_law": {
      "type": "object",
      "additionalProperties": false,
      "required": ["jurisdiction", "dispute_resolution"],
      "description": "Choice of law and dispute path for the license contract. Non-waivable statutory rights (state right-of-publicity, BIPA, an enacted NO FAKES Act) apply regardless of this election. Talent-protective digital-replica statutes make CA/NY/IL sensible defaults for human licensors.",
      "properties": {
        "jurisdiction": { "type": "string", "description": "Governing-law jurisdiction (e.g. 'US-CA')." },
        "venue": { "type": "string", "description": "Agreed venue or arbitral seat for disputes not resolved by the platform process." },
        "platform_dispute_process_first": { "type": "boolean", "default": true, "description": "Whether parties must complete the platform's human-reviewed dispute process before litigation/arbitration." },
        "dispute_resolution": { "enum": ["courts", "arbitration", "mediation_then_arbitration", "mediation_then_courts"], "description": "Dispute-resolution path after the platform process." }
      }
    },
    "execution": {
      "type": "object",
      "additionalProperties": false,
      "required": ["executed_at", "certificate_id", "licensor_signature_ref", "licensee_signature_ref", "contract_document_ref", "payment"],
      "description": "Artifacts created at execution: signatures, the public license certificate, payment state, and (post-delivery) the asset manifest. Required for status executed/active/expired/revoked/terminated; absent for draft/quoted/pending_approval/declined/cancelled (see root allOf) — this is the execution-time block.",
      "properties": {
        "executed_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp both signatures and payment capture completed and the license entered 'executed'." },
        "certificate_id": { "type": "string", "pattern": "^cert_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Identifier of the signed, publicly verifiable license certificate resolvable at provenance.verify_endpoint. Embedded in C2PA manifests of delivered assets and presented to platforms and verifiers." },
        "licensor_signature_ref": { "type": "string", "minLength": 1, "description": "Reference to the licensor's executed signature record on the human-readable contract — or, for machine-executed licenses (approval.mode 'auto_approve_within_parameters' or 'standing_offer'), to the pre-signed advance-authorization instrument (consent.instrument_ref), which is the instrument legally executed at the machine transition (INV-023)." },
        "licensee_signature_ref": { "type": "string", "minLength": 1, "description": "Reference to the licensee's executed signature or, for agentic execution, the agent's mandate-backed acceptance record." },
        "contract_document_ref": { "$ref": "#/$defs/evidence_ref", "description": "Evidence reference to the generated human-readable contract (with consent instrument and any union rider) that this machine document parallels. The machine document governs evaluation and enforcement systems; on conflict, the signed human-readable instrument controls in court — and says so." },
        "human_confirmation": {
          "type": "object",
          "additionalProperties": false,
          "required": ["confirmed_by", "confirmed_at", "method_ref"],
          "description": "Licensee-side human-in-the-loop confirmation artifact (INV-035). REQUIRED in the executed document whenever the computed fee exceeded approval.human_confirmation_threshold or agent_delegation.human_confirmation_required_above (algorithm step 15); absent otherwise. Records who confirmed, when, and under what evidence — exactly what an agentic-payment dispute needs.",
          "properties": {
            "confirmed_by": { "type": "string", "minLength": 1, "description": "Identifier of the natural person at the licensee/principal who confirmed (account user id or named individual reference — never the agent itself)." },
            "confirmed_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the confirmation. MUST precede executed_at." },
            "method_ref": { "type": "string", "minLength": 1, "description": "Reference to the confirmation evidence (signed confirmation record, step-up auth event id, payment-protocol HITL artifact)." }
          }
        },
        "payment": {
          "type": "object",
          "additionalProperties": false,
          "required": ["provider", "payment_ref"],
          "description": "Payment capture record for the executed license. Escrow disposition lives in pricing.escrow.state (single source of truth).",
          "properties": {
            "provider": { "enum": ["stripe_connect"], "description": "Payment rails used (mirrors pricing.escrow.provider)." },
            "payment_ref": { "type": "string", "minLength": 1, "description": "Opaque provider reference (e.g. Stripe PaymentIntent id) for the captured funds." }
          }
        },
        "delivery": {
          "type": "object",
          "additionalProperties": false,
          "required": ["asset_manifest"],
          "description": "Record of watermarked asset deliveries under this license; the manifest is what verify_license matches wild content hashes against (INV-008).",
          "properties": {
            "delivered_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of first delivery (drives executed -> active when later than term start and escrow funding)." },
            "asset_manifest": {
              "type": "array",
              "minItems": 1,
              "description": "Every delivered asset, hashed and watermark-keyed.",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["asset_id", "sha256", "watermark_id"],
                "description": "One delivered asset record.",
                "properties": {
                  "asset_id": { "type": "string", "pattern": "^ast_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Stable identifier of the delivered asset." },
                  "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "Lowercase hex SHA-256 of the delivered file, for exact-match verification." },
                  "c2pa_manifest_id": { "type": "string", "description": "Identifier of the embedded C2PA manifest, when the container format supports embedding." },
                  "watermark_id": { "type": "string", "minLength": 1, "description": "Identifier of the invisible watermark payload embedded in this asset, resolvable to license_id." }
                }
              }
            }
          }
        }
      }
    }
  },
  "allOf": [
    {
      "$comment": "EXECUTION-TIME REQUIREMENTS: consent and execution artifacts (and the execute_license idempotency key, INV-010) must exist from 'executed' onward; they are not required while drafting/quoting (draftable states: draft, quoted, pending_approval, declined, cancelled).",
      "if": { "properties": { "status": { "enum": ["executed", "active", "expired", "revoked", "terminated"] } }, "required": ["status"] },
      "then": { "required": ["consent", "execution"], "properties": { "integration": { "required": ["execution_idempotency_key"] } } }
    },
    {
      "$comment": "Once priced, the license must trace to its quote (request_quote -> create_booking -> execute_license lineage).",
      "if": { "properties": { "status": { "enum": ["quoted", "pending_approval", "executed", "active", "expired", "revoked", "terminated"] } }, "required": ["status"] },
      "then": { "required": ["integration"], "properties": { "integration": { "required": ["quote_id"] } } }
    },
    {
      "$comment": "ADVANCE-AUTHORIZATION REQUIREMENTS (INV-023/INV-026): executed licenses under non-manual approval modes must carry the advance-authorization consent binding, the licensee's request-time content declaration, AND the campaign record with the promoted product/service stated — the only record of what the likeness actually promoted, disclosed to the licensor at execution.",
      "if": {
        "properties": {
          "status": { "enum": ["executed", "active", "expired", "revoked", "terminated"] },
          "approval": { "properties": { "mode": { "enum": ["auto_approve_within_parameters", "standing_offer"] } }, "required": ["mode"] }
        },
        "required": ["status", "approval"]
      },
      "then": {
        "required": ["content_declaration", "campaign"],
        "properties": {
          "consent": { "required": ["advance_authorization"] },
          "campaign": { "required": ["product_or_service"] }
        }
      }
    },
    {
      "$comment": "HUMAN-LICENSOR ADVANCE-MODE REPRESENTATION GATE (0.1.2): until the fifty-state consent-adequacy matrix lands, an UNREPRESENTED human licensor cannot publish auto/standing envelopes — Cal. Lab. Code 927's safe harbor for a provision later found insufficiently specific exists only with legal counsel or union CBA coverage, and class-level advance consent is exactly the untested case. Entity licensors (character/estate) are outside the 927 human-performer analysis and unaffected.",
      "if": {
        "properties": {
          "parties": { "properties": { "licensor": { "properties": { "identity_type": { "const": "human" } }, "required": ["identity_type"] } }, "required": ["licensor"] },
          "approval": { "properties": { "mode": { "enum": ["auto_approve_within_parameters", "standing_offer"] } }, "required": ["mode"] }
        },
        "required": ["parties", "approval"]
      },
      "then": {
        "properties": { "consent": { "properties": { "representation": { "enum": ["legal_counsel", "union_cba_coverage"], "description": "Advance-mode human licensors must hold a 927 safe harbor: counsel-reviewed or CBA-covered." } } } }
      }
    },
    {
      "$comment": "DELIVERABLE-REVIEW ENFORCEMENT SURFACE MUST EXIST (0.1.2): a custom exclusion electing 'deliverable_review' — under ANY approval mode — requires deliverable_approval.required true with 'generated_outputs' in scope; otherwise the red line's sole enforcement surface can silently not exist.",
      "if": {
        "properties": { "grant": { "properties": { "content_exclusions": { "properties": { "custom_exclusions": { "contains": { "type": "object", "properties": { "enforcement": { "const": "deliverable_review" } }, "required": ["enforcement"] } } }, "required": ["custom_exclusions"] } }, "required": ["content_exclusions"] } },
        "required": ["grant"]
      },
      "then": {
        "properties": { "approval": { "required": ["deliverable_approval"], "properties": { "deliverable_approval": { "required": ["required", "scope"], "properties": { "required": { "const": true }, "scope": { "contains": { "const": "generated_outputs" } } } } } } }
      }
    },
    {
      "$comment": "PROHIBITED PHRASINGS need the same review surface: they are deliverable-review-enforced by definition.",
      "if": {
        "properties": { "grant": { "properties": { "content_exclusions": { "properties": { "endorsement_restrictions": { "properties": { "prohibited_phrasings": { "minItems": 1 } }, "required": ["prohibited_phrasings"] } }, "required": ["endorsement_restrictions"] } }, "required": ["content_exclusions"] } },
        "required": ["grant"]
      },
      "then": {
        "properties": { "approval": { "required": ["deliverable_approval"], "properties": { "deliverable_approval": { "required": ["required", "scope"], "properties": { "required": { "const": true }, "scope": { "contains": { "const": "generated_outputs" } } } } } } }
      }
    },
    {
      "$comment": "Manual approvals: the licensor signs against final terms with the licensee's identity disclosed BEFORE consent; advance-authorization machinery is forbidden (it belongs to machine-execution modes only).",
      "if": {
        "properties": { "approval": { "properties": { "mode": { "const": "manual" } }, "required": ["mode"] } },
        "required": ["approval"]
      },
      "then": {
        "properties": {
          "consent": {
            "properties": {
              "advance_authorization": false,
              "intended_use": { "properties": { "licensee_identity_disclosure": { "const": "disclosed_prior_to_consent" } } }
            }
          }
        }
      }
    },
    {
      "$comment": "Interactive persona gating (INV-006): manual approval only, business-verified+ licensee, revenue-share economics. Persistence and persona terms are forced inside /grant's own conditional.",
      "if": {
        "properties": { "grant": { "properties": { "use_categories": { "contains": { "const": "interactive_persona" } } }, "required": ["use_categories"] } },
        "required": ["grant"]
      },
      "then": {
        "properties": {
          "approval": { "properties": { "mode": { "const": "manual", "description": "Interactive persona licenses always require manual licensor approval." } } },
          "parties": { "properties": { "licensee": { "properties": { "verification_tier": { "enum": ["tier_3_business_verified", "tier_4_enterprise_contracted"], "description": "Interactive persona uses are gated to business-verified or enterprise licensees only." } } } } },
          "pricing": { "properties": { "fee_components": { "contains": { "type": "object", "required": ["model"], "properties": { "model": { "const": "revenue_share" } } } } } }
        }
      }
    },
    {
      "$comment": "Worldwide territory forces EU AI Act Article 50 labeling (country-list EU detection is INV-018).",
      "if": {
        "properties": { "grant": { "properties": { "territory": { "properties": { "mode": { "const": "worldwide" } }, "required": ["mode"] } }, "required": ["territory"] } },
        "required": ["grant"]
      },
      "then": {
        "properties": { "grant": { "properties": { "ai_disclosure": { "properties": { "eu_ai_act_art50_labeling": { "const": true } }, "required": ["eu_ai_act_art50_labeling"] } } } }
      }
    }
  ],
  "$defs": {
    "status": {
      "enum": ["draft", "quoted", "pending_approval", "executed", "active", "expired", "revoked", "terminated", "declined", "cancelled"],
      "description": "License lifecycle states. Core path: draft -> quoted -> pending_approval -> executed -> active -> (expired | revoked | terminated). 'declined' (licensor rejected) and 'cancelled' (abandoned or expired pre-execution) exist so pending_approval and quoted have machine-unambiguous exits — no dead-end states. See x-state-machine for the exhaustive transition table."
    },
    "use_category": {
      "enum": ["advertising", "film_tv", "games", "social_ugc", "corporate_training", "interactive_persona", "music_audio"],
      "description": "Closed 7-value use-category taxonomy (the primary matching dimension). 'advertising' = paid brand media; 'film_tv' = scripted/unscripted productions; 'games' = in-game characters, NPCs, voice; 'social_ugc' = organic/creator content; 'corporate_training' = internal comms, L&D, presenters; 'interactive_persona' = chatbots, AI companions, always-on avatars (highest-risk, persistent, manual-only); 'music_audio' = songs, vocals, audio productions."
    },
    "media_type": {
      "enum": ["video", "image", "audio_voice", "music", "text", "motion_performance", "live_interactive", "avatar_3d", "ar_vr"],
      "description": "Closed media-modality taxonomy. 'audio_voice' is spoken voice; 'music' is singing/musical performance (separately consented — different union and moral-rights posture); 'motion_performance' is motion/performance-capture data driving animation; 'live_interactive' covers real-time operation (live avatar puppeting, streams); 'avatar_3d' covers 3D model/rig outputs."
    },
    "channel": {
      "enum": ["broadcast_tv", "cinema", "streaming_ott", "social_organic", "social_paid", "digital_display_ads", "search_ads", "ooh_dooh", "in_game", "app_embedded", "website", "ecommerce_pdp", "podcast_streaming_audio", "radio", "print", "email_crm", "messaging", "point_of_sale", "live_event", "b2b_internal"],
      "description": "Closed distribution-channel taxonomy. There is deliberately no 'all channels' value — every channel is an affirmative, enumerated grant (AB 2602 specificity by construction). NORMATIVE BOUNDARY DEFINITIONS (these classifications are exclusive; an ad buy fits exactly one channel): 'social_paid' = paid placements purchased through a social or video platform's OWN ad system, expressly including YouTube pre-roll/in-stream, Meta, and TikTok ad units; 'digital_display_ads' = programmatic/direct display, banner, and outstream video bought OUTSIDE a platform's own social ad system; 'streaming_ott' = the licensed content is distributed AS OR WITHIN programming on an OTT/streaming service, never ad insertion against third-party content; 'in_game' = inside the playable product itself, including its patches and DLC — store pages, trailers (including in-engine captures cut for promotion), and marketing surfaces are NOT in_game and require their own channel grants; end users' own gameplay streams are not a licensee distribution and are out of scope. Paid social is distinct from organic because ad-platform provenance policies and union rates differ."
    },
    "verification_tier": {
      "enum": ["tier_0_unverified", "tier_1_email_verified", "tier_2_id_verified", "tier_3_business_verified", "tier_4_enterprise_contracted"],
      "description": "Licensee verification tiers, ordered least to most trusted. Values are constructed so LEXICOGRAPHIC string comparison equals trust comparison ('tier_2...' < 'tier_3...'), letting evaluators do min-tier checks with plain string ordering. tier_2 = government-ID-verified individual; tier_3 = KYB-verified business; tier_4 = enterprise under a negotiated master agreement. NAMING RULE, normative for future versions: the single-digit namespace tops out at tier_9; any tier beyond that MUST introduce zero-padded identifiers for the ENTIRE enum (tier_00_..., tier_01_..., ...) in a breaking schema version — 'tier_10' alongside 'tier_2' would silently corrupt lexicographic comparison and is forbidden."
    },
    "money": {
      "type": "object",
      "additionalProperties": false,
      "required": ["amount_minor", "currency"],
      "description": "Monetary amount as INTEGER minor units plus ISO 4217 currency. No floating-point money anywhere in this schema; comparisons are integer comparisons and never cross currencies (INV-003).",
      "properties": {
        "amount_minor": { "type": "integer", "minimum": 0, "description": "Amount in the currency's minor units (e.g. cents for USD: $5,000.00 -> 500000). Exponent per ISO 4217 (JPY has 0 decimal places, so amount_minor is whole yen)." },
        "currency": { "type": "string", "pattern": "^[A-Z]{3}$", "description": "ISO 4217 alphabetic currency code (e.g. 'USD', 'EUR', 'JPY'). Must equal /pricing/currency per INV-003." }
      }
    },
    "basis_points": {
      "type": "integer",
      "minimum": 0,
      "maximum": 10000,
      "description": "A proportion expressed as integer basis points (100 bps = 1%; 10000 = 100%). Used for every percentage in this schema — no float percentages, so settlement and split math is deterministic."
    },
    "territory": {
      "type": "object",
      "additionalProperties": false,
      "required": ["mode"],
      "description": "Distribution territory as explicit ISO 3166-1 alpha-2 country sets. Evaluation expands to concrete sets ('worldwide' = all codes; 'exclude' = world minus codes) and checks subset relations (INV-009) — no free-text region names like 'EMEA'.",
      "properties": {
        "mode": { "enum": ["worldwide", "include", "exclude"], "description": "'worldwide' = every territory; 'include' = only the listed countries; 'exclude' = everywhere except the listed countries (e.g. carve-outs for sanctions regimes or the licensor's conflicting deal in one market)." },
        "country_codes": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Z]{2}$", "description": "ISO 3166-1 alpha-2 country code." }, "description": "Country list for include/exclude modes. Required (and only meaningful) when mode != 'worldwide'." },
        "geo_targeting_required": { "type": "boolean", "description": "If true, the licensee must geo-target paid distribution to the licensed territory; publishing without geo controls is a breach even if the audience is 'mostly' in-territory." },
        "organic_spillover_permitted": { "type": "boolean", "description": "Whether organic (non-targetable) availability outside the territory is tolerated. Standard true for social; must be false for territory-exclusive deals with conflicting licenses elsewhere." }
      },
      "allOf": [
        { "if": { "properties": { "mode": { "enum": ["include", "exclude"] } }, "required": ["mode"] }, "then": { "required": ["country_codes"] } }
      ]
    },
    "fee_election": {
      "type": "object",
      "additionalProperties": false,
      "required": ["basis", "elected_at"],
      "description": "Marks a fee component that entered the deal by ELECTION at execution rather than as a mandatory term. The executed document records only the elected outcome; the pre-election menu is preserved in the immutable quote. (Full elective-menu pricing inside the license document is a v0.2 candidate.) Absence of this object = the component was a mandatory term.",
      "properties": {
        "basis": { "enum": ["licensee_elected", "licensor_elected", "mutual_election"], "description": "Which party's election brought the component into force." },
        "elected_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the election (at or before execution)." }
      }
    },
    "iso_duration": {
      "type": "string",
      "pattern": "^P(?:[0-9]+W|(?=[0-9]|T[0-9])([0-9]+Y)?([0-9]+M)?([0-9]+D)?(?:T(?=[0-9])([0-9]+H)?([0-9]+M)?([0-9]+S)?)?)$",
      "description": "ISO 8601 duration (e.g. 'P6M', 'P10Y', 'P7D', 'P2W', 'PT0S'). Week designators are EXCLUSIVE per ISO 8601: 'P2W' is valid, but mixing W with any other designator ('P1W2D') is not — the pattern rejects it (0.1.2). Used for term ceilings, notice/report periods, and rate-limit windows; engines compare durations by applying them to concrete dates, never by string comparison."
    },
    "utc_datetime": {
      "type": "string",
      "format": "date-time",
      "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?Z$",
      "description": "UTC instant as RFC 3339 date-time with a REQUIRED trailing 'Z' (0.1.2): every timestamp in this schema is UTC by definition, and the pattern makes non-UTC offsets ('+02:00') unrepresentable rather than merely discouraged — ordering comparisons (INV-023, INV-030) are plain string/instant comparisons with no offset math."
    },
    "age_attestation": {
      "type": "object",
      "additionalProperties": false,
      "required": ["date_of_birth_verified", "age_verification_ref", "verified_at"],
      "description": "Structured 18+ attestation for one verified natural person (INV-012, 0.1.2 — replaces reliance on the bare adult_verified constant): a court or auditor can trace the adulthood assertion to a specific, hash-fixed verification artifact instead of a schema-required word. Used for human licensors, estate representatives, character-owner signatories, and embodied performers.",
      "properties": {
        "date_of_birth_verified": { "const": true, "description": "Constant true: the person's date of birth was verified from a government-ID KYC artifact showing age >= 18 at verified_at. The evidentiary weight lives in age_verification_ref, not in this flag." },
        "age_verification_ref": { "$ref": "#/$defs/evidence_ref", "description": "Hash-fixed reference to the specific KYC/identity artifact asserting the verified date of birth (vendor inquiry report or registry age-verification record). References only — the DOB itself never lives in a license document." },
        "verified_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp the age verification was performed or last re-confirmed." }
      }
    },
    "content_code": {
      "enum": ["politics_elections", "religion", "alcohol", "tobacco_nicotine_vaping", "cannabis", "gambling_betting", "firearms_weapons", "intimacy_romantic_depiction", "pharmaceuticals_medical_claims", "health_supplements", "energy_drinks_high_caffeine", "weight_loss_cosmetic_procedures", "financial_products_advice", "crypto_speculative_finance", "dating_services", "fast_food", "fur_animal_products", "fossil_fuels", "military_defense", "first_person_endorsement_phrasing", "profanity_crude_humor", "violence_gore", "horror_shock", "children_directed_advertising", "political_figures_association", "competitor_of_current_sponsors"],
      "description": "The closed 26-code content taxonomy (single source of truth, hoisted in 0.1.2 so exclusions, affirmative permissions, and request-time declarations can never drift apart; 'energy_drinks_high_caffeine' graduated from custom usage in 0.1.1). Matched by INV-017: a declared code in (excluded_codes minus affirmative_permissions) denies the request."
    },
    "evidence_ref": {
      "type": "object",
      "additionalProperties": false,
      "required": ["ref_id", "sha256"],
      "description": "Evidence-grade document reference: stable identifier, retrieval URI, and content hash so the referenced instrument can be produced and authenticated in a dispute. Every compliance-critical instrument in this schema is hash-fixed at execution.",
      "properties": {
        "ref_id": { "type": "string", "minLength": 1, "description": "Stable identifier of the referenced document in the Semblance records system / Rights Vault." },
        "uri": { "type": "string", "format": "uri", "description": "Retrieval URI for authorized parties (access-controlled)." },
        "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "Lowercase hex SHA-256 of the referenced document at execution time, fixing its contents evidentially." },
        "captured_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp when the referenced document was captured or executed." }
      }
    },
    "licensor": {
      "type": "object",
      "additionalProperties": false,
      "required": ["licensor_id", "identity_type", "display_name", "adult_verified"],
      "description": "The verified rights holder. Identity-type-specific verification blocks are conditionally required; the minors exclusion is structural (adult_verified is a required constant true — no instance can represent a minor licensor).",
      "properties": {
        "licensor_id": { "type": "string", "pattern": "^tal_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Stable Semblance registry identifier of the talent/character profile." },
        "identity_type": { "enum": ["human", "estate", "character"], "description": "Closed identity taxonomy driving verification requirements and term rules: 'human' -> KYC + liveness and the 10-year term cap (INV-001); 'estate' -> documented post-mortem authority bounding the term (INV-002); 'character' -> chain-of-title over the IP, no statutory term cap (ordinary contract law), with the embodied-performer trap handled explicitly." },
        "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the rights-holding person or entity (for estates, the administrator entity; for characters, the IP owner). May be withheld from public display per grant.credit anonymity." },
        "display_name": { "type": "string", "minLength": 1, "description": "Public roster name (person's professional name, or character name) as listed in the registry and used in credits." },
        "adult_verified": { "const": true, "description": "Constant true: every verified natural person behind this licensor is 18 or older. NOT free-standing (INV-012): the assertion MUST be backed by a structured age_attestation for the human licensor (licensor.age_attestation), the estate representative (estate_authority.representative), the character-owner signatory (character_provenance.owner_signatory), and any embodied performer (character_provenance.embodied_performer) — each naming the KYC artifact that verified date of birth. Minors are categorically excluded — a license for a minor's likeness cannot be expressed in this schema. The prohibited-use baseline independently bans any sexualization or depiction of minors in outputs, and character licensors warrant the character is not presented as a real, identifiable minor." },
        "age_attestation": { "$ref": "#/$defs/age_attestation", "description": "Structured 18+ attestation for the HUMAN licensor (required iff identity_type == 'human'): the verified-DOB assertion, the KYC artifact that verified it, and when. Estate representatives, character-owner signatories, and embodied performers carry their own attestations in their blocks (INV-012)." },
        "human_verification": {
          "type": "object",
          "additionalProperties": false,
          "required": ["kyc_provider", "kyc_reference", "liveness_verified_at"],
          "description": "Identity-proofing references for living humans. Required iff identity_type == 'human'. References only — no biometric data lives in license documents (BIPA/GDPR).",
          "properties": {
            "kyc_provider": { "enum": ["persona", "onfido"], "description": "Approved KYC vendor that performed government-ID verification. Closed allowlist; extending it is a schema change." },
            "kyc_reference": { "type": "string", "minLength": 1, "description": "Opaque vendor reference to the completed KYC inquiry/report, auditable on demand." },
            "liveness_verified_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the most recent successful biometric liveness check proving the listed person controls this profile — nobody can list a face that isn't theirs." }
          }
        },
        "estate_authority": {
          "type": "object",
          "additionalProperties": false,
          "required": ["decedent_legal_name", "date_of_death", "jurisdiction", "authority_type", "authority_document_refs", "post_mortem_rights_expire_at", "representative"],
          "description": "Proof of authority to license a deceased individual's likeness under the applicable post-mortem right-of-publicity regime. Required iff identity_type == 'estate'.",
          "properties": {
            "decedent_legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the deceased individual whose likeness is licensed." },
            "date_of_death": { "type": "string", "format": "date", "description": "Date of death (ISO 8601), anchoring the post-mortem rights term computation." },
            "jurisdiction": { "type": "string", "pattern": "^[A-Z]{2}(-[A-Z0-9]{1,3})?$", "description": "Governing post-mortem right-of-publicity jurisdiction as ISO 3166-1 alpha-2, optionally with ISO 3166-2 subdivision (e.g. 'US-CA' Civ. Code 3344.1, 'US-TN', 'US-NY' CRL 50-f)." },
            "authority_type": { "enum": ["executor", "heir_or_assignee", "foundation", "licensed_representative"], "description": "Basis of the estate's authority. 'licensed_representative' covers estate-agency arrangements (CMG-style) acting under written mandate." },
            "authority_document_refs": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidence_ref" }, "description": "Evidence references to letters testamentary, registration of claim (e.g. California 3344.1 registration), assignment or exclusive license from heirs, or representation mandates reviewed at onboarding." },
            "post_mortem_rights_expire_at": { "type": "string", "format": "date", "description": "Date the post-mortem rights (or the representative's mandate, if earlier) expire under the governing regime — CA 70 years, NY 40, TN potentially perpetual, NO FAKES 10+5-year renewals. The license term.end_date must not exceed this date (INV-002; recorded here as the bound a court applies), and the platform MUST re-verify this date against the regime at every execution and renewal — renewal-contingent regimes can move it (INV-002). For effectively perpetual regimes, record the next re-verification date of the representative's mandate." },
            "representative": {
              "type": "object",
              "additionalProperties": false,
              "required": ["legal_name", "age_attestation"],
              "description": "The natural person acting for the estate — the human who signs (consent.signatory role 'estate_representative') and is registry-verified. Required: estates act only through identified, age-attested people (INV-012).",
              "properties": {
                "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the acting estate representative (executor, foundation officer, or licensed-representative signatory)." },
                "age_attestation": { "$ref": "#/$defs/age_attestation", "description": "Structured 18+ attestation for the estate representative." }
              }
            }
          }
        },
        "character_provenance": {
          "type": "object",
          "additionalProperties": false,
          "required": ["character_name", "chain_of_title_doc_refs", "no_third_party_elements_warranty", "owner_signatory", "embodied_human_performer"],
          "description": "Chain-of-title evidence for fictional characters (VTubers, virtual influencers, game/animation IP). Required iff identity_type == 'character'. Screens out performers who do not own their avatars — many corporate VTubers do not — and closes the trap most drafts miss: owning the character does not clear the embodied human performer's rights. When a living performer is embodied, that performer is a FIRST-CLASS SUB-PARTY (embodied_performer, 0.1.2): own age attestation, own KYC/liveness, own BIPA release, own intended-use consent, own payout role — and the INV-001 10-year cap applies to the whole grant.",
          "properties": {
            "character_name": { "type": "string", "minLength": 1, "description": "Name of the fictional character or virtual persona licensed." },
            "chain_of_title_doc_refs": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/evidence_ref" }, "description": "Evidence references establishing outright ownership: commission/work-for-hire agreements, assignments, copyright registrations, trademark filings, and (for VTubers) proof of model ownership from the rigger/artist." },
            "copyright_registration_numbers": { "type": "array", "uniqueItems": true, "items": { "type": "string", "description": "One copyright registration number." }, "description": "Copyright registration numbers covering the character design/model, where obtained." },
            "trademark_registration_numbers": { "type": "array", "uniqueItems": true, "items": { "type": "string", "description": "One trademark registration or application number." }, "description": "Trademark registrations/applications covering the character name/design, where obtained." },
            "no_third_party_elements_warranty": { "const": true, "description": "Constant true: the licensor warrants the character model, rig, and assets contain no unlicensed third-party elements (art, base meshes, music, fonts, other IP)." },
            "owner_signatory": {
              "type": "object",
              "additionalProperties": false,
              "required": ["legal_name", "age_attestation"],
              "description": "The natural person who signs for the owning entity (consent.signatory role 'character_owner'). Required: entities act only through identified, age-attested people (INV-012).",
              "properties": {
                "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the owning entity's signatory (e.g. representative director, managing member)." },
                "age_attestation": { "$ref": "#/$defs/age_attestation", "description": "Structured 18+ attestation for the owner signatory." }
              }
            },
            "embodied_human_performer": { "type": "boolean", "description": "Whether a specific living human's voice, face, or performance is embodied in the character (common for VTubers). If true, the embodied_performer sub-party block is required — character ownership does NOT clear the human performer's voice/likeness rights, the performer's union coverage flows into union_rider, the INV-001 10-year term cap applies to the grant, and payout_split MUST carry an 'embodied_performer' entry (INV-013)." },
            "embodied_performer": {
              "type": "object",
              "additionalProperties": false,
              "required": ["performer_id", "legal_name", "adult_verified", "age_attestation", "verification", "consent_ref", "bipa_written_release_ref"],
              "description": "FIRST-CLASS SUB-PARTY (0.1.2): the living human whose voice, face, or performance is embodied in the character. Required when embodied_human_performer is true. The character wrapper defeats no human-protective rule: the performer carries their own age attestation, KYC/liveness, intended-use consent, and data-subject BIPA release, is compensated visibly (payout_split role 'embodied_performer'), and brings the grant under the INV-001 living-person term cap. The performer's legal identity here is confidential contract data — public anonymity is separately governed by grant.credit.performer_anonymity_required.",
              "properties": {
                "performer_id": { "type": "string", "pattern": "^per_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Stable Semblance registry identifier of the performer ('per_' + Crockford-base32 ULID) — referenced by written_release_signatory.performer_id and the payout split." },
                "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the performer. Never publicly displayed when credit.performer_anonymity_required is true." },
                "adult_verified": { "const": true, "description": "Constant true, backed by this block's age_attestation (INV-012): a minor performer embodied in a character licensor is unrepresentable." },
                "age_attestation": { "$ref": "#/$defs/age_attestation", "description": "Structured 18+ attestation for the performer — the specific KYC artifact verifying the performer's date of birth." },
                "verification": {
                  "type": "object",
                  "additionalProperties": false,
                  "required": ["kyc_provider", "kyc_reference", "liveness_verified_at"],
                  "description": "Identity-proofing references for the performer, identical in shape and rigor to human_verification for direct human licensors. References only — no biometric data lives in license documents.",
                  "properties": {
                    "kyc_provider": { "enum": ["persona", "onfido"], "description": "Approved KYC vendor that performed government-ID verification of the performer." },
                    "kyc_reference": { "type": "string", "minLength": 1, "description": "Opaque vendor reference to the performer's completed KYC inquiry/report." },
                    "liveness_verified_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp of the performer's most recent successful liveness check — nobody can embody a voice or face that isn't theirs to give." }
                  }
                },
                "consent_ref": { "$ref": "#/$defs/evidence_ref", "description": "The performer's OWN executed intended-use consent covering this license's use of their voice/face/performance through the character — mirroring the specificity duties of /consent (named use class, narrative, revocability). Distinct from the owner entity's consent record; character ownership never substitutes for it." },
                "bipa_written_release_ref": { "$ref": "#/$defs/evidence_ref", "description": "The performer's OWN written release under 740 ILCS 14/15(b) and analogues, executed by the performer as data subject, authorizing collection/storage/disclosure of their biometric identifiers (voiceprint-bearing samples, face geometry, performance capture). asset_handling.written_release_ref MUST resolve to (or incorporate) this instrument when the released reference materials carry this performer's biometrics, with written_release_signatory.capacity == 'embodied_performer', and INV-030's release-before-collection ordering applies to its captured_at." }
              }
            }
          },
          "allOf": [
            { "if": { "properties": { "embodied_human_performer": { "const": true } }, "required": ["embodied_human_performer"] }, "then": { "required": ["embodied_performer"] } }
          ]
        },
        "representation": {
          "type": "object",
          "additionalProperties": false,
          "description": "The talent's human representation, if any. Agents stay in the loop — the platform routes approvals to the agent of record when set, and commission is expressed in payout_split.",
          "properties": {
            "represented": { "type": "boolean", "description": "True if a talent agent/manager of record participates in approvals and payout." },
            "agent_of_record": { "type": "string", "description": "Name and agency of the representative of record (e.g. 'J. Rivera, Meridian Talent — digital division')." },
            "agent_contact_ref": { "type": "string", "description": "Platform contact/notification reference for routing approval requests and notices to the agent." }
          }
        },
        "payout_split": {
          "type": "array",
          "minItems": 1,
          "description": "How licensor-side proceeds divide after the platform take rate. share_bps MUST sum to 10000 (INV-013). Makes agent commissions, estate beneficiary splits, and union trust remittances first-class instead of off-platform side deals. Absent = 100% to the talent payout account.",
          "items": {
            "type": "object",
            "additionalProperties": false,
            "required": ["payee_ref", "role", "share_bps"],
            "description": "One payout split line.",
            "properties": {
              "payee_ref": { "type": "string", "minLength": 1, "description": "Payout account reference (Stripe Connect account or platform payee id)." },
              "role": { "enum": ["talent", "agent_commission", "estate_beneficiary", "ip_co_owner", "union_trust", "embodied_performer"], "description": "Why this payee receives a share (agent_commission typically 1000-2000 bps; union_trust for P&H remittance where applicable; embodied_performer is REQUIRED when character_provenance.embodied_human_performer is true — performer compensation is a visible platform term, INV-013)." },
              "share_bps": { "$ref": "#/$defs/basis_points", "description": "Share of licensor-side net proceeds in basis points (rounding/remainder per INV-032)." }
            }
          }
        }
      },
      "allOf": [
        { "if": { "properties": { "identity_type": { "const": "human" } }, "required": ["identity_type"] }, "then": { "required": ["human_verification", "age_attestation"] } },
        { "if": { "properties": { "identity_type": { "const": "estate" } }, "required": ["identity_type"] }, "then": { "required": ["estate_authority"] } },
        { "if": { "properties": { "identity_type": { "const": "character" } }, "required": ["identity_type"] }, "then": { "required": ["character_provenance"] } }
      ]
    },
    "licensee": {
      "type": "object",
      "additionalProperties": false,
      "required": ["licensee_id", "legal_name", "entity_type", "verification_tier", "booked_via"],
      "description": "The party acquiring usage rights. Verification tier gates which use categories and approval paths are available; agentic bookings are first-class and auditable, never impersonation — the principal, not the agent, is the counterparty.",
      "properties": {
        "licensee_id": { "type": "string", "pattern": "^lce_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Stable Semblance identifier of the licensee account; the value matched against auto-approval allow/blocklists." },
        "legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the contracting individual or entity as it appears on the human-readable contract (the principal, where an AI agent transacts)." },
        "entity_type": { "enum": ["individual", "business", "platform_partner"], "description": "Kind of contracting party. 'platform_partner' marks generation platforms embedding the licensed catalog." },
        "verification_tier": { "$ref": "#/$defs/verification_tier", "description": "Licensee's current verification tier. Auto-approval compares this lexicographically against min_licensee_verification_tier; higher-risk use categories are gated to tier_3+ (INV-006)." },
        "verification_reference": {
          "type": "object",
          "additionalProperties": false,
          "required": ["provider", "reference_id"],
          "description": "Reference to the evidence backing the claimed verification tier.",
          "properties": {
            "provider": { "enum": ["persona", "onfido", "stripe_identity", "manual_review"], "description": "Verification vendor or process that established the tier." },
            "reference_id": { "type": "string", "minLength": 1, "description": "Opaque vendor/process reference for audit." },
            "verified_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp the tier was last (re)confirmed." }
          }
        },
        "jurisdiction": { "type": "string", "pattern": "^[A-Z]{2}$", "description": "ISO 3166-1 alpha-2 country of the licensee's incorporation/residence; feeds sanctions/eligibility screening, jurisdiction-specific contract clauses, and EU AI Act labeling." },
        "booked_via": { "enum": ["web", "api", "mcp_agent"], "description": "Channel through which the booking originated. 'mcp_agent' bookings require the agent_delegation block (root conditional in this def) and are subject to human-confirmation thresholds. NOT caller-asserted (INV-034): the platform derives this from the authenticated credential — any OAuth client registered as an autonomous agent is forced to 'mcp_agent' with full delegation; an agent presenting as 'api'/'web' to skip delegation and HITL thresholds is rejected platform-side." },
        "agent_delegation": {
          "type": "object",
          "additionalProperties": false,
          "required": ["agent_id", "principal_legal_name", "protocol"],
          "description": "Present when an AI agent transacts on the licensee's behalf via API/MCP. Proves delegated authority per agentic-commerce norms and names the principal who is legally bound — an agent cannot be the counterparty. Its absence means a human acted directly.",
          "properties": {
            "agent_id": { "type": "string", "minLength": 1, "description": "Stable identifier of the acting agent (OAuth client id or agent-registry id)." },
            "principal_legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the human or entity principal on whose behalf the agent acts and who is bound by this license (must match parties.licensee.legal_name)." },
            "protocol": { "enum": ["oauth2_delegated", "acp", "ucp", "ap2_mandate", "visa_trusted_agent", "mastercard_agent_pay", "x402", "other_signed_mandate"], "description": "Delegation/payment protocol under which the agent proved authority to bind and pay for the licensee." },
            "mandate_reference": { "type": "string", "description": "Opaque reference to the signed mandate/verifiable credential presented by the agent, stored for audit." },
            "human_confirmation_required_above": { "$ref": "#/$defs/money", "description": "Licensee-side (principal-set) total-fee threshold above which a human at the principal must confirm before execute_license completes, regardless of the talent's approval mode — the second half of the agentic HITL pattern (the licensor-side threshold lives in approval.human_confirmation_threshold)." }
          }
        },
        "brand": {
          "type": "object",
          "additionalProperties": false,
          "description": "The brand/product the likeness will actually promote or embody. Deal-critical: exclusivity and competitor blocks attach to the END brand, not the booking agency (INV-016).",
          "properties": {
            "brand_name": { "type": "string", "description": "Consumer-facing brand name the outputs will serve." },
            "industry_naics": { "type": "string", "pattern": "^[0-9]{2,6}$", "description": "NAICS 2022 code (2-6 digits) of the end brand's industry, used for deterministic exclusivity conflict checks and competitor-block prefix matching." }
          }
        },
        "is_agency_of_record": { "type": "boolean", "description": "True when the licensee is an agency booking on behalf of an end client. If true, end_client_legal_name is required (sibling conditional) and warranties flow through to the end client. This structure — not sublicensing — is how agency deals are papered." },
        "end_client_legal_name": { "type": "string", "minLength": 1, "description": "Legal name of the end client when booked through an agency. Exclusivity, category blocks, and endorsement rights are evaluated against this entity (INV-016)." }
      },
      "allOf": [
        { "if": { "properties": { "booked_via": { "const": "mcp_agent" } }, "required": ["booked_via"] }, "then": { "required": ["agent_delegation"] } },
        { "if": { "properties": { "is_agency_of_record": { "const": true } }, "required": ["is_agency_of_record"] }, "then": { "required": ["end_client_legal_name"] } }
      ]
    },
    "consent": {
      "type": "object",
      "additionalProperties": false,
      "required": ["consent_record_id", "consent_version", "captured_at", "method", "instrument_ref", "signatory", "intended_use", "statutory_bases", "representation", "revocable", "language", "grant_hash"],
      "description": "The structured consent instrument. Designed so an AB 2602-adequate 'reasonably specific description of intended uses' cannot be omitted: the intended_use block, its narrative minimum length, and enumerated deliverables are all required. Consent is per-license and per-version — never reused across licenses; renewals require a fresh record (INV-021) — and is cryptographically bound to the exact /grant object (grant_hash, INV-007). TWO EXECUTION MODELS, both explicit: for manual approvals the licensor signs against the final terms and captured_at is that signing; for auto_approve_within_parameters and standing_offer, the licensor PRE-SIGNS an advance instrument describing the authorized class of uses and reproducing the parameter envelope — captured_at is the advance signing, the machine executes under it, and advance_authorization (required, INV-023) binds this record to the exact /approval envelope. Nobody has to guess who 'executed' an auto-approved license or when consent happened.",
      "properties": {
        "consent_record_id": { "type": "string", "pattern": "^cst_[0-9A-HJKMNP-TV-Z]{26}$", "description": "Identifier of the stored, versioned, revocable consent record in the consent ledger." },
        "consent_version": { "type": "integer", "minimum": 1, "description": "Version of this consent record; increments whenever license_version increments (amended terms require re-consent). Prior versions are retained immutably." },
        "captured_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp the licensor executed the consent instrument. For advance authorizations (auto/standing modes) this is when the ADVANCE instrument was signed — always before machine execution (INV-023), never backdated or stamped at execution time." },
        "method": { "enum": ["qualified_electronic_signature", "electronic_signature", "wet_signature_scanned", "recorded_video_consent_plus_esignature"], "description": "How consent was executed. All methods produce a signed, hash-fixed instrument referenced by instrument_ref. Union work, estates, and some jurisdictions may require stronger formalities than click-through." },
        "instrument_ref": { "$ref": "#/$defs/evidence_ref", "description": "Evidence reference to the executed consent instrument itself — the writing a court reads. MUST contain the intended_use narrative and deliverables verbatim (INV-019)." },
        "signatory": {
          "type": "object",
          "additionalProperties": false,
          "required": ["role"],
          "description": "Who signed the consent and in what capacity; non-self signatories must prove authority.",
          "properties": {
            "role": { "enum": ["self", "estate_representative", "character_owner", "authorized_agent"], "description": "Capacity of the signatory: the individual themself ('self' — human licensors only), an estate representative, the character owner (REQUIRED role for identity_type 'character': the owning entity's signatory signs in this capacity), or an authorized agent of the licensor." },
            "authority_doc_ref": { "$ref": "#/$defs/evidence_ref", "description": "Document establishing the signatory's authority. Required for every role other than 'self' (sibling conditional). For character_owner this MAY reference the registry's onboarding chain-of-title summary — it binds this signatory to the verified owning entity and is not redundant with character_provenance." }
          },
          "allOf": [
            { "if": { "properties": { "role": { "enum": ["estate_representative", "character_owner", "authorized_agent"] } }, "required": ["role"] }, "then": { "required": ["authority_doc_ref"] } }
          ]
        },
        "intended_use": {
          "type": "object",
          "additionalProperties": false,
          "required": ["project_or_campaign_name", "narrative_description", "deliverables", "licensee_identity_disclosure"],
          "description": "The structurally forced 'reasonably specific description of intended uses' (Cal. Lab. Code 927 / AB 2602; IL and NY analogues). Generic grants ('any and all uses, in perpetuity, in all media') cannot validate: a named project, a substantive narrative, and enumerated deliverables are all mandatory. For ADVANCE authorizations (auto/standing modes) the named 'project' is the published envelope/offer itself and the narrative describes the authorized CLASS of uses with its hard parameter bounds; per-execution specifics are recorded in /campaign and disclosed at execution (INV-023). Jurisdiction-specific adequacy of class-level advance consent is a flagged v0.2 work item (see SPEC 'Known limitations').",
          "properties": {
            "project_or_campaign_name": { "type": "string", "minLength": 3, "description": "Name of the specific project, campaign, game, or persona deployment this consent covers — or, for advance authorizations, the name of the published parameter envelope / standing offer." },
            "narrative_description": { "type": "string", "minLength": 200, "maxLength": 5000, "description": "Plain-language narrative of exactly how the likeness will be used: what the outputs will depict, the context they appear in, the audience, and what the licensor will be shown saying or doing. For advance authorizations: the class of uses being pre-authorized and its bounds. Minimum 200 characters to force substantive specificity rather than boilerplate. Free text — used for the legal instrument, never for machine matching." },
            "deliverables": {
              "type": "array",
              "minItems": 1,
              "description": "Enumerated deliverables the consent covers. Each ties a concrete description to a media type and quantity estimate, mirroring the grant (INV-019).",
              "items": {
                "type": "object",
                "additionalProperties": false,
                "required": ["description", "media_type", "quantity_estimate"],
                "description": "One consented deliverable.",
                "properties": {
                  "description": { "type": "string", "minLength": 20, "description": "Concrete description of the deliverable (e.g. 'six 15-second vertical video ads for spring skincare launch')." },
                  "media_type": { "$ref": "#/$defs/media_type", "description": "Media modality of this deliverable; must be within grant.media_types (INV-019)." },
                  "quantity_estimate": { "type": "integer", "minimum": 1, "description": "Good-faith estimated count of outputs for this deliverable." }
                }
              }
            },
            "licensee_identity_disclosure": { "enum": ["disclosed_prior_to_consent", "disclosed_at_execution_per_advance_authorization"], "description": "How the licensor learns the licensee's verified identity. 'disclosed_prior_to_consent': shown before signing (required for manual approvals — root conditional). 'disclosed_at_execution_per_advance_authorization': the licensor pre-consented to a class of VERIFIED licensees (tier floor, allow/blocklists in the envelope) and is shown each executing licensee's verified identity at execution via dashboard and webhook (only valid with consent.advance_authorization, INV-023). Anonymous buyers cannot obtain a license under either value — identity verification precedes execution always." },
            "sample_outputs_ref": { "$ref": "#/$defs/evidence_ref", "description": "Optional reference to storyboards, scripts, or sample outputs shown to the licensor during consent, strengthening the specificity record." }
          }
        },
        "advance_authorization": {
          "type": "object",
          "additionalProperties": false,
          "required": ["envelope_signed_at", "approval_hash", "licensor_terms_ref"],
          "description": "Present exactly when this consent is an ADVANCE authorization for machine execution (approval.mode 'auto_approve_within_parameters' or 'standing_offer'; required from 'executed' onward for those modes — root conditional + INV-023). The instrument referenced by consent.instrument_ref IS the advance instrument: it reproduces the intended-use narrative, the full auto_approval_parameters, and any standing_offer verbatim. This block cryptographically pins that instrument to the exact /approval envelope, so 'the licensor pre-authorized THESE parameters' is machine-verifiable and any envelope change demands a fresh advance instrument.",
          "properties": {
            "envelope_signed_at": { "$ref": "#/$defs/utc_datetime", "description": "UTC timestamp the licensor signed the advance instrument. MUST equal consent.captured_at and precede any auto-executed transition (INV-023)." },
            "licensor_terms_ref": { "$ref": "#/$defs/evidence_ref", "description": "Hash-fixed reference to the licensor's PUBLISHED STANDING-TERMS document — the profile terms (content exclusions, platform allowlist, AI-disclosure terms, revocation elections, asset-handling regime, usage-reporting obligations, payout split) the licensor actually signed alongside the envelope. At every machine execution the platform verifies byte-equality of those talent-fixed blocks in the assembled license against this document (INV-029): approval_hash pins the ENVELOPE; this pins everything else the licensor fixed, so a buggy or compromised booking assembler cannot ship terms the licensor never saw." },
            "approval_hash": {
              "type": "object",
              "additionalProperties": false,
              "required": ["algorithm", "canonicalization", "value"],
              "description": "Hash binding of the advance instrument to the exact /approval object in force at execution (the envelope analogue of consent.grant_hash).",
              "properties": {
                "algorithm": { "const": "sha-256", "description": "Hash algorithm. Fixed in v0.1." },
                "canonicalization": { "const": "rfc8785_jcs", "description": "JSON canonicalization scheme applied to /approval before hashing (RFC 8785 JCS). Fixed in v0.1." },
                "value": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "Lowercase hex SHA-256 digest of the canonicalized /approval object." }
              }
            }
          }
        },
        "statutory_bases": {
          "type": "array",
          "minItems": 1,
          "uniqueItems": true,
          "items": { "enum": ["ca_lab_927_ab2602", "ca_civ_3344", "ca_civ_3344_1_postmortem", "il_ropa_digital_replica", "il_bipa_740_ilcs_14", "ny_crl_50f_postmortem", "ny_crl_52c_digital_replica", "tn_elvis_act", "no_fakes_act_draft", "eu_gdpr_art9_explicit_consent", "eu_ai_act_art50", "canada_quebec_civil_code_privacy", "canada_provincial_privacy_acts", "canada_common_law_personality", "japan_publicity_right_caselaw", "contract_and_ip_only_no_publicity_right", "other_state_rop", "other_national_regime"], "description": "One statutory or regulatory basis. US 'ca_' prefixes are California; Canadian regimes use 'canada_' ('canada_quebec_civil_code_privacy' = Quebec Civil Code arts. 3/35-36; 'canada_provincial_privacy_acts' = BC/SK/MB/NL statutory privacy torts; 'canada_common_law_personality' = appropriation-of-personality tort). 'japan_publicity_right_caselaw' covers the Japanese publicity right (Pink Lady line of cases). 'contract_and_ip_only_no_publicity_right' is the honest basis for pure character/IP deals resting on copyright, trademark, and contract rather than any personality right." },
          "description": "Statutes and regimes this consent record was drafted to satisfy, recorded so enforcement systems and takedown notices know which formalities were applied and which to cite. Cover the licensed TERRITORY's principal regimes, not only the forum's (a US-CA grant distributing into Canada should cite the Canadian bases)."
        },
        "representation": { "enum": ["legal_counsel", "union_cba_coverage", "unrepresented_specificity_relied_upon", "entity_licensor_not_applicable"], "description": "Whether the licensor was represented when consenting. Under Cal. Lab. Code 927, a digital-replica provision lacking reasonable specificity is unenforceable UNLESS the individual was represented by legal counsel or covered by a union CBA — this records which safe harbor (if any) applies in addition to the forced specificity above, proving enforceability either way. 'entity_licensor_not_applicable' is for character/estate ENTITY licensors licensing owned IP under business judgment, where the human-performer safe-harbor analysis does not apply (any embodied performer's own consent is separately recorded via character_provenance.embodied_performer.consent_ref). ROOT CONDITIONAL (0.1.2): a HUMAN licensor under a non-manual approval mode MUST record 'legal_counsel' or 'union_cba_coverage' — unrepresented class-level advance consent is unrepresentable until the fifty-state adequacy matrix lands." },
        "revocable": { "const": true, "description": "Constant true: consent is revocable per the /revocation block; a purported irrevocable consent cannot be expressed in this schema." },
        "language": { "type": "string", "pattern": "^[a-z]{2,3}(-[a-zA-Z0-9]{2,8})*$", "description": "BCP 47 language tag (lowercase-canonical primary subtag) of the consent instrument as presented to and executed by the signatory (e.g. 'en-US', 'es-MX'). Translations provided are referenced within the instrument." },
        "grant_hash": {
          "type": "object",
          "additionalProperties": false,
          "required": ["algorithm", "canonicalization", "value"],
          "description": "Cryptographic binding of the consent record to the exact /grant object consented to (INV-007). Makes 'the licensor consented to THESE specific terms' machine-verifiable at execution, and any post-consent tampering with the grant detectable.",
          "properties": {
            "algorithm": { "const": "sha-256", "description": "Hash algorithm. Fixed in v0.1." },
            "canonicalization": { "const": "rfc8785_jcs", "description": "JSON canonicalization scheme applied to /grant before hashing (RFC 8785 JCS). Fixed in v0.1 so independent implementations compute identical hashes." },
            "value": { "type": "string", "pattern": "^[a-f0-9]{64}$", "description": "Lowercase hex SHA-256 digest of the canonicalized /grant object." }
          }
        }
      }
    }
  }
}