{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unfragile.ai/schema.json","title":"Unfragile Capability Protocol Schemas","description":"Versioned JSON Schemas for the Unfragile Capability Protocol. Two stable contracts: the unfragile.yml manifest (what builders publish) and the trust passport (what /api/v1/passport returns).","license":"CC-BY-4.0","licenseInfo":{"name":"Creative Commons Attribution 4.0 International","spdx":"CC-BY-4.0","url":"https://creativecommons.org/licenses/by/4.0/","summary":"The Unfragile Capability Protocol schemas are licensed CC-BY-4.0. You may read, write, validate, fork, embed, and extend them for any purpose — including commercially — provided you give attribution to Unfragile (unfragile.ai)."},"versions":{"unfragile_manifest":"1.0","trust_passport":"1.0","snapshot":"2026-05"},"schemas":{"unfragile_manifest_v1":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unfragile.ai/schema.json#unfragile_manifest_v1","title":"Unfragile Manifest","description":"Builder-publishable declaration of an AI artifact: identity, capabilities, conditions, trust signals, pricing, permissions, failure modes, compliance, and execution details. Place an unfragile.yml at the root of your repo and submit the URL via https://unfragile.ai/submit.","type":"object","required":["artifact","capabilities"],"properties":{"unfragile_version":{"type":"string","const":"1.0","description":"Manifest schema version. Currently '1.0'."},"artifact":{"type":"object","required":["name","slug","type","maintainer"],"properties":{"name":{"type":"string","minLength":1,"maxLength":200},"slug":{"type":"string","pattern":"^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$","description":"URL-safe identifier (lowercase, digits, hyphens)"},"type":{"type":"string","enum":["agent","model","mcp","repo","api","extension","workflow","product","app","webapp","prompt","skill","dataset","template","framework","cli","finetune","benchmark","platform"]},"maintainer":{"type":"string","minLength":1},"repository":{"type":"string","format":"uri"},"homepage":{"type":"string","format":"uri"},"license":{"type":"string"},"version":{"type":"string"},"description":{"type":"string","minLength":20,"maxLength":500}}},"capabilities":{"type":"array","minItems":1,"maxItems":50,"items":{"type":"object","required":["id","name","description","intents_served"],"properties":{"id":{"type":"string","pattern":"^[a-z0-9][a-z0-9._-]*$"},"name":{"type":"string","minLength":1,"maxLength":160},"description":{"type":"string","minLength":100,"maxLength":2000,"description":"Architecturally deep — describe HOW it works, not just what it claims"},"intents_served":{"type":"array","minItems":1,"maxItems":20,"items":{"type":"string"}},"conditions":{"type":"object","properties":{"bestFor":{"type":"array","items":{"type":"string"}},"limitations":{"type":"array","items":{"type":"string"}},"requires":{"type":"array","items":{"type":"string"}}}},"inputs":{"type":"array","items":{"type":"string"}},"outputs":{"type":"array","items":{"type":"string"}},"examples":{"type":"array","items":{"type":"string"}},"unique_aspect":{"type":"string"},"strength_vs_alternatives":{"type":"string"}}}},"trust":{"type":"object","properties":{"self_reported_metrics":{"type":"object","additionalProperties":{"type":["string","number","boolean"]}},"declared_score":{"type":"number","minimum":0,"maximum":100}}},"pricing":{"type":"object","required":["model"],"properties":{"model":{"type":"string","enum":["free","freemium","paid","usage","open-source"]},"tiers":{"type":"array","items":{"type":"object","required":["name"],"properties":{"name":{"type":"string"},"price":{"type":["number","string"]},"unit":{"type":"string"},"includes":{"type":"array","items":{"type":"string"}}}}},"currency":{"type":"string"},"starting_price":{"type":["number","string"]}}},"permissions":{"type":"array","items":{"type":"object","properties":{"data_access_types":{"type":"array","items":{"type":"string"}},"scopes":{"type":"array","items":{"type":"string"}},"sensitive_operations":{"type":"array","items":{"type":"string"}}}}},"failure_modes":{"type":"array","items":{"type":"object","required":["mode"],"properties":{"mode":{"type":"string"},"frequency":{"type":"string","enum":["rare","occasional","common","unknown"]},"mitigation":{"type":"string"}}}},"compliance":{"type":"object","properties":{"jurisdictions":{"type":"array","items":{"type":"string"}},"certifications":{"type":"array","items":{"type":"string"}},"data_residency":{"type":"string"}}},"execution":{"type":"object","properties":{"endpoint":{"type":"string","format":"uri"},"protocol":{"type":"string","enum":["http","https","mcp","stdio","websocket","grpc"]},"auth_method":{"type":"string","enum":["none","api-key","oauth2","bearer","basic","custom"]},"invocation":{"type":"string"}}}},"license":"CC-BY-4.0"},"trust_passport_v1":{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unfragile.ai/schema.json#trust_passport_v1","title":"Unfragile Trust Passport","description":"Machine-readable trust passport for AI artifacts: identity, capabilities, constraints, permissions, observed match outcomes, and UnfragileRank evidence. Served by /api/v1/passport/[slug]. Stable contract version is '@version'.","type":"object","required":["unfragile"],"properties":{"unfragile":{"type":"object","required":["@version","version","artifact","capabilities","trust"],"properties":{"@version":{"type":"string","const":"1.0","description":"Semver-style trust-passport contract version. Stable across non-breaking changes."},"version":{"type":"string","examples":["2026-05"],"description":"Dated snapshot ID (YYYY-MM)"},"artifact":{"type":"object","required":["id","slug","name","type","url","page_url","status","verified"],"properties":{"id":{"type":"string"},"slug":{"type":"string"},"name":{"type":"string"},"type":{"type":"string","enum":["product","agent","mcp","api","repo","prompt","skill","extension","workflow","model","dataset","template","app","webapp","framework","cli","finetune","benchmark","platform"]},"url":{"type":"string","format":"uri"},"page_url":{"type":"string","format":"uri"},"categories":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}},"status":{"type":"string","enum":["active","stale","dead","pending_review"]},"verified":{"type":"boolean"}}},"capabilities":{"type":"array","items":{"type":"object","required":["id","uri","name","description","intents","confidence"],"properties":{"id":{"type":"string"},"uri":{"type":"string","pattern":"^capability://"},"name":{"type":"string"},"description":{"type":"string"},"intents":{"type":"array","items":{"type":"string"}},"best_for":{"type":"array","items":{"type":"string"}},"limitations":{"type":"array","items":{"type":"string"}},"requires":{"type":"array","items":{"type":"string"}},"input_types":{"type":"array","items":{"type":"string"}},"output_types":{"type":"array","items":{"type":"string"}},"categories":{"type":"array","items":{"type":"string"}},"confidence":{"type":"number","minimum":0,"maximum":1},"matches":{"type":"integer","minimum":0},"success_rate":{"type":"number","minimum":0,"maximum":1}}}},"trust":{"type":"object","required":["score","verified","data_access_risk","permissions","failure_modes"],"properties":{"score":{"type":"integer","minimum":1,"maximum":100},"verified":{"type":"boolean"},"data_access_risk":{"type":"string","enum":["low","moderate","high"]},"permissions":{"type":"array","items":{"type":"string"}},"failure_modes":{"type":"array","items":{"type":"string"}},"observed_outcomes":{"type":"object"},"maintenance":{"type":"object"},"community":{"type":"object"}}}}}},"license":"CC-BY-4.0"}},"conformance":{"algorithm":"ed25519","canonicalization":{"recipe":["Take the signed passport object (response.passport from /api/v1/passport/[slug]).","Remove the four envelope fields: signature, signedAt, signedBy, version.","Serialize the remaining object as deterministic JSON with recursively sorted keys (RFC-8785-style; implemented here via safe-stable-stringify).","UTF-8 encode that string to bytes.","ed25519.verify(base64Decode(signature), bytes, base64Decode(publicKey)) MUST return true."],"serializer":"safe-stable-stringify (sorted keys, standard JSON separators, no extra whitespace)","signed_input":"the bare payload bytes (envelope fields stripped)"},"publicKey":{"source":"https://unfragile.ai/api/v1/trust-passport-public-key","field":"publicKey","format":"32-byte raw Ed25519 public key, base64"},"runnableCheck":{"description":"Authoritative, always-current interop test: fetch a live signed passport and verify response.passport against the published public key.","fetch":"https://unfragile.ai/api/v1/passport/cursor","verifyAgainst":"response.passport","expected":true},"frozenVector":{"status":"TEMPLATE — signature not yet filled by maintainer","note":"Self-consistent frozen vector. Maintainer: sign the canonical bytes of `payload` (after stripping envelope fields, sorted-key JSON, UTF-8) with the production private key and replace `signature` with the base64 result. publicKey must equal the live /api/v1/trust-passport-public-key value at signing time. Do not invent a signature.","payload":{"unfragile":{"@version":"1.0","version":"2026-05","artifact":{"id":"conformance-vector","slug":"conformance-vector","name":"Conformance Vector","type":"mcp","url":"https://example.com/conformance-vector","page_url":"https://unfragile.ai/conformance-vector","categories":["tool-use-integration"],"tags":["conformance","test-vector"],"status":"active","verified":false},"capabilities":[],"trust":{"score":1,"verified":false,"data_access_risk":"low","permissions":[],"failure_modes":["fixed conformance vector — not a real artifact"]}}},"signature":null,"publicKey":null,"expectedVerification":true}},"_links":{"protocol":"https://unfragile.ai/protocol","schema_docs":"https://unfragile.ai/schema","validate":"https://unfragile.ai/api/v1/validate","passport_example":"https://unfragile.ai/api/v1/passport/cursor","public_key":"https://unfragile.ai/api/v1/trust-passport-public-key","conformance":"https://unfragile.ai/trust#conformance","license":"https://creativecommons.org/licenses/by/4.0/","builder_guide":"https://unfragile.ai/docs/protocol"}}