{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://efij.github.io/AgentDFIR/schema/event.schema.json",
  "title": "AgentDFIR Normalized Event",
  "description": "One vendor-neutral forensic event in the AgentDFIR unified agent forensic schema. Large or sensitive content is never inlined; events reference raw evidence by artifact, offset and hash.",
  "type": "object",
  "required": ["event_id", "event_type", "source_artifact", "corroboration_state"],
  "properties": {
    "event_id": {"type": "string"},
    "case_id": {"type": "string"},
    "schema_version": {"type": "string"},
    "sequence": {"type": "integer", "description": "Monotonic per-package tie-breaker for identical/skewed timestamps."},
    "timestamp": {"type": "string", "description": "RFC 3339 event time."},
    "end_timestamp": {"type": "string", "description": "For span-shaped events (e.g. tool calls)."},
    "timestamp_source": {"type": "string"},
    "host": {"type": "string"},
    "user": {"type": "string"},
    "vendor": {"type": "string", "examples": ["anthropic", "openai"]},
    "product": {"type": "string", "examples": ["claude-code", "codex-cli"]},
    "product_version": {"type": "string"},
    "session_id": {"type": "string"},
    "agent_id": {"type": "string"},
    "parent_agent_id": {"type": "string"},
    "task_id": {"type": "string"},
    "actor_type": {"enum": ["human", "model", "agent", "system"]},
    "event_type": {"enum": ["human_prompt", "model_response", "tool_call", "tool_result", "agent_spawn", "agent_message", "session_meta", "trace_gap"]},
    "model": {"type": "string"},
    "tool": {"type": "string"},
    "tool_call_id": {"type": "string"},
    "mcp_server": {"type": "string"},
    "mcp_tool": {"type": "string"},
    "command": {"type": "string"},
    "file": {"type": "string"},
    "network_destination": {"type": "string"},
    "action": {"type": "string"},
    "result": {"type": "string"},
    "summary": {"type": "string", "description": "Short, sanitized extract. Never a full prompt/response body."},
    "source_artifact": {"type": "string", "description": "artifact_id (content SHA-256) in the sealed zone."},
    "source_logical_path": {"type": "string"},
    "source_offset": {"type": "integer"},
    "source_line": {"type": "integer"},
    "corroboration_state": {
      "enum": ["REQUESTED", "REPORTED", "OBSERVED", "PARTIALLY_CORROBORATED", "CORROBORATED", "CONTRADICTED", "UNKNOWN"],
      "description": "Evidence-vs-claims state. REPORTED = model narrative (not proof). OBSERVED = tool-call record present. CORROBORATED = independent endpoint evidence confirms."
    }
  }
}