Scan attestation predicate (/scan/v1)

• 1. Property scanner
  • 1.1. Property name
  • 1.2. Property version
• 2. Property format
• 3. Property summary
  • 3.1. Property additionalProperties
• 4. Property report_digest
• 5. Property attested_at
• 6. Property builder_id

Title: Scan attestation predicate (/scan/v1)

Type	object
Required	No
Additional properties	Not allowed

Description: houba's normalized scan summary — the signed, verifiable form of io.houba.scan.*.

Property	Pattern	Type	Deprecated	Definition	Title/Description
+ scanner	No	object	No	In #/$defs/Scanner	Scanner
+ format	No	string	No	-	Format
+ summary	No	object	No	-	Summary
+ report_digest	No	string	No	-	Report Digest
+ attested_at	No	string	No	-	Attested At
+ builder_id	No	string	No	-	Builder Id

1. Property scanner

Title: Scanner

Type	object
Required	Yes
Additional properties	Not allowed
Defined in	#/$defs/Scanner

Description: The upstream scanner that produced the report (houba did not run it).

Property	Pattern	Type	Deprecated	Definition	Title/Description
+ name	No	string	No	-	Name
+ version	No	string	No	-	Version

1.1. Property name

Title: Name

Type	string
Required	Yes

1.2. Property version

Title: Version

Type	string
Required	Yes

2. Property format

Title: Format

Type	string
Required	Yes

3. Property summary

Title: Summary

Type	object
Required	Yes
Additional properties	Each additional property must conform to the schema

Property	Pattern	Type	Deprecated	Definition	Title/Description
-	No	string	No	-	-

3.1. Property additionalProperties

Type	string
Required	No

4. Property report_digest

Title: Report Digest

Type	string
Required	Yes

5. Property attested_at

Title: Attested At

Type	string
Required	Yes

Description: ISO-8601 timestamp of when houba attached and signed this scan. The freshness clock: an admission controller enforces a max-age policy against it (admit only if now - attested_at <= max-age). This signed field is the only trustworthy freshness source — not the unsigned scan-timestamp annotation (the HOUBA_LABEL_PREFIX-prefixed key, e.g. io.houba.scan.timestamp), which exists only for gc.

6. Property builder_id

Title: Builder Id

Type	string
Required	Yes

---