{
  "title": "Bounded incident evidence",
  "type": "object",
  "additionalProperties": false,
  "properties": {
    "question": {"type": "string", "minLength": 1},
    "observations": {
      "type": "array",
      "maxItems": 100,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {
          "id": {"type": "string", "minLength": 1},
          "timestamp": {"type": ["string", "null"]},
          "source": {"type": "string", "minLength": 1},
          "sha256": {"type": ["string", "null"], "pattern": "^[0-9a-f]{64}$"},
          "observation": {"type": "string", "minLength": 1}
        },
        "required": ["id", "timestamp", "source", "sha256", "observation"]
      }
    },
    "commands": {
      "type": "array",
      "maxItems": 30,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "properties": {"command": {"type": "string", "minLength": 1}, "exit_code": {"type": "integer"}, "observation": {"type": "string", "minLength": 1}},
        "required": ["command", "exit_code", "observation"]
      }
    },
    "contradictions": {"type": "array", "items": {"type": "string"}, "maxItems": 30},
    "gaps": {"type": "array", "items": {"type": "string"}, "maxItems": 30}
  },
  "required": ["question", "observations", "commands", "contradictions", "gaps"]
}