# Portable AATS records

These JSON Schema Draft 2020-12 files describe interoperable v0.9 exports. They do not mandate a storage vendor or signing service. A conforming producer MUST validate records before export. Consumers MUST reject unknown certificate state values, verify signatures using trusted issuer keys, check expiry and revocation through a current status source, and match the certificate scope to the action or system being evaluated. Schemas validate structure, not truth of evidence or issuer independence.

| Schema | Purpose |
|---|---|
| `scope.schema.json` | Declared deployment boundary and capability |
| `evidence.schema.json` | Integrity-protected control evidence reference |
| `state-event.schema.json` | Explainable certification transition |
| `certificate.schema.json` | Independent assurance decision and live status |
| `passport.schema.json` | Human/machine-readable summarized trust claims |

`signature` is an object with `alg`, `key_id`, and base64url `value`. The signed payload and canonicalization profile MUST be specified by the issuer; v0.9 examples use a detached JSON canonicalization convention in metadata, but production interoperability requires a final v1 signature profile. Do not treat schema validation as signature validation.