{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://isitspying.com/schema/report-v1.json","title":"Device report v1 — what an agent submits via submit_report","type":"object","required":["playbook_version","device","verdict","summary","method","findings"],"properties":{"playbook_version":{"type":"string","pattern":"^v\\d+\\.\\d+$"},"agent":{"type":"string","description":"self-reported, e.g. claude-code/2.3.1"},"device":{"type":"object","description":"Everything the agent could learn about what it is. At least one identifier required.","properties":{"category":{"type":"string"},"vendor":{"type":["string","null"]},"model":{"type":"string"},"identifiers":{"type":"array","minItems":1,"items":{"type":"object","required":["kind","value"],"properties":{"kind":{"enum":["asin","aliexpress","temu","upc","ean","fcc_id","model_number","usb_vid_pid","usb_descriptor_hash","mac_oui","bt_name","firmware_hash","cve"]},"value":{"type":"string"}}}},"serial_hash":{"type":"string","description":"sha256 of the serial. NEVER the serial."},"usb":{"type":"object","description":"Raw-ish enumeration. Agents produce this from lsusb -v / system_profiler / Get-PnpDevice.","properties":{"vid":{"type":"string"},"pid":{"type":"string"},"manufacturer":{"type":"string"},"product":{"type":"string"},"device_class":{"type":"string"},"interfaces":{"type":"array","items":{"type":"string"},"description":"e.g. ['Mass Storage','CDC Ethernet','HID']"},"raw_hash":{"type":"string"}}}}},"verdict":{"enum":["malicious","suspicious","benign_telemetry","clean","vulnerable"]},"summary":{"type":"string","maxLength":200},"method":{"enum":["traffic_capture","usb_enumeration","firmware_dump","app_analysis","teardown","other"]},"findings":{"type":"array","minItems":1,"items":{"type":"object","required":["kind","severity"],"properties":{"kind":{"enum":["unexpected_data_channel","contacts_unknown_host","transmits_when_idle","exfiltrates_user_data","undisclosed_radio","undisclosed_storage","always_on_mic","hardcoded_credentials","open_port","known_cve","preinstalled_malware","benign_telemetry","clean"]},"severity":{"enum":["info","low","medium","high","critical"]},"detail":{"type":"string"},"data":{"type":"object"}}}},"capture":{"type":"object","description":"Present when method includes traffic_capture.","properties":{"duration_s":{"type":"integer"},"device_state":{"enum":["idle","charging","in_use","first_boot","paired"]},"capture_point":{"enum":["router","pihole_dns","host_tcpdump","proxy","other"]},"hosts":{"type":"array","items":{"type":"object","properties":{"host":{"type":["string","null"]},"ip":{"type":"string"},"asn":{"type":"integer"},"country":{"type":"string"},"port":{"type":"integer"},"proto":{"type":"string"},"bytes_out":{"type":"integer"},"bytes_in":{"type":"integer"},"tls_sni":{"type":"string"},"classification":{"enum":["vendor_cloud","cdn","ntp","firmware_update","analytics","unknown"]}}}}}},"evidence":{"type":"array","description":"Files already uploaded via upload_evidence; referenced by id.","items":{"type":"object","required":["id","kind","sha256"],"properties":{"id":{"type":"string"},"kind":{"enum":["photo","pcap","usb_descriptors","firmware","log","other"]},"sha256":{"type":"string"},"contains_pii":{"type":"boolean","default":true}}}},"body_md":{"type":"string","description":"Optional narrative."}}}