{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "CodeSecurityResult",
  "type": "object",
  "required": [
    "risk_summary",
    "vulnerabilities",
    "fix_plan",
    "compliance_notes",
    "need_security_review",
    "report_markdown"
  ],
  "properties": {
    "insufficient_context": { "type": "boolean" },
    "risk_summary": { "type": "string" },
    "vulnerabilities": {
      "type": "array",
      "items": {
        "type": "object",
        "required": ["type", "severity", "status", "file", "line", "rule_id", "description", "evidence", "impact", "fix_suggestion"],
        "properties": {
          "type": { "type": "string" },
          "severity": { "type": "string", "enum": ["critical", "high", "medium", "low", "info"] },
          "status": { "type": "string", "enum": ["confirmed", "suspicious", "false_positive_candidate"] },
          "tool": { "type": "string" },
          "file": { "type": "string" },
          "line": { "type": "number" },
          "rule_id": { "type": "string" },
          "description": { "type": "string" },
          "evidence": { "type": "string" },
          "impact": { "type": "string" },
          "fix_suggestion": { "type": "string" },
          "safe_example": { "type": "string" }
        }
      }
    },
    "fix_plan": { "type": "array", "items": { "type": "string" } },
    "compliance_notes": { "type": "array", "items": { "type": "string" } },
    "need_security_review": { "type": "boolean" },
    "confidence": { "type": "string", "enum": ["high", "medium", "low"] },
    "evidence": { "type": "array", "items": { "type": "string" } },
    "report_markdown": { "type": "string" }
  }
}