{
  "$defs": {
    "DispositionAction": {
      "description": "Disposition action when retention expires.",
      "oneOf": [
        {
          "const": "crypto_erase",
          "description": "Cryptographic erase / DEK rotation.",
          "type": "string"
        },
        {
          "const": "physical_destruction",
          "description": "Physical destruction.",
          "type": "string"
        },
        {
          "const": "secure_wipe",
          "description": "Secure wipe.",
          "type": "string"
        },
        {
          "const": "anonymise",
          "description": "Anonymise (statistical aggregation preserved).",
          "type": "string"
        },
        {
          "const": "pseudonymise",
          "description": "Pseudonymise (linkability removed).",
          "type": "string"
        },
        {
          "const": "archive_cold_storage",
          "description": "Archive to cold storage.",
          "type": "string"
        },
        {
          "const": "transfer_out",
          "description": "Transfer to data-subject / counterparty.",
          "type": "string"
        },
        {
          "const": "no_action",
          "description": "No action — retain indefinitely (rare; must be justified).",
          "type": "string"
        }
      ]
    },
    "IsoDate": {
      "description": "ISO 8601 date (YYYY-MM-DD).",
      "format": "date",
      "type": "string"
    },
    "PathRef": {
      "description": "Path-based cross-reference relative to .corpospec/ root.\nPattern: `^[a-z0-9_-]+(/[a-z0-9_.-]+)+$`",
      "pattern": "^[a-z0-9_-]+(/[a-z0-9_.-]+)+$",
      "type": "string"
    },
    "RetentionRegime": {
      "description": "Regulatory regime.",
      "oneOf": [
        {
          "enum": [
            "other"
          ],
          "type": "string"
        },
        {
          "const": "gdpr",
          "description": "GDPR Art. 5(1)(e) storage-limitation principle.",
          "type": "string"
        },
        {
          "const": "de_hgb",
          "description": "DE HGB §257 commercial records.",
          "type": "string"
        },
        {
          "const": "de_ao",
          "description": "DE AO §147 tax records.",
          "type": "string"
        },
        {
          "const": "de_go_bd",
          "description": "DE GoBD (audit-grade retention).",
          "type": "string"
        },
        {
          "const": "de_b_url_g",
          "description": "DE BUrlG (vacation records).",
          "type": "string"
        },
        {
          "const": "de_betr_avg",
          "description": "DE BetrAVG (BAV — 30 years).",
          "type": "string"
        },
        {
          "const": "us_flsa",
          "description": "US FLSA (Fair Labor Standards Act).",
          "type": "string"
        },
        {
          "const": "us_irs",
          "description": "US IRS §6001 (3y income-tax records, 4y employment).",
          "type": "string"
        },
        {
          "const": "us_sox",
          "description": "US Sarbanes-Oxley §802.",
          "type": "string"
        },
        {
          "const": "uk_companies_act",
          "description": "UK Companies Act §388.",
          "type": "string"
        },
        {
          "const": "uk_hmrc",
          "description": "UK HMRC tax retention.",
          "type": "string"
        },
        {
          "const": "pci_dss",
          "description": "PCI DSS v4.0 retention.",
          "type": "string"
        },
        {
          "const": "hipaa",
          "description": "HIPAA 6-year retention (45 CFR §164.530(j)).",
          "type": "string"
        },
        {
          "const": "iso27001",
          "description": "ISO 27001 A.5.34 (records retention).",
          "type": "string"
        },
        {
          "const": "internal",
          "description": "Internal / contractual policy.",
          "type": "string"
        }
      ]
    },
    "RetentionTrigger": {
      "description": "Trigger that starts the retention clock.",
      "oneOf": [
        {
          "const": "creation",
          "description": "From creation date.",
          "type": "string"
        },
        {
          "const": "end_of_fiscal_year",
          "description": "From end of fiscal year (typical for HGB §257).",
          "type": "string"
        },
        {
          "const": "end_of_relationship",
          "description": "From end of contract / relationship.",
          "type": "string"
        },
        {
          "const": "last_activity",
          "description": "From last access / activity.",
          "type": "string"
        },
        {
          "const": "employee_separation",
          "description": "From employee separation.",
          "type": "string"
        },
        {
          "const": "customer_churn",
          "description": "From customer churn.",
          "type": "string"
        },
        {
          "const": "consent_withdrawal",
          "description": "From data-subject consent withdrawal.",
          "type": "string"
        },
        {
          "const": "statutory_event",
          "description": "From statutory event (audit close, legal hold release).",
          "type": "string"
        }
      ]
    },
    "ScheduleStatus": {
      "description": "Schedule lifecycle.",
      "enum": [
        "draft",
        "approved",
        "in_revision",
        "retired"
      ],
      "type": "string"
    }
  },
  "$id": "https://corpospec.com/schemas/v0.16.0/retention-schedule.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "One retention-schedule entry.",
  "properties": {
    "citation": {
      "type": "string"
    },
    "covers_assets": {
      "description": "PathRefs to asset_inventory entries this schedule covers.",
      "items": {
        "$ref": "#/$defs/PathRef"
      },
      "type": "array"
    },
    "data_category": {
      "description": "Data category narrative.",
      "type": "string"
    },
    "disposition": {
      "$ref": "#/$defs/DispositionAction",
      "description": "Disposition action on expiry."
    },
    "effective_from": {
      "$ref": "#/$defs/IsoDate"
    },
    "entity": {
      "$ref": "#/$defs/PathRef"
    },
    "id": {
      "$ref": "#/$defs/PathRef"
    },
    "justification": {
      "description": "Justification narrative (especially when retention exceeds\nstatutory floor).",
      "type": "string"
    },
    "name": {
      "type": "string"
    },
    "next_review_due": {
      "$ref": "#/$defs/IsoDate"
    },
    "owner": {
      "$ref": "#/$defs/PathRef"
    },
    "regime": {
      "$ref": "#/$defs/RetentionRegime",
      "description": "Statutory citation."
    },
    "retention_months": {
      "description": "Retention period in months.",
      "format": "int32",
      "type": "integer"
    },
    "ropa_refs": {
      "description": "PathRefs to ROPA entries that cite this schedule.",
      "items": {
        "$ref": "#/$defs/PathRef"
      },
      "type": "array"
    },
    "status": {
      "$ref": "#/$defs/ScheduleStatus"
    },
    "supports_legal_hold": {
      "description": "Whether the schedule supports legal-hold suspension.",
      "type": "boolean"
    },
    "trigger": {
      "$ref": "#/$defs/RetentionTrigger"
    }
  },
  "required": [
    "id",
    "entity",
    "status",
    "name",
    "data_category",
    "regime",
    "citation",
    "covers_assets",
    "trigger",
    "retention_months",
    "disposition",
    "supports_legal_hold",
    "justification",
    "owner",
    "effective_from",
    "next_review_due"
  ],
  "title": "RetentionSchedule",
  "type": "object",
  "x-corpospec-pillar": "privacy"
}