{
  "$defs": {
    "FinalDisposition": {
      "description": "Final disposition.",
      "oneOf": [
        {
          "const": "no_action",
          "description": "No action — unsubstantiated.",
          "type": "string"
        },
        {
          "const": "remedial_action",
          "description": "Remedial action taken (corrective).",
          "type": "string"
        },
        {
          "const": "disciplinary_action",
          "description": "Disciplinary action against responsible party.",
          "type": "string"
        },
        {
          "const": "termination",
          "description": "Termination of responsible party.",
          "type": "string"
        },
        {
          "const": "authority_notified",
          "description": "Reported to authority.",
          "type": "string"
        },
        {
          "const": "settlement",
          "description": "Settlement / restitution paid.",
          "type": "string"
        },
        {
          "const": "systemic_change",
          "description": "Policy / control change.",
          "type": "string"
        }
      ]
    },
    "IsoDate": {
      "description": "ISO 8601 date (YYYY-MM-DD).",
      "format": "date",
      "type": "string"
    },
    "PathRef": {
      "description": "Path-based cross-reference relative to .corpospec/ root.\nPattern: `^[a-z0-9_-]+(/[a-z0-9_.-]+)+$`",
      "pattern": "^[a-z0-9_-]+(/[a-z0-9_.-]+)+$",
      "type": "string"
    },
    "PiiClass": {
      "description": "Personal-data classification on every record carrying personal data, per\nBDR 0070 / BDR 0069 / BDR 0078. Used by `corpospec-report` to gate\nrendering and by the privacy pillar's RoPA records to determine\nsafeguards.",
      "oneOf": [
        {
          "const": "none",
          "description": "No personal data.",
          "type": "string"
        },
        {
          "const": "public_personal",
          "description": "Public personal data (already disclosed by the subject, e.g. CEO name).",
          "type": "string"
        },
        {
          "const": "internal",
          "description": "Internal-only personal data (employee directory).",
          "type": "string"
        },
        {
          "const": "personal",
          "description": "Personal data per GDPR Art. 4(1).",
          "type": "string"
        },
        {
          "const": "special_category",
          "description": "Special-category data per GDPR Art. 9 (health, biometric, genetic,\nreligion, ethnicity, sex life, political opinion, trade union).",
          "type": "string"
        },
        {
          "const": "criminal_data",
          "description": "Criminal data per GDPR Art. 10.",
          "type": "string"
        },
        {
          "const": "sensitive",
          "description": "CCPA / CPRA \"sensitive personal information\".",
          "type": "string"
        }
      ]
    },
    "ReportChannel": {
      "description": "Receipt channel.",
      "oneOf": [
        {
          "const": "internal_channel",
          "description": "Internal channel (designated officer / hotline).",
          "type": "string"
        },
        {
          "const": "external_authority",
          "description": "External authority (BAFA, BaFin, EU OLAF, etc.).",
          "type": "string"
        },
        {
          "const": "public_disclosure",
          "description": "Public disclosure (Art. 15 EU 2019/1937 conditions).",
          "type": "string"
        },
        {
          "const": "vendor_portal",
          "description": "Pseudonymous via vendor (EQS Integrity Line, etc.).",
          "type": "string"
        }
      ]
    },
    "ReportSubject": {
      "description": "Subject-matter area.",
      "oneOf": [
        {
          "enum": [
            "other"
          ],
          "type": "string"
        },
        {
          "const": "financial",
          "description": "Financial misconduct, fraud.",
          "type": "string"
        },
        {
          "const": "anti_money_laundering",
          "description": "Money laundering / sanctions (GwG / EU 6AMLD).",
          "type": "string"
        },
        {
          "const": "bribery",
          "description": "Bribery & corruption.",
          "type": "string"
        },
        {
          "const": "data_protection",
          "description": "GDPR data-protection breach.",
          "type": "string"
        },
        {
          "const": "product_safety",
          "description": "Product safety / quality.",
          "type": "string"
        },
        {
          "const": "occupational_safety",
          "description": "Health & safety at work.",
          "type": "string"
        },
        {
          "const": "environment",
          "description": "Environment / pollution.",
          "type": "string"
        },
        {
          "const": "harassment",
          "description": "Workplace harassment, discrimination, bullying.",
          "type": "string"
        },
        {
          "const": "market_abuse",
          "description": "Insider trading / market manipulation.",
          "type": "string"
        },
        {
          "const": "sexual_misconduct",
          "description": "Sexual misconduct.",
          "type": "string"
        },
        {
          "const": "supply_chain",
          "description": "LkSG / CSDDD supply-chain breach.",
          "type": "string"
        },
        {
          "const": "retaliation",
          "description": "Whistleblower-protection breach (retaliation).",
          "type": "string"
        }
      ]
    },
    "RetaliationCheck": {
      "description": "Retaliation check (Art. 19 EU 2019/1937 prohibits).",
      "properties": {
        "conducted_by": {
          "$ref": "#/$defs/PathRef"
        },
        "conducted_on": {
          "$ref": "#/$defs/IsoDate"
        },
        "corrective_action": {
          "description": "If observed — corrective action narrative.",
          "type": [
            "string",
            "null"
          ]
        },
        "retaliation_observed": {
          "type": "boolean"
        }
      },
      "required": [
        "conducted_on",
        "conducted_by",
        "retaliation_observed"
      ],
      "type": "object"
    },
    "WhistleblowerStatus": {
      "description": "Report lifecycle.",
      "oneOf": [
        {
          "enum": [
            "received",
            "acknowledged",
            "under_investigation",
            "substantiated",
            "unsubstantiated",
            "withdrawn"
          ],
          "type": "string"
        },
        {
          "const": "closed_inconclusive",
          "description": "Closed without conclusion (e.g. inadequate facts).",
          "type": "string"
        },
        {
          "const": "escalated",
          "description": "Forwarded to external authority.",
          "type": "string"
        }
      ]
    }
  },
  "$id": "https://corpospec.com/schemas/v0.16.0/whistleblower-report.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "Whistleblower report record.",
  "properties": {
    "ack_deadline": {
      "$ref": "#/$defs/IsoDate",
      "description": "Statutory acknowledgement deadline (received_at + 7d)."
    },
    "acknowledged_on": {
      "anyOf": [
        {
          "$ref": "#/$defs/IsoDate"
        },
        {
          "type": "null"
        }
      ]
    },
    "channel": {
      "$ref": "#/$defs/ReportChannel"
    },
    "disposition_narrative": {
      "type": [
        "string",
        "null"
      ]
    },
    "entity": {
      "$ref": "#/$defs/PathRef"
    },
    "evidence_refs": {
      "description": "PathRefs to evidence collected.",
      "items": {
        "$ref": "#/$defs/PathRef"
      },
      "type": "array"
    },
    "final_disposition": {
      "anyOf": [
        {
          "$ref": "#/$defs/FinalDisposition"
        },
        {
          "type": "null"
        }
      ],
      "description": "Disposition + supporting narrative."
    },
    "follow_up_refs": {
      "description": "PathRefs to follow-up corrective measures / policies updated.",
      "items": {
        "$ref": "#/$defs/PathRef"
      },
      "type": "array"
    },
    "id": {
      "$ref": "#/$defs/PathRef"
    },
    "investigation_owner": {
      "$ref": "#/$defs/PathRef"
    },
    "leadership_involved": {
      "description": "Whether the report involved senior leadership (escalates\nreporting line per HinSchG §15 — keeps reporter outside the\norg chart of the alleged perpetrator).",
      "type": "boolean"
    },
    "pii_class": {
      "$ref": "#/$defs/PiiClass"
    },
    "received_at": {
      "$ref": "#/$defs/IsoDate"
    },
    "reporter_anonymous": {
      "description": "Whether the reporter chose to remain anonymous.",
      "type": "boolean"
    },
    "reporter_pseudonym": {
      "description": "Pseudonymised reporter handle (when anonymous, a stable token\nthe reporter receives for follow-up).",
      "type": [
        "string",
        "null"
      ]
    },
    "responded_on": {
      "anyOf": [
        {
          "$ref": "#/$defs/IsoDate"
        },
        {
          "type": "null"
        }
      ]
    },
    "response_deadline": {
      "$ref": "#/$defs/IsoDate",
      "description": "Statutory response deadline (received_at + 3m / extendable to 6m)."
    },
    "response_extended_to_6m": {
      "description": "Whether the 3-month deadline was extended to 6 months.",
      "type": "boolean"
    },
    "retaliation_checks": {
      "description": "Retaliation checks (multiple over time per Art. 19).",
      "items": {
        "$ref": "#/$defs/RetaliationCheck"
      },
      "type": "array"
    },
    "retention_until": {
      "$ref": "#/$defs/IsoDate",
      "description": "Retention 3 years after closure (Art. 18 EU 2019/1937 — record\nonly as long as needed)."
    },
    "status": {
      "$ref": "#/$defs/WhistleblowerStatus"
    },
    "subject": {
      "$ref": "#/$defs/ReportSubject"
    },
    "summary_redacted": {
      "description": "Free-form summary (redacted of identifying details).",
      "type": "string"
    }
  },
  "required": [
    "id",
    "entity",
    "channel",
    "subject",
    "reporter_anonymous",
    "status",
    "summary_redacted",
    "received_at",
    "ack_deadline",
    "response_deadline",
    "response_extended_to_6m",
    "investigation_owner",
    "retaliation_checks",
    "leadership_involved",
    "retention_until",
    "pii_class"
  ],
  "title": "WhistleblowerReport",
  "type": "object",
  "x-corpospec-pillar": "legal"
}