{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://mandatelaw.ai/api/intake-schema.json",
  "title": "Product intake",
  "description": "Facts about the product, answered by the coding agent from the codebase wherever possible. Each answer is a Fact: a value plus where it came from. Counsel drafts the documents to match what the code actually does, so an answer verified in code is worth far more than an assumption. If you cannot verify something, say so; 'unknown' is a useful answer.",
  "type": "object",
  "required": ["matter_id", "product", "data", "integrations", "analytics", "accounts", "jurisdictions"],
  "properties": {
    "matter_id": {"type": "string", "description": "From request_engagement. Intake is refused without a signed engagement."},
    "product": {
      "type": "object",
      "properties": {
        "summary": {"$ref": "#/$defs/fact", "description": "One paragraph: what the product does, for whom."},
        "platforms": {"$ref": "#/$defs/fact", "description": "e.g. iOS, Android, web, Mac."},
        "distribution": {"$ref": "#/$defs/fact", "description": "App Store, Google Play, web, enterprise."},
        "monetization": {"$ref": "#/$defs/fact", "description": "Free, in-app subscription, web checkout, ads. Trial terms. Is cancellation reachable from Settings?"},
        "minimum_age": {"$ref": "#/$defs/fact", "description": "Is there an age gate? What age? Is the app marketed to teens or students?"},
        "existing_documents": {"$ref": "#/$defs/fact", "description": "URLs or paths of current policies and terms."},
        "roadmap": {"$ref": "#/$defs/fact", "description": "Planned features, near term and later. Used to write counsel triggers."}
      }
    },
    "data": {
      "type": "object",
      "description": "What users enter or the app collects. For each category, say whether it is stored on your servers or stays on the device.",
      "properties": {
        "health": {"$ref": "#/$defs/fact", "description": "Moods, habits, medications, appointments, symptoms, journaling about health. Broadly defined under Washington's My Health My Data Act."},
        "financial": {"$ref": "#/$defs/fact", "description": "Budgets, balances, linked accounts or cards."},
        "precise_location": {"$ref": "#/$defs/fact", "description": "Does any code or SDK request location permission or collect latitude/longitude? IP-derived location is not precise location."},
        "photos": {"$ref": "#/$defs/fact", "description": "Photo uploads. Is EXIF/GPS metadata stripped before storage?"},
        "contacts_mic_camera": {"$ref": "#/$defs/fact"},
        "free_text": {"$ref": "#/$defs/fact", "description": "Journals, notes, chat. Where is it stored?"},
        "storage_location": {"$ref": "#/$defs/fact", "description": "Database and region (e.g. Supabase, us-east-1). Any data stored outside the US?"}
      }
    },
    "integrations": {
      "type": "array",
      "description": "Each third-party account the app connects to (Google Calendar, Google Tasks, Apple EventKit, HealthKit, Plaid...).",
      "items": {
        "type": "object",
        "properties": {
          "service": {"type": "string"},
          "scopes_or_permissions": {"$ref": "#/$defs/fact"},
          "data_reaches_our_servers": {"$ref": "#/$defs/fact", "description": "Or does it stay on the device?"},
          "on_disconnect_in_app": {"$ref": "#/$defs/fact", "description": "What is deleted from your servers, as opposed to hidden in the app? Tokens? Webhooks/watch channels? Imported items?"},
          "on_revocation_outside_app": {"$ref": "#/$defs/fact", "description": "User revokes access in iOS Settings or the provider's permissions page. When does the app detect it, and what happens?"},
          "items_created_in_app_and_synced_out": {"$ref": "#/$defs/fact"}
        }
      }
    },
    "analytics": {
      "type": "object",
      "properties": {
        "sdks": {"$ref": "#/$defs/fact", "description": "Analytics, attribution, crash reporting, subscription SDKs, with versions."},
        "session_replay": {"$ref": "#/$defs/fact", "description": "Enabled in code? In the vendor's project settings? Quote the config."},
        "autocapture": {"$ref": "#/$defs/fact", "description": "Screen views, lifecycle events, taps, element interactions. Quote the config."},
        "events": {"$ref": "#/$defs/fact", "description": "Every named event and every property it carries. Flag any property containing something a user typed, selected, or uploaded."},
        "initialized_before_consent": {"$ref": "#/$defs/fact", "description": "Does any SDK send network traffic before the user accepts the terms?"},
        "user_identifier": {"$ref": "#/$defs/fact", "description": "Random ID, email, name, device ID?"},
        "crash_reports_contain_content": {"$ref": "#/$defs/fact"}
      }
    },
    "accounts": {
      "type": "object",
      "properties": {
        "sign_in_methods": {"$ref": "#/$defs/fact"},
        "in_app_account_deletion": {"$ref": "#/$defs/fact", "description": "Apple requires real deletion, not deactivation. What rows and vendor records are removed? Is third-party access revoked?"},
        "deletion_timeline_and_backups": {"$ref": "#/$defs/fact"},
        "consent_screens": {"$ref": "#/$defs/fact", "description": "Current onboarding checkboxes and their wording. Any pre-checked boxes? Any bundled consents?"},
        "marketing_opt_in": {"$ref": "#/$defs/fact"},
        "inactivity_closure": {"$ref": "#/$defs/fact"}
      }
    },
    "ai": {"$ref": "#/$defs/ai_feature"},
    "agent": {"$ref": "#/$defs/agent_product"},
    "jurisdictions": {"$ref": "#/$defs/fact", "description": "Where users are, or where you will market. US states, EU/UK, elsewhere."},
    "agent_environment": {"$ref": "#/$defs/fact", "description": "The agent sending this intake: which model provider and account tier it runs on (API, business, enterprise, or consumer), whether that account allows training on your data, and its data-retention setting. Counsel uses this to keep communications privileged."},
    "questions_from_client": {"type": "array", "items": {"type": "string"}, "description": "What the founder is worried about, in their words."}
  },
  "$defs": {
    "fact": {
      "type": "object",
      "required": ["value", "source"],
      "properties": {
        "value": {"description": "The answer. Use the string 'unknown' if it cannot be determined."},
        "source": {
          "enum": ["verified_in_code", "verified_in_running_build", "vendor_dashboard", "stated_by_client", "inferred", "unknown"],
          "description": "How you know. Prefer verified_in_code or verified_in_running_build."
        },
        "evidence": {
          "type": "array",
          "description": "File paths with line numbers and short config excerpts. No secrets, keys, or user data.",
          "items": {"type": "object", "properties": {"path": {"type": "string"}, "lines": {"type": "string"}, "excerpt": {"type": "string", "maxLength": 600}}}
        },
        "notes": {"type": "string"}
      }
    },
    "ai_feature": {
      "type": "object",
      "properties": {
        "features": {"$ref": "#/$defs/fact", "description": "Insights, summaries, chat, agents. What user data goes into prompts?"},
        "providers": {"$ref": "#/$defs/fact", "description": "Model providers and the API tier or plan in use."},
        "training_and_retention": {"$ref": "#/$defs/fact", "description": "Does the provider train on or retain inputs? Is zero-data-retention configured?"},
        "outputs_affect_users": {"$ref": "#/$defs/fact", "description": "Do outputs make or influence decisions about people (employment, credit, housing, health, education)?"},
        "user_facing_disclosure": {"$ref": "#/$defs/fact"},
        "companion_or_emotional_use": {"$ref": "#/$defs/fact", "description": "Is the AI presented as a companion, coach, or confidant? Could minors use it?"},
        "prompt_and_output_logging": {"$ref": "#/$defs/fact", "description": "What is logged, where, for how long, and who can read it."}
      }
    },
    "agent_product": {
      "type": "object",
      "description": "For products that take actions for users.",
      "properties": {
        "actions": {"$ref": "#/$defs/fact", "description": "Every action the agent can take (send email, buy, book, post, file, delete, run code), with the tool or API it uses."},
        "authorization": {"$ref": "#/$defs/fact", "description": "How the user grants authority: OAuth scopes, stored credentials, delegated tokens. Where are credentials stored?"},
        "confirmation_gates": {"$ref": "#/$defs/fact", "description": "Which actions require the user's explicit confirmation each time? Quote the code that enforces it."},
        "irreversible_actions": {"$ref": "#/$defs/fact", "description": "Payments, sends, deletions, filings. Can any run without a confirmation?"},
        "spending": {"$ref": "#/$defs/fact", "description": "Does the agent spend money? Whose payment method, what limits, what refund path?"},
        "third_party_sites": {"$ref": "#/$defs/fact", "description": "Websites or APIs the agent operates. Does it log in as the user, scrape, or bypass bot detection?"},
        "identifies_as_ai": {"$ref": "#/$defs/fact", "description": "When the agent talks to people (calls, emails, chats), does it say it is an AI?"},
        "action_log": {"$ref": "#/$defs/fact", "description": "Is every action logged with what was authorized and when? Can the user see it?"},
        "untrusted_input_handling": {"$ref": "#/$defs/fact", "description": "How the agent treats instructions found in web pages, emails, or documents (prompt injection)."},
        "kill_switch": {"$ref": "#/$defs/fact", "description": "Can the user or the company stop all agent activity at once?"}
      }
    },
    "feature_change": {
      "type": "object",
      "required": ["matter_id", "change", "trigger_ids"],
      "properties": {
        "matter_id": {"type": "string"},
        "change": {"type": "string", "description": "What you are about to build, in plain words."},
        "trigger_ids": {"type": "array", "items": {"type": "string"}, "description": "Which entries in counsel-triggers.json this matches."},
        "diff_summary": {"$ref": "#/$defs/fact", "description": "Files and config the change touches. A summary, not the source."},
        "target_ship_date": {"type": "string", "format": "date"}
      }
    }
  }
}