The canonical JSON Schema for the CARL Scan output is carl-scan.schema.json (draft 2020-12). The schema formalizes the minimum fields described in §7 of the standard and adds Scan-specific sanitization constraints.

Two sibling schemas cover the per-developer prompts:

• carl-review-team.schema.json
• carl-review-solo.schema.json

Assessors MUST produce output that validates against the appropriate schema.

Field reference (carl-scan)

standard_version (required)

String, must equal "1.0" for this schema. Other CARL Standard versions use their own versioned schema files.

subject (required)

Object with:

• type — one of repository, application, organization. Per §4.3 of the standard.
• identifier — a stable string identifying the subject. For a GitHub repository, the canonical form is owner/repo. For an application in a monorepo, owner/repo:packages/app-name.
• commit_hash — 7–40 hex characters. The Git SHA of the state assessed. Assessors SHOULD use full-length SHAs for robustness.

assessed_at (required)

ISO-8601 timestamp, e.g. 2026-04-22T14:03:11Z. UTC recommended.

assessor (required)

Object describing the assessor that produced the report:

• name — human-readable name, e.g. "CARL Scan (claude-opus-4-7)". Include the model identifier for AI-assisted assessors so report provenance is unambiguous.
• type — one of deterministic, ai-assisted, human, mixed. Misrepresenting the type is a prohibited claim.
• version — the assessor's own version string.

level_achieved (required)

Integer in [1, 5]. MUST be derived from the 80% gating rule in §4.2 applied to the criteria array — not independently asserted.

pillar_scores (required)

Object with exactly eight keys, one per pillar. Each value is a float in [0, 1] representing the fraction of criteria in that pillar that passed (applicability-adjusted). The key names (JSON-camelCase) are:

• documentation
• codeQuality
• testing
• buildEnvironment
• observability
• security
• taskIntakeRouting
• deliveryMeasurement

criteria (required)

Array with at least one item. Each item:

• id — matches the pattern ^[A-Z]{3}-[0-9]{3}$ (e.g., DOC-010).
• pillar — one of the eight pillar keys above.
• level — integer in [1, 5].
• result — pass, fail, or not_applicable.
• rationale — non-empty string; short human-readable justification.
• evidence_summary — non-empty string; sanitized structural observation. See the sanitization constraint below.

ai_assisted_variance (optional)

Float in [0, 1]. The measured variance for AI-assisted portions of the assessment. Per §6.2, it SHOULD be below 0.02. Assessors that use AI-assisted evaluation SHOULD include this field.

remediation (required)

Array of remediation suggestions derived from failing or weak criteria. Each item:

• criterion_id — must correspond to an id in the criteria array.
• text — non-empty, user-facing remediation copy. Safe to render in a UI.
• severity — critical, high, medium, low, or info.
• effort_estimate — S (<1hr), M (1-4hr), L (4-8hr), XL (>1 day).

Additional constraints

• additionalProperties: false on every object. Consumers are free to reject reports that carry unexpected fields.
• Schema identifier ($id) is the canonical URL https://carl.wentzel.ai/prompts/schemas/v1.0/carl-scan.schema.json; a future v1.1 schema will live at a different path so clients can pin.

Example (abbreviated)

{
  "standard_version": "1.0",
  "subject": {
    "type": "repository",
    "identifier": "your-org/your-repo",
    "commit_hash": "5581990"
  },
  "assessed_at": "2026-04-22T14:03:11Z",
  "assessor": {
    "name": "CARL Scan (claude-opus-4-7)",
    "type": "ai-assisted",
    "version": "1.0.0"
  },
  "level_achieved": 3,
  "pillar_scores": {
    "documentation": 0.86,
    "codeQuality": 0.92,
    "testing": 0.73,
    "buildEnvironment": 0.8,
    "observability": 0.67,
    "security": 0.81,
    "taskIntakeRouting": 0.58,
    "deliveryMeasurement": 0.64
  },
  "criteria": [
    {
      "id": "DOC-030",
      "pillar": "documentation",
      "level": 2,
      "result": "pass",
      "rationale": "AGENTS.md present with expected sections.",
      "evidence_summary": "Found AGENTS.md at repo root with 7 headings."
    }
  ],
  "ai_assisted_variance": 0.015,
  "remediation": [
    {
      "criterion_id": "TST-040",
      "text": "Raise coverage thresholds in vitest.config.ts to 80% across branches, functions, lines, statements.",
      "severity": "high",
      "effort_estimate": "S"
    }
  ]
}

Related

• Report format (normative) — the minimum field set specified by the standard.
• Assessment methodology — how the standard requires AI-assisted evaluation to be disclosed.
• Reference Prompts — where the schemas originate.