Skimming through the current port object, it states that:

services - MUST be a list of Service object(s) that describes the service(s) behind this port

But then in the example that follows, the services key isn't defined for the first entry.

I expect the intention of this is that if the services key is defined, then it must be an array of service objects. At least, this is how I would expect it to be.

I'm not sure that it would make sense to enforce a MUST on the service objects, as there is a potential where we know a port is open but know nothing else about what is behind it.