@agenticprimitives/content-primitives 1.0.0-alpha.6 → 1.0.0-alpha.7

package/README.md

@@ -1,13 +1,12 @@
 # @agenticprimitives/content-primitives
 
-Verifiable Content Substrate — name, resolve, commit, entitlement-gate, and cite
-content that lives off-platform and is controlled by third-party rights holders.
+The verifiable content substrate — name, resolve, commit, entitlement-gate, and cite content that lives off-platform and is controlled by third-party rights holders.
 
-It is **content-agnostic** ([ADR-0033](../../docs/architecture/decisions/0033-content-agnostic-verifiable-content-firewall.md)):
-a referenced unit of content (e.g. a Bible verse) is **not** a Smart Agent, and
-this package never embeds a translation, a faith term, or any rendering text.
-Bible verses are its first usage domain ([spec 267](../../specs/267-scripture-demo-vertical.md)),
-not its vocabulary.
+Agents increasingly act on content they do not own: quoting a licensed text, citing a canonical passage, gating access to a rights-held corpus. The naive approaches all fail — copy the text and you violate the license; trust the platform and the citation is unverifiable; mint every passage an identity and the identity layer drowns. This package takes the third path: content is **never an agent and never stored**. A unit of content gets a deterministic, scheme-anchored address; an issuer (who IS a Smart Agent) signs a commitment to it; readers verify the signature, evaluate the entitlement, and cite the result — all without the text ever entering the substrate ([ADR-0033](../../docs/architecture/decisions/0033-content-agnostic-verifiable-content-firewall.md)).
+
+The package is strictly content-agnostic: no rendering text in any descriptor or commitment we store (R3), no licensed material in the repo (R1), and the reference grammar is app-injected, never hardcoded (R4). Trust derives from the issuer's signature and access policy, never a platform claim (R5).
+
+Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
 
 ## Model (FRBR)
 
@@ -18,6 +17,8 @@ not its vocabulary.
 | Item | `ContentDescriptor` | commitment + `retrievalPointer` + issuer signature — **never text** |
 | — | `Entitlement` / `CitationAssertion` | W3C VC 2.0 subjects |
 
+The FRBR Work/Item split is why this is a new substrate and not another naming-record type: a content locus is an address computed from a reference scheme, while only issuers, corpora owners, and parties are Smart Agents (ADR-0010 still governs *them*).
+
 ## Quick start
 
 ```ts
@@ -28,15 +29,15 @@ import {
 } from '@agenticprimitives/content-primitives';
 
 // 1. App supplies the reference grammar (kept out of the package — R4).
-const bibleVerse = { id: 'bible-verse', normalize: (p: string) => /* OSIS */ p };
-const locus = buildCanonicalLocus(bibleVerse, 'John 3:16'); // -> { locusId, path: 'John.3.16' }
+const clauseScheme = { id: 'standard-clause', normalize: (p: string) => /* canonical form */ p };
+const locus = buildCanonicalLocus(clauseScheme, 'Part 4, Section 2'); // -> { locusId, path: 'Part4.Section2' }
 
 // 2. Issuer commits to off-platform text + signs a descriptor (no text on-chain — R3).
 const commitment = contentCommitment(renderingText); // keccak256, off-platform
 const descriptor = await buildContentDescriptor(
-  { locusId: locus.locusId, corpusRef: ref, contentType: 'bible-verse',
+  { locusId: locus.locusId, corpusRef: ref, contentType: 'standard-clause',
     commitment, proofPolicy: 'signature', accessPolicy: 'public',
-    retrievalPointer: 'content://bible-verse/bsb/John.3.16', issuer },
+    retrievalPointer: 'content://standard-clause/v3/Part4.Section2', issuer },
   issuerSign, // signs descriptorHash via the issuer SA (ERC-1271)
 );
 
@@ -45,5 +46,18 @@ const ok = await verifyContentDescriptor(descriptor, { verifySignature });
 const gate = evaluateEntitlement(descriptor.accessPolicy, descriptor.corpusRef);
 ```
 
-Full SDK + phased roadmap: [spec 266](../../specs/266-verifiable-content-substrate.md).
-ZK proofs and paid access are reserved (Phase 4/5) and throw until implemented.
+Entitlement evaluation is fail-closed; Merkle helpers ship under the `/merkle` subpath; ERC-1271 signature verification is dependency-injected so the package stays at the base of the graph.
+
+## Status
+
+Phases 1–3 (naming, commitment, descriptor verification, entitlement gating, citation) are implemented and tested. **ZK proofs and paid access are reserved (Phase 4/5) and throw until implemented** — the full SDK surface and phased roadmap live in [spec 266](../../specs/266-verifiable-content-substrate.md) (see [`spec.md`](./spec.md)).
+
+Testnet/pilot-ready. Production launch is gated on the public checklist in the root README — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).
+
+## Build
+
+```bash
+pnpm --filter @agenticprimitives/content-primitives typecheck
+pnpm --filter @agenticprimitives/content-primitives test
+pnpm --filter @agenticprimitives/content-primitives build
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/content-primitives",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.7",
   "description": "Verifiable Content Substrate SDK: name, resolve, commit, entitlement-gate, and cite off-platform content controlled by third-party rights holders. Owns CanonicalLocus / CorpusManifest / ContentDescriptor / CitationAssertion / Entitlement (FRBR-aligned), deterministic locusId, Merkle corpus commitments, and issuer-signature verification. Content-agnostic — no vertical/faith vocabulary, no content text (ADR-0033).",
   "license": "MIT",
   "repository": {
@@ -32,13 +32,22 @@
     "README.md",
     "CLAUDE.md"
   ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run test/reference.test.ts test/merkle.test.ts test/descriptor.test.ts test/entitlement.test.ts test/resolution.test.ts --passWithNoTests",
+    "test:integration": "vitest run test/integration --passWithNoTests",
+    "test:watch": "vitest",
+    "clean": "rm -rf dist"
+  },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "viem": "^2.52.2",
-    "@agenticprimitives/types": "1.0.0-alpha.6",
-    "@agenticprimitives/verifiable-credentials": "0.0.0-alpha.2"
+    "@agenticprimitives/types": "workspace:*",
+    "@agenticprimitives/verifiable-credentials": "workspace:*",
+    "viem": "^2.52.2"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",
@@ -51,14 +60,5 @@
     "provenance",
     "citation",
     "agentic"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "test:unit": "vitest run test/reference.test.ts test/merkle.test.ts test/descriptor.test.ts test/entitlement.test.ts",
-    "test:integration": "vitest run test/integration.test.ts",
-    "test:watch": "vitest",
-    "clean": "rm -rf dist"
-  }
-}
+  ]
+}