@agenticprimitives/ontology 1.0.0-alpha.20 → 1.0.0-alpha.22

package/tbox/agent-resolution.ttl

@@ -0,0 +1,296 @@
+# T-box — agent resolution vocabulary (spec 338; ADR-0056).
+#
+# VOCABULARY HAZARD — READ BEFORE EXTENDING:
+#   `apres:` (ns/resolution#) is INTENT resolution — apres:Resolver, apres:ResolutionReceipt,
+#   the ERC-7683 Resolver pattern owned by `intent-resolver`. THIS module is AGENT resolution and
+#   uses `apar:` (ns/agent-resolution#). Never reuse the bare terms Resolver / ResolutionReceipt
+#   here; this plane's receipt is apar:AgentResolutionReceipt.
+#
+# THE GAP THIS MODULE OWNS: an agent's canonical identity is stable, but WHERE it is right now, and
+# WHO may find that out, are separate mutable questions. Public naming answers neither privately nor
+# freshly. A signed card proves a snapshot was not modified; it does not prove the snapshot is still
+# in force.
+#
+# THE RULE THAT GOVERNS EVERY TERM BELOW:
+#   A resolution grant answers      "may this party DISCOVER how to reach this agent?"
+#   It NEVER answers                "may this party USE this agent?"
+# Service use remains delegation ∩ entitlement ∩ tool/action policy ∩ invocation proof ∩ revocation
+# ∩ audit. Resolution is a FOURTH orthogonal concern beside custody, admission and authority.
+#
+# FOUR INDEPENDENT DIMENSIONS (apar:AgentDiscoveryPolicy): naming, listing, resolution, inbound.
+# "Nameless" describes only the absence of a public label — it never implies "unresolvable".
+
+@prefix apar:   <https://agenticprimitives.dev/ns/agent-resolution#> .
+@prefix ap:     <https://agenticprimitives.dev/ns/core#> .
+@prefix apdisc: <https://agenticprimitives.dev/ns/discovery#> .
+@prefix apsec:  <https://agenticprimitives.dev/ns/security-exposure#> .
+@prefix rdf:    <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs:   <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:    <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:    <http://www.w3.org/2001/XMLSchema#> .
+@prefix prov:   <http://www.w3.org/ns/prov#> .
+@prefix skos:   <http://www.w3.org/2004/02/skos/core#> .
+
+apar: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — agent resolution ontology" ;
+    owl:versionInfo "0.1.0" ;
+    rdfs:comment "Spec 338 / ADR-0056. Private and public agent resolution: discovery policy, signed sequenced service publication, private resolution grants, connection invitations, rendezvous services, and privacy-minimized resolution receipts. Distinct from apres: (intent resolution)." .
+
+# ─── Discovery policy — four independent dimensions ───────────────────────
+
+apar:AgentDiscoveryPolicy a owl:Class ;
+    rdfs:label "Agent Discovery Policy" ;
+    rdfs:comment "The four INDEPENDENT postures of an agent: naming (public/private-label/none), listing (public/consented-projection/none), resolution (public/authenticated/invitation/pairwise/direct/none), inbound (open/known-peer/delegation-required/outbound-only). Never a single enum — collapsing them is the modelling error spec 338 corrects." .
+
+apar:namingPosture a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentDiscoveryPolicy ;
+    rdfs:range xsd:string ;
+    rdfs:label "naming posture" ;
+    rdfs:comment "public | private-label | none. Says nothing about resolvability." .
+
+apar:listingPosture a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentDiscoveryPolicy ;
+    rdfs:range xsd:string ;
+    rdfs:label "listing posture" ;
+    rdfs:comment "public | consented-projection | none. A private agent enters search ONLY via an explicit, revocable consent record." .
+
+apar:resolutionPosture a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentDiscoveryPolicy ;
+    rdfs:range xsd:string ;
+    rdfs:label "resolution posture" ;
+    rdfs:comment "public | authenticated | invitation | pairwise | direct | none." .
+
+apar:inboundPosture a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentDiscoveryPolicy ;
+    rdfs:range xsd:string ;
+    rdfs:label "inbound posture" ;
+    rdfs:comment "open | known-peer | delegation-required | outbound-only. Resolving is not connecting." .
+
+apar:hasDiscoveryPolicy a owl:ObjectProperty ;
+    rdfs:domain ap:SmartAgent ;
+    rdfs:range apar:AgentDiscoveryPolicy ;
+    rdfs:label "has discovery policy" .
+
+# ─── Resolution references + methods ──────────────────────────────────────
+
+apar:AgentResolutionMethod a owl:Class ;
+    rdfs:subClassOf skos:Concept ;
+    rdfs:label "Agent Resolution Method" ;
+    rdfs:comment "ans | private-grant | direct-invitation | canonical-id | dntls | did | local-directory | …. Open-ended (ADR-0038): a new method is a Ring-1 adapter, never a change to verification rules." .
+
+apar:AgentResolutionReference a owl:Class ;
+    rdfs:label "Agent Resolution Reference" ;
+    rdfs:comment "A portable 'how do I look this agent up' value, tagged with its method. Holding one is not authority to resolve, let alone to invoke." .
+
+apar:hasResolutionMethod a owl:ObjectProperty ;
+    rdfs:domain apar:AgentResolutionReference ;
+    rdfs:range apar:AgentResolutionMethod ;
+    rdfs:label "has resolution method" .
+
+# ─── Service publication — signed, sequenced, expiring ────────────────────
+
+apar:AgentServicePublication a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Agent Service Publication" ;
+    rdfs:comment "The CURRENT signed operational projection of an agent's surfaces: endpoints, transport keys, protocol versions, audience, status and freshness. Distinct from the durable agent profile and from a design-time surface descriptor. A content hash proves it was not modified; sequence + expiry + status prove it is current." .
+
+apar:ServiceSurface a owl:Class ;
+    rdfs:label "Service Surface" ;
+    rdfs:comment "One callable or readable endpoint within a publication: protocol, version, URI, exposure, audience, security requirements, optional transport key and endpoint-control proof." .
+
+apar:PublicationAuthority a owl:Class ;
+    rdfs:label "Publication Authority" ;
+    rdfs:comment "The record permitting an agent to sign publications on behalf of a target agent. A valid signature by an unauthorized publisher is still a forgery." .
+
+apar:describesAgent a owl:ObjectProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range ap:SmartAgent ;
+    rdfs:label "describes agent" ;
+    rdfs:comment "Exactly one canonical Smart Agent per publication (ADR-0010)." .
+
+apar:hasServiceSurface a owl:ObjectProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range apar:ServiceSurface ;
+    rdfs:label "has service surface" .
+
+apar:publishedBy a owl:ObjectProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range ap:SmartAgent ;
+    rdfs:label "published by" .
+
+apar:authorizedBy a owl:ObjectProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range apar:PublicationAuthority ;
+    rdfs:label "authorized by" .
+
+apar:publicationSequence a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range xsd:nonNegativeInteger ;
+    rdfs:label "publication sequence" ;
+    rdfs:comment "Monotonic WITHIN a channel. The anti-rollback axis: a lower sequence is rejected, an equal sequence with a different digest is publisher equivocation." .
+
+apar:previousPublication a owl:ObjectProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range apar:AgentServicePublication ;
+    rdfs:label "previous publication" .
+
+apar:supersedesPublication a owl:ObjectProperty ;
+    owl:inverseOf apar:previousPublication ;
+    rdfs:label "supersedes publication" .
+
+apar:publicationDigest a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range xsd:string ;
+    rdfs:label "publication digest" .
+
+apar:publicationStatus a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentServicePublication ;
+    rdfs:range xsd:string ;
+    rdfs:label "publication status" ;
+    rdfs:comment "active | superseded | suspended | revoked | compromised. Only active may be used to reach an agent." .
+
+apar:surfaceExposure a owl:DatatypeProperty ;
+    rdfs:domain apar:ServiceSurface ;
+    rdfs:range xsd:string ;
+    rdfs:label "surface exposure" ;
+    rdfs:comment "public | authenticated | private | service-only. A private surface with no audience is visible to NOBODY (fail-closed)." .
+
+apar:disclosedTo a owl:ObjectProperty ;
+    rdfs:domain apar:ServiceSurface ;
+    rdfs:range ap:SmartAgent ;
+    rdfs:label "disclosed to" ;
+    rdfs:comment "The audience of a private surface. Never projected into any public graph." .
+
+# ─── Endpoint + transport-key evidence ────────────────────────────────────
+
+apar:EndpointControlProof a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Endpoint Control Proof" ;
+    rdfs:comment "Evidence that the publisher CONTROLS the endpoint it published — the difference between claiming a URI and controlling it." .
+
+apar:TransportKeyBinding a owl:Class ;
+    rdfs:label "Transport Key Binding" ;
+    rdfs:comment "A transport key bound to a surface, with a purpose and a validity interval. Rotating it republishes at sequence+1; it never changes the canonical agent." .
+
+apar:hasEndpointControlProof a owl:ObjectProperty ;
+    rdfs:domain apar:ServiceSurface ;
+    rdfs:range apar:EndpointControlProof ;
+    rdfs:label "has endpoint control proof" .
+
+apar:hasTransportKeyBinding a owl:ObjectProperty ;
+    rdfs:domain apar:ServiceSurface ;
+    rdfs:range apar:TransportKeyBinding ;
+    rdfs:label "has transport key binding" .
+
+# ─── Private resolution grants + invitations ──────────────────────────────
+
+apar:PrivateResolutionGrant a owl:Class ;
+    rdfs:label "Private Resolution Grant" ;
+    rdfs:comment "A capability to DISCOVER, never to USE. High-entropy opaque id — never a salted hash of a human-readable name. Modes: subject-bound (default; a copied grant is inert), pairwise (per-relationship id/projection/label), bearer-bootstrap (short-lived, exchanged for a subject-bound grant)." .
+
+apar:PairwiseAgentAlias a owl:Class ;
+    rdfs:label "Pairwise Agent Alias" ;
+    rdfs:comment "A per-counterparty private label for the same canonical agent. MUST NOT have a public projection — a public row is a common identifier that defeats unlinkability." .
+
+apar:AgentConnectionInvitation a owl:Class ;
+    rdfs:label "Agent Connection Invitation" ;
+    rdfs:comment "Bootstrap: carries an initial signed publication (connect now, resolver-independent) AND a grant plus rendezvous locator (refresh forever). This is why an endpoint change never requires a new invitation." .
+
+apar:RendezvousService a owl:Class ;
+    rdfs:subClassOf ap:ServiceAgent ;
+    rdfs:label "Rendezvous Service" ;
+    rdfs:comment "A shared resolution endpoint for an organization. Reveals only that the org operates one — not which agents exist, their names, endpoints, capabilities or partners. Replaceable; cannot forge a target publication; cannot grant action authority." .
+
+apar:permitsDiscoveryOf a owl:ObjectProperty ;
+    rdfs:domain apar:PrivateResolutionGrant ;
+    rdfs:range ap:SmartAgent ;
+    rdfs:label "permits discovery of" ;
+    rdfs:comment "The target agent, signed into the grant so it cannot be retargeted. This is DISCOVERY permission only." .
+
+apar:permitsProjection a owl:DatatypeProperty ;
+    rdfs:domain apar:PrivateResolutionGrant ;
+    rdfs:range xsd:string ;
+    rdfs:label "permits projection" ;
+    rdfs:comment "The named projection profile. A grant NARROWS a projection; it can never widen past the profile's exposure ceiling." .
+
+apar:grantMode a owl:DatatypeProperty ;
+    rdfs:domain apar:PrivateResolutionGrant ;
+    rdfs:range xsd:string ;
+    rdfs:label "grant mode" ;
+    rdfs:comment "subject-bound | pairwise | bearer-bootstrap." .
+
+apar:aliasOfAgent a owl:ObjectProperty ;
+    rdfs:domain apar:PairwiseAgentAlias ;
+    rdfs:range ap:SmartAgent ;
+    rdfs:label "alias of agent" .
+
+apar:carriesGrant a owl:ObjectProperty ;
+    rdfs:domain apar:AgentConnectionInvitation ;
+    rdfs:range apar:PrivateResolutionGrant ;
+    rdfs:label "carries grant" .
+
+apar:carriesInitialPublication a owl:ObjectProperty ;
+    rdfs:domain apar:AgentConnectionInvitation ;
+    rdfs:range apar:AgentServicePublication ;
+    rdfs:label "carries initial publication" .
+
+# ─── Resolution requests, decisions, receipts ─────────────────────────────
+
+apar:ResolutionRequest a owl:Class ;
+    rdfs:subClassOf prov:Activity ;
+    rdfs:label "Resolution Request" ;
+    rdfs:comment "A presented reference plus a challenge response. Distinct from apdisc:CandidateQuery, which searches; this one LOCATES an already-identified agent." .
+
+apar:ResolutionDecision a owl:Class ;
+    rdfs:label "Resolution Decision" ;
+    rdfs:comment "allowed | denied. Every DENIAL is uniform on the wire — distinguishing unknown/expired/unauthorized is a grant-existence oracle." .
+
+apar:AgentResolutionReceipt a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Agent Resolution Receipt" ;
+    rdfs:comment "Privacy-minimized evidence of one resolution: grant-id DIGEST, publication id/digest/sequence, projection profile, disclosed field CLASSES, decision. NEVER the raw grant, a bearer secret, or a private label in global logs — audit metadata about resolution is itself relationship data. Distinct from apres:ResolutionReceipt (intent resolution)." .
+
+apar:usedResolutionGrant a owl:ObjectProperty ;
+    rdfs:domain apar:ResolutionRequest ;
+    rdfs:range apar:PrivateResolutionGrant ;
+    rdfs:label "used resolution grant" .
+
+apar:resolvedBy a owl:ObjectProperty ;
+    rdfs:domain apar:ResolutionRequest ;
+    rdfs:range apar:RendezvousService ;
+    rdfs:label "resolved by" .
+
+apar:hasResolutionDecision a owl:ObjectProperty ;
+    rdfs:domain apar:ResolutionRequest ;
+    rdfs:range apar:ResolutionDecision ;
+    rdfs:label "has resolution decision" .
+
+apar:resolutionAssurance a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentResolutionReceipt ;
+    rdfs:range xsd:string ;
+    rdfs:label "resolution assurance" ;
+    rdfs:comment "unverified | asserted | signed-publication | endpoint-control-verified | peer-authenticated. A consumer states a MINIMUM; a weaker level is never silently accepted (ADR-0013)." .
+
+apar:grantIdDigest a owl:DatatypeProperty ;
+    rdfs:domain apar:AgentResolutionReceipt ;
+    rdfs:range xsd:string ;
+    rdfs:label "grant id digest" ;
+    rdfs:comment "A keyed digest. The raw grant id MUST NOT appear in any receipt, log, URL, trace, or graph projection." .
+
+# ─── Boundary axioms (normative commentary; SHACL enforces) ───────────────
+#
+#  1. Exactly one apar:describesAgent per publication.
+#  2. An active publication has a sequence, an expiry, a digest and a proof.
+#  3. Every grant has a target and an expiry; subject-bound/pairwise grants identify a subject.
+#  4. bearer-bootstrap grants carry a bounded maximum lifetime.
+#  5. A PairwiseAgentAlias MUST NOT have a public projection.
+#  6. A surface with exposure private/service-only MUST NOT appear in a public publication.
+#  7. Every ServiceSurface has a protocol, a version, an exposure and a security requirement.
+#  8. Every TransportKeyBinding has a purpose and a validity interval.
+#  9. publicationSequence is non-negative; a superseding publication references its prior digest
+#     where continuity is required.
+# 10. NEVER project into a public graph (extends apsec: exposure rules + ADR-0040): grant ids,
+#     private labels, partner identities, private endpoints, pairwise relationships, private
+#     capabilities, resolution logs, private transport keys.
+# 11. apar:PrivateResolutionGrant is NEVER an input to an authorization decision. Discovery
+#     permission and action authority are disjoint (ADR-0056).