@agenticprimitives/ontology 1.0.0-alpha.21 → 1.0.0-alpha.23

package/README.md

@@ -55,6 +55,17 @@ Bounded to generic AP primitives: identity, credential, custody, delegation, aud
 
 The discovery ontology deliberately builds from the domain-derived vocabulary shape in Agent Explorer's `apps/ontology/ontology` modules — `core.ttl`, `discovery.ttl`, `descriptors.ttl`, `erc8004.ttl`, `hol.ttl`, `oasf.ttl`, and `trust.ttl` — while refining it into AP-native namespaces rooted in PROV-O and DOLCE+DnS/DUL.
 
+### Module map (additions by spec)
+
+| Concern | T-box | C-box |
+|---------|-------|-------|
+| Identity, kinds, derived types | `tbox/core.ttl`, `tbox/identity.ttl` | `cbox/controlled-vocabularies.ttl`, `cbox/canonical-agent-id-shape.shacl.ttl` |
+| Typed naming, registry core (spec 346) | `tbox/naming.ttl`, `tbox/registry.ttl` | `cbox/naming-registry-shapes.shacl.ttl`, `cbox/registry-vocabulary.ttl` |
+| Capabilities, claims, taxonomy mappings (specs 251/325/347 §5) | `tbox/skills.ttl` (`aps:SkillTaxonomyMapping` — `relation` = a SKOS mapping property) | `cbox/skill-vocabulary.ttl`, `cbox/capability-catalog-shapes.shacl.ttl` |
+| **Canonical profile → A2A Agent Card → projection → publication → external identity binding (spec 347 §11; ADR-0062)** | `tbox/card-projection.ttl` — a second module of the `ap:` core namespace; PROV-O-grounded (generation/publication ⊑ `prov:Activity`; artifact/releases ⊑ `prov:Entity`; publisher/adapter ⊑ `prov:SoftwareAgent`); "canonical agent" ≡ `ap:Agent`, no second class | `cbox/card-projection-shapes.shacl.ttl` — public card metadata; projection provenance (all **eight** digests as named sub-properties of `ap:hasDigest`); external binding; **public disclosure boundary** (SPARQL-targeted at `ap:disclosureScope "public"`: no loopback / private / link-local endpoint, no vault locator; absence of scope is private). Codelists `ap:lossCategoryScheme`, card-release / projection-instance / binding lifecycles, `ap:bindingVerificationStateScheme`, `ap:digestRoleScheme` in `cbox/controlled-vocabularies.ttl` |
+| Agentic interaction (spec 340) | `tbox/interaction.ttl` | `cbox/interaction-shapes.shacl.ttl`, `cbox/interaction-vocabulary.ttl` |
+| Coordination / engagement / execution (specs 332/336/330) | `tbox/coordination.ttl`, `tbox/engagement.ttl`, `tbox/execution.ttl`, `tbox/plan.ttl` | — |
+
 ## What this is NOT
 
 - Not the TS types — `@agenticprimitives/types` owns `CanonicalAgentId`, `Assurance`, etc.; this package names the IRIs. One brand.

package/cbox/card-projection-shapes.shacl.ttl

@@ -0,0 +1,216 @@
+# C-box — SHACL shapes for the A2A Agent Card, projection provenance, external identity bindings
+# and the public/private disclosure boundary (spec 347 §11; ADR-0062).
+#
+# STRUCTURE, NEVER PERMISSION — AND NEVER AUTHORITY. A conformant card is still only a description;
+# a conformant artifact is still only a payload; a conformant binding is evidence that an external
+# record points at the SA, never a grant. What these refuse is a record that misleads on its face:
+#
+#   a card with no interface URL              — "how to interact" that says nothing
+#   an artifact missing one of eight digests  — provenance with a hole nobody can audit later
+#   an artifact with no loss report link      — (not refused: an EMPTY report is a statement; what is
+#                                               refused is a loss with a made-up category)
+#   a binding with no verification state      — 'unverified' silently read as 'verified'
+#   a PUBLIC artifact naming localhost / 10.x — a private endpoint about to be published
+#   a PUBLIC artifact carrying a vault ref    — a private locator leaking into a registry
+#
+# THE EIGHT DIGESTS are modelled as eight named DATATYPE sub-properties of ap:hasDigest (see the
+# T-box note): eight sh:property blocks with minCount 1 say "all eight" in SHACL-Core, with no SPARQL.
+#
+# THE DISCLOSURE BOUNDARY targets ONLY nodes marked ap:disclosureScope "public" (a SPARQL target;
+# the house harness registers shacl-engine's sparql targetResolvers). Absence of the scope is
+# PRIVATE: an unmarked artifact is exempt here and MUST NOT be published. The endpoint checks are
+# sh:not/sh:pattern negations; the vault-reference check is its own NodeShape because it scans every
+# literal one hop deep, which needs SPARQL, and shacl-engine compiles one sh:sparql per shape.
+#
+# SUBCLASS HANDLING. sh:class ap:Agent relies on the rdfs:subClassOf* closure the harness materializes.
+
+@prefix ap:   <https://agenticprimitives.dev/ns/core#> .
+@prefix prov: <http://www.w3.org/ns/prov#> .
+@prefix sh:   <http://www.w3.org/ns/shacl#> .
+@prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd:  <http://www.w3.org/2001/XMLSchema#> .
+
+# ─── (1) Public card metadata ───────────────────────────────────────────────
+
+ap:PublicCardMetadataShape a sh:NodeShape ;
+  rdfs:label "Public A2A card metadata shape" ;
+  sh:targetClass ap:A2AAgentCard ;
+
+  sh:property [
+    sh:path ap:describesAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "An A2AAgentCard describes exactly one canonical Agent — the card points AT the SA; it is never the identity (ADR-0010, ADR-0062 §2)." ;
+  ] ;
+  sh:property [
+    sh:path ap:cardName ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "An A2AAgentCard MUST carry exactly one non-empty cardName (A2A 1.0 AgentCard.name)." ;
+  ] ;
+  sh:property [
+    sh:path ap:interfaceUrl ;
+    sh:minCount 1 ; sh:datatype xsd:anyURI ;
+    sh:message "An A2AAgentCard MUST list at least one interface URL (supportedInterfaces) — a card that says nothing about how to interact describes nothing (spec 347 §4.4)." ;
+  ] ;
+  sh:property [
+    sh:path ap:protocolVersion ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "An A2AAgentCard MUST pin exactly one protocolVersion." ;
+  ] ;
+  sh:property [
+    sh:path ap:disclosureScope ;
+    sh:maxCount 1 ; sh:in ( "public" "private" ) ;
+    sh:message "disclosureScope is 'public' or 'private'; absence is private." ;
+  ] .
+
+# ─── (2) Projection provenance — all eight digests ─────────────────────────
+
+ap:ProjectionProvenanceShape a sh:NodeShape ;
+  rdfs:label "Projection provenance shape" ;
+  sh:targetClass ap:ProjectionArtifact ;
+
+  sh:property [
+    sh:path ap:describesAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "A ProjectionArtifact describes exactly one canonical Agent." ;
+  ] ;
+  sh:property [
+    sh:path ap:projectsTo ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "A ProjectionArtifact MUST name the target family it was projected for (ap:projectsTo)." ;
+  ] ;
+  sh:property [
+    sh:path prov:wasGeneratedBy ;
+    sh:minCount 1 ; sh:class ap:ProjectionGeneration ;
+    sh:message "A ProjectionArtifact MUST record the ProjectionGeneration that produced it (prov:wasGeneratedBy) — a payload with no generating activity has no provenance." ;
+  ] ;
+  sh:property [
+    sh:path ap:hasLoss ;
+    sh:class ap:ProjectionLoss ;
+    sh:message "Every ap:hasLoss value MUST be a ProjectionLoss." ;
+  ] ;
+
+  # The eight digests. Each exactly once, each a sha256.
+  sh:property [ sh:path ap:hasSourceDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 1/8 missing or malformed: hasSourceDigest (the ProjectionInputBundle) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasDefinitionDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 2/8 missing or malformed: hasDefinitionDigest (the ProjectionDefinition) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasTargetSpecificationDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 3/8 missing or malformed: hasTargetSpecificationDigest (the pinned target spec) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasAdapterDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 4/8 missing or malformed: hasAdapterDigest (the adapter build) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasConfigurationDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 5/8 missing or malformed: hasConfigurationDigest (the instance configuration) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasArtifactDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 6/8 missing or malformed: hasArtifactDigest (the emitted payload) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasCanonicalProfileDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 7/8 missing or malformed: hasCanonicalProfileDigest (the profile release) — every artifact records all eight digests (spec 347 §6.4)." ] ;
+  sh:property [ sh:path ap:hasSelectedCardDigest ; sh:minCount 1 ; sh:maxCount 1 ; sh:pattern "^sha256:[0-9a-f]{64}$" ;
+    sh:message "Digest 8/8 missing or malformed: hasSelectedCardDigest (the released card consumed) — every artifact records all eight digests (spec 347 §6.4)." ] .
+
+ap:ProjectionLossShape a sh:NodeShape ;
+  rdfs:label "Projection loss shape" ;
+  sh:targetClass ap:ProjectionLoss ;
+  sh:property [
+    sh:path ap:lossCategory ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:in ( "unsupported" "truncated" "approximateMapping" "omittedByPolicy" "targetDefault" "manualActionRequired" ) ;
+    sh:message "A ProjectionLoss MUST carry exactly one lossCategory from ap:lossCategoryScheme: unsupported | truncated | approximateMapping | omittedByPolicy | targetDefault | manualActionRequired." ;
+  ] ;
+  sh:property [
+    sh:path ap:lossExplanation ;
+    sh:minCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "A ProjectionLoss MUST explain itself — a loss nobody can read is not a report." ;
+  ] .
+
+# ─── (3) External identity binding ──────────────────────────────────────────
+
+ap:ExternalIdentityBindingShape a sh:NodeShape ;
+  rdfs:label "External identity binding shape" ;
+  sh:targetClass ap:ExternalIdentityBinding ;
+
+  sh:property [
+    sh:path ap:describesAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "An ExternalIdentityBinding binds exactly one canonical Agent — the external id points AT the SA, never replaces it (ADR-0010)." ;
+  ] ;
+  sh:property [
+    sh:path ap:targetFamily ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "An ExternalIdentityBinding MUST name its target family." ;
+  ] ;
+  sh:property [
+    sh:path ap:externalId ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ; sh:minLength 1 ;
+    sh:message "An ExternalIdentityBinding MUST carry exactly one externalId." ;
+  ] ;
+  sh:property [
+    sh:path ap:verificationState ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:in ( "unverified" "verified" "failed" ) ;
+    sh:message "An ExternalIdentityBinding MUST record exactly one verificationState from ap:bindingVerificationStateScheme (unverified | verified | failed) — 'unverified' is RECORDED, never silently read as verified." ;
+  ] ;
+  sh:property [
+    sh:path ap:lifecycleState ;
+    sh:maxCount 1 ; sh:in ( "pendingVerification" "active" "stale" "suspended" "superseded" "revoked" ) ;
+    sh:message "A binding lifecycleState MUST be an ap:bindingLifecycleStateScheme value: pendingVerification | active | stale | suspended | superseded | revoked." ;
+  ] .
+
+# ─── (4) Public disclosure boundary ─────────────────────────────────────────
+# Targets ONLY artifacts / cards marked public. The regex refuses loopback (localhost, 127/8, ::1,
+# 0.0.0.0), RFC 1918 (10/8, 172.16/12, 192.168/16), link-local (169.254/16) and *.local / *.internal
+# / *.localhost hosts. An unmarked node is private and exempt — and must never be published.
+
+ap:PublicDisclosureBoundaryShape a sh:NodeShape ;
+  rdfs:label "Public disclosure boundary shape" ;
+  sh:target [
+    sh:select """
+      SELECT ?this WHERE {
+        ?this <https://agenticprimitives.dev/ns/core#disclosureScope> "public" .
+        { ?this a <https://agenticprimitives.dev/ns/core#ProjectionArtifact> }
+        UNION
+        { ?this a <https://agenticprimitives.dev/ns/core#A2AAgentCard> }
+      }
+    """ ;
+  ] ;
+
+  sh:property [
+    sh:path ap:cardUri ;
+    sh:not [
+      sh:pattern "^[a-z][a-z0-9+.-]*://(localhost|127\\.[0-9]+\\.[0-9]+\\.[0-9]+|0\\.0\\.0\\.0|\\[::1\\]|10\\.[0-9]+\\.[0-9]+\\.[0-9]+|192\\.168\\.[0-9]+\\.[0-9]+|172\\.(1[6-9]|2[0-9]|3[01])\\.[0-9]+\\.[0-9]+|169\\.254\\.[0-9]+\\.[0-9]+|[^/:]+\\.(local|internal|localhost))(:[0-9]+)?([/?#]|$)" ;
+      sh:flags "i" ;
+    ] ;
+    sh:message "A PUBLIC artifact's cardUri MUST NOT be a loopback, private-range, link-local or *.local/*.internal address — a private endpoint is about to be published (spec 347 §11 disclosure boundary)." ;
+  ] ;
+  sh:property [
+    sh:path ap:interfaceUrl ;
+    sh:not [
+      sh:pattern "^[a-z][a-z0-9+.-]*://(localhost|127\\.[0-9]+\\.[0-9]+\\.[0-9]+|0\\.0\\.0\\.0|\\[::1\\]|10\\.[0-9]+\\.[0-9]+\\.[0-9]+|192\\.168\\.[0-9]+\\.[0-9]+|172\\.(1[6-9]|2[0-9]|3[01])\\.[0-9]+\\.[0-9]+|169\\.254\\.[0-9]+\\.[0-9]+|[^/:]+\\.(local|internal|localhost))(:[0-9]+)?([/?#]|$)" ;
+      sh:flags "i" ;
+    ] ;
+    sh:message "A PUBLIC artifact's interfaceUrl MUST NOT be a loopback, private-range, link-local or *.local/*.internal address — a private endpoint is about to be published (spec 347 §11 disclosure boundary)." ;
+  ] .
+
+# Its own NodeShape: one sh:sparql per shape (shacl-engine compiles them as one unit). Scans every
+# literal on the node and one hop below it (losses, nested descriptors) for a vault locator.
+ap:PublicArtifactNoVaultRefShape a sh:NodeShape ;
+  rdfs:label "Public artifact carries no vault reference" ;
+  sh:target [
+    sh:select """
+      SELECT ?this WHERE {
+        ?this <https://agenticprimitives.dev/ns/core#disclosureScope> "public" .
+        { ?this a <https://agenticprimitives.dev/ns/core#ProjectionArtifact> }
+        UNION
+        { ?this a <https://agenticprimitives.dev/ns/core#A2AAgentCard> }
+      }
+    """ ;
+  ] ;
+  sh:sparql [
+    sh:message "A PUBLIC artifact MUST NOT carry a vault reference (urn:ap:vault… / vault:…) anywhere in its literals — the vault is the private record (ADR-0055); a locator into it is not public data (spec 347 §11 disclosure boundary)." ;
+    sh:select """
+      SELECT $this ?p ?v WHERE {
+        { $this ?p ?v }
+        UNION
+        { $this ?p1 ?n . ?n ?p ?v . FILTER(!isLiteral(?n)) }
+        FILTER(isLiteral(?v) && REGEX(STR(?v), "^\\\\s*(urn:ap:vault|vault:)", "i"))
+      }
+    """ ;
+  ] .

package/cbox/controlled-vocabularies.ttl

@@ -2,20 +2,22 @@
 # Spec 225 §6. These closed sets are the off-chain source of truth that the
 # on-chain OntologyTermRegistry enum-sets (ADR-0009) bind in lockstep, and that
 # the @agenticprimitives/types unions (AgentType, CredentialKind, Assurance,
-# CredentialRole) mirror. NOTE (audit P1-4): agentKind (4) and profileType (6)
-# are DISTINCT vocabularies.
+# CredentialRole) mirror. NOTE (audit P1-4): agentKind (3), profileType (8; agent-profile
+# ProfileType) and agentType (7 derived types; spec 346) are DISTINCT vocabularies.
 
 @prefix ap:   <https://agenticprimitives.dev/ns/core#> .
 @prefix apcr: <https://agenticprimitives.dev/ns/credential#> .
 @prefix apcus: <https://agenticprimitives.dev/ns/custody#> .
 @prefix apid: <https://agenticprimitives.dev/ns/identity#> .
+@prefix apnam: <https://agenticprimitives.dev/ns/naming#> .
+@prefix aporg: <https://agenticprimitives.dev/ns/org#> .
 @prefix skos: <http://www.w3.org/2004/02/skos/core#> .
 @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
 
-# ─── agentKind — 4 values, on-chain-bound (ADR-0009 enum / types.AgentType) ──
+# ─── agentKind — 3 values, on-chain-bound (ADR-0009 enum / types.AgentType) ──
 ap:agentKind a skos:ConceptScheme ;
     rdfs:label "agentKind" ;
-    rdfs:comment "The 3-value on-chain-bound kind (person/org/service). Distinct from profileType (6 values; agent-profile/HCS-11). treasury is NOT an agentKind — it is a profileType ⊂ service (ap:Treasury rdfs:subClassOf ap:ServiceAgent; tbox/identity)." ;
+    rdfs:comment "The 3-value on-chain-bound ROOT kind (person/org/service) carried on the NAME node; 'service' names the ap:ApplicationAgent root (ADR-0046 amendment). Distinct from profileType (8 values; agent-profile/HCS-11) and from ap:agentTypeScheme (the 7 DERIVED types on the SA subject; spec 346 §2.3). treasury is NOT an agentKind — it is a profileType ⊂ service (ap:Treasury rdfs:subClassOf ap:ServiceAgent; tbox/core); team and alliance are NOT agentKinds — they are profileTypes ⊂ org (ap:TeamAgent / ap:AllianceAgent rdfs:subClassOf ap:OrganizationAgent; spec 344 §4.4). Never new agentKinds." ;
     skos:hasTopConcept ap:Person, ap:OrgKind, ap:Service .
 ap:Person   a skos:Concept ; skos:inScheme ap:agentKind ; skos:prefLabel "person" .
 ap:OrgKind  a skos:Concept ; skos:inScheme ap:agentKind ; skos:prefLabel "org" .
@@ -55,3 +57,169 @@ ap:Custodied      a skos:Concept ; skos:inScheme ap:controlStatusScheme ; skos:p
     rdfs:comment "EVM (eip155) — custodied via ERC-4337/ERC-1271." .
 ap:IdentifierOnly a skos:Concept ; skos:inScheme ap:controlStatusScheme ; skos:prefLabel "identifier-only" ;
     rdfs:comment "hedera:* / solana:* — addressable, not custodied by this stack." .
+
+# ─── agentType — the 7 DERIVED types, on-chain-bound (spec 346 §2; ADR-0061) ─
+# AGENT_TYPE_ENUM / types.DerivedAgentType. Person and Organization are their own derived type (the
+# trivial specialization) so every agent has exactly one. rootClassFor: team→org;
+# service|workspace|treasury|registry→service. The 3-value ap:agentKind scheme above
+# is UNCHANGED — nothing is ever added to the root trichotomy.
+ap:agentTypeScheme a skos:ConceptScheme ;
+    rdfs:label "agentType" ;
+    rdfs:comment "9 values, on-chain-bound (AGENT_TYPE_ENUM / types.DerivedAgentType): person org team service workspace treasury registry church circle. rootClassFor: team→org; service|workspace|treasury|registry→service. Each concept rdfs:seeAlso the OWL class it projects (tbox/core)." ;
+    skos:hasTopConcept ap:PersonType, ap:OrgType, ap:TeamType, ap:ServiceType, ap:WorkspaceType, ap:TreasuryType, ap:RegistryType, ap:ChurchType, ap:CircleType .
+ap:PersonType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "person" ;                rdfs:seeAlso ap:PersonAgent .
+ap:OrgType                  a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "org" ;                   rdfs:seeAlso ap:OrganizationAgent .
+ap:TeamType                 a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "team" ;                  rdfs:seeAlso ap:TeamAgent .
+ap:ServiceType              a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "service" ;               rdfs:seeAlso ap:ServiceAgent .
+ap:WorkspaceType a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "workspace" ; rdfs:seeAlso ap:WorkspaceAgent .
+ap:TreasuryType             a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "treasury" ;              rdfs:seeAlso ap:Treasury .
+ap:RegistryType             a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "registry" ;              rdfs:seeAlso ap:RegistryAgent .
+ap:ChurchType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "church" ;                rdfs:seeAlso ap:ChurchAgent .
+ap:CircleType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "circle" ;                rdfs:seeAlso ap:CircleAgent .
+
+# ─── tld — the typed name suffixes (spec 346 §3.1; ADR-0061 §3) ──────────
+# A suffix NAMES a derived type — never the inheritance structure, a root, a role, or a technology.
+# apnam:namesDerivedType is the suffix→derived-type map the resolver applies (derivedTypeForTld);
+# apnam:TypedAgentNameShape checks a name's suffix against its target's ap:agentType. `.alliance`
+# and `.agent` are reserved/inactive and deliberately NOT concepts here; `.ws` is an alias, not a tld.
+apnam:tldScheme a skos:ConceptScheme ;
+    rdfs:label "tld" ;
+    rdfs:comment "The 7 active typed suffixes: me org team svc workspace treasury registry. Each names exactly one ap:agentTypeScheme concept (apnam:namesDerivedType)." ;
+    skos:hasTopConcept apnam:MeTld, apnam:OrgTld, apnam:TeamTld, apnam:SvcTld, apnam:WorkspaceTld, apnam:TreasuryTld, apnam:RegistryTld, apnam:ChurchTld, apnam:CircleTld .
+apnam:ChurchTld    a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "church" ;    apnam:namesDerivedType ap:ChurchType .
+apnam:CircleTld    a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "circle" ;    apnam:namesDerivedType ap:CircleType .
+apnam:MeTld        a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "me" ;        apnam:namesDerivedType ap:PersonType .
+apnam:OrgTld       a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "org" ;       apnam:namesDerivedType ap:OrgType .
+apnam:TeamTld      a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "team" ;      apnam:namesDerivedType ap:TeamType .
+apnam:SvcTld       a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "svc" ;       apnam:namesDerivedType ap:ServiceType .
+apnam:WorkspaceTld a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "workspace" ; skos:altLabel "ws" ; apnam:namesDerivedType ap:WorkspaceType .
+apnam:TreasuryTld  a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "treasury" ;  apnam:namesDerivedType ap:TreasuryType .
+apnam:RegistryTld  a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "registry" ;  apnam:namesDerivedType ap:RegistryType .
+
+# ─── Team affiliation + workspace schemes (spec 344 §4.4) ─────────────────
+# profileType gains team ⊂ org and alliance ⊂ org (see the ap:agentKind note above). Never new agentKinds.
+
+aporg:affiliationKindScheme a skos:ConceptScheme ;
+    rdfs:label "affiliationKind" ;
+    skos:hasTopConcept aporg:CharteredAffiliation, aporg:EngagedAffiliation .
+aporg:CharteredAffiliation a skos:Concept ; skos:inScheme aporg:affiliationKindScheme ; skos:prefLabel "chartered" .
+aporg:EngagedAffiliation   a skos:Concept ; skos:inScheme aporg:affiliationKindScheme ; skos:prefLabel "engaged" .
+
+aporg:workspacePolicyScheme a skos:ConceptScheme ;
+    rdfs:label "workspaceParticipationPolicy" ;
+    skos:hasTopConcept aporg:OpenWorkspace, aporg:RestrictedWorkspace .
+aporg:OpenWorkspace       a skos:Concept ; skos:inScheme aporg:workspacePolicyScheme ; skos:prefLabel "open" .
+aporg:RestrictedWorkspace a skos:Concept ; skos:inScheme aporg:workspacePolicyScheme ; skos:prefLabel "restricted" .
+
+aporg:workspaceProfileScheme a skos:ConceptScheme ;
+    rdfs:label "workspaceProfile" ;
+    rdfs:comment """coordination | field-operations | data-collection | mobilization |
+      personal-project — domain packs extend. An app binding declares supported profiles.""" ;
+    skos:hasTopConcept aporg:CoordinationProfile, aporg:FieldOperationsProfile, aporg:DataCollectionProfile,
+        aporg:MobilizationProfile, aporg:PersonalProjectProfile .
+aporg:CoordinationProfile    a skos:Concept ; skos:inScheme aporg:workspaceProfileScheme ; skos:prefLabel "coordination" .
+aporg:FieldOperationsProfile a skos:Concept ; skos:inScheme aporg:workspaceProfileScheme ; skos:prefLabel "field-operations" .
+aporg:DataCollectionProfile  a skos:Concept ; skos:inScheme aporg:workspaceProfileScheme ; skos:prefLabel "data-collection" .
+aporg:MobilizationProfile    a skos:Concept ; skos:inScheme aporg:workspaceProfileScheme ; skos:prefLabel "mobilization" .
+aporg:PersonalProjectProfile a skos:Concept ; skos:inScheme aporg:workspaceProfileScheme ; skos:prefLabel "personal-project" .
+
+aporg:workspaceRoleScheme a skos:ConceptScheme ;
+    rdfs:label "workspaceRole" ;
+    rdfs:comment """Workspace Steward · Security/Data Steward · Contributor · Partner Observer —
+      templates, never the authorization model. Assignment = aporg:RoleAssignment scoped to the
+      workspace.""" ;
+    skos:hasTopConcept aporg:WorkspaceStewardRole, aporg:SecurityDataStewardRole, aporg:ContributorRole, aporg:PartnerObserverRole .
+aporg:WorkspaceStewardRole    a skos:Concept ; skos:inScheme aporg:workspaceRoleScheme ; skos:prefLabel "workspace-steward" .
+aporg:SecurityDataStewardRole a skos:Concept ; skos:inScheme aporg:workspaceRoleScheme ; skos:prefLabel "security-data-steward" .
+aporg:ContributorRole         a skos:Concept ; skos:inScheme aporg:workspaceRoleScheme ; skos:prefLabel "contributor" .
+aporg:PartnerObserverRole     a skos:Concept ; skos:inScheme aporg:workspaceRoleScheme ; skos:prefLabel "partner-observer" .
+
+# ═══ Card projection codelists (spec 347 §3 / §6.4 / §11; ADR-0062; tbox/card-projection.ttl) ═══
+# Mirrored by registry-kit/projection + agent-profile/a2a TS unions; the .ttl is the source of truth.
+
+# ─── lossCategory — what a projector could not represent faithfully (§6.4 ProjectionLossV1) ──
+ap:lossCategoryScheme a skos:ConceptScheme ;
+    rdfs:label "lossCategory" ;
+    rdfs:comment "ProjectionLossV1.category: unsupported truncated approximateMapping omittedByPolicy targetDefault manualActionRequired. A projector ALWAYS emits a loss report; an empty one is a statement, a missing one is a defect." ;
+    skos:hasTopConcept ap:LossUnsupported, ap:LossTruncated, ap:LossApproximateMapping, ap:LossOmittedByPolicy, ap:LossTargetDefault, ap:LossManualActionRequired .
+ap:LossUnsupported           a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "unsupported" ;
+    rdfs:comment "The target has no place for this fact at all." .
+ap:LossTruncated             a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "truncated" ;
+    rdfs:comment "Represented, but cut to a target limit (length, count)." .
+ap:LossApproximateMapping    a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "approximateMapping" ;
+    rdfs:comment "Represented by a close/broad/narrow taxon or field, not an exact one." .
+ap:LossOmittedByPolicy       a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "omittedByPolicy" ;
+    rdfs:comment "Deliberately withheld by the disclosure policy (never a defect of the target)." .
+ap:LossTargetDefault         a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "targetDefault" ;
+    rdfs:comment "The target required a value the source does not have; a target default was written." .
+ap:LossManualActionRequired  a skos:Concept ; skos:inScheme ap:lossCategoryScheme ; skos:prefLabel "manualActionRequired" ;
+    rdfs:comment "Cannot be completed by a pure projector — a human or an approval must act." .
+
+# ─── cardReleaseState — the card lifecycle (§3) ──
+ap:cardReleaseStateScheme a skos:ConceptScheme ;
+    rdfs:label "cardReleaseState" ;
+    rdfs:comment "draft → validated → approvalPending → approved → signed → published → superseded | deprecated | revoked. Editing at approved or later creates a NEW draft; a revoked release is not projection-ready." ;
+    skos:hasTopConcept ap:CardDraft, ap:CardValidated, ap:CardApprovalPending, ap:CardApproved, ap:CardSigned, ap:CardPublished, ap:CardSuperseded, ap:CardDeprecated, ap:CardRevoked .
+ap:CardDraft           a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "draft" .
+ap:CardValidated       a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "validated" .
+ap:CardApprovalPending a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "approvalPending" .
+ap:CardApproved        a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "approved" .
+ap:CardSigned          a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "signed" .
+ap:CardPublished       a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "published" .
+ap:CardSuperseded      a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "superseded" .
+ap:CardDeprecated      a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "deprecated" .
+ap:CardRevoked         a skos:Concept ; skos:inScheme ap:cardReleaseStateScheme ; skos:prefLabel "revoked" .
+
+# ─── projectionInstanceState — the projection lifecycle (§3) ──
+ap:projectionInstanceStateScheme a skos:ConceptScheme ;
+    rdfs:label "projectionInstanceState" ;
+    rdfs:comment "unconfigured → configured → ready → generated → approvalPending → publishing → published → drifted | stale | failed | retired. A remote change is a DRIFT that yields an import proposal, never a canonical write." ;
+    skos:hasTopConcept ap:ProjectionUnconfigured, ap:ProjectionConfigured, ap:ProjectionReady, ap:ProjectionGenerated, ap:ProjectionApprovalPending, ap:ProjectionPublishing, ap:ProjectionPublished, ap:ProjectionDrifted, ap:ProjectionStale, ap:ProjectionFailed, ap:ProjectionRetired .
+ap:ProjectionUnconfigured    a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "unconfigured" .
+ap:ProjectionConfigured      a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "configured" .
+ap:ProjectionReady           a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "ready" .
+ap:ProjectionGenerated       a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "generated" .
+ap:ProjectionApprovalPending a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "approvalPending" .
+ap:ProjectionPublishing      a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "publishing" .
+ap:ProjectionPublished       a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "published" .
+ap:ProjectionDrifted         a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "drifted" .
+ap:ProjectionStale           a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "stale" .
+ap:ProjectionFailed          a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "failed" .
+ap:ProjectionRetired         a skos:Concept ; skos:inScheme ap:projectionInstanceStateScheme ; skos:prefLabel "retired" .
+
+# ─── bindingLifecycleState — the external identity binding lifecycle (§3) ──
+ap:bindingLifecycleStateScheme a skos:ConceptScheme ;
+    rdfs:label "bindingLifecycleState" ;
+    rdfs:comment "pendingVerification → active → stale | suspended | superseded | revoked (ExternalIdentityBindingV1.lifecycle.state)." ;
+    skos:hasTopConcept ap:BindingPendingVerification, ap:BindingActive, ap:BindingStale, ap:BindingSuspended, ap:BindingSuperseded, ap:BindingRevoked .
+ap:BindingPendingVerification a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "pendingVerification" .
+ap:BindingActive              a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "active" .
+ap:BindingStale               a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "stale" .
+ap:BindingSuspended           a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "suspended" .
+ap:BindingSuperseded          a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "superseded" .
+ap:BindingRevoked             a skos:Concept ; skos:inScheme ap:bindingLifecycleStateScheme ; skos:prefLabel "revoked" .
+
+# ─── bindingVerificationState — was the external record checked against the canonical agent? ──
+ap:bindingVerificationStateScheme a skos:ConceptScheme ;
+    rdfs:label "bindingVerificationState" ;
+    rdfs:comment "ExternalIdentityBindingV1.verification.state: unverified | verified | failed. 'unverified' is RECORDED, never silently equal to 'verified' (the spec 346 receipt rule, applied to bindings)." ;
+    skos:hasTopConcept ap:BindingUnverified, ap:BindingVerified, ap:BindingVerificationFailed .
+ap:BindingUnverified          a skos:Concept ; skos:inScheme ap:bindingVerificationStateScheme ; skos:prefLabel "unverified" .
+ap:BindingVerified            a skos:Concept ; skos:inScheme ap:bindingVerificationStateScheme ; skos:prefLabel "verified" .
+ap:BindingVerificationFailed  a skos:Concept ; skos:inScheme ap:bindingVerificationStateScheme ; skos:prefLabel "failed" .
+
+# ─── digestRole — the eight digests every artifact / receipt records (§6.4) ──
+# The T-box carries them as eight named sub-properties of ap:hasDigest; this scheme names the roles
+# for a store that prefers a reified (digest, role) form. Each concept rdfs:seeAlso its property.
+ap:digestRoleScheme a skos:ConceptScheme ;
+    rdfs:label "digestRole" ;
+    rdfs:comment "source-bundle definition target-specification adapter configuration artifact canonical-profile selected-card. ap:ProjectionProvenanceShape requires ALL eight on every ProjectionArtifact." ;
+    skos:hasTopConcept ap:SourceBundleDigestRole, ap:DefinitionDigestRole, ap:TargetSpecificationDigestRole, ap:AdapterDigestRole, ap:ConfigurationDigestRole, ap:ArtifactDigestRole, ap:CanonicalProfileDigestRole, ap:SelectedCardDigestRole .
+ap:SourceBundleDigestRole        a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "source-bundle" ;        rdfs:seeAlso ap:hasSourceDigest .
+ap:DefinitionDigestRole          a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "definition" ;           rdfs:seeAlso ap:hasDefinitionDigest .
+ap:TargetSpecificationDigestRole a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "target-specification" ; rdfs:seeAlso ap:hasTargetSpecificationDigest .
+ap:AdapterDigestRole             a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "adapter" ;              rdfs:seeAlso ap:hasAdapterDigest .
+ap:ConfigurationDigestRole       a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "configuration" ;        rdfs:seeAlso ap:hasConfigurationDigest .
+ap:ArtifactDigestRole            a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "artifact" ;             rdfs:seeAlso ap:hasArtifactDigest .
+ap:CanonicalProfileDigestRole    a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "canonical-profile" ;    rdfs:seeAlso ap:hasCanonicalProfileDigest .
+ap:SelectedCardDigestRole        a skos:Concept ; skos:inScheme ap:digestRoleScheme ; skos:prefLabel "selected-card" ;        rdfs:seeAlso ap:hasSelectedCardDigest .