@agenticprimitives/ontology 1.0.0-alpha.4 → 1.0.0-alpha.40

package/tbox/trust.ttl

@@ -0,0 +1,210 @@
+# T-box — trust evidence and reputation vocabulary.
+# Refines Agent Explorer trust/analytics vocabulary into AP-native evidence.
+
+@prefix ap:      <https://agenticprimitives.dev/ns/core#> .
+@prefix aptrust: <https://agenticprimitives.dev/ns/trust#> .
+@prefix apatt:   <https://agenticprimitives.dev/ns/attestation#> .
+@prefix apdisc:  <https://agenticprimitives.dev/ns/discovery#> .
+@prefix rdf:     <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
+@prefix rdfs:    <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:     <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:     <http://www.w3.org/2001/XMLSchema#> .
+@prefix prov:    <http://www.w3.org/ns/prov#> .
+@prefix dul:     <http://www.ontologydesignpatterns.org/ont/dul/DUL.owl#> .
+@prefix skos:    <http://www.w3.org/2004/02/skos/core#> .
+
+aptrust: a owl:Ontology ;
+  rdfs:label "Agentic Primitives — trust ontology" ;
+  owl:versionInfo "0.1.0" ;
+  rdfs:seeAlso <https://github.com/agentictrustlabs/agent-explorer/tree/main/apps/ontology/ontology> ;
+  rdfs:comment "Vocabulary for public trust signals, reputation evidence, validations, and trust determinations used by discovery." .
+
+aptrust:TrustSignal a owl:Class ;
+  rdfs:subClassOf prov:Entity, dul:InformationObject ;
+  rdfs:label "TrustSignal" ;
+  rdfs:comment "A public signal that may influence trust determination: validation, outcome, feedback, issuer standing, graph relationship, or exposure finding." .
+
+aptrust:ReputationEvidence a owl:Class ;
+  rdfs:subClassOf aptrust:TrustSignal ;
+  rdfs:label "ReputationEvidence" ;
+  rdfs:comment "A normalized reputation signal. ERC-8004 feedback is one external projection source, not AP authority." .
+
+aptrust:ValidationEvidence a owl:Class ;
+  rdfs:subClassOf aptrust:TrustSignal ;
+  rdfs:label "ValidationEvidence" ;
+  rdfs:comment "Evidence from an independent validation process, validator credential, or validation registry projection." .
+
+aptrust:OutcomeEvidence a owl:Class ;
+  rdfs:subClassOf aptrust:TrustSignal ;
+  rdfs:label "OutcomeEvidence" ;
+  rdfs:comment "Evidence that work completed with a cited artifact/outcome credential." .
+
+aptrust:FeedbackSignal a owl:Class ;
+  rdfs:subClassOf aptrust:ReputationEvidence ;
+  rdfs:label "FeedbackSignal" ;
+  rdfs:comment "Feedback from a client/human/agent interaction. Must include provenance and anti-spam/authorization evidence if used for ranking." .
+
+aptrust:TrustGraphEdge a owl:Class ;
+  rdfs:subClassOf prov:Entity ;
+  rdfs:label "TrustGraphEdge" ;
+  rdfs:comment "An evidence-backed edge between agents or facets in the public trust graph." .
+
+aptrust:TrustScore a owl:Class ;
+  rdfs:subClassOf dul:Parameter ;
+  rdfs:label "TrustScore" ;
+  rdfs:comment "A computed score over evidence under a named policy and graph snapshot. Score is derived evidence, not authority." .
+
+aptrust:signalSubject a owl:ObjectProperty ;
+  rdfs:domain aptrust:TrustSignal ;
+  rdfs:range ap:Agent ;
+  rdfs:label "signalSubject" .
+
+aptrust:signalIssuer a owl:ObjectProperty ;
+  rdfs:domain aptrust:TrustSignal ;
+  rdfs:range ap:Agent ;
+  rdfs:label "signalIssuer" .
+
+aptrust:signalValue a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustSignal ;
+  rdfs:range xsd:decimal ;
+  rdfs:label "signalValue" .
+
+aptrust:signalTag a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustSignal ;
+  rdfs:range xsd:string ;
+  rdfs:label "signalTag" .
+
+aptrust:derivedUnderPolicy a owl:ObjectProperty ;
+  rdfs:domain aptrust:TrustScore ;
+  rdfs:range apdisc:TrustPolicy ;
+  rdfs:label "derivedUnderPolicy" .
+
+aptrust:usesTrustSignal a owl:ObjectProperty ;
+  rdfs:domain apdisc:TrustDetermination ;
+  rdfs:range aptrust:TrustSignal ;
+  rdfs:label "usesTrustSignal" .
+
+aptrust:hasTrustScore a owl:ObjectProperty ;
+  rdfs:domain apdisc:TrustDetermination ;
+  rdfs:range aptrust:TrustScore ;
+  rdfs:label "hasTrustScore" .
+
+# ═══════════════════════════════════════════════════════════════════════════
+# T-BOX PROMOTION of the projected trust-fabric terms (facet-registries G1; spec 331)
+# ═══════════════════════════════════════════════════════════════════════════
+#
+# WHAT WAS WRONG. `apps/demo-discovery-indexer/src/ontology.ts` coined a set of `ap:` terms for
+# the relationship and attestation projectors and wrote them into the production graph;
+# `apps/demo-discovery-mcp/src/graphdb.ts` queries them by name (`?e ap:edgeId ?eid ;
+# ap:edgeSubject ?subj ; ap:edgeObject ?obj ; …`). None of them were ever declared in a T-box.
+# `aprel:` is a declared namespace with no module and no terms, and this file typed the EDGE
+# (aptrust:TrustGraphEdge) while declaring nothing about its subject, object, type or status.
+# The result was a live query path over undeclared vocabulary — exactly the read-path-without-a-
+# definition condition ADR-0013 forbids, and the mirror image of gap G5 on the write side.
+#
+# WHY THE `ap:` PREFIX IS RETAINED RATHER THAN RE-MINTED AS `aptrust:` OR `aprel:`.
+# The IRIs are already in the deployed GraphDB and already in the MCP's SPARQL query TEXT.
+# Re-prefixing them is a graph migration plus a coordinated Worker deploy, not an edit — and it
+# would buy nothing semantic, because a T-box term's namespace is not its meaning. This follows
+# the established discipline (facet-registries §7, ADR-0051): IDENTIFIERS KEEP THEIR NAMES, prose
+# and docs use the canonical term. The alternative considered and rejected was declaring `aptrust:`
+# twins as owl:equivalentProperty aliases — that is a SECOND mechanism for one read path, which
+# ADR-0013 forbids more strongly than it forbids an awkward prefix.
+#
+# NOTHING IS MINTED HERE. Every term below is verbatim the IRI the indexer already emits.
+# Promotion is a declaration, not a change; the graph is unaffected.
+#
+# ENDPOINT-RELATIVE vs ABSOLUTE — the invariant that decides which properties sit where.
+# One on-chain AgentRelationship edge is ONE record shared by both endpoints, and the edge node's
+# IRI derives from the deterministic on-chain edgeId, so BOTH agents project the SAME subject.
+# Its properties must therefore be endpoint-INDEPENDENT. `ap:edgeDirection` and `ap:relatedAgent`
+# are meaningful only relative to whoever is looking, so they hang on the AGENT; the shared edge
+# node states subject and object ABSOLUTELY.
+
+@prefix apreg: <https://agenticprimitives.dev/ns/registry#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+
+# ─── Agent → child-node facet links ─────────────────────────────────────────
+
+ap:hasRelationship a owl:ObjectProperty ;
+  rdfs:domain ap:Agent ; rdfs:range aptrust:TrustGraphEdge ;
+  rdfs:label "hasRelationship" ;
+  rdfs:comment "Agent → a projected AgentRelationship edge it is an endpoint of (either side)." .
+
+ap:hasAttestation a owl:ObjectProperty ;
+  rdfs:domain ap:Agent ; rdfs:range apatt:Attestation ;
+  rdfs:label "hasAttestation" ;
+  rdfs:comment "Agent → an AttestationRegistry row in which it is the SUBJECT. Issuer-side rows are not projected onto the issuer: an attestation is evidence ABOUT its subject." .
+
+# ─── Edge-node properties — ABSOLUTE, endpoint-independent ──────────────────
+
+ap:edgeId a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range xsd:string ;
+  rdfs:label "edgeId" ;
+  rdfs:comment "The deterministic on-chain edgeId = computeEdgeId(subject, object, relationshipType). The edge node's IRI derives from it, which is why both endpoints project one shared node." .
+
+ap:edgeSubject a owl:ObjectProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range ap:CanonicalAgentId ;
+  rdfs:label "edgeSubject" ;
+  rdfs:comment "The SA that PROPOSED the edge. On-chain `proposeEdge` requires msg.sender == subject, so this is structurally the proposing party — never inferred, never symmetric with edgeObject." .
+
+ap:edgeObject a owl:ObjectProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range ap:CanonicalAgentId ;
+  rdfs:label "edgeObject" ;
+  rdfs:comment "The SA that CONFIRMED the edge. An edge reaches ACTIVE only through PROPOSED → CONFIRMED → ACTIVE, so an active edge is bilateral by construction: both parties consented on chain." .
+
+ap:relationshipType a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range xsd:string ;
+  rdfs:label "relationshipType" ;
+  rdfs:comment "The well-known label ('HAS_MEMBER', 'VALIDATION_TRUST', 'RECOMMENDS', …) when the type hash resolves; absent otherwise. Never a substitute for relationshipTypeId." .
+
+ap:relationshipTypeId a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range xsd:string ;
+  rdfs:label "relationshipTypeId" ;
+  rdfs:comment "The raw on-chain bytes32 type id, ALWAYS emitted — an unresolved governor-registered type must still be queryable (ADR-0013: no silent gaps)." .
+
+ap:edgeStatus a owl:DatatypeProperty ;
+  rdfs:domain aptrust:TrustGraphEdge ; rdfs:range xsd:string ;
+  rdfs:label "edgeStatus" ;
+  rdfs:comment "'PROPOSED' | 'CONFIRMED' | 'ACTIVE' | 'REVOKED'. Only ACTIVE edges may inform trust scoring — a proposal is one party talking to itself, and revocation is terminal." .
+
+# ─── Agent-level, endpoint-RELATIVE denormalizations ────────────────────────
+
+ap:relatedAgent a owl:ObjectProperty ;
+  rdfs:domain ap:Agent ; rdfs:range ap:CanonicalAgentId ;
+  rdfs:label "relatedAgent" ;
+  rdfs:comment "The COUNTERPARTY as seen from this agent. Endpoint-relative by construction, hence on the agent and never on the shared edge node." .
+
+ap:edgeDirection a owl:DatatypeProperty ;
+  rdfs:domain ap:Agent ; rdfs:range xsd:string ;
+  rdfs:label "edgeDirection" ;
+  rdfs:comment "'subject' | 'object' — which end of the edge THIS agent occupies. Endpoint-relative; see ap:relatedAgent." .
+
+ap:edgeCount a owl:DatatypeProperty ;
+  rdfs:domain ap:Agent ; rdfs:range xsd:integer ; rdfs:label "edgeCount" .
+
+ap:activeEdgeCount a owl:DatatypeProperty ;
+  rdfs:domain ap:Agent ; rdfs:range xsd:integer ;
+  rdfs:label "activeEdgeCount" ;
+  rdfs:comment "Edges in ACTIVE status only. This is the count trustScore reads, and it saturates fast — a public edge is cheap to create, so it is corroboration, never authority." .
+
+# ─── Attestation terms with no apatt: home (the T-box does not model the
+#     on-chain struct's issuer or its isValid(uid) view) ─────────────────────
+
+ap:attestationIssuer a owl:ObjectProperty ;
+  rdfs:domain apatt:Attestation ; rdfs:range ap:CanonicalAgentId ;
+  rdfs:label "attestationIssuer" ;
+  rdfs:comment "The asserting party. AttestationRegistry leaves msg.sender UNCONSTRAINED and derives authority from a recomputed EIP-712 signature, so the issuer here is the SIGNER, never the transaction sender. This is what makes third-party endorsement relayable without the issuer holding gas — the property spec 331's endorsement ceremony depends on." .
+
+ap:attestationValid a owl:DatatypeProperty ;
+  rdfs:domain apatt:Attestation ; rdfs:range xsd:boolean ;
+  rdfs:label "attestationValid" ;
+  rdfs:comment "The contract's isValid(uid) verdict at index time. Note AR-06: there is NO issuer-revoke entrypoint — only the holder or a party may revoke on chain; issuer-side revocation is off-chain via offchainCredentialStatusList and is therefore NOT reflected here." .
+
+ap:attestationCount a owl:DatatypeProperty ;
+  rdfs:domain ap:Agent ; rdfs:range xsd:integer ; rdfs:label "attestationCount" .
+
+ap:validAttestationCount a owl:DatatypeProperty ;
+  rdfs:domain ap:Agent ; rdfs:range xsd:integer ;
+  rdfs:label "validAttestationCount" ;
+  rdfs:comment "Non-revoked attestations where this agent is the SUBJECT. The count trustScore reads." .

package/tbox/values.ttl

@@ -0,0 +1,81 @@
+# T-box — WHAT AN ARGUMENT IS, when it is not a party (spec 363 W2).
+#
+# `PARTY_ROLES` already says what an argument's PARTY may be — a payer is a Treasury or an Organization,
+# an invitee is a Person (or, since spec 372, a Service agent). Nothing said what the REST of an argument is, so every argument that was not an
+# agent was a string, and every branch that touched one re-invented how to read it.
+#
+# THAT COST REAL MONEY. Asked to send 20 USDC a planner wrote `amount: "20"` into a smallest-units field
+# and twenty base units settled — 0.00002 dollars — under a mandate every gate approved. A person who
+# answered "10 usdc" to "how much?" was silently re-asked, because one branch's regex wanted bare digits.
+# A request for "a way to reach your treasury" was sent to somebody being invited to a TEAM, because the
+# kind of thing wanted had no declared value set and defaulted to the only one the code knew.
+#
+# Each of those is one question: WHAT KIND OF VALUE IS THIS, and who is allowed to say. These terms are
+# the answer, and `packages/ontology/src/arg-types.ts` binds arguments to them with ONE reader each — so
+# a person's phrasing is understood identically wherever they typed it, and a refusal always names what
+# it could not read instead of asking the same question again.
+
+@prefix apval: <https://agenticprimitives.dev/ns/value#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:   <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+
+apval: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — Argument values" ;
+    rdfs:comment "The kinds of value a capability argument can hold when it is not an agent: a quantity, an asset, an address for mail, a label, a flag, a kind of agent. One term, one reader (spec 363 §3)." .
+
+apval:Value a owl:Class ;
+    rdfs:label "Value" ;
+    rdfs:comment "A capability argument that is not a party. Its TYPE says how it is read and what a refusal may say." .
+
+apval:Amount a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "Amount" ;
+    rdfs:comment """A quantity OF SOMETHING, said the way people say it: "20", "12.50", "10 usdc", "$10",
+      "1,000". A currency word or symbol beside a figure adds no information a single-asset deployment
+      does not already have, and a thousands comma is punctuation — so all of those read. "10,50" and
+      "a tenner" do NOT, and the honest response is to name what could not be read.
+
+      SMALLEST UNITS ARE NOT AN AMOUNT, they are a REPRESENTATION. Only a caller that computed them (a
+      form, a script) may state them; a planner repeating what a person said may not, because it has no
+      basis for the conversion and getting it wrong moves the wrong money silently.""" .
+
+apval:Asset a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "Asset" ;
+    rdfs:comment """The token a quantity is IN. A deployment fact, not a planner's to recall: asked to
+      send USDC a model wrote Base Sepolia's token address from memory — well-formed, and wrong for this
+      chain. Read as an address, or as a symbol this deployment actually configures.""" .
+
+apval:EmailAddress a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "EmailAddress" ;
+    rdfs:comment "Where someone's mail goes. Checked for shape before it is stored, because a malformed one is discovered later by whoever tried to write to it." .
+
+apval:DisplayLabel a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "DisplayLabel" ;
+    rdfs:comment "A short human string shown back to people — a name for a treasury, what someone calls a household member. Trimmed and bounded; never markup, never a control character." .
+
+apval:Flag a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "Flag" ;
+    rdfs:comment "A yes/no the person actually said. \"true\", \"yes\", \"on\" and their opposites read; anything else is not an answer and is asked again." .
+
+apval:AgentKind a owl:Class ;
+    rdfs:subClassOf apval:Value ;
+    rdfs:label "AgentKind" ;
+    rdfs:comment """WHICH KIND of agent an argument names — a treasury, an organization, a team. Its
+      values are the derived agent TYPES (ADR-0061), so the vocabulary is the one `CLASS_FOR_SUFFIX`
+      already binds rather than a second list.
+
+      IT HAS NO DEFAULT, and that is the point. `wants ?? 'treasury'` sent somebody being invited to a
+      team a request for a way to reach their treasury: two unrelated sentences stapled together, and
+      nothing he could act on. A kind that was not said is asked for.""" .
+
+apval:valueType a owl:ObjectProperty ;
+    rdfs:domain ap:Agent ; rdfs:range apval:Value ;
+    rdfs:label "valueType" ;
+    rdfs:comment "Binds a capability argument to the kind of value it holds. Consumed by the compiled ARG_TYPES table; a binding whose term this T-box does not declare fails the build." .

package/tbox/verification-receipt.ttl

@@ -0,0 +1,134 @@
+# T-box — verification-receipt provenance vocabulary (spec 303).
+# The provenance layer is GROUNDED IN W3C PROV-O: verification is a
+# prov:Activity, its artifacts are prov:Entity, the verifier is the
+# associated prov:SoftwareAgent, and delegated authority is PROV's own
+# relation for it — prov:actedOnBehalfOf (delegate acts on behalf of
+# principal).
+#
+# THE PRIVACY SPLIT, IN PROV TERMS (ADR-0010 amendment 2026-07-07):
+# the PUBLIC receipt entity carries COMMITMENTS — it deliberately has NO
+# prov:actedOnBehalfOf / prov:wasAttributedTo edge to a person principal
+# (that edge would rebuild the correlation graph in the provenance layer).
+# The agent-linkage lives ONLY on the PRIVATE detail entity (vault-resident,
+# DecryptGrant-gated): there, apvr:onBehalfOf ⊑ prov:actedOnBehalfOf binds
+# delegate → principal, and prov:wasAttributedTo names the principal.
+# Opening the commitments (dispute path) is what re-attaches the public
+# receipt to the private PROV agent graph.
+#
+# Consumers: spec 303 receipts (packages/verification-receipts wire shapes
+# project onto these terms); any future A-box projection MUST respect
+# ADR-0040 (public KB rows only from public data — i.e. only the PUBLIC
+# receipt projection, never the detail).
+
+@prefix apvr:   <https://agenticprimitives.dev/ns/verification-receipt#> .
+@prefix ap:     <https://agenticprimitives.dev/ns/core#> .
+@prefix apdel:  <https://agenticprimitives.dev/ns/delegation#> .
+@prefix rdfs:   <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix owl:    <http://www.w3.org/2002/07/owl#> .
+@prefix xsd:    <http://www.w3.org/2001/XMLSchema#> .
+@prefix prov:   <http://www.w3.org/ns/prov#> .
+
+apvr: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — verification-receipt provenance ontology" ;
+    owl:versionInfo "0.1.0" ;
+    rdfs:comment "Spec 303: execution-time verification as PROV-O provenance. Public receipt = commitment entity; private detail = the PROV agent-linkage, vault-resident." .
+
+# ─── The activity ─────────────────────────────────────────────────────
+
+apvr:VerificationActivity a owl:Class ;
+    rdfs:subClassOf prov:Activity ;
+    rdfs:label "Verification Activity" ;
+    rdfs:comment "One execution-time verification: signature check, transaction-parameters-vs-scope comparison, current-revocation check (the verifier duties). prov:wasAssociatedWith the verifying service agent; prov:used the delegation, invocation proof, and chain status evidence." .
+
+# ─── The artifacts (prov:Entity) ──────────────────────────────────────
+
+apvr:VerificationReceipt a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Verification Receipt (public)" ;
+    rdfs:comment "The commitment-only public artifact (VerificationReceiptV1). prov:wasGeneratedBy a VerificationActivity; prov:wasAttributedTo the VERIFIER only (Mode-1 public service agent). Person-linked values appear ONLY as HMAC commitments — no PROV edge to the principal here, by design." .
+
+apvr:VerificationReceiptDetail a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Verification Receipt Detail (private)" ;
+    rdfs:comment "The vault-resident opening material (VerificationReceiptDetailV1). Carries the PROV agent-linkage the public receipt withholds: prov:wasAttributedTo the principal, and the delegate apvr:onBehalfOf the principal. DecryptGrant-gated; destroying it (with the receiptKey) is the erasure path." .
+
+apvr:ChainStatusEvidence a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Chain Status Evidence" ;
+    rdfs:comment "Duty-3 evidence prov:used by the activity: revocation status at (chainId, blockNumber, blockHash). Produced by the chain-state authority reader (spec 289)." .
+
+# ─── Delegation grounding ─────────────────────────────────────────────
+# First PROV declaration of the delegation artifact (the apdel namespace
+# existed as a TS constant only). The EIP-712 delegation IS a prov:Entity;
+# the AUTHORITY RELATION it encodes is prov:actedOnBehalfOf between the
+# delegate and the principal — PROV-O's native modeling of exactly the
+# "acting on behalf" problem the receipts layer exists to evidence.
+
+apdel:Delegation a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "Delegation" ;
+    rdfs:comment "An EIP-712 caveat-scoped delegation (the @agenticprimitives/delegation grant). As provenance: the entity whose verification licenses an apvr:onBehalfOf (⊑ prov:actedOnBehalfOf) relation between delegate and principal." .
+
+apdel:supersedes a owl:ObjectProperty ;
+    rdfs:subPropertyOf prov:wasRevisionOf ;
+    rdfs:domain apdel:Delegation ;
+    rdfs:range apdel:Delegation ;
+    rdfs:label "supersedes" ;
+    rdfs:comment "Spec 410 §1.2 — this delegation was RE-ISSUED for a credential rotation and replaces the one named: same delegator, delegate, terms and salt, validated by the account's approved-digest sentinel under the new custody epoch instead of by a key that is being retired. What it is NOT: a new grant (nothing about the authority changed), a revocation (the old object simply no longer validates), or anything a recovery produces (a recovery re-issues nothing). The record lives in the delegator's vault; the delegate fetches the head of the lineage from the delegator's agent." .
+
+# ─── PROV property specializations ────────────────────────────────────
+
+apvr:onBehalfOf a owl:ObjectProperty ;
+    rdfs:subPropertyOf prov:actedOnBehalfOf ;
+    rdfs:label "on behalf of" ;
+    rdfs:domain prov:Agent ;
+    rdfs:range prov:Agent ;
+    rdfs:comment "The delegated-authority relation the receipt attests: the delegate (session key / service agent) acted on behalf of the principal Smart Agent, under a verified delegation. PRIVATE-detail projection only for person principals (ADR-0010 amendment)." .
+
+apvr:usedDelegation a owl:ObjectProperty ;
+    rdfs:subPropertyOf prov:used ;
+    rdfs:label "used delegation" ;
+    rdfs:domain apvr:VerificationActivity ;
+    rdfs:range apdel:Delegation ;
+    rdfs:comment "The activity consumed this delegation as its authority input (referenced by EIP-712 hash on the wire)." .
+
+apvr:usedStatusEvidence a owl:ObjectProperty ;
+    rdfs:subPropertyOf prov:used ;
+    rdfs:label "used status evidence" ;
+    rdfs:domain apvr:VerificationActivity ;
+    rdfs:range apvr:ChainStatusEvidence .
+
+apvr:opensReceipt a owl:ObjectProperty ;
+    rdfs:label "opens receipt" ;
+    rdfs:domain apvr:VerificationReceiptDetail ;
+    rdfs:range apvr:VerificationReceipt ;
+    rdfs:comment "The detail's receiptKey opens the receipt's commitments (the dispute path). Deliberately NOT a prov:wasDerivedFrom — both entities are co-generated by the activity; this is the opening relation." .
+
+# ─── Datatype properties (wire-shape projection) ──────────────────────
+
+apvr:decision a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string ;
+    rdfs:comment "'allow' | 'deny'." .
+
+apvr:reasonCode a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string ;
+    rdfs:comment "Coarse public taxonomy only — never the private deny detail." .
+
+apvr:scopeDecision a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string ;
+    rdfs:comment "'in_scope' | 'out_of_scope' | 'not_evaluated' — never a verdict that wasn't computed." .
+
+apvr:verifiedAtBucket a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:date ;
+    rdfs:comment "UTC-day bucket. The exact prov:generatedAtTime lives on the PRIVATE detail only (timestamp coarsening is part of the privacy split)." .
+
+apvr:principalCommitment a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string ;
+    rdfs:comment "HMAC-SHA256(receiptKey, principal) — the public stand-in for the withheld prov:actedOnBehalfOf target." .
+
+apvr:argsCommitment a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string .
+
+apvr:receiptHash a owl:DatatypeProperty ;
+    rdfs:domain apvr:VerificationReceipt ; rdfs:range xsd:string ;
+    rdfs:comment "sha256 over the canonical body; the verifier's signature is over this." .

package/versions.adoption.json

@@ -0,0 +1,173 @@
+{
+  "$comment": "Spec 410 §10 — every manifest digest this package has published, each naming its STEWARD. `check:ontology-version-adoption` refuses a T-box change whose new manifest digest is not the latest entry here. An estate adopts one entry (AdoptedVersionV1) by governance proposal; its verifiers bind that digest.",
+  "entries": [
+    {
+      "manifestDigest": "0xe8670c7e790cae65539333c3544818b1830d8cbe6ced533bd1d9db9cd75eb4eb",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-20",
+      "note": "Spec 410: apdel:supersedes (§1), apexec:observedOutcome / providerRef / observedAt (§2), apint:Outcome and OrganizedGathering (§6), ap:RelationshipCredential (§8), governance.ttl and apexec:disputedBy (§10)."
+    },
+    {
+      "manifestDigest": "0x340337249219c7667b53339ad91ca2680a43a3688687112607f1033fe93a1bef",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-20",
+      "note": "Spec 410 §4.4: apexec:estate (the estate a run was performed in) and apexec:ReceiptAnchor with anchorDigest / anchorRegistry / anchoredByAgent / anchorTransaction (the citation beside a carried bundle)."
+    },
+    {
+      "manifestDigest": "0x4f3d52a359a3431a21939380916a872c27f7d011e2a315c0550e0c4017759b9b",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-20",
+      "note": "Spec 410 §7: payload.ttl — appay:PayloadClass and its twelve subclasses (what a write carries), replacing the undeclared apvault: placeholders in the outcome table."
+    },
+    {
+      "manifestDigest": "0x0bb4fe3b98756aa8b77615c2bcd3275a40bccfe202179f097f577a0db498b919",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-24",
+      "note": "Spec 413: content.ttl — apcnt:PublishedWork and its seven properties (a public, owner-released Library document as the discovery KB holds it; ADR-0040 amendment 2026-09-24)."
+    },
+    {
+      "manifestDigest": "0x6cea7241154c37b9737735a1de223b5c5f524b2d6d979d484c296a8727aa7b94",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-25",
+      "note": "Spec 414 A0: skos-imports.ttl (declarations of the W3C SKOS terms already in use); ap:Agent ⊑ prov:Agent (core 0.2.1 — the PROV-O trichotomy the doctrine already states, now machine-readable); apexec:ObservedOutcome ⊑ skos:Concept (execution 0.1.1). No new substrate vocabulary."
+    },
+    {
+      "manifestDigest": "0xf613c6161af432e08a7f8dd3e89770f7e3b28cc9ce6e28cc611c29f49b0791d5",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-25",
+      "note": "Spec 414 A1a: execution 0.2.0 — the trace from the door (apexec:Door, ModelInvocation, Variant, StartingState, CapabilityEngagement ⊑ prov:Influence, governedBySkill), the HarnessCapabilities SKOS scheme (17 concepts incl. judgment) and the EngagementEffect code list; prov-imports 0.1.1 declares prov:Influence. Shapes R8–R11. Door kinds include channel-mention (spec 327's @-mention turn)."
+    },
+    {
+      "manifestDigest": "0xfbba935d2f882e80c32710125d3ccde449a851120032062e1eab2a5310ef57a9",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-25",
+      "note": "Spec 414 A2: evaluation.ttl (apeval: — Metric ⊑ dqv:Metric + skos:Concept, RunMeasurement ⊑ dqv:QualityMeasurement + prov:Entity, Measuring, RunMeasures, 16 intrinsic metrics) and dqv-imports.ttl (the W3C DQV terms the measurement records emit)."
+    },
+    {
+      "manifestDigest": "0xd4ade4e26bee3a98017ad96a1c4825f4cf023d8ba74fedb8b87c01d03a9dfe25",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-25",
+      "note": "Spec 415 S0 + SEL-1: evaluation 0.2.0 — ReplaySet ⊑ dcat:Dataset, ReplayIntent, SelectionCriterion ⊑ ep-plan:Constraint, Judgment, Judge (+ judgeKind), the SelectionOutcomes scheme (8 classes, methodology v1.0 §1); execution — the skill-selection/* capability family (model · ontology · rules · judgment) and offeredCandidate / chose / rejectedNeighbour on an engagement; earl-imports.ttl + dcat-imports.ttl."
+    },
+    {
+      "manifestDigest": "0xf360dd93066b7ba382ff837e316ccbf47624e449d5874a6f1a070d87e8f3816f",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-25",
+      "note": "Spec 415 A4: evaluation 0.3.0 — ExperimentPlan ⊑ p-plan:Plan (replay set / criterion / variants / thresholds by digest, confounded flag), Experiment ⊑ prov:Activity (hasRun ⊑ prov:used, planDigest, refusedCount), CaptureWindow ⊑ prov:Activity (captureLevel, roster, estate) — the eval store and its firewall."
+    },
+    {
+      "manifestDigest": "0xe83f477c927e98769f4b3bbf5f7f0afb7d2224cb55f6e3b18eab6ca5b5907723",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-26",
+      "note": "Spec 415 A4: execution 0.3.0 — the intent typed in the domain ontology on a skill-selection engagement: apexec:inferredRequest (the class the request asks FOR), apexec:inferredAbout, apexec:OutsideDomain."
+    },
+    {
+      "manifestDigest": "0x64b6ec7aeb58ff10757a1d84e81c71e83d425c70347198b241ca79b9622d04ac",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-26",
+      "note": "Spec 415 A4: execution 0.3.1 — apexec:invocationRole gains `judge` (the model call that chose which skill, if any, handles the request), so the selection judge is a model invocation on the run's provenance like the planner and composer."
+    },
+    {
+      "manifestDigest": "0x3571672d4237840d725757b0f26e88514c0a500ea3dbe79fdcb0dca408bbd2e8",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-27",
+      "note": "Spec 418 §2: evaluation 0.4.0 — the TEST CASE as data: apeval:expectedSkill/acceptableSkill/forbiddenSkill/collidesWith, SelectionBehaviour (route · decline · clarify · several · plan), ExpectedPlanStep + planPosition/stepSkill, expectedMissing, exercisesClass, adjudication, message, inReplaySet, underStartingState + holdsClass/recentSkill/memoryTag, latestResult — so a domain projects its evaluation sets into its own graph."
+    },
+    {
+      "manifestDigest": "0x35a8b33b44c5203793f40191b279ade3b254fc68972e973214486a4cd66faa73",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-28",
+      "note": "Spec 420: principles.ttl — appr:DomainPrinciple (statement · governs · enforcedBy · violation · area), appr:ValueHolder ≡ ap:Treasury disjoint with ap:PersonAgent and ap:OrganizationAgent (assets live only in treasuries), and seventeen principles of value, household, membership, charter, room and truth."
+    },
+    {
+      "manifestDigest": "0x0611017398dd4e08e3307582beeacd365b8184ae4c562f2abad87aa9dce6698f",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-28",
+      "note": "Spec 420 §2: transition.ttl — aptr:CapabilityTransition with establishes / requires (SituationPrecondition · StandingPrecondition) / outcomeClass / evidence: a capability as a typed transition between situations, with authority as a precondition and evidence as the proof."
+    },
+    {
+      "manifestDigest": "0xcdd8468804dc87c1a90df91cb4c4a51d2e1af1de76572f9757cac677727f5ee2",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-28",
+      "note": "Spec 420 §10: principles.ttl — appr:namesResolveInContext (a bare name means the person nearest the asker in her context; several at one distance is a question; no directory hit) and appr:disclosureFollowsProximity (the record within a shared context under a grant; attestations and signals beyond it)."
+    },
+    {
+      "manifestDigest": "0x7d3f28f42450f88e88762eb3bd5e7731efaf7ec50e573bfbc167eccceb3e90d2",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-09-29",
+      "note": "Spec 421 §1.2: principles.ttl — appr:othersWordsAreNotHerInstruction (another person's words — a message, a post, a page, a published work — are data her agent may quote and act on where she asks, never an instruction; an act whose party or content comes only from them is not planned from them, and a write of her own records built from them is read back first). Enforced by renderContinuation and requirePersonsTurn; cited by act set 9."
+    },
+    {
+      "manifestDigest": "0x32e63853f05d325bd57bd0768d71665ff7ac136df8b2812444c3cddcffd3736d",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-01",
+      "note": "Spec 422 §3.3 / §9.3: identity.ttl — apcr:ChannelFacet (an email or phone that OPENS a home and is where it is TOLD; never a signer, a quorum slot, a step-up or a recovery signer). Vault records security.credentials (labels over apcr:CredentialFacet) and security.channels bound in vault-records.ts."
+    },
+    {
+      "manifestDigest": "0xc5ae33940a2f2cb4291d2ce93cbaac7ceb5cd97939265be7c4f903ee79b43127",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-02",
+      "note": "context.ttl: a club is an ORGANIZATION whose workspace is coordinated by a .workspace agent (ap:WorkspaceAgent ⊑ ap:ServiceAgent, aporg:coordinatedBy — a service, never an organization by kind) and governed by the club's own organization agent (aporg:Workspace aporg:governedBy <org>). Membership lives on the governing organization (org.membership); a workspace agent holds no members and names its governor in workspace.governor. A club chartered before the pairing keeps its own records."
+    },
+    {
+      "manifestDigest": "0xf64becd4c395e8b7f0d935ca97640a6d4b37fc087ee0073af48f3841ab3361c8",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-05",
+      "note": "Spec 427 W6: org.ttl 0.4.0 — a role definition may OFFER skill packs (aporg:offersSkillPack → aps:AgentArchetype), an invitation may PROPOSE role definitions (aporg:proposesRoleDefinition, spec 324 §5), and a membership's role assignment records what it was offered as words and references: roleDefinitionId, roleName, roleDescription, roleScope, accessRole, offeredSkillPack, assignedBy, assignedAt, roleSetAt. Additive. None is authority: a gate reads the delegation that materializes a role, never its name, its access word or its pack."
+    },
+    {
+      "manifestDigest": "0x4b78a17c2543dfb37288c0e0410caa318b76db71c3b830c64d94b25bde3f4c7c",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-10",
+      "note": "Spec 434 W0: inference.ttl 0.1.0 (apinf:) — ModelProfile, ModelCatalogEntry (enabled), ClientEntitlement (the gateway's own policy, never a delegation), InferenceReceipt ⊑ apix:Receipt (assertedAgent is evidence), BudgetReservation, PolicyChange ⊑ prov:Activity, EstateHeartbeat (counts, never a person); apexec:receiptRef on ModelInvocation; vault bindings inference.receipt: / profile: / model: / client: / policy-change:."
+    },
+    {
+      "manifestDigest": "0x8b12d8212e8c55ccdcb25a4bf1ee4450e1cd384b94c943debe38a55c1661a769",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-10",
+      "note": "Spec 435 W0 + 436 §5.5 + 437: context.ttl 0.2.0 (apctx:Town, apctx:Estate, ap:inEstate — derived, never authority); attestation.ttl 0.2.0 (apatt:TownStanding — the opt-in joint disclosure of a steward; no gate reads it); agent-resolution.ttl 0.2.0 (apar:McpToolManifest, apar:McpToolBundle); inference.ttl 0.2.0 (apinf:TownPulse, apinf:StandingChecklist, apinf:EstateManifest — the Town Ask's records, counts never a person). Vault bindings town.standing: · mcp.manifest: · mcp.bundle: · pulse.day: · pulse.sample: · estate.checklist: · estate.manifest:."
+    },
+    {
+      "manifestDigest": "0x070dc33af2c3790e9ef0764e0f549abeb55dfd2197192a1c8fe9ba5218487306",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-12",
+      "note": "Spec 438 W0: execution.ttl — apexec:workRef (ServiceExecution → apcoord:Endeavor; a REFERENCE, never authority, and may be absent) and apexec:EvidenceStatus with five separate SKOS schemes (coverage · consistency · origin · integrity · assessment), because collapsing them into one flag is how a record view tells a plausible falsehood; evaluation.ttl — apeval:Assessment ⊑ apeval:Judgment with supersedes / criteriaRevision / evaluatorImplementation (a judgment is stored BESIDE the run and never edits it; J1/J2/J6 of 414 §3.4); coordination.ttl — apcoord:CommitmentState scheme over the words the reducer persists (active | fulfilled | withdrawn | reallocated) plus breached | lapsed; a breach is DECLARED by the coordinator after the deadline, never derived by a timer, apcoord:AttributionPolicy and apcoord:AttributionAssessment (evidence, NEVER an entitlement). Vault bindings run.assessment: · endeavor.continuation:. Nothing here is read by any gate."
+    },
+    {
+      "manifestDigest": "0xfca65719b93a247119e089d220f2234b8c8a64afa3dd69831acebd4313c2eab1",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-14",
+      "note": "Spec 410 §4 / ap-federation 439 F1: a NEW module estate.ttl (apest:) — apest:ProjectionSubmission with projectionSet / vouchedDigest / leafBlind / leafSubject / submittedBy / submissionSource / vouchExpiresAt / retiredReason. The estate-projection package has shipped since spec 410 §4 and its records had no vocabulary at all: the roots go to public ground while the LEAVES, with their openings, are the estate's own record, and until now that record lived in a Durable Object with no class and no field meanings. apest:leafBlind is the reason the module exists — the opening is the one value that exists nowhere else, so ADR-0055 makes the record a VAULT record (federation.projection-submission:) rather than a cache, and a vault record needs a class. prov-imports.ttl also gains prov:generatedAtTime and prov:invalidatedAtTime, an ENTITY's two times as distinct from an activity's, because a retired vouch is marked and kept rather than deleted. Nothing here is read by any gate: inclusion in a projected set says a grant was live when the tree was last built, never that a party may act."
+    },
+    {
+      "manifestDigest": "0x4cb39006190be0e359cc32ce3f7d7ebe11b39c1160ca7e3122f50154f8e05d26",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-14",
+      "note": "\"Evals article gap\" W1/W2/W4/W6 — evaluation.ttl to 0.5.0, earl-imports.ttl to 0.1.1. The theme is that EVERY NUMBER SAYS WHAT IT MEANS. W1: a result that is not a verdict names its cause (apeval:FailureCause / failureCause over the closed apeval:FailureCauses — agent, grader or environment), so an estate outage is never read as an agent miss; an assertion also says which repeat it is (apeval:trialIndex) and what kind of grader asserted it (apeval:graderKind), beside EARL's own mode and assertor — which is why earl-imports gains earl:semiAuto. W2: a case may carry a solvability proof the author wrote (apeval:referenceAnswer / referenceScore), held to 1.0 under the graders and never a target to diff against. W4: a replay set says whether it is a capability or a regression suite (apeval:SuiteKind / suiteKind), so the two are never pooled into one number. W6 is the one that matters most: the outcome gold is a dul:Description (apeval:OutcomeDescription, with describesClass / describesMissing / describesAsk) and what a run delivered is a situation that satisfies it or does not (apeval:DeliveredSituation, satisfies, reachedUnder) — the same descriptions-and-situations spine the substrate's own capabilities stand on (spec 420's transitions), rather than a score with a private meaning. Authored by the Home developer; committed here with the ap-home half after typecheck and 848 package tests green (evaluation 188, orchestration 343, ontology 317). Nothing here is read by any gate: an evaluation says how well something worked, never that anyone may act."
+    },
+    {
+      "manifestDigest": "0xaf9c1f034bff9070f87a56cc4efbe2a017744c9876bbc37ce9591a4d29ee4a91",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-15",
+      "note": "spec 305 W2 / zkID alignment §4 (Z3): `apest:projectionSet` gains `live-credential` — a credential issuer's live set, anchored as the issuer's own row on EstateProjectionRegistry (first root slot, charterHash = the issuer tag). Comment-only T-box change; no class or property added or removed."
+    },
+    {
+      "manifestDigest": "0xdf7e54bdb37e5e0a299abb001c4e9ec41430f875c37f41f6cfde69353951f9fb",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-15",
+      "note": "Anonymous credentials — tbox/privacy-credential.ttl (appc:, 0.1.0), specs 304 / 305 / 442 §7.2 / 443 W5 and the zkID alignment waves Z1–Z4 as live at ap-federation's door. New classes: IssuerKeyFacet (anchoredBy an attestation; subject an org or service, never a person) · IssuerRow (the issuer's tagged live-credential root on neutral ground; its leaves are apest:ProjectionSubmission in the live-credential set; revocation = retire + re-anchor) · AnonymousCredential (⊑ apvc:VerifiableCredential; issuedUnder a facet, boundToDeviceKey) · DeviceKey (custodied; signs only under a mandate) · PairwiseAccount (what a verifier sees; NO property to the person, on purpose) · ProofRequest / PredicateProgram / Predicate (the verifier's own question, digested) · PrivatePresentation (answers · presentedUnder · provesPredicate · carriesNullifier · carriesStatus · madeUnderMandate · presents — the last three the holder's record only) · Nullifier (graded: asserted < in-circuit) · CredentialStatusPresentation (statusOf an IssuerRow at a sequence the verifier READ) · PresentationMandate (⊑ apdel:Delegation; audiences · predicate digests · facets · maxPresentations) · PresentationRelease (⊑ prov:Activity; one judgement per device-key signature) · VerifierPolicy (what a door asks and accepts, incl. nullifierWindowSeconds and verifierPlacement) · PredicateAdmissionEvidence (the predicate held, beside an apix:AdmissionReceipt; evidence, never authority). Codelists: presentationSuite, issuerKeySuite, nullifierGrade, predicateOp, verifierPlacement, proofGrade (identity · standing · predicate). Doctrine: proof is evidence, the mandate is authority, the receipt binds the two; no claim value and no link to the person anywhere in the vocabulary."
+    },
+    {
+      "manifestDigest": "0xf5494ddf4f9001f02919cc56d6ab6dd71d4e5a1b5b7efcaa68031f5d21680881",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-15",
+      "note": "apvc: reconciled — five T-box modules (agreement, attestation, fulfillment, payment, privacy-credential) and mappings/spine-standards.ttl bound the prefix to /ns/credential# (apcr's namespace, the CONTROL credentials) while NS.apvc, context.jsonld and the collaboration crosswalk said /ns/verifiable-credential#; and no module declared apvc:VerifiableCredential at all. Now one IRI (verifiable-credential#) everywhere and the class declared once in attestation.ttl (⊑ prov:Entity; owl:equivalentClass w3cvc:VerifiableCredential in the mapping). Every subClassOf apvc:VerifiableCredential axiom in the spine now points at a declared class. No term renamed; the prefix moved."
+    },
+    {
+      "manifestDigest": "0xf1f4359aba735b1cae1ac5f4439d4bd71460a9b5b6a89aed40481e80346f5730",
+      "steward": "richardpedersen3@gmail.com",
+      "publishedAt": "2026-10-15",
+      "note": "spec 442 §11 W0 — tbox/identity.ttl gains the four terms for a person's agent at a company's door (ap:, the core namespace; prov: prefix added): ClientKeyBinding (a Smart Agent's signed statement that one JWK may PRESENT for it at external doors under one custody epoch — a credential, not a delegation; atl:clientKeys on chain) · PairwiseSubject (what one company calls the person: HKDF over a vault secret salted by the issuer; no property to the person, as appc:PairwiseAccount) · ExternalOperation (PAP operation / ACP session / UCP checkout seen from our side — an INTENT whose digest a mandate binds; never an approval) · ExternalAccountLink (the account at one company and the credentials it left behind; a vault record the Security section lists and revokes). Properties: clientId, jwkThumbprint, jwsAlgorithm, boundUnderCustodyEpoch, bindingNotBefore/After, pairwiseIssuer, pairwiseSubjectDigest, operationAuthority, operationId, operationRevision, termsDigest, accountGrantedAt/ExpiresAt/LastUsedAt, grantedScope. Bound in vault-records.ts: identity.client-key-binding: · identity.pairwise-secret · identity.external-account-link:. Doctrine: approval is a signature, never an assertion; the person is never the client_id; protocol vocabulary (poppy.json, DPoP, Idempotency-Key) stays in ap-federation (spec 443). Nothing here is read by any verifier."
+    }
+  ]
+}