@agenticprimitives/ontology 1.0.0-alpha.4 → 1.0.0-alpha.40

package/cbox/naming-registry-shapes.shacl.ttl

@@ -0,0 +1,272 @@
+# C-box — SHACL shapes for typed names, contextual issuance, the workspace agent and registry agents,
+# registration receipts and the lifecycle log (spec 346 §11; ADR-0061).
+#
+# STRUCTURE, NEVER PERMISSION. A typed name that conforms is still only a claim; a receipt that
+# conforms is evidence, not authority (ADR-0020); a conformant lifecycle event proves the log's
+# shape, not the truth of the event. What these refuse is a record that misleads on its face:
+#
+#   a `.team` name on a Person                  — the suffix contradicts the on-chain record; the
+#                                                 record wins, so the name must not resolve (§2.3)
+#   a workspace agent serving two workspaces        — two contexts behind one agentive face
+#   a registry agent operating no registry      — a '.registry' name that names nothing
+#   a receipt that omits a check                — 'not verified' silently read as 'verified'
+#   a receipt listing a check twice             — verified AND failed: which is it?
+#   an event with no chain link                 — an append-only log that can be rewritten
+#
+# SUBCLASS HANDLING. sh:class against ap:Agent / ap:OrganizationAgent relies on the rdfs:subClassOf*
+# closure; shacl-engine 1.1.2 does not compute it. The house test materializes it from the T-box
+# first. The SPARQL constraints need the cbox codelists (controlled-vocabularies.ttl,
+# registry-vocabulary.ttl) IN THE DATA GRAPH — they join on skos:prefLabel / skos:inScheme.
+
+@prefix apnam: <https://agenticprimitives.dev/ns/naming#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix aporg: <https://agenticprimitives.dev/ns/org#> .
+@prefix apreg: <https://agenticprimitives.dev/ns/registry#> .
+@prefix apdel: <https://agenticprimitives.dev/ns/delegation#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+@prefix sh:    <http://www.w3.org/ns/shacl#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+
+# ─── Typed names (§3.1, §2.3) ───────────────────────────────────────────────
+# Targets names that CARRY a tld. Legacy roots (.agent / .impact) carry none and are exempt — they
+# keep resolving as legacy throughout (spec 346 §3.5); a shape that failed them would be a migration.
+
+apnam:TypedAgentNameShape a sh:NodeShape ;
+  rdfs:label "TypedAgentName shape" ;
+  sh:targetSubjectsOf apnam:tld ;
+
+  sh:property [
+    sh:path apnam:tld ;
+    sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:in ( "me" "org" "team" "svc" "workspace" "treasury" "registry" ) ;
+    sh:message "Exactly one canonical tld from apnam:tldScheme: me | org | team | svc | workspace | treasury | registry. 'ws' is an alias resolved before storage; .alliance and .agent are reserved/inactive." ;
+  ] ;
+  sh:property [
+    sh:path apnam:resolvesTo ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "A typed name resolves to exactly one canonical Agent — every suffix names an agent; there are no non-agent subjects in the naming registry (ADR-0061 §4)." ;
+  ] ;
+  # The suffix is a CLAIM; the SA-keyed ap:agentType record is the authority. Disagreement resolves
+  # to null with reason type_mismatch (ADR-0013: empty is an answer) — so it must be a violation here.
+  sh:sparql [
+    sh:message "The name's tld MUST name the derived type recorded on its target (ap:agentType, via apnam:namesDerivedType). The suffix never overrides the record; the record never bends to the suffix (spec 346 §2.3)." ;
+    sh:select """
+      SELECT $this ?tld ?actual ?expected WHERE {
+        $this <https://agenticprimitives.dev/ns/naming#tld> ?tld ;
+              <https://agenticprimitives.dev/ns/naming#resolvesTo> ?agent .
+        ?agent <https://agenticprimitives.dev/ns/core#agentType> ?actual .
+        ?concept <http://www.w3.org/2004/02/skos/core#inScheme> <https://agenticprimitives.dev/ns/naming#tldScheme> ;
+                 <http://www.w3.org/2004/02/skos/core#prefLabel> ?tld ;
+                 <https://agenticprimitives.dev/ns/naming#namesDerivedType> ?expected .
+        FILTER (?actual != ?expected)
+      }
+    """ ;
+  ] .
+
+# ─── Contextual issuance (§3.2, §9) ─────────────────────────────────────────
+
+apnam:ContextualNameIssuanceShape a sh:NodeShape ;
+  rdfs:label "ContextualNameIssuance shape" ;
+  sh:targetClass apnam:ContextualNameIssuance ;
+
+  sh:property [
+    sh:path apnam:issuedBy ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:or ( [ sh:class ap:OrganizationAgent ] [ sh:class ap:WorkspaceAgent ] ) ;
+    sh:message "Exactly one issuedBy, and it MUST be a context that owns a namespace: an OrganizationAgent (incl. a Team) or a WorkspaceAgent. A person issues no contextual names." ;
+  ] ;
+  sh:property [
+    sh:path apnam:issuedFor ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "Exactly one issuedFor — the canonical subject the contextual name refers to." ;
+  ] ;
+  sh:property [
+    sh:path apnam:issuanceBasis ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class apdel:Delegation ;
+    sh:message "Exactly one issuanceBasis — the Delegation whose liveness makes the name CURRENT. No basis, no name: a contextual name is a reference over a live delegation, never an identity (ADR-0061 §6)." ;
+  ] ;
+  sh:property [
+    sh:path apnam:issuanceKind ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:in ( "scoped" "reference" ) ;
+    sh:message "issuanceKind is exactly one of scoped | reference." ;
+  ] ;
+  sh:property [
+    sh:path apnam:issuedName ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "The issued contextual form is recorded verbatim." ;
+  ] ;
+  sh:sparql [
+    sh:message "A 'reference' issuance names ANOTHER agent in the issuer's namespace: issuedFor MUST differ from issuedBy." ;
+    sh:select """
+      SELECT $this WHERE {
+        $this <https://agenticprimitives.dev/ns/naming#issuanceKind> "reference" ;
+              <https://agenticprimitives.dev/ns/naming#issuedBy> ?ctx ;
+              <https://agenticprimitives.dev/ns/naming#issuedFor> ?ctx .
+      }
+    """ ;
+  ] .
+
+# ─── The two named service roles that are also derived types (§2.1) ─────────
+
+ap:WorkspaceAgentShape a sh:NodeShape ;
+  rdfs:label "WorkspaceAgent shape" ;
+  sh:targetClass ap:WorkspaceAgent ;
+
+  sh:property [
+    sh:path aporg:coordinatesWorkspace ;
+    sh:maxCount 1 ; sh:class aporg:Workspace ;
+    sh:message "A WorkspaceAgent custodies and serves AT MOST ONE Workspace (spec 346 §2.2) — the '.workspace' name is one context's agentive face, not a multiplexer." ;
+  ] ;
+  sh:property [
+    sh:path ap:serviceRole ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:hasValue "workspace" ;
+    sh:message "serviceRole MUST be exactly 'workspace' — the §2.3 claim-time invariant, made structural." ;
+  ] .
+
+ap:RegistryAgentShape a sh:NodeShape ;
+  rdfs:label "RegistryAgent shape" ;
+  sh:targetClass ap:RegistryAgent ;
+
+  sh:property [
+    sh:path apreg:operatesRegistry ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class apreg:Registry ;
+    sh:message "A RegistryAgent operates EXACTLY ONE apreg:Registry — a '.registry' name that operates nothing names nothing; one that operates two is two registries' face." ;
+  ] ;
+  sh:property [
+    sh:path ap:serviceRole ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:hasValue "registry" ;
+    sh:message "serviceRole MUST be exactly 'registry'." ;
+  ] .
+
+# ─── Registration receipt (§7.2) ────────────────────────────────────────────
+
+apreg:RegistrationReceiptShape a sh:NodeShape ;
+  rdfs:label "RegistrationReceipt shape" ;
+  sh:targetClass apreg:RegistrationReceipt ;
+
+  sh:property [
+    sh:path apreg:inRegistry ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class apreg:Registry ;
+    sh:message "A receipt belongs to exactly one Registry." ;
+  ] ;
+  sh:property [
+    sh:path apreg:subjectAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "A receipt is about exactly one canonical subject Agent." ;
+  ] ;
+  sh:property [
+    sh:path apreg:subjectType ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:node [ sh:property [ sh:path skos:inScheme ; sh:hasValue ap:agentTypeScheme ] ] ;
+    sh:message "subjectType is exactly one ap:agentTypeScheme concept — the derived type the admission checked." ;
+  ] ;
+  sh:property [
+    sh:path apreg:receiptSigner ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:RegistryAgent ;
+    sh:message "A receipt is signed by exactly one RegistryAgent — the operator SA; an unsigned receipt is a claim by nobody." ;
+  ] ;
+  sh:property [
+    sh:path apreg:admittedAt ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:dateTime ;
+    sh:message "admittedAt is required — 'verified on <date>' is the whole consumer-facing claim." ;
+  ] ;
+  # Every listed check is a real AdmissionCheck …
+  sh:property [
+    sh:path [ sh:alternativePath ( apreg:verifiedCheck apreg:failedCheck apreg:notVerifiedCheck ) ] ;
+    sh:node [ sh:property [ sh:path skos:inScheme ; sh:hasValue apreg:admissionCheckScheme ] ] ;
+    sh:message "Every verified / failed / notVerified value MUST be an apreg:admissionCheckScheme concept." ;
+  ] ;
+  # … appears in AT MOST one list …
+  sh:property [
+    sh:path apreg:verifiedCheck ; sh:disjoint apreg:failedCheck ;
+    sh:message "A check cannot be both verified and failed." ;
+  ] ;
+  sh:property [
+    sh:path apreg:verifiedCheck ; sh:disjoint apreg:notVerifiedCheck ;
+    sh:message "A check cannot be both verified and not-verified." ;
+  ] ;
+  sh:property [
+    sh:path apreg:failedCheck ; sh:disjoint apreg:notVerifiedCheck ;
+    sh:message "A check cannot be both failed and not-verified." ;
+  ] ;
+  # … and in AT LEAST one. Together: exactly one. Omission is the dangerous direction — a missing
+  # line is read as 'verified' by anyone who does not know to look for it.
+  sh:sparql [
+    sh:message "Every AdmissionCheck in apreg:admissionCheckScheme MUST appear in exactly one of verifiedCheck / failedCheck / notVerifiedCheck. 'Not verified' is a first-class outcome and is RECORDED, never omitted (spec 346 §7.1)." ;
+    sh:select """
+      SELECT $this ?check WHERE {
+        ?check <http://www.w3.org/2004/02/skos/core#inScheme> <https://agenticprimitives.dev/ns/registry#admissionCheckScheme> .
+        FILTER NOT EXISTS { $this <https://agenticprimitives.dev/ns/registry#verifiedCheck> ?check }
+        FILTER NOT EXISTS { $this <https://agenticprimitives.dev/ns/registry#failedCheck> ?check }
+        FILTER NOT EXISTS { $this <https://agenticprimitives.dev/ns/registry#notVerifiedCheck> ?check }
+      }
+    """ ;
+  ] .
+
+# ─── The append-only lifecycle log (§7.3) ───────────────────────────────────
+
+apreg:RegistryLifecycleEventShape a sh:NodeShape ;
+  rdfs:label "RegistryLifecycleEvent shape" ;
+  sh:targetClass apreg:RegistryLifecycleEvent ;
+
+  sh:property [
+    sh:path apreg:inRegistry ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class apreg:Registry ;
+    sh:message "An event belongs to exactly one Registry — the log whose sequence it occupies." ;
+  ] ;
+  sh:property [
+    sh:path apreg:eventKind ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:node [ sh:property [ sh:path skos:inScheme ; sh:hasValue apreg:lifecycleEventScheme ] ] ;
+    sh:message "eventKind is exactly one apreg:lifecycleEventScheme concept." ;
+  ] ;
+  sh:property [
+    sh:path apreg:eventSequence ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:nonNegativeInteger ;
+    sh:message "Exactly one eventSequence (xsd:nonNegativeInteger) — the event's position in the log." ;
+  ] ;
+  sh:property [
+    sh:path apreg:eventDigest ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "Exactly one eventDigest — the value the next event chains to." ;
+  ] ;
+  sh:property [
+    sh:path apreg:occurredAt ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:dateTime ;
+    sh:message "occurredAt is required." ;
+  ] ;
+  sh:property [
+    sh:path apreg:previousEventDigest ;
+    sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "At most one previousEventDigest." ;
+  ] ;
+  sh:sparql [
+    sh:message "Every event with eventSequence > 0 MUST carry previousEventDigest — without the chain link the log is append-only in name only (spec 346 §7.3)." ;
+    sh:select """
+      SELECT $this ?seq WHERE {
+        $this <https://agenticprimitives.dev/ns/registry#eventSequence> ?seq .
+        FILTER (?seq > 0)
+        FILTER NOT EXISTS { $this <https://agenticprimitives.dev/ns/registry#previousEventDigest> ?prev }
+      }
+    """ ;
+  ] .
+
+# Kept as its OWN NodeShape: shacl-engine 1.1.2 compiles the sh:sparql constraints of one shape as a
+# single unit (one select, all messages), so two sh:sparql on one shape mis-report. One per shape.
+apreg:RegistryLogSequenceShape a sh:NodeShape ;
+  rdfs:label "RegistryLogSequence shape" ;
+  sh:targetClass apreg:RegistryLifecycleEvent ;
+  sh:sparql [
+    sh:message "eventSequence MUST be unique within a registry — two events at one position means the log was forked or rewritten (spec 346 §7.3: strictly increasing per registry)." ;
+    sh:select """
+      SELECT $this ?other ?seq WHERE {
+        $this  <https://agenticprimitives.dev/ns/registry#inRegistry> ?registry ;
+               <https://agenticprimitives.dev/ns/registry#eventSequence> ?seq .
+        ?other <https://agenticprimitives.dev/ns/registry#inRegistry> ?registry ;
+               <https://agenticprimitives.dev/ns/registry#eventSequence> ?seq .
+        FILTER (?other != $this)
+      }
+    """ ;
+  ] .

package/cbox/org-team-shapes.shacl.ttl

@@ -0,0 +1,184 @@
+# C-box — SHACL shapes for team affiliation, the workspace plane, representations and
+# responsibilities (spec 344 §4.6).
+#
+# STRUCTURE, NEVER PERMISSION (ADR-0043/ADR-0048). A conformant TeamAffiliation is not a charter, a
+# conformant Workspace grants nobody anything, and a conformant ResponsibilityAssignment authorizes
+# no act. Each shape exists because its absence lets a record be written that cannot later be
+# interpreted — or, in one case, that would be interpreted as PERMISSIVE by default:
+#
+#   an affiliation with no kind / two teams     — which side is the team, and chartered or engaged?
+#   a workspace with no governor                — whose policy, whose vault, whose audit context?
+#   an open workspace with asserted members     — two participation models on one plane
+#   a representation with no sharing policy     — THE FAIL-CLOSED FLOOR: absence of a policy is
+#                                                 never public; an unclassified projection fails
+#   a responsibility carrying grant terms       — a responsibility that looks like an authorization
+#
+# SUBCLASS HANDLING. Several constraints use sh:class against a SUPERCLASS (ap:Agent,
+# ap:OrganizationAgent) and rely on SHACL-instance-of (rdf:type/rdfs:subClassOf*). shacl-engine 1.1.2
+# does not compute that closure; the house test materializes it from tbox/core.ttl + tbox/org.ttl before
+# validating. Any other consumer must do the same or load an RDFS-inferencing store.
+
+@prefix aporg: <https://agenticprimitives.dev/ns/org#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix apdel: <https://agenticprimitives.dev/ns/delegation#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+@prefix sh:    <http://www.w3.org/ns/shacl#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+
+# ─── Team affiliation (§1.2) ────────────────────────────────────────────────
+
+aporg:TeamAffiliationShape a sh:NodeShape ;
+  rdfs:label "TeamAffiliation shape" ;
+  sh:targetClass aporg:TeamAffiliation ;
+
+  sh:property [
+    sh:path aporg:teamAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:TeamAgent ;
+    sh:message "A TeamAffiliation names exactly one teamAgent, and it MUST be an ap:TeamAgent (profileType 'team') — an informal WorkingGroup cannot be affiliated, it is not an agent (spec 344 §1.1)." ;
+  ] ;
+  sh:property [
+    sh:path aporg:affiliatedOrganization ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:OrganizationAgent ;
+    sh:message "A TeamAffiliation names exactly one affiliatedOrganization (an org, team or alliance)." ;
+  ] ;
+  sh:property [
+    sh:path aporg:affiliationKind ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:in ( aporg:CharteredAffiliation aporg:EngagedAffiliation ) ;
+    sh:message "affiliationKind is exactly one of aporg:affiliationKindScheme: chartered | engaged. An affiliation of no kind cannot be read as a charter OR as an engagement." ;
+  ] ;
+  # A team is itself an OrganizationAgent, so nothing else stops it from being 'affiliated' with itself.
+  sh:property [
+    sh:path aporg:teamAgent ;
+    sh:disjoint aporg:affiliatedOrganization ;
+    sh:message "The two sides of a TeamAffiliation MUST be distinct agents — a team cannot charter or engage itself." ;
+  ] ;
+  sh:property [
+    sh:path aporg:mandatedByDelegation ;
+    sh:maxCount 1 ; sh:class apdel:Delegation ;
+    sh:message "At most one chartering mandate, and it is a Delegation reference — the gate verifies the delegation, never this record." ;
+  ] .
+
+# ─── The workspace plane (§2) ───────────────────────────────────────────────
+
+aporg:WorkspaceShape a sh:NodeShape ;
+  rdfs:label "Workspace shape" ;
+  sh:targetClass aporg:Workspace ;
+
+  sh:property [
+    sh:path aporg:governedBy ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:OrganizationAgent ;
+    sh:message "A Workspace is governed by exactly one OrganizationAgent (org, team or alliance) — the source of every policy it has and the owner of the vault its records live in (ADR-0055). A workspace has no authority of its own." ;
+  ] ;
+  sh:property [
+    sh:path aporg:workspaceParticipationPolicy ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:in ( aporg:OpenWorkspace aporg:RestrictedWorkspace ) ;
+    sh:message "Exactly one workspaceParticipationPolicy from aporg:workspacePolicyScheme: open | restricted. Absence would have to be read as one of them, and the convenient reading is 'open'." ;
+  ] ;
+  sh:property [
+    sh:path aporg:workspaceProfile ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:node [ sh:property [ sh:path skos:inScheme ; sh:hasValue aporg:workspaceProfileScheme ] ] ;
+    sh:message "One primary workspaceProfile, a concept of aporg:workspaceProfileScheme (domain packs extend the scheme, so membership is checked rather than a closed list)." ;
+  ] ;
+  sh:property [
+    sh:path aporg:coordinatedBy ;
+    sh:maxCount 1 ; sh:class ap:WorkspaceAgent ;
+    sh:message "At most one workspace agent, and it is an ap:WorkspaceAgent — the workspace's single agentive face (ADR-0061 §4). Two workspace agents would be two names for one context." ;
+  ] ;
+  # An 'open' workspace DERIVES participation from the governor's membership; an asserted
+  # WorkspaceParticipation on it would be a second, contradicting participation model.
+  sh:sparql [
+    sh:message "An OPEN workspace MUST NOT have asserted WorkspaceParticipation records — participation is derived from the governor's membership, never asserted (spec 344 §2.1). Make it restricted, or drop the assertions." ;
+    sh:select """
+      SELECT $this ?participation WHERE {
+        $this <https://agenticprimitives.dev/ns/org#workspaceParticipationPolicy> <https://agenticprimitives.dev/ns/org#OpenWorkspace> .
+        ?participation <https://agenticprimitives.dev/ns/org#inWorkspace> $this .
+      }
+    """ ;
+  ] .
+
+aporg:WorkspaceParticipationShape a sh:NodeShape ;
+  rdfs:label "WorkspaceParticipation shape" ;
+  sh:targetClass aporg:WorkspaceParticipation ;
+
+  sh:property [
+    sh:path aporg:participantAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "Exactly one participantAgent — ANY agent kind (a person, or an org/team that projects its own live roster in; the Gather27 GatherHost shape)." ;
+  ] ;
+  sh:property [
+    sh:path aporg:inWorkspace ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class aporg:Workspace ;
+    sh:message "Exactly one inWorkspace — a participation that names no workspace, or two, is not a participation in anything." ;
+  ] .
+
+# ─── Representations (§2.2) — the fail-closed floor ─────────────────────────
+
+aporg:WorkspaceRepresentationShape a sh:NodeShape ;
+  rdfs:label "WorkspaceRepresentation shape" ;
+  sh:targetClass aporg:WorkspaceRepresentation ;
+
+  sh:property [
+    sh:path aporg:represents ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:message "A representation projects exactly one domain entity." ;
+  ] ;
+  sh:property [
+    sh:path aporg:representationOfWorkspace ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class aporg:Workspace ;
+    sh:message "A representation is scoped to exactly one Workspace — the plane whose policy bounds it." ;
+  ] ;
+  sh:property [
+    sh:path aporg:sourceCustodian ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "Exactly one sourceCustodian — whose vault holds the authoritative record. Custody NEVER moves into the workspace." ;
+  ] ;
+  # THE FLOOR. Not a default, not a warning: a representation with no disclosure bound is refused
+  # at the structural level, because the only alternative reading of 'no policy' is 'public'.
+  sh:property [
+    sh:path aporg:sharingPolicy ;
+    sh:minCount 1 ;
+    sh:message "A WorkspaceRepresentation MUST carry a sharingPolicy. Absence of a policy is never public — an unclassified representation fails closed (spec 344 §2.2 normative floor)." ;
+  ] .
+
+# ─── Responsibility (§1.5) — never an authorization ─────────────────────────
+
+aporg:ResponsibilityShape a sh:NodeShape ;
+  rdfs:label "ResponsibilityAssignment shape" ;
+  sh:targetClass aporg:ResponsibilityAssignment ;
+
+  sh:property [
+    sh:path aporg:responsibleAgent ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "Exactly one responsibleAgent — the one expected to care for the outcome." ;
+  ] ;
+  sh:property [
+    sh:path aporg:accountableAgent ;
+    sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "At most one accountableAgent — who answers for the result; MAY differ from the responsible agent." ;
+  ] ;
+  sh:property [
+    sh:path aporg:responsibilityKind ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:message "A responsibility has exactly one kind." ;
+  ] ;
+  sh:property [
+    sh:path aporg:underMandate ;
+    sh:maxCount 1 ; sh:class apdel:Delegation ;
+    sh:message "underMandate is a REFERENCE to the delegation the responsible agent exercises — at most one, and never the grant itself." ;
+  ] ;
+  # A ResponsibilityAssignment MUST NOT carry the authority-materialization terms a RoleAssignment
+  # does. The moment one does, a reader has a record that looks like an authorization and is not.
+  sh:property [
+    sh:path aporg:materializedByDelegation ;
+    sh:maxCount 0 ;
+    sh:message "A ResponsibilityAssignment MUST NOT carry aporg:materializedByDelegation — a responsibility is never an authorization; that term belongs to RoleAssignment (spec 344 §1.5)." ;
+  ] ;
+  sh:property [
+    sh:path aporg:supportedByEntitlement ;
+    sh:maxCount 0 ;
+    sh:message "A ResponsibilityAssignment MUST NOT carry aporg:supportedByEntitlement — grant terms on a responsibility make it read as authority." ;
+  ] .

package/cbox/privacy-credential-shapes.shacl.ttl

@@ -0,0 +1,187 @@
+# C-box — SHACL shapes for anonymous credentials (tbox/privacy-credential.ttl; specs 304 / 305 / 442 §7.2 / 443 W5).
+#
+# STRUCTURE, NEVER PERMISSION. A conformant presentation is still only a claim a verifier has yet to check; a
+# conformant mandate authorizes nothing by being well-formed; conformant evidence is evidence. What these refuse is a
+# record that would MISLEAD ON ITS FACE or LEAK BY ITS SHAPE:
+#
+#   a pairwise account linked to a person          — the one join this vocabulary exists to withhold (INV-305-1)
+#   a presentation carrying a claim value          — the suite reveals none; a record that does was not made by it
+#   a presentation answering no request            — a proof of nothing in particular
+#   a nullifier with no audience or no grade       — "one visit" per what, worth how much?
+#   a facet whose subject is a person              — a person's agent holds credentials; it does not issue them
+#   a facet with no attestation                    — a document alone proves nothing; the chain does
+#   a mandate naming no audience                   — a device key that may sign for anyone
+#   evidence with no facet or no predicate digest  — "a predicate held" with neither named is not evidence
+#
+# SUBCLASS HANDLING. sh:class against ap:Agent relies on the rdfs:subClassOf* closure; the house test materializes it
+# from the T-box first. The SPARQL constraints need the cbox codelists in the data graph (they join on skos:inScheme).
+
+@prefix appc:  <https://agenticprimitives.dev/ns/privacy-credential#> .
+@prefix apatt: <https://agenticprimitives.dev/ns/attestation#> .
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
+@prefix sh:    <http://www.w3.org/ns/shacl#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
+
+# ─── The pairwise account names no person ────────────────────────────────────────────────────────
+appc:PairwiseAccountShape a sh:NodeShape ;
+  rdfs:label "PairwiseAccount shape" ;
+  sh:targetClass appc:PairwiseAccount ;
+  sh:property [
+    sh:path appc:pairwiseFor ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:anyURI ;
+    sh:message "A pairwise account exists for exactly ONE verifier origin (appc:pairwiseFor). The same holder at another origin is another account." ;
+  ] ;
+  sh:sparql [
+    sh:message "A pairwise account MUST NOT be linked to any Agent: the join from the account a verifier sees to the person exists only in her vault (INV-305-1, ADR-0025). A triple from this account to an ap:Agent, under any property, is the disclosure this vocabulary withholds." ;
+    sh:select """
+      SELECT $this ?p ?agent WHERE {
+        $this ?p ?agent .
+        ?agent a/<http://www.w3.org/2000/01/rdf-schema#subClassOf>* <https://agenticprimitives.dev/ns/core#Agent> .
+      }
+    """ ;
+  ] .
+
+# ─── A presentation answers one request, names its facet, and carries no claim value ────────────
+appc:PrivatePresentationShape a sh:NodeShape ;
+  rdfs:label "PrivatePresentation shape" ;
+  sh:targetClass appc:PrivatePresentation ;
+  sh:property [
+    sh:path appc:answersRequest ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class appc:ProofRequest ;
+    sh:message "A presentation answers exactly ONE proof request — the verifier's own, with its audience and single-use nonce. A proof answering no request is a proof of nothing in particular." ;
+  ] ;
+  sh:property [
+    sh:path appc:presentedUnder ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class appc:IssuerKeyFacet ;
+    sh:message "A presentation names the ONE issuer facet it was made under; the verifier resolves it through the chain and checks the proven key against it." ;
+  ] ;
+  sh:property [
+    sh:path appc:provesPredicate ;
+    sh:maxCount 1 ; sh:class appc:PredicateProgram ;
+    sh:message "At most one predicate program per presentation — the request's." ;
+  ] ;
+  sh:property [
+    sh:path appc:carriesNullifier ;
+    sh:maxCount 1 ; sh:class appc:Nullifier ;
+    sh:message "At most one nullifier, for the request's audience." ;
+  ] ;
+  sh:property [
+    sh:path appc:predicateClaim ;
+    sh:maxCount 0 ;
+    sh:message "A presentation carries NO claim name or value of its own: the suite reveals none, and a record that does was not made by it. Claims belong to the predicate PROGRAM (the verifier's thresholds), never to the presentation." ;
+  ] ;
+  sh:property [
+    sh:path appc:predicateOperand ;
+    sh:maxCount 0 ;
+    sh:message "A presentation carries no operand — see appc:predicateClaim." ;
+  ] .
+
+# ─── A nullifier is scoped and graded ─────────────────────────────────────────────────────────────
+appc:NullifierShape a sh:NodeShape ;
+  rdfs:label "Nullifier shape" ;
+  sh:targetClass appc:Nullifier ;
+  sh:property [
+    sh:path appc:audience ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:anyURI ;
+    sh:message "A nullifier is one-per-AUDIENCE: without the audience it is a value that links nothing to nothing, or everything to everything." ;
+  ] ;
+  sh:property [
+    sh:path appc:nullifierValue ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "Exactly one value." ;
+  ] ;
+  sh:property [
+    sh:path appc:nullifierGrade ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:message "A nullifier says what it is worth: its grade (appc:nullifierGradeScheme — asserted | in-circuit). An ungraded nullifier would be read as the stronger one." ;
+  ] ;
+  sh:sparql [
+    sh:message "The grade MUST be a concept of appc:nullifierGradeScheme." ;
+    sh:select """
+      SELECT $this ?g WHERE {
+        $this <https://agenticprimitives.dev/ns/privacy-credential#nullifierGrade> ?g .
+        FILTER NOT EXISTS { ?g <http://www.w3.org/2004/02/skos/core#inScheme> <https://agenticprimitives.dev/ns/privacy-credential#nullifierGradeScheme> }
+      }
+    """ ;
+  ] .
+
+# ─── An issuer facet is an organization's or a service's, anchored ───────────────────────────────
+appc:IssuerKeyFacetShape a sh:NodeShape ;
+  rdfs:label "IssuerKeyFacet shape" ;
+  sh:targetClass appc:IssuerKeyFacet ;
+  sh:property [
+    sh:path appc:facetSubject ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
+    sh:message "A facet speaks for exactly one agent." ;
+  ] ;
+  sh:property [
+    sh:path appc:facetKeyId ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "One key id — what a credential names and a verifier resolves by." ;
+  ] ;
+  sh:property [
+    sh:path appc:facetHash ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "The facet hash the agent signed and the attestation carries." ;
+  ] ;
+  sh:property [
+    sh:path appc:anchoredBy ;
+    sh:minCount 1 ; sh:class apatt:Attestation ;
+    sh:message "A facet is ANCHORED: an attestation on the issuer's chain binds it to the agent. A facet document with no attestation proves nothing to a stranger — the chain does." ;
+  ] ;
+  sh:sparql [
+    sh:message "A facet's subject is an organization or a service — NEVER a person. A person's agent holds credentials; it does not issue them (spec 443 §2)." ;
+    sh:select """
+      SELECT $this ?subject WHERE {
+        $this <https://agenticprimitives.dev/ns/privacy-credential#facetSubject> ?subject .
+        ?subject a/<http://www.w3.org/2000/01/rdf-schema#subClassOf>* <https://agenticprimitives.dev/ns/core#PersonAgent> .
+      }
+    """ ;
+  ] .
+
+# ─── A presentation mandate is bounded ───────────────────────────────────────────────────────────
+appc:PresentationMandateShape a sh:NodeShape ;
+  rdfs:label "PresentationMandate shape" ;
+  sh:targetClass appc:PresentationMandate ;
+  sh:property [
+    sh:path appc:mandateAudience ;
+    sh:minCount 1 ; sh:datatype xsd:anyURI ;
+    sh:message "A presentation mandate names at least one verifier origin. A device key that may sign for ANY audience is a key that may be phished by any door." ;
+  ] ;
+  sh:property [
+    sh:path appc:mandatePredicateDigest ;
+    sh:minCount 1 ; sh:datatype xsd:string ;
+    sh:message "A presentation mandate names at least one predicate program by digest — what the person agreed may be proved." ;
+  ] ;
+  sh:property [
+    sh:path appc:mandateIssuerKeyId ;
+    sh:minCount 1 ; sh:datatype xsd:string ;
+    sh:message "A presentation mandate names at least one issuer facet." ;
+  ] .
+
+# ─── Evidence names what held ────────────────────────────────────────────────────────────────────
+appc:PredicateAdmissionEvidenceShape a sh:NodeShape ;
+  rdfs:label "PredicateAdmissionEvidence shape" ;
+  sh:targetClass appc:PredicateAdmissionEvidence ;
+  sh:property [
+    sh:path appc:evidenceFacet ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:class appc:IssuerKeyFacet ;
+    sh:message "Evidence names the facet the proof verified under." ;
+  ] ;
+  sh:property [
+    sh:path appc:evidencePredicateDigest ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:message "Evidence names the predicate program the DOOR asked, by digest. \"A predicate held\" with none named is not evidence." ;
+  ] ;
+  sh:property [
+    sh:path appc:verifierPlacement ;
+    sh:minCount 1 ; sh:maxCount 1 ;
+    sh:message "Evidence says WHERE the proof was verified (appc:verifierPlacementScheme). A receipt that cannot is not a receipt." ;
+  ] ;
+  sh:property [
+    sh:path appc:predicateOperand ;
+    sh:maxCount 0 ;
+    sh:message "Evidence carries no claim value and no operand — the digest of the program is what it names." ;
+  ] .