@agenticprimitives/ontology 1.0.0-alpha.45 → 1.0.0-alpha.47

package/cbox/controlled-vocabularies.ttl

@@ -18,7 +18,7 @@
 # ─── agentKind — 3 values, on-chain-bound (ADR-0009 enum / types.AgentType) ──
 ap:agentKind a skos:ConceptScheme ;
     rdfs:label "agentKind" ;
-    rdfs:comment "The 3-value on-chain-bound ROOT kind (person/org/service) carried on the NAME node; 'service' names the ap:ApplicationAgent root (ADR-0046 amendment). Distinct from profileType (8 values; agent-profile/HCS-11) and from ap:agentTypeScheme (the 7 DERIVED types on the SA subject; spec 346 §2.3). treasury is NOT an agentKind — it is a profileType ⊂ service (ap:Treasury rdfs:subClassOf ap:ServiceAgent; tbox/core); team and alliance are NOT agentKinds — they are profileTypes ⊂ org (ap:TeamAgent / ap:AllianceAgent rdfs:subClassOf ap:OrganizationAgent; spec 344 §4.4). Never new agentKinds." ;
+    rdfs:comment "The 3-value on-chain-bound ROOT kind (person/org/service) carried on the NAME node; 'service' names the ap:ApplicationAgent root (ADR-0046 amendment). Distinct from profileType (8 values; agent-profile/HCS-11) and from ap:agentTypeScheme (the 10 DERIVED types on the SA subject; spec 346 §2.3). treasury is NOT an agentKind — it is a profileType ⊂ service (ap:Treasury rdfs:subClassOf ap:ServiceAgent; tbox/core); team and alliance are NOT agentKinds — they are profileTypes ⊂ org (ap:TeamAgent / ap:AllianceAgent rdfs:subClassOf ap:OrganizationAgent; spec 344 §4.4). Never new agentKinds." ;
     skos:hasTopConcept ap:Person, ap:OrgKind, ap:Service .
 ap:Person   a skos:Concept ; skos:inScheme ap:agentKind ; skos:prefLabel "person" .
 ap:OrgKind  a skos:Concept ; skos:inScheme ap:agentKind ; skos:prefLabel "org" .
@@ -59,15 +59,15 @@ ap:Custodied      a skos:Concept ; skos:inScheme ap:controlStatusScheme ; skos:p
 ap:IdentifierOnly a skos:Concept ; skos:inScheme ap:controlStatusScheme ; skos:prefLabel "identifier-only" ;
     rdfs:comment "hedera:* / solana:* — addressable, not custodied by this stack." .
 
-# ─── agentType — the 7 DERIVED types, on-chain-bound (spec 346 §2; ADR-0061) ─
+# ─── agentType — the 10 DERIVED types, on-chain-bound (spec 346 §2; ADR-0061; spec 368 adds household) ─
 # AGENT_TYPE_ENUM / types.DerivedAgentType. Person and Organization are their own derived type (the
 # trivial specialization) so every agent has exactly one. rootClassFor: team→org;
 # service|workspace|treasury|registry→service. The 3-value ap:agentKind scheme above
 # is UNCHANGED — nothing is ever added to the root trichotomy.
 ap:agentTypeScheme a skos:ConceptScheme ;
     rdfs:label "agentType" ;
-    rdfs:comment "9 values, on-chain-bound (AGENT_TYPE_ENUM / types.DerivedAgentType): person org team service workspace treasury registry church circle. rootClassFor: team→org; service|workspace|treasury|registry→service. Each concept rdfs:seeAlso the OWL class it projects (tbox/core)." ;
-    skos:hasTopConcept ap:PersonType, ap:OrgType, ap:TeamType, ap:ServiceType, ap:WorkspaceType, ap:TreasuryType, ap:RegistryType, ap:ChurchType, ap:CircleType .
+    rdfs:comment "10 values, on-chain-bound (AGENT_TYPE_ENUM / types.DerivedAgentType): person org team service workspace treasury registry church circle household. rootClassFor: team|church|circle|household→org; service|workspace|treasury|registry→service. Each concept rdfs:seeAlso the OWL class it projects (tbox/core)." ;
+    skos:hasTopConcept ap:PersonType, ap:OrgType, ap:TeamType, ap:ServiceType, ap:WorkspaceType, ap:TreasuryType, ap:RegistryType, ap:ChurchType, ap:CircleType, ap:HouseholdType .
 ap:PersonType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "person" ;                rdfs:seeAlso ap:PersonAgent .
 ap:OrgType                  a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "org" ;                   rdfs:seeAlso ap:OrganizationAgent .
 ap:TeamType                 a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "team" ;                  rdfs:seeAlso ap:TeamAgent .
@@ -77,6 +77,9 @@ ap:TreasuryType             a skos:Concept ; skos:inScheme ap:agentTypeScheme ;
 ap:RegistryType             a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "registry" ;              rdfs:seeAlso ap:RegistryAgent .
 ap:ChurchType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "church" ;                rdfs:seeAlso ap:ChurchAgent .
 ap:CircleType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "circle" ;                rdfs:seeAlso ap:CircleAgent .
+# Spec 368 / ADR-0061 amendment 2026-09-07 — `.household` is a Ring-0 derived type (live on faithchain); it was in
+# AGENT_TLDS and CLASS_FOR_SUFFIX but in no codelist until ONT-3 (2026-11-10 review).
+ap:HouseholdType            a skos:Concept ; skos:inScheme ap:agentTypeScheme ; skos:prefLabel "household" ;             rdfs:seeAlso ap:HouseholdAgent .
 
 # ─── tld — the typed name suffixes (spec 346 §3.1; ADR-0061 §3) ──────────
 # A suffix NAMES a derived type — never the inheritance structure, a root, a role, or a technology.
@@ -85,10 +88,11 @@ ap:CircleType               a skos:Concept ; skos:inScheme ap:agentTypeScheme ;
 # and `.agent` are reserved/inactive and deliberately NOT concepts here; `.ws` is an alias, not a tld.
 apnam:tldScheme a skos:ConceptScheme ;
     rdfs:label "tld" ;
-    rdfs:comment "The 7 active typed suffixes: me org team svc workspace treasury registry. Each names exactly one ap:agentTypeScheme concept (apnam:namesDerivedType)." ;
-    skos:hasTopConcept apnam:MeTld, apnam:OrgTld, apnam:TeamTld, apnam:SvcTld, apnam:WorkspaceTld, apnam:TreasuryTld, apnam:RegistryTld, apnam:ChurchTld, apnam:CircleTld .
+    rdfs:comment "The 10 active typed suffixes: me org team svc workspace treasury registry church circle household. Each names exactly one ap:agentTypeScheme concept (apnam:namesDerivedType). THE ONE LIST: apnam:TypedAgentNameShape reads this scheme (apnam:TldFromSchemeShape) instead of carrying its own copy, so a suffix added here is valid there with no second edit (ONT-3, 2026-11-10 review — the shape's inline list had drifted to seven)." ;
+    skos:hasTopConcept apnam:MeTld, apnam:OrgTld, apnam:TeamTld, apnam:SvcTld, apnam:WorkspaceTld, apnam:TreasuryTld, apnam:RegistryTld, apnam:ChurchTld, apnam:CircleTld, apnam:HouseholdTld .
 apnam:ChurchTld    a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "church" ;    apnam:namesDerivedType ap:ChurchType .
 apnam:CircleTld    a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "circle" ;    apnam:namesDerivedType ap:CircleType .
+apnam:HouseholdTld a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "household" ; apnam:namesDerivedType ap:HouseholdType .
 apnam:MeTld        a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "me" ;        apnam:namesDerivedType ap:PersonType .
 apnam:OrgTld       a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "org" ;       apnam:namesDerivedType ap:OrgType .
 apnam:TeamTld      a skos:Concept ; skos:inScheme apnam:tldScheme ; skos:prefLabel "team" ;      apnam:namesDerivedType ap:TeamType .

package/cbox/interaction-shapes.shacl.ttl

@@ -60,6 +60,13 @@ apix:InteractionProfileShape a sh:NodeShape ;
     sh:path apix:profileVersion ;
     sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
     sh:message "An InteractionProfile MUST carry an exact version — it is pinned into every Exchange to make downgrade detectable (ADR-0058)." ;
+  ] ;
+
+  # ONT-1 (2026-11-10 review): a profile whose own version is a floating word cannot be pinned exactly.
+  sh:property [
+    sh:path apix:profileVersion ;
+    sh:not [ sh:pattern "^(current|latest|head|main|tip|now)$" ; sh:flags "i" ] ;
+    sh:message "An InteractionProfile's version MUST be exact — `current`/`latest`/`HEAD` name whatever exists today, which is no version at all (ADR-0058)." ;
   ] .
 
 # ─── The unit that crosses the boundary ─────────────────────────────────────
@@ -100,6 +107,15 @@ apix:ExchangeShape a sh:NodeShape ;
     sh:message "An Exchange MUST record the exact profile version it was made under, on itself — reading it off the live Interaction lets a Negotiation be reread as a Conversation after the fact (ADR-0058)." ;
   ] ;
 
+  # The floating-pointer ban, where the pin LIVES (ONT-1, 2026-11-10 review). It used to sit on the
+  # ContextSnapshot shape, where `pinsProfileVersion` never appears (its domain is apix:Exchange), so an
+  # Exchange pinned to "latest" conformed. This is STRUCTURE — the form of the pin — not permission.
+  sh:property [
+    sh:path apix:pinsProfileVersion ;
+    sh:not [ sh:pattern "^(current|latest|head|main|tip|now)$" ; sh:flags "i" ] ;
+    sh:message "`current`/`latest`/`HEAD` are FORBIDDEN as an Exchange's profile pin — a floating version makes the Exchange unreplayable and its profile downgradable (ADR-0058)." ;
+  ] ;
+
   sh:property [
     sh:path apix:realizesAct ;
     sh:minCount 1 ;
@@ -185,12 +201,13 @@ apix:ContextSnapshotShape a sh:NodeShape ;
     sh:message "A ContextSnapshot MUST carry its digest — it is addressed BY content, never by a name that could later point elsewhere." ;
   ] ;
 
-  # The floating-pointer ban, made checkable. A historical record that resolves to whatever exists
-  # today says nothing about the moment it was made.
+  # The floating-pointer ban, made checkable on the snapshot's own pin. A historical record that resolves
+  # to whatever exists today says nothing about the moment it was made. (The profile-version half of the
+  # ban lives on ExchangeShape, where `pinsProfileVersion` is used — ONT-1.)
   sh:property [
-    sh:path apix:pinsProfileVersion ;
-    sh:not [ sh:in ( "current" "latest" "HEAD" ) ] ;
-    sh:message "`current`/`latest`/`HEAD` are FORBIDDEN inside a historical record — a floating version makes the Exchange unreplayable (ADR-0058)." ;
+    sh:path apix:contextDigest ;
+    sh:not [ sh:pattern "^(current|latest|head|main|tip|now)$" ; sh:flags "i" ] ;
+    sh:message "`current`/`latest`/`HEAD` are FORBIDDEN as a ContextSnapshot's digest — a floating pointer makes the Exchange that pins it unreplayable (ADR-0058)." ;
   ] .
 
 # ─── Typed evidence ─────────────────────────────────────────────────────────

package/cbox/naming-registry-shapes.shacl.ttl

@@ -29,7 +29,7 @@
 @prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
 
 # ─── Typed names (§3.1, §2.3) ───────────────────────────────────────────────
-# Targets names that CARRY a tld. Legacy roots (.agent / .impact) carry none and are exempt — they
+# Targets names that CARRY a tld. The legacy root (.agent) carries none and is exempt — they
 # keep resolving as legacy throughout (spec 346 §3.5); a shape that failed them would be a migration.
 
 apnam:TypedAgentNameShape a sh:NodeShape ;
@@ -39,9 +39,13 @@ apnam:TypedAgentNameShape a sh:NodeShape ;
   sh:property [
     sh:path apnam:tld ;
     sh:maxCount 1 ; sh:datatype xsd:string ;
-    sh:in ( "me" "org" "team" "svc" "workspace" "treasury" "registry" ) ;
-    sh:message "Exactly one canonical tld from apnam:tldScheme: me | org | team | svc | workspace | treasury | registry. 'ws' is an alias resolved before storage; .alliance and .agent are reserved/inactive." ;
+    sh:message "Exactly one tld, a string." ;
   ] ;
+  # The suffix list is NOT written here (ONT-3, 2026-11-10 review): an inline sh:in had drifted to seven
+  # values while the scheme carried nine and the contracts issued ten, so live `.church`/`.circle`/
+  # `.household` names were shape-invalid. The one list is apnam:tldScheme (cbox/controlled-vocabularies.ttl);
+  # TldFromSchemeShape reads it. (A separate node shape because shacl-engine compiles one sh:sparql per
+  # NodeShape — see the package CLAUDE.md — targeting the same subjects, so its own message is reported.)
   sh:property [
     sh:path apnam:resolvesTo ;
     sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
@@ -64,6 +68,25 @@ apnam:TypedAgentNameShape a sh:NodeShape ;
     """ ;
   ] .
 
+# The tld must be the prefLabel of a concept in apnam:tldScheme. Requires the codelist in the data graph,
+# exactly as the suffix-vs-record check above does. 'ws' is an alias resolved before storage (skos:altLabel,
+# deliberately not matched); .alliance and .agent are reserved/inactive and are not concepts.
+apnam:TldFromSchemeShape a sh:NodeShape ;
+  rdfs:label "Tld-from-scheme shape" ;
+  sh:targetSubjectsOf apnam:tld ;
+  sh:sparql [
+    sh:message "Exactly one canonical tld from apnam:tldScheme (cbox/controlled-vocabularies.ttl). 'ws' is an alias resolved before storage; .alliance and .agent are reserved/inactive." ;
+    sh:select """
+      SELECT $this ?value WHERE {
+        $this <https://agenticprimitives.dev/ns/naming#tld> ?value .
+        FILTER NOT EXISTS {
+          ?concept <http://www.w3.org/2004/02/skos/core#inScheme> <https://agenticprimitives.dev/ns/naming#tldScheme> ;
+                   <http://www.w3.org/2004/02/skos/core#prefLabel> ?value .
+        }
+      }
+    """ ;
+  ] .
+
 # ─── Contextual issuance (§3.2, §9) ─────────────────────────────────────────
 
 apnam:ContextualNameIssuanceShape a sh:NodeShape ;
@@ -81,10 +104,15 @@ apnam:ContextualNameIssuanceShape a sh:NodeShape ;
     sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:Agent ;
     sh:message "Exactly one issuedFor — the canonical subject the contextual name refers to." ;
   ] ;
+  # STRUCTURE ONLY (ONT-11, 2026-11-10 review): the basis must be NAMED, once, as a Delegation — the presence and form
+  # of the field. Whether that delegation is live, signed by the issuing context and of a kind valid for this issuance
+  # — whether the issuance was AUTHORIZED — is decided in code and never here: agent-naming `validateContextualIssuance`
+  # (basis kind per issuance kind), registry-resolution `resolve` (the issuer's signature over the body, NAME-14; a
+  # basis not current ⇒ `basis_not_current`). An issuance over a dead or forged basis stays recordable as evidence.
   sh:property [
     sh:path apnam:issuanceBasis ;
     sh:minCount 1 ; sh:maxCount 1 ; sh:class apdel:Delegation ;
-    sh:message "Exactly one issuanceBasis — the Delegation whose liveness makes the name CURRENT. No basis, no name: a contextual name is a reference over a live delegation, never an identity (ADR-0061 §6)." ;
+    sh:message "Exactly one issuanceBasis, naming a Delegation — the record of WHAT the name stands on. Whether it is live and the issuer's is decided by the resolver, not this shape (ADR-0061 §6)." ;
   ] ;
   sh:property [
     sh:path apnam:issuanceKind ;
@@ -162,10 +190,14 @@ apreg:RegistrationReceiptShape a sh:NodeShape ;
     sh:node [ sh:property [ sh:path skos:inScheme ; sh:hasValue ap:agentTypeScheme ] ] ;
     sh:message "subjectType is exactly one ap:agentTypeScheme concept — the derived type the admission checked." ;
   ] ;
+  # STRUCTURE ONLY (ONT-11, 2026-11-10 review): the signer must be NAMED, once, as a node. Whether it is the registry's
+  # operator agent is whether the receipt is AUTHENTIC — decided by registry-kit `verifyReceipt` (expectedOperator
+  # must equal proof.signer, NAME-13), never here. This said `sh:class ap:RegistryAgent`, which made a receipt signed
+  # by the wrong party invalid instead of recorded as a bad receipt — and a bad receipt is the evidence (ADR-0058).
   sh:property [
     sh:path apreg:receiptSigner ;
-    sh:minCount 1 ; sh:maxCount 1 ; sh:class ap:RegistryAgent ;
-    sh:message "A receipt is signed by exactly one RegistryAgent — the operator SA; an unsigned receipt is a claim by nobody." ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:nodeKind sh:IRI ;
+    sh:message "A receipt names exactly one signer; an unsigned receipt is a claim by nobody. Whether the signer is the registry's operator is verifyReceipt's decision (NAME-13)." ;
   ] ;
   sh:property [
     sh:path apreg:admittedAt ;

package/cbox/run-provenance-shapes.shacl.ttl

@@ -80,10 +80,10 @@ apexec:StepUsageResolvableShape a sh:NodeShape ;
     """ ;
   ] .
 
-# ─── R3 · a completed capability step ran under a mandate that allowed it ────
+# ─── R3 · a completed capability step names its mandate and records its verdict ────
 
 apexec:CapabilityStepMandateShape a sh:NodeShape ;
-  rdfs:label "R3 — a completed capability step presented a mandate and the verdict was allow" ;
+  rdfs:label "R3 — a completed capability step names the mandate it presented and records the verdict" ;
   sh:target [
     sh:select """
       SELECT ?this WHERE {
@@ -97,10 +97,16 @@ apexec:CapabilityStepMandateShape a sh:NodeShape ;
     sh:minCount 1 ; sh:nodeKind sh:IRI ;
     sh:message "R3: a COMPLETED capability step names no mandate (apvr:usedDelegation) — a consequential act with nothing behind it is a forged record, not a run (spec 389 W2; spec 350: every consequential step presents a mandate)." ;
   ] ;
+  # STRUCTURE ONLY (ONT-11, 2026-11-10 review). The verdict must be RECORDED, as one of the verifier's three words — not
+  # be "allow". Whether the step was authorized is the verifier's decision (`verifyMandateForStep`,
+  # packages/delegation/src/mandate.ts), made before the act and enforced by the harness, which runs a step only on
+  # `allow`. A record of a step that completed under `deny` is EVIDENCE of exactly the fault that matters; refusing it
+  # here would delete that evidence (ADR-0058). This shape used to say `sh:in ( "allow" )`.
   sh:property [
     sh:path apexec:authorityDecision ;
-    sh:minCount 1 ; sh:in ( "allow" ) ;
-    sh:message "R3: a COMPLETED capability step records a verdict other than allow — a step that completed under a deny is a record that contradicts itself (spec 389 W2)." ;
+    sh:minCount 1 ; sh:maxCount 1 ; sh:datatype xsd:string ;
+    sh:in ( "allow" "approval-required" "deny" ) ;
+    sh:message "R3: a COMPLETED capability step records no verdict, or one that is not a verifier decision (allow | approval-required | deny) — the verdict is part of what the step was (spec 389 W2)." ;
   ] .
 
 # ─── R4 · a completed step left its receipt ──────────────────────────────────

package/cbox/value-rail-shapes.shacl.ttl

@@ -0,0 +1,60 @@
+# C-box — THE VALUE RAIL AS STRUCTURE (ONT-4, 2026-11-10 review; spec 373 / 420).
+#
+# `appr:ValueHolder ≡ ap:Treasury`, disjoint with persons and organizations: assets live only in treasuries. The
+# T-box now makes the ends of a value move treasuries by RANGE (ap:primaryPayee, ap:primaryPayer,
+# aphh:householdPayee, appay:payer, appay:payee); these shapes make that range checkable, because an RDFS range
+# INFERS a type rather than refusing a value, and a resolver that reads a person at the end of `primaryPayee` would
+# otherwise be told she is a treasury.
+#
+# STRUCTURE, NEVER PERMISSION. This says what KIND of node may stand at the end of the property — the same kind of
+# statement as "a typed name resolves to an Agent". It says nothing about who may pay, from where, or how much:
+# that is the mandate (ADR-0041). And it deliberately does NOT constrain evidence: `apix:receiptPayer` /
+# `apix:receiptPayee` keep range prov:Agent, so a receipt recording that money DID reach a person stays
+# shape-valid — refusing to record it would delete the evidence of the very fault (ADR-0058).
+
+@prefix ap:    <https://agenticprimitives.dev/ns/core#> .
+@prefix aphh:  <https://agenticprimitives.dev/ns/household#> .
+@prefix appay: <https://agenticprimitives.dev/ns/payment#> .
+@prefix sh:    <http://www.w3.org/ns/shacl#> .
+@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
+
+ap:PrimaryPayeeShape a sh:NodeShape ;
+  rdfs:label "primaryPayee is a treasury" ;
+  sh:targetSubjectsOf ap:primaryPayee ;
+  sh:property [
+    sh:path ap:primaryPayee ;
+    sh:class ap:Treasury ;
+    sh:message "ap:primaryPayee MUST name a treasury — a person or organization is who money is FOR, a treasury is where it GOES (spec 373)." ;
+  ] .
+
+ap:PrimaryPayerShape a sh:NodeShape ;
+  rdfs:label "primaryPayer is a treasury" ;
+  sh:targetSubjectsOf ap:primaryPayer ;
+  sh:property [
+    sh:path ap:primaryPayer ;
+    sh:class ap:Treasury ;
+    sh:message "ap:primaryPayer MUST name a treasury — an owner pays from the treasury it charters, never from itself (spec 373)." ;
+  ] .
+
+aphh:HouseholdPayeeShape a sh:NodeShape ;
+  rdfs:label "householdPayee is a treasury" ;
+  sh:targetSubjectsOf aphh:householdPayee ;
+  sh:property [
+    sh:path aphh:householdPayee ;
+    sh:class ap:Treasury ;
+    sh:message "aphh:householdPayee MUST land on a treasury — the chain ends at the account a member marked, never at the member (the 2026-09-08 carol.me payment)." ;
+  ] .
+
+appay:PaymentMandatePartiesShape a sh:NodeShape ;
+  rdfs:label "a payment mandate names treasuries" ;
+  sh:targetClass appay:PaymentMandate ;
+  sh:property [
+    sh:path appay:payer ;
+    sh:class ap:Treasury ;
+    sh:message "appay:payer MUST be the treasury the funds leave; its owner signs as appay:granter (spec 373)." ;
+  ] ;
+  sh:property [
+    sh:path appay:payee ;
+    sh:class ap:Treasury ;
+    sh:message "appay:payee MUST be the treasury the funds reach (spec 373)." ;
+  ] .

package/dist/artifacts.d.ts

@@ -11,8 +11,8 @@ export declare const ARTIFACTS: {
     readonly runMeasuresContext: "run-measures.jsonld";
     /** Spec 415 S0/SEL-1 — replay sets (DCAT) and judgments (EARL). */
     readonly evaluationContext: "evaluation.jsonld";
-    readonly tbox: readonly ["tbox/core.ttl", "tbox/identity.ttl", "tbox/contact.ttl", "tbox/naming.ttl", "tbox/intents.ttl", "tbox/constraints.ttl", "tbox/resolution.ttl", "tbox/agreement.ttl", "tbox/payment.ttl", "tbox/fulfillment.ttl", "tbox/attestation.ttl", "tbox/skills.ttl", "tbox/geo.ttl", "tbox/content.ttl", "tbox/registry.ttl", "tbox/discovery.ttl", "tbox/trust.ttl", "tbox/security-exposure.ttl", "tbox/agent-resolution.ttl", "tbox/verification-receipt.ttl", "tbox/scope.ttl", "tbox/situation.ttl", "tbox/org.ttl", "tbox/familyoffice.ttl", "tbox/entitlement.ttl", "tbox/interaction.ttl", "tbox/messaging.ttl", "tbox/guidance.ttl", "tbox/actor-context.ttl", "tbox/context.ttl", "tbox/profile.ttl", "tbox/execution.ttl", "tbox/plan.ttl", "tbox/prov-imports.ttl", "tbox/skos-imports.ttl", "tbox/dqv-imports.ttl", "tbox/earl-imports.ttl", "tbox/dcat-imports.ttl", "tbox/evaluation.ttl", "tbox/coordination.ttl", "tbox/engagement.ttl", "tbox/card-projection.ttl", "tbox/estate.ttl", "tbox/privacy-credential.ttl"];
-    readonly cbox: readonly ["cbox/canonical-agent-id-shape.shacl.ttl", "cbox/controlled-vocabularies.ttl", "cbox/registry-vocabulary.ttl", "cbox/skill-vocabulary.ttl", "cbox/geo-vocabulary.ttl", "cbox/scope-vocabulary.ttl", "cbox/content-vocabulary.ttl", "cbox/discovery-graph-shapes.shacl.ttl", "cbox/interaction-vocabulary.ttl", "cbox/familyoffice-vocabulary.ttl", "cbox/familyoffice-shapes.shacl.ttl", "cbox/privacy-credential-shapes.shacl.ttl", "cbox/consultation-shapes.shacl.ttl", "cbox/interaction-shapes.shacl.ttl", "cbox/skill-grounding-vocabulary.ttl", "cbox/guidance-vocabulary.ttl", "cbox/profile-facet-vocabulary.ttl", "cbox/agent-facet-shapes.shacl.ttl", "cbox/capability-catalog-shapes.shacl.ttl", "cbox/org-team-shapes.shacl.ttl", "cbox/naming-registry-shapes.shacl.ttl", "cbox/run-provenance-shapes.shacl.ttl", "cbox/run-measures-shapes.shacl.ttl", "cbox/judgment-shapes.shacl.ttl", "cbox/card-projection-shapes.shacl.ttl"];
+    readonly tbox: readonly ["tbox/core.ttl", "tbox/identity.ttl", "tbox/contact.ttl", "tbox/naming.ttl", "tbox/intents.ttl", "tbox/constraints.ttl", "tbox/resolution.ttl", "tbox/agreement.ttl", "tbox/payment.ttl", "tbox/fulfillment.ttl", "tbox/attestation.ttl", "tbox/skills.ttl", "tbox/geo.ttl", "tbox/content.ttl", "tbox/registry.ttl", "tbox/discovery.ttl", "tbox/trust.ttl", "tbox/security-exposure.ttl", "tbox/agent-resolution.ttl", "tbox/verification-receipt.ttl", "tbox/scope.ttl", "tbox/situation.ttl", "tbox/org.ttl", "tbox/familyoffice.ttl", "tbox/entitlement.ttl", "tbox/interaction.ttl", "tbox/messaging.ttl", "tbox/guidance.ttl", "tbox/actor-context.ttl", "tbox/context.ttl", "tbox/profile.ttl", "tbox/execution.ttl", "tbox/plan.ttl", "tbox/prov-imports.ttl", "tbox/skos-imports.ttl", "tbox/dqv-imports.ttl", "tbox/earl-imports.ttl", "tbox/dcat-imports.ttl", "tbox/evaluation.ttl", "tbox/coordination.ttl", "tbox/engagement.ttl", "tbox/card-projection.ttl", "tbox/estate.ttl", "tbox/privacy-credential.ttl", "tbox/governance.ttl", "tbox/household.ttl", "tbox/inference.ttl", "tbox/payload.ttl", "tbox/principles.ttl", "tbox/transition.ttl", "tbox/values.ttl"];
+    readonly cbox: readonly ["cbox/canonical-agent-id-shape.shacl.ttl", "cbox/controlled-vocabularies.ttl", "cbox/registry-vocabulary.ttl", "cbox/skill-vocabulary.ttl", "cbox/geo-vocabulary.ttl", "cbox/scope-vocabulary.ttl", "cbox/content-vocabulary.ttl", "cbox/discovery-graph-shapes.shacl.ttl", "cbox/interaction-vocabulary.ttl", "cbox/familyoffice-vocabulary.ttl", "cbox/familyoffice-shapes.shacl.ttl", "cbox/privacy-credential-shapes.shacl.ttl", "cbox/consultation-shapes.shacl.ttl", "cbox/interaction-shapes.shacl.ttl", "cbox/skill-grounding-vocabulary.ttl", "cbox/guidance-vocabulary.ttl", "cbox/profile-facet-vocabulary.ttl", "cbox/agent-facet-shapes.shacl.ttl", "cbox/capability-catalog-shapes.shacl.ttl", "cbox/org-team-shapes.shacl.ttl", "cbox/naming-registry-shapes.shacl.ttl", "cbox/run-provenance-shapes.shacl.ttl", "cbox/run-measures-shapes.shacl.ttl", "cbox/judgment-shapes.shacl.ttl", "cbox/card-projection-shapes.shacl.ttl", "cbox/value-rail-shapes.shacl.ttl"];
     readonly mappings: readonly ["mappings/spine-standards.ttl", "mappings/agent-discovery-standards.ttl", "mappings/collaboration-profile.ttl", "mappings/collaboration-crosswalk-actors.ttl", "mappings/collaboration-crosswalk-organization.ttl", "mappings/collaboration-crosswalk-messaging.ttl", "mappings/collaboration-crosswalk-intent.ttl", "mappings/collaboration-crosswalk-skills.ttl", "mappings/collaboration-crosswalk-authority.ttl", "mappings/collaboration-crosswalk-protocols.ttl", "mappings/collaboration-crosswalk-guidance.ttl", "mappings/actor-context-standards.ttl", "mappings/commerce-engagement-crosswalk.ttl"];
 };
 /**

package/dist/artifacts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,SAAS;;IAEpB,6GAA6G;;IAE7G,0GAA0G;;IAE1G,mEAAmE;;;;;CAqJ3D,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEzD"}
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,SAAS;;IAEpB,6GAA6G;;IAE7G,0GAA0G;;IAE1G,mEAAmE;;;;;CAwK3D,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/artifacts.js

@@ -96,6 +96,23 @@ export const ARTIFACTS = {
         // keeps. Declared because the openings became a vault record and a vault record needs a class.
         'tbox/estate.ttl',
         'tbox/privacy-credential.ttl',
+        // ONT-5 (2026-11-10 review): these seven were in tbox/ but not declared here, so the SHACL harness
+        // closed subclasses without them and a class declared in them was never seen as its superclass.
+        // A test (445-ontology-medium.test.ts) now asserts this list equals the directory listing.
+        // Governance of the common model (spec 410 §10)
+        'tbox/governance.ttl',
+        // The household (spec 363 W4) — private by construction
+        'tbox/household.ttl',
+        // The model gateway's records + estate heartbeat (spec 434)
+        'tbox/inference.ttl',
+        // What a write carries (spec 410 §7) — `apload:` payload classes (ONT-10)
+        'tbox/payload.ttl',
+        // Domain principles as individuals (spec 420)
+        'tbox/principles.ttl',
+        // Capabilities as typed transitions between situations (spec 420 §2)
+        'tbox/transition.ttl',
+        // What an argument is when it is not a party (spec 363 W2)
+        'tbox/values.ttl',
     ],
     cbox: [
         'cbox/canonical-agent-id-shape.shacl.ttl',
@@ -146,6 +163,8 @@ export const ARTIFACTS = {
         // Public card metadata, projection provenance (eight digests), external bindings, the
         // public/private disclosure boundary (spec 347 §11)
         'cbox/card-projection-shapes.shacl.ttl',
+        // The value rail as structure — the ends of a value move are treasuries (ONT-4; spec 373 / 420)
+        'cbox/value-rail-shapes.shacl.ttl',
     ],
     mappings: [
         'mappings/spine-standards.ttl',

package/dist/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,gBAAgB;IACzB,6GAA6G;IAC7G,oBAAoB,EAAE,uBAAuB;IAC7C,0GAA0G;IAC1G,kBAAkB,EAAE,qBAAqB;IACzC,mEAAmE;IACnE,iBAAiB,EAAE,mBAAmB;IACtC,IAAI,EAAE;QACJ,4BAA4B;QAC5B,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,kGAAkG;QAClG,iBAAiB;QACjB,8DAA8D;QAC9D,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,kBAAkB;QAClB,sBAAsB;QACtB,sBAAsB;QACtB,4CAA4C;QAC5C,iBAAiB;QACjB,cAAc;QACd,kDAAkD;QAClD,kBAAkB;QAClB,oEAAoE;QACpE,mBAAmB;QACnB,oBAAoB;QACpB,gBAAgB;QAChB,4BAA4B;QAC5B,uFAAuF;QACvF,wFAAwF;QACxF,2BAA2B;QAC3B,8DAA8D;QAC9D,+BAA+B;QAC/B,yBAAyB;QACzB,gBAAgB;QAChB,oDAAoD;QACpD,oBAAoB;QACpB,cAAc;QACd,8EAA8E;QAC9E,4EAA4E;QAC5E,uBAAuB;QACvB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,oFAAoF;QACpF,mBAAmB;QACnB,gEAAgE;QAChE,wBAAwB;QACxB,uFAAuF;QACvF,kBAAkB;QAClB,2FAA2F;QAC3F,2FAA2F;QAC3F,kBAAkB;QAClB,oFAAoF;QACpF,6FAA6F;QAC7F,iDAAiD;QACjD,oBAAoB;QACpB,2EAA2E;QAC3E,eAAe;QACf,iHAAiH;QACjH,uBAAuB;QACvB,+GAA+G;QAC/G,uBAAuB;QACvB,uDAAuD;QACvD,sBAAsB;QACtB,mFAAmF;QACnF,uBAAuB;QACvB,uBAAuB;QACvB,uDAAuD;QACvD,qBAAqB;QACrB,+FAA+F;QAC/F,uBAAuB;QACvB,qGAAqG;QACrG,qBAAqB;QACrB,4FAA4F;QAC5F,wEAAwE;QACxE,0BAA0B;QAC1B,oGAAoG;QACpG,+FAA+F;QAC/F,iBAAiB;QACjB,6BAA6B;KAC9B;IACD,IAAI,EAAE;QACJ,yCAAyC;QACzC,kCAAkC;QAClC,yFAAyF;QACzF,8BAA8B;QAC9B,6EAA6E;QAC7E,2BAA2B;QAC3B,yBAAyB;QACzB,0DAA0D;QAC1D,2BAA2B;QAC3B,oEAAoE;QACpE,6BAA6B;QAC7B,kEAAkE;QAClE,uCAAuC;QACvC,kDAAkD;QAClD,iCAAiC;QACjC,gFAAgF;QAChF,kCAAkC;QAClC,gGAAgG;QAChG,2EAA2E;QAC3E,oCAAoC;QACpC,0CAA0C;QAC1C,oDAAoD;QACpD,oCAAoC;QACpC,gFAAgF;QAChF,mCAAmC;QACnC,uCAAuC;QACvC,qCAAqC;QACrC,8BAA8B;QAC9B,wFAAwF;QACxF,mCAAmC;QACnC,iDAAiD;QACjD,mCAAmC;QACnC,yFAAyF;QACzF,0CAA0C;QAC1C,wFAAwF;QACxF,gCAAgC;QAChC,+FAA+F;QAC/F,+CAA+C;QAC/C,uCAAuC;QACvC,uFAAuF;QACvF,sCAAsC;QACtC,uDAAuD;QACvD,oCAAoC;QACpC,8FAA8F;QAC9F,gCAAgC;QAChC,sFAAsF;QACtF,oDAAoD;QACpD,uCAAuC;KACxC;IACD,QAAQ,EAAE;QACR,8BAA8B;QAC9B,wCAAwC;QACxC,wDAAwD;QACxD,oCAAoC;QACpC,6CAA6C;QAC7C,mDAAmD;QACnD,gDAAgD;QAChD,6CAA6C;QAC7C,6CAA6C;QAC7C,gDAAgD;QAChD,gDAAgD;QAChD,+CAA+C;QAC/C,yFAAyF;QACzF,sCAAsC;QACtC,uGAAuG;QACvG,4CAA4C;KAC7C;CACO,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,YAAY,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,gBAAgB;IACzB,6GAA6G;IAC7G,oBAAoB,EAAE,uBAAuB;IAC7C,0GAA0G;IAC1G,kBAAkB,EAAE,qBAAqB;IACzC,mEAAmE;IACnE,iBAAiB,EAAE,mBAAmB;IACtC,IAAI,EAAE;QACJ,4BAA4B;QAC5B,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,kGAAkG;QAClG,iBAAiB;QACjB,8DAA8D;QAC9D,kBAAkB;QAClB,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,kBAAkB;QAClB,sBAAsB;QACtB,sBAAsB;QACtB,4CAA4C;QAC5C,iBAAiB;QACjB,cAAc;QACd,kDAAkD;QAClD,kBAAkB;QAClB,oEAAoE;QACpE,mBAAmB;QACnB,oBAAoB;QACpB,gBAAgB;QAChB,4BAA4B;QAC5B,uFAAuF;QACvF,wFAAwF;QACxF,2BAA2B;QAC3B,8DAA8D;QAC9D,+BAA+B;QAC/B,yBAAyB;QACzB,gBAAgB;QAChB,oDAAoD;QACpD,oBAAoB;QACpB,cAAc;QACd,8EAA8E;QAC9E,4EAA4E;QAC5E,uBAAuB;QACvB,sBAAsB;QACtB,sBAAsB;QACtB,oBAAoB;QACpB,oFAAoF;QACpF,mBAAmB;QACnB,gEAAgE;QAChE,wBAAwB;QACxB,uFAAuF;QACvF,kBAAkB;QAClB,2FAA2F;QAC3F,2FAA2F;QAC3F,kBAAkB;QAClB,oFAAoF;QACpF,6FAA6F;QAC7F,iDAAiD;QACjD,oBAAoB;QACpB,2EAA2E;QAC3E,eAAe;QACf,iHAAiH;QACjH,uBAAuB;QACvB,+GAA+G;QAC/G,uBAAuB;QACvB,uDAAuD;QACvD,sBAAsB;QACtB,mFAAmF;QACnF,uBAAuB;QACvB,uBAAuB;QACvB,uDAAuD;QACvD,qBAAqB;QACrB,+FAA+F;QAC/F,uBAAuB;QACvB,qGAAqG;QACrG,qBAAqB;QACrB,4FAA4F;QAC5F,wEAAwE;QACxE,0BAA0B;QAC1B,oGAAoG;QACpG,+FAA+F;QAC/F,iBAAiB;QACjB,6BAA6B;QAC7B,mGAAmG;QACnG,gGAAgG;QAChG,2FAA2F;QAC3F,gDAAgD;QAChD,qBAAqB;QACrB,wDAAwD;QACxD,oBAAoB;QACpB,4DAA4D;QAC5D,oBAAoB;QACpB,0EAA0E;QAC1E,kBAAkB;QAClB,8CAA8C;QAC9C,qBAAqB;QACrB,qEAAqE;QACrE,qBAAqB;QACrB,2DAA2D;QAC3D,iBAAiB;KAClB;IACD,IAAI,EAAE;QACJ,yCAAyC;QACzC,kCAAkC;QAClC,yFAAyF;QACzF,8BAA8B;QAC9B,6EAA6E;QAC7E,2BAA2B;QAC3B,yBAAyB;QACzB,0DAA0D;QAC1D,2BAA2B;QAC3B,oEAAoE;QACpE,6BAA6B;QAC7B,kEAAkE;QAClE,uCAAuC;QACvC,kDAAkD;QAClD,iCAAiC;QACjC,gFAAgF;QAChF,kCAAkC;QAClC,gGAAgG;QAChG,2EAA2E;QAC3E,oCAAoC;QACpC,0CAA0C;QAC1C,oDAAoD;QACpD,oCAAoC;QACpC,gFAAgF;QAChF,mCAAmC;QACnC,uCAAuC;QACvC,qCAAqC;QACrC,8BAA8B;QAC9B,wFAAwF;QACxF,mCAAmC;QACnC,iDAAiD;QACjD,mCAAmC;QACnC,yFAAyF;QACzF,0CAA0C;QAC1C,wFAAwF;QACxF,gCAAgC;QAChC,+FAA+F;QAC/F,+CAA+C;QAC/C,uCAAuC;QACvC,uFAAuF;QACvF,sCAAsC;QACtC,uDAAuD;QACvD,oCAAoC;QACpC,8FAA8F;QAC9F,gCAAgC;QAChC,sFAAsF;QACtF,oDAAoD;QACpD,uCAAuC;QACvC,gGAAgG;QAChG,kCAAkC;KACnC;IACD,QAAQ,EAAE;QACR,8BAA8B;QAC9B,wCAAwC;QACxC,wDAAwD;QACxD,oCAAoC;QACpC,6CAA6C;QAC7C,mDAAmD;QACnD,gDAAgD;QAChD,6CAA6C;QAC7C,6CAA6C;QAC7C,gDAAgD;QAChD,gDAAgD;QAChD,+CAA+C;QAC/C,yFAAyF;QACzF,sCAAsC;QACtC,uGAAuG;QACvG,4CAA4C;KAC7C;CACO,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,MAAM,YAAY,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/household.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"household.d.ts","sourceRoot":"","sources":["../src/household.ts"],"names":[],"mappings":"AAcA,yDAAyD;AACzD,eAAO,MAAM,SAAS,mDAAoD,CAAC;AAC3E,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,uGAAuG;AACvG,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAK1D,CAAC;AAEF,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAEvD;AAED,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE5C;AAED,yGAAyG;AACzG,eAAO,MAAM,eAAe,8CAA+C,CAAC;AAC5E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAGxE"}
+{"version":3,"file":"household.d.ts","sourceRoot":"","sources":["../src/household.ts"],"names":[],"mappings":"AAcA,yDAAyD;AACzD,eAAO,MAAM,SAAS,mDAAoD,CAAC;AAC3E,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,uGAAuG;AAEvG,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKtB,CAAC;AAEtC,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAKvD;AAED,iFAAiF;AACjF,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE5C;AAED,yGAAyG;AACzG,eAAO,MAAM,eAAe,8CAA+C,CAAC;AAC5E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAGxE"}

package/dist/household.js

@@ -13,15 +13,19 @@ const AP_HH_NS = 'https://agenticprimitives.dev/ns/household#';
 /** The canonical kin terms (`aphh:*`), by local name. */
 export const KIN_TERMS = ['spouse', 'child', 'parent', 'sibling'];
 /** The words people say → the term the T-box declares (its `skos:prefLabel` or an `skos:altLabel`). */
-export const KIN_WORD_FOR = {
+// No prototype — a consumer indexing it with a said word must not reach `Object.prototype` (see `kinTermFor`).
+export const KIN_WORD_FOR = Object.freeze(Object.assign(Object.create(null), {
     spouse: 'spouse', wife: 'spouse', husband: 'spouse', partner: 'spouse',
     child: 'child', daughter: 'child', son: 'child', kid: 'child',
     parent: 'parent', mother: 'parent', father: 'parent', mom: 'parent', mum: 'parent', dad: 'parent',
     sibling: 'sibling', sister: 'sibling', brother: 'sibling',
-};
+}));
 /** The T-box term a said word names, or null — null means "keep their word", never "guess the nearest". */
 export function kinTermFor(said) {
-    return KIN_WORD_FOR[said.trim().toLowerCase().replace(/^(my|our)\s+/, '')] ?? null;
+    // OWN keys only: the table is a plain object and the word is what somebody SAID — "constructor" indexed it
+    // straight into Object.prototype and came back as a function, not null (found 2026-11-10, spec 445).
+    const word = said.trim().toLowerCase().replace(/^(my|our)\s+/, '');
+    return Object.hasOwn(KIN_WORD_FOR, word) ? KIN_WORD_FOR[word] : null;
 }
 /** The IRI of a kin term, for a record that wants to say which term it means. */
 export function kinIri(term) {

package/dist/household.js.map

@@ -1 +1 @@
-{"version":3,"file":"household.js","sourceRoot":"","sources":["../src/household.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,yEAAyE;AACzE,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,iGAAiG;AAEjG,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAE/D,yDAAyD;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAG3E,uGAAuG;AACvG,MAAM,CAAC,MAAM,YAAY,GAAsC;IAC7D,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACtE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ;IACjG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS;CAC1D,CAAC;AAEF,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AACrF,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AAG5E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAQ,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"household.js","sourceRoot":"","sources":["../src/household.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,yEAAyE;AACzE,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,iGAAiG;AAEjG,MAAM,QAAQ,GAAG,6CAA6C,CAAC;AAE/D,yDAAyD;AACzD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAG3E,uGAAuG;AACvG,+GAA+G;AAC/G,MAAM,CAAC,MAAM,YAAY,GAAsC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,EAAE;IACzI,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACtE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO;IAC7D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ;IACjG,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS;CACxB,CAAC,CAAC,CAAC;AAEtC,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,2GAA2G;IAC3G,qGAAqG;IACrG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,MAAM,CAAC,IAAa;IAClC,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AAG5E;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAQ,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9F,CAAC"}

package/dist/index.d.ts

@@ -384,6 +384,8 @@ export declare const CLASS: {
     readonly FailedActivity: "https://w3id.org/ep-plan#FailedActivity";
     /** One thing an estate vouches for, WITH its opening — the estate's own record behind a public root. */
     readonly ProjectionSubmission: "https://agenticprimitives.dev/ns/estate#ProjectionSubmission";
+    /** ONT-2 — the estate's held copy WITH the blind (⊑ ProjectionSubmission, ap:HeldSecret). Never told; the commitment is public. */
+    readonly HeldProjectionSubmission: "https://agenticprimitives.dev/ns/estate#HeldProjectionSubmission";
     /** A key an issuing agent (org or service, never a person) signs credentials with; anchored as an attestation. */
     readonly IssuerKeyFacet: "https://agenticprimitives.dev/ns/privacy-credential#IssuerKeyFacet";
     /** The issuer's live-credential root on neutral ground — its own, tagged row; revocation is retire + re-anchor. */
@@ -394,6 +396,12 @@ export declare const CLASS: {
     readonly DeviceKey: "https://agenticprimitives.dev/ns/privacy-credential#DeviceKey";
     /** The account a verifier sees: one per verifier origin, unlinkable across them; never the person. */
     readonly PairwiseAccount: "https://agenticprimitives.dev/ns/privacy-credential#PairwiseAccount";
+    /** ONT-2 — the secret pairwise accounts derive from (⊑ ap:HeldSecret; disjoint from PairwiseAccount). */
+    readonly HolderSecret: "https://agenticprimitives.dev/ns/privacy-credential#HolderSecret";
+    /** ONT-2 — a device key's private half held as a vault record (⊑ DeviceKey, ap:HeldSecret). */
+    readonly DeviceKeyMaterial: "https://agenticprimitives.dev/ns/privacy-credential#DeviceKeyMaterial";
+    /** ONT-2 — the holder's own copy of an anonymous credential, claims included (⊑ AnonymousCredential, ap:HeldSecret). */
+    readonly HeldAnonymousCredential: "https://agenticprimitives.dev/ns/privacy-credential#HeldAnonymousCredential";
     /** What a verifier asks — built from ITS policy and ITS challenge, never from a presentation. */
     readonly ProofRequest: "https://agenticprimitives.dev/ns/privacy-credential#ProofRequest";
     /** The statement proved: predicates compiled to canonical form and digested; what a mandate names. */
@@ -418,6 +426,10 @@ export declare const CLASS: {
     readonly ClientKeyBinding: "https://agenticprimitives.dev/ns/core#ClientKeyBinding";
     /** What one company calls the person: HKDF over a vault secret, salted by the issuer; no property leads to the person. */
     readonly PairwiseSubject: "https://agenticprimitives.dev/ns/core#PairwiseSubject";
+    /** ONT-2 — the secret pairwise subjects derive from (⊑ ap:HeldSecret; disjoint from PairwiseSubject). */
+    readonly PairwiseSecret: "https://agenticprimitives.dev/ns/core#PairwiseSecret";
+    /** Material held and never told (REM-2; `role: 'secret'` vault records). Every secret class is under it. */
+    readonly HeldSecret: "https://agenticprimitives.dev/ns/core#HeldSecret";
     /** A company-proposed, revision-pinned set of terms — an INTENT until a mandate binds its digest. Never an approval. */
     readonly ExternalOperation: "https://agenticprimitives.dev/ns/core#ExternalOperation";
     /** The person's account at one company and the credentials it left behind; a vault record, listed and revocable. */
@@ -1114,6 +1126,7 @@ export type { GroundedTerm, StandardGrounding } from './grounded-vocabulary.js';
 export { GROUNDED_VOCABULARY, groundedTerm } from './grounded-vocabulary.js';
 export * from './party-roles.js';
 export * from './vault-records.js';
+export { OVERSIGHT_DELEGATION, oversightCaveatRule, type OversightCaveatKind, type OversightCaveatRule } from './stewardship.js';
 export * from './plan-shapes.js';
 export * from './relations.js';
 export * from './arg-types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,EAAG,OAAgB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFL,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;CASd,CAAC;AAEX,4DAA4D;AAC5D,eAAO,MAAM,KAAK;;;;;;;;;;;IAiBhB,kDAAkD;;IAElD,gFAAgF;;IAEhF,sGAAsG;;IAEtG,2FAA2F;;;IAG3F,qFAAqF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmNrF,2CAA2C;;;IAG3C,0CAA0C;;;IAG1C,mDAAmD;;;IAGnD,4CAA4C;;;;IAK5C,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoHxC,4EAA4E;;IAE5E,kEAAkE;;;;IAIlE,sHAAsH;;;;;;;;;;;IActH,wGAAwG;;IAGxG,kHAAkH;;IAElH,mHAAmH;;IAEnH,yHAAyH;;IAEzH,uGAAuG;;IAEvG,sGAAsG;;IAEtG,iGAAiG;;IAEjG,sGAAsG;;IAEtG,iGAAiG;;IAEjG,yHAAyH;;IAEzH,qHAAqH;;IAErH,mHAAmH;;IAEnH,sHAAsH;;IAEtH,oGAAoG;;IAEpG,0HAA0H;;IAE1H,+FAA+F;;IAI/F,qIAAqI;;IAErI,0HAA0H;;IAE1H,wHAAwH;;IAExH,oHAAoH;;CAE5G,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiCpB,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmKlE,qGAAqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiGrG,wEAAwE;;;;IAIxE,gEAAgE;;;;;;;IAOhE,wFAAwF;;;;;;;;;;;IAYxF,+EAA+E;;;;;;;;;;;;;IAc/E,sGAAsG;;;IAGtG,kGAAkG;;;;;;;;;;;;;;;;IAqBlG,wGAAwG;;;;;;;;;;;;IAgBxG;;;;2GAIuG;;IAEvG;6EACyE;;IAEzE,+FAA+F;;IAE/F,+FAA+F;;IAE/F,gGAAgG;;IAEhG;;yGAEqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0JrG,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuGxC,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmChB,oFAAoF;;;IAKpF,uFAAuF;;;;;IAKvF,8EAA8E;;IAE9E,uFAAuF;;IAEvF,sFAAsF;;;;;;;;;;;;IAiBtF,wFAAwF;;;;;;;;;;;;;;;;;;;;IAyBxF,+EAA+E;;IAE/E;0EACsE;;;IAGtE;;kGAE8F;;IAE9F,0FAA0F;;;;;;;;IAc1F,6DAA6D;;IAE7D,wFAAwF;;IAExF,gFAAgF;;IAEhF,mGAAmG;;IAEnG,oGAAoG;;IAEpG,4GAA4G;;CAEpG,CAAC;AAQX,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAI7E,cAAc,kBAAkB,CAAC;AAGjC,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,cAAc,6BAA6B,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjV,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmBA,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB,EAAG,OAAgB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsFL,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;CASd,CAAC;AAEX,4DAA4D;AAC5D,eAAO,MAAM,KAAK;;;;;;;;;;;IAiBhB,kDAAkD;;IAElD,gFAAgF;;IAEhF,sGAAsG;;IAEtG,2FAA2F;;;IAG3F,qFAAqF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmNrF,2CAA2C;;;IAG3C,0CAA0C;;;IAG1C,mDAAmD;;;IAGnD,4CAA4C;;;;IAK5C,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoHxC,4EAA4E;;IAE5E,kEAAkE;;;;IAIlE,sHAAsH;;;;;;;;;;;IActH,wGAAwG;;IAExG,mIAAmI;;IAGnI,kHAAkH;;IAElH,mHAAmH;;IAEnH,yHAAyH;;IAEzH,uGAAuG;;IAEvG,sGAAsG;;IAEtG,yGAAyG;;IAEzG,+FAA+F;;IAE/F,wHAAwH;;IAExH,iGAAiG;;IAEjG,sGAAsG;;IAEtG,iGAAiG;;IAEjG,yHAAyH;;IAEzH,qHAAqH;;IAErH,mHAAmH;;IAEnH,sHAAsH;;IAEtH,oGAAoG;;IAEpG,0HAA0H;;IAE1H,+FAA+F;;IAI/F,qIAAqI;;IAErI,0HAA0H;;IAE1H,yGAAyG;;IAEzG,4GAA4G;;IAE5G,wHAAwH;;IAExH,oHAAoH;;CAE5G,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiCpB,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmKlE,qGAAqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiGrG,wEAAwE;;;;IAIxE,gEAAgE;;;;;;;IAOhE,wFAAwF;;;;;;;;;;;IAYxF,+EAA+E;;;;;;;;;;;;;IAc/E,sGAAsG;;;IAGtG,kGAAkG;;;;;;;;;;;;;;;;IAqBlG,wGAAwG;;;;;;;;;;;;IAgBxG;;;;2GAIuG;;IAEvG;6EACyE;;IAEzE,+FAA+F;;IAE/F,+FAA+F;;IAE/F,gGAAgG;;IAEhG;;yGAEqG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0JrG,gDAAgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuGxC,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmChB,oFAAoF;;;IAKpF,uFAAuF;;;;;IAKvF,8EAA8E;;IAE9E,uFAAuF;;IAEvF,sFAAsF;;;;;;;;;;;;IAiBtF,wFAAwF;;;;;;;;;;;;;;;;;;;;IAyBxF,+EAA+E;;IAE/E;0EACsE;;;IAGtE;;kGAE8F;;IAE9F,0FAA0F;;;;;;;;IAc1F,6DAA6D;;IAE7D,wFAAwF;;IAExF,gFAAgF;;IAEhF,mGAAmG;;IAEnG,oGAAoG;;IAEpG,4GAA4G;;CAEpG,CAAC;AAQX,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAI7E,cAAc,kBAAkB,CAAC;AAGjC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGjI,cAAc,kBAAkB,CAAC;AAGjC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,gBAAgB,CAAC;AAI/B,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,cAAc,6BAA6B,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACnJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAElI,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjV,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -521,6 +521,8 @@ export const CLASS = {
     // ── Estate projection (tbox/estate.ttl; spec 410 §4) ──
     /** One thing an estate vouches for, WITH its opening — the estate's own record behind a public root. */
     ProjectionSubmission: `${NS.apest}ProjectionSubmission`,
+    /** ONT-2 — the estate's held copy WITH the blind (⊑ ProjectionSubmission, ap:HeldSecret). Never told; the commitment is public. */
+    HeldProjectionSubmission: `${NS.apest}HeldProjectionSubmission`,
     // ── Anonymous credentials (tbox/privacy-credential.ttl; specs 304 / 305 / 442 §7.2 / 443 W5) ──
     /** A key an issuing agent (org or service, never a person) signs credentials with; anchored as an attestation. */
     IssuerKeyFacet: `${NS.appc}IssuerKeyFacet`,
@@ -532,6 +534,12 @@ export const CLASS = {
     DeviceKey: `${NS.appc}DeviceKey`,
     /** The account a verifier sees: one per verifier origin, unlinkable across them; never the person. */
     PairwiseAccount: `${NS.appc}PairwiseAccount`,
+    /** ONT-2 — the secret pairwise accounts derive from (⊑ ap:HeldSecret; disjoint from PairwiseAccount). */
+    HolderSecret: `${NS.appc}HolderSecret`,
+    /** ONT-2 — a device key's private half held as a vault record (⊑ DeviceKey, ap:HeldSecret). */
+    DeviceKeyMaterial: `${NS.appc}DeviceKeyMaterial`,
+    /** ONT-2 — the holder's own copy of an anonymous credential, claims included (⊑ AnonymousCredential, ap:HeldSecret). */
+    HeldAnonymousCredential: `${NS.appc}HeldAnonymousCredential`,
     /** What a verifier asks — built from ITS policy and ITS challenge, never from a presentation. */
     ProofRequest: `${NS.appc}ProofRequest`,
     /** The statement proved: predicates compiled to canonical form and digested; what a mandate names. */
@@ -558,6 +566,10 @@ export const CLASS = {
     ClientKeyBinding: `${NS.ap}ClientKeyBinding`,
     /** What one company calls the person: HKDF over a vault secret, salted by the issuer; no property leads to the person. */
     PairwiseSubject: `${NS.ap}PairwiseSubject`,
+    /** ONT-2 — the secret pairwise subjects derive from (⊑ ap:HeldSecret; disjoint from PairwiseSubject). */
+    PairwiseSecret: `${NS.ap}PairwiseSecret`,
+    /** Material held and never told (REM-2; `role: 'secret'` vault records). Every secret class is under it. */
+    HeldSecret: `${NS.ap}HeldSecret`,
     /** A company-proposed, revision-pinned set of terms — an INTENT until a mandate binds its digest. Never an approval. */
     ExternalOperation: `${NS.ap}ExternalOperation`,
     /** The person's account at one company and the credentials it left behind; a vault record, listed and revocable. */
@@ -1351,6 +1363,7 @@ export { GROUNDED_VOCABULARY, groundedTerm } from './grounded-vocabulary.js';
 export * from './party-roles.js';
 // Spec 356 W1 — what a vault record key MEANS, bound by IRI to classes the T-box declares.
 export * from './vault-records.js';
+export { OVERSIGHT_DELEGATION, oversightCaveatRule } from './stewardship.js';
 // Spec 358 W4 — which relations a plan may enumerate and fan out over. Bound by IRI, fail-closed.
 export * from './plan-shapes.js';
 // Spec 363 W3 — the R-box compiled: which relations are inverses, which are chains, and how to walk one.