@agenticprimitives/ontology 1.0.0-alpha.45 → 1.0.0-alpha.47

package/dist/vault-records.js

@@ -47,6 +47,9 @@ const PPLAN = 'http://purl.org/net/p-plan#';
 const EPPLAN = 'https://w3id.org/ep-plan#';
 const APEVAL = 'https://agenticprimitives.dev/ns/evaluation#';
 const DQV = 'http://www.w3.org/ns/dqv#';
+export const VAULT_RECORD_ROLES = ['entity', 'index', 'secret'];
+/** What a `secret` row IS, in the T-box — bound by IRI so the role is not vocabulary this file invented. */
+export const HELD_SECRET_CLASS = 'https://agenticprimitives.dev/ns/core#HeldSecret';
 /**
  * The record kinds this substrate stores, each bound to what it IS.
  *
@@ -63,14 +66,14 @@ export const VAULT_RECORD_BINDINGS = [
     // it was here until the check started reading record bindings. You ask about endeavors; the log is how
     // one of them got where it is.
     { match: { prefix: 'coordination.endeavor:events:' }, class: `${APCOORD}Endeavor`, label: 'endeavor history', plural: 'endeavor history', ownedBy: 'either', role: 'index' },
-    { match: { prefix: 'coordination.endeavor:' }, class: `${APCOORD}Endeavor`, label: 'endeavor', plural: 'endeavors', ownedBy: 'either' },
-    { match: { exact: 'coordination.requests' }, class: `${APCOORD}EndeavorRequest`, label: 'request for work', plural: 'requests for work', ownedBy: 'either' },
+    { match: { prefix: 'coordination.endeavor:' }, class: `${APCOORD}Endeavor`, label: 'endeavor', plural: 'endeavors', ownedBy: 'either', role: 'entity' },
+    { match: { exact: 'coordination.requests' }, class: `${APCOORD}EndeavorRequest`, label: 'request for work', plural: 'requests for work', ownedBy: 'either', role: 'entity' },
     // ── The parties' own evidence of a transfer (spec 360) ────────────────────────────────────────
     // A payment's StepReceipt is AUTHORITY evidence and lives in the audit sink. This is the different
     // artifact the two PARTIES hold: what Alice can point at to say she paid, and what tells Bob he was
     // paid, to which treasury, in what amount. Keyed by the transaction, because that is the one identifier
     // both sides can check against the chain rather than take on trust.
-    { match: { prefix: 'payment.receipt:' }, class: `${APIX}PaymentReceipt`, label: 'payment receipt', plural: 'payment receipts', ownedBy: 'either',
+    { match: { prefix: 'payment.receipt:' }, class: `${APIX}PaymentReceipt`, label: 'payment receipt', plural: 'payment receipts', ownedBy: 'either', role: 'entity',
         properties: {
             payer: `${APIX}receiptPayer`,
             payee: `${APIX}receiptPayee`,
@@ -82,12 +85,13 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Organization membership (spec 324, ADR-0025) ──────────────────────────────────────────────
     // The ROSTER an organization keeps of its own members. This is the record `organization.membership.list`
     // reads today through its own hand-written invoker — W4 retires that in favour of this binding.
-    { match: { exact: 'directory.data' }, class: `${APORG}DirectoryListing`, label: 'member listing', plural: 'member listings', ownedBy: 'organization' },
-    { match: { prefix: 'org.invite:agent:' }, class: `${APORG}MembershipInvitation`, label: 'membership invitation', plural: 'membership invitations', ownedBy: 'organization' },
+    { match: { exact: 'directory.data' }, class: `${APORG}DirectoryListing`, label: 'member listing', plural: 'member listings', ownedBy: 'organization', role: 'entity' },
+    { match: { prefix: 'org.invite:agent:' }, class: `${APORG}MembershipInvitation`, label: 'membership invitation', plural: 'membership invitations', ownedBy: 'organization', role: 'entity' },
     // Spec 401 (amended 2026-10-26) — ONE HALF of a friendship: a person's own offer to another person (`friend:<their sa>`),
     // with the grant they signed. A friendship is never a record — it is derived from two of these, one in each vault.
-    { match: { prefix: 'friend:' }, class: `${APORG}FriendshipOffer`, label: 'friendship offer', plural: 'friendship offers', ownedBy: 'person' },
-    { match: { exact: 'org.applications' }, class: `${APORG}MembershipApplication`, label: 'membership application', plural: 'membership applications', ownedBy: 'organization' },
+    { match: { prefix: 'friend:' }, class: `${APORG}FriendshipOffer`, label: 'friendship offer', plural: 'friendship offers', ownedBy: 'person', role: 'entity',
+        properties: { offeredTo: `${APORG}offeredTo`, friendType: `${APORG}friendTypeLabel`, delegation: `${APORG}offerGrant`, status: `${APORG}offerStatus`, withdrawnAt: `${APORG}offerWithdrawnAt` } },
+    { match: { exact: 'org.applications' }, class: `${APORG}MembershipApplication`, label: 'membership application', plural: 'membership applications', ownedBy: 'organization', role: 'entity' },
     // THE MEMBERSHIP ITSELF — spec 325's shape, in the organization's own vault. Distinct from the
     // invitation, which the T-box files under "Enrollment instruments (NOT membership)": an invitation is
     // how somebody came to be admitted, and satisfying one creates nothing. The membership is the record
@@ -97,7 +101,7 @@ export const VAULT_RECORD_BINDINGS = [
     // already carries, and clear of `org.membership:local-names`, which is a name map and not a member.
     {
         match: { prefix: 'org.membership:member:' }, class: `${APORG}OrganizationMembership`,
-        label: 'member', plural: 'members', ownedBy: 'organization',
+        label: 'member', plural: 'members', ownedBy: 'organization', role: 'entity',
         // Spec 325's shape, field for field — this is what "readable by the ontology" looks like in practice.
         properties: {
             memberAgent: `${APORG}memberAgent`,
@@ -123,7 +127,7 @@ export const VAULT_RECORD_BINDINGS = [
     // Ask that can change a name can change a street address, and the record's write allow-list agrees.
     {
         match: { exact: 'impact-profile' }, class: `${APCON}ContactProfile`,
-        label: 'contact profile', plural: 'contact profiles', ownedBy: 'person',
+        label: 'contact profile', plural: 'contact profiles', ownedBy: 'person', role: 'entity',
         properties: { ...CONTACT_PROFILE_PROPERTIES, 'contact.location.precision': `${APCON}locationPrecision` },
     },
     // A PERSON's own record of who they are connected to — private, a vault credential and never an
@@ -134,14 +138,14 @@ export const VAULT_RECORD_BINDINGS = [
         // per person holding their own household — not a shared roster, because two people's records can
         // disagree and the honest model says whose you are reading.
         match: { exact: 'household.data' }, class: `${APHH}Household`,
-        label: 'household', plural: 'household', ownedBy: 'person',
+        label: 'household', plural: 'household', ownedBy: 'person', role: 'entity',
         properties: {
             'members[].agent': `${APHH}householdMember`,
             'members[].role': `${APHH}householdRole`,
             'members[].kin': `${APHH}kinRelation`,
         },
     },
-    { match: { exact: 'relationships.data' }, class: `${APORG}OrganizationMembership`, label: 'organization you belong to', plural: 'organizations you belong to', ownedBy: 'person',
+    { match: { exact: 'relationships.data' }, class: `${APORG}OrganizationMembership`, label: 'organization you belong to', plural: 'organizations you belong to', ownedBy: 'person', role: 'entity',
         // The map is KEYED by the organization — the thing a reader most often gets wrong here.
         properties: {
             'orgs{}': `${APORG}organizationAgent`,
@@ -150,7 +154,7 @@ export const VAULT_RECORD_BINDINGS = [
         },
     },
     // ── Content (spec 347 / the field artifacts) ──────────────────────────────────────────────────
-    { match: { prefix: 'content.artifact.' }, class: `${APFUL}Artifact`, label: 'artifact', plural: 'artifacts', ownedBy: 'either',
+    { match: { prefix: 'content.artifact.' }, class: `${APFUL}Artifact`, label: 'artifact', plural: 'artifacts', ownedBy: 'either', role: 'entity',
         properties: {
             'kind': `${APFUL}artifactKind`,
             'commitment': `${APFUL}bodyHash`,
@@ -158,49 +162,49 @@ export const VAULT_RECORD_BINDINGS = [
     },
     // ── Conversation (spec 313/316) ───────────────────────────────────────────────────────────────
     // A message BODY is the content of one message; a topic is the conversation it sits in.
-    { match: { prefix: 'message.body:' }, class: `${APFUL}Message`, label: 'message', plural: 'messages', ownedBy: 'either' },
-    { match: { prefix: 'conversation.topic:' }, class: `${APMSG}DiscussionTopic`, label: 'discussion', plural: 'discussions', ownedBy: 'either' },
+    { match: { prefix: 'message.body:' }, class: `${APFUL}Message`, label: 'message', plural: 'messages', ownedBy: 'either', role: 'entity' },
+    { match: { prefix: 'conversation.topic:' }, class: `${APMSG}DiscussionTopic`, label: 'discussion', plural: 'discussions', ownedBy: 'either', role: 'entity' },
     // ── Relationship credentials (spec 410 §8) ───────────────────────────────────────────────────
     // The countersigned form of a relationship, one copy in each party's vault; the revocation likewise.
-    { match: { prefix: 'relationships.credential:' }, class: `${AP}RelationshipCredential`, label: 'relationship credential', plural: 'relationship credentials', ownedBy: 'either',
+    { match: { prefix: 'relationships.credential:' }, class: `${AP}RelationshipCredential`, label: 'relationship credential', plural: 'relationship credentials', ownedBy: 'either', role: 'entity',
         properties: { kind: `${AP}relationshipKind` },
     },
-    { match: { prefix: 'relationships.revocation:' }, class: `${AP}RelationshipCredential`, label: 'relationship revocation', plural: 'relationship revocations', ownedBy: 'either',
+    { match: { prefix: 'relationships.revocation:' }, class: `${AP}RelationshipCredential`, label: 'relationship revocation', plural: 'relationship revocations', ownedBy: 'either', role: 'entity',
         properties: { credential: `${AP}revokes` },
     },
     // ── Governance of the common model (spec 410 §10) ────────────────────────────────────────────
-    { match: { prefix: 'ontology.meaning:' }, class: `${APGOV}LocalMeaning`, label: 'local meaning of a common term', plural: 'local meanings', ownedBy: 'organization',
+    { match: { prefix: 'ontology.meaning:' }, class: `${APGOV}LocalMeaning`, label: 'local meaning of a common term', plural: 'local meanings', ownedBy: 'organization', role: 'entity',
         properties: { term: `${APGOV}ofTerm`, organization: `${APGOV}heldBy`, relation: `${APGOV}mappingRelation` },
     },
-    { match: { exact: 'ontology.adopted' }, class: `${APGOV}AdoptedVersion`, label: 'adopted ontology version', plural: 'adopted ontology versions', ownedBy: 'either',
+    { match: { exact: 'ontology.adopted' }, class: `${APGOV}AdoptedVersion`, label: 'adopted ontology version', plural: 'adopted ontology versions', ownedBy: 'either', role: 'entity',
         properties: { manifestDigest: `${APGOV}manifestDigest`, adoptedAt: `${APGOV}adoptedAt`, proposalRef: `${APGOV}proposalRef` },
     },
-    { match: { prefix: 'ontology.steward:' }, class: `${APGOV}Steward`, label: 'steward of a term', plural: 'stewards', ownedBy: 'either',
+    { match: { prefix: 'ontology.steward:' }, class: `${APGOV}Steward`, label: 'steward of a term', plural: 'stewards', ownedBy: 'either', role: 'entity',
         properties: { subject: `${APGOV}stewards`, stewardAgent: `${APGOV}stewardAgent`, charterRef: `${APGOV}charterRef` },
     },
     // ── Delegation lineage (spec 410 §1.2) ───────────────────────────────────────────────────────
     // A key-signed wire re-issued for a credential rotation, and which wire it replaces. The delegator's vault holds
     // it; the delegate fetches the head of the lineage from the delegator's agent. Never a grant of anything new.
-    { match: { prefix: 'delegation.lineage:' }, class: `${APDEL}Delegation`, label: 'delegation re-issued for a rotation', plural: 'delegations re-issued for a rotation', ownedBy: 'either',
+    { match: { prefix: 'delegation.lineage:' }, class: `${APDEL}Delegation`, label: 'delegation re-issued for a rotation', plural: 'delegations re-issued for a rotation', ownedBy: 'either', role: 'entity',
         properties: { supersedes: `${APDEL}supersedes` },
     },
     // ── Resolution (spec 338) ─────────────────────────────────────────────────────────────────────
-    { match: { exact: 'resolution.grants' }, class: `${APAR}PrivateResolutionGrant`, label: 'way to reach someone', plural: 'ways to reach people', ownedBy: 'either',
+    { match: { exact: 'resolution.grants' }, class: `${APAR}PrivateResolutionGrant`, label: 'way to reach someone', plural: 'ways to reach people', ownedBy: 'either', role: 'entity',
         // The held record names WHOSE agent it opens; the address itself comes from the resolver, per use.
         properties: {
             'grants[].owner': `${APAR}permitsDiscoveryOf`,
         },
     },
-    { match: { exact: 'resolution.requests' }, class: `${APAR}AgentConnectionInvitation`, label: 'request for a way to reach an agent', plural: 'requests for a way to reach an agent', ownedBy: 'either' },
+    { match: { exact: 'resolution.requests' }, class: `${APAR}AgentConnectionInvitation`, label: 'request for a way to reach an agent', plural: 'requests for a way to reach an agent', ownedBy: 'either', role: 'entity' },
     // ── What an agent IS and CAN DO ───────────────────────────────────────────────────────────────
-    { match: { exact: 'capabilities.data' }, class: `${APS}CapabilityCatalog`, label: 'capability', plural: 'capabilities', ownedBy: 'either',
+    { match: { exact: 'capabilities.data' }, class: `${APS}CapabilityCatalog`, label: 'capability', plural: 'capabilities', ownedBy: 'either', role: 'entity',
         // The record is the catalogue; each ENTRY is a claim, so its fields map to SkillClaim's properties.
         properties: {
             '[].relation': `${APS}claimRelation`,
             '[].label': `${APS}semanticType`,
         },
     },
-    { match: { exact: 'skills.data' }, class: `${APS}SkillClaim`, label: 'skill claim', plural: 'skill claims', ownedBy: 'either',
+    { match: { exact: 'skills.data' }, class: `${APS}SkillClaim`, label: 'skill claim', plural: 'skill claims', ownedBy: 'either', role: 'entity',
         properties: {
             '[].definitionId': `${APS}definitionId`,
             '[].subject': `${APS}claimSubject`,
@@ -216,7 +220,7 @@ export const VAULT_RECORD_BINDINGS = [
         properties: { '[].kind': `${APCR}credentialKind` } },
     // The emails and phones that open this home and are told when something changes. Never a signer.
     { match: { exact: 'security.channels' }, class: `${APCR}ChannelFacet`, label: 'contact channel', plural: 'contact channels', ownedBy: 'person', role: 'index' },
-    { match: { exact: 'impact-profile' }, class: `${APROF}AgentProfile`, label: 'profile', plural: 'profile', ownedBy: 'either',
+    { match: { exact: 'impact-profile' }, class: `${APROF}AgentProfile`, label: 'profile', plural: 'profile', ownedBy: 'either', role: 'entity',
         // Observed records carry only `contact`, which the T-box has no property for — see the coverage ledger.
         properties: {
             'displayName': `${APROF}displayName`,
@@ -226,11 +230,11 @@ export const VAULT_RECORD_BINDINGS = [
     // An index over the artifacts, not a thing beside them.
     { match: { exact: 'content.catalog' }, class: `${APFUL}Artifact`, label: 'content index', plural: 'content index', ownedBy: 'either', role: 'index' },
     // ── The card studio (spec 347) ────────────────────────────────────────────────────────────────
-    { match: { prefix: 'agent-cards:' }, class: `${AP}A2AAgentCard`, label: 'agent card', plural: 'agent cards', ownedBy: 'either' },
+    { match: { prefix: 'agent-cards:' }, class: `${AP}A2AAgentCard`, label: 'agent card', plural: 'agent cards', ownedBy: 'either', role: 'entity' },
     // ── The playbook an agent runs under (spec 354) ───────────────────────────────────────────────
     {
         match: { exact: 'archetype.assignment' }, class: `${APS}ArchetypeAssignment`,
-        label: 'playbook', plural: 'playbook', ownedBy: 'either',
+        label: 'playbook', plural: 'playbook', ownedBy: 'either', role: 'entity',
         properties: {
             archetypeId: `${APS}assignedArchetype`,
             definitionDigest: `${APS}definitionDigest`,
@@ -245,7 +249,7 @@ export const VAULT_RECORD_BINDINGS = [
     // the same IRI the context maps it to — bound twice on purpose, checked once by the build.
     {
         match: { prefix: 'run.provenance:' }, class: `${EPPLAN}ExecutionTraceBundle`,
-        label: 'run provenance', plural: 'run provenances', ownedBy: 'either',
+        label: 'run provenance', plural: 'run provenances', ownedBy: 'either', role: 'entity',
         properties: {
             wasAttributedTo: `${PROV}wasAttributedTo`,
             wasInformedBy: `${PROV}wasInformedBy`,
@@ -337,7 +341,7 @@ export const VAULT_RECORD_BINDINGS = [
     // estate it was (`estate`). A claim about where to look — the holder recomputes the digest and reads the registry.
     {
         match: { prefix: 'run.anchor:' }, class: `${APEXEC}ReceiptAnchor`,
-        label: 'run anchor', plural: 'run anchors', ownedBy: 'either',
+        label: 'run anchor', plural: 'run anchors', ownedBy: 'either', role: 'entity',
         properties: {
             digest: `${APEXEC}anchorDigest`,
             registry: `${APEXEC}anchorRegistry`,
@@ -351,7 +355,7 @@ export const VAULT_RECORD_BINDINGS = [
     // metric (and per step where the number is a step's). Descriptive, never judged; no words (shape M3).
     {
         match: { prefix: 'run.measures:' }, class: `${APEVAL}RunMeasures`,
-        label: 'run measurements', plural: 'run measurements', ownedBy: 'either',
+        label: 'run measurements', plural: 'run measurements', ownedBy: 'either', role: 'entity',
         properties: {
             wasDerivedFrom: `${PROV}wasDerivedFrom`,
             wasAttributedTo: `${PROV}wasAttributedTo`,
@@ -375,7 +379,7 @@ export const VAULT_RECORD_BINDINGS = [
     // (the service-agent-signing rule), or by a person's SA at her Home.
     {
         match: { prefix: 'run.assessment:' }, class: `${APEVAL}Assessment`,
-        label: 'run assessment', plural: 'run assessments', ownedBy: 'either',
+        label: 'run assessment', plural: 'run assessments', ownedBy: 'either', role: 'entity',
         properties: {
             subject: `${PROV}used`,
             recordDigest: `${APEXEC}anchorDigest`,
@@ -394,7 +398,7 @@ export const VAULT_RECORD_BINDINGS = [
     // That is the whole reason this is a record and not a handoff token.
     {
         match: { prefix: 'endeavor.continuation:' }, class: `${APCOORD}Endeavor`,
-        label: 'continuation package', plural: 'continuation packages', ownedBy: 'either',
+        label: 'continuation package', plural: 'continuation packages', ownedBy: 'either', role: 'entity',
         properties: {
             // The objective is the Endeavor's OutcomeSpecification — the observable success definition that already
             // exists, not a prose restatement of it. An agent picking the work up is told what "done" means in the
@@ -410,7 +414,7 @@ export const VAULT_RECORD_BINDINGS = [
     // Every exchange is one signed unit by its author; a steward's determination closes it; it reverses nothing.
     {
         match: { prefix: 'interaction.dispute:' }, class: `${APIX}Interaction`,
-        label: 'dispute', plural: 'disputes', ownedBy: 'either',
+        label: 'dispute', plural: 'disputes', ownedBy: 'either', role: 'entity',
         properties: {
             profileVersion: `${APIX}profileVersion`,
             'exchanges[].performative': `${APIX}performative`,
@@ -419,7 +423,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── The run's pointer to the dispute that cites it (spec 410 §10, `apexec:disputedBy`) ──
     {
         match: { prefix: 'run.dispute:' }, class: `${APEXEC}ServiceExecution`,
-        label: 'run dispute', plural: 'run disputes', ownedBy: 'either',
+        label: 'run dispute', plural: 'run disputes', ownedBy: 'either', role: 'entity',
         properties: {
             disputedBy: `${APEXEC}disputedBy`,
         },
@@ -428,7 +432,7 @@ export const VAULT_RECORD_BINDINGS = [
     // The body a resume or a person fetches under the agent's grant; the receipt's outputDigest commits to it.
     {
         match: { prefix: 'run.artifact:' }, class: `${APEXEC}RunArtifact`,
-        label: 'run artifact', plural: 'run artifacts', ownedBy: 'either',
+        label: 'run artifact', plural: 'run artifacts', ownedBy: 'either', role: 'entity',
         properties: {
             digest: `${APEXEC}artifactDigest`,
             bytes: `${APEXEC}artifactBytes`,
@@ -438,7 +442,7 @@ export const VAULT_RECORD_BINDINGS = [
     // The files the model wrote and the test evidence as recorded; the PR opened from it names this record.
     {
         match: { prefix: 'build.run:' }, class: `${APEXEC}BuildArtifact`,
-        label: 'build run', plural: 'build runs', ownedBy: 'either',
+        label: 'build run', plural: 'build runs', ownedBy: 'either', role: 'entity',
         properties: {
             repository: `${APEXEC}buildRepository`,
             base: `${APEXEC}buildBase`,
@@ -454,7 +458,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Build promotions (spec 398 §9.4 / ap-build B5) — the exact tuple a steward's signature was over ──
     {
         match: { prefix: 'build.promotion:' }, class: `${APEXEC}BuildPromotion`,
-        label: 'build promotion', plural: 'build promotions', ownedBy: 'either',
+        label: 'build promotion', plural: 'build promotions', ownedBy: 'either', role: 'entity',
         properties: {
             repository: `${APEXEC}buildRepository`,
             commit: `${APEXEC}promotedCommit`,
@@ -467,7 +471,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── The agent's budget (P1.4) — what it may do in a day, declared by its steward ──
     {
         match: { exact: 'agent.budget' }, class: `${APCTX}AgentBudget`,
-        label: 'agent budget', plural: 'agent budget', ownedBy: 'either',
+        label: 'agent budget', plural: 'agent budget', ownedBy: 'either', role: 'entity',
         properties: { asksPerDay: `${APCTX}asksPerDay`, vaultCallsPerDay: `${APCTX}vaultCallsPerDay` },
     },
     // ── The town's model gateway (spec 434) — inference.svc's OWN records: policy, entitlements, receipts ──
@@ -475,28 +479,28 @@ export const VAULT_RECORD_BINDINGS = [
     // service's own policy over its own resource, never a delegation (G8). `assertedAgent` is what the caller SAID.
     {
         match: { prefix: 'inference.receipt:' }, class: `${APINF}InferenceReceipt`,
-        label: 'inference receipt', plural: 'inference receipts', ownedBy: 'either',
+        label: 'inference receipt', plural: 'inference receipts', ownedBy: 'either', role: 'entity',
         properties: { profile: `${APINF}profileId`, profileVersion: `${APINF}profileVersion`, provider: `${APINF}modelProvider`, model: `${APINF}modelId`, principal: `${APINF}principal`, assertedAgent: `${APINF}assertedAgent`, costMicroUsd: `${APINF}costMicroUsd`, attempt: `${APINF}attempt`, fallbackOf: `${APINF}fallbackOf`, reconciliation: `${APINF}reconciliationState`, outcome: `${APINF}outcome`, purpose: `${APINF}purpose`, estate: `${APINF}estate`, clientKind: `${APINF}clientKind` },
     },
-    { match: { prefix: 'inference.profile:' }, class: `${APINF}ModelProfile`, label: 'model profile', plural: 'model profiles', ownedBy: 'either', properties: { id: `${APINF}profileId`, 'servesCapability[]': `${APINF}servesCapability` } },
-    { match: { prefix: 'inference.model:' }, class: `${APINF}ModelCatalogEntry`, label: 'model catalog entry', plural: 'model catalog entries', ownedBy: 'either', properties: { provider: `${APINF}modelProvider`, model: `${APINF}modelId`, enabled: `${APINF}enabled` } },
-    { match: { prefix: 'inference.client:' }, class: `${APINF}ClientEntitlement`, label: 'inference client', plural: 'inference clients', ownedBy: 'either', properties: { principal: `${APINF}principal`, estate: `${APINF}estate`, kind: `${APINF}clientKind` } },
-    { match: { prefix: 'inference.policy-change:' }, class: `${APINF}PolicyChange`, label: 'inference policy change', plural: 'inference policy changes', ownedBy: 'either', properties: { recordKey: `${APINF}changedRecord`, reason: `${APINF}reason` } },
+    { match: { prefix: 'inference.profile:' }, class: `${APINF}ModelProfile`, label: 'model profile', plural: 'model profiles', ownedBy: 'either', role: 'entity', properties: { id: `${APINF}profileId`, 'servesCapability[]': `${APINF}servesCapability` } },
+    { match: { prefix: 'inference.model:' }, class: `${APINF}ModelCatalogEntry`, label: 'model catalog entry', plural: 'model catalog entries', ownedBy: 'either', role: 'entity', properties: { provider: `${APINF}modelProvider`, model: `${APINF}modelId`, enabled: `${APINF}enabled` } },
+    { match: { prefix: 'inference.client:' }, class: `${APINF}ClientEntitlement`, label: 'inference client', plural: 'inference clients', ownedBy: 'either', role: 'entity', properties: { principal: `${APINF}principal`, estate: `${APINF}estate`, kind: `${APINF}clientKind` } },
+    { match: { prefix: 'inference.policy-change:' }, class: `${APINF}PolicyChange`, label: 'inference policy change', plural: 'inference policy changes', ownedBy: 'either', role: 'entity', properties: { recordKey: `${APINF}changedRecord`, reason: `${APINF}reason` } },
     // ── Spec 435 / 436 / 437 — standing, manifests, the Town Ask's records ──
     // The agent's own copy of its TownStanding VC (the chain holds the hash): read to show and renew; no gate reads it.
-    { match: { prefix: 'town.standing:' }, class: `${APATT}TownStanding`, label: 'town standing', plural: 'town standings', ownedBy: 'either', properties: { town: `${APATT}standingTown`, estate: `${APATT}standingEstate`, steward: `${APATT}standingSteward`, validUntil: `${APATT}standingValidUntil` } },
+    { match: { prefix: 'town.standing:' }, class: `${APATT}TownStanding`, label: 'town standing', plural: 'town standings', ownedBy: 'either', role: 'entity', properties: { town: `${APATT}standingTown`, estate: `${APATT}standingEstate`, steward: `${APATT}standingSteward`, validUntil: `${APATT}standingValidUntil` } },
     // A service's own signed MCP tool manifest, as published; a holder pins its digest on `connector.mcp:` (spec 404).
-    { match: { prefix: 'mcp.manifest:' }, class: `${APAR}McpToolManifest`, label: 'MCP tool manifest', plural: 'MCP tool manifests', ownedBy: 'either', properties: { 'server.url': `${APAR}manifestServerUrl` } },
-    { match: { prefix: 'mcp.bundle:' }, class: `${APAR}McpToolBundle`, label: 'MCP tool bundle', plural: 'MCP tool bundles', ownedBy: 'either' },
+    { match: { prefix: 'mcp.manifest:' }, class: `${APAR}McpToolManifest`, label: 'MCP tool manifest', plural: 'MCP tool manifests', ownedBy: 'either', role: 'entity', properties: { 'server.url': `${APAR}manifestServerUrl` } },
+    { match: { prefix: 'mcp.bundle:' }, class: `${APAR}McpToolBundle`, label: 'MCP tool bundle', plural: 'MCP tool bundles', ownedBy: 'either', role: 'entity' },
     // The Town Ask (spec 436 §5.5, 437): the context agents' memory of the Pulse — counts, never a person.
-    { match: { prefix: 'pulse.day:' }, class: `${APINF}TownPulse`, label: "day's pulse", plural: 'daily pulses', ownedBy: 'either', properties: { day: `${APINF}pulseDay` } },
-    { match: { prefix: 'pulse.sample:' }, class: `${APINF}TownPulse`, label: 'pulse sample', plural: 'pulse samples', ownedBy: 'either' },
-    { match: { prefix: 'estate.checklist:' }, class: `${APINF}StandingChecklist`, label: 'standing checklist', plural: 'standing checklists', ownedBy: 'either' },
-    { match: { prefix: 'estate.manifest:' }, class: `${APINF}EstateManifest`, label: 'estate manifest', plural: 'estate manifests', ownedBy: 'either' },
+    { match: { prefix: 'pulse.day:' }, class: `${APINF}TownPulse`, label: "day's pulse", plural: 'daily pulses', ownedBy: 'either', role: 'entity', properties: { day: `${APINF}pulseDay` } },
+    { match: { prefix: 'pulse.sample:' }, class: `${APINF}TownPulse`, label: 'pulse sample', plural: 'pulse samples', ownedBy: 'either', role: 'entity' },
+    { match: { prefix: 'estate.checklist:' }, class: `${APINF}StandingChecklist`, label: 'standing checklist', plural: 'standing checklists', ownedBy: 'either', role: 'entity' },
+    { match: { prefix: 'estate.manifest:' }, class: `${APINF}EstateManifest`, label: 'estate manifest', plural: 'estate manifests', ownedBy: 'either', role: 'entity' },
     // ── External MCP servers as connectors (spec 404) — the holder's own; the token is NOT in the record ──
     {
         match: { prefix: 'connector.mcp:' }, class: `${APCTX}McpConnector`,
-        label: 'MCP connector', plural: 'MCP connectors', ownedBy: 'either',
+        label: 'MCP connector', plural: 'MCP connectors', ownedBy: 'either', role: 'entity',
         properties: {
             name: `${APCTX}connectorName`,
             url: `${APCTX}connectorUrl`,
@@ -508,7 +512,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Conversation memory (spec 370 P7) — what the agent RESOLVED for the owner lately, in their vault ──
     {
         match: { exact: 'conversation.recent' }, class: `${APCTX}ConversationMemory`,
-        label: 'recent conversation', plural: 'recent conversations', ownedBy: 'person',
+        label: 'recent conversation', plural: 'recent conversations', ownedBy: 'person', role: 'entity',
         properties: {
             'turns[].at': `${APCTX}recalledAt`,
             'turns[].parties[].agent': `${APCTX}recalledParty`,
@@ -518,7 +522,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Learned memory (spec 358 W5) — what the owner TOLD the agent, in their own vault ────────────
     {
         match: { prefix: 'preference:' }, class: `${APCTX}LearnedPreference`,
-        label: 'thing you told me', plural: 'things you told me', ownedBy: 'person',
+        label: 'thing you told me', plural: 'things you told me', ownedBy: 'person', role: 'entity',
         properties: {
             subject: `${APCTX}preferenceSubject`,
             trigger: `${APCTX}preferenceTrigger`,
@@ -528,7 +532,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Confirmation memory (spec 385; bound here by spec 394) — which "David" the owner chose, per scope ──
     {
         match: { exact: 'confirmation.preferences' }, class: `${APCTX}ConfirmationMemory`,
-        label: 'remembered choice', plural: 'remembered choices', ownedBy: 'person',
+        label: 'remembered choice', plural: 'remembered choices', ownedBy: 'person', role: 'entity',
         properties: {
             'entries[].agent': `${APCTX}confirmedParty`,
             'entries[].word': `${APCTX}confirmedWords`,
@@ -538,7 +542,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Playbook memory — the agent's own counts on the subjects of one skill family ───────────────
     {
         match: { prefix: 'playbook.memory:' }, class: `${APCTX}PlaybookMemory`,
-        label: 'playbook memory', plural: 'playbook memories', ownedBy: 'either',
+        label: 'playbook memory', plural: 'playbook memories', ownedBy: 'either', role: 'entity',
         properties: {
             family: `${APCTX}memoryFamily`,
             rounds: `${APCTX}memoryRounds`,
@@ -547,50 +551,50 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Card-room study records — the person's own play, read by a named coach service under a grant ──
     {
         match: { exact: 'cardroom.hand' }, class: `${APCTX}CardRoomHandRecord`,
-        label: 'hand record', plural: 'hand records', ownedBy: 'person',
+        label: 'hand record', plural: 'hand records', ownedBy: 'person', role: 'entity',
         properties: { hands: `${APCTX}handsRecorded` },
     },
-    { match: { exact: 'cardroom.style' }, class: `${APCTX}CardRoomStyleRecord`, label: 'playing style', plural: 'playing styles', ownedBy: 'person' },
-    { match: { exact: 'cardroom.read' }, class: `${APCTX}CardRoomPlayerRead`, label: 'player read', plural: 'player reads', ownedBy: 'person' },
+    { match: { exact: 'cardroom.style' }, class: `${APCTX}CardRoomStyleRecord`, label: 'playing style', plural: 'playing styles', ownedBy: 'person', role: 'entity' },
+    { match: { exact: 'cardroom.read' }, class: `${APCTX}CardRoomPlayerRead`, label: 'player read', plural: 'player reads', ownedBy: 'person', role: 'entity' },
     {
         match: { exact: 'cardroom.note' }, class: `${APCTX}CardRoomCoachNote`,
-        label: 'coach note', plural: 'coach notes', ownedBy: 'person',
+        label: 'coach note', plural: 'coach notes', ownedBy: 'person', role: 'entity',
         properties: { 'entries[].by': `${APCTX}coachedBy` },
     },
-    { match: { exact: 'cardroom.client' }, class: `${APCTX}CardRoomCoachClient`, label: 'coaching client', plural: 'coaching clients', ownedBy: 'either' },
-    { match: { prefix: 'cardroom.hands:' }, class: `${APCTX}CardRoomHandRecord`, label: 'a day’s hands', plural: 'days of hands', ownedBy: 'person' },
-    { match: { exact: 'cardroom.prefs' }, class: `${APCTX}CardRoomPreferences`, label: 'card-room preferences', plural: 'card-room preferences', ownedBy: 'person' },
+    { match: { exact: 'cardroom.client' }, class: `${APCTX}CardRoomCoachClient`, label: 'coaching client', plural: 'coaching clients', ownedBy: 'either', role: 'entity' },
+    { match: { prefix: 'cardroom.hands:' }, class: `${APCTX}CardRoomHandRecord`, label: 'a day’s hands', plural: 'days of hands', ownedBy: 'person', role: 'entity' },
+    { match: { exact: 'cardroom.prefs' }, class: `${APCTX}CardRoomPreferences`, label: 'card-room preferences', plural: 'card-room preferences', ownedBy: 'person', role: 'entity' },
     // Who the person is as a player — ONE record across games (cr:PlayerProfile in the card-room ontology).
-    { match: { exact: 'cardroom.profile' }, class: `${APCTX}CardRoomPlayerProfile`, label: 'player profile', plural: 'player profiles', ownedBy: 'person' },
+    { match: { exact: 'cardroom.profile' }, class: `${APCTX}CardRoomPlayerProfile`, label: 'player profile', plural: 'player profiles', ownedBy: 'person', role: 'entity' },
     // A CLUB, kept by its own workspace agent (apctx:CardRoomClub…): the profile, the rule it meets by, and
     // the nights as they diverge from the rule. The roster is the organization's own membership records.
-    { match: { exact: 'cardroom.club.profile' }, class: `${APCTX}CardRoomClub`, label: 'club', plural: 'clubs', ownedBy: 'organization' },
-    { match: { exact: 'cardroom.club.schedule' }, class: `${APCTX}CardRoomClubSchedule`, label: 'club schedule', plural: 'club schedules', ownedBy: 'organization' },
-    { match: { exact: 'cardroom.club.nights' }, class: `${APCTX}CardRoomClubNights`, label: 'club nights', plural: 'club nights', ownedBy: 'organization' },
+    { match: { exact: 'cardroom.club.profile' }, class: `${APCTX}CardRoomClub`, label: 'club', plural: 'clubs', ownedBy: 'organization', role: 'entity' },
+    { match: { exact: 'cardroom.club.schedule' }, class: `${APCTX}CardRoomClubSchedule`, label: 'club schedule', plural: 'club schedules', ownedBy: 'organization', role: 'entity' },
+    { match: { exact: 'cardroom.club.nights' }, class: `${APCTX}CardRoomClubNights`, label: 'club nights', plural: 'club nights', ownedBy: 'organization', role: 'entity' },
     // A MISSION, kept by its own organization (apctx:CardRoomMission…): the presence a card room's map shows,
     // the steward's signed covenant, and the confidential contact — written in the registration ceremony.
-    { match: { exact: 'cardroom.mission.presence' }, class: `${APCTX}CardRoomMission`, label: 'mission presence', plural: 'mission presences', ownedBy: 'organization' },
-    { match: { exact: 'cardroom.mission.covenant' }, class: `${APCTX}CardRoomMissionCovenant`, label: 'mission covenant', plural: 'mission covenants', ownedBy: 'organization' },
-    { match: { exact: 'cardroom.mission.contact' }, class: `${APCTX}CardRoomMissionContact`, label: 'mission contact', plural: 'mission contacts', ownedBy: 'organization' },
+    { match: { exact: 'cardroom.mission.presence' }, class: `${APCTX}CardRoomMission`, label: 'mission presence', plural: 'mission presences', ownedBy: 'organization', role: 'entity' },
+    { match: { exact: 'cardroom.mission.covenant' }, class: `${APCTX}CardRoomMissionCovenant`, label: 'mission covenant', plural: 'mission covenants', ownedBy: 'organization', role: 'entity' },
+    { match: { exact: 'cardroom.mission.contact' }, class: `${APCTX}CardRoomMissionContact`, label: 'mission contact', plural: 'mission contacts', ownedBy: 'organization', role: 'entity' },
     // ONE CABINET PER GAME: hold'em's study records are the bare names above; every other game's carry the
     // family — canasta's here, the same classes, a different coach's grant.
     {
         match: { exact: 'cardroom.canasta.hand' }, class: `${APCTX}CardRoomHandRecord`,
-        label: 'canasta round record', plural: 'canasta round records', ownedBy: 'person',
+        label: 'canasta round record', plural: 'canasta round records', ownedBy: 'person', role: 'entity',
         properties: { hands: `${APCTX}handsRecorded` },
     },
-    { match: { exact: 'cardroom.canasta.style' }, class: `${APCTX}CardRoomStyleRecord`, label: 'canasta playing style', plural: 'canasta playing styles', ownedBy: 'person' },
-    { match: { exact: 'cardroom.canasta.read' }, class: `${APCTX}CardRoomPlayerRead`, label: 'canasta player read', plural: 'canasta player reads', ownedBy: 'person' },
+    { match: { exact: 'cardroom.canasta.style' }, class: `${APCTX}CardRoomStyleRecord`, label: 'canasta playing style', plural: 'canasta playing styles', ownedBy: 'person', role: 'entity' },
+    { match: { exact: 'cardroom.canasta.read' }, class: `${APCTX}CardRoomPlayerRead`, label: 'canasta player read', plural: 'canasta player reads', ownedBy: 'person', role: 'entity' },
     {
         match: { exact: 'cardroom.canasta.note' }, class: `${APCTX}CardRoomCoachNote`,
-        label: 'canasta coach note', plural: 'canasta coach notes', ownedBy: 'person',
+        label: 'canasta coach note', plural: 'canasta coach notes', ownedBy: 'person', role: 'entity',
         properties: { 'entries[].by': `${APCTX}coachedBy` },
     },
-    { match: { prefix: 'cardroom.canasta.hands:' }, class: `${APCTX}CardRoomHandRecord`, label: 'a day’s canasta rounds', plural: 'days of canasta rounds', ownedBy: 'person' },
+    { match: { prefix: 'cardroom.canasta.hands:' }, class: `${APCTX}CardRoomHandRecord`, label: 'a day’s canasta rounds', plural: 'days of canasta rounds', ownedBy: 'person', role: 'entity' },
     // ── Standing instructions (spec 394) — the owner's declared defaults, per room ──────────────────
     {
         match: { exact: 'standing.instructions' }, class: `${APCTX}StandingInstruction`,
-        label: 'standing instruction', plural: 'standing instructions', ownedBy: 'person',
+        label: 'standing instruction', plural: 'standing instructions', ownedBy: 'person', role: 'entity',
         properties: {
             'entries[].capability': `${APCTX}instructionCapability`,
             'entries[].arg': `${APCTX}instructionArgument`,
@@ -602,7 +606,7 @@ export const VAULT_RECORD_BINDINGS = [
     // ── Declared routines (spec 402 W3 · 323 W6) — the owner's routines as a record that travels ─────
     {
         match: { exact: 'routines.data' }, class: `${APCTX}DeclaredRoutine`,
-        label: 'declared routine', plural: 'declared routines', ownedBy: 'person',
+        label: 'declared routine', plural: 'declared routines', ownedBy: 'person', role: 'entity',
         properties: {
             'entries[].ask': `${APCTX}routineAsk`,
             'entries[].every': `${APCTX}routineEvery`,
@@ -613,13 +617,13 @@ export const VAULT_RECORD_BINDINGS = [
     // ── The person's preferences (spec 403 W2/W4) — nudges and how to answer ─────────────────────────
     {
         match: { exact: 'person.preferences' }, class: `${APCTX}PersonPreferences`,
-        label: 'preferences', plural: 'preferences', ownedBy: 'person',
+        label: 'preferences', plural: 'preferences', ownedBy: 'person', role: 'entity',
         properties: { 'notify.email': `${APCTX}nudgeByEmail`, 'answer.style': `${APCTX}answerStyle`, 'answer.language': `${APCTX}answerLanguage` },
     },
     // ── Remembered facts (spec 402 W1) — what the owner's agent knows about the owner ────────────────
     {
         match: { exact: 'memory.facts' }, class: `${APCTX}RememberedFact`,
-        label: 'remembered fact', plural: 'remembered facts', ownedBy: 'person',
+        label: 'remembered fact', plural: 'remembered facts', ownedBy: 'person', role: 'entity',
         properties: {
             'entries[].fact': `${APCTX}factWords`,
             'entries[].source': `${APCTX}factSource`,
@@ -633,8 +637,8 @@ export const VAULT_RECORD_BINDINGS = [
     // against. A rebuild is fine; this would be a bereavement. The Durable Object stays as the serving
     // projection, rebuilt from these records and never their only copy.
     {
-        match: { prefix: 'federation.projection-submission:' }, class: `${APEST}ProjectionSubmission`,
-        label: 'projection submission', plural: 'projection submissions', ownedBy: 'either',
+        match: { prefix: 'federation.projection-submission:' }, class: `${APEST}HeldProjectionSubmission`, // ⊑ apest:ProjectionSubmission, ap:HeldSecret (ONT-2)
+        label: 'projection submission', plural: 'projection submissions', ownedBy: 'either', role: 'secret', // carries the leaf's BLIND
         properties: {
             set: `${APEST}projectionSet`,
             digest: `${APEST}vouchedDigest`,
@@ -655,9 +659,11 @@ export const VAULT_RECORD_BINDINGS = [
     // holds only its digest; lose the device key and no presentation can ever be made; lose the secret and every
     // pairwise account at every verifier is unreachable. Bereavements, all three — vault records, never a cache.
     // None of these is read by any gate: the mandate is judged per signature by the presentation release (ADR-0041).
+    // The credential, the device key and the holder secret are `secret` (REM-2): held, used by the release under its
+    // own grant, and never opened by a question. The mandate, the issuer's records and the door's evidence are things.
     {
-        match: { prefix: 'credential.anonymous:' }, class: `${APPC}AnonymousCredential`,
-        label: 'anonymous credential', plural: 'anonymous credentials', ownedBy: 'person',
+        match: { prefix: 'credential.anonymous:' }, class: `${APPC}HeldAnonymousCredential`, // ⊑ appc:AnonymousCredential, ap:HeldSecret (ONT-2)
+        label: 'anonymous credential', plural: 'anonymous credentials', ownedBy: 'person', role: 'secret', // the credential itself, claim values included
         properties: {
             issuerKeyId: `${APPC}facetKeyId`,
             digest: `${APPC}credentialDigest`,
@@ -667,23 +673,24 @@ export const VAULT_RECORD_BINDINGS = [
         },
     },
     {
-        match: { prefix: 'credential.device-key:' }, class: `${APPC}DeviceKey`,
-        label: 'device key', plural: 'device keys', ownedBy: 'person',
+        match: { prefix: 'credential.device-key:' }, class: `${APPC}DeviceKeyMaterial`, // ⊑ appc:DeviceKey, ap:HeldSecret (ONT-2)
+        label: 'device key', plural: 'device keys', ownedBy: 'person', role: 'secret', // key material in a deployment that predates the managed key
         properties: { thumbprint: `${APPC}deviceKeyThumbprint`, createdAt: `${PROV}generatedAtTime` },
     },
-    { match: { prefix: 'credential.holder-secret:' }, class: `${APPC}PairwiseAccount`, label: 'holder secret (pairwise accounts derive from it)', plural: 'holder secrets', ownedBy: 'person' },
+    // ONT-2: the SECRET (appc:HolderSecret ⊑ ap:HeldSecret), never the PairwiseAccount derived from it — the classes are disjoint.
+    { match: { prefix: 'credential.holder-secret:' }, class: `${APPC}HolderSecret`, label: 'holder secret (pairwise accounts derive from it)', plural: 'holder secrets', ownedBy: 'person', role: 'secret' },
     // Her standing `credential.present` wire — a delegation, kept under its own family because what it bounds (venues,
     // programs, facets) is this module's vocabulary. The release judges it per signature (ADR-0041); no gate reads it.
     {
         match: { prefix: 'credential.presentation-mandate:' }, class: `${APPC}PresentationMandate`,
-        label: 'presentation mandate', plural: 'presentation mandates', ownedBy: 'person',
+        label: 'presentation mandate', plural: 'presentation mandates', ownedBy: 'person', role: 'entity',
         properties: { audiences: `${APPC}mandateAudience`, predicateDigests: `${APPC}mandatePredicateDigest`, issuerKeyIds: `${APPC}mandateIssuerKeyId`, maxPresentations: `${APPC}maxPresentations`, issuedAt: `${PROV}generatedAtTime` },
     },
     // THE ISSUER'S records: what the ORGANIZATION issued (spec 444) — one record per issuance, so it can revoke what it
     // issued; the member it went to, never the claim values (those are the holder's).
     {
         match: { prefix: 'credential.issued:' }, class: `${APPC}Issuance`,
-        label: 'issued credential', plural: 'issued credentials', ownedBy: 'organization',
+        label: 'issued credential', plural: 'issued credentials', ownedBy: 'organization', role: 'entity',
         properties: {
             digest: `${APPC}issuedDigest`,
             issuerKeyId: `${APPC}facetKeyId`,
@@ -698,7 +705,7 @@ export const VAULT_RECORD_BINDINGS = [
     // to revoke) — the live set's leaves are `federation.projection-submission:` rows in the `live-credential` set.
     {
         match: { prefix: 'credential.issuer-facet:' }, class: `${APPC}IssuerKeyFacet`,
-        label: 'issuer key facet', plural: 'issuer key facets', ownedBy: 'organization',
+        label: 'issuer key facet', plural: 'issuer key facets', ownedBy: 'organization', role: 'entity',
         properties: {
             keyId: `${APPC}facetKeyId`,
             thumbprint: `${APPC}facetPublicKeyThumbprint`,
@@ -711,7 +718,7 @@ export const VAULT_RECORD_BINDINGS = [
     // THE DOOR'S record of a predicate held — beside the admission decision; the digests, never the bundle.
     {
         match: { prefix: 'door.credential:' }, class: `${APPC}PredicateAdmissionEvidence`,
-        label: 'predicate admission', plural: 'predicate admissions', ownedBy: 'either',
+        label: 'predicate admission', plural: 'predicate admissions', ownedBy: 'either', role: 'entity',
         properties: {
             issuerKeyId: `${APPC}facetKeyId`,
             predicateDigest: `${APPC}evidencePredicateDigest`,
@@ -730,7 +737,7 @@ export const VAULT_RECORD_BINDINGS = [
     // verifier (ADR-0041): what the agent may DO at a door is a mandate, judged per step.
     {
         match: { prefix: 'identity.client-key-binding:' }, class: `${AP}ClientKeyBinding`,
-        label: 'client key binding', plural: 'client key bindings', ownedBy: 'either',
+        label: 'client key binding', plural: 'client key bindings', ownedBy: 'either', role: 'entity',
         properties: {
             clientId: `${AP}clientId`,
             jwkThumbprint: `${AP}jwkThumbprint`,
@@ -741,10 +748,11 @@ export const VAULT_RECORD_BINDINGS = [
         },
     },
     // The secret her pairwise subjects derive from — one record, per person; a rotation is a new `sub` everywhere.
-    { match: { exact: 'identity.pairwise-secret' }, class: `${AP}PairwiseSubject`, label: 'pairwise secret (company subjects derive from it)', plural: 'pairwise secrets', ownedBy: 'person' },
+    // ONT-2: ap:PairwiseSecret ⊑ ap:HeldSecret, disjoint from the ap:PairwiseSubject derived from it.
+    { match: { exact: 'identity.pairwise-secret' }, class: `${AP}PairwiseSecret`, label: 'pairwise secret (company subjects derive from it)', plural: 'pairwise secrets', ownedBy: 'person', role: 'secret' },
     {
         match: { prefix: 'identity.external-account-link:' }, class: `${AP}ExternalAccountLink`,
-        label: 'account at a company', plural: 'accounts at companies', ownedBy: 'person',
+        label: 'account at a company', plural: 'accounts at companies', ownedBy: 'person', role: 'entity',
         properties: {
             issuer: `${AP}pairwiseIssuer`,
             pairwiseSubjectDigest: `${AP}pairwiseSubjectDigest`,
@@ -778,16 +786,35 @@ export function askableRecordKinds() {
     const seen = new Set();
     const out = [];
     for (const b of VAULT_RECORD_BINDINGS) {
-        // An index is not a thing to ask about — see `VaultRecordRole`.
-        if ((b.role ?? 'entity') !== 'entity' || seen.has(b.class))
+        // An index is not a thing to ask about, and a secret is never told — see `VaultRecordRole`.
+        if (b.role !== 'entity' || seen.has(b.class))
             continue;
         seen.add(b.class);
         out.push({ label: b.label, plural: b.plural, class: b.class });
     }
     return out;
 }
-/** Every record type bound to this class — what a query over a kind must actually read. */
+/** Every record type bound to this class THAT A QUESTION MAY READ — what a query over a kind must actually read.
+ *  A class is often bound twice (the thing and its index): only the `entity` rows. A secret has its own class
+ *  under `ap:HeldSecret` (ONT-2), so it never shares one with an entity. */
 export function recordTypesForClass(classIri) {
-    return VAULT_RECORD_BINDINGS.filter((b) => b.class === classIri);
+    return VAULT_RECORD_BINDINGS.filter((b) => b.class === classIri && b.role === 'entity');
+}
+/** Is this record key one that is held and never told (`role: 'secret'`)? The check every reader that hands a
+ *  record's content — or its key — to a model makes at the point of use (REM-2). */
+export function isSecretRecordType(recordType) {
+    return bindingForRecordType(recordType)?.role === 'secret';
+}
+/** Rows that carry no decision about what they are FOR — none, in a table that compiles. For a gate
+ *  (`check:ontology-bindings`) and the unit test: a row built outside the compiler's sight (a cast, a JSON import,
+ *  a JS caller) must not reach the table as askable-by-default. */
+export function bindingsWithoutRole(rows = VAULT_RECORD_BINDINGS) {
+    return rows
+        .filter((b) => !VAULT_RECORD_ROLES.includes(b.role))
+        .map((b) => b.match?.exact ?? b.match?.prefix ?? '(no key)');
+}
+/** The record kinds classified secret — for a gate, a doc, or a grant builder that must leave them out. */
+export function secretRecordKinds() {
+    return VAULT_RECORD_BINDINGS.filter((b) => b.role === 'secret');
 }
 //# sourceMappingURL=vault-records.js.map