@agenticprimitives/ontology 1.0.0-alpha.46 → 1.0.0-alpha.48

package/tbox/core.ttl

@@ -16,7 +16,7 @@
 
 ap: a owl:Ontology ;
     rdfs:label "Agentic Primitives — core ontology" ;
-    owl:versionInfo "0.2.1" .
+    owl:versionInfo "0.4.0" .
 
 # ─── Classes ──────────────────────────────────────────────────────────
 
@@ -64,6 +64,13 @@ ap:ApplicationAgent a owl:Class ;
     rdfs:label "Application Agent" ;
     rdfs:comment "The prov:SoftwareAgent ROOT (wire value 'service' in AgentType / atl:agentKind — ADR-0046 amendment 2026-08-29). Closed root; derived types subclass it. 'Software agent' is the class; 'service' is what most of ours DO, so ServiceAgent is a derived type under this root, not the root itself." .
 
+# ONT-8 (2026-11-10 review): every Smart Agent is EXACTLY one of a Person, an Organization or a Service (ADR-0046) — said
+# in comments and enforced by a product-repo doctor rule (`demo-person-org-distinct`), but the T-box admitted an agent
+# typed as two roots. The three roots are pairwise disjoint; every derived type inherits it (a team is never a person,
+# a treasury never an organization — the same fact appr:ValueHolder states for value).
+[] a owl:AllDisjointClasses ;
+    owl:members ( ap:PersonAgent ap:OrganizationAgent ap:ApplicationAgent ) .
+
 ap:ServiceAgent a owl:Class ;
     rdfs:subClassOf ap:ApplicationAgent ;
     rdfs:label "Service Agent" ;
@@ -190,7 +197,7 @@ ap:agentType a owl:ObjectProperty ;
     rdfs:label "agentType" ;
     rdfs:domain ap:Agent ;
     rdfs:range skos:Concept ;
-    rdfs:comment "The DERIVED agent type (ap:agentTypeScheme, cbox — 7 values: person org team service workspace treasury registry). On-chain: atl:agentType on the SA subject (AgentProfileResolver, written by the SA itself, survives name changes). Distinct from ap:agentKind (the 3-value root scheme on the NAME node). The projection term external directory entries (ARD, A2A extension) carry. rootClassFor: team→org; service|workspace|treasury|registry→service. A suffix is checked AGAINST this record; it never overrides it." .
+    rdfs:comment "The DERIVED agent type (ap:agentTypeScheme, cbox — 10 values: person org team service workspace treasury registry church circle household). On-chain: atl:agentType on the SA subject (AgentProfileResolver, written by the SA itself, survives name changes). Distinct from ap:agentKind (the 3-value root scheme on the NAME node). The projection term external directory entries (ARD, A2A extension) carry. rootClassFor: team|church|circle|household→org; service|workspace|treasury|registry→service. A suffix is checked AGAINST this record; it never overrides it." .
 
 ap:serviceRole a owl:DatatypeProperty ;
     rdfs:label "serviceRole" ;
@@ -264,6 +271,15 @@ ap:revokes a owl:ObjectProperty ;
     rdfs:label "revokes" ;
     rdfs:comment "A two-sided (or labelled-unilateral) revocation of a relationship credential, written to both vaults; the departing party keeps her copy and the revocation, never the organization's records." .
 
+# The OVERSIGHT DELEGATION itself — what makes a wire evidence of stewardship (audit 2026-11-10 RUNC-1, spec 445).
+# Until this class existed "is this a stewardship wire" was answered by what the wire was NOT (no record scope), and a
+# payment mandate or a message grant from the same organization is also not that. Named so the recogniser binds to
+# what the wire IS: `OVERSIGHT_DELEGATION` in `src/stewardship.ts` lists the caveat kinds, and nothing else passes.
+ap:OversightDelegation a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "OversightDelegation" ;
+    rdfs:comment "The delegation an organization-class or service-class agent signs to the person who stewards it (spec 246): time-boxed (the timestamp caveat is REQUIRED — a wire with no time box is not one; src/stewardship.ts, ONT-7), moving no value, and pinned to the GOVERNANCE contracts of its estate (the relationship registry and the name registry) — and carrying no other caveat. Its digest is ap:stewardshipDelegation. What it is NOT: a payment mandate (targets an asset, names methods), a message grant (targets an agent, names methods), a data grant (carries a vault-record scope), or any delegation that merely comes from the organization — being delegated SOMETHING by an organization is not stewarding it. A wire with a caveat this class does not name is not one." .
+
 ap:steward a owl:ObjectProperty ;
     rdfs:domain ap:Stewardship ; rdfs:range ap:PersonAgent ;
     rdfs:label "steward" ;
@@ -277,6 +293,14 @@ ap:stewardshipDelegation a owl:DatatypeProperty ;
     rdfs:label "stewardshipDelegation" ;
     rdfs:comment "The digest of the oversight delegation that evidences the stewardship (spec 246) — the record, not the authority." .
 
+# HELD AND NEVER TOLD (audit 2026-11-10 REM-2, spec 445). The vault holds some records for code to USE — a seed
+# identifiers derive from, key material, a blind, a credential made to be proved about — and a question about the
+# vault is answered by a model. Without a class for them they were ordinary things, and a question could open them.
+ap:HeldSecret a owl:Class ;
+    rdfs:subClassOf prov:Entity ;
+    rdfs:label "HeldSecret" ;
+    rdfs:comment "A vault record whose content is material to be USED and never TOLD: a secret other identifiers derive from, key material, a commitment's blind, a credential whose point is that only predicates about it are disclosed. The role a vault-record binding gives such a record (`role: 'secret'`, src/vault-records.ts): not listed to a question, not opened by one, not passed to an answer composer or a model provider — for its owner as much as anyone. What it is NOT: a statement about who may read the record (the delegation decides that, per record, ADR-0041), a claim that the record is encrypted differently, or a reason to keep it out of the vault (losing one is a bereavement, ADR-0055)." .
+
 ap:CustodyMember a owl:Class ;
     rdfs:label "CustodyMember" ;
     rdfs:comment """One opaque, public, chain-reproducible token standing for the fact that a credential
@@ -302,7 +326,10 @@ ap:CustodyMember a owl:Class ;
 ap:primaryPayee a owl:ObjectProperty ;
     rdfs:label "primaryPayee" ;
     rdfs:domain ap:Agent ;
-    rdfs:range ap:Agent ;
+    # ONT-4 (2026-11-10 review): the range is a TREASURY — assets live only in treasuries (appr:ValueHolder ≡
+    # ap:Treasury, spec 373 / 420). It read ap:Agent, so a resolver built from the T-box alone could land on a
+    # person (the 2026-09-08 `carol.me` payment). The domain stays any agent: whose preference it is.
+    rdfs:range ap:Treasury ;
     rdfs:comment """The agent this one wants to be PAID INTO — "when someone sends me money, it goes here".
       An agent may hold several treasuries; only its owner knows which is the one to receive, and until
       this existed a payer had to guess or be asked, which put the choice on the wrong person entirely.
@@ -320,7 +347,10 @@ ap:primaryPayee a owl:ObjectProperty ;
 ap:primaryPayer a owl:ObjectProperty ;
     rdfs:label "primaryPayer" ;
     rdfs:domain ap:Agent ;
-    rdfs:range ap:Agent ;
+    # ONT-4 (2026-11-10 review): the range is a TREASURY — assets live only in treasuries (appr:ValueHolder ≡
+    # ap:Treasury, spec 373 / 420). It read ap:Agent, so a resolver built from the T-box alone could land on a
+    # person (the 2026-09-08 `carol.me` payment). The domain stays any agent: whose preference it is.
+    rdfs:range ap:Treasury ;
     rdfs:comment """The account this agent USUALLY PAYS FROM — "when I send money, take it from here".
 
       The mirror of ap:primaryPayee, and the half that was missing. The ontology could say which of

package/tbox/estate.ttl

@@ -29,7 +29,7 @@
 
 apest: a owl:Ontology ;
   rdfs:label "Agentic Primitives — estate projection" ;
-  owl:versionInfo "0.1.0" ;
+  owl:versionInfo "0.2.0" ;
   rdfs:comment "What an estate vouches for on neutral ground, and the opening it keeps for the holder. Spec 410 §4." .
 
 apest:ProjectionSubmission a owl:Class ;
@@ -47,6 +47,12 @@ apest:vouchedDigest a owl:DatatypeProperty ;
   rdfs:label "vouched digest" ;
   rdfs:comment "The 32-byte thing vouched for: the delegation hash in the live-grant set, the relationship credential digest in the membership set. Named in the estate's record and never on public ground — the tree carries only its blinded commitment." .
 
+# ONT-2 (2026-11-10 review): the record that carries the blind is a held secret, in its own class.
+apest:HeldProjectionSubmission a owl:Class ;
+  rdfs:subClassOf apest:ProjectionSubmission , ap:HeldSecret ;
+  rdfs:label "HeldProjectionSubmission" ;
+  rdfs:comment "THE ESTATE'S HELD COPY of a submission, WITH ITS BLIND (`federation.projection-submission:`): the opening that, with the digest, reproduces the leaf's commitment. Held and never told — the blind is the one value here that exists nowhere else, and a question that opened the record would hand it to a model. What it is NOT: the commitment (keccak256(digest ‖ blind), public on neutral ground), the projection's roots, or a statement about who may read the record (spec 277)." .
+
 apest:leafBlind a owl:DatatypeProperty ;
   rdfs:domain apest:ProjectionSubmission ; rdfs:range xsd:string ;
   rdfs:label "leaf blind" ;

package/tbox/geo.ttl

@@ -5,10 +5,16 @@
 # skill↔geo mapping.
 
 @prefix apg:  <https://agenticprimitives.dev/ns/geo#> .
+@prefix owl:  <http://www.w3.org/2002/07/owl#> .
 @prefix ap:   <https://agenticprimitives.dev/ns/core#> .
 @prefix rdf:  <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
 @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> .
 
+# ONT-13 (2026-11-10 review): this module had no ontology header, so its manifest row carried versionInfo null.
+apg: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — geo substrate (spec 251)" ;
+    owl:versionInfo "0.1.0" .
+
 apg:GeoFeature a rdfs:Class ;
     rdfs:label "GeoFeature" ;
     rdfs:comment "A versioned, PUBLIC, generic geographic feature. Anchored on chain by GeoFeatureRegistry (geometryHash + coverage/source roots + coarse bbox; exact geometry off chain via metadataURI). Neutral public geography only." .

package/tbox/household.ttl

@@ -31,6 +31,7 @@
 @prefix prov:  <http://www.w3.org/ns/prov#> .
 
 aphh: a owl:Ontology ;
+    owl:versionInfo "0.2.0" ;
     rdfs:label "Agentic Primitives — Household" ;
     rdfs:comment "The people someone lives with, as they record it: a private-tier body whose members may be agents, with roles and family relations that let a resolver understand 'my daughter' without a directory search (spec 363 W4)." .
 
@@ -43,8 +44,9 @@ aphh:Household a owl:Class ;
 
       An ORGANIZATION in the PROV sense (a social entity with members), NOT a new agent class and not a
       new kind of Smart Agent: the trichotomy stands (ADR-0046). It may be coordinated by an agent — a
-      `.circle` for a family that wants a shared inbox, an `.org` if it starts holding money — and it may
-      have none at all, which is the ordinary case and must stay free.
+      `.circle` for a family that wants a shared inbox, or the family's own ap:HouseholdAgent (spec 368);
+      money it holds lives in a treasury that agent charters, never on the agent itself (spec 373) — and
+      it may have none at all, which is the ordinary case and must stay free.
 
       It is a RECORD ITS MEMBERS KEEP, not a global fact. Each member's vault holds their own household
       record; two records may disagree, and the resolver always says whose it read.""" .
@@ -129,7 +131,7 @@ aphh:kinRelation a owl:ObjectProperty ;
 
 aphh:householdPayee a owl:ObjectProperty ;
     owl:propertyChainAxiom ( aphh:householdMember ap:primaryPayee ) ;
-    rdfs:domain aphh:Household ; rdfs:range ap:Agent ;
+    rdfs:domain aphh:Household ; rdfs:range ap:Treasury ;   # ONT-4: the chain ends at an account (it read ap:Agent)
     rdfs:label "householdPayee" ;
     rdfs:comment """The accounts a household's members want paid — a member, then the account that member
       marked (ap:primaryPayee).

package/tbox/identity.ttl

@@ -59,7 +59,7 @@ aporg:memberOf a owl:ObjectProperty ;
     rdfs:label "memberOf" ;
     rdfs:domain ap:Agent ;
     rdfs:range ap:OrganizationAgent ;
-    rdfs:comment "An Agent is a member of an Organization Agent. Membership is informational; authority lives in custody/relationships." .
+    rdfs:comment "An Agent is a member of an Organization Agent. Membership is informational and authorizes nothing: authority to act for the organization is a delegation (ADR-0041) — never this edge, and never custody (see ap:CustodyMember). DERIVED and private-by-default — the governing definition is in tbox/org.ttl (true iff an active, valid, disclosable aporg:OrganizationMembership exists; never asserted globally, never projected to the public knowledge base, ADR-0040)." .
 
 # ─── At the company's door (spec 442 §11) ─────────────────────────────────────────────────────────
 # Four terms for what a person's agent IS at an external door (OAuth, HTTP-signature, checkout) and what it
@@ -78,6 +78,17 @@ ap:PairwiseSubject a owl:Class ;
     rdfs:label "PairwiseSubject" ;
     rdfs:comment "The opaque identifier a person is known by at ONE company (an OAuth issuer): HKDF over a 32-byte secret in the person's vault, salted by the issuer, so it is stable there, different everywhere else, and non-reversible to the Smart Agent, to any name or to any other company's subject without the secret (spec 442 §4; derivePairwiseSubject). It is NOT an alias of the SA, NOT a name and NOT linkable across issuers — the vocabulary carries no property from it to the person, on purpose (the same rule as appc:PairwiseAccount). Rotating the secret produces a new subject everywhere, which is the point of having one." .
 
+# ONT-2 (2026-11-10 review): the SECRET a pairwise subject derives from has its own class. It was bound to
+# ap:PairwiseSubject — the class of the value a company is SHOWN — so a reader reasoning from the class had nothing
+# telling it the record is held and never told.
+ap:PairwiseSecret a owl:Class ;
+    rdfs:subClassOf ap:HeldSecret ;
+    owl:disjointWith ap:PairwiseSubject ;
+    rdfs:label "PairwiseSecret" ;
+    rdfs:comment "The person's 32-byte secret every pairwise subject is derived from (HKDF, salted by the issuer; spec 442 §4; derivePairwiseSubject) — one per person, held in her own vault (`identity.pairwise-secret`). Read by its exact key by the derivation under its own grant; never listed to a question, never opened by one, never handed to a model. What it is NOT: a pairwise subject (ap:PairwiseSubject is the derived, disclosed-to-one-company value, and the two classes are disjoint), an identifier of any kind, or a statement about who may read the record (the delegation decides that, ADR-0041). Rotating it is a new subject everywhere." .
+
+ap:HeldSecret owl:disjointWith ap:PairwiseSubject .
+
 ap:ExternalOperation a owl:Class ;
     rdfs:subClassOf prov:Entity ;
     rdfs:label "ExternalOperation" ;

package/tbox/inference.ttl

@@ -23,7 +23,7 @@
 
 apinf: a owl:Ontology ;
   rdfs:label "Agentic Primitives — inference (the model gateway's records)" ;
-  owl:versionInfo "0.2.0" ;
+  owl:versionInfo "0.3.0" ;
   rdfs:seeAlso <https://github.com/agentictrustlabs/ap-town/blob/master/specs/434-ap-model-gateway-and-the-town-pulse.md> ;
   rdfs:comment "Profiles, the model catalog, entitlements, inference receipts, policy changes and the estate heartbeat. Records of a town service; nothing here grants." .
 
@@ -52,7 +52,12 @@ apinf:PolicyChange a owl:Class ;
 # ─── The receipt ─────────────────────────────────────────────────────────────────────────────────────────────────────
 
 apinf:InferenceReceipt a owl:Class ;
-  rdfs:subClassOf apix:Receipt ;
+  # ONT-5 (2026-11-10 review): it IS a receipt — evidence that one model call occurred (spec 434: "every call leaves a
+  # receipt"), never that it was authorized, which is apix:Receipt's own rule. Seated under ExecutionReceipt (work
+  # started, progressed or completed: one attempt ran and answered, failed or was refused) so it satisfies
+  # apix:ReceiptShape's "use a TYPED receipt" — a bare apix:Receipt subclass says nothing about what it proves.
+  # Like every receipt it must name what it attests (apix:attests — the call it records).
+  rdfs:subClassOf apix:ExecutionReceipt ;
   rdfs:label "InferenceReceipt" ;
   rdfs:comment "One attempt at one model under one profile version for one principal: usage, cost, latency, outcome, the policy decision that admitted it, and — when it was a declared fallback — the receipt of the attempt it replaced. Evidence that a call occurred and what it cost; never that it was authorized. No prompt or response text." .
 

package/tbox/naming.ttl

@@ -30,7 +30,7 @@
 
 <https://agenticprimitives.dev/ns/naming> a owl:Ontology ;
     rdfs:label "Agentic Primitives — typed agent naming (spec 346)" ;
-    owl:versionInfo "0.1.0" ;
+    owl:versionInfo "0.1.1" ;
     rdfs:comment "Typed suffixes, contextual name issuance, contextual references. A name is a facet (ADR-0006/ADR-0010): decorative, resolvable, replaceable — never the identifier and never authority." .
 
 # ─── The typed suffix ────────────────────────────────────────────────────────
@@ -39,7 +39,7 @@ apnam:tld a owl:DatatypeProperty ;
     rdfs:domain apnam:NameFacet ;
     rdfs:range xsd:string ;
     rdfs:label "tld" ;
-    rdfs:comment "The canonical suffix; names the derived type — derivedTypeForTld. NEVER authority. Values are the prefLabels of apnam:tldScheme (cbox): me org team svc workspace treasury registry; 'ws' is an alias of 'workspace', never stored. Legacy roots (.agent, .impact) carry no tld and are exempt from apnam:TypedAgentNameShape." .
+    rdfs:comment "The canonical suffix; names the derived type — derivedTypeForTld. NEVER authority. Values are the prefLabels of apnam:tldScheme (cbox): me org team svc workspace treasury registry church circle; 'ws' is an alias of 'workspace', never stored. The only remaining untyped legacy root (.agent) carries no tld and is exempt from apnam:TypedAgentNameShape." .
 
 apnam:namesDerivedType a owl:ObjectProperty ;
     rdfs:domain skos:Concept ;

package/tbox/payload.ttl

@@ -7,17 +7,20 @@
 # the caveat does not name is refused — an undeclared payload is not within it.
 #
 # THESE ARE CLASSES OF INFORMATION, NOT OF VALUES. `apval:EmailAddress` says how an argument is READ ("is this
-# well-formed?"); `appay:ContactEmail` says what it DISCLOSES when it leaves ("someone's address is now in the
+# well-formed?"); `apload:ContactEmail` says what it DISCLOSES when it leaves ("someone's address is now in the
 # message"). One value can carry several: a free-text body may carry an email address the person typed. The
 # declaration is the ADAPTER AUTHOR's claim about the argument's kind, never an inspection of its content — a
 # classifier reading bodies for phone numbers is exactly the heuristic this vocabulary exists to replace.
 #
-# The one class every free-text argument carries is appay:FreeText: the person's own words, which may carry
+# The one class every free-text argument carries is apload:FreeText: the person's own words, which may carry
 # anything. A mandate that permits FreeText permits what the person chose to write; a mandate that does not
 # refuses a body the planner composed. That is the honest floor, and it is why "text" arguments are declared
 # rather than left undeclared (undeclared = denied under any caveat).
 
-@prefix appay: <https://agenticprimitives.dev/ns/payload#> .
+# ONT-10 (2026-11-10 review): this module's prefix was `appay:`, which every other file binds to …/ns/payment#; it is
+# `apload:` now so one prefix names one namespace repo-wide. IRIs are UNCHANGED. The compact ids src/payload-classes.ts
+# publishes (`appay:FreeText`, …) are a wire format carried by tool tables and caveats and are NOT renamed here.
+@prefix apload: <https://agenticprimitives.dev/ns/payload#> .
 @prefix apval: <https://agenticprimitives.dev/ns/value#> .
 @prefix ap:    <https://agenticprimitives.dev/ns/core#> .
 @prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
@@ -25,75 +28,76 @@
 @prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
 @prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
 
-appay: a owl:Ontology ;
+apload: a owl:Ontology ;
+    owl:versionInfo "0.1.1" ;
     rdfs:label "Agentic Primitives — Payload classes (what a write carries)" ;
     rdfs:comment "The kinds of information an act may carry out of the estate: declared per argument by a tool's adapter, permitted by a mandate's payload-classes caveat, compared by the verifier (spec 410 §7). Classes of DISCLOSURE, not of value syntax (apval:)." .
 
-appay:PayloadClass a owl:Class ;
+apload:PayloadClass a owl:Class ;
     rdfs:label "PayloadClass" ;
     rdfs:comment "A kind of information a write may carry. Every payload class is a subclass; a caveat names subclasses, never this root (naming the root would permit everything, which is the absence of a caveat said twice)." .
 
-appay:FreeText a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:FreeText a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "FreeText" ;
     rdfs:comment "The person's own words, or a body composed on their behalf: may carry anything. The floor every text argument declares. A mandate that does not permit it refuses composed bodies." .
 
-appay:CredentialClaims a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:CredentialClaims a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "CredentialClaims" ;
     rdfs:comment "Claim values an organization VOUCHES FOR leave with the write, inside a credential it issues to a member (spec 444) — an age, a membership flag. Attributes about a person, written into a credential the person then holds; a mandate that permits only MembershipTerms does not permit them." .
 
-appay:ContactEmail a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:ContactEmail a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "ContactEmail" ;
     rdfs:comment "Someone's email address leaves with the write (an invitation carrying it; a message body that names one)." .
 
-appay:ContactPhone a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:ContactPhone a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "ContactPhone" ;
     rdfs:comment "Someone's phone number leaves with the write." .
 
-appay:PostalAddress a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:PostalAddress a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "PostalAddress" ;
     rdfs:comment "Where someone lives or receives mail leaves with the write." .
 
-appay:EventDetails a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:EventDetails a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "EventDetails" ;
     rdfs:comment "When and where a gathering happens, and its title — what an invitation or a calendar entry carries." .
 
-appay:GivingHistory a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:GivingHistory a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "GivingHistory" ;
     rdfs:comment "What someone has given, to whom, when — a treasury's or a person's giving records." .
 
-appay:Money a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:Money a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "Money" ;
     rdfs:comment "Value moves with the write: an amount of an asset. The AMOUNT is bounded by the spend policy and the value caveat; this class says only that the write is a transfer, so a payload caveat that omits it refuses a payment outright." .
 
-appay:File a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:File a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "File" ;
     rdfs:comment "A document or attachment leaves with the write, whatever it contains — the file's own classes are not inspected." .
 
-appay:MembershipTerms a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:MembershipTerms a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "MembershipTerms" ;
     rdfs:comment "The terms of a membership or a household relation (a role, a kinship word) leave with the write." .
 
-appay:PersonalPreference a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:PersonalPreference a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "PersonalPreference" ;
     rdfs:comment "Something the person wants remembered about how they are answered, what they call things, when their routines run — written into their own agent's records." .
 
-appay:Instruction a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:Instruction a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "Instruction" ;
     rdfs:comment "A standing instruction or a routine's rule: words that will shape future acts, written into the agent's own records." .
 
-appay:CodeChange a owl:Class ;
-    rdfs:subClassOf appay:PayloadClass ;
+apload:CodeChange a owl:Class ;
+    rdfs:subClassOf apload:PayloadClass ;
     rdfs:label "CodeChange" ;
     rdfs:comment "Source files or a pull request leave with the write — a build artifact, a PR body." .

package/tbox/payment.ttl

@@ -14,7 +14,7 @@
 
 appay: a owl:Ontology ;
     rdfs:label "Agentic Primitives — payment ontology" ;
-    owl:versionInfo "0.1.0" ;
+    owl:versionInfo "0.2.0" ;
     rdfs:comment "Layer 9b of the spine. PaymentMandate + ContextBinding + MandateConstraints + Mode discrimination + PaymentReceipt." .
 
 # ─── Core classes ─────────────────────────────────────────────────────
@@ -36,7 +36,7 @@ appay:ClosedPaymentMandate a owl:Class ;
 appay:PaymentReceipt a owl:Class ;
     rdfs:subClassOf apvc:VerifiableCredential ;
     rdfs:label "PaymentReceipt" ;
-    rdfs:comment "Immutable VC issued by rail executor on successful redemption. Asserted to AttestationRegistry; PMT-INV-11: no revoke entrypoint." .
+    rdfs:comment "Immutable VC issued by rail executor on successful redemption. Asserted to AttestationRegistry; PMT-INV-11: no revoke entrypoint. What it is NOT (ONT-6, 2026-11-10 review): the record a payment leaves with both parties — that is apix:PaymentReceipt (`payment.receipt:*`), the one class a payment transition establishes and goal regression reads. Same English word, two artifacts: this one is the rail's credential." .
 
 appay:MandateConstraints a owl:Class ;
     rdfs:label "MandateConstraints" ;
@@ -52,15 +52,19 @@ appay:PaymentRail a owl:Class ;
 
 # ─── Properties ───────────────────────────────────────────────────────
 
+# ONT-4 (2026-11-10 review): a mandate names the ACCOUNTS — the treasury funds leave and the treasury they reach —
+# never their owners. The owner who signs is appay:granter. Ranges read ap:Agent until 2026-11-10.
 appay:payer a owl:ObjectProperty ;
     rdfs:domain appay:PaymentMandate ;
-    rdfs:range ap:Agent ;
-    rdfs:label "payer" .
+    rdfs:range ap:Treasury ;
+    rdfs:label "payer" ;
+    rdfs:comment "The treasury the funds leave (spec 373: value moves between treasuries; an organization or person pays from a treasury it charters). Not the person or organization that owns it — that party signs, as appay:granter. A fact the mandate states, never authority: the signature is." .
 
 appay:payee a owl:ObjectProperty ;
     rdfs:domain appay:PaymentMandate ;
-    rdfs:range ap:Agent ;
-    rdfs:label "payee" .
+    rdfs:range ap:Treasury ;
+    rdfs:label "payee" ;
+    rdfs:comment "The treasury the funds reach — a person or organization is who money is FOR, a treasury is where it GOES (spec 373; PARTY_ROLES treasury.payment.execute/payee). Pinned when the mandate is signed, never chosen after." .
 
 appay:granter a owl:ObjectProperty ;
     rdfs:domain appay:PaymentMandate ;

package/tbox/privacy-credential.ttl

@@ -40,7 +40,7 @@
 
 appc: a owl:Ontology ;
   rdfs:label "Agentic Primitives — anonymous credentials" ;
-  owl:versionInfo "0.1.0" ;
+  owl:versionInfo "0.2.0" ;
   rdfs:comment "Issuer-key facets, holder-bound credentials, proof requests and predicate programs, zero-knowledge presentations with their nullifiers and status, the issuer's live-credential row, the presentation mandate, and the predicate as admission evidence. Specs 304 / 305 / 442 §7.2 / 443 W5." .
 
 # ═══ The issuer side ══════════════════════════════════════════════════════════════════════════════
@@ -179,6 +179,26 @@ appc:deviceKeyThumbprint a owl:DatatypeProperty ;
   rdfs:domain appc:DeviceKey ; rdfs:range xsd:string ;
   rdfs:label "device key thumbprint" .
 
+# ONT-2 (2026-11-10 review): the three things a holder keeps and never tells, each its own class under ap:HeldSecret,
+# distinct from what a verifier SEES (appc:PairwiseAccount, a presentation, a thumbprint).
+appc:HolderSecret a owl:Class ;
+  rdfs:subClassOf ap:HeldSecret ;
+  owl:disjointWith appc:PairwiseAccount ;
+  rdfs:label "HolderSecret" ;
+  rdfs:comment "THE SECRET THE PAIRWISE ACCOUNTS DERIVE FROM: one per holder (`credential.holder-secret:`), combined with a verifier's origin to make the account that verifier sees. Held in her vault, read by its exact key by the derivation, never listed to a question, opened by one or handed to a model. What it is NOT: a pairwise account (appc:PairwiseAccount is the derived value a door's receipt carries; the classes are disjoint), a key that signs anything, or a statement about who may read the record (ADR-0041)." .
+
+appc:DeviceKeyMaterial a owl:Class ;
+  rdfs:subClassOf appc:DeviceKey , ap:HeldSecret ;
+  rdfs:label "DeviceKeyMaterial" ;
+  rdfs:comment "THE PRIVATE HALF OF A DEVICE KEY, held as a vault record (`credential.device-key:`) in a deployment that predates the managed key service. Still a appc:DeviceKey (it carries the key's thumbprint, which IS public — the identifier a credential binds), but the record also holds the material that signs, so it is held and never told. What it is NOT: the thumbprint, a managed key (whose material never reaches a vault), or permission to sign (a presentation mandate is, judged per signature)." .
+
+appc:HeldAnonymousCredential a owl:Class ;
+  rdfs:subClassOf appc:AnonymousCredential , ap:HeldSecret ;
+  rdfs:label "HeldAnonymousCredential" ;
+  rdfs:comment "THE HOLDER'S OWN COPY of an anonymous credential (`credential.anonymous:`), claim values included — the thing a presentation proves predicates ABOUT without showing. Held and never told: a question that opened it would disclose exactly the claims the credential exists to keep. What it is NOT: the credential's digest (public — the issuer's live set holds it), a presentation, or the issuer's record of the issuance." .
+
+ap:HeldSecret owl:disjointWith appc:PairwiseAccount .
+
 appc:PairwiseAccount a owl:Class ;
   rdfs:subClassOf prov:Entity ;
   rdfs:label "PairwiseAccount" ;

package/tbox/skills.ttl

@@ -145,6 +145,11 @@ aps:matchedSkill a owl:ObjectProperty ;
 @prefix sh:      <http://www.w3.org/ns/shacl#> .
 @prefix xsd:     <http://www.w3.org/2001/XMLSchema#> .
 
+# ONT-13 (2026-11-10 review): this module had no ontology header, so its manifest row carried versionInfo null.
+aps: a owl:Ontology ;
+    rdfs:label "Agentic Primitives — generic skills substrate (spec 251)" ;
+    owl:versionInfo "0.1.0" .
+
 aps:Capability a owl:Class ;
     rdfs:label "Capability" ;
     rdfs:comment "The stable, provider-independent identity of an achievable OUTCOME. Not a service, not a plan, not a taxonomy term, not an execution, and not a subject domain. Its identity NEVER depends on one provider, one jurisdiction, one language, or one playbook — those are apctx: facets of a realization. A capability is not a prov:Activity: it is what COULD be achieved; an activity is an occurrence that attempted it (architecture §5)." .

package/tbox/transition.ttl

@@ -14,7 +14,7 @@
 
 aptr: a owl:Ontology ;
     rdfs:label "Agentic Primitives — capability transitions" ;
-    owl:versionInfo "0.1.0" ;
+    owl:versionInfo "0.2.0" ;
     rdfs:comment "Capabilities as transitions between situations, with authority as a precondition and evidence as the proof (spec 420 §2). Bound by IRI from packages/ontology/src/transitions.ts." .
 
 aptr:CapabilityTransition a owl:Class ;
@@ -34,9 +34,13 @@ aptr:StandingPrecondition a owl:Class ; rdfs:subClassOf aptr:Precondition ;
     rdfs:comment "The asker's derived standing (self · steward · member) at the agent an argument names. A standing the asker lacks makes the step unauthorizable — named before any signature is asked for, and never acted around." .
 
 aptr:establishes a owl:ObjectProperty ;
-    rdfs:domain aptr:CapabilityTransition ; rdfs:range apsit:Situation ;
+    # ONT-6 (2026-11-10 review): the range read apsit:Situation, but six of the nine transitions establish something
+    # else — an invitation and a payment receipt (entities), a message event (an activity), a chartered team, treasury
+    # or household (agents). And the value is a CLASS (`establishes.situation` in transitions.ts names a T-box class),
+    # not an instance. So the range is owl:Class: the KIND of thing the act brings about.
+    rdfs:domain aptr:CapabilityTransition ; rdfs:range owl:Class ;
     rdfs:label "establishes" ;
-    rdfs:comment "The situation this capability brings about (with role bindings from its arguments). A SUBMISSION establishes the proposal (an invitation), never the outcome the other party still has to bring about (a membership)." .
+    rdfs:comment "The CLASS of what this capability brings about, with role bindings from its arguments: a situation (apsit:Situation subclass — a membership), an entity (an invitation; apix:PaymentReceipt, the record a payment leaves with both parties), an event (a message), or a chartered agent class (a team, a treasury, a household, under `roles.parent`). Goal regression asks whether an instance of it is present in the record. A SUBMISSION establishes the proposal (an invitation), never the outcome the other party still has to bring about (a membership). What it is NOT: an assertion that the act is permitted." .
 
 aptr:requires a owl:ObjectProperty ;
     rdfs:domain aptr:CapabilityTransition ; rdfs:range aptr:Precondition ;
@@ -61,3 +65,56 @@ aptr:evidence a owl:DatatypeProperty ;
     rdfs:domain aptr:CapabilityTransition ; rdfs:range xsd:string ;
     rdfs:label "evidence" ;
     rdfs:comment "What proves the effect landed, by kind: chain-edge (an ACTIVE relationship edge) · countersigned-credential (both parties' vaults) · receipt (the counterparty's) · transfer (an on-chain token event) · own-record (the asker's own vault). Read back by spec 420 W4 before 'done'." .
+
+# ─── Preconditions, fully stated (ONT-6, 2026-11-10 review) ───────────────────────────────────────────────────────────
+# The fields of CapabilityTransitionV1 that carry "authority as a precondition" — authority, standing, at, of, in — bound
+# to nothing, and aptr:StandingPrecondition had no properties, so "requires a steward at the org" and "requires a mandate
+# of this kind" could not be SAID in the ontology. Each field now has a term. Still behaviour, never authority: no
+# verifier reads these; they let a plan name, before any signature is asked for, the authority a step would need.
+
+aptr:situation a owl:ObjectProperty ;
+    rdfs:domain aptr:SituationPrecondition ; rdfs:range owl:Class ;
+    rdfs:label "situation" ;
+    rdfs:comment "The class of situation the precondition reads (`situation` in transitions.ts) — e.g. aporg:OrganizationMembership." .
+
+aptr:of a owl:DatatypeProperty ;
+    rdfs:domain aptr:SituationPrecondition ; rdfs:range xsd:string ;
+    rdfs:label "of" ;
+    rdfs:comment "The argument naming the situation's SUBJECT (the member a membership is of)." .
+
+aptr:in a owl:DatatypeProperty ;
+    rdfs:domain aptr:SituationPrecondition ; rdfs:range xsd:string ;
+    rdfs:label "in" ;
+    rdfs:comment "The argument naming the situation's CONTEXT party (the organization a membership is in). Absent: any context." .
+
+aptr:StandingLevel a owl:Class ;
+    rdfs:label "StandingLevel" ;
+    rdfs:comment "A derived standing an asker may hold at an agent: self (it is her own agent), steward (she stewards it — custody, charter or an oversight delegation), member (she is a member of it). Derived from the record (packages/context deriveStanding), never asserted by the asker." .
+aptr:self    a aptr:StandingLevel ; rdfs:label "self" .
+aptr:steward a aptr:StandingLevel ; rdfs:label "steward" .
+aptr:member  a aptr:StandingLevel ; rdfs:label "member" .
+
+aptr:standing a owl:ObjectProperty ;
+    rdfs:domain aptr:StandingPrecondition ; rdfs:range aptr:StandingLevel ;
+    rdfs:label "standing" ;
+    rdfs:comment "The standing the asker must hold (`standing` in transitions.ts). Lacking it makes the step unauthorizable — named before any signature, never acted around." .
+
+aptr:at a owl:DatatypeProperty ;
+    rdfs:domain aptr:StandingPrecondition ; rdfs:range xsd:string ;
+    rdfs:label "at" ;
+    rdfs:comment "The argument naming the agent the standing is held AT, or `room` for the agent being asked (`at` in transitions.ts)." .
+
+aptr:AuthorityPrecondition a owl:Class ; rdfs:subClassOf aptr:Precondition ;
+    rdfs:label "AuthorityPrecondition" ;
+    rdfs:comment "The KIND of authority artifact the step must be carried under — \"requires a mandate of type X\" (spec 420 §2). Stated so goal regression can say, before asking for any signature, what will be asked for. What it is NOT: the mandate, or a check of one — the mandate is judged per step by the verifier (ADR-0041), which never reads this." .
+
+aptr:mandateClass a owl:ObjectProperty ;
+    rdfs:domain aptr:AuthorityPrecondition ; rdfs:range owl:Class ;
+    rdfs:label "mandateClass" ;
+    rdfs:comment "The class of the authority artifact required (`mandate` in transitions.ts) — e.g. apeng:Mandate, the per-intent projection of a standing delegation that the harness signs for a step. A class, not an instance." .
+
+aptr:spendsAuthorityOf a owl:DatatypeProperty ;
+    rdfs:domain aptr:CapabilityTransition ; rdfs:range xsd:string ;
+    rdfs:label "spendsAuthorityOf" ;
+    rdfs:comment "The argument whose authority the act spends — the PARTY_ROLES `acting` side — or `self` for a self-acting write (`authority` in transitions.ts). Whose signature the mandate needs; never a grant of it." .
+

package/tbox/values.ttl

@@ -1,6 +1,6 @@
 # T-box — WHAT AN ARGUMENT IS, when it is not a party (spec 363 W2).
 #
-# `PARTY_ROLES` already says what an argument's PARTY may be — a payer is a Treasury or an Organization,
+# `PARTY_ROLES` already says what an argument's PARTY may be — a payer is a Treasury (spec 373: an organization pays from the treasury it charters, never from itself),
 # an invitee is a Person (or, since spec 372, a Service agent). Nothing said what the REST of an argument is, so every argument that was not an
 # agent was a string, and every branch that touched one re-invented how to read it.
 #
@@ -23,6 +23,7 @@
 @prefix skos:  <http://www.w3.org/2004/02/skos/core#> .
 
 apval: a owl:Ontology ;
+    owl:versionInfo "0.1.0" ;
     rdfs:label "Agentic Primitives — Argument values" ;
     rdfs:comment "The kinds of value a capability argument can hold when it is not an agent: a quantity, an asset, an address for mail, a label, a flag, a kind of agent. One term, one reader (spec 363 §3)." .
 

package/versions.adoption.json

@@ -186,6 +186,24 @@
    "steward": "richardpedersen3@gmail.com",
    "publishedAt": "2026-10-26",
    "note": "spec 401 amended — tbox/org.ttl 0.5.0: there is no one-sided 'contact'. aporg:Contact, contactAgent, contactOf, contactRole, ContactRole and the role-* individuals are REMOVED; aporg:Friendship (two-way, between two PersonAgents, DERIVED iff both have a standing aporg:FriendshipOffer naming the other) replaces them, with FriendshipOffer (one person's own record + the grant they signed; offeredBy, offeredTo, offerGrant, offerStatus standing|withdrawn, offerWithdrawnAt), FriendType (friend, family, coach, other — declarative, every one two-way) and FriendshipState (request-sent, request-received, friends, ended — derived from the two offers). Shape: aporg:FriendshipOfferShape. Breaking for any binding to aporg:Contact."
+  },
+  {
+   "manifestDigest": "0xfd42411027b8d71e9f5b343b871a12612ea72fd444924e21d6ceeb1e5ea0b6fb",
+   "steward": "richardpedersen3@gmail.com",
+   "publishedAt": "2026-11-10",
+   "note": "spec 445 (audit 2026-11-10 RUNC-1, REM-2) — tbox/core.ttl 0.3.0, additive: ap:OversightDelegation (the delegation an organization signs to its steward — time-boxed, no value, pinned to the estate's governance contracts and carrying no other caveat; what a stewardship recogniser binds to instead of excluding other wires) and ap:HeldSecret (a vault record whose content is used and never told: the role 'secret' of a vault-record binding — not listed to, opened by, or passed on from a question). Nothing removed or renamed."
+  },
+  {
+   "manifestDigest": "0xc320befe674b92adb345b301519945728ee7fe3872cf2cf82464fc7f0ec980ca",
+   "steward": "richardpedersen3@gmail.com",
+   "publishedAt": "2026-11-10",
+   "note": "spec 445 (audit 2026-11-10 coverage gap, reviewer report 14) — ANNOTATIONS ONLY, no class, property, axiom or shape changed: tbox/naming.ttl 0.1.1 (apnam:tld comment: the retired .impact root removed — .agent is the only remaining untyped legacy root; the value list names all nine tldScheme suffixes), tbox/core.ttl 0.3.1 (ap:agentType comment: nine derived types, matching ap:agentTypeScheme), tbox/identity.ttl (aporg:memberOf comment no longer says authority lives in custody — it is a delegation, ADR-0041; points at the governing definition in org.ttl), tbox/values.ttl and tbox/household.ttl (comments no longer say an organization pays from or holds money itself — spec 373, assets live only in treasuries)."
+  },
+  {
+   "manifestDigest": "0x654d0c2113665b0ffca61c12e85590769404f1e9e55062bd13cecd6d96ab1a40",
+   "steward": "richardpedersen3@gmail.com",
+   "publishedAt": "2026-11-10",
+   "note": "spec 445 §9 decision 8 (reviewer report 14, ONT-1…ONT-8, ONT-10, ONT-11, ONT-13) — ONE release. BREAKING for bindings that read these ranges or rebind secret rows: ap:primaryPayee / ap:primaryPayer (core 0.4.0), appay:payer / appay:payee (payment 0.2.0) and aphh:householdPayee (household 0.2.0) now range over ap:Treasury (spec 373: assets live only in treasuries). ap:PersonAgent, ap:OrganizationAgent and ap:ApplicationAgent are pairwise disjoint (owl:AllDisjointClasses). Secrets get classes of their own under ap:HeldSecret: ap:PairwiseSecret (identity; disjoint from ap:PairwiseSubject), appc:HolderSecret (disjoint from appc:PairwiseAccount), appc:DeviceKeyMaterial, appc:HeldAnonymousCredential (privacy-credential 0.2.0), apest:HeldProjectionSubmission (estate 0.2.0); ap:HeldSecret disjoint from ap:PairwiseSubject and appc:PairwiseAccount; the five secret vault records rebound. apinf:InferenceReceipt ⊑ apix:ExecutionReceipt (inference 0.3.0). transition 0.2.0: aptr:establishes ranges over owl:Class; new aptr:situation, of, in, standing (aptr:StandingLevel self|steward|member), at, AuthorityPrecondition, mandateClass, spendsAuthorityOf; the payment transition establishes apix:PaymentReceipt (the vault record's class). ap:OversightDelegation comment: the timestamp caveat is REQUIRED (recogniser changed to match). payload.ttl prefix appay: → apload: (IRIs unchanged; 0.1.1). versionInfo added to actor-context, values, household, payload; ontology headers added to content, geo, skills."
   }
  ]
 }