@aikdna/kdna-core 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,156 @@
 # Changelog
 
+## v0.18.0 (2026-07-15)
+
+### Added
+
+- Add opt-in Runtime Capsule 2 Core primitives, formal Capsule 1/Capsule 2 and
+  digest-evidence schemas, RFC 8785 JCS delivery hashing, deterministic
+  v2-to-v1 adaptation, and committed A/C/E/P conformance goldens. Existing
+  Runtime load entry points continue to emit frozen Capsule 1 values.
+- Accept independent expected A/C/E values through `expectedDigests` and block
+  Capsule 2 emission with digest-specific mismatch codes.
+- Preserve the four frozen Capsule 1 inheritance, dependency, and RAG
+  extension fields through the one-way Capsule 2 compatibility member.
+- Define strict opt-in ConsumptionPlan 1.0, Agent Host 2, capability, runtime
+  receipt, and authoritative JudgmentTrace 1.0 schemas. Add committed
+  negotiation, plan/P recomputation, five-terminal Trace, exact-budget,
+  source-directory block, required-null, and cross-document tamper conformance
+  vectors. Plan 1 formally supports only Capsule 2 plus Host 2 and has no
+  downgrade or adapter; runtime defaults remain Plan 0.9, Capsule 1, and Host 1.
+- Bind Trace elapsed evidence to the correlated Host receipt, make
+  unobserved finite limits propagate to an honest `not_observed` overall
+  comparison, and record Host-side P mismatch as a correlated pre-execution
+  rejection instead of an impossible terminal state.
+- Expose the strict opt-in ConsumptionPlan 1, Agent Host 2, budget-evidence,
+  and JudgmentTrace 1 builders and validators from CJS, ESM, and TypeScript.
+  The conformance runner now consumes this single packaged implementation.
+- Add a dedicated pre-Host budget-blocked Trace builder and validator. They
+  preserve projected A/C/E/P, profile, and exact character evidence without
+  exposing an over-budget Host request; calls within budget fail closed.
+- Add a bounded raw execution-contract JSON parser that rejects duplicate
+  decoded keys, invalid UTF-8 and Unicode, BOMs, hostile-key prototype
+  mutation, non-finite numbers, and trailing or non-RFC JSON input before
+  Host 2 object validation.
+
+### Changed
+
+- Converge the compatibility names `inspectKDNA`, `validateKDNA`, and
+  `loadKDNA` on the current unversioned Runtime implementation. Validation now
+  returns the current five format/schema/payload/checksum/load-contract gates,
+  and loading returns a Runtime Capsule; the old source-tree validation and
+  `{domain, context}` result shapes are no longer synthesized for current
+  assets.
+- Make CJS, ESM, and TypeScript declarations expose the same compatibility
+  names and current return contracts.
+- Accept `.kdna` bytes in memory across current inspect, validate, LoadPlan,
+  and load paths. Buffer verification does not extract or materialize the
+  asset on disk.
+- Read packaged file paths once at load entry so LoadPlan authorization and
+  Runtime Capsule projection use the same immutable bytes. The default load
+  result is a Runtime Capsule, matching explicit `as: "json"`.
+- Make `composeKDNA` fail closed with
+  `KDNA_COMPOSE_PROTOCOL_UNAVAILABLE` until current Cluster/Capsule
+  composition semantics are defined; it no longer returns a misleading empty
+  composition.
+- Identify `schema/manifest.schema.json` as the sole Runtime manifest schema.
+  The older `schema/kdna-manifest.json` remains only for explicit legacy-source
+  migration. Runtime `language` remains valid and `creator` provenance remains
+  optional, while an explicitly declared creator still requires a non-empty
+  name.
+
+### Fixed
+
+- Restrict Core publication to canonical `kdna-core-v*` published-release
+  events, require the exact version tag to identify the workflow commit, and
+  make already-published versions idempotent only when registry `gitHead` and
+  artifact integrity and SHA-1 shasum match the current release evidence. Only
+  npm's structured, exact-version `No match found` response is treated as an
+  unpublished version; missing packages, authorization/registry errors,
+  missing identity, malformed digests, or a different artifact fail closed
+  instead of being treated as a successful duplicate.
+- Report an unavailable GitHub Release lookup as an explicit non-gating
+  `SKIP`, rather than wrapping the skipped observation in a misleading
+  readiness `PASS`. Remove unused downstream repository checkouts from the
+  Core publish job.
+- Make the ESM root and TypeScript declarations expose every existing CJS
+  public value, including the crypto, external-grant, Work Pack, composition,
+  container, and semver helpers. Permanent source and packed-install checks now
+  block entrypoint drift.
+- Model the complete Argon2id password-KDF descriptor and require a machine
+  fingerprint when the unified decrypt API receives a legacy or profile-unknown
+  envelope. Package tests now isolate every npm operation from the user cache
+  and keep pack caches separate from a provably empty offline-install cache.
+  Third-party dependency fixtures are packed from script-free temporary copies,
+  so package-manager lifecycle behavior cannot introduce network or build-tool
+  dependencies into the offline release gate.
+- Require a non-null independently trusted Plan digest throughout the strict
+  Plan 1 / Host 2 chain, snapshot hostile validation contexts without invoking
+  accessors, and keep pre-Host budget enforcement unavailable as a public
+  bypass option.
+- Require matched Host receipts to correlate sender, Host-recomputed, echoed,
+  and actual Capsule delivery digests. Trace construction now requires an
+  explicit trusted delivery observation when no receipt exists, distinguishing
+  `not_delivered` from `not_observed` without inferring either from a request.
+- Check internal C/E declarations and canonical/legacy alias agreement before
+  independent expected values, so external matches cannot hide conflicting
+  asset declarations.
+- Validate public Capsule 2 builder and adapter inputs and outputs against the
+  packaged schemas and cross-field success invariants.
+- Preserve only the frozen Capsule 1 access aliases `open`, `protected`, and
+  `runtime` for exact adapter parity while keeping Capsule 2 access canonical;
+  fail closed if compatibility metadata pairs an alias with the wrong
+  canonical access.
+- Compute Capsule 1 E directly from Runtime manifest and payload bytes when
+  checksums are absent, share the same pure E implementation across checksum
+  build/verify and both Capsule generations, and reject Capsule 1 builder
+  inputs that disagree with their manifest or digest evidence.
+- Sort canonical content-tree and signing entry paths by UTF-8 bytes while
+  retaining the existing UTF-16 JSON object-key order. U+E000/U+10000 vectors
+  freeze the distinction.
+
+- Make stable verification fail closed on malformed CBOR, invalid current
+  manifests, checksum mismatches, and forbidden legacy plaintext containers,
+  while preserving whole-file `asset_digest`, canonical `content_digest`, and
+  existing expected-digest/signature hooks.
+- Make direct `createKdnaAssetReader().loadProfile*` return the current Runtime
+  Capsule instead of silently returning `domain: null`; legacy `readDataMap*`
+  now fails explicitly rather than pretending current payloads are old source
+  files.
+
+## v0.17.0 (2026-07-14)
+
+### Added
+
+- Structurally validate optional payload `worldview`, ordered `value_order`,
+  and `judgment_role`, then preserve their declared values in the compact
+  Runtime Capsule instead of silently dropping them. Compact prompt projection
+  renders worldview, value order, and the standard role fields `acts_as`,
+  `does_not_act_as`, and `responsibility`; role extension fields remain
+  available in the JSON Capsule without an unsupported prompt claim.
+- Add a synthetic Golden Single-Asset Core fixture. It proves schema,
+  validation, content-neutral inspect, and exact compact projection only; it
+  does not claim author quality, task applicability, model consumption, or
+  conformance.
+
+### Changed
+
+- Make Runtime `creator` provenance optional. When it is declared,
+  `creator.name` remains required and non-empty; when provenance is unavailable,
+  producers omit the block instead of inventing an anonymous or `Unknown`
+  identity. This does not weaken authoring-source identity rules or turn
+  provenance into a trust claim.
+- Keep canonical and packaged Runtime manifest/payload schemas aligned with the
+  creator and scoped-judgment contracts.
+
+### Fixed
+
+- Make ecosystem truth validation fail closed when a live component has
+  neither package/artifact evidence nor a verifiable repository checkout,
+  instead of silently accepting missing external evidence.
+- Derive web-package readiness expectations from the declared current Core
+  version rather than a stale hard-coded release number.
+
 ## v0.16.0 (2026-07-13)
 
 ### Added
@@ -141,7 +292,6 @@ Story 6 — dependencies runtime. Supports semver-matching local/registry depend
 - **Topological Sorting Resolver**: Added a robust, pure post-order DFS topological sorter with circular cycle, missing dependency, and version range mismatch checks.
 - **Topological Prompt Composition**: Enabled recursive, multi-domain prompt composition and flat topological JSON return inside `loadAuthorized`.
 
-
 ## v0.15.6 (2026-06-28)
 
 Story 5 — Bundle payload type. Bumps KDNA manifest format schema to v2, introduces bundle-profile-v1 payload profile, and starts KDNA v1 format deprecation window.
@@ -150,7 +300,6 @@ Story 5 — Bundle payload type. Bumps KDNA manifest format schema to v2, introd
 - **V2 Schema support:** bumped manifest schema version to v2.0, supporting `kdna_version` as `"2.0"`.
 - **Bundle profile support:** added `bundle-profile-v1` payload profile and validator.
 
-
 ## v0.15.5 (2026-06-28)
 
 Phase 12 audit follow-up. Closes 3 issues filed against this
@@ -198,6 +347,7 @@ signature generated by one tool is accepted by every other.
   in `docs/CANONICALIZATION.md`.
 
 ## v0.15.3 (2026-06-27)
+
 - Fix (PC-2, real): `renderPromptItem` now actually ships the
   boundary card branch. The previous v0.15.2 release (ee20c5e)
   bumped package.json and added a CHANGELOG entry but did NOT
@@ -208,6 +358,7 @@ signature generated by one tool is accepted by every other.
   `in scope: X; out of scope: Y` instead of the UUID `id`.
 
 ## v0.15.2 (2026-06-27)
+
 - Fix (PC-2): `renderPromptItem` now renders boundary cards as
   `in scope: X; out of scope: Y; exceptions: ...` instead of
   falling through to the UUID `id`. The previous behavior made
@@ -219,12 +370,14 @@ signature generated by one tool is accepted by every other.
   UUID `id`, so any unrecognized card shape is visible.
 
 ## v0.15.1 (2026-06-27)
+
 - Fix: package.json `files` array now includes `CHANGELOG.md`. The
   v0.15.0 tarball was published without the changelog, leaving
   consumers with no way to read release notes from `npm install`.
   Adding it now is a no-op for code but resolves the docs gap.
 
 ## v0.15.0 (2026-06-27)
+
 - B2: scrypt password profile `kdna-password-protected-v1-scrypt` (ADR-007)
   - encryptProtectedEntryScrypt / decryptProtectedEntryScrypt (zero new deps, Node crypto.scryptSync)
   - AES-256-GCM + AES-256-KW envelope encryption, same CEK model as RFC-0008
@@ -235,6 +388,7 @@ signature generated by one tool is accepted by every other.
 - B5: conformance:canonical npm script (threshold #8)
 
 ## v0.14.0 (2026-06-25)
+
 - B1: unified container dispatcher (readAsset — v1/v2/ dir → CanonicalAssetModel)
 - B4: loadAuthorized decryption orchestration (opts.password, opts.decryptEntry)
 - B4: encrypted payload detection in runValidate (backward compatible)
@@ -245,6 +399,7 @@ signature generated by one tool is accepted by every other.
 - Add: engines.node >=18.0.0
 
 ## v0.13.3 (2026-06-22)
+
 - Fix: index profile includes max_tokens_hint
 - Fix: compact profile falls back to full_statement for TBD placeholders
 
@@ -253,11 +408,13 @@ Packages: `@aikdna/kdna-core`
 ## v0.13.2 (2026-06-21)
 
 ### Fixed
+
 - Compact boundary projection now correctly preserves `applies_when`, `does_not_apply_when`, and `failure_risk` fields across all load profiles. These axiom governance fields are required by `kdna-loader` for domain routing decisions and were being dropped in compact mode under certain manifest configurations.
 - Cross-platform test stability: Node test glob patterns are now compatible with both macOS and Linux filesystem sort orders.
 - Hash library compatibility: `@noble/hashes` replaces Node-only crypto for digest operations, maintaining Node 18 compatibility without native module binding requirements.
 
 ### Changed
+
 - Public API boundary hardened: `loadKDNA`, `loadKDNASync`, `inspectKDNA`, and `inspectKDNASync` now enforce the asset-first contract — callers must pass `.kdna` files or asset handles, not raw directory paths.
 - Examples in README and inline docs reference the packaged `.kdna` path rather than source directories.
 - First-run contract tightened: exported symbols, error codes, and validation gate names are now part of the stable API surface.
@@ -267,10 +424,12 @@ Packages: `@aikdna/kdna-core`
 ## v0.13.1 (2026-06-21)
 
 ### Fixed
+
 - **Compact boundary projection preserved.** The `planLoad` function and `loadAuthorized` shim now pass through the full axiom governance projection (applies_when, does_not_apply_when, failure_risk) even when the load contract is not present in the manifest. Prior versions could strip these fields under compact profile, breaking domain routing for `kdna-loader`.
 - Digest matching now tolerates `sha256:` prefix in both `manifest_digest` and `payload_digest` checksums entries. Previously, a leading `sha256:` prefix was treated as part of the hex digest, causing false mismatches.
 
 ### Changed
+
 - Public API provenance and profile split clarified: `loadKDNA` / `loadKDNASync` are the stable entry points for runtime consumers. Lower-level `readV1Layout`, `runValidate`, and `planLoad` are exported for advanced tooling but carry no backward-compatibility guarantee.
 - Access enum values normalized everywhere: `public`, `licensed`, `remote`. Legacy aliases (`open` → `public`, `protected` → `licensed`, `runtime` → `remote`) are mapped transparently with an info-level issue in the LoadPlan.
 - `verifyAsset` / `verifyAssetSync`, `verifyDigest` / `verifyDigestSync`, and `verifySignature` / `verifySignatureSync` are now documented as the stable verification API surface.
@@ -280,6 +439,7 @@ Packages: `@aikdna/kdna-core`
 ## v0.13.0 (2026-06-19)
 
 ### Added
+
 - **Authorization LoadPlan contract.** The `planLoad(inputPath, opts)` function returns a structured LoadPlan before any judgment content is decrypted or emitted. The LoadPlan reports:
   - `asset_id`, `asset_uid`, `title`, `version`, `judgment_version`
   - `access` model (`public` | `licensed` | `remote`)
@@ -315,11 +475,13 @@ Packages: `@aikdna/kdna-core`
 - **TypeScript declarations.** `src/types.d.ts` exports type definitions for the stable public API surface.
 
 ### Changed
+
 - **V1 is the only active format path.** The v2 reader (`readDataMapSync`, `readDataMap`) remains in the codebase for migration compatibility but is no longer the default path. All new integrations should use the v1 API: `inspect`, `validate`, `planLoad`, `loadAuthorized`.
 - `validate` and `planLoad` reject v2 containers (`application/vnd.aikdna.kdna+zip`) with a format error.
 - Access model normalized to the three-tier `public` | `licensed` | `remote` enum. The LoadPlan maps legacy values transparently with an info-level issue.
 - Container format detection (`detectContainerFormat`) reads only the first central-directory entry to determine v1 vs v2, preventing malicious later entries from causing format confusion.
 
 ### Removed
+
 - Legacy v1 compatibility shims removed. v2 is the only legacy format and is handled through the existing `asset-reader.js` module.
 - `readDataMapSync` / `readDataMap` deprecated for new use. Use `planLoad` + `loadV1` for runtime loading or `validate` + `inspect` for diagnostics.

package/README.md

@@ -28,9 +28,13 @@ const {
   validate,
   planLoad,
   loadAuthorized,
+  loadCapsuleV2,
+  computeDigestEvidence,
+  computeCapsuleDeliveryDigest,
+  adaptCapsuleV2ToV1,
   pack,
   unpack,
-  buildChecksums
+  buildChecksums,
 } = require('@aikdna/kdna-core');
 
 const validation = validate('./asset.kdna');
@@ -45,7 +49,7 @@ if (plan.can_load_now !== true) {
 
 const capsule = loadAuthorized('./asset.kdna', {
   profile: 'compact',
-  as: 'json'
+  as: 'json',
 });
 
 if (capsule.type !== 'kdna.context.capsule') {
@@ -53,6 +57,145 @@ if (capsule.type !== 'kdna.context.capsule') {
 }
 ```
 
+Capsule 2 is opt-in. It exposes A/C/E under distinct digest members while the
+default Runtime API remains on the frozen Capsule 1 contract:
+
+```js
+const expectedA = {
+  value: 'sha256:<64 lowercase hex>',
+  source: 'install_receipt',
+};
+
+const evidence = computeDigestEvidence('./asset.kdna', {
+  expectedDigests: {
+    asset: expectedA,
+  },
+});
+
+const capsule2 = loadCapsuleV2('./asset.kdna', {
+  profile: 'compact',
+  expectedDigests: {
+    asset: expectedA,
+  },
+});
+
+const deliveryDigest = computeCapsuleDeliveryDigest(capsule2);
+const legacyCapsule = adaptCapsuleV2ToV1(capsule2);
+```
+
+ConsumptionPlan 1, Agent Host 2, and JudgmentTrace 1 are opt-in APIs in
+`@aikdna/kdna-core@0.18.0`. Plan 1 accepts only Capsule 2 plus Host 2: it has no
+downgrade or legacy adapter. The default Runtime path remains Capsule 1,
+ConsumptionPlan 0.9, and Agent Host 1. The opt-in builders derive
+protocol-owned members, while every verifier receives a non-null trusted Plan
+digest and independently observed capabilities, request, receipt, and delivery
+state as explicit context:
+
+```js
+const {
+  parseExecutionContractJsonV1,
+  buildConsumptionPlanV1,
+  buildAgentHost2RequestV1,
+  buildPreHostBudgetBlockedTraceV1,
+  validatePreHostBudgetBlockedTraceV1,
+  validateAgentHost2ReceiptV1,
+  buildJudgmentTraceV1,
+} = require('@aikdna/kdna-core');
+
+const plan = buildConsumptionPlanV1({
+  plan_id: 'plan_0123456789abcdef',
+  created_at: new Date().toISOString(),
+  task,
+  asset_ref,
+  projection_profile: 'compact',
+  budget,
+  constraints: { enforce_before_host: true, reject_on_exceed: true },
+  trace_policy: { emit: true, storage: 'session' },
+});
+
+const executionContext = {
+  plan,
+  trustedPlanDigest: plan.integrity.plan_digest,
+  capabilities: observedHostCapabilities,
+  coreCapsuleVersions: ['2.0', '1.0'],
+};
+const request = buildAgentHost2RequestV1(
+  { request_id: 'host_0123456789abcdef01234567', capsule: capsule2 },
+  executionContext,
+);
+
+// Parse raw Host JSON before object-level Schema/correlation validation.
+const receipt = parseExecutionContractJsonV1(rawReceiptBytes);
+const receiptValidation = validateAgentHost2ReceiptV1(receipt, { request });
+if (!receiptValidation.valid) throw new Error(receiptValidation.code);
+
+const trace = buildJudgmentTraceV1(traceInput, {
+  ...executionContext,
+  request,
+  receipt,
+  trustedDeliveryObservation: 'host_receipt',
+});
+```
+
+When no receipt exists, Trace construction requires the caller to state the
+trusted observation explicitly as `not_delivered` or `not_observed`; request
+existence alone is not treated as delivery evidence.
+
+If Capsule projection succeeded but the exact projection or task character
+count exceeds the Plan budget, `buildAgentHost2RequestV1()` fails closed and
+must not be bypassed. Use the dedicated evidence-only terminal instead:
+
+```js
+const blockedTrace = buildPreHostBudgetBlockedTraceV1(
+  {
+    trace_id: 'trace_0123456789abcdef',
+    timestamp: new Date().toISOString(),
+    capsule: capsule2,
+  },
+  executionContext,
+);
+
+const blockedValidation = validatePreHostBudgetBlockedTraceV1(blockedTrace, {
+  ...executionContext,
+  capsule: capsule2,
+});
+if (!blockedValidation.valid) throw new Error(blockedValidation.code);
+```
+
+This API returns only a `blocked` / `not_delivered` Trace with a fixed budget
+error. It retains A/C/E, sender P, projection profile, exact character actuals,
+and `exceeded` comparison, but it never exposes an over-budget Host request or
+a request ID. Calling it when neither projection nor task is over budget is an
+error.
+
+`parseExecutionContractJsonV1()` is the raw protocol boundary. It rejects
+duplicate decoded object keys, invalid UTF-8, BOMs, non-scalar Unicode,
+non-finite numbers, trailing input, and non-RFC JSON grammar before an object
+validator runs. Its default limits are 2 MiB and 64 nested containers;
+`maxBytes` and `maxDepth` may only tighten those limits. Error
+`code_unit_offset` details are UTF-16 code-unit indexes, not UTF-8 byte
+offsets. Parsed object validators cannot reconstruct overwritten duplicate
+keys, invalid original bytes, or a stripped BOM, so Host adapters must not use
+plain `JSON.parse()` for untrusted protocol messages.
+
+An A, C, or E mismatch is returned as evidence by `computeDigestEvidence()`
+and blocks `loadCapsuleV2()` with a digest-specific error. The adapter always
+maps E to Capsule 1 `asset_digest`; it never substitutes A or C. Core computes
+E from the raw Runtime manifest and payload bytes even when `checksums.json` is
+absent, in which case E is reported as `not_compared`.
+Internal manifest/checksum declarations are checked before independent
+expected values, so a receipt match cannot conceal a bad declaration or
+conflicting digest alias. The adapter also preserves the four frozen Capsule 1
+inheritance/dependency/RAG extension fields through
+`compatibility.capsule_1_extensions` without giving them Capsule 2 authority.
+It preserves only the legacy access aliases `open`, `protected`, and `runtime`
+through `compatibility.capsule_1_access`; Capsule 2 itself always uses
+`public`, `licensed`, or `remote`. These values must map exactly as
+`open`/`public`, `protected`/`licensed`, and `runtime`/`remote`; the builder and
+adapter reject any mismatched pair. The public builder rejects a Capsule 1 value
+whose domain, judgment version, access, or E does not match the supplied
+manifest and digest evidence.
+
 ## Supported Runtime Flow
 
 ```text
@@ -64,6 +207,12 @@ if (capsule.type !== 'kdna.context.capsule') {
 → Agent/runtime context
 ```
 
+The default compact Capsule preserves the asset's scoped judgment context:
+`highest_question`, `worldview`, ordered `value_order`, `judgment_role`,
+applicability-aware axioms, boundaries, self-checks, failure modes, and a
+bounded pattern set. Core copies the three optional scoped fields without
+trimming, reordering, or treating them as facts, policy, or quality evidence.
+
 For authoring and test fixtures, `pack()` can turn a local working folder into
 a `.kdna` file before validation:
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@aikdna/kdna-core",
-    "version": "0.16.0",
+    "version": "0.18.0",
     "description": "KDNA Core library for validating, planning, and loading local .kdna judgment assets.",
     "engines": {
         "node": ">=18.0.0"
@@ -21,7 +21,8 @@
     "scripts": {
         "test": "node ../../scripts/run-node-tests.js test/*.test.js && node -e \"const m = require('./src/index.js'); console.log('kdna-core exports:', Object.keys(m).join(', '));\"",
         "prepublishOnly": "npm run release:check",
-        "release:check": "node scripts/check-release-readiness.js"
+        "release:check": "node scripts/check-release-readiness.js",
+        "publish:guard": "node scripts/check-publish-duplicate.js"
     },
     "files": [
         "src/",

package/schema/agent-host-2-receipt.schema.json

@@ -0,0 +1,206 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/aikdna/kdna/specs/agent-host-2-receipt.schema.json",
+  "title": "KDNA Agent Host 2 Correlated Response Receipt",
+  "description": "Host 2 correlated response envelope. A matched runtime_receipt proves only that the Host boundary accepted the exact Capsule 2 value. A mismatched runtime_receipt proves that the Host rejected the request before provider execution. Neither proves semantic consumption or conformance.",
+  "type": "object",
+  "required": ["protocol", "request_id", "runtime_receipt", "outcome"],
+  "additionalProperties": false,
+  "properties": {
+    "protocol": { "const": "kdna.agent-host/2" },
+    "request_id": { "type": "string", "pattern": "^host_[0-9a-f]{24}$" },
+    "runtime_receipt": { "$ref": "#/$defs/runtimeReceipt" },
+    "outcome": {
+      "oneOf": [{ "$ref": "#/$defs/outcome" }, { "type": "null" }]
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "runtime_receipt": {
+            "properties": { "provider_execution_status": { "const": "completed" } },
+            "required": ["provider_execution_status"]
+          }
+        },
+        "required": ["runtime_receipt"]
+      },
+      "then": { "properties": { "outcome": { "$ref": "#/$defs/outcome" } } },
+      "else": { "properties": { "outcome": { "type": "null" } } }
+    }
+  ],
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "runtimeReceipt": {
+      "type": "object",
+      "required": [
+        "type",
+        "receipt_version",
+        "capsule_version",
+        "capsule_digest_profile",
+        "sender_capsule_delivery_digest",
+        "host_recomputed_capsule_delivery_digest",
+        "echoed_capsule_delivery_digest",
+        "capsule_delivery_comparison",
+        "capsule_schema_validation",
+        "asset_id_correlation",
+        "provider_execution_status",
+        "usage",
+        "semantic_consumption",
+        "model_identity"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "const": "kdna.agent-host.runtime-receipt" },
+        "receipt_version": { "const": "1.0.0" },
+        "capsule_version": { "const": "2.0" },
+        "capsule_digest_profile": { "const": "kdna-capsule-jcs-v1" },
+        "sender_capsule_delivery_digest": { "$ref": "#/$defs/sha256" },
+        "host_recomputed_capsule_delivery_digest": { "$ref": "#/$defs/sha256" },
+        "echoed_capsule_delivery_digest": { "$ref": "#/$defs/sha256" },
+        "capsule_delivery_comparison": { "enum": ["matched", "mismatched"] },
+        "capsule_schema_validation": { "const": "passed" },
+        "asset_id_correlation": { "const": "matched" },
+        "provider_execution_status": {
+          "enum": ["completed", "not_started", "failed", "cancelled", "timed_out"]
+        },
+        "usage": { "$ref": "#/$defs/observedUsage" },
+        "semantic_consumption": { "$ref": "#/$defs/semanticConsumption" },
+        "model_identity": { "$ref": "#/$defs/modelIdentity" }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "capsule_delivery_comparison": { "const": "matched" } },
+            "required": ["capsule_delivery_comparison"]
+          },
+          "then": {
+            "properties": {
+              "provider_execution_status": {
+                "enum": ["completed", "failed", "cancelled", "timed_out"]
+              }
+            }
+          },
+          "else": {
+            "properties": {
+              "provider_execution_status": { "const": "not_started" },
+              "usage": {
+                "properties": {
+                  "tokens_used": { "type": "null" },
+                  "model_calls": { "type": "null" },
+                  "basis": { "const": "not_observed" }
+                }
+              },
+              "model_identity": {
+                "properties": {
+                  "value": { "type": "null" },
+                  "basis": { "const": "not_observed" }
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "semanticConsumption": {
+      "type": "object",
+      "required": ["state", "basis"],
+      "additionalProperties": false,
+      "properties": {
+        "state": { "const": "not_observed" },
+        "basis": { "type": "null" }
+      }
+    },
+    "observedUsage": {
+      "type": "object",
+      "required": ["elapsed_ms", "elapsed_basis", "tokens_used", "model_calls", "basis"],
+      "additionalProperties": false,
+      "properties": {
+        "elapsed_ms": { "type": "integer", "minimum": 0 },
+        "elapsed_basis": { "const": "host_monotonic" },
+        "tokens_used": {
+          "oneOf": [{ "type": "integer", "minimum": 0 }, { "type": "null" }]
+        },
+        "model_calls": {
+          "oneOf": [{ "type": "integer", "minimum": 0 }, { "type": "null" }]
+        },
+        "basis": { "enum": ["host_reported", "not_observed"] }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "basis": { "const": "host_reported" } },
+            "required": ["basis"]
+          },
+          "then": {
+            "properties": {
+              "tokens_used": { "type": "integer", "minimum": 0 },
+              "model_calls": { "type": "integer", "minimum": 0 }
+            }
+          },
+          "else": {
+            "properties": {
+              "tokens_used": { "type": "null" },
+              "model_calls": { "type": "null" }
+            }
+          }
+        }
+      ]
+    },
+    "modelIdentity": {
+      "type": "object",
+      "required": ["value", "basis"],
+      "additionalProperties": false,
+      "properties": {
+        "value": { "type": ["string", "null"], "minLength": 1 },
+        "basis": { "enum": ["host_reported", "not_observed"] }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": { "basis": { "const": "host_reported" } },
+            "required": ["basis"]
+          },
+          "then": { "properties": { "value": { "type": "string", "minLength": 1 } } },
+          "else": { "properties": { "value": { "type": "null" } } }
+        }
+      ]
+    },
+    "outcome": {
+      "type": "object",
+      "required": ["judgment", "usage"],
+      "additionalProperties": false,
+      "properties": {
+        "judgment": { "$ref": "#/$defs/judgment" },
+        "usage": {
+          "oneOf": [{ "$ref": "#/$defs/usage" }, { "type": "null" }]
+        }
+      }
+    },
+    "judgment": {
+      "type": "object",
+      "required": ["answer", "reasoning", "confidence"],
+      "additionalProperties": false,
+      "properties": {
+        "answer": { "type": "string", "minLength": 1 },
+        "reasoning": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "confidence": { "type": ["string", "null"], "minLength": 1 }
+      }
+    },
+    "usage": {
+      "type": "object",
+      "required": ["tokens_used", "model_calls"],
+      "additionalProperties": false,
+      "properties": {
+        "tokens_used": { "type": "integer", "minimum": 0 },
+        "model_calls": { "type": "integer", "minimum": 0 }
+      }
+    }
+  }
+}