@hraness/oh 0.2.3

package/spec/v1/graph.md

@@ -0,0 +1,87 @@
+# Graph and operation contract V1
+
+The graph format version is `1`. It stores canonical JSON records behind stable
+logical keys and records every change in a content-addressed operation chain.
+
+## Record envelope
+
+```json
+{
+  "dependencies": [],
+  "key": "entity:ada-lovelace",
+  "kind": "entity",
+  "recordSha256": "<64 lowercase hex characters>",
+  "v": 1,
+  "value": { "name": "Ada Lovelace" }
+}
+```
+
+A logical key begins with a lowercase letter, contains at most 512 characters,
+and uses lowercase alphanumeric segments separated by `.`, `_`, `:`, `/`, or
+`-`. Dependencies use the same grammar. They MUST be strictly ordered, unique,
+non-reflexive, and present after the operation settles.
+
+V1 record kinds are:
+
+```text
+activity assertion context dependency-manifest edition entity evidence
+identity-operation inquiry inquiry-event review-decision rights-decision
+schema shape statement type-membership view vocabulary
+```
+
+The `value` is arbitrary canonical JSON. A registered codec MAY impose a
+stricter value contract for a kind. The generic envelope parser remains the
+wire boundary.
+
+## Changes
+
+A put change contains `{ "kind": "put", "record": ..., "v": 1 }`. A
+tombstone contains the logical key and exact prior record digest. Changes in an
+operation MUST be sorted by logical key and unique. A tombstone fails if its
+prior digest does not match the current record.
+
+One operation contains 1 through 8,192 changes. Each record has no more than
+4,096 dependencies and a value no larger than 1,048,576 canonical UTF-8 bytes.
+A bounded snapshot contains no more than 65,536 records under the V1 graph
+limit.
+
+## Graph revisions
+
+A graph revision binds the canonical changes, stable operation ID, parent graph
+revision digest, sorted complete record references, complete record-set digest,
+positive revision, and revision digest. Replaying a revision chain MUST reject
+gaps, forks, duplicate operation IDs, false record snapshots, missing
+dependencies, and digest mismatches.
+
+Each record reference contains `dependencies`, `key`, `kind`, `sha256`, and
+`v`. Dependencies are ordered, unique, non-reflexive keys. The complete
+reference set therefore carries enough information to reject a tombstone that
+would strand an unchanged record. `recordsSha256` hashes the ordered complete
+reference array. `graphRevisionSha256` hashes the canonical transition fields
+listed in [`canonical-json.md`](canonical-json.md); `recordRefs` are bound
+through `recordsSha256` and are not duplicated in that digest preimage.
+
+Creators, parsers, reducers, and stores MUST reject a resulting snapshot above
+65,536 records, including growth accumulated across multiple operations.
+
+## Operations
+
+An operation adds the actor ID, contract ID, canonical UTC instant, operation
+chain, space ID, and sequence to the graph transition. Sequence starts at one
+with a null parent operation digest. Every later operation increments sequence
+by one and binds the prior operation digest.
+
+`operationId` gives a writer idempotency. Reusing it with the same actor and
+changes returns the existing operation. Reusing it for different content is a
+conflict.
+
+The complete operation is at most 67,108,864 bytes. Its `operationSha256`
+hashes the payload without that field.
+
+## Concurrency
+
+A commit supplies the expected generation and operation digest. The store
+acquires an immediate transaction, reads the current head, computes the full
+transition, appends the operation, materializes records and dependencies, and
+moves the head with compare-and-swap. A stale expected head fails without a
+partial mutation.

package/spec/v1/memory.md

@@ -0,0 +1,193 @@
+# Experimental composite agent memory
+
+`@hraness/oh/experimental/memory` is the first consumer-facing composition of
+the stable store and projection contracts. It is experimental API, not a new
+ontology or a third storage authority.
+
+## One kernel, two authorities
+
+A host MUST bind two distinct physical authorities before it creates the
+facade:
+
+- a working-profile store, writable only through codec-enforced semantic
+  bundles; and
+- a canonical-profile store pinned at one exact host-selected head and never
+  writable through the returned agent object.
+
+The host supplies opaque authority IDs plus the exact expected binding digests.
+The factory rejects equal authority IDs, a binding mismatch, or the wrong
+profile. Authority IDs identify custody in results without revealing a database
+path, URL, credential, or purge handle. An Oh space, a semantic context, a
+runtime tenant/session, and a physical authority remain different boundaries.
+The host also binds the working actor, every named program's purpose, and every
+named nomination route. None of those authority-bearing labels comes from
+agent input.
+
+The returned object exposes only `remember`, `query`, `explain`, and
+`nominate`. It has no generic commit, store selection, path, sync, rule
+registration, canonical write, or purge operation.
+
+`remember` accepts only an expected working head, semantic puts and tombstones,
+and an idempotency request ID. The facade supplies its host-bound actor, uses
+its non-regressing host clock, derives the operation ID, and returns an
+immutable, locator-free receipt with the working authority ID, binding digest,
+resulting complete head, operation digest, actor, and actual instant. It never
+returns raw operation changes or accepts a caller-asserted actor or timestamp.
+
+## Composite projection
+
+Every query reads the current working head and the factory-pinned canonical
+head. It builds a disposable composite dataset with lane-tagged
+`memory.record` and `memory.dependency` facts. Equal logical keys with different
+record digests produce an explicit `memory.conflict` fact and result entry;
+working data never shadows canonical data by recency. Equal digests produce
+`memory.agreement`.
+
+Trusted host code may register digest-identified domain fact extractors. Each
+extractor declares a disjoint set of relations it owns. The facade supplies a
+deeply immutable record and its exact physical source, bounds invocation and
+output counts, and forbids custom ownership of reserved `memory.*` or `oh.*`
+relations. Every fact proof identifies the built-in fact pack or exact domain
+extractor ID and digest that emitted it. Trusted host code also registers a
+bounded set of parsed rule-pack/query pairs and their fixed purposes under
+names. Agent input selects a name; it cannot submit a purpose, rule, query AST,
+or inert validity label.
+
+The composite identity binds:
+
+- both opaque authority IDs, binding digests, complete heads, projection
+  snapshots, and lane dataset digests;
+- the composite fact dataset;
+- the named program, exact rule pack and query;
+- evaluation and engine identity inherited from the projection result;
+- the host-bound program purpose and fixed visible-conflict policy.
+
+Changing any of these values produces a different memory digest and a full
+rebuild. Results and proofs remain `derived`. A rule cannot upgrade the
+authority of its premises. Each public row is labeled from its visible physical
+premise lanes; a truncated or missing witness is `unknown` rather than
+silently canonical. Returned result, row, value, proof, source, and receipt
+graphs are detached and deeply immutable, so a caller cannot mutate bytes after
+their digest or explanation capability is issued.
+
+## Additive parameterized pagination (V2 experimental API)
+
+`createOhMemoryAgentV2` is an additive experimental query surface. It does not
+change a V1 request, result, digest preimage, factory, or type. Its `remember`
+and `nominate` methods continue to use the V1 semantic-bundle and nomination
+contracts. Only its `query` and `explain` envelopes use V2.
+
+A V2 named program is still entirely host-owned. In addition to the fixed
+purpose, rule pack, query, and extractor registry, the host declares:
+
+- the exact query-body variables that may receive parameters;
+- every projection evaluation limit;
+- the maximum complete result row count;
+- a page size of at most 256 rows; and
+- a canonical byte ceiling for each outward page.
+
+The host query limit MUST equal the declared maximum row count. A parameter
+variable MUST occur in the query body and MUST NOT be a projected output
+variable. Agent input supplies one exact object of bounded JSON primitive
+values for those names plus a program ID and either `null` or a continuation.
+It cannot supply a purpose, rule, query AST, evaluator option, page size, or
+source selector. Binding substitutes constants only into the fixed query body;
+the rules and projected output remain the registered program.
+
+The V2 identity includes the canonical bindings and their digest, the template
+and bound query digests, the complete program digest, and the same physical
+source and projection identities as V1. Thus a parameter value is part of both
+the projection identity and the memory identity, not an unrecorded filter.
+This supports a host extractor that emits bounded primitive value chunks while
+a named program binds `lane` and `key` and projects only chunk position and
+chunk content. Each chunk remains subject to the V1 16 KiB atom limit and the
+extractor's existing count and source rules.
+
+The evaluator computes one canonical, ordered result no larger than the
+host-declared row limit before it selects a page. A projection `query-limit` or
+`result-bytes` truncation returns no page. The outward page reports its start,
+end, configured and returned row counts, total rows, `hasMore`, `complete` or
+`partial` status, and explicit empty truncation evidence. Its configured slice
+must fit the host-declared page byte ceiling; the facade fails closed instead
+of silently shortening the slice. Every returned page therefore has
+`truncation.truncated: false`; `partial` means more exact pages exist, not that
+the projection is incomplete. Proof-budget truncation remains visible on
+the affected row as `proofsTruncated` and yields `unknown` premise authority,
+as in V1.
+
+A continuation is an authenticated bearer cursor, not knowledge authority. Its
+canonical envelope contains an unsigned cursor identity, a public
+`continuationSha256` digest of that identity, and a domain-separated
+HMAC-SHA-256. The identity binds the next offset to the exact program, bindings,
+complete projection result, page size, total row count, and composite memory
+identity. The HMAC makes only host-issued offsets usable; recomputing the public
+digest does not issue a cursor. The envelope is authenticated, not encrypted,
+and the same token can be replayed for the same exact page.
+
+By default the facade generates a private random continuation key, so its
+cursors are scoped to that facade instance. A host that must reconstruct the
+facade or route a cursor to another replica supplies the same 32 through 64 raw
+key bytes through `continuationKey`; the factory clones those bytes. The host
+keeps that key out of agent input and persisted results. Changing the key
+invalidates outstanding cursors.
+
+The request parser first establishes an exact shallow envelope, a bounded
+primitive binding map, and bounded strings before canonical serialization.
+After resolving the registered program and exact bindings, it authenticates a
+continuation and checks its program, binding, page-size, range, and alignment
+before reading the working store, invoking extractors, evaluating rules, or
+mapping proofs. Every valid continued call then rereads the current working
+head and rebuilds the projection. A head, source, result, or row-count change
+fails with an integrity error before proof mapping rather than mixing pages
+from two snapshots.
+
+An outward result publishes `continuationSha256` beside the opaque token, or
+`null` beside `null` on the final page. `resultSha256` commits that deterministic
+digest instead of the key-dependent token, so the same exact result identity is
+stable across signing keys. The actual token still counts toward the outward
+page-byte ceiling. A V2 explanation capability retains only its exact outward
+page and mapped physical proofs, and requires that page's result digest and
+page-local row index.
+
+## Explanations and nominations
+
+Query returns an opaque, random, short-lived explanation capability bound to
+that exact deterministic result. Its expiry uses a non-regressing monotonic
+clock; the wall-clock instant is display metadata. A capability may explain
+multiple rows until expiry or eviction. Count, per-entry bytes, and aggregate
+retained evidence are bounded. `explain` also requires the exact result digest
+and row index. It maps every projection fact witness back to an authority ID,
+binding digest, complete pinned head, lane, original record key and digest. A
+wrong, expired, evicted, or result-mismatched capability fails closed.
+
+`nominate` selects one host-registered route by opaque name, then exports and
+re-verifies an exact dependency closure and exact requested root set from the
+current working head. Its
+output is only a content-addressed `prepared` proposal for that route's fixed
+destination purpose. It does not sync the working operation chain, mutate the
+canonical store, import a derived tuple, grant rights, record a review, or turn
+a proposed assertion into reviewed knowledge. Destination-owned application
+code must perform those steps under its own policy and compare-and-swap head.
+
+## Lifecycle and custody boundary
+
+Oh deliberately does not choose a tenant, session, retention deadline,
+physical database, credential, scheduler, or backup policy. The application
+host owns those lifecycle controls and retains the separate working store host
+object. Purge removes a working authority through that host-only
+capability; tombstoning is not erasure because operation history retains prior
+bytes. Database credentials or same-UID filesystem access remain outside this
+API boundary.
+
+The facade requests at most 8,192 records per lane, rejects a lane snapshot
+over 32 MiB, rejects a remember request over 8 MiB, bounds extractor
+invocations and emitted facts, limits the public result to 32 MiB, and retains
+at most 64 MiB of explanation evidence. A trusted store still constructs the
+snapshot before returning it, and a trusted synchronous fact extractor can
+consume time or temporary memory before it returns. Provider response limits,
+host storage quotas, callback review, isolation, deadlines, and cancellation
+remain application responsibilities.
+
+Suss is an optional differential evaluator behind the separate projection
+compatibility subpath. The memory facade uses the package-owned bounded
+reference evaluator. Cozo is neither evaluated nor loaded.

package/spec/v1/migration.md

@@ -0,0 +1,92 @@
+# Compatibility and migration V1
+
+This document defines the supported migration path for one conforming Oh V1
+space to another storage location or Oh installation. Source and target MUST
+use contract `oh.ontology.v1` with contract digest
+`e53ae573c2af417082be9f554d0f6f3e317f054daf745181f462608e3f622594` and
+the same space ID.
+
+V1 does not ship a cross-contract transformer. A different contract digest,
+protocol identifier, or space ID fails closed before an operation is applied.
+
+## Preserved authority
+
+The append-only operation chain is the migration unit. Every imported operation
+MUST retain its canonical fields, record envelopes, logical keys, dependencies,
+sequence, parent digest, record-set digest, graph-revision digest, and operation
+digest. A migration MUST NOT rename identifiers, rewrite record values, replace
+timestamps, recompute operations under a different contract, or reconstruct the
+chain from current-row snapshots.
+
+SQLite current-record and dependency tables are checked materializations of the
+operation chain. Search documents, FTS5 rows, and the QMD semantic directory are
+derived state and are not migration authority.
+
+## Offline migration
+
+Use the shipped CLI to move a space:
+
+1. Stop or coordinate writers to keep the source head stable during export.
+2. Run `oh contract` and confirm its printed contract ID and digest match the
+   required values above. Then run `oh verify --db <source> --space <space>`
+   against the source database and space.
+3. Initialize an empty target with the same space ID.
+4. Export operations in ascending sequence with
+   `oh sync export --after <sequence> --limit <count>`. The limit MUST be from
+   1 through 1,000. Begin after sequence `0` and continue from the last exported
+   sequence until the bundle is empty.
+5. Transfer each complete JSON bundle without changing its parsed content.
+6. Import the bundles in order with `oh sync import --file <path>`. Import
+   verifies the protocol, contract digest, bundle digest, space ID, operation
+   digests, contiguous sequence, parent head, and reproduced graph head.
+7. Run `oh verify` against the target.
+8. Compare the source and target `head` objects returned by `oh verify`. The
+   `generation`, `sequence`, `operationSha256`, `graphRevisionSha256`, and
+   `recordsSha256` values MUST match exactly before the target becomes
+   authoritative.
+
+Re-importing an operation already present with the same digest and canonical
+content is idempotent. An operation that does not extend the target head is a
+conflict. Equal sequence numbers with different operation digests are also a
+conflict. Oh does not merge divergent histories automatically.
+
+## Connected migration
+
+`synchronizeOhStoreV1` provides the same fast-forward rule through an
+`OhOperationSyncTransportV1`. The transport handshake compares the complete V1
+contract manifest before exchanging operations. Settlement succeeds only when
+both heads have the same sequence and operation digest. Applications own
+transport credentials, availability, retries, backups, and any explicit merge
+policy.
+
+## Search state
+
+Keyword search remains available from the SQLite store after operation import.
+Semantic state MAY be rebuilt with the exact profile in
+[`embedding-profile.json`](embedding-profile.json). A semantic result is current
+only after it rejoins a record with the same record digest. Copying a semantic
+directory does not establish migration parity.
+
+## Rollback
+
+Keep the verified source database read-only until the target head has matched
+and the application has accepted the cutover. If the target fails verification
+or serving checks, restore routing to that unchanged source. Do not make
+rollback depend on reversing a content or identifier rewrite.
+
+SQLite schema migrations are separate from space transfer. The store records
+each applied migration name and SQL digest in `oh_migrations` and refuses to
+open when an applied version has different migration bytes.
+
+SQLite schema version 2 appends `0002_store_realms` without changing the
+released `0001_oh_core` SQL. Existing spaces remain unbound after upgrade. A
+host may bind one through the promise-based store authority; once persisted,
+the exact realm and profile bytes cannot be replaced. A purged working space
+cannot be used as a migration source or recreated under the same identifier.
+
+The direct libSQL authority has its own `oh_authority_` schema digest. It emits
+the same V1 record and operation bytes, but it is not a destination for the
+offline CLI import procedure above. Applications moving authority between
+adapters MUST prove an exact complete operation chain and matching head through
+a separately reviewed migration workflow. A dependency-closure capsule is a
+selective content export for adoption, not proof of full authority migration.

package/spec/v1/ontology.json

@@ -0,0 +1,55 @@
+{
+  "contractId": "oh.ontology.v1",
+  "idPatterns": {
+    "assertion": "^kast_[a-z0-9]{24}$",
+    "entity": "^kent_[a-z0-9]{24}$",
+    "evidence": "^kevd_[a-z0-9]{24}$",
+    "inquiry": "^kinq_[a-z0-9]{24}$"
+  },
+  "kernelConcepts": [
+    {
+      "code": "entity",
+      "description": "A stable identity anchor for something that can be referred to.",
+      "label": "Entity"
+    },
+    {
+      "code": "statement",
+      "description": "An immutable proposition with a subject, predicate, object, and qualifiers.",
+      "label": "Statement"
+    },
+    {
+      "code": "assertion",
+      "description": "An attributable stance toward a statement.",
+      "label": "Assertion"
+    },
+    {
+      "code": "evidence",
+      "description": "A typed account of how an observation bears on an assertion.",
+      "label": "Evidence"
+    },
+    {
+      "code": "context",
+      "description": "The scenario and dimensions in which knowledge applies.",
+      "label": "Context"
+    },
+    {
+      "code": "inquiry",
+      "description": "A question and its durable investigation trail.",
+      "label": "Inquiry"
+    },
+    {
+      "code": "projection",
+      "description": "A reproducible view derived from exact knowledge.",
+      "label": "Projection"
+    }
+  ],
+  "limits": {
+    "dimensions": 64,
+    "listValues": 256,
+    "qualifiers": 128,
+    "statementBytes": 262144,
+    "textBytes": 65536
+  },
+  "ontologyVersion": "1.0.0",
+  "v": 1
+}

package/spec/v1/ontology.md

@@ -0,0 +1,80 @@
+# Ontology V1
+
+Ontology V1 is identified by `oh.ontology.v1` and version `1.0.0`. Its contract
+manifest digest is
+`e53ae573c2af417082be9f554d0f6f3e317f054daf745181f462608e3f622594`.
+
+## Kernel concepts
+
+| Concept | Meaning |
+| --- | --- |
+| Entity | A stable identity anchor for something that can be referred to. |
+| Statement | An immutable proposition with a subject, predicate, object, and qualifiers. |
+| Assertion | An attributable stance toward a statement. |
+| Evidence | A typed account of how an observation bears on an assertion. |
+| Context | The scenario and dimensions in which knowledge applies. |
+| Inquiry | A question and its durable investigation trail. |
+| Projection | A reproducible view derived from exact knowledge. |
+
+The kernel separates a proposition from a person's stance toward it, evidence
+from the assertion it bears on, and authored knowledge from a derived view.
+Product vocabularies can refine these concepts without changing the graph
+envelope.
+
+## Identities
+
+V1 retains four opaque identity grammars:
+
+| Identity | Pattern |
+| --- | --- |
+| Entity | `kent_[a-z0-9]{24}` |
+| Assertion | `kast_[a-z0-9]{24}` |
+| Evidence | `kevd_[a-z0-9]{24}` |
+| Inquiry | `kinq_[a-z0-9]{24}` |
+
+These identifiers are opaque. A consumer MUST NOT infer time, authorship, or
+ordering from their suffixes.
+
+Schema references contain the exact `namespace`, `code`, positive `revision`,
+`schemaSha256`, and `v: 1`. Namespaces and codes use lowercase safe-code
+segments separated by `.`, `_`, `:`, `/`, or `-`.
+
+## Values
+
+A `KnowledgeValueV1` is one of:
+
+- an entity reference;
+- NFC text with a lowercase BCP 47-style language tag;
+- a bounded string or boolean;
+- a canonical integer or decimal represented as a string;
+- a canonical absolute URI without credentials and without the `data`, `file`,
+  or `javascript` scheme;
+- a list that preserves order;
+- a set in strict canonical order with no duplicates; or
+- an extension bound to a schema, canonicalizer digest, canonical value, media
+  type, and value digest.
+
+Lists and sets contain at most 256 values and nest at most eight levels.
+General text is at most 65,536 UTF-8 bytes.
+
+## Contexts, statements, and inquiries
+
+A context contains at most 64 canonically ordered, unique predicate-value
+dimensions and one scenario: `actual`, `counterfactual`, `hypothetical`, or
+`planned`. `contextSha256` binds the complete context payload.
+
+A statement binds an entity subject, schema predicate, typed object, and at
+most 128 canonically ordered, unique qualifiers. Its canonical payload is at
+most 262,144 UTF-8 bytes. `statementSha256` binds that payload.
+
+An inquiry binds its opaque ID, author entity, question, answer form, language,
+privacy, status, optional context digest, creation instant, and ordered parent
+inquiry IDs. The creation instant uses exact UTC millisecond form such as
+`2026-08-27T12:00:00.000Z`.
+
+## Errors
+
+Ontology parsers return a field and one stable issue class:
+`dependency-missing`, `digest-mismatch`, `invalid-input`, `limit-exceeded`, or
+`noncanonical-input`. A result identifies a contract failure, not whether the
+underlying research claim is true.

package/spec/v1/operation.schema.json

@@ -0,0 +1,138 @@
+{
+  "$defs": {
+    "change": {
+      "oneOf": [
+        {
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "put"
+            },
+            "record": {
+              "$ref": "./record.schema.json"
+            },
+            "v": {
+              "const": 1
+            }
+          },
+          "required": [
+            "kind",
+            "record",
+            "v"
+          ],
+          "type": "object"
+        },
+        {
+          "additionalProperties": false,
+          "properties": {
+            "key": {
+              "$ref": "#/$defs/recordKey"
+            },
+            "kind": {
+              "const": "tombstone"
+            },
+            "priorSha256": {
+              "$ref": "#/$defs/sha256"
+            },
+            "v": {
+              "const": 1
+            }
+          },
+          "required": [
+            "key",
+            "kind",
+            "priorSha256",
+            "v"
+          ],
+          "type": "object"
+        }
+      ]
+    },
+    "recordKey": {
+      "maxLength": 512,
+      "pattern": "^[a-z][a-z0-9]*(?:[._:/-][a-z0-9]+)*$",
+      "type": "string"
+    },
+    "safeCode": {
+      "maxLength": 128,
+      "pattern": "^[a-z][a-z0-9]*(?:[._:/-][a-z0-9]+)*$",
+      "type": "string"
+    },
+    "sha256": {
+      "pattern": "^[a-f0-9]{64}$",
+      "type": "string"
+    }
+  },
+  "$id": "https://oh.computer/spec/v1/operation.schema.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$comment": "Runtime conformance additionally requires canonical ordered unique changes, a contiguous parent chain, exact graph and record-set digests, the 64 MiB byte bound, and a recomputed operationSha256.",
+  "additionalProperties": false,
+  "properties": {
+    "actorId": {
+      "$ref": "#/$defs/safeCode"
+    },
+    "changes": {
+      "items": {
+        "$ref": "#/$defs/change"
+      },
+      "maxItems": 8192,
+      "minItems": 1,
+      "type": "array"
+    },
+    "contractId": {
+      "const": "oh.ontology.v1"
+    },
+    "graphRevisionSha256": {
+      "$ref": "#/$defs/sha256"
+    },
+    "instant": {
+      "pattern": "^[0-9]{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12][0-9]|3[01])T(?:[01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\\.[0-9]{3}Z$",
+      "type": "string"
+    },
+    "operationId": {
+      "$ref": "#/$defs/safeCode"
+    },
+    "operationSha256": {
+      "$ref": "#/$defs/sha256"
+    },
+    "parentOperationSha256": {
+      "anyOf": [
+        {
+          "type": "null"
+        },
+        {
+          "$ref": "#/$defs/sha256"
+        }
+      ]
+    },
+    "recordsSha256": {
+      "$ref": "#/$defs/sha256"
+    },
+    "sequence": {
+      "minimum": 1,
+      "type": "integer"
+    },
+    "spaceId": {
+      "$ref": "#/$defs/safeCode"
+    },
+    "v": {
+      "const": 1
+    }
+  },
+  "required": [
+    "actorId",
+    "changes",
+    "contractId",
+    "graphRevisionSha256",
+    "instant",
+    "operationId",
+    "operationSha256",
+    "parentOperationSha256",
+    "recordsSha256",
+    "sequence",
+    "spaceId",
+    "v"
+  ],
+  "title": "Oh operation V1",
+  "type": "object"
+}