@kya-os/mcp 1.10.0 → 1.11.0

package/schemas/audit-anchor-receipt.schema.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0",
+  "title": "KYA-OS Supporting Checkpoint Anchor Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "kind", "providerId", "checkpointDigest", "issuedAt"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0" },
+    "kind": { "enum": ["worm", "rfc3161", "scitt"] },
+    "providerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "checkpointDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "issuedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "receiptData": { "type": "string", "minLength": 1, "maxLength": 65536 }
+  }
+}

package/schemas/audit-bundle-manifest.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0",
+  "title": "KYA-OS Audit Bundle Manifest Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "kyaUniqueProperty": { "array": "inventory", "property": "path" },
+  "required": ["schema", "bundleId", "formatVersion", "selections", "exporter", "purpose", "exportedAt", "verificationPolicyDigest", "inventory", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0" },
+    "bundleId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "formatVersion": { "const": "1.0.0" },
+    "selections": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/selection" } },
+    "exporter": { "$ref": "#/$defs/signerRef" },
+    "purpose": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "exportedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "verificationPolicyDigest": { "$ref": "#/$defs/digest" },
+    "inventory": { "type": "array", "maxItems": 10000, "items": { "$ref": "#/$defs/inventoryItem" } },
+    "integritySuite": { "const": "KYA-AUDIT-BUNDLE-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "selection": {
+      "type": "object", "additionalProperties": false,
+      "kyaOrderedDecimalRange": { "first": "firstSequence", "last": "lastSequence" },
+      "required": ["ledgerId", "ledgerEpochId", "firstSequence", "lastSequence", "expectedHeadDigest", "checkpointTreeSizes"],
+      "properties": {
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "firstSequence": { "$ref": "#/$defs/decimal" },
+        "lastSequence": { "$ref": "#/$defs/decimal" },
+        "expectedHeadDigest": { "$ref": "#/$defs/digest" },
+        "checkpointTreeSizes": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/decimal" } }
+      }
+    },
+    "inventoryItem": {
+      "oneOf": [
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["path", "mediaType", "disposition", "digest", "size"],
+          "properties": {
+            "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+            "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "disposition": { "const": "included" },
+            "digest": { "$ref": "#/$defs/digest" },
+            "size": { "$ref": "#/$defs/decimal" }
+          }
+        },
+        {
+          "type": "object", "additionalProperties": false,
+          "required": ["path", "mediaType", "disposition", "reasonCode"],
+          "properties": {
+            "path": { "type": "string", "minLength": 1, "maxLength": 1024 },
+            "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "disposition": { "enum": ["redacted", "disposed", "unavailable", "policy_excluded"] },
+            "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 }
+          }
+        }
+      ]
+    }
+  }
+}

package/schemas/audit-checkpoint.schema.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0",
+  "title": "KYA-OS Audit Checkpoint Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "kyaOrderedDecimalRange": { "first": "firstSequence", "last": "lastSequence" },
+  "required": ["schema", "checkpointId", "ledgerId", "ledgerEpochId", "treeSize", "firstSequence", "lastSequence", "rootDigest", "headEntryDigest", "previousCheckpointDigest", "createdAt", "issuer", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0" },
+    "checkpointId": { "type": "string", "minLength": 1, "maxLength": 512 },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "treeSize": { "$ref": "#/$defs/nonzeroDecimal" },
+    "firstSequence": { "$ref": "#/$defs/decimal" },
+    "lastSequence": { "$ref": "#/$defs/decimal" },
+    "rootDigest": { "$ref": "#/$defs/digest" },
+    "headEntryDigest": { "$ref": "#/$defs/digest" },
+    "previousCheckpointDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "createdAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "issuer": { "$ref": "#/$defs/signerRef" },
+    "integritySuite": { "const": "KYA-AUDIT-RFC9162-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "nonzeroDecimal": { "type": "string", "maxLength": 20, "pattern": "^[1-9][0-9]*$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}

package/schemas/audit-consistency-proof.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/consistency-proof/v1.0.0",
+  "title": "KYA-OS RFC 9162 Consistency Proof v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["oldTreeSize", "newTreeSize", "auditPath"],
+  "properties": {
+    "oldTreeSize": { "$ref": "#/$defs/decimal" },
+    "newTreeSize": { "$ref": "#/$defs/decimal" },
+    "auditPath": { "type": "array", "items": { "$ref": "#/$defs/digest" } }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  }
+}

package/schemas/audit-entry.schema.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0",
+  "title": "KYA-OS Audit Entry Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "ledgerId", "ledgerEpochId", "sequence", "previousEntryDigest", "recordedAt", "recorder", "eventDigest", "event", "evidenceManifestDigest", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0" },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "sequence": { "$ref": "#/$defs/decimal" },
+    "previousEntryDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "recordedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "recorder": { "$ref": "#/$defs/signerRef" },
+    "eventDigest": { "$ref": "#/$defs/digest" },
+    "event": { "$ref": "./audit-event.schema.json" },
+    "evidenceManifestDigest": { "$ref": "#/$defs/digest" },
+    "integritySuite": { "const": "KYA-AUDIT-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}

package/schemas/audit-event.schema.json

@@ -0,0 +1,168 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0",
+  "title": "KYA-OS Audit Producer Event v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "eventId", "eventType", "eventVersion", "binding", "occurredAt", "tenantRef", "source", "action", "outcome", "evidence", "details", "privacy"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0" },
+    "eventId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "eventType": {
+      "enum": [
+        "session.established", "session.rejected", "session.expired", "session.replay_rejected",
+        "tool.call.started", "tool.call.completed", "tool.call.failed", "tool.call.denied", "tool.call.challenged",
+        "proof.generated", "proof.verified", "proof.rejected",
+        "delegation.issued", "delegation.verified", "delegation.rejected", "delegation.revoked", "delegation.cascade_revoked", "delegation.outbound_attached",
+        "authorization.evaluated", "authorization.approved", "authorization.denied", "authorization.step_up_required", "grant.used",
+        "consent.requested", "consent.approved", "consent.denied", "credential.required", "credential.verified", "credential.failed",
+        "key.rotated", "policy.changed", "configuration.changed", "integrity_suite.transitioned",
+        "ledger.epoch.started", "ledger.epoch.transitioned", "checkpoint.created", "checkpoint.anchored", "checkpoint.anchor_failed", "evidence.disposed", "projection.reconciled",
+        "audit.source_high_water", "audit.accessed", "audit.exported", "legal_hold.applied", "retention.executed"
+      ]
+    },
+    "eventVersion": { "const": "1.0.0" },
+    "binding": { "type": "string", "maxLength": 256, "pattern": "^urn:kya-os:audit-binding:[a-z0-9][a-z0-9._:-]*$" },
+    "occurredAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "tenantRef": { "$ref": "#/$defs/partyRef" },
+    "source": {
+      "type": "object", "additionalProperties": false,
+      "required": ["producer", "sourceId"],
+      "properties": {
+        "producer": { "$ref": "#/$defs/partyRef" },
+        "sourceId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "sourceSequence": { "$ref": "#/$defs/decimal" },
+        "previousSourceEventDigest": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "correlationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "causationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "trace": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "traceId": { "type": "string", "pattern": "^[a-f0-9]{32}$" },
+        "spanId": { "type": "string", "pattern": "^[a-f0-9]{16}$" }
+      }
+    },
+    "session": {
+      "type": "object", "additionalProperties": false, "required": ["ref"],
+      "properties": {
+        "ref": { "$ref": "#/$defs/partyRef" },
+        "handshakeNonceCommitment": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "actor": { "$ref": "#/$defs/partyRef" },
+    "responsibleParty": { "$ref": "#/$defs/partyRef" },
+    "resource": { "$ref": "#/$defs/partyRef" },
+    "action": {
+      "type": "object", "additionalProperties": false, "required": ["category"],
+      "properties": {
+        "category": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "name": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "detailRef": { "$ref": "#/$defs/evidenceRef" }
+      }
+    },
+    "outcome": { "enum": ["succeeded", "failed", "denied", "challenged", "unknown"] },
+    "reason": {
+      "type": "object", "additionalProperties": false, "required": ["code"],
+      "properties": {
+        "code": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "detailRef": { "$ref": "#/$defs/evidenceRef" }
+      }
+    },
+    "authorization": {
+      "type": "object", "additionalProperties": false, "required": ["source", "decision"],
+      "properties": {
+        "source": { "enum": ["delegation", "grant", "anonymous", "policy"] },
+        "decision": { "enum": ["allowed", "denied", "step_up_required", "needs_authorization"] },
+        "scopeId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "delegationRef": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "delegationCredentialDigest": { "$ref": "#/$defs/digest" },
+        "delegationChainDigests": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/digest" } },
+        "statusEvidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } },
+        "grantRef": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyVersion": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyDigest": { "$ref": "#/$defs/digest" },
+        "verificationCode": { "type": "string", "minLength": 1, "maxLength": 128 }
+      }
+    },
+    "proof": { "$ref": "#/$defs/evidenceRef" },
+    "evidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } },
+    "details": { "$ref": "#/$defs/details" },
+    "privacy": {
+      "type": "object", "additionalProperties": false,
+      "required": ["classification", "retentionClass"],
+      "properties": {
+        "classification": { "enum": ["public", "internal", "confidential", "restricted"] },
+        "retentionClass": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "legalHold": { "type": "string", "minLength": 1, "maxLength": 256 }
+      }
+    }
+  },
+  "allOf": [
+    { "if": { "properties": { "eventType": { "pattern": "^session\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "session" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^tool\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "tool" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^proof\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "proof" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^delegation\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "delegation" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(authorization\\.|grant\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "authorization" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(consent\\.|credential\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "consent" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(key\\.|policy\\.|configuration\\.|integrity_suite\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "key" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(ledger\\.|checkpoint\\.|evidence\\.|projection\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "ledger" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(audit\\.|legal_hold\\.|retention\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "administration" } } } } } }
+  ],
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "evidenceRef": {
+      "type": "object", "additionalProperties": false,
+      "required": ["objectId", "ciphertextDigest", "mediaType", "size", "encryption"],
+      "properties": {
+        "objectId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ciphertextDigest": { "$ref": "#/$defs/digest" },
+        "plaintextCommitment": { "$ref": "#/$defs/digest" },
+        "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "size": { "$ref": "#/$defs/decimal" },
+        "encryption": {
+          "type": "object", "additionalProperties": false,
+          "required": ["suite", "keyId", "nonce", "aadDigest"],
+          "properties": {
+            "suite": { "const": "A256GCM" },
+            "keyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "nonce": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "aadDigest": { "$ref": "#/$defs/digest" }
+          }
+        }
+      }
+    },
+    "partyRef": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["kind", "did"], "properties": { "kind": { "const": "public_did" }, "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "did"], "properties": { "kind": { "const": "pairwise_did" }, "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "value", "keyId"], "properties": { "kind": { "const": "keyed_commitment" }, "value": { "$ref": "#/$defs/digest" }, "keyId": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "ref"], "properties": { "kind": { "const": "evidence_ref" }, "ref": { "$ref": "#/$defs/evidenceRef" } } }
+      ]
+    },
+    "details": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "session" }, "phase": { "enum": ["established", "rejected", "expired", "replay_rejected"] }, "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase", "attempt"], "properties": { "family": { "const": "tool" }, "phase": { "enum": ["started", "completed", "failed", "denied", "challenged"] }, "attempt": { "$ref": "#/$defs/decimal" }, "idempotencyRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "proof" }, "phase": { "enum": ["generated", "verified", "rejected"] }, "proofDigest": { "$ref": "#/$defs/digest" }, "verificationCode": { "type": "string", "minLength": 1, "maxLength": 128 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase", "delegationRef"], "properties": { "family": { "const": "delegation" }, "phase": { "enum": ["issued", "verified", "rejected", "revoked", "cascade_revoked", "outbound_attached"] }, "delegationRef": { "type": "string", "minLength": 1, "maxLength": 256 }, "parentRef": { "type": "string", "minLength": 1, "maxLength": 256 }, "statusEvidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "authorization" }, "phase": { "enum": ["evaluated", "approved", "denied", "step_up_required", "grant_used"] }, "policyDigest": { "$ref": "#/$defs/digest" }, "grantRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "consent" }, "phase": { "enum": ["requested", "approved", "denied", "credential_required", "credential_verified", "credential_failed"] }, "consentRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "key" }, "phase": { "enum": ["rotated", "policy_changed", "configuration_changed", "integrity_suite_transitioned"] }, "previousSigner": { "$ref": "#/$defs/signerRef" }, "nextSigner": { "$ref": "#/$defs/signerRef" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "ledger" }, "phase": { "enum": ["epoch_started", "epoch_transitioned", "checkpoint_created", "checkpoint_anchored", "checkpoint_anchor_failed", "evidence_disposed", "projection_reconciled"] }, "checkpointDigest": { "$ref": "#/$defs/digest" }, "previousEpochId": { "type": "string", "minLength": 1, "maxLength": 256 }, "previousTerminalCheckpointDigest": { "$ref": "#/$defs/digest" }, "successorEpochIds": { "type": "array", "maxItems": 256, "items": { "type": "string", "minLength": 1, "maxLength": 256 } }, "targetEvidenceRef": { "$ref": "#/$defs/evidenceRef" } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "administration" }, "phase": { "enum": ["source_high_water", "accessed", "exported", "legal_hold_applied", "retention_executed"] }, "purpose": { "type": "string", "minLength": 1, "maxLength": 256 }, "sourceSequence": { "$ref": "#/$defs/decimal" }, "selectionDigest": { "$ref": "#/$defs/digest" } } }
+      ]
+    }
+  }
+}

package/schemas/audit-inclusion-proof.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/inclusion-proof/v1.0.0",
+  "title": "KYA-OS RFC 9162 Inclusion Proof v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["leafIndex", "treeSize", "auditPath"],
+  "properties": {
+    "leafIndex": { "$ref": "#/$defs/decimal" },
+    "treeSize": { "$ref": "#/$defs/decimal" },
+    "auditPath": { "type": "array", "items": { "$ref": "#/$defs/digest" } }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  }
+}

package/schemas/audit-observation.schema.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0",
+  "title": "KYA-OS Independent Checkpoint Observation Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["core", "observationDigest", "jws"],
+  "properties": {
+    "core": { "$ref": "#/$defs/core" },
+    "observationDigest": { "$ref": "#/$defs/digest" },
+    "jws": { "type": "string", "minLength": 1, "maxLength": 4096 }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signer": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "core": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schema", "observerId", "observer", "ledgerId", "ledgerEpochId", "checkpointDigest", "treeSize", "observedAt", "previousObservationDigest"],
+      "properties": {
+        "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0" },
+        "observerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "observer": { "$ref": "#/$defs/signer" },
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "checkpointDigest": { "$ref": "#/$defs/digest" },
+        "treeSize": { "$ref": "#/$defs/decimal" },
+        "observedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "previousObservationDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] }
+      }
+    }
+  }
+}

package/schemas/audit-receipt.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0",
+  "title": "KYA-OS Audit Recorder Receipt Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "ledgerId", "ledgerEpochId", "sequence", "eventId", "entryDigest", "previousEntryDigest", "recordedAt", "recorder", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0" },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "sequence": { "$ref": "#/$defs/decimal" },
+    "eventId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "entryDigest": { "$ref": "#/$defs/digest" },
+    "previousEntryDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "recordedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "recorder": { "$ref": "#/$defs/signerRef" },
+    "integritySuite": { "const": "KYA-AUDIT-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}

package/schemas/audit-verification-policy.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-policy/v1.0.0",
+  "title": "KYA-OS Out-of-Band Audit Verification Policy v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["policyId", "trustedLedgerEpochs", "trustedObservers", "authorizedExporters", "acceptedIntegritySuites", "acceptedAlgorithms", "keyRevocationMode"],
+  "properties": {
+    "policyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "trustedLedgerEpochs": { "type": "array", "items": { "$ref": "#/$defs/ledgerTrust" } },
+    "trustedObservers": { "type": "array", "items": { "$ref": "#/$defs/keyPolicy" } },
+    "trustedSupportingAnchors": { "type": "array", "items": { "$ref": "#/$defs/anchorTrust" } },
+    "authorizedExporters": { "type": "array", "items": { "$ref": "#/$defs/exporter" } },
+    "acceptedIntegritySuites": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 128 }, "uniqueItems": true },
+    "acceptedAlgorithms": { "type": "array", "minItems": 1, "items": { "enum": ["EdDSA", "ES256"] }, "uniqueItems": true },
+    "keyRevocationMode": { "enum": ["as_observed", "current", "both"] },
+    "requiredCheckpointFreshnessMs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "requiredAuditProfile": { "enum": ["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"] }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signer": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "keyPolicy": {
+      "type": "object", "additionalProperties": false, "required": ["signer"],
+      "kyaOrderedNumberRange": { "first": "validFrom", "last": "validUntil" },
+      "properties": {
+        "signer": { "$ref": "#/$defs/signer" },
+        "validFrom": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validUntil": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validFromCheckpoint": { "$ref": "#/$defs/digest" },
+        "validUntilCheckpoint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "ledgerTrust": {
+      "type": "object", "additionalProperties": false,
+      "required": ["ledgerId", "ledgerEpochId", "recorderKeys"],
+      "properties": {
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "recorderKeys": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/keyPolicy" } },
+        "validFromCheckpoint": { "$ref": "#/$defs/digest" },
+        "validUntilCheckpoint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "anchorTrust": {
+      "type": "object", "additionalProperties": false, "required": ["kind", "providerId"],
+      "properties": {
+        "kind": { "enum": ["worm", "rfc3161", "scitt"] },
+        "providerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "validFrom": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validUntil": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }
+      }
+    },
+    "exporter": {
+      "type": "object", "additionalProperties": false,
+      "required": ["signerKeys", "allowedLedgerIds", "allowedPurposes"],
+      "properties": {
+        "signerKeys": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/keyPolicy" } },
+        "allowedLedgerIds": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "uniqueItems": true },
+        "allowedPurposes": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "uniqueItems": true }
+      }
+    }
+  }
+}

package/schemas/audit-verification-report.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0",
+  "title": "KYA-OS Audit Verification Report v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "policyId", "cryptographicIntegrity", "chainIntegrity", "checkpointIntegrity", "anchorIntegrity", "scopeEvidenceCompleteness", "authorizedAsObserved", "currentAuthorization"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0" },
+    "policyId": { "type": "string", "minLength": 1 },
+    "verifiedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "cryptographicIntegrity": { "$ref": "#/$defs/dimension" },
+    "chainIntegrity": { "$ref": "#/$defs/dimension" },
+    "checkpointIntegrity": { "$ref": "#/$defs/dimension" },
+    "anchorIntegrity": { "$ref": "#/$defs/dimension" },
+    "scopeEvidenceCompleteness": { "$ref": "#/$defs/dimension" },
+    "authorizedAsObserved": { "$ref": "#/$defs/dimension" },
+    "currentAuthorization": { "$ref": "#/$defs/dimension" }
+  },
+  "$defs": {
+    "dimension": {
+      "type": "object", "additionalProperties": false, "required": ["verdict", "reasonCodes"],
+      "properties": {
+        "verdict": { "enum": ["valid", "invalid", "indeterminate"] },
+        "reasonCodes": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+      }
+    }
+  }
+}

package/schemas/well-known-mcpi.json

@@ -72,6 +72,23 @@
         "crisp": {
           "type": "boolean",
           "description": "Server supports CRISP constraint evaluation."
+        },
+        "audit": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["profile", "recorderTopology", "delivery", "journalDurability", "atomicAppend", "sourceHighWater", "merkleCheckpoints", "independentObservation", "supportingAnchors", "evidenceRetention"],
+          "properties": {
+            "profile": { "enum": ["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"] },
+            "recorderTopology": { "enum": ["none", "self-hosted", "managed", "verified-mirror"] },
+            "delivery": { "enum": ["best-effort", "buffered", "required"] },
+            "journalDurability": { "enum": ["none", "ephemeral", "durable"] },
+            "atomicAppend": { "type": "boolean" },
+            "sourceHighWater": { "type": "boolean" },
+            "merkleCheckpoints": { "type": "boolean" },
+            "independentObservation": { "type": "boolean" },
+            "supportingAnchors": { "type": "array", "items": { "enum": ["worm", "rfc3161", "scitt"] }, "uniqueItems": true },
+            "evidenceRetention": { "enum": ["none", "inline", "separate"] }
+          }
         }
       },
       "additionalProperties": true