@kya-os/mcp 1.10.1 → 1.12.0

package/schemas/audit-event.schema.json

@@ -0,0 +1,168 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0",
+  "title": "KYA-OS Audit Producer Event v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "eventId", "eventType", "eventVersion", "binding", "occurredAt", "tenantRef", "source", "action", "outcome", "evidence", "details", "privacy"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0" },
+    "eventId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "eventType": {
+      "enum": [
+        "session.established", "session.rejected", "session.expired", "session.replay_rejected",
+        "tool.call.started", "tool.call.completed", "tool.call.failed", "tool.call.denied", "tool.call.challenged",
+        "proof.generated", "proof.verified", "proof.rejected",
+        "delegation.issued", "delegation.verified", "delegation.rejected", "delegation.revoked", "delegation.cascade_revoked", "delegation.outbound_attached",
+        "authorization.evaluated", "authorization.approved", "authorization.denied", "authorization.step_up_required", "grant.used",
+        "consent.requested", "consent.approved", "consent.denied", "credential.required", "credential.verified", "credential.failed",
+        "key.rotated", "policy.changed", "configuration.changed", "integrity_suite.transitioned",
+        "ledger.epoch.started", "ledger.epoch.transitioned", "checkpoint.created", "checkpoint.anchored", "checkpoint.anchor_failed", "evidence.disposed", "projection.reconciled",
+        "audit.source_high_water", "audit.accessed", "audit.exported", "legal_hold.applied", "retention.executed"
+      ]
+    },
+    "eventVersion": { "const": "1.0.0" },
+    "binding": { "type": "string", "maxLength": 256, "pattern": "^urn:kya-os:audit-binding:[a-z0-9][a-z0-9._:-]*$" },
+    "occurredAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "tenantRef": { "$ref": "#/$defs/partyRef" },
+    "source": {
+      "type": "object", "additionalProperties": false,
+      "required": ["producer", "sourceId"],
+      "properties": {
+        "producer": { "$ref": "#/$defs/partyRef" },
+        "sourceId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "sourceSequence": { "$ref": "#/$defs/decimal" },
+        "previousSourceEventDigest": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "correlationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "causationId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "trace": {
+      "type": "object", "additionalProperties": false,
+      "properties": {
+        "traceId": { "type": "string", "pattern": "^[a-f0-9]{32}$" },
+        "spanId": { "type": "string", "pattern": "^[a-f0-9]{16}$" }
+      }
+    },
+    "session": {
+      "type": "object", "additionalProperties": false, "required": ["ref"],
+      "properties": {
+        "ref": { "$ref": "#/$defs/partyRef" },
+        "handshakeNonceCommitment": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "actor": { "$ref": "#/$defs/partyRef" },
+    "responsibleParty": { "$ref": "#/$defs/partyRef" },
+    "resource": { "$ref": "#/$defs/partyRef" },
+    "action": {
+      "type": "object", "additionalProperties": false, "required": ["category"],
+      "properties": {
+        "category": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "name": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "detailRef": { "$ref": "#/$defs/evidenceRef" }
+      }
+    },
+    "outcome": { "enum": ["succeeded", "failed", "denied", "challenged", "unknown"] },
+    "reason": {
+      "type": "object", "additionalProperties": false, "required": ["code"],
+      "properties": {
+        "code": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "detailRef": { "$ref": "#/$defs/evidenceRef" }
+      }
+    },
+    "authorization": {
+      "type": "object", "additionalProperties": false, "required": ["source", "decision"],
+      "properties": {
+        "source": { "enum": ["delegation", "grant", "anonymous", "policy"] },
+        "decision": { "enum": ["allowed", "denied", "step_up_required", "needs_authorization"] },
+        "scopeId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "delegationRef": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "delegationCredentialDigest": { "$ref": "#/$defs/digest" },
+        "delegationChainDigests": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/digest" } },
+        "statusEvidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } },
+        "grantRef": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyVersion": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "policyDigest": { "$ref": "#/$defs/digest" },
+        "verificationCode": { "type": "string", "minLength": 1, "maxLength": 128 }
+      }
+    },
+    "proof": { "$ref": "#/$defs/evidenceRef" },
+    "evidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } },
+    "details": { "$ref": "#/$defs/details" },
+    "privacy": {
+      "type": "object", "additionalProperties": false,
+      "required": ["classification", "retentionClass"],
+      "properties": {
+        "classification": { "enum": ["public", "internal", "confidential", "restricted"] },
+        "retentionClass": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "legalHold": { "type": "string", "minLength": 1, "maxLength": 256 }
+      }
+    }
+  },
+  "allOf": [
+    { "if": { "properties": { "eventType": { "pattern": "^session\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "session" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^tool\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "tool" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^proof\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "proof" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^delegation\\." } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "delegation" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(authorization\\.|grant\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "authorization" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(consent\\.|credential\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "consent" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(key\\.|policy\\.|configuration\\.|integrity_suite\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "key" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(ledger\\.|checkpoint\\.|evidence\\.|projection\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "ledger" } } } } } },
+    { "if": { "properties": { "eventType": { "pattern": "^(audit\\.|legal_hold\\.|retention\\.)" } } }, "then": { "properties": { "details": { "properties": { "family": { "const": "administration" } } } } } }
+  ],
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "evidenceRef": {
+      "type": "object", "additionalProperties": false,
+      "required": ["objectId", "ciphertextDigest", "mediaType", "size", "encryption"],
+      "properties": {
+        "objectId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ciphertextDigest": { "$ref": "#/$defs/digest" },
+        "plaintextCommitment": { "$ref": "#/$defs/digest" },
+        "mediaType": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "size": { "$ref": "#/$defs/decimal" },
+        "encryption": {
+          "type": "object", "additionalProperties": false,
+          "required": ["suite", "keyId", "nonce", "aadDigest"],
+          "properties": {
+            "suite": { "const": "A256GCM" },
+            "keyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "nonce": { "type": "string", "minLength": 1, "maxLength": 256 },
+            "aadDigest": { "$ref": "#/$defs/digest" }
+          }
+        }
+      }
+    },
+    "partyRef": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["kind", "did"], "properties": { "kind": { "const": "public_did" }, "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "did"], "properties": { "kind": { "const": "pairwise_did" }, "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "value", "keyId"], "properties": { "kind": { "const": "keyed_commitment" }, "value": { "$ref": "#/$defs/digest" }, "keyId": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["kind", "ref"], "properties": { "kind": { "const": "evidence_ref" }, "ref": { "$ref": "#/$defs/evidenceRef" } } }
+      ]
+    },
+    "details": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "session" }, "phase": { "enum": ["established", "rejected", "expired", "replay_rejected"] }, "reasonCode": { "type": "string", "minLength": 1, "maxLength": 128 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase", "attempt"], "properties": { "family": { "const": "tool" }, "phase": { "enum": ["started", "completed", "failed", "denied", "challenged"] }, "attempt": { "$ref": "#/$defs/decimal" }, "idempotencyRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "proof" }, "phase": { "enum": ["generated", "verified", "rejected"] }, "proofDigest": { "$ref": "#/$defs/digest" }, "verificationCode": { "type": "string", "minLength": 1, "maxLength": 128 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase", "delegationRef"], "properties": { "family": { "const": "delegation" }, "phase": { "enum": ["issued", "verified", "rejected", "revoked", "cascade_revoked", "outbound_attached"] }, "delegationRef": { "type": "string", "minLength": 1, "maxLength": 256 }, "parentRef": { "type": "string", "minLength": 1, "maxLength": 256 }, "statusEvidence": { "type": "array", "maxItems": 256, "items": { "$ref": "#/$defs/evidenceRef" } } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "authorization" }, "phase": { "enum": ["evaluated", "approved", "denied", "step_up_required", "grant_used"] }, "policyDigest": { "$ref": "#/$defs/digest" }, "grantRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "consent" }, "phase": { "enum": ["requested", "approved", "denied", "credential_required", "credential_verified", "credential_failed"] }, "consentRef": { "type": "string", "minLength": 1, "maxLength": 256 } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "key" }, "phase": { "enum": ["rotated", "policy_changed", "configuration_changed", "integrity_suite_transitioned"] }, "previousSigner": { "$ref": "#/$defs/signerRef" }, "nextSigner": { "$ref": "#/$defs/signerRef" }, "configurationDigest": { "$ref": "#/$defs/digest" } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "ledger" }, "phase": { "enum": ["epoch_started", "epoch_transitioned", "checkpoint_created", "checkpoint_anchored", "checkpoint_anchor_failed", "evidence_disposed", "projection_reconciled"] }, "checkpointDigest": { "$ref": "#/$defs/digest" }, "previousEpochId": { "type": "string", "minLength": 1, "maxLength": 256 }, "previousTerminalCheckpointDigest": { "$ref": "#/$defs/digest" }, "successorEpochIds": { "type": "array", "maxItems": 256, "items": { "type": "string", "minLength": 1, "maxLength": 256 } }, "targetEvidenceRef": { "$ref": "#/$defs/evidenceRef" } } },
+        { "type": "object", "additionalProperties": false, "required": ["family", "phase"], "properties": { "family": { "const": "administration" }, "phase": { "enum": ["source_high_water", "accessed", "exported", "legal_hold_applied", "retention_executed"] }, "purpose": { "type": "string", "minLength": 1, "maxLength": 256 }, "sourceSequence": { "$ref": "#/$defs/decimal" }, "selectionDigest": { "$ref": "#/$defs/digest" } } }
+      ]
+    }
+  }
+}

package/schemas/audit-inclusion-proof.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/inclusion-proof/v1.0.0",
+  "title": "KYA-OS RFC 9162 Inclusion Proof v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["leafIndex", "treeSize", "auditPath"],
+  "properties": {
+    "leafIndex": { "$ref": "#/$defs/decimal" },
+    "treeSize": { "$ref": "#/$defs/decimal" },
+    "auditPath": { "type": "array", "items": { "$ref": "#/$defs/digest" } }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  }
+}

package/schemas/audit-observation.schema.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0",
+  "title": "KYA-OS Independent Checkpoint Observation Receipt v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["core", "observationDigest", "jws"],
+  "properties": {
+    "core": { "$ref": "#/$defs/core" },
+    "observationDigest": { "$ref": "#/$defs/digest" },
+    "jws": { "type": "string", "minLength": 1, "maxLength": 4096 }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signer": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "core": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schema", "observerId", "observer", "ledgerId", "ledgerEpochId", "checkpointDigest", "treeSize", "observedAt", "previousObservationDigest"],
+      "properties": {
+        "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0" },
+        "observerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "observer": { "$ref": "#/$defs/signer" },
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "checkpointDigest": { "$ref": "#/$defs/digest" },
+        "treeSize": { "$ref": "#/$defs/decimal" },
+        "observedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "previousObservationDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] }
+      }
+    }
+  }
+}

package/schemas/audit-receipt.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0",
+  "title": "KYA-OS Audit Recorder Receipt Core v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "ledgerId", "ledgerEpochId", "sequence", "eventId", "entryDigest", "previousEntryDigest", "recordedAt", "recorder", "integritySuite"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0" },
+    "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "sequence": { "$ref": "#/$defs/decimal" },
+    "eventId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "entryDigest": { "$ref": "#/$defs/digest" },
+    "previousEntryDigest": { "oneOf": [{ "$ref": "#/$defs/digest" }, { "type": "null" }] },
+    "recordedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "recorder": { "$ref": "#/$defs/signerRef" },
+    "integritySuite": { "const": "KYA-AUDIT-JCS-SHA256-JWS-2026" }
+  },
+  "$defs": {
+    "decimal": { "type": "string", "maxLength": 20, "pattern": "^(0|[1-9][0-9]*)$" },
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signerRef": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    }
+  }
+}

package/schemas/audit-verification-policy.schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-policy/v1.0.0",
+  "title": "KYA-OS Out-of-Band Audit Verification Policy v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["policyId", "trustedLedgerEpochs", "trustedObservers", "authorizedExporters", "acceptedIntegritySuites", "acceptedAlgorithms", "keyRevocationMode"],
+  "properties": {
+    "policyId": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "trustedLedgerEpochs": { "type": "array", "items": { "$ref": "#/$defs/ledgerTrust" } },
+    "trustedObservers": { "type": "array", "items": { "$ref": "#/$defs/keyPolicy" } },
+    "trustedSupportingAnchors": { "type": "array", "items": { "$ref": "#/$defs/anchorTrust" } },
+    "authorizedExporters": { "type": "array", "items": { "$ref": "#/$defs/exporter" } },
+    "acceptedIntegritySuites": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 128 }, "uniqueItems": true },
+    "acceptedAlgorithms": { "type": "array", "minItems": 1, "items": { "enum": ["EdDSA", "ES256"] }, "uniqueItems": true },
+    "keyRevocationMode": { "enum": ["as_observed", "current", "both"] },
+    "requiredCheckpointFreshnessMs": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "requiredAuditProfile": { "enum": ["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"] }
+  },
+  "$defs": {
+    "digest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "signer": {
+      "type": "object", "additionalProperties": false, "required": ["did", "kid", "alg"],
+      "properties": {
+        "did": { "type": "string", "minLength": 5, "maxLength": 2048, "pattern": "^did:[^\\r\\n]+$" },
+        "kid": { "type": "string", "minLength": 1, "maxLength": 2304 },
+        "alg": { "enum": ["EdDSA", "ES256"] }
+      }
+    },
+    "keyPolicy": {
+      "type": "object", "additionalProperties": false, "required": ["signer"],
+      "kyaOrderedNumberRange": { "first": "validFrom", "last": "validUntil" },
+      "properties": {
+        "signer": { "$ref": "#/$defs/signer" },
+        "validFrom": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validUntil": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validFromCheckpoint": { "$ref": "#/$defs/digest" },
+        "validUntilCheckpoint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "ledgerTrust": {
+      "type": "object", "additionalProperties": false,
+      "required": ["ledgerId", "ledgerEpochId", "recorderKeys"],
+      "properties": {
+        "ledgerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "ledgerEpochId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "recorderKeys": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/keyPolicy" } },
+        "validFromCheckpoint": { "$ref": "#/$defs/digest" },
+        "validUntilCheckpoint": { "$ref": "#/$defs/digest" }
+      }
+    },
+    "anchorTrust": {
+      "type": "object", "additionalProperties": false, "required": ["kind", "providerId"],
+      "properties": {
+        "kind": { "enum": ["worm", "rfc3161", "scitt"] },
+        "providerId": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "validFrom": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+        "validUntil": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 }
+      }
+    },
+    "exporter": {
+      "type": "object", "additionalProperties": false,
+      "required": ["signerKeys", "allowedLedgerIds", "allowedPurposes"],
+      "properties": {
+        "signerKeys": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/keyPolicy" } },
+        "allowedLedgerIds": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "uniqueItems": true },
+        "allowedPurposes": { "type": "array", "minItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "uniqueItems": true }
+      }
+    }
+  }
+}

package/schemas/audit-verification-report.schema.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0",
+  "title": "KYA-OS Audit Verification Report v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "policyId", "cryptographicIntegrity", "chainIntegrity", "checkpointIntegrity", "anchorIntegrity", "scopeEvidenceCompleteness", "authorizedAsObserved", "currentAuthorization"],
+  "properties": {
+    "schema": { "const": "https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0" },
+    "policyId": { "type": "string", "minLength": 1 },
+    "verifiedAt": { "type": "integer", "minimum": 0, "maximum": 9007199254740991 },
+    "cryptographicIntegrity": { "$ref": "#/$defs/dimension" },
+    "chainIntegrity": { "$ref": "#/$defs/dimension" },
+    "checkpointIntegrity": { "$ref": "#/$defs/dimension" },
+    "anchorIntegrity": { "$ref": "#/$defs/dimension" },
+    "scopeEvidenceCompleteness": { "$ref": "#/$defs/dimension" },
+    "authorizedAsObserved": { "$ref": "#/$defs/dimension" },
+    "currentAuthorization": { "$ref": "#/$defs/dimension" }
+  },
+  "$defs": {
+    "dimension": {
+      "type": "object", "additionalProperties": false, "required": ["verdict", "reasonCodes"],
+      "properties": {
+        "verdict": { "enum": ["valid", "invalid", "indeterminate"] },
+        "reasonCodes": { "type": "array", "items": { "type": "string", "minLength": 1 }, "uniqueItems": true }
+      }
+    }
+  }
+}

package/schemas/kya-os-card.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schema.kya-os.org/v1/protocol/identity/card/v1.1.0",
   "title": "KYA-OS Entity Card",
-  "description": "A typed, DID-anchored identity card for a KYA-OS entity (mcp | agent | client | verifier | human). One canonical card is anchored by a `KyaOsEntityCard` service entry on the entity's did:web DID document and projected onto the four discovery surfaces the ecosystem already indexes (MCP server.json / catalog.json `_meta['org.kya-os/card']`, A2A AgentExtension, NANDA AgentFacts, and the MCP catalog entry). The card asserts identity + type + declared capabilities; everything trust-bearing (accountability, attested capabilities, KYC/KYB) is proven by referenced credentials, not self-claimed (claim-minimalism). The sender-constrained holder-of-key proof (`org.kya-os/proof@1`) is NEVER on the static card — it rides per-request `_meta` on top (see detached-proof); `proofProfile` only names the profile a verifier should expect.",
+  "description": "A typed, DID-anchored identity card for a KYA-OS entity (mcp | agent | client | verifier | human). One canonical card is anchored by a `KyaOsEntityCard` service entry on the entity's did:web DID document and projected onto the four discovery surfaces the ecosystem already indexes (MCP server.json / catalog.json `_meta['org.kya-os/card']`, A2A AgentExtension, NANDA AgentFacts, and the MCP catalog entry). The card asserts identity + type + declared capabilities; everything trust-bearing (accountability, attested capabilities, KYC/KYB) is proven by referenced credentials, not self-claimed (claim-minimalism). The sender-constrained holder-of-key proof (`org.kya-os/proof.v1`) is NEVER on the static card — it rides per-request `_meta` on top (see detached-proof); `proofProfile` only names the profile a verifier should expect.",
   "type": "object",
   "required": ["id", "entityType", "name"],
   "properties": {
@@ -69,8 +69,8 @@
       "description": "URL of the entity's DID document (the trust anchor for did:web; integrity derives from domain control). The DID document carries the `KyaOsEntityCard` service entry that anchors this card."
     },
     "proofProfile": {
-      "const": "org.kya-os/proof@1",
-      "description": "Names the per-request holder-of-key proof profile this entity's requests carry — the stateless, sender-constrained `org.kya-os/proof@1` envelope (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on this static card; it rides per-request `_meta`. This field only advertises the profile a verifier should expect."
+      "enum": ["org.kya-os/proof.v1", "org.kya-os/proof@1"],
+      "description": "Names the per-request holder-of-key proof profile this entity's requests carry — the stateless, sender-constrained `org.kya-os/proof.v1` envelope (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on this static card; it rides per-request `_meta`. This field only advertises the profile a verifier should expect."
     },
     "cimd": {
       "$ref": "#/$defs/CimdBinding",
@@ -234,7 +234,7 @@
       "name": "KYA-OS Inspector (dev)",
       "capabilities": ["handshake", "signing", "verification"],
       "conformanceLevel": "L1",
-      "proofProfile": "org.kya-os/proof@1"
+      "proofProfile": "org.kya-os/proof.v1"
     },
     {
       "id": "did:web:example.com:mcp:acme-search",
@@ -255,7 +255,7 @@
       "responsibleParty": "did:web:example.com:org:acme",
       "delegationRef": "vc_root>del_mcp",
       "didDocument": "https://example.com/mcp/acme-search/did.json",
-      "proofProfile": "org.kya-os/proof@1",
+      "proofProfile": "org.kya-os/proof.v1",
       "cimd": {
         "clientId": "https://example.com/mcp/acme-search",
         "jwksUri": "https://example.com/mcp/acme-search/jwks.json"
@@ -274,7 +274,7 @@
       "conformanceLevel": "L1",
       "responsibleParty": "did:web:example.com:org:acme",
       "didDocument": "https://example.com/clients/acme-cli/did.json",
-      "proofProfile": "org.kya-os/proof@1",
+      "proofProfile": "org.kya-os/proof.v1",
       "cimd": {
         "clientId": "https://example.com/clients/acme-cli",
         "jwksUri": "https://example.com/clients/acme-cli/jwks.json"

package/schemas/mcp-extension-settings.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schema.kya-os.org/v1/protocol/mcp-extension/settings/v1.0.0",
+  "title": "KYA-OS MCP Extension Settings",
+  "description": "The settings object declared under capabilities.extensions[\"org.kya-os/decentralized-authority\"] in MCP ClientCapabilities and ServerCapabilities (SEP-2133). All members are optional; an empty object means the extension is supported with default configuration. Unknown members are ignored for forward compatibility. See SPEC-MCP-EXTENSION.md section 3.",
+  "type": "object",
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "The SPEC-MCP-EXTENSION.md document version the peer implements. Defaults to 1.0.0.",
+      "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$",
+      "default": "1.0.0"
+    },
+    "proofProfiles": {
+      "type": "array",
+      "description": "Proof profiles the peer can mint (client) or verify (server). Defaults to [\"org.kya-os/proof.v1\"].",
+      "items": { "type": "string", "minLength": 1 },
+      "minItems": 1,
+      "uniqueItems": true,
+      "default": ["org.kya-os/proof.v1"]
+    },
+    "didMethods": {
+      "type": "array",
+      "description": "DID methods the peer uses (client) or resolves (server), as full method prefixes, e.g. did:key, did:web. Defaults to [\"did:key\", \"did:web\"]; did:cheqd is explicit opt-in per SPEC.md section 4.4.1.",
+      "items": { "type": "string", "pattern": "^did:[a-z0-9]+$" },
+      "minItems": 1,
+      "uniqueItems": true,
+      "default": ["did:key", "did:web"]
+    },
+    "required": {
+      "type": "boolean",
+      "description": "Server-side only: when true, the server rejects requests from clients that did not declare org.kya-os/decentralized-authority, using JSON-RPC error -32021 (MissingRequiredClientCapabilityError). Meaningless on a client declaration and ignored there. Defaults to false.",
+      "default": false
+    }
+  },
+  "additionalProperties": true
+}

package/schemas/well-known-mcpi.json

@@ -72,6 +72,23 @@
         "crisp": {
           "type": "boolean",
           "description": "Server supports CRISP constraint evaluation."
+        },
+        "audit": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["profile", "recorderTopology", "delivery", "journalDurability", "atomicAppend", "sourceHighWater", "merkleCheckpoints", "independentObservation", "supportingAnchors", "evidenceRetention"],
+          "properties": {
+            "profile": { "enum": ["AAP-0", "AAP-1", "AAP-2", "AAP-3", "AAP-4"] },
+            "recorderTopology": { "enum": ["none", "self-hosted", "managed", "verified-mirror"] },
+            "delivery": { "enum": ["best-effort", "buffered", "required"] },
+            "journalDurability": { "enum": ["none", "ephemeral", "durable"] },
+            "atomicAppend": { "type": "boolean" },
+            "sourceHighWater": { "type": "boolean" },
+            "merkleCheckpoints": { "type": "boolean" },
+            "independentObservation": { "type": "boolean" },
+            "supportingAnchors": { "type": "array", "items": { "enum": ["worm", "rfc3161", "scitt"] }, "uniqueItems": true },
+            "evidenceRetention": { "enum": ["none", "inline", "separate"] }
+          }
         }
       },
       "additionalProperties": true