@real-life/trust-protocol 0.4.0 → 0.6.0

package/dist/schemas.js

@@ -19,15 +19,18 @@ export const SCHEMAS = freeze({
     "encounter-credential-0.25.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/encounter-credential-0.25.schema.json", "title": "RLTP Encounter Credential (rltp-encounter@0.30)", "description": "Normative wire format per RLTP Encounter Layer 0.30, section 7.2 (RLTP-ENC-7010 ff.). Wire version 0.25: the credential is a conformant DTG RelationshipCredential per DTGWG Core Credentials WD01 - the DTG context joins the pinned @context (three elements, in order) and the type array carries VerifiableCredential + DTGCredential + RelationshipCredential + EncounterCredential (order-insensitive, EncounterCredential = concrete RLTP hint per the WD01 PHC pattern). Issuer and credentialSubject.id are PAIR anchors (fresh always, spec 4.4): issuer scope pairwise, one identifier per enactment, stricter than one per relationship. Root and credentialSubject remain CLOSED; validity-controlling VC properties absent by construction (immutability 7.3; WD01 marks validUntil OPTIONAL). Size bounds re-measured at generation time (spec 7.5/15).", "type": "object", "required": ["@context", "type", "issuer", "validFrom", "credentialSubject", "proof"], "additionalProperties": false, "properties": { "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false }, "type": { "type": "array", "description": "order-insensitive: four members, four distinct contains-constants - every slot pinned", "minItems": 4, "maxItems": 4, "allOf": [{ "contains": { "const": "VerifiableCredential" } }, { "contains": { "const": "DTGCredential" } }, { "contains": { "const": "RelationshipCredential" } }, { "contains": { "const": "EncounterCredential" } }] }, "issuer": { "$ref": "#/$defs/didKey" }, "validFrom": { "$ref": "#/$defs/rfc3339utc" }, "credentialSubject": { "type": "object", "required": ["id", "format", "ceremony", "challenge", "enactmentBinding"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/didKey" }, "format": { "const": "rltp-encounter-credential/0.25" }, "ceremony": { "$ref": "#/$defs/ceremonyId" }, "challenge": { "$ref": "#/$defs/challenge" }, "enactmentBinding": { "$ref": "#/$defs/multibaseSha256" }, "channel": { "type": "string", "maxLength": 64 }, "commitment": { "type": "object", "additionalProperties": false, "required": ["suite", "value"], "properties": { "suite": { "type": "string", "pattern": "^[a-z0-9-]+@[0-9]+$", "maxLength": 32, "description": "commitment suite identifier from the (initially empty) suite registry; unassigned semantics in 0.24" }, "value": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]{1,96}$" } }, "description": "pre-wired ZK seam (spec 7.2): suite names the future interpretation so later assignment is registration, not re-interpretation; verifiers MUST accept-and-ignore" } } }, "proof": { "$ref": "#/$defs/dataIntegrityProof" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$", "description": "did:key over an Ed25519 public key; MUST additionally decode to multicodec ed25519-pub + 32 bytes (spec 2.3)" }, "ceremonyId": { "type": "string", "description": "registered ceremony identifier and version, at most 56 characters: label at most 48, each version part at most 3 digits (spec 7.5). The registered label of this profile is 19 characters; the bound leaves room for future registrations while keeping the field finite, which the credential's size guarantee requires.", "maxLength": 56, "pattern": "^[a-z0-9-]{1,48}@[0-9]{1,3}\\.[0-9]{1,3}$", "examples": ["encounter-scan@0.24"] }, "challenge": { "type": "string", "description": "22-88 base64url characters, at least 128 bits of cryptographically random material; UUID v4 is non-conformant", "pattern": "^[A-Za-z0-9_-]{22,88}$" }, "multibaseSha256": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase-encoded multihash (sha2-256: 0x12 0x20 + 32 bytes) over JCS-canonicalized input; emit 'u' (46 chars after header), accept 'u'/'z' per CID 1.0; decoded multihash verified at parse" }, "rfc3339utc": { "type": "string", "description": "RFC3339 UTC 'Z', seconds 00-59, AT MOST 3 fractional-second digits (spec 2.3) — 24 characters maximum; syntactic gate, calendar validity is a parse-time check. Fractional seconds carry no protocol meaning, and spec 2.3 makes that a rule rather than an assertion: EVERY Encounter comparison — every comparison the Encounter Layer requires, and every comparison a companion document delegates to it, but NOT a companion's own time windows — normalizes EVERY operand, artifact timestamps, stored t_ch, and the local 'now', to whole seconds by truncation toward the past (delete the '.' and everything between it and the 'Z') before comparing, and the section 9 parameters are added afterwards. Because those parameters are whole seconds, truncation can only ever widen acceptance at a boundary, never narrow it. Normalization governs comparison ONLY; the bytes hashed, signed and digested are always the artifact's own, so an implementation that truncates before JCS breaks the proof. Producers SHOULD emit whole seconds (one instant, one serialization, one digest). The length bound itself is byte economy: an unbounded fraction is an unbounded field in a size-capped artifact (7.5).", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$" }, "dataIntegrityProof": { "type": "object", "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue", "@context"], "additionalProperties": false, "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "description": "multibase base58btc of an Ed25519 signature, which is exactly 64 bytes (RFC 8032): 'z' plus 64 to 88 base58 characters, so 65 to 89 characters and nothing else. Upper end: 58^87 <= 2^512-1 < 58^88, so 88 digits suffice and 89 are never needed. Lower end: base58btc renders each leading zero byte as one '1', so the all-zero 64-byte string is the shortest at 64. A value outside this interval is not the encoding of 64 bytes and could never have verified (spec 2.3).", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$" }, "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false, "description": "W3C DI-EDDSA copies the document @context into the embedded proof (0.27 repair); with the DTG adoption the pinned array has three elements" } } } } },
     "encounter-credential-0.26.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/encounter-credential-0.26.schema.json", "title": "RLTP Encounter Credential (rltp-encounter@0.31)", "description": "Normative wire format per RLTP Encounter Layer 0.31, section 7.2 (RLTP-ENC-7010 ff.). Wire version 0.26: the credential is a DTG RelationshipCredential per DTG Credentials Working Draft 0.6.0 - @context is exactly [W3C VC v2, DTG context v1 (https://registry.trustoverip.org/dtg/context/v1, exact bytes, document pinned by SHA-256 in contexts/dtg-v1.jsonld), RLTP v1], in order; the type array carries VerifiableCredential + DTGCredential + RelationshipCredential + EncounterCredential (order-insensitive; RelationshipCredential is the one concrete DTG subtype, EncounterCredential a non-authoritative hint per the DTG PHC pattern); issuerScope is REQUIRED at the root and is pairwise: issuer and credentialSubject.id are PAIR anchors, fresh for every enactment (spec 4.4), so the issuer's identifier is known to exactly one counterparty. Root and credentialSubject remain CLOSED; validity-controlling VC properties absent by construction (immutability 7.3; DTG marks validUntil OPTIONAL). Size bounds measured (spec 7.5/15). The 0.25 form keeps its own schema (encounter-credential-0.25.schema.json); a held 0.25 credential stays valid under it (spec 7.3, 12).", "type": "object", "required": ["@context", "type", "issuer", "issuerScope", "validFrom", "credentialSubject", "proof"], "additionalProperties": false, "properties": { "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://registry.trustoverip.org/dtg/context/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false }, "type": { "type": "array", "description": "order-insensitive: four members, four distinct contains-constants - every slot pinned", "minItems": 4, "maxItems": 4, "allOf": [{ "contains": { "const": "VerifiableCredential" } }, { "contains": { "const": "DTGCredential" } }, { "contains": { "const": "RelationshipCredential" } }, { "contains": { "const": "EncounterCredential" } }] }, "issuer": { "$ref": "#/$defs/didKey" }, "issuerScope": { "const": "pairwise", "description": "DTG correlation scope of the issuer's identifier (DTG WD 0.6.0 Base Structure, Correlation Scope). An encounter credential is issued under a fresh pair anchor known to exactly one counterparty (spec 4.4), so its declaration is pairwise and nothing else; a receiver rejects absence and every other value, compared case-sensitively (spec 7.2)." }, "validFrom": { "$ref": "#/$defs/rfc3339utc" }, "credentialSubject": { "type": "object", "required": ["id", "format", "ceremony", "challenge", "enactmentBinding"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/didKey" }, "format": { "const": "rltp-encounter-credential/0.26" }, "ceremony": { "$ref": "#/$defs/ceremonyId" }, "challenge": { "$ref": "#/$defs/challenge" }, "enactmentBinding": { "$ref": "#/$defs/multibaseSha256" }, "channel": { "type": "string", "maxLength": 64 }, "commitment": { "type": "object", "additionalProperties": false, "required": ["suite", "value"], "properties": { "suite": { "type": "string", "pattern": "^[a-z0-9-]+@[0-9]+$", "maxLength": 32, "description": "commitment suite identifier from the (initially empty) suite registry; semantically unassigned (spec 7.2)" }, "value": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]{1,96}$" } }, "description": "pre-wired ZK seam (spec 7.2): suite names the future interpretation so later assignment is registration, not re-interpretation; verifiers MUST accept-and-ignore" } } }, "proof": { "$ref": "#/$defs/dataIntegrityProof" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$", "description": "did:key over an Ed25519 public key; MUST additionally decode to multicodec ed25519-pub + 32 bytes (spec 2.3)" }, "ceremonyId": { "type": "string", "description": "registered ceremony identifier and version, at most 56 characters: label at most 48, each version part at most 3 digits (spec 7.5). The registered label of this profile is 19 characters; the bound leaves room for future registrations while keeping the field finite, which the credential's size guarantee requires.", "maxLength": 56, "pattern": "^[a-z0-9-]{1,48}@[0-9]{1,3}\\.[0-9]{1,3}$", "examples": ["encounter-scan@0.25"] }, "challenge": { "type": "string", "description": "22-88 base64url characters, at least 128 bits of cryptographically random material; UUID v4 is non-conformant", "pattern": "^[A-Za-z0-9_-]{22,88}$" }, "multibaseSha256": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase-encoded multihash (sha2-256: 0x12 0x20 + 32 bytes) over JCS-canonicalized input; emit 'u' (46 chars after header), accept 'u'/'z' per CID 1.0; decoded multihash verified at parse" }, "rfc3339utc": { "type": "string", "description": "RFC3339 UTC 'Z', seconds 00-59, AT MOST 3 fractional-second digits (spec 2.3) — 24 characters maximum; syntactic gate, calendar validity is a parse-time check. Fractional seconds carry no protocol meaning, and spec 2.3 makes that a rule rather than an assertion: EVERY Encounter comparison — every comparison the Encounter Layer requires, and every comparison a companion document delegates to it, but NOT a companion's own time windows — normalizes EVERY operand, artifact timestamps, stored t_ch, and the local 'now', to whole seconds by truncation toward the past (delete the '.' and everything between it and the 'Z') before comparing, and the section 9 parameters are added afterwards. Because those parameters are whole seconds, truncation can only ever widen acceptance at a boundary, never narrow it. Normalization governs comparison ONLY; the bytes hashed, signed and digested are always the artifact's own, so an implementation that truncates before JCS breaks the proof. Producers SHOULD emit whole seconds (one instant, one serialization, one digest). The length bound itself is byte economy: an unbounded fraction is an unbounded field in a size-capped artifact (7.5).", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$" }, "dataIntegrityProof": { "type": "object", "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue", "@context"], "additionalProperties": false, "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "description": "multibase base58btc of an Ed25519 signature, which is exactly 64 bytes (RFC 8032): 'z' plus 64 to 88 base58 characters, so 65 to 89 characters and nothing else. Upper end: 58^87 <= 2^512-1 < 58^88, so 88 digits suffice and 89 are never needed. Lower end: base58btc renders each leading zero byte as one '1', so the all-zero 64-byte string is the shortest at 64. A value outside this interval is not the encoding of 64 bytes and could never have verified (spec 2.3).", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$" }, "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://registry.trustoverip.org/dtg/context/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false, "description": "W3C DI-EDDSA copies the document @context into the embedded proof: the same three pinned contexts, in order" } } } } },
     "encounter-credential.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/encounter-credential.schema.json", "title": "RLTP Encounter Credential (rltp-encounter@0.31) — mobile $id, carried by the unversioned resource", "description": "Normative wire format per RLTP Encounter Layer 0.31, section 7.2 (RLTP-ENC-7010 ff.). Wire version 0.26: the credential is a DTG RelationshipCredential per DTG Credentials Working Draft 0.6.0 - @context is exactly [W3C VC v2, DTG context v1 (https://registry.trustoverip.org/dtg/context/v1, exact bytes, document pinned by SHA-256 in contexts/dtg-v1.jsonld), RLTP v1], in order; the type array carries VerifiableCredential + DTGCredential + RelationshipCredential + EncounterCredential (order-insensitive; RelationshipCredential is the one concrete DTG subtype, EncounterCredential a non-authoritative hint per the DTG PHC pattern); issuerScope is REQUIRED at the root and is pairwise: issuer and credentialSubject.id are PAIR anchors, fresh for every enactment (spec 4.4), so the issuer's identifier is known to exactly one counterparty. Root and credentialSubject remain CLOSED; validity-controlling VC properties absent by construction (immutability 7.3; DTG marks validUntil OPTIONAL). Size bounds measured (spec 7.5/15). The 0.25 form keeps its own schema (encounter-credential-0.25.schema.json); a held 0.25 credential stays valid under it (spec 7.3, 12).", "type": "object", "required": ["@context", "type", "issuer", "issuerScope", "validFrom", "credentialSubject", "proof"], "additionalProperties": false, "properties": { "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://registry.trustoverip.org/dtg/context/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false }, "type": { "type": "array", "description": "order-insensitive: four members, four distinct contains-constants - every slot pinned", "minItems": 4, "maxItems": 4, "allOf": [{ "contains": { "const": "VerifiableCredential" } }, { "contains": { "const": "DTGCredential" } }, { "contains": { "const": "RelationshipCredential" } }, { "contains": { "const": "EncounterCredential" } }] }, "issuer": { "$ref": "#/$defs/didKey" }, "issuerScope": { "const": "pairwise", "description": "DTG correlation scope of the issuer's identifier (DTG WD 0.6.0 Base Structure, Correlation Scope). An encounter credential is issued under a fresh pair anchor known to exactly one counterparty (spec 4.4), so its declaration is pairwise and nothing else; a receiver rejects absence and every other value, compared case-sensitively (spec 7.2)." }, "validFrom": { "$ref": "#/$defs/rfc3339utc" }, "credentialSubject": { "type": "object", "required": ["id", "format", "ceremony", "challenge", "enactmentBinding"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/didKey" }, "format": { "const": "rltp-encounter-credential/0.26" }, "ceremony": { "$ref": "#/$defs/ceremonyId" }, "challenge": { "$ref": "#/$defs/challenge" }, "enactmentBinding": { "$ref": "#/$defs/multibaseSha256" }, "channel": { "type": "string", "maxLength": 64 }, "commitment": { "type": "object", "additionalProperties": false, "required": ["suite", "value"], "properties": { "suite": { "type": "string", "pattern": "^[a-z0-9-]+@[0-9]+$", "maxLength": 32, "description": "commitment suite identifier from the (initially empty) suite registry; semantically unassigned (spec 7.2)" }, "value": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]{1,96}$" } }, "description": "pre-wired ZK seam (spec 7.2): suite names the future interpretation so later assignment is registration, not re-interpretation; verifiers MUST accept-and-ignore" } } }, "proof": { "$ref": "#/$defs/dataIntegrityProof" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$", "description": "did:key over an Ed25519 public key; MUST additionally decode to multicodec ed25519-pub + 32 bytes (spec 2.3)" }, "ceremonyId": { "type": "string", "description": "registered ceremony identifier and version, at most 56 characters: label at most 48, each version part at most 3 digits (spec 7.5). The registered label of this profile is 19 characters; the bound leaves room for future registrations while keeping the field finite, which the credential's size guarantee requires.", "maxLength": 56, "pattern": "^[a-z0-9-]{1,48}@[0-9]{1,3}\\.[0-9]{1,3}$", "examples": ["encounter-scan@0.25"] }, "challenge": { "type": "string", "description": "22-88 base64url characters, at least 128 bits of cryptographically random material; UUID v4 is non-conformant", "pattern": "^[A-Za-z0-9_-]{22,88}$" }, "multibaseSha256": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase-encoded multihash (sha2-256: 0x12 0x20 + 32 bytes) over JCS-canonicalized input; emit 'u' (46 chars after header), accept 'u'/'z' per CID 1.0; decoded multihash verified at parse" }, "rfc3339utc": { "type": "string", "description": "RFC3339 UTC 'Z', seconds 00-59, AT MOST 3 fractional-second digits (spec 2.3) — 24 characters maximum; syntactic gate, calendar validity is a parse-time check. Fractional seconds carry no protocol meaning, and spec 2.3 makes that a rule rather than an assertion: EVERY Encounter comparison — every comparison the Encounter Layer requires, and every comparison a companion document delegates to it, but NOT a companion's own time windows — normalizes EVERY operand, artifact timestamps, stored t_ch, and the local 'now', to whole seconds by truncation toward the past (delete the '.' and everything between it and the 'Z') before comparing, and the section 9 parameters are added afterwards. Because those parameters are whole seconds, truncation can only ever widen acceptance at a boundary, never narrow it. Normalization governs comparison ONLY; the bytes hashed, signed and digested are always the artifact's own, so an implementation that truncates before JCS breaks the proof. Producers SHOULD emit whole seconds (one instant, one serialization, one digest). The length bound itself is byte economy: an unbounded fraction is an unbounded field in a size-capped artifact (7.5).", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$" }, "dataIntegrityProof": { "type": "object", "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue", "@context"], "additionalProperties": false, "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "description": "multibase base58btc of an Ed25519 signature, which is exactly 64 bytes (RFC 8032): 'z' plus 64 to 88 base58 characters, so 65 to 89 characters and nothing else. Upper end: 58^87 <= 2^512-1 < 58^88, so 88 digits suffice and 89 are never needed. Lower end: base58btc renders each leading zero byte as one '1', so the all-zero 64-byte string is the shortest at 64. A value outside this interval is not the encoding of 64 bytes and could never have verified (spec 2.3).", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$" }, "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://registry.trustoverip.org/dtg/context/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false, "description": "W3C DI-EDDSA copies the document @context into the embedded proof: the same three pinned contexts, in order" } } } } },
-    "payload-access-operation.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/access-operation/0.1", "title": "Payload: access-operation/0.1 (rltp-membership@0.19, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). Carries exactly one thing across the replica boundary: an admitting member.add with its welcome, delivered to its own subject (Membership Tasks 3.3). The enclosed operation is an Access envelope rltp-access/0.25 (Access 0.57; const below, RLTP-MT-10020); member.add is additive and carries no keyOpDigest. Replication owns the inside, a removed member's notice is Access's removal-notice/0.1 (its 10.2), transition key material travels via key-delivery/0.1 (its 10.1), and transition-carrying envelopes never leave the replica (RLTP-ACC-5350). The schema therefore requires op = member.add, the member.add body, and the welcome seal, and additionally rejects any operation body carrying a transition. The envelope carries its own signatures, so the task document carries no proof, and the document issuer MUST be the operation's author or one of its signers. The enclosed member.add proof is a transported variant capped at 64 signatures and 16 credentials (each credential at most 2048 bytes JCS, a prose rule; RLTP-ACC-5320), never a replica's merged proof. Validity, canonicality, consumption, and every merge question are Access 5.3's; this schema is transport shape only.", "type": "object", "required": ["operation", "welcome"], "additionalProperties": false, "allOf": [{ "properties": { "operation": { "properties": { "v": { "const": "rltp-access/0.25" } }, "required": ["v"] } }, "description": "wire pin (Membership Tasks RLTP-MT-10020, RLTP-MT-10050): the enclosed envelope is rltp-access/0.25; any other version is rejected, whatever the shared Access transcription admits" }, { "properties": { "operation": { "properties": { "op": { "const": "member.add" }, "body": { "not": { "required": ["transition"] } } }, "required": ["op"] } }, "description": "admission-only rule (Membership Tasks 3.3): op MUST be member.add; no-transition rule as defence in depth (Access 5.3)" }, { "properties": { "operation": { "properties": { "proof": { "properties": { "signatures": { "maxItems": 64 }, "credentials": { "maxItems": 16 } } } } } }, "description": "transported-variant caps on the enclosed admission proof (Access 5.3)" }], "properties": { "operation": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/access-operation-envelope.schema.json" }, { "if": { "properties": { "op": { "const": "member.add" } }, "required": ["op"] }, "then": { "properties": { "body": { "type": "object", "required": ["subject", "admission"], "properties": { "subject": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "admission": { "type": "object", "required": ["invite", "accept", "welcome"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }], "description": "the COMPLETE membership-invite document; authenticity = the enclosed credential's DataIntegrityProof (document-level proof absent) — verifiable by every replica" }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }], "description": "the COMPLETE membership-accept document, proof REQUIRED" }, "welcome": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase multihash over JCS of the welcome plaintext (Membership Tasks section 4)" } } } } } } } }] }, "welcome": { "type": "object", "required": ["sealed"], "additionalProperties": false, "properties": { "sealed": { "$ref": "https://real-life.org/rltp/v1/schemas/sealed-envelope.schema.json", "description": "welcome seal (HKDF info rltp/v1/welcome, never a delivery document): plaintext = rltp-welcome/0.1 (welcome.schema.json), sealed to the key-agreement key of the accept's ownership-verified card, the subject's first device binding (RLTP-ACC-5125)" } } } } },
+    "message.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/message.schema.json", "type": "object", "additionalProperties": false, "required": ["body", "proof"], "properties": { "body": { "type": "object", "additionalProperties": false, "required": ["type", "mid", "sentAt", "text"], "properties": { "type": { "const": "message@1" }, "mid": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" }, "sentAt": { "type": "string", "pattern": "^[0-9]{4}-((0[13578]|1[02])-(0[1-9]|[12][0-9]|3[01])|(0[469]|11)-(0[1-9]|[12][0-9]|30)|02-(0[1-9]|[12][0-9]))T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]Z$" }, "text": { "type": "string", "minLength": 1, "maxLength": 4096 }, "replyTo": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" } } }, "proof": { "type": "object", "additionalProperties": false, "required": ["mac"], "properties": { "mac": { "type": "string", "pattern": "^u[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" } } } }, "title": "RLTP message@1 (rltp-message@0.1)", "description": "A text message from one party of a relationship to the other, proved by a mac under the directional key k_msg (Message Tasks 3.3). Unsigned, deniable, one unchunked Delivery document." },
+    "payload-access-operation.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/access-operation/0.1", "title": "Payload: access-operation/0.1 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). Carries exactly one thing across the replica boundary: an admitting member.add with its welcome, delivered to its own subject (Membership Tasks 3.3). The enclosed operation is an Access envelope rltp-access/0.25 (Access 0.57; const below, RLTP-MT-10020); member.add is additive and carries no keyOpDigest. Replication owns the inside, a removed member's notice is Access's removal-notice/0.1 (its 10.2), transition key material travels via key-delivery/0.1 (its 10.1), and transition-carrying envelopes never leave the replica (RLTP-ACC-5350). The schema therefore requires op = member.add, the member.add body, and the welcome seal, and additionally rejects any operation body carrying a transition. The envelope carries its own signatures, so the task document carries no proof, and the document issuer MUST be the operation's author or one of its signers. The enclosed member.add proof is a transported variant capped at 64 signatures and 16 credentials (each credential at most 2048 bytes JCS, a prose rule; RLTP-ACC-5320), never a replica's merged proof. Validity, canonicality, consumption, and every merge question are Access 5.3's; this schema is transport shape only.", "type": "object", "required": ["operation", "welcome"], "additionalProperties": false, "allOf": [{ "properties": { "operation": { "properties": { "v": { "const": "rltp-access/0.25" } }, "required": ["v"] } }, "description": "wire pin (Membership Tasks RLTP-MT-10020, RLTP-MT-10050): the enclosed envelope is rltp-access/0.25; any other version is rejected, whatever the shared Access transcription admits" }, { "properties": { "operation": { "properties": { "op": { "const": "member.add" }, "body": { "not": { "required": ["transition"] } } }, "required": ["op"] } }, "description": "admission-only rule (Membership Tasks 3.3): op MUST be member.add; no-transition rule as defence in depth (Access 5.3)" }, { "properties": { "operation": { "properties": { "proof": { "properties": { "signatures": { "maxItems": 64 }, "credentials": { "maxItems": 16 } } } } } }, "description": "transported-variant caps on the enclosed admission proof (Access 5.3)" }], "properties": { "operation": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/access-operation-envelope.schema.json" }, { "if": { "properties": { "op": { "const": "member.add" } }, "required": ["op"] }, "then": { "properties": { "body": { "type": "object", "required": ["subject", "admission"], "properties": { "subject": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "admission": { "type": "object", "required": ["invite", "accept", "welcome"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }], "description": "the COMPLETE membership-invite document; authenticity = the enclosed credential's DataIntegrityProof (document-level proof absent) — verifiable by every replica" }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }], "description": "the COMPLETE membership-accept document, proof REQUIRED" }, "welcome": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase multihash over JCS of the welcome plaintext (Membership Tasks section 4)" } } } } } } } }] }, "welcome": { "type": "object", "required": ["sealed"], "additionalProperties": false, "properties": { "sealed": { "$ref": "https://real-life.org/rltp/v1/schemas/sealed-envelope.schema.json", "description": "welcome seal (HKDF info rltp/v1/welcome, never a delivery document): plaintext = rltp-welcome/0.1 (welcome.schema.json), sealed to the key-agreement key of the accept's ownership-verified card, the subject's first device binding (RLTP-ACC-5125)" } } } } },
     "payload-delivery-ack.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/delivery-ack/0.1", "title": "Payload: delivery-ack/0.1 (rltp-delivery@0.81, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). Arrival acknowledgement per Delivery Contract 4.2: machine-generated at the durable recording of the referenced document's defined effect; the document carrying this payload MUST carry a proof in the form the 4.2/4.4 acknowledgement class rule selects: eddsa-jcs-2022 under the issuer anchor for signature-class payloads, the deniable channel-keyed MAC for designated-verifier payloads; meaning is arrival only, never acceptance or any human act.", "type": "object", "required": ["ref", "meaning"], "additionalProperties": false, "properties": { "ref": { "type": "string", "description": "multibase-encoded multihash (sha2-256: 0x12 0x20 + 32 bytes) over JCS-canonicalized input; emit 'u' (46 chars after header), accept 'u'/'z' per CID 1.0; decoded multihash verified at parse", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$" }, "meaning": { "const": "received" } } },
     "payload-encounter-bundle.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/encounter-bundle/0.1", "title": "Payload: encounter-bundle/0.1 (rltp-delivery@0.81, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). One-scan transmission per Delivery Contract 4.1: the scanner's sent card and step credential. Consistency and validate-then-consume rules are normative in Delivery Contract 4.1/6.2.", "type": "object", "required": ["card", "credential"], "additionalProperties": false, "properties": { "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the scanner's sent card: fresh sent-challenge, sentTo = the document recipient" }, "credential": { "$ref": "https://real-life.org/rltp/v1/schemas/encounter-credential.schema.json", "description": "the scanner's step credential binding the recipient's displayed challenge" } } },
     "payload-encounter-credential-delivery.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/encounter-credential-delivery/0.1", "title": "Payload: encounter-credential-delivery/0.1 (rltp-delivery@0.81, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). Post-enactment delivery of a step credential per Delivery Contract 4.3. Outer/inner consistency (document issuer = credential issuer, recipient = credential subject) is normative in Delivery Contract 4.3; credential acceptance is entirely Encounter 5.6.", "type": "object", "required": ["credential"], "additionalProperties": false, "properties": { "credential": { "$ref": "https://real-life.org/rltp/v1/schemas/encounter-credential.schema.json" } } },
     "payload-key-delivery.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/key-delivery/0.1", "title": "Payload: key-delivery/0.1 (rltp-access@0.57, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI). Epoch key material to a specific party, and the authenticated request for it: kind=keydist (transition key envelope; authority carrier = the transition whose keyDist commits this sealed envelope's digest, AAD-bound to genesis digest, newEpoch, and recipient — never the operation id), kind=re-welcome (welcome seal toward an admission subject) and kind=refresh (keydist-profile seal toward any currently entitled member) — both registered by linear/0.1 and both from fresh P4 material, adopted only if the unsealed material verifies against the log's binding of the key state its keyState names (RLTP-ACC-9362, 10110) (which authenticates ALL consensus-relevant material: side secrets are derived from the content key, never transported) — kind=material (registered by beekem/0.1, RLTP-ACC-9897: the answer to an entitled key request, a rltp-access-material/0.25 object whose epoch is the helper's current epoch, whose keyState names the helper's current key state and whose keys.op is a key operation freshly produced by the helper's device that gives the requesting device a leaf or path there, sealed as re-welcome is sealed to the key-agreement key of the requesting device, recipient check applied to that device; the receiver verifies the named key state against its own materialization, the helper's binding, and that the operation applies there — never against an earlier keyOpDigest) — and kind=request (signed claim under the key service duty, per device (RLTP-ACC-5560, 5565): it carries the requesting device's card, or for a first device the contact card whose derived binding (5125) is not revoked; a request under a member anchor alone is refused; the task document's proof is REQUIRED and verifies under the claiming anchor, which equals the enclosed card's anchor; never pends; it names the operation its claim rests on in op or, where the requester holds no identifier of a canonical admission, the admission reference admission { subject, acceptDigest } instead, exactly one of the two, RLTP-ACC-10172; the receiver resolves the reference to the canonical admissions of subject in its own state whose enclosed accept has that document digest, 10174, and its answer names the resolved admission in op, 10176). Material kinds carry NO document proof (one carrier) and always name op. Every kind names the entitled member anchor in subject (REQUIRED, RLTP-ACC-10105). The document recipient differs by direction: a material document is addressed to the device the material is sealed to (for an answer to a request, the requesting device); a request is addressed to the helper device it asks, while its card names the requesting device. Entitlement is checked against subject; binding, revocation and the seal against the requesting device (RLTP-ACC-10105). For key-delivery documents a device is the Delivery Contract's recipient principal: its did:key satisfies the own-anchor check of Delivery section 6 step 5, the Access binding check (5.1) follows at step 8 (RLTP-ACC-10107). The group identity (genesisDigest) is computed over the proof-free genesis signature input (Access 3.2). Consistency and effects: Access 10.1.", "type": "object", "required": ["keyDelivery"], "additionalProperties": false, "properties": { "keyDelivery": { "type": "object", "required": ["group", "genesisDigest", "subject", "epoch", "kind"], "additionalProperties": false, "properties": { "group": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "genesisDigest": { "type": "string", "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$", "maxLength": 128, "description": "the group's identity (Access 3.2: multihash over the proof-free genesis signature input); MUST match the recipient's state for the group, or a bootstrapping invitee's own invite digest" }, "subject": { "$ref": "#/$defs/didKey", "description": "the entitled member anchor (RLTP-ACC-10105), REQUIRED for every kind: entitlement — the canonical admission or genesis named in op, and current membership where the receiver holds a materialized state — is checked against subject (10100). The document's recipient is a device, by direction: for a material kind the device the material is sealed to (the requesting device when it answers a request), for request the helper device the request is addressed to, the requesting device being named by the enclosed card; binding, revocation and the seal are checked against the requesting device (5.1, 10105), and the Delivery Contract's recipient check applies to the device as recipient principal (10107). For request subject is the claiming anchor (= issuer, 10090)" }, "epoch": { "type": "integer", "minimum": 0, "description": "keydist: MUST equal the named transition's newEpoch; re-welcome, refresh and material: MUST equal the unsealed material's epoch and the recipient's current epoch at adoption (RLTP-ACC-10110); request: informative" }, "op": { "type": "string", "pattern": "^oid:[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$", "description": "the transition (keydist), the canonical admission (re-welcome), any canonical admission of the subject (refresh and material — none is distinguished, Access 5.3) or the genesis whose founder is the subject (RLTP-ACC-10100), the operation the claim rests on (request: a canonical admission of the requesting anchor or, for the founder, the genesis, RLTP-ACC-5560). REQUIRED for every material kind; a request carries op or admission, exactly one (RLTP-ACC-10040, 10172); an answer to a request by admission reference names the admission the receiver resolved (10176). The key state the material belongs to is named inside the sealed material (keyState, RLTP-ACC-9362), never by op" }, "admission": { "type": "object", "required": ["subject", "acceptDigest"], "additionalProperties": false, "properties": { "subject": { "$ref": "#/$defs/didKey", "description": "the claiming member anchor; equals the request's issuer and keyDelivery.subject (RLTP-ACC-10172, a runtime check)" }, "acceptDigest": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "the document digest of the membership-accept the requester issued (u or z multihash, Access 3.2)" } }, "description": "the admission reference of RLTP-ACC-10172: for a request whose issuer holds no identifier of a canonical admission, in place of op; resolved by the receiver to the canonical admissions of subject in its own materialized state whose enclosed accept has the document digest acceptDigest, any one of them serving (10174); a reference that resolves to none is failed(validation-failed), never pending (10170). Absent for every material kind." }, "kind": { "enum": ["keydist", "re-welcome", "refresh", "material", "request"] }, "sealed": { "$ref": "https://real-life.org/rltp/v1/schemas/sealed-envelope.schema.json", "description": "REQUIRED for every material kind (keydist, re-welcome, refresh, material); absent for request. keydist: seal per Delivery section 5 with three deliberate differences (HKDF info rltp/v1/keydist; AAD = UTF-8 of JCS {genesis, newEpoch, recipient}; plaintext = rltp-access-keydist/0.25 object with keyState) whose digest the named transition commits. re-welcome: welcome seal per Membership section 4. refresh: keydist-profile seal from fresh P4 material at the sender's current position, sealed to the request's card; adopted only when its keyState names a key state of the recipient's materialization and the material verifies against the log's binding of that key state (RLTP-ACC-10110). material (beekem/0.1): the rltp-access-material/0.25 object (epoch = the helper's current epoch, keyState = the identifier of the helper's current key state, keys.op = a key operation freshly produced by the helper's device at that key state giving the requesting device a leaf or path there) sealed as re-welcome is sealed, to the key-agreement key of the requesting device (RLTP-ACC-9897); verified against the named key state and the helper's binding, never against an earlier keyOpDigest (9898)." }, "card": { "oneOf": [{ "$ref": "#/$defs/deviceCard", "description": "the requesting device's card (Access 5.1), for a further device bound by device.add" }, { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "for a first device: the person's contact card in the displayed form, whose derived binding (RLTP-ACC-5125) is the device" }], "description": "REQUIRED for request, absent otherwise (RLTP-ACC-10060). Recovery is per device (RLTP-ACC-5565): the requesting device's card (5.1), or for a first device the contact card whose derived binding (5125) is not revoked; the helper checks that the device is bound to the requesting anchor and not revoked at its own current state (5560) and seals the answer to that device's key-agreement key (5580). A request under a member anchor alone is refused." } }, "allOf": [{ "if": { "properties": { "kind": { "enum": ["keydist", "re-welcome", "refresh", "material"] } } }, "then": { "required": ["sealed", "op"], "not": { "anyOf": [{ "required": ["card"] }, { "required": ["admission"] }] } } }, { "if": { "properties": { "kind": { "const": "request" } } }, "then": { "required": ["card"], "not": { "required": ["sealed"] }, "oneOf": [{ "required": ["op"], "not": { "required": ["admission"] } }, { "required": ["admission"], "not": { "required": ["op"] } }] } }] } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$", "description": "did:key over an Ed25519 public key; MUST additionally decode to multicodec ed25519-pub + 32 bytes (Encounter 2.3)" }, "deviceCard": { "type": "object", "required": ["anchor", "device", "keyAgreement", "serviceIdentity", "proof"], "additionalProperties": false, "description": "device card (Access 5.1), transcribed from access-operation-envelope.schema.json $defs/deviceCard (keep both in step): binds a further device to its person's member anchor; carries exactly these fields (RLTP-ACC-5110); proof = { signer, sig } by a bound, unrevoked device of the same person (5120).", "properties": { "anchor": { "$ref": "#/$defs/didKey", "description": "the member anchor of the device's person in this group" }, "device": { "$ref": "#/$defs/didKey", "description": "the device's Ed25519 did:key, under which the device acts in the key port" }, "keyAgreement": { "type": "string", "pattern": "^z6LS[1-9A-HJ-NP-Za-km-z]{44}$", "description": "the device's X25519 key-agreement Multikey, to which key material for this device is sealed" }, "serviceIdentity": { "$ref": "#/$defs/didKey", "description": "the device's derived service identity (Access 5.2)" }, "proof": { "type": "object", "required": ["signer", "sig"], "additionalProperties": false, "properties": { "signer": { "$ref": "#/$defs/didKey" }, "sig": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$", "minLength": 65, "maxLength": 89 } } } } } } },
-    "payload-membership-accept.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-accept/0.2", "title": "Payload: membership-accept/0.2 (rltp-membership@0.19, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The consent artifact: subject MUST equal the document issuer and the referenced invite's credentialSubject.id; ref binds this accept to exactly one invitation by credential digest, the multibase multihash over the JCS of the invite's complete payload.invite including its proof (Membership Tasks RLTP-MT-2180, RLTP-MT-3230); card is the subject's contact card, whose key-agreement key the welcome is sealed to and from which the Access layer derives the subject's first device binding (RLTP-ACC-5125); card proof MUST verify and card.anchor MUST equal subject; the key is retained for as long as the subject is a member (RLTP-ACC-5550). candidacy is the subject's signed consent to or refusal of candidacy surfacing (Membership Tasks 3.4). The document MUST carry a proof verifying under the issuer. An accept is consent to one membership and is consumed content-bound, never freed (RLTP-MT-3285, RLTP-MT-3290; Access 5.3).", "type": "object", "required": ["accept"], "additionalProperties": false, "properties": { "accept": { "type": "object", "required": ["group", "subject", "ref", "card", "candidacy"], "additionalProperties": false, "properties": { "group": { "$ref": "#/$defs/didKey" }, "subject": { "$ref": "#/$defs/didKey" }, "ref": { "$ref": "#/$defs/multibaseMultihash" }, "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the subject's contact card (displayed form): carries the key-agreement key the welcome will be sealed to" }, "candidacy": { "type": "boolean", "description": "the subject's explicit, signed consent (true) or refusal (false) to the pre-admission candidacy surfacing into the group space (Membership 3.4); false means silent evidence relay only" } } } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "credential digest of the invite being accepted: multibase multihash over the JCS of the complete payload.invite including its proof (Membership Tasks 3.2, section 2)" } } },
-    "payload-membership-evidence-0.1.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-evidence/0.1", "title": "Payload: membership-evidence/0.1 (rltp-membership@0.19, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). membership-evidence/0.1, accepted by every receiver (Membership Tasks RLTP-MT-3815): the payload of membership-evidence/0.2 without vouches. The complete invite and accept documents travel enclosed (their signed recipients are facts of the pair, not the task's recipient), so any authorized member can verify the consent chain and complete the admission. The task document carries no proof; the enclosed documents carry their own (one carrier). Normative rules in Membership Tasks 3.4.", "type": "object", "required": ["evidence"], "additionalProperties": false, "properties": { "evidence": { "type": "object", "required": ["invite", "accept"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }] }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }] } } } } },
-    "payload-membership-evidence.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-evidence/0.2", "title": "Payload: membership-evidence/0.2 (rltp-membership@0.19, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The evidence relay: the complete invite and accept documents travel enclosed (their signed recipients are facts of the pair, not the task's recipient), so any authorized member can verify the consent chain and complete the admission; optional vouches (vouch@2, at most 16, Access RLTP-ACC-5360, RLTP-ACC-5390) travel alongside. The task document carries no proof; the enclosed documents and vouches carry their own. Normative rules in Membership Tasks 3.4. membership-evidence/0.1 is this payload without vouches and remains accepted (RLTP-MT-3815).", "type": "object", "required": ["evidence"], "additionalProperties": false, "properties": { "evidence": { "type": "object", "required": ["invite", "accept"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }] }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }] }, "vouches": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "https://real-life.org/rltp/v1/schemas/access-vouch.schema.json" }, "description": "vouch@2 credentials supporting this candidacy: credentialSubject.id = accept.subject, endorsement.accept = document digest of the enclosed accept, endorsement.genesisDigest = the invite's genesisDigest (RLTP-MT-3810)" } } } } },
-    "payload-membership-invite.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-invite/0.2", "title": "Payload: membership-invite/0.2 (rltp-membership@0.19, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The invitation is a conformant DTG InvitationCredential (DTGWG Core Credentials WD01): issuer = the inviting member's anchor (MUST equal the document issuer), credentialSubject.id = the invitee's member anchor (MUST equal the document recipient; accept.subject MUST equal it), group/genesisDigest/card are WD01-legal additional subject properties, validUntil bounds the invite's answerable life and the inviter's reply-key retention, taskContext = the membership thread (MUST equal the document threadId). The credential's DataIntegrityProof is the one authenticity carrier: the enclosing document carries no document-level proof (Membership Tasks RLTP-MT-2150, 3.1).", "type": "object", "required": ["invite"], "additionalProperties": false, "properties": { "invite": { "type": "object", "required": ["@context", "type", "issuer", "credentialSubject", "validFrom", "validUntil", "taskContext", "proof"], "additionalProperties": false, "properties": { "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false }, "type": { "type": "array", "minItems": 4, "maxItems": 4, "allOf": [{ "contains": { "const": "VerifiableCredential" } }, { "contains": { "const": "DTGCredential" } }, { "contains": { "const": "InvitationCredential" } }, { "contains": { "const": "MembershipInvite" } }] }, "issuer": { "$ref": "#/$defs/didKey" }, "credentialSubject": { "type": "object", "required": ["id", "group", "genesisDigest", "card"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/didKey" }, "group": { "$ref": "#/$defs/didKey" }, "genesisDigest": { "$ref": "#/$defs/multibaseMultihash" }, "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the inviter's contact card (displayed form): carries the key-agreement key the accept will be sealed to" }, "name": { "type": "string", "maxLength": 200 }, "note": { "type": "string", "maxLength": 2000 } } }, "validFrom": { "$ref": "#/$defs/rfc3339utc" }, "validUntil": { "$ref": "#/$defs/rfc3339utc" }, "taskContext": { "$ref": "#/$defs/uuid" }, "proof": { "type": "object", "additionalProperties": false, "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue", "@context"], "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$", "description": "multibase base58btc of an Ed25519 signature (exactly 64 bytes): 'z' plus 64 to 88 base58 characters — the Encounter 2.3 form, shared verbatim by all three RLTP credential schemas." }, "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false } } } } } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase(multihash sha2-256) per Encounter 2.3: emit u, accept u/z" }, "rfc3339utc": { "type": "string", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$", "description": "RFC3339 UTC 'Z', at most 3 fractional-second digits, 24 characters maximum — the Encounter 2.3 securing profile's timestamp language, shared verbatim by all three RLTP credential schemas: a syntactic gate, calendar validity is a parse-time check." }, "uuid": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" } } },
+    "payload-membership-accept.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-accept/0.2", "title": "Payload: membership-accept/0.2 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The consent artifact: subject MUST equal the document issuer and the referenced invite's credentialSubject.id; ref binds this accept to exactly one invitation by credential digest, the multibase multihash over the JCS of the invite's complete payload.invite including its proof (Membership Tasks RLTP-MT-2180, RLTP-MT-3230); card is the subject's contact card, whose key-agreement key the welcome is sealed to and from which the Access layer derives the subject's first device binding (RLTP-ACC-5125); card proof MUST verify and card.anchor MUST equal subject; the key is retained for as long as the subject is a member (RLTP-ACC-5550). candidacy is the subject's signed consent to or refusal of candidacy surfacing (Membership Tasks 3.4). The document MUST carry a proof verifying under the issuer. An accept is consent to one membership and is consumed content-bound, never freed (RLTP-MT-3285, RLTP-MT-3290; Access 5.3).", "type": "object", "required": ["accept"], "additionalProperties": false, "properties": { "accept": { "type": "object", "required": ["group", "subject", "ref", "card", "candidacy"], "additionalProperties": false, "properties": { "group": { "$ref": "#/$defs/didKey" }, "subject": { "$ref": "#/$defs/didKey" }, "ref": { "$ref": "#/$defs/multibaseMultihash" }, "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the subject's contact card (displayed form): carries the key-agreement key the welcome will be sealed to" }, "candidacy": { "type": "boolean", "description": "the subject's explicit, signed consent (true) or refusal (false) to the pre-admission candidacy surfacing into the group space (Membership 3.4); false means silent evidence relay only" } } } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "credential digest of the invite being accepted: multibase multihash over the JCS of the complete payload.invite including its proof (Membership Tasks 3.2, section 2)" } } },
+    "payload-membership-evidence-0.1.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-evidence/0.1", "title": "Payload: membership-evidence/0.1 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). membership-evidence/0.1, accepted by every receiver (Membership Tasks RLTP-MT-3815): the payload of membership-evidence/0.2 without vouches. The complete invite and accept documents travel enclosed (their signed recipients are facts of the pair, not the task's recipient), so any authorized member can verify the consent chain and complete the admission. The task document carries no proof; the enclosed documents carry their own (one carrier). Normative rules in Membership Tasks 3.4.", "type": "object", "required": ["evidence"], "additionalProperties": false, "properties": { "evidence": { "type": "object", "required": ["invite", "accept"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }] }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }] } } } } },
+    "payload-membership-evidence.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-evidence/0.2", "title": "Payload: membership-evidence/0.2 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The evidence relay: the complete invite and accept documents travel enclosed (their signed recipients are facts of the pair, not the task's recipient), so any authorized member can verify the consent chain and complete the admission; optional vouches (vouch@2, at most 16, Access RLTP-ACC-5360, RLTP-ACC-5390) travel alongside. The task document carries no proof; the enclosed documents and vouches carry their own. Normative rules in Membership Tasks 3.4. membership-evidence/0.1 is this payload without vouches and remains accepted (RLTP-MT-3815).", "type": "object", "required": ["evidence"], "additionalProperties": false, "properties": { "evidence": { "type": "object", "required": ["invite", "accept"], "additionalProperties": false, "properties": { "invite": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-invite/0.2" }, "proof": false } }] }, "accept": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json" }, { "required": ["proof"], "properties": { "type": { "const": "https://real-life.org/trust-tasks/membership-accept/0.2" }, "payload": { "$ref": "https://real-life.org/trust-tasks/membership-accept/0.2" } } }] }, "vouches": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "https://real-life.org/rltp/v1/schemas/access-vouch.schema.json" }, "description": "vouch@2 credentials supporting this candidacy: credentialSubject.id = accept.subject, endorsement.accept = document digest of the enclosed accept, endorsement.genesisDigest = the invite's genesisDigest (RLTP-MT-3810)" } } } } },
+    "payload-membership-invite.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-invite/0.2", "title": "Payload: membership-invite/0.2 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The invitation is a conformant DTG InvitationCredential (DTGWG Core Credentials WD01): issuer = the inviting member's anchor (MUST equal the document issuer), credentialSubject.id = the invitee's member anchor (MUST equal the document recipient; accept.subject MUST equal it), group/genesisDigest/card are WD01-legal additional subject properties, validUntil bounds the invite's answerable life and the inviter's reply-key retention, taskContext = the membership thread (MUST equal the document threadId). The credential's DataIntegrityProof is the one authenticity carrier: the enclosing document carries no document-level proof (Membership Tasks RLTP-MT-2150, 3.1).", "type": "object", "required": ["invite"], "additionalProperties": false, "properties": { "invite": { "type": "object", "required": ["@context", "type", "issuer", "credentialSubject", "validFrom", "validUntil", "taskContext", "proof"], "additionalProperties": false, "properties": { "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false }, "type": { "type": "array", "minItems": 4, "maxItems": 4, "allOf": [{ "contains": { "const": "VerifiableCredential" } }, { "contains": { "const": "DTGCredential" } }, { "contains": { "const": "InvitationCredential" } }, { "contains": { "const": "MembershipInvite" } }] }, "issuer": { "$ref": "#/$defs/didKey" }, "credentialSubject": { "type": "object", "required": ["id", "group", "genesisDigest", "card"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/didKey" }, "group": { "$ref": "#/$defs/didKey" }, "genesisDigest": { "$ref": "#/$defs/multibaseMultihash" }, "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the inviter's contact card (displayed form): carries the key-agreement key the accept will be sealed to" }, "name": { "type": "string", "maxLength": 200 }, "note": { "type": "string", "maxLength": 2000 } } }, "validFrom": { "$ref": "#/$defs/rfc3339utc" }, "validUntil": { "$ref": "#/$defs/rfc3339utc" }, "taskContext": { "$ref": "#/$defs/uuid" }, "proof": { "type": "object", "additionalProperties": false, "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue", "@context"], "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$", "description": "multibase base58btc of an Ed25519 signature (exactly 64 bytes): 'z' plus 64 to 88 base58 characters — the Encounter 2.3 form, shared verbatim by all three RLTP credential schemas." }, "@context": { "type": "array", "minItems": 3, "maxItems": 3, "prefixItems": [{ "const": "https://www.w3.org/ns/credentials/v2" }, { "const": "https://firstperson.network/credentials/dtg/v1" }, { "const": "https://real-life.org/rltp/v1" }], "items": false } } } } } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase(multihash sha2-256) per Encounter 2.3: emit u, accept u/z" }, "rfc3339utc": { "type": "string", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$", "description": "RFC3339 UTC 'Z', at most 3 fractional-second digits, 24 characters maximum — the Encounter 2.3 securing profile's timestamp language, shared verbatim by all three RLTP credential schemas: a syntactic gate, calendar validity is a parse-time check." }, "uuid": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" } } },
+    "payload-membership-prelude-reply.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-prelude-reply/0.1", "title": "Payload: membership-prelude-reply/0.1 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The invitee's answer to a membership-prelude-request/0.1 on the same tuple and thread (Membership Tasks 3.5): genesisDigest repeats the request's, card is the invitee's displayed contact card at its member anchor of that group (Membership Tasks 2.6), whose key-agreement key the invitation is sealed to. The document carries a proof verifying under its issuer, the invitee's pair anchor of the tuple (RLTP-MT-3960). The member anchor is trusted only through the invitee's own derivation check and the accept's signature (RLTP-MT-3030, RLTP-MT-8090).", "type": "object", "required": ["genesisDigest", "card"], "additionalProperties": false, "properties": { "genesisDigest": { "$ref": "#/$defs/multibaseMultihash" }, "card": { "$ref": "https://real-life.org/rltp/v1/schemas/contact-card.schema.json", "description": "the invitee's contact card at its member anchor (displayed form, Membership Tasks 2.6)" } }, "$defs": { "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase(multihash sha2-256) per Encounter 2.3: emit u, accept u/z" } } },
+    "payload-membership-prelude-request.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/membership-prelude-request/0.1", "title": "Payload: membership-prelude-request/0.1 (rltp-membership@0.20, target Trust Tasks framework 0.4)", "description": "Payload schema per Trust Tasks 6.3 ($id = Type URI, describes only the payload). The inviter's request for the invitee's member anchor of one group, travelling on the active head of a relationship between the two (Membership Tasks 3.5). genesisDigest names the offered group, group its DID, name its display name, inviter the inviter's member anchor. binding is the inviter binding membership-inviter@1, signed under the inviter's member anchor over the inviter, the genesis digest, and the request document's threadId, issuer (from) and recipient (to), so that the request cannot be replayed on another channel or for another inviter (RLTP-MT-3905, RLTP-MT-3910). The document carries a proof verifying under its issuer, the sender's pair anchor of the tuple (RLTP-MT-3900).", "type": "object", "required": ["genesisDigest", "group", "name", "inviter", "binding"], "additionalProperties": false, "properties": { "genesisDigest": { "$ref": "#/$defs/multibaseMultihash" }, "group": { "$ref": "#/$defs/didKey" }, "name": { "type": "string", "maxLength": 200 }, "inviter": { "$ref": "#/$defs/didKey" }, "binding": { "type": "object", "required": ["type", "inviter", "genesisDigest", "threadId", "from", "to", "proof"], "additionalProperties": false, "properties": { "type": { "const": "membership-inviter@1" }, "inviter": { "$ref": "#/$defs/didKey" }, "genesisDigest": { "$ref": "#/$defs/multibaseMultihash" }, "threadId": { "$ref": "#/$defs/uuid" }, "from": { "$ref": "#/$defs/didKey" }, "to": { "$ref": "#/$defs/didKey" }, "proof": { "type": "object", "additionalProperties": false, "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"], "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "minLength": 65, "maxLength": 89, "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$", "description": "multibase base58btc of an Ed25519 signature (exactly 64 bytes): 'z' plus 64 to 88 base58 characters — the Encounter 2.3 form, shared verbatim by all three RLTP credential schemas." } } } } } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "multibaseMultihash": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "multibase(multihash sha2-256) per Encounter 2.3: emit u, accept u/z" }, "rfc3339utc": { "type": "string", "maxLength": 24, "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$", "description": "RFC3339 UTC 'Z', at most 3 fractional-second digits, 24 characters maximum — the Encounter 2.3 securing profile's timestamp language, shared verbatim by all three RLTP credential schemas: a syntactic gate, calendar validity is a parse-time check." }, "uuid": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" } } },
     "payload-registry-declaration.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/registry-declaration/0.1", "title": "RLTP payload registry-declaration (rltp-delivery@0.81)", "description": "Per-party declaration of fixed operational constants for a served role (Delivery 4.4). The schema is deliberately generic — it fixes the envelope of a declaration, never the constant names, which each role's specification registers. The first constant registered this way was the introduction mediator's ack-delay (Visibility 8.4); the carrier role of Delivery 4.4 has since registered seven carrier constants, and further roles may register others without touching this file.", "type": "object", "additionalProperties": false, "required": ["declaration"], "properties": { "declaration": { "type": "object", "additionalProperties": false, "required": ["role", "revision", "constants"], "properties": { "role": { "type": "string", "pattern": "^https://real-life\\.org/trust-tasks/[a-z0-9-]+/[0-9]+\\.[0-9]+$" }, "revision": { "type": "string", "pattern": "^[1-9][0-9]{0,17}$", "description": "per (issuer, role); generic revision rule of Delivery 4.4 - higher wins, no rollback" }, "constants": { "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": { "pattern": "^[a-z][a-z0-9-]{0,31}$" }, "additionalProperties": { "type": "string", "maxLength": 64 } } } } } },
     "payload-removal-notice.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/trust-tasks/removal-notice/0.1", "title": "RLTP Removal Notice (Access Layer 0.57 section 10.2)", "description": "Payload of the removal-notice/0.1 task registered by the Access layer (10.2) — the compact artifact by which a removed member is told, never the operation envelope itself, whose membership-scaled keyDist fits no carrier budget (Access 5.3 boundary rule). Signature input = JCS serialization with sig omitted. The notice's issuer is the member who produced it, not necessarily the removal's author (RLTP-ACC-10350): every member that materializes the removal can issue it; sig MUST verify under issuer, and issuer MUST be a member of the state that materializes the named removal as canonical (10360); author names the member.remove operation's author. The document carries no proof; its issuer addresses it to the service identity of every device bound to the removed anchor in the issuer's materialization, and a service delivers it to each addressed identity it served (10370). The recipient verifies against their own last-held state (10380): the payload is schema-valid, sig verifies, genesisDigest matches a group of that state, issuer was a member there, author authored the named operation where the recipient holds it, and subject is themselves. The membership and authorship checks are runtime checks against state, not schema-expressible. A verified notice is a SURFACED CLAIM WITH NO MANDATORY STATE EFFECT: it MUST be surfaced, SHOULD trigger a verification attempt, and MUST NOT by itself suspend writing or alter authorization state — the ONLY binding event for victim-side write hygiene is the recipient's own canonical application of the removal; a peer's refusal to serve is a signal prompting verification, never a binding event (Access 10.2; anything stronger would make every member signature a policy-free denial lever). Dispositions: unique on first surfacing, duplicate-known on redelivery (Delivery section 6's closed set).", "type": "object", "required": ["v", "type", "group", "genesisDigest", "op", "subject", "epoch", "author", "issuer", "sig"], "additionalProperties": false, "properties": { "v": { "const": "rltp-access-removal-notice/0.25" }, "type": { "const": "removal-notice" }, "group": { "$ref": "#/$defs/didKey" }, "genesisDigest": { "$ref": "#/$defs/digest" }, "op": { "$ref": "#/$defs/oid", "description": "the canonical member.remove operation this notice reports" }, "subject": { "$ref": "#/$defs/didKey", "description": "the removed anchor; a recipient MUST discard a notice whose subject is not themselves" }, "epoch": { "type": "integer", "minimum": 1, "description": "the removal transition's newEpoch" }, "author": { "$ref": "#/$defs/didKey", "description": "the member.remove operation's author (RLTP-ACC-10350); the recipient checks that author authored the named operation where the recipient holds that operation (10380)" }, "issuer": { "$ref": "#/$defs/didKey", "description": "the member who produced the notice (RLTP-ACC-10350); sig MUST verify under issuer, and issuer MUST be a member of the state that materializes the named removal as canonical (10360); the recipient checks that issuer was a member of its own last-held state (10380)" }, "sig": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$", "maxLength": 128, "description": "signature by issuer over the JCS serialization with sig omitted (RLTP-ACC-10360)" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "oid": { "type": "string", "pattern": "^oid:[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" }, "digest": { "type": "string", "pattern": "^(z[1-9A-HJ-NP-Za-km-z]+|u[A-Za-z0-9_-]+)$", "maxLength": 128 } } },
     "rltp-delivery-document.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/rltp-delivery-document.schema.json", "title": "RLTP Delivery Document Profile (rltp-delivery@0.81)", "description": "RLTP document profile (Delivery 3): proof REQUIRED on delivery-ack and registry-declaration (their authenticity has no other carrier; a delivery-ack carries the DataIntegrityProof form for signature-class payloads and the deniable {mac} form (HMAC over JCS of the document without proof, under the channel ack key) for designated-verifier payloads per the 4.2/4.4 acknowledgement class rule; the schema conditions proof presence by type — which of the two ack proof forms applies is class state the receiver checks at validation (stage 8), not schema-expressible), MUST be absent on the other own types; own types' payload schemas carry \\$id = Type URI, companion-registered types dispatch through the 4.4 registry entry.", "type": "object", "required": ["id", "type", "issuer", "recipient", "threadId", "issuedAt", "payload"], "additionalProperties": false, "properties": { "id": { "$ref": "#/$defs/uuid" }, "type": { "type": "string", "pattern": "^https://real-life\\.org/trust-tasks/[a-z0-9-]+/[0-9]+\\.[0-9]+$" }, "issuer": { "$ref": "#/$defs/didKey" }, "recipient": { "$ref": "#/$defs/didKey" }, "threadId": { "$ref": "#/$defs/uuid" }, "ceremony": { "type": "object", "description": "OPTIONAL and structurally unconstrained per Trust Tasks 4.11.1: this schema imposes NOTHING on its members — every framework field (enactment, step, round, terminal, prev, ...) passes through unrejected, in any shape. The single RLTP profile rule lives in prose (Contract section 3): a present enactment value MUST recompute against enclosed material; it grants no authority." }, "issuedAt": { "$ref": "#/$defs/rfc3339utc" }, "payload": { "type": "object" }, "proof": { "oneOf": [{ "type": "object", "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"], "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$" } }, "additionalProperties": false }, { "type": "object", "additionalProperties": false, "required": ["mac"], "properties": { "mac": { "type": "string", "pattern": "^u[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" } }, "description": "deniable acknowledgement proof (4.4 acknowledgement class rule): HMAC-SHA-256 over JCS of the document without proof under the arrival tuple's ack key — for acks of designated-verifier payloads only" }] } }, "$defs": { "uuid": { "type": "string", "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$" }, "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "rfc3339utc": { "type": "string", "pattern": "^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9](\\.[0-9]{1,3})?Z$" } }, "allOf": [{ "if": { "properties": { "type": { "const": "https://real-life.org/trust-tasks/delivery-ack/0.1" } }, "required": ["type"] }, "then": { "required": ["proof"] } }, { "if": { "properties": { "type": { "const": "https://real-life.org/trust-tasks/registry-declaration/0.1" } }, "required": ["type"] }, "then": { "required": ["proof"], "properties": { "proof": { "type": "object", "required": ["type", "cryptosuite", "created", "verificationMethod", "proofPurpose", "proofValue"], "properties": { "type": { "const": "DataIntegrityProof" }, "cryptosuite": { "const": "eddsa-jcs-2022" }, "created": { "$ref": "#/$defs/rfc3339utc" }, "verificationMethod": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}#z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "proofPurpose": { "const": "assertionMethod" }, "proofValue": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]+$" } }, "additionalProperties": false } } } }, { "if": { "properties": { "type": { "const": "https://real-life.org/trust-tasks/encounter-bundle/0.1" } }, "required": ["type"] }, "then": { "properties": { "proof": false } } }, { "if": { "properties": { "type": { "const": "https://real-life.org/trust-tasks/encounter-credential-delivery/0.1" } }, "required": ["type"] }, "then": { "properties": { "proof": false } } }] },
@@ -50,6 +53,6 @@ export const SCHEMAS = freeze({
     "visibility-payload-introduction-voucher.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "additionalProperties": false, "required": ["voucher"], "properties": { "voucher": { "$ref": "visibility-introduction-voucher.schema.json" } }, "title": "RLTP payload introduction-voucher (rltp-trust@0.31)" },
     "visibility-self-card.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "additionalProperties": false, "required": ["body", "proof"], "properties": { "body": { "type": "object", "additionalProperties": false, "required": ["type", "anchor", "keyAgreement", "commit"], "properties": { "type": { "const": "self-card@2" }, "anchor": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" }, "keyAgreement": { "type": "string", "pattern": "^z6LS[1-9A-HJ-NP-Za-km-z]{44}$" }, "commit": { "type": "string", "pattern": "^u[A-Za-z0-9_-]{45}[AQgw]$", "description": "the pre-rotation binding to the next generation of the community anchor named in anchor (generation g + 1 of the same digest): u + base64url (unpadded) of the sha2-256 multihash (0x12 0x20 || 32 digest bytes) over the multikey bytes of that generation's Ed25519 public key, 0xed 0x01 || 32 key bytes (Identity 5.4, 8.1)" } } }, "proof": { "type": "object", "additionalProperties": false, "required": ["proofValue"], "properties": { "proofValue": { "type": "string", "pattern": "^z[1-9A-HJ-NP-Za-km-z]{64,88}$" } } } }, "title": "RLTP self-card@2 (rltp-trust@0.31)" },
     "visibility-star.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "type": "object", "additionalProperties": false, "required": ["body", "proof"], "properties": { "body": { "type": "object", "additionalProperties": false, "required": ["type", "salt", "seq", "last", "blinded"], "properties": { "type": { "const": "star@2" }, "salt": { "type": "string", "pattern": "^[1-9][0-9]{0,17}$" }, "seq": { "type": "string", "pattern": "^[1-9][0-9]{0,17}$" }, "last": { "type": "boolean" }, "blinded": { "type": "array", "maxItems": 1024, "uniqueItems": true, "items": { "type": "string", "pattern": "^u[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" } } } }, "proof": { "type": "object", "additionalProperties": false, "required": ["mac"], "properties": { "mac": { "type": "string", "pattern": "^u[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$" } } } }, "title": "RLTP star@2 (rltp-trust@0.31)" },
-    "welcome.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/welcome.schema.json", "title": "RLTP Welcome (rltp-welcome/0.1, rltp-membership@0.19)", "description": "The plaintext of a welcome seal (Membership Tasks Section 4): binding fields (v, group, subject, accept) are owned by Membership Tasks and closed; the receiver verifies them against the admitting operation. material is owned by the Access layer: the rltp-access-material/0.25 object of Access 9.4, naming in keyState the key state its keys belong to (RLTP-ACC-9362), validated against access-material.schema.json; the welcome carries the material of the current key state only (RLTP-ACC-9290), never the keydist form, and history opens through the adapter's chain in the replicated log. The digest over JCS(this document) is committed in the admitting operation's body (admission.welcome), the welcome's one authenticity carrier. The welcome binds the accept digest, never the operation id: the id covers admission.welcome, so a back-pointer would be an unconstructible hash fixed point.", "type": "object", "required": ["v", "group", "subject", "accept", "material"], "additionalProperties": false, "properties": { "v": { "const": "rltp-welcome/0.1" }, "group": { "$ref": "#/$defs/didKey" }, "subject": { "$ref": "#/$defs/didKey" }, "accept": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "document digest of the accept this admission consumes (= digest of admission.accept)" }, "material": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/access-material.schema.json" }, { "properties": { "v": { "const": "rltp-access-material/0.25" } }, "required": ["keyState"], "description": "wire pin (Membership Tasks RLTP-MT-10020, RLTP-MT-10050): the material form rltp-access-material/0.25 with keyState; the keydist form and rltp-access-material/0.24 are rejected" }], "description": "Access-owned: the rltp-access-material/0.25 object of Access 9.4 with keyState (RLTP-ACC-9360, RLTP-ACC-9362)" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" } } },
+    "welcome.schema.json": { "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://real-life.org/rltp/v1/schemas/welcome.schema.json", "title": "RLTP Welcome (rltp-welcome/0.1, rltp-membership@0.20)", "description": "The plaintext of a welcome seal (Membership Tasks Section 4): binding fields (v, group, subject, accept) are owned by Membership Tasks and closed; the receiver verifies them against the admitting operation. material is owned by the Access layer: the rltp-access-material/0.25 object of Access 9.4, naming in keyState the key state its keys belong to (RLTP-ACC-9362), validated against access-material.schema.json; the welcome carries the material of the current key state only (RLTP-ACC-9290), never the keydist form, and history opens through the adapter's chain in the replicated log. The digest over JCS(this document) is committed in the admitting operation's body (admission.welcome), the welcome's one authenticity carrier. The welcome binds the accept digest, never the operation id: the id covers admission.welcome, so a back-pointer would be an unconstructible hash fixed point.", "type": "object", "required": ["v", "group", "subject", "accept", "material"], "additionalProperties": false, "properties": { "v": { "const": "rltp-welcome/0.1" }, "group": { "$ref": "#/$defs/didKey" }, "subject": { "$ref": "#/$defs/didKey" }, "accept": { "type": "string", "pattern": "^(u[A-Za-z0-9_-]{45}[AQgw]|z[1-9A-HJ-NP-Za-km-z]{44,48})$", "description": "document digest of the accept this admission consumes (= digest of admission.accept)" }, "material": { "allOf": [{ "$ref": "https://real-life.org/rltp/v1/schemas/access-material.schema.json" }, { "properties": { "v": { "const": "rltp-access-material/0.25" } }, "required": ["keyState"], "description": "wire pin (Membership Tasks RLTP-MT-10020, RLTP-MT-10050): the material form rltp-access-material/0.25 with keyState; the keydist form and rltp-access-material/0.24 are rejected" }], "description": "Access-owned: the rltp-access-material/0.25 object of Access 9.4 with keyState (RLTP-ACC-9360, RLTP-ACC-9362)" } }, "$defs": { "didKey": { "type": "string", "pattern": "^did:key:z6Mk[1-9A-HJ-NP-Za-km-z]{44}$" } } },
 });
 //# sourceMappingURL=schemas.js.map