@the-rfp-hub/standard 1.0.0

package/ARTIFACTS.md

@@ -0,0 +1,85 @@
+# Artifacts — what this standard ships, what it will ship, and what it will not
+
+A standard is a set of files. This is the list, with a status and a generator for each, so that
+"can I get this as X?" has a written answer instead of an implied roadmap.
+
+Three statuses: **shipped** (in the package today), **planned** (agreed, with a stated trigger —
+not a promise of a date), **declined** (decided against, with the reason).
+
+The reason declines are written down at all: an unwritten decline reads as an oversight, gets
+re-proposed every few months, and each time costs the same conversation.
+
+---
+
+## Shipped
+
+| Artifact | What it is | Generated by |
+|---|---|---|
+| [`schemas/v1.0.0/opportunity.schema.json`](./schemas/v1.0.0/opportunity.schema.json) | **The normative artifact.** JSON Schema draft 2020-12, one self-contained file, local `#/$defs` pointers only. | Hand-authored. Identity (`$id`, the `specVersion` constant, description) stamped by `scripts/codegen.mjs` from `spec.config.json`. |
+| [`src/generated/opportunity.ts`](./src/generated/opportunity.ts) | TypeScript types for every object in the schema. | `scripts/codegen.mjs` via `json-schema-to-typescript`. CI-gated by `codegen:check`. |
+| [`schemas/v1.0.0/context.jsonld`](./schemas/v1.0.0/context.jsonld) | JSON-LD context mapping every top-level term to schema.org / DAOIP-5 / the RFP Hub vocabulary. Term IRIs are versionless; the *document* is versioned. | Hand-authored; `@vocab` stamped by codegen. Drift against the schema fails CI (`scripts/check-spec.mjs`). |
+| [`conformance/v1.0.0/{pass,fail}/`](./conformance/v1.0.0) | Whole documents, one file per rule, named after the rule. Shipped in the package `files` array so external implementers can run them. | Hand-authored. |
+| [`registries/*.json`](./registries) | The three open vocabularies whose values must mean the same thing across publishers: eligibility keys, deadline labels, program models. Plus `entry.schema.json` constraining their shape. `ecosystems` and `networks` are open lists with **no** registry — see the decline below. | Hand-authored entries; `registries/index.json` generated by codegen. |
+| [`schemas/v1.0.0/FIELDS.md`](./schemas/v1.0.0/FIELDS.md) — the field tables | The field reference: type, requiredness, description and governing registry for every property. | `scripts/codegen.mjs`, spliced into the `generated:fields` marker block. Narrative around it is hand-written. |
+| [`schemas/index.json`](./schemas/index.json) | Machine-readable index of published versions, with `latest`. | `scripts/codegen.mjs` from `spec.config.json`. |
+| [`meta/rfphub-schema.meta.json`](./meta/rfphub-schema.meta.json) | Metaschema constraining our own schema file and legalising the three `x-` annotations (`x-stability`, `x-since`, `x-deprecated`) on top of the native 2020-12 vocabulary — including the rule that `x-deprecated` may only accompany a native `deprecated: true`, never replace it. | Hand-authored, validated in CI. |
+| [`spec.config.json`](./spec.config.json) | The spec's identity. The only place a version string or namespace IRI is hand-written. | Hand-authored. |
+| [`schemas/v1.0.0/examples/`](./schemas/v1.0.0/examples) | 28 curated real-world documents. Illustrative, not normative. | Mapped from a public aggregator API; see `BENCHMARK.md`. |
+| Policy docs — [`PROCESS.md`](./PROCESS.md), [`NORMATIVE.md`](./NORMATIVE.md), [`CHANGELOG.md`](./CHANGELOG.md), [`STATUS.md`](./schemas/v1.0.0/STATUS.md), [`adr/`](../../adr) | Four Markdown files and a decision log. No tooling, highest credibility per hour of anything in this table. | Hand-written. |
+
+---
+
+## Planned
+
+Each carries a **trigger** — the condition that makes it worth building. None is scheduled;
+building any of them before its trigger is carrying cost for no reader.
+
+| Artifact | What it would be | Trigger |
+|---|---|---|
+| **Zod schemas** | Runtime-parsing schemas for TypeScript consumers, generated from the JSON Schema — never hand-written. | A consumer needs runtime parsing that the ajv path does not already cover. (The root README has promised these; this row is that promise, scheduled honestly.) |
+| **Pydantic models** | The same for Python consumers. | The first Python consumer. Adding a Python toolchain to a pnpm monorepo before then is pure carrying cost. |
+| **`vocabulary.ttl`** | RDFS/OWL in Turtle — the only format that can state "this field **is** that schema.org property" via `owl:equivalentProperty`, rather than the informal assertion `context.jsonld` makes today. ~200 lines, and the source any other RDF serialization would be generated from. | A consumer asks for it. Not before — see the RDF decline below. |
+| **DAOIP-5 `grantPools` export adapter** | A one-way output adapter emitting grant-type opportunities as DAOIP-5 `grantPools` JSON, applying the three cardinality reductions documented in [`CROSSWALK.md`](./schemas/v1.0.0/CROSSWALK.md). Emits the object shape directly — DAOIP-5's own `@context` does not resolve. | A named consumer wants DAOIP-5 output. It is the only serialization in this niche with a real audience. |
+| **`opportunity-package.schema.json`** (envelope) | `{specVersion, publisher, license, generatedAt, opportunities: [...]}` — because "this object is valid" and "this file is valid RFP Hub data" are different claims, and the envelope is the natural home for publisher, licence and generation time. Both closest domain analogues ship exactly two schemas. | The first bulk export or bulk publication path. Cheaper now than later, but it is an addition to a settled field plan, so it lands as its own decision. |
+| **HTTP `Link` header context advertisement** | On `application/json` opportunity responses from the API: `Link: <…/context.jsonld>; rel="http://www.w3.org/ns/json-ld#context"`. Upgrades every response to linked data for zero payload bytes and no `@context` pollution. | **The canonical domain decision.** A conformant processor MUST fetch an advertised context, so advertising one is only worth doing once the URL is stable — the raw-repository URL used today would pin every consumer to a branch path. |
+
+Two more, noted rather than tabled: **CSV codelists** of the registries (worth it when
+non-developer curators or translators appear — today it adds a parser and a second
+source-of-truth question), and a **separate publication tree** mirroring `$id` byte-for-byte
+(the right end state, blocked on the same domain decision).
+
+### On identifiers, while the domain is undecided
+
+**The canonical domain is undecided, and no identifier pretends otherwise.** Nothing is minted on
+a domain the project does not own. `$id` — for the schema, the metaschema and the registry entry
+schema — is a `raw.githubusercontent.com` URL that dereferences to exactly the bytes shipped here
+(served as `text/plain`, the one known limitation). `@vocab` carries a `draft` segment so it reads
+as provisional on sight.
+
+**Swap `spec.config.json` + run `pnpm codegen` when the domain lands.** `baseUrl` and `vocabIri`
+in [`spec.config.json`](./spec.config.json) are the only hand-written identifiers in the package;
+every `$id`, the `@vocab`, and the self-identification examples in the schema are stamped from
+them. `pnpm check` fails if any identifier is hand-written or points at the retired placeholder
+domain, so the swap cannot be done halfway.
+
+---
+
+## Declined
+
+| Not shipping | Why |
+|---|---|
+| **RDF serializations beyond the JSON-LD context** — RDF/XML, N-Triples, N-Quads, a standalone OWL file, SHACL, ShEx | Schema.org itself generates SHACL/ShEx and does not even serve them; both closest domain analogues ship no RDF at all. Each additional serialization is another file to keep in sync with no reader. If RDF is ever needed, `vocabulary.ttl` is the single source and the rest are one-line conversions from it. |
+| **YAML-authored schema compiled to JSON** | The extra build step and the "which file is the source?" ambiguity start paying off somewhere past ~1500 lines. This schema is a few hundred. |
+| **Content negotiation** — 303 redirects, `Accept` sniffing, PURL registration, VoID/DCAT descriptors | Verified that schema.org does none of these. A stable URL serving the correct `Content-Type` is the entire requirement. |
+| **IANA media type registration** (`application/vnd.rfphub…`) | This is what made GeoJSON an interop primitive, but it only pays once something on the wire must distinguish standard payloads from arbitrary JSON. `application/schema+json` and `application/ld+json` cover today's needs. |
+| **Dual `http://` and `https://` namespace IRIs** | Actively harmful. Schema.org's four-variant matrix exists only because it cannot escape URIs minted in 2011 — it is a scar, not a template. Pick `https` once. |
+| **JSON Schema `$vocabulary` / a custom dialect** | Dialects exist for projects that add keywords to the schema *language*. This is an application schema; a ~25-line metaschema is the right weight. |
+| **`x-crosswalk` / `x-daoip5` annotations inside the schema** | JSON Schema's direction of travel forbids undeclared unknown keywords. Crosswalk data stays in a sidecar document. |
+| **A bundled / dereferenced schema copy** | One self-contained file using only local `#/$defs` pointers. There is nothing to dereference. |
+| **One Markdown file per registry entry** (the layout larger bodies use) | That shape only pays off because a static site renders it into index pages, detail pages and feeds. Without the site it is N files nobody can read as a list. One JSON file per vocabulary is readable, diffable and machine-consumable today. |
+| **A separate conformance-suite repository** | Repo overhead at this size. A versioned directory shipped in the package `files` array gets an external implementer exactly the same thing. |
+| **Branch-per-release-line** with forward-porting scripts | Exists to serve several concurrent release lines and a large technical committee. Frozen sibling directories on `main` is the correct shape here. Borrow the discipline it protects, not the machinery. |
+| **Sphinx / Read the Docs + gettext i18n** | The most expensive component of the largest comparable stack, justified there by a real multi-language mandate. Generated field tables do the useful half. |
+| **A Zenodo DOI** | Cheap to mint and plausible if benchmark results ever get cited in ecosystem research. There is no citer today. Revisit when there is one. |
+| **A machine-readable migration sidecar** (`migration/v1.0.0-recut.json` + a generated `MIGRATION.md`) | Built during the re-cut and removed the same day. It is a converter input with **zero external consumers** — the whole basis for re-cutting v1.0.0 in place was that nobody was holding pre-re-cut data. The [field mapping table in `CHANGELOG.md`](./CHANGELOG.md#field-mapping-old--new) carries the same information for the only audience that exists, a human reading the release entry, at a fraction of the machinery. Revisit if a consumer with pre-re-cut data appears. |
+| **Registries for `ecosystems` and `networks`** | Both fields stay open with no registry. A registry over a list of chain names reads as an allowed-values list however carefully `NORMATIVE.md` words the "registered ≠ allowed" distinction, and it would put a review step in front of a newly launched chain for no interoperability gain. No decision in the re-cut required one. The three registries that remain govern vocabularies where two publishers genuinely need to mean the same thing by a value. |

package/CHANGELOG.md

@@ -0,0 +1,264 @@
+# Changelog — RFP Hub Standard
+
+This file records changes to the **standard** (the schema, the context, and the artifacts
+governed by them). It is not the npm package's release log: package version and spec version
+are separate axes, and only the spec version is tracked here.
+
+Entries are grouped **Schema / Context / Tooling / Docs**.
+
+---
+
+## Spec v1.0.0 re-cut in place (2026-07-27)
+
+**v1.0.0 was re-cut in place: the contents published under this version string differ from
+those published before this date.** This is the one thing semantic versioning exists to
+prevent, and it was done deliberately and once. The standard's initial milestone was never
+declared complete and no external consumer had adopted the earlier shape, so a version bump
+would have invented a migration story
+nobody needed. **In-place re-cuts end here** — a second one would not be defensible.
+
+- **Pre-re-cut bytes:** git tag `standard/spec-v1.0.0-precut-2026-07`, created before the first
+  re-cut commit. That tag is the only way to recover the earlier shape.
+- **Rationale and alternatives considered:** [`adr/0001-recut-v1.0.0-in-place.md`](../../adr/0001-recut-v1.0.0-in-place.md)
+- **The field decisions themselves:** [`adr/0002-v-next-field-recut.md`](../../adr/0002-v-next-field-recut.md)
+- **Field-by-field mapping:** the [Field mapping (old → new)](#field-mapping-old--new) table
+  below. Rows are never removed from it — a field that disappeared from the schema keeps its
+  row here permanently, because that row is what tells a reader holding pre-re-cut data what
+  happened to it.
+
+A document valid against the pre-re-cut schema is **not** valid against this one.
+
+### Schema
+
+**Renamed**
+
+- `type` → `fundingType`. Same six-value structural discriminator; the invariant is now
+  `opportunity[opportunity.fundingType]`.
+- `funding.totalBudget` → `funding.budget`.
+- `funding.amountDistributed` → `funding.allocated`. **Semantics change**, not just a rename:
+  *distributed* → *committed to date*. `remaining` is derived as `budget − allocated` and never
+  stored.
+- `grant.fundingMechanism` (scalar enum) → `grant.fundingMechanisms` (array, `uniqueItems`),
+  with `matching` added to the value set — mechanisms co-occur, and a single-valued enum
+  recorded the fixed-grant-plus-matching-grant case wrongly.
+
+**Removed**
+
+- `organization` (superseded by `sponsoringOrganizations[]`).
+- `source.url`, and the provenance `$def`'s `required: ["url"]`, not replaced. Link-back now
+  runs through `applicationUrl` alone. Consequence, stated plainly: "every entry is traceable
+  to an original posting" is now asserted by ingestion policy, not by validation.
+- `closesAt` (superseded by `deadlines[]`).
+- `funding.awardsToDate`.
+- `rfp.issuingOrganization`, `rfp.budget`, `rfp.proposalDeadline`.
+- `hackathon.registrationDeadline`, `hackathon.submissionDeadline`, `hackathon.startDate`,
+  `hackathon.endDate`.
+- `accelerator.applicationDeadline`.
+
+**Added**
+
+- `sponsoringOrganizations[]` (required, `minItems: 1`; `[0]` is the primary/display org) and
+  `operatingOrganizations[]` (who runs intake/process).
+- `organization.contacts[]` — `{name?, role?, telegram?, email?}`, every field optional, `{}`
+  validates deliberately.
+- `deadlines[]` — `{type: "fixed"|"rolling", date?, label?}`. **Every** per-type-block date
+  folds in, event boundaries included, distinguished by `label`. `date` is required and
+  non-null when `type` is `"fixed"`, enforced by `if`/`then`.
+- `milestones[]` and `$defs/milestone` — `{title?, amount?, criteria?}`, valid on any
+  `fundingType`, array order is the sequence, no date field. Marked `x-stability: provisional`.
+- `eligibility` — an open key→value map of plain strings.
+- `prerequisites`, `resourceLinks`, `serviceAgreement` — three optional top-level free-text
+  strings. `serviceAgreement` is marked `x-stability: provisional`.
+- `grant.programModel` — an open string, marked `x-stability: provisional`.
+- Optional top-level `$schema`, `@context` and `@type`, so an instance can identify itself
+  against `additionalProperties: false` and be consumed as linked data.
+- `x-stability` / `x-since` / `x-deprecated` annotations, legalised by a new metaschema. They
+  extend the 2020-12 vocabulary rather than duplicating it: deprecation is signalled by the
+  **native** `deprecated` keyword, and `x-deprecated` may only accompany it to carry the
+  since/replacedBy/note metadata JSON Schema has no keyword for.
+
+**Newly enforced**
+
+- **One block per funding type.** Each of the six `if`/`then` branches now also forbids every
+  non-matching type block. A `grant` record carrying an `rfp` object used to validate; it now
+  fails. `opportunity[opportunity.fundingType]` is a guarantee rather than an expectation.
+- `specVersion` stays `const "1.0.0"`. It was briefly loosened to a `^1\.0\.\d+$` patch-line
+  pattern during this release and **reverted the same day**: a loosening is a breaking change
+  under this project's own bidirectional definition, and there is no patch process in existence
+  for it to serve. Revisit at the first real editorial patch. See
+  [`adr/0003`](../../adr/0003-instance-self-identification-and-version-pattern.md).
+
+**Schema-file hygiene**, from an audit of the file itself against JSON Schema, OpenAPI and
+OCDS/360Giving practice rather than against the field plan:
+
+- **Descriptions are informative prose only.** Every all-caps BCP 14 keyword was removed from a
+  description and either keyword-enforced or reworded. `NORMATIVE.md` says the schema's
+  *keywords* are the constraints; a MUST in a description that no keyword backs is a prose
+  constraint hiding in the schema. The one genuinely unenforceable rule — `milestones[].amount`
+  following `funding.currency`, a dependency that crosses two objects — now says so at the point
+  it is stated and points at FIELDS.md.
+- **Editorial notes moved to `$comment`.** Design rationale, deliberate omissions, and traps a
+  future editor might "fix" (why `hackathon.prizes` is not `uniqueItems`, why there is no
+  `rfp.outOfScope`, why `organization` has no `extensions`) are maintainer notes, not consumer
+  documentation, and they no longer leak into the generated field reference.
+- **`examples` added** to the fields whose shape is not obvious from their type: `eligibility`,
+  `deadlines`, `milestones`, `serviceAgreement`, `grant.fundingMechanisms`, `grant.programModel`,
+  and a dozen others.
+- **Descriptions completed** — every declared property and every `$def` now carries one, checked
+  in CI. Twenty-eight were previously bare (`socialLinks.*`, `teamSize.*`, most of `accelerator`
+  and `vcFund`, and the roots of `monetaryAmount`, `amountRange`, `teamSize`, `socialLinks`,
+  `prize`, `bounty`, `vcFund`).
+- **Constraints tightened where they were merely absent:** `format: "uri"` on all seven
+  `socialLinks` values (they are links, not handles — `contact.telegram` remains a handle and is
+  documented as the exception); `uniqueItems` on `deadlines` and `rfp.requirements`;
+  `minLength: 1` on the items of `hackathon.tracks`, `bounty.skills`, `vcFund.portfolio` and
+  `rfp.requirements`, matching the other free-text arrays. No committed example changed.
+- **`$defs` reordered** to match the order the generated field reference renders them in, and a
+  root `$comment` now records the property-ordering convention, the `x-stability` default, and
+  why `additionalProperties: false` is safe alongside `allOf` here.
+
+**Also cleaned:** an internal issue-tracker ID that had leaked into the normative `ecosystems`
+description (and from there into every generated type file). A CI lint now fails on any
+recurrence — the standard is CC0 and designed to be embedded and forked, so a leak travels.
+
+#### Field mapping (old → new)
+
+Every field that changed name, shape or existence in the re-cut. **No row is ever removed from
+this table.** Two rows carry a semantics change rather than a mechanical move — those are the
+ones a converter cannot get right by renaming keys, and they are called out in the notes.
+
+| Old | New | Kind | Note |
+|---|---|---|---|
+| `type` | `fundingType` | renamed | Same six values; the invariant becomes `opportunity[opportunity.fundingType]`. |
+| `organization` | `sponsoringOrganizations[0]` | reshaped | Single required object → required array, `minItems: 1`. Wrap to migrate; `[0]` is primary/display. |
+| — | `operatingOrganizations` | added | Who runs intake/process, as distinct from who backs it. |
+| — | `sponsoringOrganizations[].contacts` | added | `{name?, role?, telegram?, email?}`, all optional. |
+| `source.url` | `applicationUrl` | removed | Partial carry-over only. `applicationUrl` is an intake channel, not necessarily the original posting; the `sameAs` sense has no successor. Put a load-bearing original posting in `resourceLinks`. |
+| `source` `required: ["url"]` | — | removed | The provenance `$def` now has no required property. `"source": {}` validates. |
+| `closesAt` | `deadlines[]` | reshaped | **Semantics change.** A single scalar becomes an array of `{type, date?, label?}`. Migrate a non-null value to `[{type:"fixed", date, label:"application"}]`; null migrates to no entry. Sorting/filtering must derive a next-deadline value at the consumer layer, and **selection is by `label`, never by array position** — the head of the array may be a hackathon's start date. |
+| `funding.totalBudget` | `funding.budget` | renamed | Pure rename. |
+| `funding.amountDistributed` | `funding.allocated` | reshaped | **Semantics change.** *Distributed* → *committed to date*. Copying the old value across asserts something different from what the source said. `remaining` is derived as `budget − allocated` and never stored; `disbursed`/`delivered` are not modelled. |
+| `funding.awardsToDate` | — | removed | A per-award count in an otherwise program-level envelope. No successor. |
+| `grant.fundingMechanism` | `grant.fundingMechanisms` | reshaped | Scalar enum → array (`uniqueItems`), plus a new `matching` value. Wrap to migrate. DAOIP-5's field stays singular, so that mapping becomes first-element-or-join. |
+| — | `grant.programModel` | added | Open string; conventional values in `registries/program-models.json`. Provisional. |
+| `rfp.issuingOrganization` | `sponsoringOrganizations[0].name` | reshaped | Free-text issuer superseded by the structured organisation. |
+| `rfp.budget` | `funding` | reshaped | RFP-local `{amount, currency}` → the top-level envelope. |
+| `rfp.proposalDeadline` | `deadlines[]` | reshaped | Label `application`. |
+| `hackathon.registrationDeadline` | `deadlines[]` | reshaped | Label `registration`. |
+| `hackathon.submissionDeadline` | `deadlines[]` | reshaped | Label `submission`. |
+| `hackathon.startDate` | `deadlines[]` | reshaped | Label `event start`. Event boundaries fold in literally — one date model, not two. |
+| `hackathon.endDate` | `deadlines[]` | reshaped | Label `event end`. |
+| `accelerator.applicationDeadline` | `deadlines[]` | reshaped | Label `application`. |
+| — | `eligibility` | added | Open key→value map of plain strings. |
+| — | `prerequisites` | added | Free text: what a *proposal* must contain. Distinct from `rfp.requirements`, which is what the *work* must deliver. |
+| — | `resourceLinks` | added | One free-form string, deliberately not an array of URIs. |
+| — | `serviceAgreement` | added | Free text; presence is the signal. Valid on any `fundingType`. Provisional. |
+| — | `milestones[]` | added | `{title?, amount?, criteria?}`; array order is the sequence; no date field. Provisional. |
+| — | `$schema` / `@context` / `@type` | added | Optional self-identification, permitted against `additionalProperties: false` and ignored by validation. |
+| `allOf` (matching block required) | `allOf` (matching required, others forbidden) | reshaped | One block per funding type is now enforced. A `grant` carrying an `rfp` object used to validate and now fails. |
+
+#### Identifiers
+
+**No identifier is minted on a domain the project does not own.** The earlier `$id` and `@vocab`
+pointed at a domain nobody controls — a URL that looks final, never dereferences, and is inherited
+by every downstream fork of a CC0 artifact.
+
+- **`$id`** — for the schema, the metaschema and the registry entry schema — is now a
+  `raw.githubusercontent.com` URL that **dereferences to exactly the bytes shipped here**. Known
+  limitation: GitHub serves it as `text/plain`, not `application/schema+json`. A URL resolving to
+  the real document with the wrong Content-Type beats one resolving to a parking page.
+- **`@vocab`** carries a `draft` path segment mirroring this version's maturity, so it reads as
+  provisional on sight. It does not dereference, and `STATUS.md` says so rather than hiding it.
+- **`spec.config.json` is the only place a base URL is written.** All three `$id`s, the `@vocab`
+  and the schema's own self-identification examples are stamped from it, so adopting a canonical
+  domain is a one-line edit plus `pnpm codegen`. `pnpm check` fails if an identifier is
+  hand-written or points at the retired placeholder domain, so the swap cannot be done halfway.
+
+### Context
+
+- `@vocab` moved off the version-scoped IRI to a versionless one. Under
+  an in-place re-cut, `…/v1.0.0#organization` would have denoted two different things at two
+  different times. Version the context *document*, never the term IRIs.
+- `@protected: true` added to the stable core terms.
+- Coverage extended from 13 terms to every top-level property of the new shape, with
+  schema.org and DAOIP-5 mappings where they exist — `sponsoringOrganizations → schema:funder`,
+  `operatingOrganizations → schema:sponsor`, `budget → daoip5:totalGrantPoolSize`,
+  `fundingMechanisms → daoip5:grantFundingMechanism`. Terms for deleted fields removed.
+- A CI check now fails on context↔schema drift in either direction, which was previously
+  invisible.
+
+### Tooling
+
+- **`spec.config.json`** — one metadata block holding the spec's identity (`specVersion`,
+  `schemaDir`, `id`, `vocabIri`, `status`, `recutDate`). The version string used to be
+  hand-written in seven places; it is now hand-written in one.
+- **`scripts/codegen.mjs`** extended to stamp that identity into the schema `$id`, the
+  `specVersion` constant, the schema description, the context's `@vocab` and `SPEC_VERSION` —
+  and to generate `registries/index.json`, `schemas/index.json` and the `FIELDS.md` field
+  tables alongside the TypeScript types. `codegen:check` covers all seven artifacts.
+- **`scripts/check-spec.mjs`** (`pnpm check`) — publication rules: context↔schema drift,
+  version-string agreement against `spec.config.json`, and the source-neutrality lint.
+- **`registries/`** — `eligibility-keys`, `deadline-labels` and `program-models`, plus
+  `entry.schema.json` and a generated `index.json`. Entries are never deleted; they are
+  deprecated with a `replacedBy` pointer. `ecosystems` and `networks` deliberately have **no**
+  registry: they stay plain open lists, because a registry there reads as an allowed-values list
+  despite what `NORMATIVE.md` says, and no decision required one.
+- **`conformance/v1.0.0/{pass,fail}/`** — whole documents, one file per rule, named after the
+  rule, shipped in the package `files` array so external implementers can run them. Replaces
+  the 2 valid + 4 invalid fixtures that lived inside `packages/validate/test/` where nobody
+  outside the repo could reach them.
+- **`meta/rfphub-schema.meta.json`** — metaschema constraining our schema file's shape and
+  legalising the three `x-` annotation keywords, validated in CI.
+- **`rfphub-validate` gains an advisory tier** (`src/checks/`): warnings reported separately
+  from schema errors, count-phrased in text output, promoted to a failing exit code by
+  `--strict`. Seed checks cover unregistered eligibility keys, deadline labels and program
+  models, plus the milestone-amount-without-envelope-currency rule that JSON Schema cannot
+  express because it crosses two objects. The registries and this tier are a pair: either one
+  alone is worth less than neither.
+
+### Docs
+
+- **`FIELDS.md` rewritten for the new shape**, and half of it is now generated: the field
+  reference tables — type, requiredness, description and governing registry for every property —
+  are rendered from the schema into a marker block by `pnpm codegen` and gated by
+  `codegen:check`. A hand-maintained field table drifts from the schema inside one release. The
+  narrative around them carries the BCP 14 keyword boilerplate, the documentation conventions the
+  schema cannot enforce (sponsor ≠ source of funds, `applicationUrl` = whatever the submission
+  channel is, `prerequisites` vs `rfp.requirements`, the three free-text siblings,
+  select-deadlines-by-label, milestone currency and due dates, single-currency-at-the-envelope),
+  and a conformance section.
+- **Design principle #2 reworded.** It used to read "every entry MUST carry a `source.url`" — a
+  MUST on a field this release deletes. It now says what is actually true: provenance
+  completeness is asserted by ingestion policy, not by schema validation.
+- **`CROSSWALK.md` remapped** for every renamed, removed and added field, with "no equivalent"
+  stated honestly rather than left blank, and the three cardinality divergences from DAOIP-5
+  (single vs. multi-currency, one close date vs. labelled deadline array, scalar vs. array
+  funding mechanism) written out. The claim that "no v1.0.0 field had to change to align" is
+  retired. **Its JSON-LD usage example now validates** — it previously carried `@context` and
+  `@type` against `additionalProperties: false`, so the project's own published example failed
+  against the project's own schema.
+- **`BENCHMARK.md` corrected** to distinguish the pre-re-cut corpus measurement (311 pulled,
+  289 validated — not re-run) from the current claim (28 committed examples, converted and
+  re-validated against the re-cut schema).
+- **New governance and process set:** `PROCESS.md` (feature stages; the operational, bidirectional
+  definition of breaking with JSON Schema's indeterminate-state carve-out; deprecation;
+  registry registration criteria; errata triage labels; release checklist), `NORMATIVE.md`
+  (normative vs. informative, and the rule that informative content may be corrected outside the
+  release cycle), `ARTIFACTS.md` (every artifact shipped/planned/declined, with its generator and
+  its trigger), `schemas/v1.0.0/STATUS.md` (maturity, the honest re-cut paragraph, feedback
+  channel), and `GOVERNANCE.md` at the repo root (editors, decision rule, review windows, appeal
+  path, and an explicit list of what this project deliberately does not have).
+- **`adr/`** added at the repo root with a MADR template, an index, and three records: the
+  in-place re-cut, the field re-cut with its accepted costs, and the two tooling-driven additions
+  (instance self-identification accepted; the `specVersion` patch-line pattern proposed and
+  reverted the same day).
+- **`schemas/index.json`** (generated) — a machine-readable index of published spec versions with
+  a `latest` pointer. Free while there is one version and impossible to retrofit cleanly.
+- Root `README.md` link-back language corrected to describe the application link, and
+  `CONTRIBUTING.md`'s versioning section rewritten — it previously promised "additive → minor,
+  breaking → new major at a new URL", the exact policy this release breaks, and forward-referenced
+  governance documents that did not exist. They exist now and it links them.
+- All 28 curated examples converted to the new shape. Where the conversion would have dropped
+  a real value, it was rehomed rather than lost: `source.url` became `applicationUrl` on the
+  seven records that had none and `resourceLinks` on the six where `applicationUrl` already
+  pointed elsewhere; the one non-zero `funding.awardsToDate` was preserved under `extensions`.

package/LICENSE

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

package/NORMATIVE.md

@@ -0,0 +1,77 @@
+# What is normative in the RFP Hub Standard
+
+Nobody infers this. It has to be written down, so this is the document that says which artifacts
+carry authority and which ones merely describe it.
+
+## Normative
+
+These define the standard. A claim of conformance is a claim about these files.
+
+| Artifact | What it governs |
+|---|---|
+| [`schemas/v1.0.0/opportunity.schema.json`](./schemas/v1.0.0/opportunity.schema.json) | **The definition.** A document conforms to v1.0.0 when it validates against this file. |
+| [`registries/`](./registries) — the **registered values** | The conventional values of the three open vocabularies the standard governs by registry: `eligibility` keys, `deadlines[].label`, `grant.programModel`. See the important qualification below. |
+| [`conformance/v1.0.0/`](./conformance/v1.0.0) | The published pass/fail cases. An implementation is conformant with respect to the suite when it accepts everything in `pass/` and rejects everything in `fail/`. |
+| [`spec.config.json`](./spec.config.json) | The spec's identity — version, `$id`, vocabulary IRI, maturity. |
+| [`schemas/v1.0.0/context.jsonld`](./schemas/v1.0.0/context.jsonld) | The term IRIs a document expands to when read as linked data. |
+
+**The qualification on registries.** A registry is normative about **what a value means**, not
+about **which values are allowed**. The schema deliberately keeps these fields open: an
+unregistered deadline label, eligibility key or program model is **valid data** and produces a
+*warning*, never a validation error. Registering a value fixes its meaning so two publishers
+using it mean the same thing. Entries are never deleted — see [`PROCESS.md`](./PROCESS.md).
+
+**Why only three.** `ecosystems` and `networks` are open lists too, and deliberately have **no**
+registry. That distinction above is a fine one, and a registry over a list of chain names would
+be read as an allowed-values list no matter how this document words it — while also putting a
+review step in front of a newly launched chain for no interoperability gain. The three
+vocabularies that *are* registry-governed are the ones where two publishers writing different
+strings for the same concept produces genuinely uncomparable data.
+
+**The qualification on the conformance suite.** Passing the suite is **evidence of conformance,
+not the definition of it**. The schema is the definition. The suite asserts nothing about which
+error an implementation reports, how many, or in what order.
+
+## Informative
+
+These explain the standard. They are corrigible, and correcting them is not a spec change.
+
+| Artifact | What it is |
+|---|---|
+| [`schemas/v1.0.0/FIELDS.md`](./schemas/v1.0.0/FIELDS.md) — the **prose** | Field explanations, documentation conventions, status semantics, consumer guidance. Its generated field tables are derived from the schema and cannot disagree with it; the narrative around them is human-written and can. |
+| [`schemas/v1.0.0/CROSSWALK.md`](./schemas/v1.0.0/CROSSWALK.md) | Mappings to DAOIP-5 and schema.org/Grant. |
+| [`schemas/v1.0.0/BENCHMARK.md`](./schemas/v1.0.0/BENCHMARK.md) | A measurement against real data. |
+| [`schemas/v1.0.0/examples/`](./schemas/v1.0.0/examples) | Curated real-world documents. Illustrations, **not** conformance cases. |
+| [`CHANGELOG.md`](./CHANGELOG.md) (including its field-mapping table), [`ARTIFACTS.md`](./ARTIFACTS.md), [`schemas/v1.0.0/STATUS.md`](./schemas/v1.0.0/STATUS.md) | The record of what changed, what ships, and where this version stands. |
+| READMEs, [`adr/`](../../adr) | Orientation and decision history. |
+| [`PROCESS.md`](./PROCESS.md), [`GOVERNANCE.md`](../../GOVERNANCE.md) | Normative about **the project's process**, not about the data format. A document does not conform or fail to conform to them. |
+
+## The two rules that follow
+
+1. **The schema takes precedence over conflicting prose.** If [`FIELDS.md`](./schemas/v1.0.0/FIELDS.md)
+   describes a constraint the schema does not enforce, or describes it differently, **the schema
+   is right and the prose is a defect**. Report it as an erratum; do not implement the prose.
+
+   One deliberate exception, stated in both places: a handful of rules in FIELDS.md are
+   **normative in intent but not schema-expressible** — the clearest is that
+   `milestones[].amount` must be denominated in `funding.currency`, a dependency that crosses two
+   objects. Those are enforced by the validator's advisory tier and by ingestion policy, and each
+   one is labelled as such at the point it is stated. They are requirements on *publishers*, not
+   conditions of schema validity.
+
+2. **Informative content may be corrected outside the release cycle.** A wrong crosswalk row, a
+   stale benchmark number, an unclear sentence in FIELDS.md, a broken link — all of these can be
+   fixed by an ordinary PR at any time, without a spec version, without a comment window, and
+   without a changelog entry beyond the commit. This is the whole point of drawing the line: it
+   keeps documentation improvable at the speed documentation needs to be improvable, while the
+   schema stays under change control.
+
+   The inverse also holds. A change to any artifact in the normative table — **including adding,
+   deprecating or re-describing a registry value** — is a spec change and follows
+   [`PROCESS.md`](./PROCESS.md).
+
+## What this does not decide
+
+Whether a *field* is stable is a separate axis from whether a *document* is normative. Per-field
+maturity is carried by the `x-stability` annotation inside the schema and governed by the feature
+stages in [`PROCESS.md`](./PROCESS.md).