@typedstandards/civic-typed-harness 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,115 @@
 Factual record of what changed per published version. Section references are
 to the Typed Standards specification unless noted otherwise.
 
+## 0.3.0 — 2026-08-20
+
+**Settlement-era civic vocabulary + produce-core 0.3.0**
+([civic-ai-tools#160](https://github.com/npstorey/civic-ai-tools/issues/160) —
+the 2026-08-19 vocabulary settlement, [ADR-0025](../../docs/adr/0025-vocabulary-settlement-evidence-excision.md);
+canonical mapping in the specification's **Appendix J**, migration class
+*frozen-in-signed-artifacts*). Minor, not breaking: no existing export is
+removed or retyped, and no already-published package changes.
+
+- **New emissions mint the settlement-era vocabulary.** `CIVIC_NS` becomes
+  `https://civicaitools.org/ns/civic/` (was
+  `https://civicaitools.org/ns/evidence/`) and `CIVIC_URN_PREFIX` becomes
+  `urn:civic-record` (was `urn:civic-evidence`). Every id emitted by
+  `buildProvenanceGraph` and every `civic:` `@context` entry moves with them.
+  **A package produced by this version is not byte-identical to one produced
+  by 0.2.0 from the same inputs** — the graph is inside the hashed envelope,
+  so its envelope hash differs. Packages already signed under 0.2.0 are
+  untouched and remain verifiable exactly as published.
+- **The prior era stays available, exported, and reproducible.** New:
+  `PRIOR_ERA_CIVIC_NS`, `PRIOR_ERA_CIVIC_URN_PREFIX`, the `CivicVocabulary`
+  type, `makeCivicVocabulary(ns, urnPrefix)`, and the two bound eras
+  `CIVIC_VOCABULARY` / `PRIOR_ERA_CIVIC_VOCABULARY`. `ProvenanceConfig` gains
+  an optional `vocabulary` field defaulting to `CIVIC_VOCABULARY`. Supplying
+  `PRIOR_ERA_CIVIC_VOCABULARY` reproduces a pre-settlement record
+  byte-for-byte — the only sanctioned use; it is never for new emissions.
+  Unlike the other `ProvenanceConfig` fields this one is defaulted rather than
+  required: emitting the current vocabulary is not the silent-attribution
+  hazard ADR-0024 guards against.
+- **Unchanged signatures.** `civicUrn`, `civicModelUrn`, `civicSourceAgentUrn`,
+  `civicPlatformUrn`, and `makeCivicProvContext` keep their exact signatures
+  and now delegate to `CIVIC_VOCABULARY`, so callers of the settlement era need
+  no edits.
+- **`buildEvaluationPrompt` takes `RecordPackage`** — produce-core 0.3.0's
+  settlement-era name for the same object (Appendix J, *alias-and-deprecate*).
+  `EvidencePackage` remains a deprecated upstream alias of that exact type, so
+  existing callers still compile; the rubric test suite deliberately stays on
+  the prior name as the executable alias proof.
+- **Dependency floor raised:** `@typedstandards/produce-core` `^0.2.0` →
+  `^0.3.0`, and the `@typedstandards/verify-core` devDependency `^0.8.0` →
+  `^0.9.0` to match the version produce-core 0.3.0 resolves (same-commit
+  manifest bump across a minor boundary). No behavior-affecting patch bumps
+  ride along.
+- **Both eras are under test.** The two captured fixtures
+  (`reference-golden.json`, `website-golden.json`) predate the settlement and
+  are not edited: their byte- and hash-parity legs now run with the prior-era
+  vocabulary injected, and a settlement-era leg asserts the same reference
+  bytes with exactly the two Appendix J literals substituted, with the hashes
+  recomputed from those substituted bytes by verify-core's shared chain. The
+  per-canonicalization-rule consequence is pinned explicitly: under
+  `legacy-json/v1` the era flip moves `contentHash` (the whole package is
+  fingerprinted, provenance included); under `dathere-ag-jupyter/v1` it does
+  not (only the executed notebook is). The envelope hash moves under both.
+- **Purity guard widened:** the capture/format boundary test now bars
+  vocabulary literals of **both** eras from `src/capture/**`. The invariant is
+  "vocabulary lives only in `format/vocabulary.ts`", not "the prior-era strings
+  are gone" — both eras are real vocabulary now, and either could be redefined
+  in the wrong module.
+
+## 0.2.0 — 2026-08-17
+
+**Breaking: identity-bearing config is now required**
+([civic-ai-tools#153](https://github.com/npstorey/civic-ai-tools/issues/153) —
+the [ADR-0024](../../docs/adr/0024-evidence-path-configuration.md) posture at
+the domain layer: configuration that reaches signed output is absent-or-error,
+never defaulted). 0.1.0 applied the civicaitools.org reference deployment's
+identity via silently-applied default parameters; 0.2.0 removes every such
+default, so a bare call fails typecheck instead of attributing output to the
+reference deployment.
+
+- **Breaking — the config parameter is required in five API families:**
+  - `buildProvenanceGraph(trace, input, config)` — `ProvenanceConfig`
+    required (was defaulted to `CIVICAITOOLS_PROVENANCE_CONFIG`).
+  - `buildDatHereEnvironment(model, skillMcpServerUrl, config)` and
+    `deriveDatHereEnvelopeFields(input, config)` —
+    `DatHereEnvironmentConfig` required (was defaulted to
+    `CIVICAITOOLS_ENVIRONMENT_CONFIG`; the `host` field lands under the
+    envelope hash, so this default was the sharpest instance).
+  - `new TraceBuilder(config)` — `TraceBuilderConfig` required (was
+    defaulted to `CIVICAITOOLS_TRACE_CONFIG`). The intra-config
+    `now`/`randomBytes` operational fallbacks are unchanged — they are not
+    identity.
+  - `isDatasetKeyedSource(sourceId, registry)`,
+    `displayNameForSource(sourceId, registry)`,
+    `formatDataSourcesSummary(entries, registry)` — `CivicSourceRegistry`
+    required in all three (was defaulted to `CIVIC_SOURCE_REGISTRY`).
+- **Breaking — the model-agent description is omitted when unset.** The
+  module-private fallback description is deleted.
+  `ProvenanceConfig.modelAgentDescription` stays optional, but when unset the
+  PROV model agent now carries **no** `dcterms:description` field at all
+  (honest absence, not an empty string — ADR-0024 §B) instead of the fallback
+  text. `CIVICAITOOLS_PROVENANCE_CONFIG` now carries
+  `modelAgentDescription: 'Large language model via OpenRouter'`, so
+  reference-config output is byte-identical to 0.1.0.
+- **The reference-value exports remain.** `CIVICAITOOLS_PROVENANCE_CONFIG`,
+  `CIVICAITOOLS_ENVIRONMENT_CONFIG`, `CIVICAITOOLS_TRACE_CONFIG`, and
+  `CIVIC_SOURCE_REGISTRY` are still exported — they are the reference
+  deployment's values, which the reference app passes explicitly; they are no
+  longer applied on any caller's behalf.
+- **Migration:** pass the exported reference configs to reproduce 0.1.x
+  behavior byte-for-byte (see README §"Migrating from 0.1.x"). Golden
+  fixtures are unchanged; byte parity now comes from tests passing the
+  reference config explicitly, never from restored defaults.
+- **Enforcement:** `src/required-config.assert.ts` encodes the acceptance
+  condition — one `@ts-expect-error` bare call per changed signature —
+  so reintroducing a default parameter fails `npm run typecheck` and
+  `npm run build`.
+- Dependencies unchanged (`@typedstandards/produce-core` `^0.2.0` remains the
+  single runtime dependency).
+
 ## 0.1.0 — 2026-08-02
 
 Initial release: the civic **domain harness** for Typed Standards evidence

package/README.md

@@ -1,6 +1,6 @@
 # @typedstandards/civic-typed-harness
 
-The civic **domain harness** for [Typed Standards](../../docs/architecture/typed-standards-specification.md) evidence packages — the DOMAIN side of the format/domain line drawn in [ADR-0021](../../docs/adr/0021-produce-core-extraction.md), relocated from the reference app as an installable package ([ADR-0022](../../docs/adr/0022-civic-typed-harness-packaging.md)). The operating rule: **the harness derives, the core assembles** — everything here produces domain-derived values (civic vocabulary terms, datHere policy fields, provenance graphs, capture artifacts) that feed [`@typedstandards/produce-core`](https://www.npmjs.com/package/@typedstandards/produce-core)'s neutral envelope assembly.
+The civic **domain harness** for [Typed Standards](../../docs/architecture/typed-standards-specification.md) record packages — the DOMAIN side of the format/domain line drawn in [ADR-0021](../../docs/adr/0021-produce-core-extraction.md), relocated from the reference app as an installable package ([ADR-0022](../../docs/adr/0022-civic-typed-harness-packaging.md)). The operating rule: **the harness derives, the core assembles** — everything here produces domain-derived values (civic vocabulary terms, datHere policy fields, provenance graphs, capture artifacts) that feed [`@typedstandards/produce-core`](https://www.npmjs.com/package/@typedstandards/produce-core)'s neutral envelope assembly.
 
 > **Name.** The package landed in-repo under the working name `civic-typed-harness` with the final npm name deferred (ADR-0022 §B). It publishes as **`@typedstandards/civic-typed-harness`** — the standard's scope with the full layer-3 basename; the rationale, the alternatives scored, and the named reversal condition are recorded in the planning-side naming memo and summarized in the [ADR-0022 addendum](../../docs/adr/0022-civic-typed-harness-packaging.md#addendum-2026-08-02--final-npm-name).
 
@@ -8,24 +8,42 @@ The civic **domain harness** for [Typed Standards](../../docs/architecture/typed
 
 | Module group | Modules | What it is |
 |---|---|---|
-| **`src/format/`** — the civic format-extension | `vocabulary.ts`, `sources.ts`, `dathere.ts`, `profiles.ts` | What extends the *standard*: the `civic:` JSON-LD namespace and `urn:civic-evidence:` id scheme, the civic source registry, the datHere envelope-policy derivations (producerProfile, canonicalization rule, summary emission, environment extension), and the captureMethod vocabulary surface. |
+| **`src/format/`** — the civic format-extension | `vocabulary.ts`, `sources.ts`, `dathere.ts`, `profiles.ts` | What extends the *standard*: the `civic:` JSON-LD namespace and `urn:civic-record:` id scheme (both in two eras — new emissions mint the settlement-era terms, the prior-era terms stay exported and reproducible because they are frozen inside already-signed records; spec Appendix J), the civic source registry, the datHere envelope-policy derivations (producerProfile, canonicalization rule, summary emission, environment extension), and the captureMethod vocabulary surface. |
 | **`src/capture/`** — the capture machinery | `trace.ts`, `skill-metadata.ts`, `data-sources.ts`, `provenance.ts` | What *produces* under it: the OTel `TraceBuilder`, skill-metadata extraction, data-source population, and the provenance **builder** — which imports its vocabulary from the format group and walks the trace. |
 | **`src/rubric/`** — the adversarial rubric | `adversarial-eval-core.ts` | The civic six-criterion evaluation rubric (pure core: rubric text, pinned version hash, prompt builder, response parser). The model runner and result emission stay implementation-side. |
 
 **The internal boundary is load-bearing:** no capture module defines vocabulary, and no format-extension module walks a trace — this sentence reserves a future split of the format-extension group into its own package (a civic extension *of Typed Standards*, distinct from the civic *harness* proper) as a mechanical move rather than a re-partition. The boundary is enforced by `src/purity.test.ts`.
 
-## Config, not constants
+## Config, not constants — and required, never defaulted
 
-Every value that names a deployment is a **typed config input**, with the civicaitools.org demo values exported as overridable defaults:
+Every value that names a deployment is a **required typed config input**. As of 0.2.0 the harness never applies a deployment identity on a caller's behalf: a call that omits the config **fails typecheck** ([ADR-0024](../../docs/adr/0024-evidence-path-configuration.md)'s posture at the domain layer — configuration that reaches signed output is absent-or-error, never defaulted; the removal of the 0.1.x defaults is [civic-ai-tools#153](https://github.com/npstorey/civic-ai-tools/issues/153)). The `CIVICAITOOLS_*` exports are the civicaitools.org **reference deployment's values** — the reference app passes them explicitly; any other instance supplies its own.
 
-| Value | Config type | Demo default export |
+| Identity-bearing input | Config type | Reference-value export |
 |---|---|---|
-| Platform-agent identity/URL | `PlatformAgentConfig` | `CIVICAITOOLS_PLATFORM_AGENT` |
+| Platform-agent identity/URL | `PlatformAgentConfig` (`ProvenanceConfig.platformAgent`) | `CIVICAITOOLS_PLATFORM_AGENT` |
 | MCP source registry (server URLs, catalog types, display names) | `CivicSourceRegistry` | `CIVIC_SOURCE_REGISTRY` |
-| Tool-name → source-id resolver | `ToolSourceResolver` | `civicToolSourceResolver` |
-| Environment-extension `host` | `DatHereEnvironmentConfig` | `CIVICAITOOLS_ENVIRONMENT_CONFIG` |
+| Tool-name → source-id resolver (a caller-supplied input, not a silent default) | `ToolSourceResolver` | `civicToolSourceResolver` |
+| Environment-extension `host` (lands under the envelope hash) | `DatHereEnvironmentConfig` | `CIVICAITOOLS_ENVIRONMENT_CONFIG` |
 | Trace `service.name` / scope identity | `TraceBuilderConfig` | `CIVICAITOOLS_TRACE_CONFIG` |
-| Provenance build (all of the above + model-agent description) | `ProvenanceConfig` | `CIVICAITOOLS_PROVENANCE_CONFIG` |
+| Model-agent `dcterms:description` | `ProvenanceConfig.modelAgentDescription` (optional field) | carried in `CIVICAITOOLS_PROVENANCE_CONFIG` |
+| Provenance build (platform agent + source registry + model-agent description) | `ProvenanceConfig` | `CIVICAITOOLS_PROVENANCE_CONFIG` |
+
+`modelAgentDescription` is the one **optional** field among these: when unset, the PROV model agent carries no `dcterms:description` at all — the field is omitted from the graph (honest absence), never filled with a fallback. The `now`/`randomBytes` fields on `TraceBuilderConfig` are operational fallbacks (runtime clock/CSPRNG), not identity, and keep their intra-config defaults.
+
+### Migrating from 0.1.x
+
+0.1.x applied the reference deployment's identity via silent default parameters; 0.2.0 removes every such default — the breaking change is the point: a bare call that would have embedded civicaitools.org's identity in the output now fails to compile. To reproduce 0.1.x behavior byte-for-byte, pass the exported reference configs explicitly:
+
+```ts
+// 0.1.x — compiled, and silently attributed output to the reference deployment:
+const graph = buildProvenanceGraph(trace, input);
+
+// 0.2.0 — the same output, byte-identical, with the identity stated:
+import { CIVICAITOOLS_PROVENANCE_CONFIG } from '@typedstandards/civic-typed-harness';
+const graph = buildProvenanceGraph(trace, input, CIVICAITOOLS_PROVENANCE_CONFIG);
+```
+
+Likewise: `buildDatHereEnvironment` / `deriveDatHereEnvelopeFields` take `CIVICAITOOLS_ENVIRONMENT_CONFIG`, `new TraceBuilder(...)` takes `CIVICAITOOLS_TRACE_CONFIG`, and `isDatasetKeyedSource` / `displayNameForSource` / `formatDataSourcesSummary` take `CIVIC_SOURCE_REGISTRY`. The acceptance condition is encoded in `src/required-config.assert.ts`: reintroducing any of the removed defaults fails `npm run typecheck`.
 
 ## Purity contract (harness-grade)
 
@@ -37,7 +55,7 @@ Runtime dependency: **`@typedstandards/produce-core` (`^0.2.0`) only.** The veri
 
 ## Byte-compatibility
 
-The port is tested for **byte parity** against golden outputs captured from the reference implementation (`src/__fixtures__/website-golden.json`): with the demo default config, `buildProvenanceGraph` and `buildDataSources` reproduce the app's output byte-for-byte, and `RUBRIC_VERSION_SHA256` is asserted against the exact reference digest (moving the rubric changes no hashes). Fixture-level byte-compat against produce-core's `reference-golden.json` (`src/golden-reproduction.test.ts`) and the produce→verify composition round-trip (`src/composition-roundtrip.test.ts`) landed in S2 P2 and run with the suite.
+The port is tested for **byte parity** against golden outputs captured from the reference implementation (`src/__fixtures__/website-golden.json`): with the reference config passed explicitly, `buildProvenanceGraph` and `buildDataSources` reproduce the app's output byte-for-byte, and `RUBRIC_VERSION_SHA256` is asserted against the exact reference digest (moving the rubric changes no hashes). Both captured fixtures predate the 2026-08-19 vocabulary settlement, so their byte-parity legs run with `PRIOR_ERA_CIVIC_VOCABULARY` injected — the fixtures are never rewritten — beside a settlement-era leg asserting the same bytes with exactly the two Appendix J literals substituted. Fixture-level byte-compat against produce-core's `reference-golden.json` (`src/golden-reproduction.test.ts`) and the produce→verify composition round-trip (`src/composition-roundtrip.test.ts`) landed in S2 P2 and run with the suite.
 
 ## Develop
 

package/dist/capture/provenance.d.ts

@@ -1,5 +1,5 @@
 import { type ProvGraph, type ProvNode } from '@typedstandards/produce-core';
-import { type PlatformAgentConfig } from '../format/vocabulary.ts';
+import { type CivicVocabulary, type PlatformAgentConfig } from '../format/vocabulary.ts';
 import { type CivicSourceRegistry } from '../format/sources.ts';
 export type { ProvGraph, ProvNode };
 /** Package-level inputs to the graph build. */
@@ -19,7 +19,7 @@ export interface ProvenanceInput {
 }
 /** Instance configuration for the graph build (config-not-constants). */
 export interface ProvenanceConfig {
-    /** Platform-agent identity — the deployment publishing the evidence. */
+    /** Platform-agent identity — the deployment publishing the record. */
     platformAgent: PlatformAgentConfig;
     /** Source registry supplying agent titles and MCP server URLs. */
     sourceRegistry: CivicSourceRegistry;
@@ -30,11 +30,22 @@ export interface ProvenanceConfig {
      *  overrides when present (the skill is fetched from that source's MCP
      *  server). Default `socrata`. */
     skillSourceId?: string;
-    /** `dcterms:description` of the model agent. Default names the demo
-     *  deployment's model gateway. */
+    /** `dcterms:description` of the model agent. When unset, the model agent
+     *  carries no `dcterms:description` at all — the field is omitted from the
+     *  graph (honest omission), never filled with a fallback. */
     modelAgentDescription?: string;
+    /** Vocabulary era to emit (spec Appendix J). Defaults to the settlement-era
+     *  `CIVIC_VOCABULARY` — the only value a new emission may use. Supply
+     *  `PRIOR_ERA_CIVIC_VOCABULARY` ONLY to reproduce or verify a record signed
+     *  before the 2026-08-19 settlement, whose identifiers are frozen under the
+     *  hash it was signed with. Unlike the other fields here this is not
+     *  deployment identity, so it is defaulted rather than required: emitting
+     *  the current vocabulary is never the silent-attribution hazard ADR-0024
+     *  guards against. */
+    vocabulary?: CivicVocabulary;
 }
-/** Demo default: the civicaitools.org reference deployment. */
+/** The civicaitools.org reference deployment's values. Passed explicitly by
+ *  the reference app — never applied as a default. */
 export declare const CIVICAITOOLS_PROVENANCE_CONFIG: ProvenanceConfig;
 /**
  * Build a W3C PROV-O JSON-LD graph from an OTel trace and package metadata.
@@ -45,4 +56,4 @@ export declare const CIVICAITOOLS_PROVENANCE_CONFIG: ProvenanceConfig;
  * - Prompt, skill guidance, data responses, output → prov:Entity
  * - LLM model, MCP server, platform → prov:Agent
  */
-export declare function buildProvenanceGraph(trace: Record<string, unknown>, input: ProvenanceInput, config?: ProvenanceConfig): ProvGraph;
+export declare function buildProvenanceGraph(trace: Record<string, unknown>, input: ProvenanceInput, config: ProvenanceConfig): ProvGraph;

package/dist/capture/provenance.js

@@ -9,20 +9,23 @@
 //
 // Config-not-constants: the platform-agent identity, the source-agent
 // registry (server URLs), and the model-agent description are typed config
-// inputs; `CIVICAITOOLS_PROVENANCE_CONFIG` is the demo default and
-// reproduces the reference implementation's output byte-for-byte (property
-// insertion order is preserved throughout — the legacy hash chain's byte
-// contract).
+// inputs, and the config is REQUIRED — no deployment identity is ever
+// applied silently (ADR-0024 posture at the domain layer).
+// `CIVICAITOOLS_PROVENANCE_CONFIG` is the reference deployment's values,
+// which the reference app passes explicitly; with it, the builder reproduces
+// the reference implementation's output byte-for-byte (property insertion
+// order is preserved throughout — the legacy hash chain's byte contract).
 import { makeProvGraph, makeEntityNode, makeActivityNode, makeAgentNode, provRef, provUsed, provWasGeneratedBy, provWasDerivedFrom, provWasAssociatedWith, xsdDateTime, } from '@typedstandards/produce-core';
 import { hash } from "./trace.js";
-import { makeCivicProvContext, civicUrn, civicModelUrn, civicSourceAgentUrn, civicPlatformUrn, CIVICAITOOLS_PLATFORM_AGENT, } from "../format/vocabulary.js";
+import { CIVIC_VOCABULARY, CIVICAITOOLS_PLATFORM_AGENT, } from "../format/vocabulary.js";
 import { CIVIC_SOURCE_REGISTRY, FALLBACK_SOURCE_ID, isDatasetKeyedSource, } from "../format/sources.js";
-/** Demo default: the civicaitools.org reference deployment. */
+/** The civicaitools.org reference deployment's values. Passed explicitly by
+ *  the reference app — never applied as a default. */
 export const CIVICAITOOLS_PROVENANCE_CONFIG = {
     platformAgent: CIVICAITOOLS_PLATFORM_AGENT,
     sourceRegistry: CIVIC_SOURCE_REGISTRY,
+    modelAgentDescription: 'Large language model via OpenRouter',
 };
-const DEFAULT_MODEL_AGENT_DESCRIPTION = 'Large language model via OpenRouter';
 // --- Helpers ---
 function getAttr(attrs, key) {
     const attr = attrs.find(a => a.key === key);
@@ -42,7 +45,7 @@ function nanoToIso(nano) {
  * - Prompt, skill guidance, data responses, output → prov:Entity
  * - LLM model, MCP server, platform → prov:Agent
  */
-export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENANCE_CONFIG) {
+export function buildProvenanceGraph(trace, input, config) {
     const otel = trace;
     const spans = otel?.resourceSpans?.[0]?.scopeSpans?.[0]?.spans || [];
     const { packageId, promptHash, promptText, outputText, model, portal } = input;
@@ -50,11 +53,14 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     const registry = config.sourceRegistry;
     const fallbackSourceId = config.fallbackSourceId ?? FALLBACK_SOURCE_ID;
     const skillSourceId = config.skillSourceId ?? FALLBACK_SOURCE_ID;
-    const modelDescription = config.modelAgentDescription ?? DEFAULT_MODEL_AGENT_DESCRIPTION;
+    // Vocabulary era — settlement-era unless a prior-era reproduction asks
+    // otherwise. Every id and the `@context` below route through it, so a graph
+    // never mixes eras.
+    const vocab = config.vocabulary ?? CIVIC_VOCABULARY;
     const graph = [];
     // --- Entities ---
     // User prompt
-    graph.push(makeEntityNode(civicUrn(packageId, 'prompt', promptHash), {
+    graph.push(makeEntityNode(vocab.urn(packageId, 'prompt', promptHash), {
         'civic:contentHash': `sha256:${promptHash}`,
         'dcterms:description': 'User query prompt',
         ...(promptText ? { 'prov:value': promptText } : {}),
@@ -67,25 +73,29 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     const skillHash = skillSpan ? getAttr(skillSpan.attributes, 'skill.text_hash') : undefined;
     const skillServerUrl = skillSpan ? getAttr(skillSpan.attributes, 'skill.mcp_server_url') : undefined;
     if (skillHash) {
-        graph.push(makeEntityNode(civicUrn(packageId, 'skill', skillHash), {
+        graph.push(makeEntityNode(vocab.urn(packageId, 'skill', skillHash), {
             'civic:contentHash': `sha256:${skillHash}`,
             'dcterms:description': 'Composed MCP skill guidance (system prompt)',
         }, ['prov:Plan']));
     }
     // Final output
-    graph.push(makeEntityNode(civicUrn(packageId, 'output', outputHash), {
+    graph.push(makeEntityNode(vocab.urn(packageId, 'output', outputHash), {
         'civic:contentHash': `sha256:${outputHash}`,
         'dcterms:description': 'AI-generated analysis output',
     }));
     // --- Agents ---
-    // LLM model
-    const modelUrn = civicModelUrn(model);
+    // LLM model. The description is emitted only when the config supplies one —
+    // absent otherwise (honest omission, same idiom as deriveProducerProfile /
+    // deriveSummaryEmission in ../format/dathere.ts).
+    const modelUrn = vocab.modelUrn(model);
     graph.push(makeAgentNode(modelUrn, {
         'dcterms:title': model,
-        'dcterms:description': modelDescription,
+        ...(config.modelAgentDescription
+            ? { 'dcterms:description': config.modelAgentDescription }
+            : {}),
     }, ['prov:SoftwareAgent']));
     // MCP server agents — one per distinct data source that appears in the
-    // trace. Tool spans carry `mcp.source`; evidence records captured before
+    // trace. Tool spans carry `mcp.source`; records captured before
     // source tagging have no source attribute, so they fall back to the
     // configured fallback source (socrata — the only source at the time) for
     // backwards compatibility. Agent coordinates come from the source registry;
@@ -94,7 +104,7 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     const sourceAgentMap = {};
     for (const [id, info] of Object.entries(registry)) {
         sourceAgentMap[id] = {
-            urn: civicSourceAgentUrn(id),
+            urn: vocab.sourceAgentUrn(id),
             title: info.agentTitle,
             serverUrl: id === skillSourceId ? skillServerUrl || info.serverUrl : info.serverUrl,
         };
@@ -106,7 +116,7 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     }
     for (const sourceId of sourcesInTrace) {
         const meta = sourceAgentMap[sourceId] ?? {
-            urn: civicSourceAgentUrn(encodeURIComponent(sourceId)),
+            urn: vocab.sourceAgentUrn(encodeURIComponent(sourceId)),
             title: `${sourceId} MCP Server`,
             serverUrl: sourceId,
         };
@@ -123,10 +133,10 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
         const id = sourceId || fallbackSourceId;
         return (sourceAgentMap[id]?.urn
             ?? sourceAgentMap[fallbackSourceId]?.urn
-            ?? civicSourceAgentUrn(encodeURIComponent(id)));
+            ?? vocab.sourceAgentUrn(encodeURIComponent(id)));
     }
     // Platform
-    graph.push(makeAgentNode(civicPlatformUrn(config.platformAgent.id), {
+    graph.push(makeAgentNode(vocab.platformUrn(config.platformAgent.id), {
         'dcterms:title': config.platformAgent.title,
         'civic:url': config.platformAgent.url,
     }, ['prov:SoftwareAgent']));
@@ -135,11 +145,11 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     const inferenceSpans = spans.filter(s => s.name === 'llm_inference');
     const inferenceUrns = [];
     for (const span of inferenceSpans) {
-        const spanUrn = civicUrn(packageId, 'inference', span.spanId);
+        const spanUrn = vocab.urn(packageId, 'inference', span.spanId);
         inferenceUrns.push(spanUrn);
-        const used = [provRef(civicUrn(packageId, 'prompt', promptHash))];
+        const used = [provRef(vocab.urn(packageId, 'prompt', promptHash))];
         if (skillHash) {
-            used.push(provRef(civicUrn(packageId, 'skill', skillHash)));
+            used.push(provRef(vocab.urn(packageId, 'skill', skillHash)));
         }
         const promptTokens = getAttr(span.attributes, 'gen_ai.response.prompt_tokens');
         const completionTokens = getAttr(span.attributes, 'gen_ai.response.completion_tokens');
@@ -160,7 +170,7 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     // MCP tool call spans
     const dataResponseUrns = [];
     for (const span of toolSpans) {
-        const toolCallUrn = civicUrn(packageId, 'tool-call', span.spanId);
+        const toolCallUrn = vocab.urn(packageId, 'tool-call', span.spanId);
         const argsStr = getAttr(span.attributes, 'tool.arguments') || '{}';
         const queryHash = hash(argsStr);
         const responseHash = getAttr(span.attributes, 'tool.response_hash');
@@ -177,19 +187,19 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
         const precedingInference = inferenceSpans
             .filter(is => Number(is.endTimeUnixNano || '0') <= toolStart)
             .sort((a, b) => Number(b.endTimeUnixNano || '0') - Number(a.endTimeUnixNano || '0'))[0];
-        const queryUrn = civicUrn(packageId, 'query', queryHash);
+        const queryUrn = vocab.urn(packageId, 'query', queryHash);
         graph.push(makeEntityNode(queryUrn, {
             'civic:contentHash': `sha256:${queryHash}`,
             'civic:toolName': toolName,
             'civic:operationType': opType,
             'dcterms:description': `MCP tool arguments (${opType})`,
             ...(precedingInference
-                ? provWasGeneratedBy(civicUrn(packageId, 'inference', precedingInference.spanId))
+                ? provWasGeneratedBy(vocab.urn(packageId, 'inference', precedingInference.spanId))
                 : {}),
         }));
         // Data response entity
         if (responseHash) {
-            const dataUrn = civicUrn(packageId, 'data', responseHash);
+            const dataUrn = vocab.urn(packageId, 'data', responseHash);
             dataResponseUrns.push(dataUrn);
             // Description varies by source — dataset-keyed sources (Socrata) have
             // a portal domain; aggregate/unknown sources are described by their
@@ -243,8 +253,8 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
     const generatorSpan = synthesisSpan || lastInference;
     if (generatorSpan) {
         const generatorUrn = synthesisSpan
-            ? civicUrn(packageId, 'synthesis', synthesisSpan.spanId)
-            : civicUrn(packageId, 'inference', generatorSpan.spanId);
+            ? vocab.urn(packageId, 'synthesis', synthesisSpan.spanId)
+            : vocab.urn(packageId, 'inference', generatorSpan.spanId);
         // Add synthesis activity if it exists
         if (synthesisSpan) {
             graph.push(makeActivityNode(generatorUrn, {
@@ -259,7 +269,7 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
             }));
         }
         // Output wasGeneratedBy
-        graph.push(makeEntityNode(civicUrn(packageId, 'output', outputHash), {
+        graph.push(makeEntityNode(vocab.urn(packageId, 'output', outputHash), {
             ...provWasGeneratedBy(generatorUrn),
             ...(dataResponseUrns.length > 0
                 ? provWasDerivedFrom(dataResponseUrns)
@@ -282,9 +292,9 @@ export function buildProvenanceGraph(trace, input, config = CIVICAITOOLS_PROVENA
             'prov:qualifiedAssociation': {
                 '@type': 'prov:Association',
                 'prov:agent': provRef(modelUrn),
-                'prov:hadPlan': provRef(civicUrn(packageId, 'skill', skillHash)),
+                'prov:hadPlan': provRef(vocab.urn(packageId, 'skill', skillHash)),
             },
         }));
     }
-    return makeProvGraph(makeCivicProvContext(), graph);
+    return makeProvGraph(vocab.context(), graph);
 }

package/dist/capture/trace.d.ts

@@ -50,7 +50,9 @@ export type TraceRandomBytes = (byteLength: number) => Uint8Array;
 /**
  * TraceBuilder identity + determinism inputs. The identity strings name the
  * capturing service, so they are per-instance config (config-not-constants);
- * the demo values are `CIVICAITOOLS_TRACE_CONFIG` below.
+ * the reference deployment's values are `CIVICAITOOLS_TRACE_CONFIG` below.
+ * The identity fields are required; `now`/`randomBytes` are operational
+ * fallbacks, not identity, and default to the runtime's clock and CSPRNG.
  */
 export interface TraceBuilderConfig {
     /** OTel resource `service.name`. */
@@ -67,8 +69,8 @@ export interface TraceBuilderConfig {
      *  `crypto.getRandomValues` (Web Crypto — Node 18+ and every browser). */
     randomBytes?: TraceRandomBytes;
 }
-/** Demo default: the civicaitools.org reference deployment's capture
- *  identity. */
+/** The civicaitools.org reference deployment's capture identity. Passed
+ *  explicitly by the reference app — never applied as a default. */
 export declare const CIVICAITOOLS_TRACE_CONFIG: TraceBuilderConfig;
 export declare class TraceBuilder {
     readonly traceId: string;
@@ -77,7 +79,7 @@ export declare class TraceBuilder {
     private readonly config;
     private readonly now;
     private readonly randomBytes;
-    constructor(config?: TraceBuilderConfig);
+    constructor(config: TraceBuilderConfig);
     private randomHex;
     private nowNano;
     /**

package/dist/capture/trace.js

@@ -5,8 +5,10 @@
 //     implements and @typedstandards/produce-core re-exports (0.2.0), removing
 //     the module's only `node:crypto` use — the harness is browser-safe.
 //   - The resource/scope identity constants (`service.name`, scope
-//     name/version, semconv version) are typed config inputs with the demo
-//     values as the exported default (config-not-constants, S2 brief §2).
+//     name/version, semconv version) are REQUIRED typed config inputs
+//     (config-not-constants, S2 brief §2); the reference deployment's values
+//     are exported as `CIVICAITOOLS_TRACE_CONFIG` for explicit use, never
+//     applied as a default.
 //
 // Clock + RNG are INHERENT to capture (span timestamps and ids are what
 // capture *is*): this module is the sanctioned exception to the package's
@@ -32,8 +34,8 @@ function attrsFromRecord(attrs) {
 export function hash(content) {
     return sha256Hex(content);
 }
-/** Demo default: the civicaitools.org reference deployment's capture
- *  identity. */
+/** The civicaitools.org reference deployment's capture identity. Passed
+ *  explicitly by the reference app — never applied as a default. */
 export const CIVICAITOOLS_TRACE_CONFIG = {
     serviceName: 'civic-ai-tools-website',
     scopeName: 'civic-ai-tools-evidence',
@@ -53,7 +55,7 @@ export class TraceBuilder {
     config;
     now;
     randomBytes;
-    constructor(config = CIVICAITOOLS_TRACE_CONFIG) {
+    constructor(config) {
         this.config = config;
         this.now = config.now ?? Date.now;
         this.randomBytes = config.randomBytes ?? defaultRandomBytes;

package/dist/format/dathere.d.ts

@@ -5,16 +5,18 @@ export declare const DATHERE_CONTENT_PROFILE = "datHere";
 export declare const DATHERE_PRODUCER_PROFILE = "ai-assisted-analysis/datHere";
 /** Reverse-DNS key of the auto-emitted environment extension. */
 export declare const ENVIRONMENT_EXTENSION_KEY = "org.civicaitools.environment";
-/** Demo default for the environment extension's `host` field: the
- *  civicaitools.org reference deployment. Config-not-constants — every other
- *  instance supplies its own via `DatHereEnvironmentConfig`. */
+/** The civicaitools.org reference deployment's value for the environment
+ *  extension's `host` field. Config-not-constants — every instance supplies
+ *  its own via `DatHereEnvironmentConfig`; the `host` lands under the
+ *  envelope hash, so it is never applied silently. */
 export declare const CIVICAITOOLS_ENVIRONMENT_HOST = "civicaitools.org";
 /** Per-instance configuration for the environment extension. */
 export interface DatHereEnvironmentConfig {
     /** Publishing host recorded in `org.civicaitools.environment.host`. */
     host: string;
 }
-/** The civicaitools.org demo default. */
+/** The civicaitools.org reference deployment's values. Passed explicitly by
+ *  the reference app — never applied as a default. */
 export declare const CIVICAITOOLS_ENVIRONMENT_CONFIG: DatHereEnvironmentConfig;
 /**
  * Derive the envelope's `producerProfile` (ADR-0006): the explicit value when
@@ -48,7 +50,7 @@ export declare function deriveSummaryEmission(contentProfile?: string, summary?:
  * skill-fetch span URL (the analysis's primary MCP server). Fields captured
  * honestly: `modelVersion` and `host`.
  */
-export declare function buildDatHereEnvironment(model: string, skillMcpServerUrl: string | undefined, config?: DatHereEnvironmentConfig): Record<string, unknown>;
+export declare function buildDatHereEnvironment(model: string, skillMcpServerUrl: string | undefined, config: DatHereEnvironmentConfig): Record<string, unknown>;
 /** Input to the composite datHere-policy derivation. */
 export interface DatHerePolicyInput {
     /** Model identifier (becomes `environment.modelVersion`). */
@@ -80,4 +82,4 @@ export interface DatHereEnvelopeFields {
  * the legacy canonicalization rule and any caller-supplied extensions —
  * byte-identical envelopes via the core's conditional spreads.
  */
-export declare function deriveDatHereEnvelopeFields(input: DatHerePolicyInput, config?: DatHereEnvironmentConfig): DatHereEnvelopeFields;
+export declare function deriveDatHereEnvelopeFields(input: DatHerePolicyInput, config: DatHereEnvironmentConfig): DatHereEnvelopeFields;

package/dist/format/dathere.js

@@ -25,11 +25,13 @@ export const DATHERE_CONTENT_PROFILE = 'datHere';
 export const DATHERE_PRODUCER_PROFILE = 'ai-assisted-analysis/datHere';
 /** Reverse-DNS key of the auto-emitted environment extension. */
 export const ENVIRONMENT_EXTENSION_KEY = 'org.civicaitools.environment';
-/** Demo default for the environment extension's `host` field: the
- *  civicaitools.org reference deployment. Config-not-constants — every other
- *  instance supplies its own via `DatHereEnvironmentConfig`. */
+/** The civicaitools.org reference deployment's value for the environment
+ *  extension's `host` field. Config-not-constants — every instance supplies
+ *  its own via `DatHereEnvironmentConfig`; the `host` lands under the
+ *  envelope hash, so it is never applied silently. */
 export const CIVICAITOOLS_ENVIRONMENT_HOST = 'civicaitools.org';
-/** The civicaitools.org demo default. */
+/** The civicaitools.org reference deployment's values. Passed explicitly by
+ *  the reference app — never applied as a default. */
 export const CIVICAITOOLS_ENVIRONMENT_CONFIG = {
     host: CIVICAITOOLS_ENVIRONMENT_HOST,
 };
@@ -78,7 +80,7 @@ export function deriveSummaryEmission(contentProfile, summary) {
  * skill-fetch span URL (the analysis's primary MCP server). Fields captured
  * honestly: `modelVersion` and `host`.
  */
-export function buildDatHereEnvironment(model, skillMcpServerUrl, config = CIVICAITOOLS_ENVIRONMENT_CONFIG) {
+export function buildDatHereEnvironment(model, skillMcpServerUrl, config) {
     const mcpServers = [];
     if (skillMcpServerUrl) {
         mcpServers.push({ url: skillMcpServerUrl });
@@ -97,7 +99,7 @@ export function buildDatHereEnvironment(model, skillMcpServerUrl, config = CIVIC
  * the legacy canonicalization rule and any caller-supplied extensions —
  * byte-identical envelopes via the core's conditional spreads.
  */
-export function deriveDatHereEnvelopeFields(input, config = CIVICAITOOLS_ENVIRONMENT_CONFIG) {
+export function deriveDatHereEnvelopeFields(input, config) {
     const extensions = { ...(input.extensions ?? {}) };
     if (input.contentProfile === DATHERE_CONTENT_PROFILE) {
         extensions[ENVIRONMENT_EXTENSION_KEY] = buildDatHereEnvironment(input.model, input.skillMcpServerUrl, config);

package/dist/format/sources.d.ts

@@ -21,14 +21,15 @@ export interface CivicSourceInfo {
 /** A source registry: source id → coordinates. Insertion order is emission
  *  order for aggregate `dataSources` entries. */
 export type CivicSourceRegistry = Record<string, CivicSourceInfo>;
-/** The civic default registry — the three demo sources. */
+/** The civic reference registry — the three demo sources. Passed explicitly
+ *  by the reference app — never applied as a default. */
 export declare const CIVIC_SOURCE_REGISTRY: CivicSourceRegistry;
 /** The source id untagged/pre-M9.1 captures fall back to. Socrata was the
  *  only source when those packages were written. */
 export declare const FALLBACK_SOURCE_ID = "socrata";
 /** Is this source dataset-keyed (one `dataSources` entry per dataset) rather
  *  than aggregate? Unknown ids are neither — they contribute no entry. */
-export declare function isDatasetKeyedSource(sourceId: string, registry?: CivicSourceRegistry): boolean;
+export declare function isDatasetKeyedSource(sourceId: string, registry: CivicSourceRegistry): boolean;
 /**
  * Resolve an MCP tool name to a source id, or `undefined` when unknown.
  * The data-source population function (capture group) takes one of these as
@@ -47,8 +48,8 @@ export declare const civicToolSourceResolver: ToolSourceResolver;
  *  capitalised form of the raw id so new sources render sensibly before the
  *  registry is updated. Missing ids coerce to the fallback source (pre-M9.3
  *  packages have no `sourceId` on dataSources entries). */
-export declare function displayNameForSource(sourceId: string | undefined | null, registry?: CivicSourceRegistry): string;
+export declare function displayNameForSource(sourceId: string | undefined | null, registry: CivicSourceRegistry): string;
 /** Format a `dataSources` array as a compact, de-duplicated summary string
  *  (middle-dot separated). Returns `null` when the array is empty or missing,
  *  letting callers render a fallback. */
-export declare function formatDataSourcesSummary(entries: DataSourceEntry[] | undefined, registry?: CivicSourceRegistry): string | null;
+export declare function formatDataSourcesSummary(entries: DataSourceEntry[] | undefined, registry: CivicSourceRegistry): string | null;

package/dist/format/sources.js

@@ -8,10 +8,12 @@
 //     app's MCP registry itself stays app-side; this is the harness's civic
 //     DEFAULT — callers supply their own resolver to add or replace sources).
 //
-// Endpoint URLs name the demo deployment's data plane, so the registry is a
-// typed config input (config-not-constants, S2 brief §2) with the civic
-// values as the exported default map.
-/** The civic default registry — the three demo sources. */
+// Endpoint URLs name a deployment's data plane, so the registry is a
+// REQUIRED typed config input (config-not-constants, S2 brief §2); the civic
+// demo map is exported as `CIVIC_SOURCE_REGISTRY` for explicit use, never
+// applied as a default.
+/** The civic reference registry — the three demo sources. Passed explicitly
+ *  by the reference app — never applied as a default. */
 export const CIVIC_SOURCE_REGISTRY = {
     socrata: {
         displayName: 'Socrata',
@@ -39,7 +41,7 @@ export const CIVIC_SOURCE_REGISTRY = {
 export const FALLBACK_SOURCE_ID = 'socrata';
 /** Is this source dataset-keyed (one `dataSources` entry per dataset) rather
  *  than aggregate? Unknown ids are neither — they contribute no entry. */
-export function isDatasetKeyedSource(sourceId, registry = CIVIC_SOURCE_REGISTRY) {
+export function isDatasetKeyedSource(sourceId, registry) {
     const info = registry[sourceId];
     return info !== undefined && info.aggregatePortalUrl === undefined;
 }
@@ -65,7 +67,7 @@ export const civicToolSourceResolver = (toolName) => CIVIC_TOOL_SOURCE_MAP[toolN
  *  capitalised form of the raw id so new sources render sensibly before the
  *  registry is updated. Missing ids coerce to the fallback source (pre-M9.3
  *  packages have no `sourceId` on dataSources entries). */
-export function displayNameForSource(sourceId, registry = CIVIC_SOURCE_REGISTRY) {
+export function displayNameForSource(sourceId, registry) {
     const id = sourceId || FALLBACK_SOURCE_ID;
     return (registry[id]?.displayName
         ?? id
@@ -77,7 +79,7 @@ export function displayNameForSource(sourceId, registry = CIVIC_SOURCE_REGISTRY)
 /** Format a `dataSources` array as a compact, de-duplicated summary string
  *  (middle-dot separated). Returns `null` when the array is empty or missing,
  *  letting callers render a fallback. */
-export function formatDataSourcesSummary(entries, registry = CIVIC_SOURCE_REGISTRY) {
+export function formatDataSourcesSummary(entries, registry) {
     if (!entries || entries.length === 0)
         return null;
     const seen = new Set();

package/dist/format/vocabulary.d.ts

@@ -1,24 +1,68 @@
 /** The `civic:` JSON-LD namespace URI. Part of the civic vocabulary itself
  *  (it names the term set, not a deployment), so it is a constant, not a
- *  config input. */
-export declare const CIVIC_NS = "https://civicaitools.org/ns/evidence/";
-/** The civic evidence-package JSON-LD `@context`: prov / xsd / civic /
+ *  config input. Settlement-era value (Appendix J). */
+export declare const CIVIC_NS = "https://civicaitools.org/ns/civic/";
+/** Root of the `urn:civic-record:` id scheme. Settlement-era value
+ *  (Appendix J). */
+export declare const CIVIC_URN_PREFIX = "urn:civic-record";
+/** The prior-era `civic:` namespace URI, frozen inside records signed before
+ *  the 2026-08-19 settlement. Never emitted for new packages. */
+export declare const PRIOR_ERA_CIVIC_NS = "https://civicaitools.org/ns/evidence/";
+/** The prior-era id-scheme root, frozen inside records signed before the
+ *  2026-08-19 settlement. Never emitted for new packages. */
+export declare const PRIOR_ERA_CIVIC_URN_PREFIX = "urn:civic-evidence";
+/**
+ * One era of the civic vocabulary: the two literals plus the emitters bound
+ * to them. The vocabulary is not deployment configuration (a deployment does
+ * not choose its own term set); this seam exists only so a prior-era package
+ * can be reproduced with the exact vocabulary it was signed under.
+ */
+export interface CivicVocabulary {
+    /** The `civic:` JSON-LD namespace URI for this era. */
+    readonly ns: string;
+    /** The id-scheme root for this era. */
+    readonly urnPrefix: string;
+    /** The civic record-package JSON-LD `@context`: prov / xsd / civic /
+     *  dcterms, in the reference emission order (legacy-chain byte discipline —
+     *  insertion order is the byte contract). */
+    context(): Record<string, string>;
+    /** Package-scoped node id: `<prefix>:<packageId>:<type>:<id>`. */
+    urn(packageId: string, type: string, id: string): string;
+    /** Model-agent id: `<prefix>:model:<modelId>` (slashes in the model
+     *  identifier collapse to dashes). */
+    modelUrn(model: string): string;
+    /** MCP source-agent id: `<prefix>:mcp-server:<sourceId>`. Known source ids
+     *  are emitted raw (they are already URN-safe by construction); callers
+     *  emitting an UNKNOWN id must encode it first (the capture-side builder
+     *  uses `encodeURIComponent`, matching the reference behavior). */
+    sourceAgentUrn(sourceId: string): string;
+    /** Platform-agent id: `<prefix>:platform:<platformId>`. */
+    platformUrn(platformId: string): string;
+}
+/** Bind the emitters to one era's two literals. */
+export declare function makeCivicVocabulary(ns: string, urnPrefix: string): CivicVocabulary;
+/** The settlement-era vocabulary — what every new emission uses. */
+export declare const CIVIC_VOCABULARY: CivicVocabulary;
+/** The prior-era vocabulary, valid forever inside records signed before the
+ *  settlement. Supply it to reproduce or verify such a record byte-for-byte;
+ *  never to mint a new package. */
+export declare const PRIOR_ERA_CIVIC_VOCABULARY: CivicVocabulary;
+/** The civic record-package JSON-LD `@context`: prov / xsd / civic /
  *  dcterms, in the reference emission order (legacy-chain byte discipline —
- *  insertion order is the byte contract). */
+ *  insertion order is the byte contract). Settlement era; for a prior-era
+ *  graph use `PRIOR_ERA_CIVIC_VOCABULARY.context()`. */
 export declare function makeCivicProvContext(): Record<string, string>;
-/** Root of the `urn:civic-evidence:` id scheme. */
-export declare const CIVIC_URN_PREFIX = "urn:civic-evidence";
-/** Package-scoped node id: `urn:civic-evidence:<packageId>:<type>:<id>`. */
+/** Package-scoped node id: `urn:civic-record:<packageId>:<type>:<id>`. */
 export declare function civicUrn(packageId: string, type: string, id: string): string;
-/** Model-agent id: `urn:civic-evidence:model:<modelId>` (slashes in the
+/** Model-agent id: `urn:civic-record:model:<modelId>` (slashes in the
  *  model identifier collapse to dashes). */
 export declare function civicModelUrn(model: string): string;
-/** MCP source-agent id: `urn:civic-evidence:mcp-server:<sourceId>`. Known
+/** MCP source-agent id: `urn:civic-record:mcp-server:<sourceId>`. Known
  *  source ids are emitted raw (they are already URN-safe by construction);
  *  callers emitting an UNKNOWN id must encode it first (the capture-side
  *  builder uses `encodeURIComponent`, matching the reference behavior). */
 export declare function civicSourceAgentUrn(sourceId: string): string;
-/** Platform-agent id: `urn:civic-evidence:platform:<platformId>`. */
+/** Platform-agent id: `urn:civic-record:platform:<platformId>`. */
 export declare function civicPlatformUrn(platformId: string): string;
 /**
  * Platform-agent identity — WHO published, as a PROV agent. A typed config
@@ -26,7 +70,8 @@ export declare function civicPlatformUrn(platformId: string): string;
  * the civicaitools.org demo values are the exported default below.
  */
 export interface PlatformAgentConfig {
-    /** Stable platform id — becomes `urn:civic-evidence:platform:<id>`. */
+    /** Stable platform id — becomes `urn:civic-record:platform:<id>` (prior-era
+     *  graphs carry the same id under the prior-era prefix). */
     id: string;
     /** Human-readable platform title (`dcterms:title`). */
     title: string;

package/dist/format/vocabulary.js

@@ -1,5 +1,5 @@
 // Civic PROV-O vocabulary (FORMAT-EXTENSION group) — the `civic:` JSON-LD
-// namespace, the `urn:civic-evidence:` id scheme, and the platform-agent
+// namespace, the `urn:civic-record:` id scheme, and the platform-agent
 // identity shape. Relocated from civic-ai-tools-website
 // `src/lib/evidence/provenance.ts` (`:51` urn scheme, `:179–184` platform
 // agent, `:384–391` context) per the S2 brief §1.
@@ -7,43 +7,81 @@
 // This module defines vocabulary; it never walks a trace. The capture-side
 // provenance BUILDER (src/capture/provenance.ts) imports its terms from here —
 // that direction is the package's internal module boundary.
+//
+// TWO ERAS (spec Appendix J — the 2026-08-19 vocabulary settlement, migration
+// class "frozen-in-signed-artifacts"). New emissions mint the SETTLEMENT-era
+// terms (`CIVIC_NS` / `CIVIC_URN_PREFIX` below, the module's canonical
+// values). The PRIOR-era terms are frozen inside every already-signed record —
+// rewriting them would change the envelope hash and invalidate the signature —
+// so they remain valid forever and are exported here too: reproducing or
+// verifying a prior-era package byte-for-byte requires emitting its vocabulary
+// exactly as it was signed. Era is not a trust signal (Appendix J §J.4 rule 2);
+// prior-era injection exists for reproduction and verification, never for new
+// emissions.
 import { makeProvContext, PROV_NS, XSD_NS, DCTERMS_NS } from '@typedstandards/produce-core';
 /** The `civic:` JSON-LD namespace URI. Part of the civic vocabulary itself
  *  (it names the term set, not a deployment), so it is a constant, not a
- *  config input. */
-export const CIVIC_NS = 'https://civicaitools.org/ns/evidence/';
-/** The civic evidence-package JSON-LD `@context`: prov / xsd / civic /
+ *  config input. Settlement-era value (Appendix J). */
+export const CIVIC_NS = 'https://civicaitools.org/ns/civic/';
+/** Root of the `urn:civic-record:` id scheme. Settlement-era value
+ *  (Appendix J). */
+export const CIVIC_URN_PREFIX = 'urn:civic-record';
+/** The prior-era `civic:` namespace URI, frozen inside records signed before
+ *  the 2026-08-19 settlement. Never emitted for new packages. */
+export const PRIOR_ERA_CIVIC_NS = 'https://civicaitools.org/ns/evidence/';
+/** The prior-era id-scheme root, frozen inside records signed before the
+ *  2026-08-19 settlement. Never emitted for new packages. */
+export const PRIOR_ERA_CIVIC_URN_PREFIX = 'urn:civic-evidence';
+/** Bind the emitters to one era's two literals. */
+export function makeCivicVocabulary(ns, urnPrefix) {
+    return {
+        ns,
+        urnPrefix,
+        context: () => makeProvContext({
+            prov: PROV_NS,
+            xsd: XSD_NS,
+            civic: ns,
+            dcterms: DCTERMS_NS,
+        }),
+        urn: (packageId, type, id) => `${urnPrefix}:${packageId}:${type}:${id}`,
+        modelUrn: (model) => `${urnPrefix}:model:${model.replace(/\//g, '-')}`,
+        sourceAgentUrn: (sourceId) => `${urnPrefix}:mcp-server:${sourceId}`,
+        platformUrn: (platformId) => `${urnPrefix}:platform:${platformId}`,
+    };
+}
+/** The settlement-era vocabulary — what every new emission uses. */
+export const CIVIC_VOCABULARY = makeCivicVocabulary(CIVIC_NS, CIVIC_URN_PREFIX);
+/** The prior-era vocabulary, valid forever inside records signed before the
+ *  settlement. Supply it to reproduce or verify such a record byte-for-byte;
+ *  never to mint a new package. */
+export const PRIOR_ERA_CIVIC_VOCABULARY = makeCivicVocabulary(PRIOR_ERA_CIVIC_NS, PRIOR_ERA_CIVIC_URN_PREFIX);
+// --- Settlement-era convenience bindings (unchanged signatures) ---
+/** The civic record-package JSON-LD `@context`: prov / xsd / civic /
  *  dcterms, in the reference emission order (legacy-chain byte discipline —
- *  insertion order is the byte contract). */
+ *  insertion order is the byte contract). Settlement era; for a prior-era
+ *  graph use `PRIOR_ERA_CIVIC_VOCABULARY.context()`. */
 export function makeCivicProvContext() {
-    return makeProvContext({
-        prov: PROV_NS,
-        xsd: XSD_NS,
-        civic: CIVIC_NS,
-        dcterms: DCTERMS_NS,
-    });
+    return CIVIC_VOCABULARY.context();
 }
-/** Root of the `urn:civic-evidence:` id scheme. */
-export const CIVIC_URN_PREFIX = 'urn:civic-evidence';
-/** Package-scoped node id: `urn:civic-evidence:<packageId>:<type>:<id>`. */
+/** Package-scoped node id: `urn:civic-record:<packageId>:<type>:<id>`. */
 export function civicUrn(packageId, type, id) {
-    return `${CIVIC_URN_PREFIX}:${packageId}:${type}:${id}`;
+    return CIVIC_VOCABULARY.urn(packageId, type, id);
 }
-/** Model-agent id: `urn:civic-evidence:model:<modelId>` (slashes in the
+/** Model-agent id: `urn:civic-record:model:<modelId>` (slashes in the
  *  model identifier collapse to dashes). */
 export function civicModelUrn(model) {
-    return `${CIVIC_URN_PREFIX}:model:${model.replace(/\//g, '-')}`;
+    return CIVIC_VOCABULARY.modelUrn(model);
 }
-/** MCP source-agent id: `urn:civic-evidence:mcp-server:<sourceId>`. Known
+/** MCP source-agent id: `urn:civic-record:mcp-server:<sourceId>`. Known
  *  source ids are emitted raw (they are already URN-safe by construction);
  *  callers emitting an UNKNOWN id must encode it first (the capture-side
  *  builder uses `encodeURIComponent`, matching the reference behavior). */
 export function civicSourceAgentUrn(sourceId) {
-    return `${CIVIC_URN_PREFIX}:mcp-server:${sourceId}`;
+    return CIVIC_VOCABULARY.sourceAgentUrn(sourceId);
 }
-/** Platform-agent id: `urn:civic-evidence:platform:<platformId>`. */
+/** Platform-agent id: `urn:civic-record:platform:<platformId>`. */
 export function civicPlatformUrn(platformId) {
-    return `${CIVIC_URN_PREFIX}:platform:${platformId}`;
+    return CIVIC_VOCABULARY.platformUrn(platformId);
 }
 /** Demo default: the civicaitools.org reference deployment's identity. */
 export const CIVICAITOOLS_PLATFORM_AGENT = {

package/dist/required-config.assert.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/required-config.assert.js

@@ -0,0 +1,27 @@
+// Type-level acceptance gate for the 0.2.0 breaking change (civic-ai-tools#153,
+// findings A3–A7): identity-bearing config is a REQUIRED parameter — a bare
+// call that omits it must FAIL typecheck. Each `@ts-expect-error` below
+// asserts exactly that: if a silently-applied default parameter is ever
+// reintroduced, the bare call becomes legal, the directive turns unused, and
+// `npm run typecheck` / `npm run build` fail.
+//
+// Compile-time only: the guard function is never exported and never invoked,
+// and the `declare`d values have no runtime existence.
+import { buildProvenanceGraph, buildDatHereEnvironment, deriveDatHereEnvelopeFields, TraceBuilder, isDatasetKeyedSource, displayNameForSource, formatDataSourcesSummary, } from "./index.js";
+function rejectsBareCalls() {
+    // @ts-expect-error A3 — buildProvenanceGraph: the ProvenanceConfig is required
+    buildProvenanceGraph(trace, provenanceInput);
+    // @ts-expect-error A4 — buildDatHereEnvironment: the DatHereEnvironmentConfig is required
+    buildDatHereEnvironment('model/slug', undefined);
+    // @ts-expect-error A4 — deriveDatHereEnvelopeFields: the DatHereEnvironmentConfig is required
+    deriveDatHereEnvelopeFields(policyInput);
+    // @ts-expect-error A6 — TraceBuilder: the TraceBuilderConfig is required
+    new TraceBuilder();
+    // @ts-expect-error A7 — isDatasetKeyedSource: the CivicSourceRegistry is required
+    isDatasetKeyedSource('socrata');
+    // @ts-expect-error A7 — displayNameForSource: the CivicSourceRegistry is required
+    displayNameForSource('socrata');
+    // @ts-expect-error A7 — formatDataSourcesSummary: the CivicSourceRegistry is required
+    formatDataSourcesSummary(entries);
+}
+void rejectsBareCalls;

package/dist/rubric/adversarial-eval-core.d.ts

@@ -1,4 +1,4 @@
-import { type EvidencePackage, type EvaluationResults } from '@typedstandards/produce-core';
+import { type RecordPackage, type EvaluationResults } from '@typedstandards/produce-core';
 /** Rubric identifier carried as the `scoringRubric` payload field and the
  *  methodology `testSet`. Six criteria, 1-10 each, plus aggregate. */
 export declare const RUBRIC_ID = "civicaitools-adversarial-rubric/six-criterion-v1";
@@ -8,8 +8,12 @@ export declare const EVALUATION_RUBRIC = "You are an independent evaluator asses
  *  once at module load. Any wording change to the rubric produces a new
  *  version, so an attestation pins the exact prompt set that scored it. */
 export declare const RUBRIC_VERSION_SHA256: string;
-/** Build the user-turn evaluation content from a package's signed fields. */
-export declare function buildEvaluationPrompt(pkg: EvidencePackage): string;
+/** Build the user-turn evaluation content from a package's signed fields.
+ *  Takes `RecordPackage` — produce-core 0.3.0's settlement-era name for the
+ *  same object (spec Appendix J, migration class alias-and-deprecate). The
+ *  prior name is a deprecated alias of this exact type upstream, so existing
+ *  callers still compile unchanged. */
+export declare function buildEvaluationPrompt(pkg: RecordPackage): string;
 export type ParsedEvaluation = {
     ok: true;
     results: EvaluationResults;

package/dist/rubric/adversarial-eval-core.js

@@ -59,7 +59,11 @@ Respond in this exact JSON format (no markdown fences, just raw JSON):
  *  once at module load. Any wording change to the rubric produces a new
  *  version, so an attestation pins the exact prompt set that scored it. */
 export const RUBRIC_VERSION_SHA256 = sha256Hex(EVALUATION_RUBRIC);
-/** Build the user-turn evaluation content from a package's signed fields. */
+/** Build the user-turn evaluation content from a package's signed fields.
+ *  Takes `RecordPackage` — produce-core 0.3.0's settlement-era name for the
+ *  same object (spec Appendix J, migration class alias-and-deprecate). The
+ *  prior name is a deprecated alias of this exact type upstream, so existing
+ *  callers still compile unchanged. */
 export function buildEvaluationPrompt(pkg) {
     const toolCallSummary = pkg.queries
         .map((q, i) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/civic-typed-harness",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Civic-domain harness for Typed Standards evidence packages — the DOMAIN layer of the ADR-0021 format/domain line: civic PROV-O vocabulary and provenance builder, datHere envelope-policy derivations, and the capture machinery (trace builder, skill-metadata extraction, data-source population, adversarial rubric core). Derives; @typedstandards/produce-core assembles.",
   "license": "MIT",
   "author": "Nathan Storey",
@@ -33,9 +33,10 @@
     "prepublishOnly": "npm run clean && npm run build"
   },
   "dependencies": {
-    "@typedstandards/produce-core": "^0.2.0"
+    "@typedstandards/produce-core": "^0.3.0"
   },
   "devDependencies": {
+    "@typedstandards/verify-core": "^0.9.0",
     "@typescript-eslint/parser": "^8",
     "eslint": "^9",
     "typescript": "^5.9.3"