git-a2a 1.7.1-rc.4 → 2.0.0

package/skills/git-a2a/references/manifest-reference.md

@@ -1,1368 +0,0 @@
-<!-- Code generated by tools/gen-reference.py; DO NOT EDIT. -->
-# Manifest field reference
-
-This reference is generated from the compiled normative `spec/_.hint` and
-`spec/schema/a2amodule.schema.json`. Run `make docs-check` to detect drift.
-Paths use `[]` for one array entry. Unknown `x-*` extension keys are allowed at every
-declared object boundary and are preserved; other unknown keys are validation errors.
-
-## `schema`
-
-- Type: integer; required.
-- Default: exactly `1`.
-- Allowed values: exact value `1`.
-- Normative source: [`spec/_.hint:115`](../spec/_.hint#L115).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-integer; the format version of this file. Value `1` for this specification. A consumer that
-sees a larger value than it knows must refuse the file (exit 2), not guess, with
-`schema <value> is newer than this tool supports (1); upgrade git-a2a`. A smaller or otherwise
-invalid value is an ordinary validation failure (exit 1).
-
-## `module`
-
-- Type: object; required.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:122`](../spec/_.hint#L122).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object; the module description. See [#module](../spec/_.hint).
-
-## `agents`
-
-- Type: array of object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:126`](../spec/_.hint#L126).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of agent bindings, see [#agent](../spec/_.hint). Empty or absent means "no agent owns this; treat
-as a plain library" — still importable, nobody to ask.
-
-## `policy`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:131`](../spec/_.hint#L131).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, see [#policy](../spec/_.hint). Routing defaults and consumer permissions.
-
-## `settings`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:135`](../spec/_.hint#L135).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, see [#settings](../spec/_.hint). Consumer-local defaults; owners of dependencies never read
-these settings from a consumer.
-
-## `dependencies`
-
-- Type: array of object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:140`](../spec/_.hint#L140).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list, see [#dependency](../spec/_.hint). Modules this module depends on.
-
-## `module.id`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: pattern `^[a-z0-9][a-z0-9._-]{0,63}$`.
-- Normative source: [`spec/_.hint:182`](../spec/_.hint#L182).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required. Stable identifier, `^[a-z0-9][a-z0-9._-]{0,63}$`. Consumers refer to the
-dependency by this id and the lock keys on it; `add` verifies that the fetched manifest's `id`
-equals the id the consumer expected (when given) and otherwise adopts it. Renaming an id is a
-breaking change for every consumer.
-
-## `module.name`
-
-- Type: string; optional.
-- Default: `module.id`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:189`](../spec/_.hint#L189).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. Display name. Defaults to `id`.
-
-## `module.description`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:193`](../spec/_.hint#L193).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, recommended. One paragraph answering "what is this and what is it for" — it is what a
-consumer's agent reads in its roster, so it should also say what kind of questions the owner
-expects. Whitespace is normalised when rendered.
-
-## `module.languages`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:199`](../spec/_.hint#L199).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, open vocabulary and informative. Known tokens and their behavior are in
-`vocabulary_languages`. Not used for wiring; `exports` is. Changing it changes discovery metadata
-only; unknown values are accepted and preserved.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `typescript` | Reports TypeScript as module metadata. | Changes discovery/documentation only; wiring still follows exports. | Accepted and preserved as informative metadata. |
-| `python` | Reports Python as module metadata. | Changes discovery/documentation only; wiring still follows exports. | Accepted and preserved as informative metadata. |
-| `go` | Reports Go as module metadata. | Changes discovery/documentation only; wiring still follows exports. | Accepted and preserved as informative metadata. |
-| `rust`, `swift`, `dart`, `ruby`, `php`, `elixir`, `haskell`, `zig`, `clojure`, `nix` | Reports the declared language as module metadata. | Changes discovery/documentation only; wiring still follows exports. | Accepted and preserved as informative metadata. |
-
-## `module.surface`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:205`](../spec/_.hint#L205).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string; relative directory path. Published content for consumers. Absent means nothing is
-published beyond the manifest.
-
-## `module.repository`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:210`](../spec/_.hint#L210).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string; the canonical git URL of this module as its owner declares it. Lets a consumer that
-obtained the module from elsewhere (a fork, a mirror, a copy) see that it is not on the
-canonical source — and that the `agents` listed may belong to the original owner rather than
-to whoever maintains the copy. Informative; never used to fetch.
-
-## `module.moved-to`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:217`](../spec/_.hint#L217).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional: `git` (string, required; the new canonical URL), `path` (string), `notes`
-(string). An owner leaves it in the last manifest at the old location when the module moves.
-Consumers are told on `update` and follow it only on explicit request; a tool never switches a
-source silently.
-
-## `module.docs`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:224`](../spec/_.hint#L224).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string; URL of human documentation.
-
-## `module.release`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:228`](../spec/_.hint#L228).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object: `channel` (string, the ref consumers should follow by default, e.g. `main`), `tags`
-(boolean, whether semver tags are published), `notes` (string, free text, e.g. "main is the only
-release channel"). `release.channel` is the default `ref` a consumer gets when it adds this
-module without naming one.
-
-## `module.exports`
-
-- Type: array of object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:235`](../spec/_.hint#L235).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of export entries; how to import this module per ecosystem. Each entry: `ecosystem`
-(string, required; use package-url type names: `npm`, `pypi`, `golang`, `cargo`, `maven`,
-`nuget`, `swift`, `cocoapods`, `pub`, `gem`, `composer`, `hex`, `hackage`, …), `name` (string,
-required; the name the ecosystem imports: npm package name, PEP 503 distribution name, Go module
-path, crate name, Maven `group:artifact`), `path` (string, optional; subdirectory containing the
-ecosystem's own manifest, default the module directory), `notes` (string, optional; anything a
-wiring tool or agent must know, e.g. "vanity import path, needs replace", "prepare script builds
-dist"). Ecosystem-specific keys are allowed under `x-<ecosystem>-*`.
-
-## `module.moved-to.git`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:251`](../spec/_.hint#L251).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required. New canonical Git URL. Changing it changes the destination offered to users;
-consumers remain on the current source until an explicit `set --git`.
-
-## `module.moved-to.path`
-
-- Type: string; optional.
-- Default: `.`.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:256`](../spec/_.hint#L256).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional relative path, default `.`. Subdirectory containing the moved module. Changing
-it changes the destination module root offered with the new Git URL.
-
-## `module.moved-to.notes`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:261`](../spec/_.hint#L261).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional. Human migration context printed with the move notice. Changing it changes only
-the guidance, never the source automatically.
-
-## `module.release.channel`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:270`](../spec/_.hint#L270).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional. Default ref used by `add` when the consumer supplies no ref, commonly `main`.
-Changing it affects future adds; existing consumers retain their declared ref until `set`.
-
-## `module.release.tags`
-
-- Type: boolean; optional.
-- Default: `false`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:275`](../spec/_.hint#L275).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-boolean, optional, default `false`. Declares whether the owner publishes semantic-version tags.
-Changing it changes what consumers may reasonably select with `set --ref`; it does not create tags.
-
-## `module.release.notes`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:280`](../spec/_.hint#L280).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional. Free release-channel guidance shown to consumers. Changing it changes guidance
-only and does not resolve or move a dependency.
-
-## `module.exports[].ecosystem`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:289`](../spec/_.hint#L289).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required, open vocabulary. Known values and adapter behavior are in
-`vocabulary_ecosystems`. Changing it selects a different adapter and therefore a different native
-manifest; an unknown value remains valid published metadata but has no wiring adapter.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `npm` | Wires a Git dependency in package.json through npm/yarn/pnpm/bun. | Selects the JavaScript package name and adapter. | Accepted; without an adapter it remains published metadata and cannot be wired. |
-| `pypi` | Wires a Git dependency in pyproject.toml through uv. | Selects the Python distribution name and adapter. | Accepted; without an adapter it remains published metadata and cannot be wired. |
-| `golang` | Wires the Go module at the locked commit with go.mod edits. | Selects the Go import path and adapter. | Accepted; without an adapter it remains published metadata and cannot be wired. |
-| `cargo`, `swift`, `pub`, `gem`, `composer`, `hex`, `hackage`, `zig`, `clojure`, `nix` | Uses the matching native Git-dependency adapter. | Selects a different native manifest and package identity. | Accepted; without an adapter it remains published metadata and cannot be wired. |
-| `cmake`, `gradle`, `msbuild`, `maven`, `meson` | Uses a vendored integration adapter and generated include when the dependency is vendored. | Selects the build-system integration and generated file. | Accepted; without an adapter it remains published metadata and cannot be wired. |
-
-## `module.exports[].name`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:295`](../spec/_.hint#L295).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required. Native package/import name in the named ecosystem. Changing it rewires the
-consumer from the old native entry to the new one on the next mutation or `wire`.
-
-## `module.exports[].path`
-
-- Type: string; optional.
-- Default: the module directory (`.`).
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:300`](../spec/_.hint#L300).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional relative path, default `.`. Subdirectory containing the ecosystem package.
-Changing it changes the Git subdirectory expression; unsupported adapters report `not wired`.
-
-## `module.exports[].notes`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:305`](../spec/_.hint#L305).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional. Export-specific facts shown to tools and agents. Changing it changes published
-guidance but does not itself alter adapter behavior.
-
-## `agents[].name`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:314`](../spec/_.hint#L314).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required. The agent's own name — must equal `name` in its A2A card when a card is given.
-An agent may appear in many modules (one agent, many repositories) and a module may list many
-agents (one repository, many agents), so `name` must be stable across repositories. Identity
-for de-duplication across modules is the `card` URL when present, else `name`; two bindings in
-different modules with the same card URL are the same agent, and tools may merge what they know
-about it. Names are scoped to whoever controls the card URL, so a public ecosystem never relies
-on a bare name being globally unique.
-
-## `agents[].role`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:324`](../spec/_.hint#L324).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required, open vocabulary. A role says what the agent owns for this module; core values
-and routing consequences are in `vocabulary_roles`. Unknown roles are accepted and participate in
-routing when `policy.intents` names the same token.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `owner` | Default routing target; identifies the agent that commits, merges, and releases. | Requests using the default route select a different binding. | Accepted and routed when policy names the same token. |
-| `maintainer` | Routes intents mapped to a maintainer. | Changes which bindings match those intents. | Accepted and routed when policy names the same token. |
-| `spec` | Routes specification, task, or sequencing ownership. | Changes which bindings match policy entries such as `change: spec`. | Accepted and routed when policy names the same token. |
-| `reviewer` | Routes review ownership. | Changes which bindings match review policy. | Accepted and routed when policy names the same token. |
-| `support` | Routes support ownership. | Changes which bindings match support policy. | Accepted and routed when policy names the same token. |
-
-## `agents[].scope`
-
-- Type: array of string; optional.
-- Default: `["**"]`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:330`](../spec/_.hint#L330).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of glob patterns relative to the module directory. What this agent answers for and may
-change. Default `["**"]`. Two agents may overlap; resolution prefers the more specific match,
-then declared order.
-
-## `agents[].card`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:336`](../spec/_.hint#L336).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. URL of the agent's A2A Agent Card (`https://…/.well-known/agent-card.json`) or a
-repository-relative path to a card file (A2A "direct configuration"). When present the card is
-the authority for `description`, `skills`, interfaces and security; git-a2a snapshots it.
-
-## `agents[].description`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:342`](../spec/_.hint#L342).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. Only when no card is available or to add module-specific wording ("for this repository,
-ask it about …"). Never a copy of the card's description.
-
-## `agents[].contacts`
-
-- Type: array of object; optional.
-- Default: none declared.
-- Allowed values: open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:347`](../spec/_.hint#L347).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-ordered list. Each contact: `intents` (list of strings, required; `"*"` allowed), `kind`
-(string, required; open vocabulary, see [#contact\_kinds](../spec/_.hint)), `note` (string,
-optional; free-text instructions shown verbatim to the asker, e.g. "state the version you are
-on"), plus kind-specific keys. Order expresses preference within an intent.
-
-## `agents[].trust`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:354`](../spec/_.hint#L354).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional: `signatures` (boolean), `accepts-external` (boolean), `jwks` (list of https
-URLs), `keys` (list of JWK SHA-256 thumbprints, RFC 7638), `origins` (list of origins
-`scheme://host[:port]`), `jwks-max-age` (duration, default `24h`), `x-*`. Defaults: no
-verification required, external not stated, nothing pinned.
-
-Verification when `signatures: true`: at least one detached JWS over the RFC 8785 canonical card
-(top-level `signatures` excluded) must verify with a key that is (a) in a JWKS whose URL is listed
-in `jwks`, or (b) whose thumbprint is listed in `keys`, or — only when both lists are empty — (c)
-served by a `jku` with the same origin as the card URL, in which case `validate` and `doctor`
-report "unpinned key source". The first verified `kid` and thumbprint are recorded in the lock
-(`cards-keys`); a different key later is a `status` failure `trust: key changed` until the
-consumer accepts it with `update --accept-keys`. Keys missing from a freshly fetched JWKS no
-longer verify. An unsigned, invalid or unverifiable card makes `status` fail; `update` retains
-the dependency update but prints a trust warning.
-
-Origin check (always on, severity depends on `signatures`): the card URL and every
-`supportedInterfaces[].url` must be in `origins` when declared; otherwise their origin must equal
-the origin of `module.repository`, or the card's git-a2a extension `params.repository` must equal
-the dependency's canonical `git`. A mismatch is a failure when `signatures: true` or when the
-consumer requires `card-origin`, a warning otherwise.
-
-## `agents[].contacts[].intents`
-
-- Type: array of string; required.
-- Default: none declared.
-- Allowed values: minimum 1 item(s); open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:382`](../spec/_.hint#L382).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, required and non-empty, open vocabulary; `"*"` is the fallback. Changing the
-list changes which requests may select this contact. Core values, fallback behavior, and unknown
-handling are in `vocabulary_intents`.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `question` | Routes a request for explanation; defaults to role `owner`. | Selects contacts declaring `question` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `change` | Routes a proposed behavior/API change. | Selects contacts declaring `change` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `bug` | Routes a defect report. | Selects contacts declaring `bug` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `review` | Routes a review request. | Selects contacts declaring `review` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `incident` | Routes an operational incident. | Selects contacts declaring `incident` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `*` | Acts as a contact fallback after exact intent matches. | Broadens that contact to unmatched intents. | Accepted; any other unknown token is an exact-match intent. |
-
-## `agents[].contacts[].kind`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:388`](../spec/_.hint#L388).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required, open vocabulary. Changing it selects another delivery driver or instruction
-renderer and changes which kind-specific fields are valid. Known values and unknown handling are
-in `contact_kinds`.
-
-Known values:
-
-The kind vocabulary is open; these kinds have defined keys and delivery behavior:
-
-| Kind | Allowed kind-specific keys | Driver or instruction | Consequence of changing it | Unknown kind |
-| --- | --- | --- | --- | --- |
-| `a2a` | `url`, optional `skill` | Sends A2A `SendMessage` JSON-RPC 1.0; the only kind derivable from a card. | Changes the JSON-RPC endpoint or target skill. | Accepted, but no delivery driver is selected. |
-| `github-issue` | `repo`, optional `server`, `labels`, `template` | Creates an issue through `gh`, then GitHub REST fallback (`server` selects a GitHub Enterprise host; API base `https://<server>/api/v3` unless `GITHUB_API_URL` overrides). | Changes the repository, host, labels, or issue template. | Accepted, but no delivery driver is selected. |
-| `gitlab-issue` | `repo`, optional `server` (default `gitlab.com`), `labels`, `template` | Creates an issue through `glab`, then GitLab REST fallback (`POST /api/v4/projects/<url-encoded path>/issues`, token from `GITLAB_TOKEN`/`GLAB_TOKEN`). | Changes the project, host, labels, or template. | Accepted, but no delivery driver is selected. |
-| `gitea-issue` | `repo`, `server` (required), optional `labels` | Creates an issue through `tea`, then Gitea/Forgejo REST fallback (`POST /api/v1/repos/<owner>/<repo>/issues`, token from `GITEA_TOKEN`/`FORGEJO_TOKEN`). Covers Gitea, Forgejo and Codeberg. | Changes the instance or repository. | Accepted, but no delivery driver is selected. |
-| `bitbucket-issue` | `repo` (`workspace/slug`), optional `labels` | Prints an instruction with a prefilled deep link; Bitbucket Cloud only — Data Center has no issue tracker. | Changes the instructed destination. | Accepted, but no delivery driver is selected. |
-| `azure-boards` | `organization`, `project`, optional `issue-type` | Prints an `az boards work-item create` instruction. | Changes the instructed organization, project, or type. | Accepted, but no delivery driver is selected. |
-| `http` | `url` (https), optional `method` (default `POST`), `headers` (static literals), `content-type`, `body` | Owner-described request. Instruction by default (rendered as the exact final request); delivered only when the consumer allows the origin in `settings.contact.allow-http`; no credential is ever attached from the declaration. | Changes the described endpoint or payload. | — |
-| `exec` | `command` (argv, bare binary name first), optional `args`, `stdin` (default `{message}`) | Owner-described local invocation. Instruction by default; executed only when the binary name is in the consumer's `settings.contact.allow-exec` and resolves on PATH; argv exec, never a shell; CLI-only — the MCP `contact` tool refuses `exec`. | Changes the described invocation. | — |
-| `email` | `address`, optional `subject-prefix` | Pipes RFC 5322 mail to `sendmail` on consumer PATH; otherwise uses `GITA2A_SMTP_URL=smtps://user@host` with `GITA2A_SMTP_PASSWORD`; otherwise prints an instruction. Coordinates come from the owner and credentials only from the consumer. | Changes the recipient or subject. | Accepted, but no delivery driver is selected. |
-| `jira` | `url`, `project`, optional `issue-type` | Prints a Jira instruction. | Changes the instructed site, project, or issue type. | Accepted, but no delivery driver is selected. |
-| `mattermost`, `slack`, `discord`, `telegram`, `teams` | `channel`, `handle`, optional `server` | Prints a chat instruction. | Changes the instructed workspace, channel, or handle. | Accepted, but no delivery driver is selected. |
-| `url` | `url`, optional `note` | Prints the URL instruction. | Changes the instructed destination. | Accepted, but no delivery driver is selected. |
-
-An unknown kind is rendered as `kind: <value>` with its extension keys, is never a validation
-error, and cannot be delivered by `contact` until a driver exists.
-
-Issue-kind instructions include a prefilled, URL-encoded and length-capped deep link when the
-forge supports one, so a driverless contact is one click for a human and one request for an
-agent. GitHub, Gitea, and Bitbucket use `…/issues/new?title=…&body=…`; GitLab uses
-`…/-/issues/new?issue[title]=…&issue[description]=…`. The title is the same capped first
-non-empty message line used by delivery drivers, and the body/description is the capped full
-message. Forges without a tracker (Gerrit, Bitbucket Data Center, bare git hosting) are served
-by `email`, `jira`, `url`, or a chat kind — contacts bind to intents, not to where the code is
-hosted.
-
-Driver resolution per contact, in order: a consumer-installed plugin executable
-`git-a2a-contact-<kind>` on PATH; the built-in driver; a declared `http`/`exec` invocation the
-consumer has consented to; the rendered instruction. The chosen path is named in the delivery
-record and by `contact --list-drivers`.
-
-## `agents[].contacts[].note`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:394`](../spec/_.hint#L394).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional. Instructions printed verbatim after the route. Changing it changes the asker's
-guidance, not routing priority or delivery mechanics.
-
-## `agents[].contacts[].url`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:399`](../spec/_.hint#L399).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `a2a`, `jira`, and `url`, required and HTTPS for `http`. Changing it changes
-the service or instruction destination; for A2A it is the JSON-RPC endpoint. `http` templates may
-place non-message placeholders only in query values according to `contact_placeholders`.
-
-## `agents[].contacts[].skill`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:405`](../spec/_.hint#L405).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `a2a`. Skill identifier requested from the remote agent. Changing it changes
-the A2A target skill without changing the endpoint.
-
-## `agents[].contacts[].address`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:410`](../spec/_.hint#L410).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `email`. Destination email address. Changing it changes the recipient.
-The reference CLI pipes RFC 5322 mail to consumer-installed `sendmail`, otherwise uses consumer
-SMTP configuration, otherwise prints the instruction.
-
-## `agents[].contacts[].subject-prefix`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:416`](../spec/_.hint#L416).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `email`. Prefix suggested for the email subject. Changing it changes only
-the printed instruction.
-
-## `agents[].contacts[].repo`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:421`](../spec/_.hint#L421).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string for `github-issue`, `gitlab-issue`, `gitea-issue`, and `bitbucket-issue`; normally
-`owner/name`, while GitLab permits nested `group/subgroup/name`. Changing it changes the repository
-where the issue driver delivers the request.
-
-## `agents[].contacts[].labels`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:427`](../spec/_.hint#L427).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, optional for issue kinds. Changing it changes labels requested when an issue is
-created; a missing label is a delivery error from the host.
-
-## `agents[].contacts[].template`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:432`](../spec/_.hint#L432).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for issue kinds. Issue form/template name. Changing it changes the requested
-template without changing routing.
-
-## `agents[].contacts[].project`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:477`](../spec/_.hint#L477).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string for `jira` and `azure-boards`. Project key. Changing it changes the project named in the
-instruction.
-
-## `agents[].contacts[].organization`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:437`](../spec/_.hint#L437).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string for `azure-boards`. Changing it changes the Azure DevOps organization named by the
-instruction.
-
-## `agents[].contacts[].issue-type`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:482`](../spec/_.hint#L482).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `jira`. Issue type. Changing it changes the Jira issue kind named in the
-instruction.
-
-## `agents[].contacts[].channel`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:487`](../spec/_.hint#L487).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for chat kinds. Channel name or id. Changing it changes the printed chat
-destination; chat contacts are instruction-only.
-
-## `agents[].contacts[].handle`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:492`](../spec/_.hint#L492).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for chat kinds. Agent mention or handle. Changing it changes whom the asker is
-told to address.
-
-## `agents[].contacts[].server`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:497`](../spec/_.hint#L497).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for chat kinds. Workspace or server URL/name. Changing it disambiguates the
-printed chat destination.
-
-## `agents[].contacts[].method`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:442`](../spec/_.hint#L442).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `http`, default `POST`. Changing it changes the exact instructed or allowed
-HTTP request method.
-
-## `agents[].contacts[].headers`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:447`](../spec/_.hint#L447).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-map of string to string, optional for `http`. Values are static literals: placeholders are invalid,
-and git-a2a never adds credentials from the declaration or consumer environment.
-
-## `agents[].contacts[].content-type`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:452`](../spec/_.hint#L452).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional for `http`. It selects the request Content-Type and JSON-aware placeholder
-escaping when it contains `json`.
-
-## `agents[].contacts[].body`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:457`](../spec/_.hint#L457).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string template, optional for `http`. It may use every value in `contact_placeholders`, including
-`{message}`; changing it changes the exact instructed or delivered payload.
-
-## `agents[].contacts[].command`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: minimum 1 item(s).
-- Normative source: [`spec/_.hint:462`](../spec/_.hint#L462).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, required for `exec`. The first item is a bare binary name without a path separator;
-remaining items are argv entries. It is never interpreted by a shell.
-
-## `agents[].contacts[].args`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:467`](../spec/_.hint#L467).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of string templates, optional for `exec`, appended to `command`. It may use every non-message
-placeholder in `contact_placeholders`; changing it changes argv only.
-
-## `agents[].contacts[].stdin`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:472`](../spec/_.hint#L472).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string template, optional for `exec`, default `{message}`. It may use the complete placeholder set
-and is passed as stdin without shell or environment expansion.
-
-## `agents[].trust.signatures`
-
-- Type: boolean; optional.
-- Default: `false`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:506`](../spec/_.hint#L506).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-boolean, optional, default `false`. When changed to `true`, unsigned, invalid, or unverifiable
-cards make `status` fail and make `update` warn while retaining the dependency update.
-
-## `agents[].trust.accepts-external`
-
-- Type: boolean; optional.
-- Default: unstated.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:511`](../spec/_.hint#L511).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-boolean, optional, default unstated. `false` is enforced by `contact`: a consumer whose
-organisation differs from the owner's is refused (exit 2) unless `--external-ok`; `who` marks the
-agent "(external requests not accepted)". Organisation = origin host plus first path segment of
-`module.repository`, or the values of `settings.organisation` when declared.
-
-## `agents[].trust.jwks`
-
-- Type: array of string; optional.
-- Default: no pinned JWKS sources.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:518`](../spec/_.hint#L518).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of HTTPS URLs, optional. A card signature may use a key served by one of these pinned JWKS
-sources. Changing the list changes the accepted key authorities; a newly selected key is still
-subject to lock key-change review.
-
-## `agents[].trust.keys`
-
-- Type: array of string; optional.
-- Default: no pinned key thumbprints.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:524`](../spec/_.hint#L524).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of RFC 7638 JWK SHA-256 thumbprints, optional. A card signature may use a key matching one
-of these pins regardless of JWKS URL. Changing the list changes the exact accepted public keys.
-
-## `agents[].trust.origins`
-
-- Type: array of string; optional.
-- Default: repository/card binding rules.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:529`](../spec/_.hint#L529).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of `scheme://host[:port]` origins, optional. When present, card and interface URLs must use
-one of these origins. Changing it changes the allowed network identity of the agent binding.
-
-## `agents[].trust.jwks-max-age`
-
-- Type: string; optional.
-- Default: `24h`.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:534`](../spec/_.hint#L534).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-duration string, optional, default `24h`. Online status refreshes older JWKS cache entries;
-offline status reports their age. Changing it changes refresh freshness, never the cache's
-recoverable status.
-
-## `policy.intents`
-
-- Type: object; optional.
-- Default: unlisted intents route to `owner`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:599`](../spec/_.hint#L599).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-map intent → role. Which role answers which intent by default. Absent intents default to
-`owner`. Example: `change: spec` sends change requests to the specification agent rather than
-the coder — the pattern where engineers have full autonomy inside their repository and none
-outside it, and the manager owns the WHAT.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `question` | Routes a request for explanation; defaults to role `owner`. | Selects contacts declaring `question` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `change` | Routes a proposed behavior/API change. | Selects contacts declaring `change` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `bug` | Routes a defect report. | Selects contacts declaring `bug` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `review` | Routes a review request. | Selects contacts declaring `review` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `incident` | Routes an operational incident. | Selects contacts declaring `incident` or `*`. | Accepted; policy and contacts can route any matching token. |
-| `*` | Acts as a contact fallback after exact intent matches. | Broadens that contact to unmatched intents. | Accepted; any other unknown token is an exact-match intent. |
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `owner` | Default routing target; identifies the agent that commits, merges, and releases. | Requests using the default route select a different binding. | Accepted and routed when policy names the same token. |
-| `maintainer` | Routes intents mapped to a maintainer. | Changes which bindings match those intents. | Accepted and routed when policy names the same token. |
-| `spec` | Routes specification, task, or sequencing ownership. | Changes which bindings match policy entries such as `change: spec`. | Accepted and routed when policy names the same token. |
-| `reviewer` | Routes review ownership. | Changes which bindings match review policy. | Accepted and routed when policy names the same token. |
-| `support` | Routes support ownership. | Changes which bindings match support policy. | Accepted and routed when policy names the same token. |
-
-## `policy.consumers`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:606`](../spec/_.hint#L606).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object: `may` and `may-not`, lists of tokens from an open vocabulary (`read-surface`, `ask`,
-`open-issue`, `propose-change`, `commit`, `edit-spec`, `release`, …). Rendered verbatim into the
-consumer's roster block so an agent sees the boundary before it acts. Defaults when absent:
-`may: [read-surface, ask]`, `may-not: [commit]`.
-
-## `policy.contact-budget`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: open vocabulary; see the known-values table in this entry.
-- Normative source: [`spec/_.hint:613`](../spec/_.hint#L613).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-map of non-empty string keys to non-empty string values, optional and open vocabulary. It
-publishes owner expectations such as `per-consumer-daily: "2"` or a `note`; `who` and the roster
-render the entries in sorted order. The reference CLI does not count or enforce them. Changing a
-value changes guidance to consumers, not routing or delivery permission.
-
-## `policy.notes`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:620`](../spec/_.hint#L620).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. Anything else consumers must know, verbatim.
-
-## `policy.consumers.may`
-
-- Type: array of string; optional.
-- Default: `[read-surface, ask]`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:628`](../spec/_.hint#L628).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, optional, default `[read-surface, ask]`. Changing it changes the allowed actions
-rendered into consumer AGENTS.md rosters; the CLI reports the boundary but does not become an
-authorization service. Known values and unknown handling are in `vocabulary_consumers`.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `read-surface` | Tells consumers they may read the published surface. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `ask` | Tells consumers they may contact an owning agent. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `open-issue`, `propose-change` | Tells consumers they may request owner-side work. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `commit`, `edit-spec`, `release` | Common `may-not` boundaries for owner-controlled changes. | Adding/removing one changes the prohibition shown in the roster. | Accepted and rendered verbatim; downstream agents must obey it. |
-
-## `policy.consumers.may-not`
-
-- Type: array of string; optional.
-- Default: `[commit]`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:634`](../spec/_.hint#L634).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, optional, default `[commit]`. Changing it changes the prohibited actions rendered
-into consumer rosters; downstream agents remain responsible for obeying the declaration. Known
-values and unknown handling are in `vocabulary_consumers`.
-
-Known values:
-
-| Known value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `read-surface` | Tells consumers they may read the published surface. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `ask` | Tells consumers they may contact an owning agent. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `open-issue`, `propose-change` | Tells consumers they may request owner-side work. | Adding/removing it changes the rendered boundary only. | Accepted and rendered verbatim; git-a2a does not enforce authorization. |
-| `commit`, `edit-spec`, `release` | Common `may-not` boundaries for owner-controlled changes. | Adding/removing one changes the prohibition shown in the roster. | Accepted and rendered verbatim; downstream agents must obey it. |
-
-## `settings.vendor-dir`
-
-- Type: string; optional.
-- Default: `deps`.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:148`](../spec/_.hint#L148).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional relative path, default `deps`. Parent directory used when a vendored dependency
-does not declare `vendor.path`. `vendor/` is deliberately not the default because Go and Composer
-assign their own semantics to that name. Changing it moves only dependencies that use the default;
-explicit `vendor.path` values remain unchanged. It obeys all vendored-path safety rules.
-
-## `settings.sync-targets`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:155`](../spec/_.hint#L155).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of relative paths, optional. Additional files whose managed roster block `sync` maintains.
-Changing the list changes sync destinations, not dependency resolution or vendoring.
-
-## `settings.organisation`
-
-- Type: array of string; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:160`](../spec/_.hint#L160).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of strings, optional. Origins or `origin/owner` prefixes that count as "our organisation"
-for `accepts-external` decisions, e.g. `["https://github.com/neprel", "ssh://git.internal"]`.
-Default: the origin host and first path segment of `module.repository`. Changing it changes only
-the external-contact boundary used by `contact`.
-
-## `settings.contact`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:167`](../spec/_.hint#L167).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional: consumer consent for owner-described invocations. `allow-http` — list of
-origins (`https://host[:port]`); a dependency's `http` contact is delivered only when its URL's
-origin is listed, otherwise it renders as an instruction. `allow-exec` — list of bare binary
-names; a dependency's `exec` contact runs only when `command[0]` is listed and resolves on
-PATH. The lists live in the consumer's own manifest, so consent is authored, reviewed, and
-versioned by the consumer — never by the dependency. Defaults: empty, meaning instruction-only.
-
-## `dependencies[].id`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: pattern `^[a-z0-9][a-z0-9._-]{0,63}$`.
-- Normative source: [`spec/_.hint:688`](../spec/_.hint#L688).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. The dependency's `module.id` for an a2a module, or the repository basename for a plain
-dependency. Required after `add` (the CLI fills it); the lock is keyed on it.
-
-## `dependencies[].git`
-
-- Type: string; required.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:693`](../spec/_.hint#L693).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, required. The git URL (`ssh://`, `https://`, `git@host:path` scp form, `file://`).
-Stored exactly as given; credentials are never stored.
-
-## `dependencies[].ref`
-
-- Type: string; optional.
-- Default: the owner's `release.channel`, otherwise remote HEAD.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:698`](../spec/_.hint#L698).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. Branch, tag or commit to follow. Default: the dependency's `release.channel`, else the
-remote HEAD. Resolution: a 40-hex string is a commit; a full refname (`refs/heads/x`,
-`refs/tags/x`) is exactly that; a short name is resolved in git's own order — `refs/tags/<ref>`
-before `refs/heads/<ref>` — and an ambiguity is reported with the name chosen. A commit ref
-implies `track: locked`. Changing `ref`, `git` or `path` of an existing dependency is an
-ordinary edit (`git-a2a set`): identity is `module.id`, so the fetched manifest must carry the
-same id unless the consumer explicitly accepts a different one; every wired ecosystem follows
-the new source and pin together.
-
-## `dependencies[].path`
-
-- Type: string; optional.
-- Default: `.`.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:709`](../spec/_.hint#L709).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string. Subdirectory containing the dependency's `a2amodule.yml` or `a2amodule.yaml`
-(monorepo), or the adopted plain source root. Default `.`.
-
-## `dependencies[].track`
-
-- Type: string; optional.
-- Default: `locked`.
-- Allowed values: one of `locked`, `floating`.
-- Normative source: [`spec/_.hint:714`](../spec/_.hint#L714).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-`locked` (default) or `floating`, a closed vocabulary described in `vocabulary_track`. Every mode
-still records one observed commit in the lock. Changing the mode rewrites supported native
-dependency forms; unknown values are rejected.
-
-Known values:
-
-| Value | What the tool does | Consequence of changing it | Unknown value |
-| --- | --- | --- | --- |
-| `locked` | Pins every supported ecosystem to the one commit recorded in the lock. | Switching to it replaces floating native refs with the resolved commit. | Rejected by validation. |
-| `floating` | Writes a branch/tag form where the adapter supports it while still recording the observed commit. | Switching to it lets native tools follow the declared ref independently. | Rejected by validation. |
-
-## `dependencies[].wire`
-
-- Type: array of string; optional.
-- Default: all matching detected ecosystems.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:720`](../spec/_.hint#L720).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-list of ecosystems to wire, or absent for "every export that matches a manifest detected in this
-repository". An empty list means "record the dependency, wire nothing". When `wire` is absent
-and an export cannot be expressed in its ecosystem (the ecosystem has no git form for that URL,
-no subdirectory support, a floating ref it cannot store), the tool wires what it can, reports
-the rest as `not wired: <reason>` and `status` shows that ecosystem as `unwired`; it is an error
-only for an ecosystem named explicitly in `wire`. Wiring is repairable at any time
-(`git-a2a wire [ID]` re-applies every adapter from the lock, idempotently) — a half-wired
-dependency is a state the tool can always see and always fix, never one it hides.
-
-## `dependencies[].vendor`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:731`](../spec/_.hint#L731).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional, see [#vendor](../spec/_.hint). Its presence explicitly asks the tool to materialise
-the locked source tree in this consumer; a dependency is never vendored implicitly.
-
-## `dependencies[].shim`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:683`](../spec/_.hint#L683).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional, see [#shim](../spec/_.hint). Consumer-authored fallback metadata for a plain Git
-dependency.
-
-## `dependencies[].require`
-
-- Type: object; optional.
-- Default: none declared.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:736`](../spec/_.hint#L736).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-object, optional, see [#require](../spec/_.hint). It states consumer-side checks that must pass before
-locking or contacting this dependency. Defaults preserve the permissive behavior.
-
-## `dependencies[].require.commits`
-
-- Type: string; optional.
-- Default: `any`.
-- Allowed values: one of `any`, `signed`.
-- Normative source: [`spec/_.hint:771`](../spec/_.hint#L771).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-`any` (default) or `signed`. With `signed`, `add`, `update`, `fetch`, and `set` verify the
-resolved commit or tag with Git against `signers` before changing the lock. Changing it re-runs
-the check on the next mutation and on `status`; unknown values are rejected.
-
-## `dependencies[].require.signers`
-
-- Type: string; optional.
-- Default: none declared.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:777`](../spec/_.hint#L777).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-repository-relative path to a Git `allowed_signers` file, required when `commits: signed`.
-Changing it changes the trusted SSH/GPG signer set. A failed check leaves the lock untouched;
-`--insecure-skip-signers` is the explicit override and records `verified: skipped`.
-
-## `dependencies[].require.cards`
-
-- Type: string; optional.
-- Default: `any`.
-- Allowed values: one of `any`, `signed`.
-- Normative source: [`spec/_.hint:783`](../spec/_.hint#L783).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-`any` (default) or `signed`. `signed` treats every agent binding in the dependency as if it
-declared `trust.signatures: true`. Changing it changes whether unsigned or unverifiable cards
-are accepted; unknown values are rejected.
-
-## `dependencies[].require.card-origin`
-
-- Type: boolean; optional.
-- Default: `false`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:789`](../spec/_.hint#L789).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-boolean, optional, default `false`. When true, a card or interface origin mismatch is a failure
-rather than a warning. Changing it changes mismatch severity, not the origin comparison.
-
-## `dependencies[].vendor.mode`
-
-- Type: string; optional.
-- Default: `submodule`.
-- Allowed values: one of `submodule`, `copy`.
-- Normative source: [`spec/_.hint:803`](../spec/_.hint#L803).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-`submodule` (default) or `copy`. `submodule` records a Git gitlink at the locked commit and may
-initialise nested submodules. `copy` records a plain Git-metadata-free tree. Changing mode replaces
-one representation with the other transactionally; unknown values are rejected.
-
-## `dependencies[].vendor.path`
-
-- Type: string; optional.
-- Default: `<settings.vendor-dir>/<dependency-id>`.
-- Allowed values: minimum length 1.
-- Normative source: [`spec/_.hint:809`](../spec/_.hint#L809).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-string, optional relative path. Default `<settings.vendor-dir>/<dependency-id>`, normally
-`deps/<id>`. After slash normalisation it must be `..`-free and non-absolute; it must not be
-`.git`, `.git-a2a`, or inside either; must not equal or be inside `module.surface`; must not overlap
-another dependency's vendor path; and no existing path component may be a symlink. For submodule
-mode it must not already be tracked or be a submodule registered with another URL. Validation
-reports violations and never silently rewrites the path.
-
-## `dependencies[].vendor.recursive`
-
-- Type: boolean; optional.
-- Default: `false`.
-- Allowed values: schema type plus the normative behavior in this entry.
-- Normative source: [`spec/_.hint:818`](../spec/_.hint#L818).
-- Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
-
-Behavior and consequence:
-
-boolean, optional, default `false`. In submodule mode, initialise the dependency's own nested
-submodules. In copy mode `true` is invalid because a Git tree contains nested gitlinks, not their
-content. Changing it changes only nested-submodule initialisation.
-
-## Extension fields
-
-At every schema object that declares `patternProperties`, keys beginning with `x-` are
-extensions. The CLI preserves them; changing one changes only the extension consumer's
-behavior. A known object rejects every other unknown key.
-
-For an authoring sequence rather than field-by-field lookup, read the
-[owner's guide](authoring.md).