sealbridge 0.0.1 → 0.2.0

package/dist/spec/README.ja.md

@@ -0,0 +1,76 @@
+# Sealbridge Protocol Specification (`spec/`)
+
+[English (README.md)](./README.md) | **日本語**
+
+**結論**: 本ディレクトリはプログラミング言語に依存しないプロトコル仕様と JSON Schema (Draft 2020-12) の正本（Single Source of Truth）を定義する。すべてのプロトコルオブジェクトは **RFC 8785 (JCS: JSON Canonicalization Scheme)** で正規化されたバイト列に対して **SHA-256 ダイジェスト** と **Ed25519 署名** を計算する。
+
+---
+
+## 1. 共通暗号・シリアライズ規則
+
+1. **エンコーディング**: UTF-8 JSON（I-JSON サブセット準拠、浮動小数点の誤差を避けるため金額・トークン数・秒数はすべて整数 `integer` で表現する）。
+2. **正規化（Canonicalization）**: 署名およびハッシュ計算の対象となるJSONオブジェクトは、[RFC 8785 (JCS)](https://www.rfc-editor.org/info/rfc8785/) に従ってキーを辞書順ソートし空白を除去した決定論的バイト列に変換する。
+3. **識別子（Principal ID）**: オーナーおよびエージェントの識別子は W3C `did:key` 形式（Ed25519公開鍵のMultibase base58btcエンコード、例: `did:key:z6Mk...`）を使用する。
+4. **ダイジェスト表記**: `"sha256:<64文字の16進小文字>"`（例: `"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"`）。
+5. **署名表記**: `"ed25519:<base64urlまたは128文字の16進小文字>"`。署名計算時は対象オブジェクトから `signature` / `signatures` フィールドを除いた状態でJCS正規化を行う。
+
+---
+
+## 2. コアスキーマ一覧
+
+| ファイル名                                                 | ステータス              | 役割                                                                                                                                                                            |
+| :--------------------------------------------------------- | :---------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| [`task-manifest.schema.json`](./task-manifest.schema.json) | **Draft v0.1 (検証済)** | 依頼側（Requester）が提示するタスク仕様・入出力JSON Schema・受入基準・検証方法・予算上限・付与Capability・隔離要件の定義                                                        |
+| `capability-token.schema.json`                             | Planned (M0)            | UCAN/Biscuit風の減衰可能スコープトークン定義（`issuer`, `audience`, `taskId`, `resources`, `allowedTools`, `argConstraints`, `maxInvocations`, `maxDelegationDepth`, `proofs`） |
+| `envelope.schema.json`                                     | Planned (M0)            | Relay通過用の署名付きメッセージエンベロープ（`envelopeId`, `taskId`, `seq`, `eventType`, `senderDid`, `recipientDid`, `payload`, `signature`）および受領確認 `AckReceipt`       |
+| `audit-entry.schema.json`                                  | Planned (M0)            | 双方向署名ハッシュチェーン台帳エントリおよび `UsageReceipt` / `ApprovalReceipt`                                                                                                 |
+
+---
+
+## 3. スキーマ検証コマンド
+
+```bash
+npx --yes -p ajv-cli@5 -p ajv-formats@3 ajv validate \
+  --spec=draft2020 \
+  -c ajv-formats \
+  -s spec/task-manifest.schema.json \
+  -d spec/examples/sample-task-manifest.json
+```
+
+## M0–M1 実行可能なワイヤプロファイル
+
+新しい `capability-token`、`usage-receipt`、`approval-receipt`、`ack-receipt`、`envelope`、`audit-entry` のスキーマは実装済みです。`pnpm validate:schemas` を実行すると、Ajv Draft 2020-12 で全スキーマをコンパイルし、すべてのサンプルを検証します。元の TaskManifest スキーマとサンプルは変更していません。
+
+署名付きプロトコルオブジェクトは `{ "payload": <object>, "signature": <block> }` です。`D = "sha256:" + hex(SHA256(UTF8(JCS(payload))))` とします。ブロックには `signerDid`、`canonicalization: "RFC8785-JCS"`、`payloadDigest: D`、`signedAt`、パディング無しの `signature: "ed25519:" + base64url(64-byte-signature)` が入ります。Ed25519 署名の正確なプレイメージは次のとおりです。
+
+```text
+UTF8(JCS({payload, signerDid, canonicalization, payloadDigest, signedAt}))
+```
+
+これはペイロードと署名メタデータを覆い、署名バイトそのものは署名しません。上の草案にある一般規則を、この形に精密化しています。JCS の入力は、有効な Unicode を持つ有限の JSON データでなければなりません。`undefined`、循環、疎な配列、非有限数、独自のオブジェクトインスタンス、孤立サロゲートは拒否します。JSON 成果物のコンテンツアドレスは `SHA256(UTF8(JCS(data)))` です。バイナリそのものには `digestBytes` を使います。did:key は Ed25519 公開鍵を、マルチコーデックのバイト `ed 01` と base58btc マルチベース `z` で符号化します。
+
+Capability の証明は、根から葉へ並んだ署名付きトークンの配列です。各子は、完全に署名された親の SHA-256 ダイジェストへ `parentHash` を束縛し、発行者を親の audience に変え、タスク束縛を保ち、リソース・ツール・引数スキーマを狭め、maxCalls と期限を上げず、notBefore を過去へ戻さず、maxDepth を少なくとも 1 減らします。深さが 0 なら、さらに子を作れません。ワイヤ上の `maxCalls` / `maxDepth` は、マニフェストの付与である `maxInvocations` / `maxDelegationDepth` に対応します。引数スキーマはツール名をキーにします。同一スキーマか、直接の `allOf` 継承だけを受理します。対応するスコープとスキーマ構文はセキュリティモデルを見てください。
+
+承認レシートのゲート名は、マニフェストのゲート名へ次のように対応します。
+
+| レシートのゲート     | マニフェストのゲート      |
+| -------------------- | ------------------------- |
+| contract_acceptance  | GATE_CONTRACT_ACCEPT      |
+| external_side_effect | GATE_EXTERNAL_SIDE_EFFECT |
+| budget_increase      | GATE_BUDGET_OVERRUN       |
+| redelegation         | GATE_SUB_DELEGATION       |
+| final_verification   | GATE_DELIVERY_ACCEPT      |
+
+オーナー署名の承認レシートは、タスク、ゲート、対象ダイジェストそのもの、APPROVED / REJECTED の決定を束縛します。ゲートのインスタンスはレシートの再生を拒否します。署名付き遷移は、契約ダイジェスト、タスク、直前の状態、0 始まりのシーケンスを束縛します。M1 の遷移プロファイルは PROPOSED、ACCEPTED、IN_PROGRESS、DELIVERED、VERIFY_ACCEPT、VERIFY_REJECT、SETTLED、CANCELLED、DISPUTED です。網羅表は `conformance/state-transitions.json` にあります。PROPOSE が PROPOSED を確立します。アーキテクチャにある交渉、再試行、タイムアウト専用の状態は、後の拡張です。
+
+監査本体のフィールドは `taskId`、0 始まりの `seq`、`prevEntryHash`（起源では null）、`actorDid`、`receiverDid`、`eventType`、`payload` です。`entryHash = digest(body)` です。`actorSignature` は本体に署名し、`counterSignature` はそのハッシュ、タスク、双方を束縛する署名付き AckReceipt です。最終の署名付きチェックポイントは件数、head、行為者を固定し、相手がもう一度署名します。JSONL は `{"entry": ...}` レコードのあとに、1件の `{"checkpoint": ...}` レコードが続きます。バンドルは `{entries, checkpoint}` です。オフライン検証にはチェックポイントが必要です。より古い有効なバンドルへの巻き戻しを検出するには、独立して入手した最新の head が必要です。
+
+妥当な `reportProgress` は途中の `metrics` を含められます。その使用量は、進捗フレームをキューへ入れる前にセッションのクォータへ計上されます。不正な `reportProgress` ペイロード（`INVALID_PROGRESS`）は、その `metrics` を適用しません。返された Promise は直ちに拒否され、セッションは粘着的な失敗を記録するため、その後の成果物で `SETTLED` にはなりません。アダプタが Promise 拒否を catch しても、依頼者は `PEER_REJECTED: {"code":"INVALID"}` を観測し、ワーカーは `INVALID_PROGRESS` で失敗します。
+
+A2A の AgentCard、Task、Message、Artifact は SDK のワイヤ形を保ち、署名付き Sealbridge エンベロープの中に載ります。ブリッジは、インストール済みの A2A SDK 0.3 のワイヤプロファイルを使います。Sealbridge の契約とレシートは、A2A を書き換えるのではなく、オーバーレイのペイロードです。MCP の `tools/call` の要求と結果は公式 SDK を使い、サンドボックスの外で物理的にプロキシされます。未知のツールと、メタデータの無い迂回は拒否します。
+
+## M2/M3 追加のディスカバリとセッションプロファイル
+
+M0/M1 の JSON スキーマとサンプルは変更していません。署名付き AgentCard と招待は、同じ `Signed<T>` のプレイメージを使います。`AgentCard` には ownerDid、agentDid、relayEndpoint、skills（任意の JSON 入出力スキーマを含む）、costModes、name、description、version が入ります。カードに署名するのはオーナーです。`AgentInvite` は、完全に署名されたカードを、同じ ownerDid / agentDid と relayUrl、および issuedAt / expiresAt に束縛します。パーサは、無効な署名、一致しない識別子や経路、未来の発行時刻、期限切れを拒否します。URI の符号化は `acp-invite:<base64url(JSON(Signed<AgentInvite>))>` または `acp://invite?token=<same-base64url>` です。
+
+セッションのエンベロープは、送信者ごとに単調なシーケンス番号を持ちます。各アプリケーションイベントのあとに、署名付き監査本体を運ぶ `AUDIT_ENTRY` エンベロープが続き、受信者は署名付き AckReceipt を運ぶ `AUDIT_ACK` を返します。双方が同一の AuditEntry を追記します。`CHECKPOINT` と `CHECKPOINT_ACK` は、最終の署名付きチェックポイントと副署を交換します。DELIVER には成果物、利用量、実行証明、およびその署名付き遷移が含まれます。証明は `effectiveIsolationLevel` と `sandboxBoundary`（`nodePermissionFlag`、`permissionModelActive`、`kernelNetworkIsolated`）を追加できます。`node:vm` はセキュリティ機構ではないです。Node の `--permission` / `--experimental-permission` は `fetch`、`node:net`、`node:http`、`node:https`、`node:dns`、`node:dgram` を止めません。`kernelNetworkIsolated` が真になるのは `oci_container`（`isolationLevel: 'oci_container'`）だけで、その経路はカーネルのネットワーク境界です（`--network none`、`--read-only`、`--cap-drop ALL`、`no-new-privileges`）。`subprocess_restricted` は権限フラグと `--allow-fs-read`、`--allow-fs-write` を組にすることがあります。元の M1 証明も有効なままです。

package/dist/spec/README.md

@@ -0,0 +1,135 @@
+# Sealbridge Protocol Specification (`spec/`)
+
+**English** | [日本語 (README.ja.md)](./README.ja.md)
+
+**Conclusion**: This directory is the language-independent source of truth for the protocol specification and the JSON Schema (Draft 2020-12). Every protocol object computes a **SHA-256 digest** and an **Ed25519 signature** over bytes canonicalized with **RFC 8785 (JCS: JSON Canonicalization Scheme)**.
+
+---
+
+## 1. Shared cryptographic and serialization rules
+
+1. **Encoding**: UTF-8 JSON (the I-JSON subset). Amounts, token counts, and durations are integers, so floating-point error does not enter the signed bytes.
+2. **Canonicalization**: A JSON object that will be signed or hashed is converted to a deterministic byte string with keys sorted lexicographically and whitespace removed, following [RFC 8785 (JCS)](https://www.rfc-editor.org/info/rfc8785/).
+3. **Principal ID**: Owner and agent identifiers use W3C `did:key` (the Ed25519 public key in multibase base58btc, for example `did:key:z6Mk...`).
+4. **Digest form**: `"sha256:<64 lowercase hex characters>"` (for example `"sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"`).
+5. **Signature form**: `"ed25519:<base64url or 128 lowercase hex characters>"`. Before signing, remove the `signature` / `signatures` fields from the object and then apply JCS.
+
+---
+
+## 2. Core schemas
+
+| File                                                       | Status                     | Role                                                                                                                                                                                      |
+| :--------------------------------------------------------- | :------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`task-manifest.schema.json`](./task-manifest.schema.json) | **Draft v0.1 (validated)** | The task specification the requester presents: input and output JSON Schema, acceptance criteria, verification method, budget cap, granted Capabilities, and isolation requirements       |
+| `capability-token.schema.json`                             | Planned (M0)               | A UCAN/Biscuit-style attenuating scope token (`issuer`, `audience`, `taskId`, `resources`, `allowedTools`, `argConstraints`, `maxInvocations`, `maxDelegationDepth`, `proofs`)            |
+| `envelope.schema.json`                                     | Planned (M0)               | The signed message envelope that crosses the Relay (`envelopeId`, `taskId`, `seq`, `eventType`, `senderDid`, `recipientDid`, `payload`, `signature`) and the acknowledgement `AckReceipt` |
+| `audit-entry.schema.json`                                  | Planned (M0)               | A bilateral signed hash-chain ledger entry, plus `UsageReceipt` / `ApprovalReceipt`                                                                                                       |
+
+---
+
+## 3. Schema validation command
+
+```bash
+npx --yes -p ajv-cli@5 -p ajv-formats@3 ajv validate \
+  --spec=draft2020 \
+  -c ajv-formats \
+  -s spec/task-manifest.schema.json \
+  -d spec/examples/sample-task-manifest.json
+```
+
+## M0–M1 executable wire profile
+
+The new `capability-token`, `usage-receipt`, `approval-receipt`, `ack-receipt`,
+`envelope` and `audit-entry` schemas are implemented. Run `pnpm validate:schemas`
+to compile all schemas and validate every example using Ajv Draft 2020-12.
+The original TaskManifest schema and example remain unchanged.
+
+Signed protocol objects use `{ "payload": <object>, "signature": <block> }`.
+Let `D = "sha256:" + hex(SHA256(UTF8(JCS(payload))))`. The block contains
+`signerDid`, `canonicalization: "RFC8785-JCS"`, `payloadDigest: D`, `signedAt`, and
+`signature: "ed25519:" + base64url(64-byte-signature)` without padding.
+The exact Ed25519 signature preimage is:
+
+```text
+UTF8(JCS({payload, signerDid, canonicalization, payloadDigest, signedAt}))
+```
+
+This covers the payload and signature metadata, and does not sign the signature
+bytes themselves. It refines the draft's general rule above. JCS inputs must be
+finite JSON data with valid Unicode; undefined, cycles, sparse arrays, nonfinite
+numbers, custom object instances and lone surrogates are rejected. Content
+addresses for JSON artifacts use `SHA256(UTF8(JCS(data)))`; `digestBytes` is
+available for exact binary content. did:key encodes the Ed25519 public key with
+multicodec bytes `ed 01` and base58btc multibase `z`.
+
+Capability proofs are an ordered root-to-leaf array of signed tokens. Each child
+binds `parentHash` to the SHA-256 digest of its complete signed parent, changes
+issuer to the parent's audience, retains task binding, narrows the resource,
+tools and argument schemas, never raises maxCalls or expiry, never backdates
+notBefore, and decreases maxDepth by at least one. A zero depth forbids another
+child. Wire token `maxCalls`/`maxDepth` correspond to manifest grant
+`maxInvocations`/`maxDelegationDepth`. Argument schemas are indexed by tool name.
+Only identical schemas or direct `allOf` inheritance are accepted. See the
+security model for supported scope and schema syntax.
+
+Approval receipt gate names map to the manifest's names:
+
+| Receipt gate         | Manifest gate             |
+| -------------------- | ------------------------- |
+| contract_acceptance  | GATE_CONTRACT_ACCEPT      |
+| external_side_effect | GATE_EXTERNAL_SIDE_EFFECT |
+| budget_increase      | GATE_BUDGET_OVERRUN       |
+| redelegation         | GATE_SUB_DELEGATION       |
+| final_verification   | GATE_DELIVERY_ACCEPT      |
+
+Owner-signed approval receipts bind the task, gate, exact target digest and
+APPROVED/REJECTED decision. Gate instances reject receipt replay. Signed
+transitions bind contract digest, task, prior state and zero-based sequence. The
+M1 transition profile uses PROPOSED, ACCEPTED, IN_PROGRESS, DELIVERED,
+VERIFY_ACCEPT, VERIFY_REJECT, SETTLED, CANCELLED and DISPUTED; the exhaustive table
+is in `conformance/state-transitions.json`. PROPOSE establishes PROPOSED. Negotiation,
+retry and timeout-specific states in the architecture remain later extensions.
+
+Audit body fields are `taskId`, zero-based `seq`, `prevEntryHash` (null at genesis),
+`actorDid`, `receiverDid`, `eventType`, `payload`. `entryHash = digest(body)`;
+`actorSignature` signs the body and `counterSignature` is a signed AckReceipt
+binding that hash, task and both parties. The final signed checkpoint fixes the
+count, head and actors and is signed again by the other party. JSONL contains
+`{"entry": ...}` records followed by one `{"checkpoint": ...}` record. Bundles
+contain `{entries, checkpoint}`. The checkpoint is required for offline verification.
+An independent latest head is required to detect rollback to an older valid bundle.
+
+A valid `reportProgress` may include intermediate `metrics`, and those metrics are charged to the session quota before the progress frame is queued. An invalid `reportProgress` payload (`INVALID_PROGRESS`) does not apply its `metrics`. The returned promise rejects immediately, and the session records a sticky failure, so a later deliverable cannot settle. The requester observes `PEER_REJECTED: {"code":"INVALID"}` and the worker fails with `INVALID_PROGRESS`, even if the adapter catches the promise.
+
+A2A AgentCard, Task, Message and Artifact retain SDK wire shapes, carried inside
+signed Sealbridge envelopes. The bridge uses the installed A2A SDK 0.3 wire profile;
+Sealbridge contract/receipt objects are overlay payloads rather than changes to A2A.
+MCP `tools/call` requests and results use the official SDK and are physically
+proxied outside the sandbox. Unknown tools and metadata-free bypasses are denied.
+
+## M2/M3 additive discovery and session profile
+
+The M0/M1 JSON schemas and examples remain unchanged. Signed AgentCards and
+invites use the same `Signed<T>` preimage. `AgentCard` contains ownerDid,
+agentDid, relayEndpoint, skills (including optional JSON input/output schemas),
+costModes, name, description and version. The owner signs the card.
+`AgentInvite` binds the complete signed card to the same ownerDid/agentDid and
+relayUrl, plus issuedAt/expiresAt. Parsers reject invalid signatures, mismatched
+identities/routes, future issuance and expiry. URI encoding is either
+`acp-invite:<base64url(JSON(Signed<AgentInvite>))>` or
+`acp://invite?token=<same-base64url>`.
+
+Session envelopes have monotonic sequence numbers per sender. Each application
+event is followed by an `AUDIT_ENTRY` envelope carrying a signed audit body;
+the receiver returns `AUDIT_ACK` carrying its signed AckReceipt. Both sides
+append the identical AuditEntry. `CHECKPOINT` and `CHECKPOINT_ACK` exchange the
+final signed checkpoint and countersignature. DELIVER includes artifact, usage,
+attestation and its signed transition. Attestations may add
+`effectiveIsolationLevel` and `sandboxBoundary` (`nodePermissionFlag`,
+`permissionModelActive`, `kernelNetworkIsolated`). `node:vm` is not a security mechanism,
+and Node's `--permission` / `--experimental-permission` model does not block
+`fetch`, `node:net`, `node:http`, `node:https`, `node:dns`, or `node:dgram`.
+`kernelNetworkIsolated` is true only for `oci_container` (`isolationLevel: 'oci_container'`),
+which is the kernel network boundary: `--network none`, `--read-only`, `--cap-drop ALL`, and `no-new-privileges`.
+`subprocess_restricted` may add `--allow-fs-read` and `--allow-fs-write` with the
+permission flag. Original M1 attestations remain valid.

package/dist/spec/ack-receipt.schema.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acp-spec.local/schemas/v0.1/ack-receipt.schema.json",
+  "title": "ack-receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "payload",
+    "signature"
+  ],
+  "properties": {
+    "payload": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "taskId",
+        "entryHash",
+        "actorDid",
+        "receiverDid"
+      ],
+      "properties": {
+        "type": {
+          "const": "AckReceipt"
+        },
+        "taskId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "entryHash": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "actorDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "receiverDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signerDid",
+        "canonicalization",
+        "payloadDigest",
+        "signedAt",
+        "signature"
+      ],
+      "properties": {
+        "signerDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "canonicalization": {
+          "const": "RFC8785-JCS"
+        },
+        "payloadDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "signature": {
+          "type": "string",
+          "pattern": "^ed25519:[A-Za-z0-9_-]{86}$"
+        }
+      }
+    }
+  }
+}

package/dist/spec/agent-card.schema.json

@@ -0,0 +1,83 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acp-spec.local/schemas/v0.1/agent-card.schema.json",
+  "title": "agent-card",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["payload", "signature"],
+  "properties": {
+    "payload": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "name",
+        "description",
+        "ownerDid",
+        "agentDid",
+        "relayEndpoint",
+        "skills",
+        "costModes",
+        "version",
+        "expiresAt"
+      ],
+      "properties": {
+        "type": { "const": "AgentCard" },
+        "name": { "type": "string", "minLength": 1 },
+        "description": { "type": "string" },
+        "ownerDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "agentDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "relayEndpoint": { "type": "string", "minLength": 1 },
+        "skills": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "name"],
+            "properties": {
+              "id": { "type": "string", "minLength": 1 },
+              "name": { "type": "string" },
+              "description": { "type": "string" },
+              "inputSchema": {},
+              "outputSchema": {}
+            }
+          }
+        },
+        "costModes": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "enum": ["worker_byok", "bilateral_quota", "external_settlement_plugin"]
+          }
+        },
+        "version": { "type": "string", "minLength": 1 },
+        "expiresAt": { "type": "string", "format": "date-time" },
+        "agentDelegation": { "$ref": "#/$defs/signature" }
+      }
+    },
+    "signature": { "$ref": "#/$defs/signature" }
+  },
+  "$defs": {
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["signerDid", "canonicalization", "payloadDigest", "signedAt", "signature"],
+      "properties": {
+        "signerDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "canonicalization": { "const": "RFC8785-JCS" },
+        "payloadDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "signedAt": { "type": "string", "format": "date-time" },
+        "signature": { "type": "string", "pattern": "^ed25519:[A-Za-z0-9_-]{86}$" }
+      }
+    }
+  }
+}

package/dist/spec/approval-receipt.schema.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acp-spec.local/schemas/v0.1/approval-receipt.schema.json",
+  "title": "approval-receipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "payload",
+    "signature"
+  ],
+  "properties": {
+    "payload": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "type",
+        "receiptId",
+        "taskId",
+        "gate",
+        "targetDigest",
+        "decision",
+        "approvedAt"
+      ],
+      "properties": {
+        "type": {
+          "const": "ApprovalReceipt"
+        },
+        "receiptId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "taskId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "gate": {
+          "enum": [
+            "contract_acceptance",
+            "external_side_effect",
+            "budget_increase",
+            "redelegation",
+            "final_verification"
+          ]
+        },
+        "targetDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "decision": {
+          "enum": [
+            "APPROVED",
+            "REJECTED"
+          ]
+        },
+        "approvedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signerDid",
+        "canonicalization",
+        "payloadDigest",
+        "signedAt",
+        "signature"
+      ],
+      "properties": {
+        "signerDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "canonicalization": {
+          "const": "RFC8785-JCS"
+        },
+        "payloadDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "signature": {
+          "type": "string",
+          "pattern": "^ed25519:[A-Za-z0-9_-]{86}$"
+        }
+      }
+    }
+  }
+}

package/dist/spec/audit-entry.schema.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acp-spec.local/schemas/v0.1/audit-entry.schema.json",
+  "title": "audit-entry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "body",
+    "entryHash",
+    "actorSignature",
+    "counterSignature"
+  ],
+  "properties": {
+    "body": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "taskId",
+        "seq",
+        "prevEntryHash",
+        "actorDid",
+        "receiverDid",
+        "eventType",
+        "payload"
+      ],
+      "properties": {
+        "taskId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "seq": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "prevEntryHash": {
+          "anyOf": [
+            {
+              "type": "string",
+              "pattern": "^sha256:[a-f0-9]{64}$"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "actorDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "receiverDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "eventType": {
+          "type": "string",
+          "minLength": 1
+        },
+        "payload": {}
+      }
+    },
+    "entryHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "actorSignature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "signerDid",
+        "canonicalization",
+        "payloadDigest",
+        "signedAt",
+        "signature"
+      ],
+      "properties": {
+        "signerDid": {
+          "type": "string",
+          "pattern": "^did:key:z[1-9A-HJ-NP-Za-km-z]{32,128}$"
+        },
+        "canonicalization": {
+          "const": "RFC8785-JCS"
+        },
+        "payloadDigest": {
+          "type": "string",
+          "pattern": "^sha256:[a-f0-9]{64}$"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "signature": {
+          "type": "string",
+          "pattern": "^ed25519:[A-Za-z0-9_-]{86}$"
+        }
+      }
+    },
+    "counterSignature": {
+      "$ref": "https://acp-spec.local/schemas/v0.1/ack-receipt.schema.json"
+    }
+  }
+}