xoonya 2.4.0 → 2.6.0

package/lib/openapi_contract.js

@@ -0,0 +1,227 @@
+"use strict";
+
+const pkg = require("../package.json");
+
+function buildOpenApiDocument() {
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "xoonya Public HTTP Contract",
+      version: pkg.version,
+      summary: "Proof and review contract for the stable public HTTP layer.",
+      description: "This OpenAPI document exposes the stable builder-facing proof, review, and compatibility surfaces that outside builders should rely on first.",
+      contact: {
+        name: "naxytra"
+      }
+    },
+    jsonSchemaDialect: "https://spec.openapis.org/oas/3.1/dialect/base",
+    servers: [
+      {
+        url: "http://127.0.0.1:4340",
+        description: "Local xoonya service"
+      }
+    ],
+    tags: [
+      { name: "health", description: "Service health and readiness." },
+      { name: "proof-center", description: "Core proof and review surfaces." },
+      { name: "events", description: "Canonicalization, hashing, and receipt emission." },
+      { name: "proof-bundles", description: "Proof bundle build and verify surfaces." },
+      { name: "compatibility", description: "Compatibility verification surfaces." },
+      { name: "intelligence", description: "Proof-side intelligence and role surfaces." }
+    ],
+    paths: {
+      "/health": {
+        get: {
+          tags: ["health"],
+          summary: "Health check",
+          operationId: "getHealth",
+          responses: {
+            "200": { description: "Service health response" }
+          }
+        }
+      },
+      "/v1/proof-center": {
+        get: {
+          tags: ["proof-center"],
+          summary: "Get proof center bundle",
+          operationId: "getProofCenter",
+          responses: {
+            "200": { description: "Proof center bundle" }
+          }
+        }
+      },
+      "/v1/proof-center/summary": {
+        get: {
+          tags: ["proof-center"],
+          summary: "Get proof center summary",
+          operationId: "getProofCenterSummary",
+          responses: {
+            "200": { description: "Proof center summary" }
+          }
+        }
+      },
+      "/v1/events/canonicalize": {
+        post: {
+          tags: ["events"],
+          summary: "Canonicalize event payload",
+          operationId: "canonicalizeEvent",
+          responses: {
+            "200": { description: "Canonical event response" },
+            "400": { description: "Invalid event payload" }
+          }
+        }
+      },
+      "/v1/events/hash": {
+        post: {
+          tags: ["events"],
+          summary: "Hash canonical event payload",
+          operationId: "hashEvent",
+          responses: {
+            "200": { description: "Event hash response" },
+            "400": { description: "Invalid event payload" }
+          }
+        }
+      },
+      "/v1/receipts/emit": {
+        post: {
+          tags: ["events"],
+          summary: "Emit proof receipt",
+          operationId: "emitReceipt",
+          responses: {
+            "200": { description: "Receipt emission response" },
+            "400": { description: "Invalid receipt emission request" }
+          }
+        }
+      },
+      "/v1/proof-bundles/build": {
+        post: {
+          tags: ["proof-bundles"],
+          summary: "Build proof bundle",
+          operationId: "buildProofBundle",
+          responses: {
+            "200": { description: "Proof bundle created" },
+            "400": { description: "Invalid proof bundle request" }
+          }
+        }
+      },
+      "/v1/proof-bundles/verify": {
+        post: {
+          tags: ["proof-bundles"],
+          summary: "Verify proof bundle",
+          operationId: "verifyProofBundle",
+          responses: {
+            "200": { description: "Proof bundle verification result" },
+            "400": { description: "Invalid proof verification request" }
+          }
+        }
+      },
+      "/v1/receipts/verify": {
+        post: {
+          tags: ["compatibility"],
+          summary: "Verify receipt",
+          operationId: "verifyReceipt",
+          responses: {
+            "200": { description: "Receipt verification result" },
+            "400": { description: "Invalid receipt verification request" }
+          }
+        }
+      },
+      "/v1/proof-center/bridge/economic-handoff": {
+        post: {
+          tags: ["proof-center"],
+          summary: "Bridge economic handoff into proof review",
+          operationId: "bridgeEconomicHandoff",
+          responses: {
+            "200": { description: "Economic handoff bridge result" },
+            "400": { description: "Invalid handoff payload" }
+          }
+        }
+      },
+      "/v1/trust-intelligence/summary": {
+        get: {
+          tags: ["intelligence"],
+          summary: "Get trust intelligence summary",
+          operationId: "getTrustIntelligenceSummary",
+          responses: {
+            "200": { description: "Trust intelligence summary" }
+          }
+        }
+      },
+      "/v1/governance-intelligence/summary": {
+        get: {
+          tags: ["intelligence"],
+          summary: "Get governance intelligence summary",
+          operationId: "getGovernanceIntelligenceSummary",
+          responses: {
+            "200": { description: "Governance intelligence summary" }
+          }
+        }
+      },
+      "/v1/role-freeze/package": {
+        get: {
+          tags: ["intelligence"],
+          summary: "Get canonical role-freeze package",
+          operationId: "getRoleFreezePackage",
+          responses: {
+            "200": { description: "Role-freeze package" }
+          }
+        }
+      },
+      "/v1/role-transition": {
+        get: {
+          tags: ["intelligence"],
+          summary: "Get role transition direction package",
+          operationId: "getRoleTransition",
+          responses: {
+            "200": { description: "Role transition package" }
+          }
+        }
+      },
+      "/v1/capability-registry-home": {
+        get: {
+          tags: ["intelligence"],
+          summary: "Get capability registry home direction package",
+          operationId: "getCapabilityRegistryHome",
+          responses: {
+            "200": { description: "Capability registry home package" }
+          }
+        }
+      }
+    },
+    "x-naxytra-contract": {
+      product: "xoonya",
+      stability: "stable_public_http_layer",
+      route_count: 14,
+      target_audience: ["builders", "partners", "reviewers"],
+      linked_docs: [
+        "SERVICE_CONTRACT.md",
+        "FINAL_CONTRACT.md",
+        "START_HERE.md"
+      ]
+    }
+  };
+}
+
+function summarizeOpenApiDocument() {
+  const document = buildOpenApiDocument();
+  return {
+    product: "xoonya",
+    category: "proof-openapi-contract-summary",
+    summary_version: "xoonya-openapi-contract-summary-v1",
+    openapi_version: document.openapi,
+    info_version: document.info.version,
+    path_count: Object.keys(document.paths).length,
+    server_count: document.servers.length,
+    primary_protocol_lanes: ["http", "proof", "bridge"],
+    linked_surfaces: {
+      openapi_ref: "/openapi.json",
+      service_contract_ref: "SERVICE_CONTRACT.md",
+      final_contract_ref: "FINAL_CONTRACT.md"
+    }
+  };
+}
+
+module.exports = {
+  buildOpenApiDocument,
+  summarizeOpenApiDocument
+};

package/lib/proof_bridge_lane_contract.js

@@ -0,0 +1,82 @@
+"use strict";
+
+const {
+  buildBridgeIntelligencePack,
+  summarizeBridgeIntelligencePack
+} = require("./bridge_intelligence");
+const {
+  buildTrustIntelligencePack,
+  summarizeTrustIntelligencePack
+} = require("./trust_intelligence");
+
+function buildProofBridgeLanePack() {
+  const bridgeIntelligence = buildBridgeIntelligencePack();
+  const trustIntelligence = buildTrustIntelligencePack();
+  return {
+    product: "xoonya",
+    category: "proof-bridge-lane-pack",
+    pack_version: "xoonya-proof-bridge-lane-pack-v1",
+    lane_state: "first_party_proof_bridge_present",
+    posture: "runtime_to_proof_handoff_and_external_proof_bridge_lane",
+    bridge_intelligence: bridgeIntelligence,
+    trust_intelligence: trustIntelligence,
+    supported_surfaces: {
+      bridge_summary_ref: "/v1/proof-center/bridge/summary",
+      bridge_profile_support_ref: "/v1/proof-center/bridge/profile-support",
+      bridge_operator_review_pack_ref: "/v1/proof-center/bridge/operator-review-pack",
+      bridge_compatibility_pack_ref: "/v1/proof-center/bridge/compatibility-pack",
+      bridge_economic_handoff_ref: "/v1/proof-center/bridge/economic-handoff",
+      bridge_workflow_pack_ref: "/v1/proof-center/bridge/workflow-pack",
+      trust_intelligence_ref: "/v1/trust-intelligence/summary",
+      bridge_intelligence_ref: "/v1/bridge-intelligence/summary",
+      phase_8_continuity_ref: "/v1/phases/phase-8/proof-bridge-continuity/summary"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "runtime_to_proof_bridge",
+        recommended_reason: "best first bridge path for carrying bounded runtime consequence into proof review",
+        sequence: [
+          "inspect_bridge_lane_summary",
+          "inspect_bridge_profile_support",
+          "submit_economic_handoff",
+          "inspect_compatibility_and_operator_review_posture"
+        ]
+      },
+      {
+        flow_ref: "external_proof_bridge_review",
+        recommended_reason: "best first external proof compatibility path for imported result, receipt, or normalized proof bundles",
+        sequence: [
+          "inspect_phase_8_continuity_summary",
+          "inspect_bridge_intelligence",
+          "inspect_operator_review_pack",
+          "inspect_trust_intelligence"
+        ]
+      }
+    ],
+    guardrails: [
+      "bridge surfaces remain bounded followthrough rather than a second runtime core",
+      "compatibility and handoff carry must remain subordinate to proof review and governance checks",
+      "the bridge lane should increase builder trust without widening xoonya into uncontrolled orchestration"
+    ]
+  };
+}
+
+function summarizeProofBridgeLanePack() {
+  const pack = buildProofBridgeLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-bridge-lane-pack-summary",
+    summary_version: "xoonya-proof-bridge-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    posture: pack.posture,
+    bridge_coverage_state: pack.bridge_intelligence.bridge_coverage_state,
+    trust_readiness_state: pack.trust_intelligence.proof_readiness_state,
+    first_run_flow_count: pack.first_run_flows.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildProofBridgeLanePack,
+  summarizeProofBridgeLanePack
+};

package/lib/provenance_lane_contract.js

@@ -0,0 +1,54 @@
+"use strict";
+
+function buildProvenanceLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-provenance-lane-pack",
+    pack_version: "xoonya-provenance-lane-pack-v1",
+    lane_state: "first_party_provenance_lane_present",
+    posture: "proof_release_and_bundle_supply_chain_trust_lane",
+    standards: ["slsa"],
+    focal_surfaces: ["release_candidate", "release_manifest", "proof_bridge", "result_package_trust"],
+    supported_surfaces: {
+      release_candidate_ref: "/v1/release-candidate",
+      release_manifest_ref: "/v1/release-manifest",
+      release_center_ref: "/v1/release-center",
+      proof_bridge_ref: "/v1/proof-bridge",
+      result_package_trust_ref: "/v1/result-package-trust"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "proof_provenance_review",
+        recommended_reason: "best path for teams that need trust in proof artifacts, release posture, and imported evidence before wider rollout",
+        sequence: [
+          "inspect_provenance_lane_summary",
+          "inspect_release_candidate_and_manifest",
+          "inspect proof_bridge and result_package_trust surfaces",
+          "treat proof artifacts and release posture as provenance-carrying trust anchors"
+        ]
+      }
+    ],
+    guardrails: [
+      "provenance should strengthen trust in proof artifacts without replacing proof verification itself",
+      "supply-chain trust remains complementary to canonical proof semantics"
+    ]
+  };
+}
+
+function summarizeProvenanceLanePack() {
+  const pack = buildProvenanceLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-provenance-lane-pack-summary",
+    summary_version: "xoonya-provenance-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    standard_count: pack.standards.length,
+    focal_surface_count: pack.focal_surfaces.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildProvenanceLanePack,
+  summarizeProvenanceLanePack
+};

package/lib/provider_lane_contract.js

@@ -0,0 +1,67 @@
+"use strict";
+
+const {
+  buildPhase1OpenaiCodexProofPack,
+  summarizePhase1OpenaiCodexProofPack
+} = require("./phase_1_openai_codex_proof_pack");
+const {
+  buildPhase1ClaudeMcpProofPack,
+  summarizePhase1ClaudeMcpProofPack
+} = require("./phase_1_claude_mcp_proof_pack");
+
+function buildProviderLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-provider-lane-pack",
+    pack_version: "xoonya-provider-lane-pack-v1",
+    lane_state: "first_party_provider_family_present",
+    posture: "provider_entry_and_proof_followthrough_family",
+    featured_providers: {
+      openai_codex: {
+        pack: buildPhase1OpenaiCodexProofPack(),
+        summary: summarizePhase1OpenaiCodexProofPack()
+      },
+      claude_mcp: {
+        pack: buildPhase1ClaudeMcpProofPack(),
+        summary: summarizePhase1ClaudeMcpProofPack()
+      }
+    },
+    supported_surfaces: {
+      phase_1_summary_ref: "/v1/phases/phase-1/summary",
+      openai_codex_summary_ref: "/v1/phases/phase-1/openai-codex/proof/summary",
+      claude_mcp_summary_ref: "/v1/phases/phase-1/claude-mcp/proof/summary",
+      proof_bridge_ref: "/v1/proof-bridge",
+      integrations_ref: "/v1/integrations"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "provider_family_proof_selection",
+        recommended_reason: "best first path for understanding how named provider-originated runs enter the canonical proof and review system",
+        sequence: [
+          "inspect_provider_lane_summary",
+          "inspect_openai_codex_and_claude_mcp_proof_profiles",
+          "choose_the_followthrough_shape",
+          "continue_into_bridge_and_result_package_review"
+        ]
+      }
+    ]
+  };
+}
+
+function summarizeProviderLanePack() {
+  const pack = buildProviderLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-provider-lane-pack-summary",
+    summary_version: "xoonya-provider-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    featured_provider_count: Object.keys(pack.featured_providers).length,
+    first_run_flow_count: pack.first_run_flows.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildProviderLanePack,
+  summarizeProviderLanePack
+};

package/lib/release_history.js

@@ -10,6 +10,38 @@ function buildReleaseHistory() {
     current_version: packageJson.version,
     release_track: "public_release",
     history: [
+      {
+        version: "2.6.0",
+        channel: "public_release",
+        maturity_posture: "expansion_ready",
+        headline: "expansion proof release with XNYA native payload and line-rate profiles, native signed and anchored methods, external proof import, and standardization guardrails",
+        milestone_refs: [
+          "xoonya_native_signed_ed25519_secp256k1_p256",
+          "xoonya_native_anchored_method",
+          "xoonya_native_payload_profile_xnyp",
+          "xoonya_native_line_rate_frame",
+          "native_payload_profile_vectors",
+          "external_proof_import_adapter",
+          "native_hybrid_readiness_guardrails",
+          "native_standardization_pack"
+        ]
+      },
+      {
+        version: "2.5.0",
+        channel: "public_release",
+        maturity_posture: "adoption_ready",
+        headline: "adoption-surface proof release with contract lanes, provider and framework discovery, bridge trust, observability, provenance, artifact distribution, shared signals, and feature-control posture",
+        milestone_refs: [
+          "openapi_asyncapi_cloudevents_contracts",
+          "provider_and_framework_lanes",
+          "proof_bridge_and_external_import_lanes",
+          "integration_matrix_and_registry_surfacing",
+          "telemetry_and_provenance_lanes",
+          "artifact_distribution_and_shared_signal_lanes",
+          "feature_control_portability_lanes",
+          "umbrella_cli_entrypoint"
+        ]
+      },
       {
         version: "2.2.0",
         channel: "public_release",

package/lib/result_package_trust_lane_contract.js

@@ -0,0 +1,74 @@
+"use strict";
+
+const {
+  buildTrustIntelligencePack,
+  summarizeTrustIntelligencePack
+} = require("./trust_intelligence");
+const {
+  buildReviewIntelligencePack,
+  summarizeReviewIntelligencePack
+} = require("./review_intelligence");
+const {
+  buildGovernanceIntelligencePack,
+  summarizeGovernanceIntelligencePack
+} = require("./governance_intelligence");
+const {
+  buildProofBridgeLanePack,
+  summarizeProofBridgeLanePack
+} = require("./proof_bridge_lane_contract");
+
+function buildResultPackageTrustLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-result-package-trust-lane-pack",
+    pack_version: "xoonya-result-package-trust-lane-pack-v1",
+    lane_state: "first_party_result_package_trust_continuity_present",
+    posture: "result_package_review_and_followthrough_trust_lane",
+    trust_intelligence: buildTrustIntelligencePack(),
+    review_intelligence: buildReviewIntelligencePack(),
+    governance_intelligence: buildGovernanceIntelligencePack(),
+    proof_bridge_summary: summarizeProofBridgeLanePack(),
+    supported_surfaces: {
+      trust_intelligence_ref: "/v1/trust-intelligence/summary",
+      review_intelligence_ref: "/v1/review-intelligence/summary",
+      governance_intelligence_ref: "/v1/governance-intelligence/summary",
+      proof_bridge_ref: "/v1/proof-bridge/summary",
+      proof_center_ref: "/v1/proof-center/summary"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "result_package_followthrough",
+        recommended_reason: "best first path for showing that carried result packages remain reviewable, governable, and trust-bearing after handoff",
+        sequence: [
+          "inspect_result_package_trust_lane_summary",
+          "inspect_trust_and_review_intelligence",
+          "inspect_governance_followthrough_posture",
+          "inspect_proof_bridge_summary_for_runtime_to_proof_continuity"
+        ]
+      }
+    ],
+    guardrails: [
+      "result package trust continuity must reinforce canonical proof review rather than create a parallel trust system",
+      "outside trust should be earned through stable followthrough, not inflated by extra packaging"
+    ]
+  };
+}
+
+function summarizeResultPackageTrustLanePack() {
+  const pack = buildResultPackageTrustLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-result-package-trust-lane-pack-summary",
+    summary_version: "xoonya-result-package-trust-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    proof_readiness_state: pack.trust_intelligence.proof_readiness_state,
+    review_posture_state: pack.review_intelligence.review_posture_state,
+    first_run_flow_count: pack.first_run_flows.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildResultPackageTrustLanePack,
+  summarizeResultPackageTrustLanePack
+};

package/lib/shared_signals_lane_contract.js

@@ -0,0 +1,54 @@
+"use strict";
+
+function buildSharedSignalsLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-shared-signals-lane-pack",
+    pack_version: "xoonya-shared-signals-lane-pack-v1",
+    lane_state: "first_party_shared_signals_lane_present",
+    posture: "real_time_review_and_risk_signal_exchange_lane",
+    standards: ["openid_shared_signals", "caep"],
+    signal_families: ["review_events", "governance_events", "bridge_attention_events", "external_import_attention_events"],
+    supported_surfaces: {
+      auth_profiles_ref: "/v1/auth-profiles",
+      identity_interop_ref: "/v1/identity-interop",
+      proof_bridge_ref: "/v1/proof-bridge",
+      result_package_trust_ref: "/v1/result-package-trust",
+      external_proof_import_ref: "/v1/external-proof-import"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "proof_risk_signal_alignment",
+        recommended_reason: "best path when partner systems need near-real-time signals about review, bridge, or imported-proof trust changes",
+        sequence: [
+          "inspect_shared_signals_lane_summary",
+          "map native proof review and bridge states to shared signal posture",
+          "connect trust attention and import attention states to external signal exchange",
+          "keep proof acceptance and governance decisions canonical inside xoonya"
+        ]
+      }
+    ],
+    guardrails: [
+      "shared signals should export proof-side state changes, not replace review or governance logic",
+      "signal exchange must remain bounded and reviewable"
+    ]
+  };
+}
+
+function summarizeSharedSignalsLanePack() {
+  const pack = buildSharedSignalsLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-shared-signals-lane-pack-summary",
+    summary_version: "xoonya-shared-signals-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    standard_count: pack.standards.length,
+    signal_family_count: pack.signal_families.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildSharedSignalsLanePack,
+  summarizeSharedSignalsLanePack
+};

package/lib/telemetry_lane_contract.js

@@ -0,0 +1,54 @@
+"use strict";
+
+function buildTelemetryLanePack() {
+  return {
+    product: "xoonya",
+    category: "proof-telemetry-lane-pack",
+    pack_version: "xoonya-telemetry-lane-pack-v1",
+    lane_state: "first_party_observability_lane_present",
+    posture: "proof_followthrough_observability_and_scale_signal_lane",
+    standards: ["opentelemetry"],
+    core_signals: ["review_traces", "verification_metrics", "bridge_logs", "proof_events"],
+    supported_surfaces: {
+      cloudevents_ref: "/cloudevents.json",
+      asyncapi_ref: "/asyncapi.json",
+      proof_bridge_ref: "/v1/proof-bridge",
+      result_package_trust_ref: "/v1/result-package-trust",
+      integration_matrix_ref: "/v1/integration-matrix"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "proof_observability_alignment",
+        recommended_reason: "best path for operators who need review, verification, and bridge visibility at production scale",
+        sequence: [
+          "inspect_telemetry_lane_summary",
+          "align proof events to cloudevents and asyncapi",
+          "map review and verification signals to observability tooling",
+          "keep proof validation canonical while exporting useful operational signals"
+        ]
+      }
+    ],
+    guardrails: [
+      "telemetry should improve proof-side observability without redefining proof validity",
+      "review and verification diagnostics should remain subordinate to canonical proof semantics"
+    ]
+  };
+}
+
+function summarizeTelemetryLanePack() {
+  const pack = buildTelemetryLanePack();
+  return {
+    product: "xoonya",
+    category: "proof-telemetry-lane-pack-summary",
+    summary_version: "xoonya-telemetry-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    standard_count: pack.standards.length,
+    signal_count: pack.core_signals.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildTelemetryLanePack,
+  summarizeTelemetryLanePack
+};