feat(schema): Multiverseal Twin — federation-facing identity/reputation projection

Makefile

@@ -1,6 +1,6 @@
 .PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples validate-data-class-examples validate-table-keys validate-dag-loop validate-vocab-currency-loop vocab-currency-dogfood validate-glossary-promotion validate-agreement validate-stopword-analysis stopword-analysis-live validate-kgram-differential validate-learned-dictionary train-dataclass-classifiers
 
-validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers
+validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers validate-multiverseal-twin-examples
 	@echo "OK: validate"
 
 validate-ingestion-pipeline-examples:
@@ -213,3 +213,7 @@ validate-sync-cycle-receipts:
 
 validate-value-type:
 	python3 tools/validate_value_type.py
+
+validate-multiverseal-twin-examples:
+	python3 -m pip install --user jsonschema >/dev/null
+	python3 tools/validate_multiverseal_twin_examples.py

docs/adr/0014-multiverseal-twin-identity.md

@@ -0,0 +1,64 @@
+# ADR-0014: Multiverseal Twin — the federation-facing identity/reputation projection
+
+Status: Accepted
+Date: 2026-08-01
+Extends: ADR-0013 (digital-soul identity & reputation)
+
+## Context
+
+ADR-0013 gave us the private core (`DigitalSoulIdentity`), the reputation plane
+(`ReputationDimension` / `SacredCapitalLedger` / `PortableReputationClaim`), and the
+on-device `AscensionReading`. What it lacked was a principled, hardened object for the part
+that actually touches the untrusted, federated world and carries imported non-first-party
+reputation. The Multiverseal Twin spec supplies exactly that, on a single reference-gated
+holographic substrate, with rigor-tiered guarantees. It also unifies three loose threads:
+the "bind reputation to evidence" rule, the reversibility-distance privacy metric (from the
+reidentification-economy dossier), and the "read movement not score" ambition.
+
+## Decisions
+
+1. **Core vs twin.** `DigitalSoulIdentity` is the sovereign, private, authoritative core.
+   `MultiversealTwin` is its federation-facing projection — the only object relying parties
+   watch. The core is never embedded in the twin; only reference-gated projections are.
+
+2. **Reference-at-ingest (Powell–Stetson) is mandatory.** A foreign attestation is admitted
+   only as `TwinAttestation` = `bind(object, r_c)` with a provenance envelope; a bare score is
+   never summed into reputation. Reconcilability is manufactured at ingest. This is the
+   holographic form of the capture-time receipt, and — per reidentification-economy §A.5 — the
+   *only* place the purpose/authorization bit can live, because it is provably unrecoverable
+   from the signal afterward.
+
+3. **One budget: ε = capacity = crosstalk = unlinkability = reversibility distance.**
+   `MultiversealTwin.unlinkability.epsilon` (Johnson–Lindenstrauss almost-orthogonality) is the
+   single knob. It is explicitly the reversibility-distance ledger from the reidentification
+   appendix — there is no separate "privacy parameter."
+
+4. **Access control is the code threshold.** QEC `[[n,k,d]]` sharing: `d` = policy. Any region
+   above `n−d` shares reconstructs; below reveals nothing. Resilience and privacy are one dial.
+
+5. **Mint/verify asymmetry via VRF, anchored to the verified core.** Only the subject's master
+   key mints; anyone verifies. The anchor is a `ProofOfSelfToken` (Identity-Is-Prime), tying
+   "who may mint this twin" to a proven subject. Forgery reduces to breaking VRF.
+
+6. **The impersonation wall is the top invariant.** A watchable persona of subject `u` mints
+   only under `u`'s key or a `u`-signed capability; phase-retrieval hardening is mandatory
+   (measurement starvation, per-view nonce, per-session references). This is the hard stop
+   against "author a replayable someone-else."
+
+7. **The primary read is the fringe, not the score.** `InterferometricDiff` reads phase drift
+   (`Δφ`) between two twin states — a leading indicator that moves below scalar-score
+   sensitivity, with global tamper-evidence for free. `AscensionReading` (ADR-0013) is the
+   on-device, self-directed special case: a live diff of the holder's own twin over time. This
+   is the operation that earns the name "prophet."
+
+## Consequences
+
+- New conformant contracts: `TwinAttestation`, `MultiversealTwin`, `InterferometricDiff`, with
+  canonical examples and an invariant validator wired into `make validate`.
+- Reputation's "bind to the fabric" rule (ADR-0013) is sharpened to "bind-at-ingest against a
+  VRF reference," and `AscensionReading` is reframed as an interferometric read.
+- The substrate is **linear by design**; Sybil-resistance and nonlinear trust policy stay in a
+  separate layer that never leaks back into the holographic medium (open problem, tracked).
+- Rigor is tiered per the source spec: holographic⇄QEC isomorphism and VRF forgery-reduction
+  are theorems; the HRR/VSA substrate and coherence-length horizon are constructions/heuristics
+  to quantify before production trust.

examples/interferometric_diff.json

@@ -0,0 +1,32 @@
+{
+  "id": "urn:srcos:interferometric-diff:abc123:2026-08-01",
+  "type": "InterferometricDiff",
+  "specVersion": "2.0.0",
+  "capturedAt": "2026-08-01T00:00:00Z",
+  "twinRef": "urn:srcos:multiverseal-twin:abc123:v1",
+  "mode": "double-exposure",
+  "watcher": {
+    "contextRef": "vrf:rc:hiring-circle:sess-9",
+    "authorized": true
+  },
+  "fringe": {
+    "deltaPhase": [
+      0.01,
+      -0.004,
+      0.02,
+      0.0
+    ],
+    "magnitude": [
+      0.0,
+      0.0,
+      0.01,
+      0.0
+    ],
+    "subThreshold": true,
+    "tamperGlobalPerturbation": true,
+    "propagated": {
+      "horizon": "P30D",
+      "digest": "b3:forecast-abc"
+    }
+  }
+}

examples/multiverseal_twin.json

@@ -0,0 +1,35 @@
+{
+  "id": "urn:srcos:multiverseal-twin:abc123:v1",
+  "type": "MultiversealTwin",
+  "specVersion": "2.0.0",
+  "createdAt": "2026-08-01T00:00:00Z",
+  "coreRef": "urn:srcos:digital-soul:abc123:v1",
+  "space": {
+    "encoding": "hrr-vsa",
+    "dimension": 4096
+  },
+  "unlinkability": {
+    "epsilon": 0.03,
+    "isReversibilityBudget": true
+  },
+  "sharing": {
+    "n": 5,
+    "k": 1,
+    "d": 3
+  },
+  "mintAnchor": {
+    "scheme": "vrf",
+    "verifyKeyRef": "key:vk:abc123",
+    "proofOfSelfRef": "urn:srcos:proof-of-self:abc123"
+  },
+  "impersonationWall": {
+    "rule": "mint-only-under-subject-key-or-subject-signed-capability",
+    "phaseRetrievalHardened": true
+  },
+  "bundle": {
+    "digest": "b3:H-abc",
+    "attestationRefs": [
+      "urn:srcos:twin-attestation:abc123:math-commons:1"
+    ]
+  }
+}

examples/twin_attestation.json

@@ -0,0 +1,34 @@
+{
+  "id": "urn:srcos:twin-attestation:abc123:math-commons:1",
+  "type": "TwinAttestation",
+  "specVersion": "2.0.0",
+  "capturedAt": "2026-08-01T00:00:00Z",
+  "twinRef": "urn:srcos:multiverseal-twin:abc123:v1",
+  "contextRef": {
+    "contextId": "nh:math-commons",
+    "referenceId": "vrf:rc:math-commons:sess-1"
+  },
+  "boundVector": {
+    "encoding": "hrr-vsa",
+    "digest": "b3:bound-abc",
+    "dimension": 4096
+  },
+  "envelope": {
+    "src": "nh:math-commons",
+    "method": "peer-review",
+    "issuedAt": "2026-08-01T00:00:00Z",
+    "weight": 0.8,
+    "evidenceRefs": [
+      "urn:srcos:reasoning-receipt:work-1"
+    ],
+    "authorization": {
+      "declaredPurpose": "reputation-attestation",
+      "authorizationProof": "cap:signed:holder:abc123"
+    }
+  },
+  "grounding": {
+    "state": "coherent",
+    "coherenceLength": 180.0,
+    "distance": 12.0
+  }
+}

schemas/InterferometricDiff.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.srcos.ai/v2/InterferometricDiff.json",
+  "title": "InterferometricDiff",
+  "description": "The primary read over a MultiversealTwin: not 'return the score' but 'return the fringe' — the interference between two identity states. Reading phase (Delta-phi) detects change far below the magnitude at which a scalar score would move: it is the leading indicator, not the lagging one. This is the operation that earns 'SocioProphet' — the prophet reads fringes, not scores. It also yields tamper-evidence for free: because the encoding is holographic, a local unauthorized write perturbs the fringe globally, so tampering is detectable even without knowing what was altered. An AscensionReading (the holder's private reputation-state abstracted onto inner axes) is the on-device, self-directed special case of a live diff of the holder's own twin over time; this contract is the general, watch/replay-facing read.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["id", "type", "specVersion", "capturedAt", "twinRef", "mode", "watcher", "fringe"],
+  "properties": {
+    "id": { "type": "string", "pattern": "^urn:srcos:interferometric-diff:", "description": "Stable URN for this read." },
+    "type": { "const": "InterferometricDiff", "description": "Type discriminator; always 'InterferometricDiff'." },
+    "specVersion": { "type": "string", "description": "Semantic version of the contract." },
+    "capturedAt": { "type": "string", "format": "date-time", "description": "When the read was taken." },
+    "twinRef": { "type": "string", "pattern": "^urn:srcos:multiverseal-twin:", "description": "The twin being read." },
+    "mode": {
+      "type": "string",
+      "enum": ["live", "double-exposure", "time-averaged"],
+      "description": "live = Delta-phi(H_live, H_stored) real-time drift/tamper map; double-exposure = fringe(H(tau1), H(tau2)) the versioned changelog between two commits; time-averaged = spectrum of periodic behavior (fringe order = amplitude of each behavioral mode)."
+    },
+    "watcher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["contextRef", "authorized"],
+      "description": "Who is reading, and with which reference. Each relying party unbinds with THEIR r_c to see THEIR angle; un-authored angles unbind to noise (rainbow angle-bounding). A watchable persona must be authorized under the subject key or a subject-signed capability (impersonation wall).",
+      "properties": {
+        "contextRef": { "type": "string", "description": "The reference r_c the watcher unbinds with (their sanctioned angle)." },
+        "authorized": { "const": true, "description": "The watch is within a sanctioned reference subspace. Un-authored angles cannot be watched. Always true for a valid diff." }
+      }
+    },
+    "fringe": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["deltaPhase", "subThreshold", "tamperGlobalPerturbation"],
+      "description": "The fringe read itself. Phase is never collapsed to magnitude at ingest, so this read is available.",
+      "properties": {
+        "deltaPhase": { "type": "array", "items": { "type": "number" }, "description": "The interferometric fringe Delta-phi — where and how much state moved, per component." },
+        "magnitude": { "type": "array", "items": { "type": "number" }, "description": "Optional raw-score magnitudes (the lagging indicator), for reference only." },
+        "subThreshold": { "const": true, "description": "Asserts this read surfaces change below scalar-score movement (leading indicator). Always true — it is the point of the contract." },
+        "tamperGlobalPerturbation": { "const": true, "description": "A local unauthorized write shows up as a global fringe perturbation; tamper is detectable without knowing what changed. Always true." },
+        "propagated": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "Optional 'replay' = unbind then propagate forward to a prophet forecast of the reconstructed future state.",
+          "properties": {
+            "horizon": { "type": "string", "description": "Forecast horizon." },
+            "digest": { "type": "string", "description": "Digest of the forecast reconstruction." }
+          }
+        }
+      }
+    }
+  }
+}