From 548834eebcac696bc63fcaa45255e61fa4ab94f0 Mon Sep 17 00:00:00 2001 From: Michael Heller <21163552+mdheller@users.noreply.github.com> Date: Tue, 4 Aug 2026 03:32:14 -0400 Subject: [PATCH] feat(contracts): upstream orphan contracts into spec (AutonomyAdmissionReceipt v0.2, QuorumProof v1.1) Reconciliation proved both were live in services but absent from sourceos-spec. Adds them under the a2a-governance convention (sourceos.dev kebab-versioned, like policy-decision.v1.1): schemas/quorum-proof.v1.1.json + schemas/autonomy-admission-receipt.v0.2.json. Registry 355->357; both added to ownedSchemas; valid draft-2020-12; reconcile tests updated (7 pass). Follow-up: consumers re-vendor from these canonical copies. --- .sourceos/manifest.json | 4 +- examples/sourceos-repo-manifest.json | 4 +- registry/contract-registry.json | 12 +- schemas/autonomy-admission-receipt.v0.2.json | 189 +++++++++++++++++++ schemas/quorum-proof.v1.1.json | 60 ++++++ tools/test_reconcile_contracts.py | 13 +- 6 files changed, 276 insertions(+), 6 deletions(-) create mode 100644 schemas/autonomy-admission-receipt.v0.2.json create mode 100644 schemas/quorum-proof.v1.1.json diff --git a/.sourceos/manifest.json b/.sourceos/manifest.json index e198920..9761bd2 100644 --- a/.sourceos/manifest.json +++ b/.sourceos/manifest.json @@ -8,7 +8,9 @@ "SourceChannelEnvelope", "SourceGraphWrite", "AgentCapabilityLease", - "AuditEvent" + "AuditEvent", + "autonomy-admission-receipt.v0.2", + "quorum-proof.v1.1" ], "syncEngines": [], "sourceChannels": [], diff --git a/examples/sourceos-repo-manifest.json b/examples/sourceos-repo-manifest.json index e198920..9761bd2 100644 --- a/examples/sourceos-repo-manifest.json +++ b/examples/sourceos-repo-manifest.json @@ -8,7 +8,9 @@ "SourceChannelEnvelope", "SourceGraphWrite", "AgentCapabilityLease", - "AuditEvent" + "AuditEvent", + "autonomy-admission-receipt.v0.2", + "quorum-proof.v1.1" ], "syncEngines": [], "sourceChannels": [], diff --git a/registry/contract-registry.json b/registry/contract-registry.json index 04a2021..848265c 100644 --- a/registry/contract-registry.json +++ b/registry/contract-registry.json @@ -1651,6 +1651,11 @@ "path": "schemas/interpretability/artifact-source-lock.v0.json", "sha256": "sha256:918bed1a49fd561fcf49c8ae2560d9c1a314403cdc9626c22f08ce312c746798" }, + "autonomy-admission-receipt.v0.2": { + "$id": "https://sourceos.dev/schemas/autonomy-admission-receipt.v0.2.json", + "path": "schemas/autonomy-admission-receipt.v0.2.json", + "sha256": "sha256:3e71216f01cc07a4c75d3ec30a4677a3ef4e4d647c609e0688bc9f87577e474a" + }, "boot-release-set": { "$id": "https://socioprophet.org/schemas/control-plane/boot-release-set.schema.json", "path": "schemas/control-plane/boot-release-set.schema.json", @@ -1706,6 +1711,11 @@ "path": "schemas/interpretability/provider-binding.v0.json", "sha256": "sha256:8077c84ceb1990c3b68ad9d5b38cbbc97310f1706b00ed14006f9bb82548c928" }, + "quorum-proof.v1.1": { + "$id": "https://sourceos.dev/schemas/quorum-proof.v1.1.json", + "path": "schemas/quorum-proof.v1.1.json", + "sha256": "sha256:043c27bc3b61e60208c4915f2dfc5cda9712c208dcb5b3bfe1570120641d82c4" + }, "release-set": { "$id": "https://socioprophet.org/schemas/control-plane/release-set.schema.json", "path": "schemas/control-plane/release-set.schema.json", @@ -1777,5 +1787,5 @@ "sha256": "sha256:eadc32085987ffda647b090e3eba3726edd102a66d4736e239457bb74867004b" } }, - "count": 355 + "count": 357 } diff --git a/schemas/autonomy-admission-receipt.v0.2.json b/schemas/autonomy-admission-receipt.v0.2.json new file mode 100644 index 0000000..e19f99a --- /dev/null +++ b/schemas/autonomy-admission-receipt.v0.2.json @@ -0,0 +1,189 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://sourceos.dev/schemas/autonomy-admission-receipt.v0.2.json", + "title": "Autonomy Admission Receipt v0.2", + "description": "Runtime evidence receipt emitted when prophet-platform admits, demotes, or denies a choir role operating at a requested AI-driven-development autonomy level. v0.2 binds the decision to the capability-membrane kernel (tools/capability_membrane.py): when an operation context is supplied, the canonical role-aware ladder decision is wrapped by the membrane's four fail-closed layers (surface class, capability radius + tension-member presence, membrane policy verdict, autonomy ladder) and collapsed into one sourceos ExecutionDecision. The membrane block records that decision and the sealHash of the sibling sealed AgentMachineReceipt, making the composed admission tamper-evident.", + "type": "object", + "required": [ + "version", + "receipt_id", + "created_at", + "service_ref", + "role", + "requested_level", + "granted_level", + "decision", + "gate", + "evidence_required", + "trust_kernel_gate_order", + "subject_ref", + "membrane", + "hash", + "hash_algo" + ], + "properties": { + "version": { + "const": "0.2" + }, + "receipt_id": { + "type": "string" + }, + "created_at": { + "type": "string" + }, + "service_ref": { + "type": "string" + }, + "role": { + "type": "string", + "description": "Choir role requesting autonomy (e.g. conductor, coding, research)." + }, + "requested_level": { + "type": "string", + "pattern": "^L[0-5]$" + }, + "granted_level": { + "type": "string", + "pattern": "^L[0-5]$" + }, + "role_ceiling": { + "type": "string", + "pattern": "^L[0-5]$" + }, + "decision": { + "type": "string", + "enum": [ + "admit", + "demote", + "deny" + ] + }, + "gate": { + "type": "string", + "description": "Name of the gate that governs the granted level." + }, + "evidence_required": { + "type": "string" + }, + "evidence_refs": { + "type": "array", + "items": { + "type": "string" + } + }, + "reason": { + "type": "string" + }, + "trust_kernel_gate_order": { + "type": "array", + "minItems": 6, + "maxItems": 6, + "prefixItems": [ + { + "const": "identity" + }, + { + "const": "policy" + }, + { + "const": "evidence" + }, + { + "const": "attestation" + }, + { + "const": "revocation" + }, + { + "const": "audit" + } + ], + "items": false + }, + "subject_ref": { + "type": "string" + }, + "envelope_ref": { + "type": "string" + }, + "policy_refs": { + "type": "array", + "items": { + "type": "string" + } + }, + "membrane": { + "type": "object", + "description": "The capability-membrane resolution that governs this admission. execution_decision is the collapsed sourceos ExecutionDecision across all four fail-closed layers; a non-allow value forces decision=deny and granted_level=L0.", + "required": [ + "execution_decision", + "verdict", + "capability_radius", + "missing_tension", + "membrane_decision", + "enforced", + "seal_hash" + ], + "properties": { + "execution_decision": { + "type": "string", + "enum": [ + "allow", + "deny", + "ask", + "defer", + "rewrite" + ] + }, + "verdict": { + "type": "string", + "enum": [ + "allowed", + "denied", + "deferred", + "failed", + "observed" + ] + }, + "capability_radius": { + "type": "string", + "pattern": "^R[0-5]$" + }, + "missing_tension": { + "type": "array", + "items": { + "type": "string" + } + }, + "membrane_decision": { + "type": "string", + "enum": [ + "ALLOW", + "DENY", + "QUARANTINE", + "REDACT", + "REQUIRE_SIGNATURE" + ] + }, + "enforced": { + "type": "boolean" + }, + "seal_hash": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "agent_machine_receipt_ref": { + "type": "string" + } + }, + "additionalProperties": false + }, + "hash": { + "type": "string" + }, + "hash_algo": { + "type": "string" + } + }, + "additionalProperties": false +} diff --git a/schemas/quorum-proof.v1.1.json b/schemas/quorum-proof.v1.1.json new file mode 100644 index 0000000..bbb094d --- /dev/null +++ b/schemas/quorum-proof.v1.1.json @@ -0,0 +1,60 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://sourceos.dev/schemas/quorum-proof.v1.1.json", + "title": "Validator Quorum Proof v1.1", + "type": "object", + "required": [ + "rule", + "validators", + "signed_payload_hash", + "signatures" + ], + "properties": { + "rule": { + "type": "string", + "minLength": 1 + }, + "validators": { + "type": "array", + "minItems": 1, + "items": { + "type": "string", + "minLength": 1 + } + }, + "signed_payload_hash": { + "type": "string", + "pattern": "^sha256:[a-f0-9]{64}$" + }, + "signatures": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "required": [ + "kind", + "spiffe_id", + "sig" + ], + "properties": { + "kind": { + "type": "string", + "enum": [ + "human" + ] + }, + "spiffe_id": { + "type": "string", + "minLength": 1 + }, + "sig": { + "type": "string", + "minLength": 16 + } + }, + "additionalProperties": false + } + } + }, + "additionalProperties": false +} diff --git a/tools/test_reconcile_contracts.py b/tools/test_reconcile_contracts.py index 0a67d07..20b5ce2 100644 --- a/tools/test_reconcile_contracts.py +++ b/tools/test_reconcile_contracts.py @@ -12,12 +12,19 @@ def _write(d: pathlib.Path, name: str, obj: dict): (d / name).write_text(json.dumps(obj), encoding="utf-8") -def test_registry_has_known_contracts_but_not_the_orphans(): +def test_registry_has_known_contracts(): reg = rc.build_registry() assert reg["count"] > 100 assert "BootProofRecord" in reg["contracts"] # properly synced - assert "AutonomyAdmissionReceipt" not in reg["contracts"] # the real orphan this session created - assert "QuorumProof" not in reg["contracts"] # ditto + + +def test_previously_orphaned_contracts_are_now_upstreamed(): + # AutonomyAdmissionReceipt + QuorumProof were live in services but absent from the spec. + # This branch upstreams them under the canonical sourceos.dev kebab-versioned names, so they + # now have a home. (The PascalCase consumer copies still need re-vendoring — see CONTRACTS.md.) + reg = rc.build_registry() + assert "quorum-proof.v1.1" in reg["contracts"] + assert "autonomy-admission-receipt.v0.2" in reg["contracts"] def test_clean_vendored_copy_reconciles(tmp_path):