feat(contracts): upstream the two orphan contracts (AutonomyAdmissionReceipt, QuorumProof)

.sourceos/manifest.json

@@ -8,7 +8,9 @@
     "SourceChannelEnvelope",
     "SourceGraphWrite",
     "AgentCapabilityLease",
-    "AuditEvent"
+    "AuditEvent",
+    "autonomy-admission-receipt.v0.2",
+    "quorum-proof.v1.1"
   ],
   "syncEngines": [],
   "sourceChannels": [],

examples/sourceos-repo-manifest.json

@@ -8,7 +8,9 @@
     "SourceChannelEnvelope",
     "SourceGraphWrite",
     "AgentCapabilityLease",
-    "AuditEvent"
+    "AuditEvent",
+    "autonomy-admission-receipt.v0.2",
+    "quorum-proof.v1.1"
   ],
   "syncEngines": [],
   "sourceChannels": [],

registry/contract-registry.json

@@ -1651,6 +1651,11 @@
       "path": "schemas/interpretability/artifact-source-lock.v0.json",
       "sha256": "sha256:918bed1a49fd561fcf49c8ae2560d9c1a314403cdc9626c22f08ce312c746798"
     },
+    "autonomy-admission-receipt.v0.2": {
+      "$id": "https://sourceos.dev/schemas/autonomy-admission-receipt.v0.2.json",
+      "path": "schemas/autonomy-admission-receipt.v0.2.json",
+      "sha256": "sha256:3e71216f01cc07a4c75d3ec30a4677a3ef4e4d647c609e0688bc9f87577e474a"
+    },
     "boot-release-set": {
       "$id": "https://socioprophet.org/schemas/control-plane/boot-release-set.schema.json",
       "path": "schemas/control-plane/boot-release-set.schema.json",
@@ -1706,6 +1711,11 @@
       "path": "schemas/interpretability/provider-binding.v0.json",
       "sha256": "sha256:8077c84ceb1990c3b68ad9d5b38cbbc97310f1706b00ed14006f9bb82548c928"
     },
+    "quorum-proof.v1.1": {
+      "$id": "https://sourceos.dev/schemas/quorum-proof.v1.1.json",
+      "path": "schemas/quorum-proof.v1.1.json",
+      "sha256": "sha256:043c27bc3b61e60208c4915f2dfc5cda9712c208dcb5b3bfe1570120641d82c4"
+    },
     "release-set": {
       "$id": "https://socioprophet.org/schemas/control-plane/release-set.schema.json",
       "path": "schemas/control-plane/release-set.schema.json",
@@ -1777,5 +1787,5 @@
       "sha256": "sha256:eadc32085987ffda647b090e3eba3726edd102a66d4736e239457bb74867004b"
     }
   },
-  "count": 355
+  "count": 357
 }

schemas/autonomy-admission-receipt.v0.2.json

@@ -0,0 +1,189 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sourceos.dev/schemas/autonomy-admission-receipt.v0.2.json",
+  "title": "Autonomy Admission Receipt v0.2",
+  "description": "Runtime evidence receipt emitted when prophet-platform admits, demotes, or denies a choir role operating at a requested AI-driven-development autonomy level. v0.2 binds the decision to the capability-membrane kernel (tools/capability_membrane.py): when an operation context is supplied, the canonical role-aware ladder decision is wrapped by the membrane's four fail-closed layers (surface class, capability radius + tension-member presence, membrane policy verdict, autonomy ladder) and collapsed into one sourceos ExecutionDecision. The membrane block records that decision and the sealHash of the sibling sealed AgentMachineReceipt, making the composed admission tamper-evident.",
+  "type": "object",
+  "required": [
+    "version",
+    "receipt_id",
+    "created_at",
+    "service_ref",
+    "role",
+    "requested_level",
+    "granted_level",
+    "decision",
+    "gate",
+    "evidence_required",
+    "trust_kernel_gate_order",
+    "subject_ref",
+    "membrane",
+    "hash",
+    "hash_algo"
+  ],
+  "properties": {
+    "version": {
+      "const": "0.2"
+    },
+    "receipt_id": {
+      "type": "string"
+    },
+    "created_at": {
+      "type": "string"
+    },
+    "service_ref": {
+      "type": "string"
+    },
+    "role": {
+      "type": "string",
+      "description": "Choir role requesting autonomy (e.g. conductor, coding, research)."
+    },
+    "requested_level": {
+      "type": "string",
+      "pattern": "^L[0-5]$"
+    },
+    "granted_level": {
+      "type": "string",
+      "pattern": "^L[0-5]$"
+    },
+    "role_ceiling": {
+      "type": "string",
+      "pattern": "^L[0-5]$"
+    },
+    "decision": {
+      "type": "string",
+      "enum": [
+        "admit",
+        "demote",
+        "deny"
+      ]
+    },
+    "gate": {
+      "type": "string",
+      "description": "Name of the gate that governs the granted level."
+    },
+    "evidence_required": {
+      "type": "string"
+    },
+    "evidence_refs": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "reason": {
+      "type": "string"
+    },
+    "trust_kernel_gate_order": {
+      "type": "array",
+      "minItems": 6,
+      "maxItems": 6,
+      "prefixItems": [
+        {
+          "const": "identity"
+        },
+        {
+          "const": "policy"
+        },
+        {
+          "const": "evidence"
+        },
+        {
+          "const": "attestation"
+        },
+        {
+          "const": "revocation"
+        },
+        {
+          "const": "audit"
+        }
+      ],
+      "items": false
+    },
+    "subject_ref": {
+      "type": "string"
+    },
+    "envelope_ref": {
+      "type": "string"
+    },
+    "policy_refs": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "membrane": {
+      "type": "object",
+      "description": "The capability-membrane resolution that governs this admission. execution_decision is the collapsed sourceos ExecutionDecision across all four fail-closed layers; a non-allow value forces decision=deny and granted_level=L0.",
+      "required": [
+        "execution_decision",
+        "verdict",
+        "capability_radius",
+        "missing_tension",
+        "membrane_decision",
+        "enforced",
+        "seal_hash"
+      ],
+      "properties": {
+        "execution_decision": {
+          "type": "string",
+          "enum": [
+            "allow",
+            "deny",
+            "ask",
+            "defer",
+            "rewrite"
+          ]
+        },
+        "verdict": {
+          "type": "string",
+          "enum": [
+            "allowed",
+            "denied",
+            "deferred",
+            "failed",
+            "observed"
+          ]
+        },
+        "capability_radius": {
+          "type": "string",
+          "pattern": "^R[0-5]$"
+        },
+        "missing_tension": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "membrane_decision": {
+          "type": "string",
+          "enum": [
+            "ALLOW",
+            "DENY",
+            "QUARANTINE",
+            "REDACT",
+            "REQUIRE_SIGNATURE"
+          ]
+        },
+        "enforced": {
+          "type": "boolean"
+        },
+        "seal_hash": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        },
+        "agent_machine_receipt_ref": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": false
+    },
+    "hash": {
+      "type": "string"
+    },
+    "hash_algo": {
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

schemas/quorum-proof.v1.1.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://sourceos.dev/schemas/quorum-proof.v1.1.json",
+  "title": "Validator Quorum Proof v1.1",
+  "type": "object",
+  "required": [
+    "rule",
+    "validators",
+    "signed_payload_hash",
+    "signatures"
+  ],
+  "properties": {
+    "rule": {
+      "type": "string",
+      "minLength": 1
+    },
+    "validators": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "signed_payload_hash": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "signatures": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": [
+          "kind",
+          "spiffe_id",
+          "sig"
+        ],
+        "properties": {
+          "kind": {
+            "type": "string",
+            "enum": [
+              "human"
+            ]
+          },
+          "spiffe_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "sig": {
+            "type": "string",
+            "minLength": 16
+          }
+        },
+        "additionalProperties": false
+      }
+    }
+  },
+  "additionalProperties": false
+}

tools/test_reconcile_contracts.py

@@ -12,12 +12,19 @@ def _write(d: pathlib.Path, name: str, obj: dict):
     (d / name).write_text(json.dumps(obj), encoding="utf-8")
 
 
-def test_registry_has_known_contracts_but_not_the_orphans():
+def test_registry_has_known_contracts():
     reg = rc.build_registry()
     assert reg["count"] > 100
     assert "BootProofRecord" in reg["contracts"]           # properly synced
-    assert "AutonomyAdmissionReceipt" not in reg["contracts"]  # the real orphan this session created
-    assert "QuorumProof" not in reg["contracts"]               # ditto
+
+
+def test_previously_orphaned_contracts_are_now_upstreamed():
+    # AutonomyAdmissionReceipt + QuorumProof were live in services but absent from the spec.
+    # This branch upstreams them under the canonical sourceos.dev kebab-versioned names, so they
+    # now have a home. (The PascalCase consumer copies still need re-vendoring — see CONTRACTS.md.)
+    reg = rc.build_registry()
+    assert "quorum-proof.v1.1" in reg["contracts"]
+    assert "autonomy-admission-receipt.v0.2" in reg["contracts"]
 
 
 def test_clean_vendored_copy_reconciles(tmp_path):