spec: consent-governance family — opt-in, explained, revocable, self-sovereign

CHANGELOG.md

@@ -9,6 +9,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Thi
 ## [Unreleased]
 
 ### Added
+- **Consent-governance family — opt-in, explained, revocable, self-sovereign.** `ConsentSurfaceRegistry` (the governed inventory of every telemetry surface a deployment *could* observe: category, sensitivity, `pii`, `projectionMode` reusing the semantic-serdes SEM243 vocabulary, optional residency, a required purpose, and the consent state — default `denied`) and `CapabilityConsentPolicy` (the consent standard for ACTIVE capabilities: camera, microphone, screen capture, computer control, remote compute, file writes, network egress, acting as the user). Both are **classification-and-consent contracts with no capture mechanics** — no collector, no transport, no payload shape, no invocation path — so a surface can be fully registered and permanently unobserved, which is how a sensitive surface is meant to appear here: as a default-deny row that makes the *non*-collection auditable rather than merely absent. The inversion is structural: `deploymentScope` is `const: "self-sovereign"` and `collectorPrincipal` must equal `subjectPrincipal`, so a document describing one party collecting from another is **not expressible**. The deliberate asymmetry — passive telemetry ships `standing-persistent`, active capabilities ship `per-use` (only `microphone` at `standing-session`, since a per-utterance prompt makes continuous listening unusable) — is pinned as a canonical matrix in the gate, not merely in the example. New `validate-consent-plane-examples` target enforces five invariants: **(a)** self-sovereign, collector ≡ subject; **(b)** default-deny (the schema must *declare* the `denied` default, a granted/revoked surface must carry the evidence of that transition so a state cannot be edited into existence, and every per-use capability ships `disabled`); **(c)** the canonical matrix, including that a canonical capability may not be *absent* (absence is not a safe default, it is ungoverned) and that `effectiveMode` may diverge from `defaultStandard` only under an attributed `userOverride`; **(d)** one-shot — a per-use capability may never carry a persistable/standing grant, *not even behind `userOverride`* (the subject may tighten, nothing may loosen), closing the hole through which one "allow" becomes a permanent permission; **(e)** a non-trivial explanation on every governed thing, because consent to something unexplained is not consent. All 16 negative controls verified biting, built from synthetic in-memory documents that never touch `examples/`. Example set grants **benign surfaces only** (`model:tokens_used`, `policy:gate_verdict`); sensitive and personal surfaces appear as off, classification-only rows. See `schemas/consent-plane.README.md`.
 - Image-trust contracts — the Assay's measured-not-asserted discipline applied to images, for both OS and agents: `ImageTrustReport` (per-dimension trust checks — reproducibility, attestation_verify, sbom_completeness, signature_verify, measured_boot, provenance_depth — each carrying a `Measurement` via `$ref`, plus a render-time `projectedTrust` ok/sad/bad verdict; unifies OS and agent images through `subjectKind`) and `AgentImage` (agent runtime-artifact identity + provenance parallel to `OSImage`, distinct from process-level `AgentPassport`). `ImagePromotionGate` now requires a `trustReportRef` when `decision: approved` (non-breaking if/then), and the new `validate-image-trust-examples` target enforces projection soundness plus the cross-document rule that an approval must reference a report projecting `ok` — closing, for images, the self-assertable-approval gap the Assay hardening closed for verifiers. Reuses `Measurement`'s gate-eligibility invariants for free via `$ref` (a declared/assumed check cannot reach `ok`). All invariants verified biting. See `schemas/image-trust.README.md`.
 - Assay fleet-tier contracts (cloud-mesh): `AssayRollup` (fleet/cohort aggregate of `ReasoningAssay` verdicts over a window — ok/sad/bad distribution, calibration-drift view of which `AssayStandard` versions are live across the fleet, unassayed-reason breakdown) and `AssayStandardRollout` (canary→widen/halt promotion of a new `AssayStandard` version across cohorts, gated on an observed `AssayRollup`; rides the release-bundle + lifecycle machinery). New `validate-assay-fleet-examples` target enforces aggregation/rollout soundness (distribution sums, drift-flag agreement, rolloutPct vs node share, decision/phase consistency, and no-promotion-by-hope), all verified biting. This is the boundary between prophet-mesh single-user-local (node self-view, no fleet dashboards, structural) and cloud-mesh (rollup + rollout + dashboards). See `schemas/assay-fleet.README.md`.
 - **Six-layer fingerprint stack (SP-FPRINT-STACK-001)** — classification that can distinguish "I don't know" from "my evidence contradicts itself". `ClassificationStance` over FOUR (POS/NEG/**ZERO**/**INADMISSIBLE**) with the support-vs-plausibility reading tag in the TYPE (DR-5); `FingerprintLayerEvidence` with per-layer discriminated witnesses for L1 OntoDT / L2 OntoDQ / L3 glossary / L4 operational semantics / L5 table topic / L6 key graph; `ColumnFingerprint` (pool -> guard -> quantize, in that order); `ColumnDriftObservation` (L5-D1/L5-D2, blocking); `EstateAdmissibilityReport` (the phase-0 deliverable — which layers this estate can trust, shipped BEFORE any classification); `ClassificationEnforcementPolicy` (**DR-4 settled**: POS/NEG not knobs, INADMISSIBLE never fail-open, ZERO an attested per-resource-class knob unavailable at confidential/restricted). Recompute-don't-trust throughout: stance from evidence, pooling from admissible layers, `n_eff` from the covariance spectrum (participation ratio — Herfindahl demoted to a cheap precheck, since two perfectly correlated layers give H=0.5 while supplying one layer's worth of information), drift from the measured distance. Axiom **X1** (parthood and subtyping disjoint; closure traverses subtyping only; open-world counts are intervals with INADMISSIBLE reported separately) enforced as a CI invariant. `DataClass.classifier.kind` const **retired**: TensorFlow Lattice was archived by its owner in April 2026, so the pin now enumerates the structurally-monotone constructions with the dead name deprecated-but-accepted, and gains a `fingerprintStack` binding. 81 checks + 9 schema negative vectors + **25 gates proven to bite** by mutation harness + an M5 property test verified against a deliberately non-monotone aggregator (the #265 vacuous-constraint defect, guarded against structurally this time).

Makefile

@@ -1,6 +1,6 @@
-.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples validate-data-class-examples validate-table-keys validate-dag-loop validate-vocab-currency-loop vocab-currency-dogfood validate-glossary-promotion validate-agreement validate-stopword-analysis stopword-analysis-live validate-kgram-differential validate-learned-dictionary train-dataclass-classifiers validate-assay-fleet-examples validate-image-trust-examples validate-schema-references validate-fingerprint-stack
+.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples validate-data-class-examples validate-table-keys validate-dag-loop validate-vocab-currency-loop vocab-currency-dogfood validate-glossary-promotion validate-agreement validate-stopword-analysis stopword-analysis-live validate-kgram-differential validate-learned-dictionary train-dataclass-classifiers validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack
 
-validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers validate-multiverseal-twin-examples validate-assay-fleet-examples validate-image-trust-examples validate-schema-references validate-fingerprint-stack
+validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers validate-multiverseal-twin-examples validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack
 	@echo "OK: validate"
 
 validate-assay-fleet-examples:
@@ -11,6 +11,16 @@ validate-image-trust-examples:
 	python3 -m pip install --user jsonschema referencing >/dev/null
 	python3 tools/validate_image_trust_examples.py
 
+# Consent-governance family: ConsentSurfaceRegistry + CapabilityConsentPolicy. Schema
+# conformance plus the five invariants that make an opt-in claim mean something —
+# self-sovereign (collector == subject), default-deny, the canonical capability default
+# matrix, per-use one-shot, and a non-trivial explanation on every governed thing. Each
+# invariant is pinned by a synthetic negative control that runs every time; if a control
+# fails to trip the gate certifies nothing.
+validate-consent-plane-examples:
+	python3 -m pip install --user jsonschema >/dev/null
+	python3 tools/validate_consent_plane_examples.py
+
 # General referential-integrity gate: every schema is a valid JSON Schema and every
 # $ref resolves. The per-example validators only exercise schemas that ship examples;
 # this catches a dangling/renamed/typo'd $ref in ANY of the 300+ schemas — a

examples/capability_consent_policy.json

@@ -0,0 +1,94 @@
+{
+  "id": "urn:srcos:consent-policy:workstation-default",
+  "type": "CapabilityConsentPolicy",
+  "specVersion": "2.0.0",
+  "deploymentScope": "self-sovereign",
+  "subjectPrincipal": "urn:srcos:principal:local-operator",
+  "capabilities": [
+    {
+      "capabilityId": "camera",
+      "riskClass": "sensor-capture",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Takes a picture through your camera. Asks every single time, and the answer is never remembered.",
+      "residency": { "ephemeral": true, "onDeviceOnly": true },
+      "oneShot": true
+    },
+    {
+      "capabilityId": "microphone",
+      "riskClass": "sensor-capture",
+      "defaultStandard": "standing-session",
+      "effectiveMode": "off",
+      "userOverride": true,
+      "defaultState": "disabled",
+      "explanation": "Listens through your microphone for as long as the session lasts, then stops.",
+      "residency": { "ephemeral": true, "onDeviceOnly": true },
+      "oneShot": false
+    },
+    {
+      "capabilityId": "screen_capture",
+      "riskClass": "sensor-capture",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Takes a picture of what is on your screen right now, including anything else open.",
+      "residency": { "ephemeral": true, "onDeviceOnly": true },
+      "oneShot": true
+    },
+    {
+      "capabilityId": "control_my_computer",
+      "riskClass": "device-control",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Moves your pointer and types on your behalf, as if you were doing it yourself.",
+      "oneShot": true
+    },
+    {
+      "capabilityId": "skycomputer",
+      "riskClass": "remote-compute",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Sends this piece of work to a remote machine to run, so it leaves your device.",
+      "residency": { "ephemeral": true, "onDeviceOnly": false },
+      "oneShot": true
+    },
+    {
+      "capabilityId": "file_write",
+      "riskClass": "data-write",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Creates or changes files on your disk. Asks before each write, naming the path.",
+      "residency": { "ephemeral": false, "onDeviceOnly": true },
+      "oneShot": true
+    },
+    {
+      "capabilityId": "network_egress",
+      "riskClass": "data-egress",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Sends data out to the network, naming the destination before anything leaves.",
+      "oneShot": true
+    },
+    {
+      "capabilityId": "send_on_behalf",
+      "riskClass": "act-as-user",
+      "defaultStandard": "per-use",
+      "effectiveMode": "per-use",
+      "userOverride": false,
+      "defaultState": "disabled",
+      "explanation": "Sends a message that will appear to come from you, shown to you in full beforehand.",
+      "oneShot": true
+    }
+  ]
+}