feat(schema): digital-soul identity & reputation contract family

docs/adr/0013-digital-soul-identity-reputation.md

@@ -0,0 +1,72 @@
+# ADR-0013: Digital soul — identity and reputation planes
+
+Status: Accepted
+Date: 2026-06-29
+
+## Context
+
+The platform is adding a "digital soul" capability: a per-person identity model
+drawn from a syncretic correspondence map (yi-globe, sefirot, zodiac, enneagram,
+chakra, the twelve senses) plus a reputation model in the Neighbourhoods + Sacred
+Capital lineage (distributed, portable, privacy-preserving). The source is a visual
+map, not a written spec, so the contracts had to make the implicit architecture
+explicit and safe.
+
+Two distinct identity senses already exist in the estate and must not be conflated:
+
+- **Verified identity** — `ProofOfSelfToken` / Identity Is Prime: *am I a real,
+  deduplicated subject?* (proof and entity-resolution plane).
+- **Constitutional identity** — the digital soul: *who am I inwardly?* (given,
+  symbolic plane).
+
+## Decisions
+
+1. **Lock the spine.** The canonical inner object is the 64-gate yi-globe
+   (`IdentitySpine.canonicalSpine = "yi-globe-64gate"`, exactly 64 gates). Every
+   other tradition is a registered **one-way projection** (`oneWay: true`,
+   `sourceOfTruth: false`, `symbolic: true`) — presentation only, never writable,
+   never a measured or physically derived value. This honors the settled
+   matter/form premise without faked numeric derivations.
+
+2. **Two planes, opposite truth-makers.** Identity is *given* and asserted
+   (`DigitalSoulIdentity`, private, default disclosure none). Reputation is *earned*
+   and witnessed (`ReputationDimension`, `SacredCapitalLedger`,
+   `PortableReputationClaim`). Reputation's truth-maker is the existing
+   reasoning-evidence fabric — attestations reference `ReasoningReceipt` /
+   `ReasoningReplayPlan`; no parallel receipt type is introduced.
+
+3. **Privacy boundary by construction.** No reputation contract has any field able
+   to carry a given identity input (birthdate / faith / personality). The boundary
+   cannot be crossed by mistake; it is also machine-checked
+   (`tools/validate_digital_soul_examples.py`).
+
+4. **One on-device, one-way bridge.** `AscensionReading` reads the holder's own
+   works-receipts back onto private inner axes ("ascension"). It is normatively
+   on-device and `networkServiceProhibited`: no party but the holder may compute or
+   store inner state. Inner state reaches the outside world only via a deliberate,
+   holder-minted `PortableReputationClaim`. This forecloses a "spiritual credit
+   score".
+
+5. **Portable meaning, not a global score.** `ReputationDimension.latticeBinding`
+   expresses a community's subjective dimension in the shared spine vocabulary, so
+   capital is legible across neighbourhoods when bound and opaque when not.
+   `SacredCapitalLedger.noGlobalScore = true`; aggregation is only within a
+   (neighbourhood, dimension) or via a declared binding.
+
+6. **Cross-plane anchoring is optional and pseudonymous.**
+   `DigitalSoulIdentity.proofOfSelfRef` may anchor the constitutional soul to a
+   `ProofOfSelfToken` so reputation is sybil-resistant. The anchor is pseudonymous
+   and carries no given-identity data. Identity Is Prime remains the proof/evidence
+   layer (see `identity-is-prime-reference/docs/70_PLATFORM_IDENTITY_CONTRACT_ADAPTER`);
+   the digital soul is a separate constitutional layer that may reference it.
+
+## Consequences
+
+- Conformant new schemas under `schemas/` with canonical examples, a validator wired
+  into `make validate`, and a contract-additions note.
+- The full per-tradition correspondence tables (gate → sign/sefira/enneatype/…) are
+  deliberately **not** committed here: they are frontier-authored canon to be added
+  as separate, sourced projection data files and validated independently, rather than
+  fabricated inline.
+- Home is `sourceos-spec` (the canonical typed-contracts repo), not
+  `identity-is-prime-reference` (a mathematical reference implementation).

docs/contract-additions/digital-soul-identity-reputation.md

@@ -0,0 +1,104 @@
+# Contract additions — digital soul: identity & reputation
+
+Adds the two-layer "digital soul" contract family: a private, given **identity**
+layer and an earned, portable, privacy-preserving **reputation** layer
+(Neighbourhoods + Sacred Capital lineage). Reputation binds to the existing
+reasoning-evidence fabric — community attestations reference `ReasoningReceipt`
+records of works; no parallel receipt type is introduced.
+
+## Why (the three forks this closes)
+
+1. **Lock the spine.** `IdentitySpine` commits the canonical inner object to the
+   64-gate yi-globe. Every other tradition (zodiac, sefirot, enneagram, chakra,
+   the twelve senses) is a registered one-way **projection** — presentation only,
+   never a writable source of truth, never a measured/derived physical value.
+2. **The dimension-schema join.** `ReputationDimension.latticeBinding` expresses a
+   community's Sensemaker dimension in the spine's shared vocabulary (a gate or an
+   inner axis). This is what turns Sacred Capital from portable *data* into portable
+   *meaning*: bound dimensions are legible across neighbourhoods; unbound ones stay
+   opaque. There is never a global score.
+3. **The private reading.** `AscensionReading` is the single one-way bridge from
+   reputation to identity: it reads the holder's own works-receipts back through the
+   spine to move private gate-state along its inner axes ("ascension"). It is
+   normatively **on-device** and **network-prohibited** — no party but the holder may
+   compute or store the holder's inner state. This forecloses a "spiritual credit score".
+
+## Contracts
+
+| Schema | Layer | Purpose |
+|---|---|---|
+| `IdentitySpine` | identity (public-shared) | canonical 64-gate lattice + inner axes + one-way projections |
+| `DigitalSoulIdentity` | identity (agent-held-private) | per-subject given inputs + gate-state; default disclosure none |
+| `AscensionReading` | bridge (agent-held-private) | on-device works→inner-axes reading; replayable |
+| `ReputationDimension` | reputation | community-authored context-local dimension + optional spine binding |
+| `SacredCapitalLedger` | reputation (agent-held-portable) | evidence-backed capital per (neighbourhood, dimension); no global score |
+| `PortableReputationClaim` | reputation | holder-minted, signed, selective disclosure; optional witnessed ascension |
+
+## URN identifiers
+
+| Type | URN prefix |
+|---|---|
+| `IdentitySpine` | `urn:srcos:identity-spine:` |
+| `DigitalSoulIdentity` | `urn:srcos:digital-soul:` |
+| `AscensionReading` | `urn:srcos:ascension-reading:` |
+| `ReputationDimension` | `urn:srcos:reputation-dimension:` |
+| `SacredCapitalLedger` | `urn:srcos:sacred-capital:` |
+| `PortableReputationClaim` | `urn:srcos:reputation-claim:` |
+
+## Binding to the evidence fabric
+
+Reputation is evidence-backed by reuse, not by a new receipt type:
+
+- works/acts in the knowledge commons are recorded as `ReasoningReceipt`
+  (`urn:srcos:reasoning-receipt:`) on the existing v2 reasoning-evidence fabric;
+- `ReputationDimension.computedOver` scores those receipts/`ReasoningEvent` types;
+- `SacredCapitalLedger.entries[].evidenceRefs` and
+  `PortableReputationClaim.*.evidenceRefs` point at those receipts;
+- `AscensionReading.replayPlanRef` may bind to a `ReasoningReplayPlan` so a reading
+  is replayable like any reasoning run.
+
+## Cross-plane anchoring (verified vs constitutional identity)
+
+Two identity senses coexist and stay separate:
+
+- **Verified identity** — `ProofOfSelfToken` (`urn:srcos:proof-of-self:`) / Identity
+  Is Prime: a real, deduplicated, pseudonymous subject.
+- **Constitutional identity** — `DigitalSoulIdentity`: who the person is inwardly.
+
+`DigitalSoulIdentity.proofOfSelfRef` optionally anchors the soul to a
+`ProofOfSelfToken`, which makes reputation sybil-resistant (capital accrues to a
+verified subject) while leaking no given inputs — the anchor is pseudonymous.
+Identity Is Prime remains the proof/evidence layer (see
+`identity-is-prime-reference/docs/70_PLATFORM_IDENTITY_CONTRACT_ADAPTER`); the digital
+soul references it but does not absorb it.
+
+## Enforced invariants (machine-checked)
+
+`tools/validate_digital_soul_examples.py` (wired into `make validate` via
+`validate-digital-soul-examples`) checks, beyond JSON Schema:
+
+- **Privacy boundary** — no reputation document may contain any given-identity key
+  (`birthdate` / `faith` / `personality*` / `givenInputs`). The boundary holds by
+  construction: the reputation schemas provide no field able to carry them.
+- **Directionality** — `AscensionReading` must be on-device, `networkServiceProhibited`,
+  and declare works→inner-axes `allowed` / identity-inputs→reputation `forbidden`.
+- **Evidence backing** — capital entries and claimed dimensions must each reference
+  at least one works-receipt; no document asserts a global score.
+- **Spine integrity** — exactly 64 unique gates.
+
+## Validate
+
+```bash
+make validate-digital-soul-examples
+```
+
+## CHANGELOG entry (ready to merge into [Unreleased] → Added)
+
+- Digital-soul contract family — identity (`IdentitySpine`, `DigitalSoulIdentity`)
+  and reputation (`ReputationDimension`, `SacredCapitalLedger`,
+  `PortableReputationClaim`) plus the one-way on-device bridge (`AscensionReading`),
+  with canonical examples and a privacy-boundary + directionality validator
+  (`tools/validate_digital_soul_examples.py`). Reputation binds to the
+  reasoning-evidence fabric via `ReasoningReceipt`/`ReasoningReplayPlan`; the
+  canonical spine is locked to the 64-gate yi-globe with all other traditions as
+  one-way projections.

docs/security/semantic-evidence-chain.md

@@ -0,0 +1,102 @@
+# Semantic Evidence Chain (SEC)
+
+Status: draft
+Scope: a directed, weighted analytic view onto the reasoning-evidence fabric (ReasoningRun / ReasoningEvent / ReasoningReceipt) that feeds image-gen red-team and blue-team detection playbooks, containment, and forensic capture.
+
+## Scope discipline
+
+SEC formalizes only falsifiable graph and evidence semantics. The "ghost space" topology and geometry framing that motivated this contract is **metaphor only** and is explicitly out of scope. This spec defines no physical quantities, no E8 or Hopf projections, no tensor fields, and no derived geometry. Every number in an SEC is an observed or estimated analytic over fabric events, never a computed physics result.
+
+## Thesis
+
+A reasoning or detection process is a walk through states of awareness. Each state is grounded in a recorded reasoning-evidence event. The transitions between states carry evidence: how clearly the transition is supported, how much uncertainty it removed, and how much time it cost. Reading those transitions as a directed weighted graph lets us score how a system arrived at awareness, where it branched into competing hypotheses, where it looped, and where competing paths converged on a single verdict.
+
+SEC is that graph. It is a **derived view**, not a new evidence store. It binds every node and edge back to the canonical fabric so that any SEC claim is traceable to a `ReasoningEvent` and ultimately to a `ReasoningReceipt`.
+
+## Data model
+
+`SEC = (N, E, W)`
+
+- **N — nodes**: awareness/detection states. Each node binds to exactly one `ReasoningEvent` via `eventRef`. `kind` is `awareness` (cognitive/reasoning state) or `detection` (security observation state). A node never upgrades trust above its bound event.
+- **E — directed edges**: state transitions, tail `from` to head `to`. `transition` is one of `advance` (linear), `branch` (divergence, >1 outgoing), `loop` (entanglement, returns to an ancestor), `converge` (inbound at a node with >1 distinct-path predecessor). An edge MAY bind an `eventRef` evidencing the transition itself.
+- **W — weight vector** (per edge): `{ clarity, entropyReduction, temporalCost }`.
+  - `clarity` ∈ [0,1] — confidence the transition is well-evidenced, from bound-event trust level and corroboration count.
+  - `entropyReduction` ≥ 0 — reduction in candidate-state uncertainty, in bits, over the run's hypothesis set. Information-theoretic analytic, not physics.
+  - `temporalCost` ≥ 0 — elapsed cost in milliseconds, from bound-event timestamps.
+
+Full awareness is a **convergence path**: a directed path that reaches a converge node, scored by cumulative W.
+
+Schema: `schemas/SemanticEvidenceChain.json`. Example: `examples/semantic_evidence_chain.json`.
+
+## Binding to the reasoning-evidence fabric
+
+SEC is a conformant projection, not a parallel store:
+
+| SEC field | Fabric binding |
+|---|---|
+| `SEC.runRef` | `ReasoningRun.id` (`urn:srcos:reasoning-run:`) |
+| `SEC.receiptRef` | `ReasoningReceipt.id` (`urn:srcos:receipt:reasoning:`) |
+| `node.eventRef`, `edge.eventRef` | `ReasoningEvent.id` (`urn:srcos:reasoning-event:`) |
+| `node.trustLevel` | mirrors `ReasoningEvent.trustLevel` |
+| `SEC.traceLevel` | the most restricted bound `ReasoningEvent.traceLevel` |
+
+Rules:
+
+1. An SEC MUST NOT exist without a parent `ReasoningRun`.
+2. Every node and every weighted edge MUST be reconstructable from bound fabric events; SEC stores no evidence the fabric does not already hold.
+3. SEC honors the fabric's safe-trace boundary: it never requires raw private reasoning content, only event summaries, trust levels, trace levels, and timestamps.
+4. `SEC.analysis` is an advisory cache. It is always recomputable from `nodes` + `edges`; a consumer MUST be able to discard and recompute it.
+
+## Operations
+
+All operations are pure functions over `(N, E, W)`.
+
+1. **build-chain(run)** — project a `ReasoningRun` and its `ReasoningEvent` set into `(N, E)`. One node per event; one edge per recorded state transition. Compute each edge's W from bound-event trust level (clarity), hypothesis-set delta (entropyReduction), and timestamp delta (temporalCost). Set `traceLevel` to the most restricted bound event.
+2. **score-path(path)** — fold W along an ordered node path: `clarity` = product of edge clarities, `entropyReduction` = sum, `temporalCost` = sum. Returns a cumulative weight vector.
+3. **detect-divergence(SEC)** — return nodes with >1 outgoing `branch` edge. Each is a competing-hypothesis fork.
+4. **detect-loop(SEC)** — return cycles reachable via `loop` edges (entanglements): a state that re-enters an ancestor. Used to flag non-terminating reasoning and repeated detection re-triggering.
+5. **find-convergence(SEC)** — find converge nodes (>1 distinct-path predecessor); among inbound paths select the one maximizing `clarity × entropyReduction` while bounding `temporalCost`. The winning ordered path is the full-awareness path; its score-path output is `analysis.cumulativeWeight`.
+
+## Mapping to the Linux image-gen red/blue playbooks
+
+The image-gen pipeline (imagelab / image-builder) emits reasoning-evidence events during build, scan, and review. SEC turns those events into actionable security graphs across three lanes; `analysis.playbookLane` records the selected lane.
+
+- **Detection coverage (blue-team).** `detect-divergence` surfaces every competing explanation a detector entertained for a suspicious image artifact (e.g. an unexpected post-install layer mutating a shell startup file). Branches that never reach a converge node are **uncovered hypotheses** — coverage gaps to add detectors for. `find-convergence` yields the confirmed verdict path with its cumulative clarity.
+- **Containment.** A converge node carrying high cumulative `clarity` and a `detection` verdict is the trigger to quarantine. SEC pairs naturally with `SecurityVerdictState` (the converge node's verdict) and `QuarantineReceipt` (the containment action), both referenced by the bound run's evidence pointers.
+- **Forensic capture.** The full SEC, with its hash-linked binding to `ReasoningEvent` and the sealing `ReasoningReceipt.traceHash`, is the forensic artifact: a replayable, append-only account of how awareness of the threat was reached, including dead-end branches and any loops (re-triggered detections).
+- **Red-team.** Run SEC over an adversarial build. A short convergence path with low `entropyReduction` means the injected artifact was caught quickly with little investigation; a long path with many `branch` divergences and `loop` entanglements means the attack induced expensive, uncertain reasoning — a detector-quality signal to harden.
+
+### Threat-detection mapping
+
+- A `loop` cycle = repeated re-triggering or oscillating hypotheses → detector instability.
+- A `branch` with no downstream converge = an explanation the system could neither confirm nor rule out → blind spot.
+- A converge node with low cumulative `clarity` = a verdict reached on weak evidence → escalate to review, do not auto-contain.
+- Rising aggregate `temporalCost` to convergence across runs = detection latency regression.
+
+## Required audit events
+
+- `sec.chain.built`
+- `sec.path.scored`
+- `sec.divergence.detected`
+- `sec.loop.detected`
+- `sec.convergence.found`
+- `sec.verdict.bound` (SEC convergence linked to a `SecurityVerdictState`)
+- `sec.containment.triggered` (SEC convergence linked to a `QuarantineReceipt`)
+
+## Dangerous anti-patterns
+
+- Treating an SEC node as evidence in its own right rather than a view onto a `ReasoningEvent`.
+- Storing reasoning content in SEC that the fabric does not hold (parallel evidence store).
+- Upgrading a node's trust level above its bound event.
+- Auto-containing on a converge node without checking cumulative `clarity`.
+- Reading the chain's geometry as a physical or topological measurement.
+
+## Acceptance criteria
+
+1. Every SEC has a `runRef` to an existing `ReasoningRun`.
+2. Every node and every weighted edge binds to a fabric event reconstructable from canonical schemas.
+3. No SEC node has a trust level higher than its bound `ReasoningEvent`.
+4. `analysis` is recomputable from `nodes` + `edges` and is never the sole source of any claim.
+5. Every blue-team containment action triggered from an SEC references a `SecurityVerdictState` and a `QuarantineReceipt`.
+6. Every divergence with no downstream convergence is reported as a detection-coverage gap.
+7. No field in any SEC asserts a derived physical, topological, or geometric quantity.

examples/ascension_reading.json

@@ -0,0 +1,49 @@
+{
+  "id": "urn:srcos:ascension-reading:abc123:2026-06-29",
+  "type": "AscensionReading",
+  "specVersion": "2.0.0",
+  "capturedAt": "2026-06-29T00:00:00Z",
+  "subjectRef": "subject:pseudo:abc123",
+  "computedOn": "holder-device",
+  "networkServiceProhibited": true,
+  "inputs": {
+    "spineRef": "urn:srcos:identity-spine:yi-globe:v1",
+    "worksReceiptRefs": [
+      "urn:srcos:reasoning-receipt:work-1",
+      "urn:srcos:reasoning-receipt:work-2"
+    ]
+  },
+  "steps": [
+    {
+      "receiptRef": "urn:srcos:reasoning-receipt:work-1",
+      "gateRef": "gate_25",
+      "axisId": "shadowGift",
+      "fromValue": -1,
+      "toValue": 0,
+      "deterministic": true
+    },
+    {
+      "receiptRef": "urn:srcos:reasoning-receipt:work-2",
+      "gateRef": "gate_25",
+      "axisId": "shadowGift",
+      "fromValue": 0,
+      "toValue": 1,
+      "deterministic": true
+    }
+  ],
+  "replayPlanRef": "urn:srcos:reasoning-replay-plan:abc123-asc-1",
+  "result": {
+    "netAscension": [
+      {
+        "axisId": "shadowGift",
+        "delta": 2
+      }
+    ]
+  },
+  "directionality": {
+    "worksToInnerAxes": "allowed",
+    "identityInputsToReputation": "forbidden",
+    "innerToOutsideRequiresClaim": true
+  },
+  "privacyClass": "agent-held-private"
+}