{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "registry": "https://schema.kya-os.org",
  "protocolVersion": "v1",
  "schemas": [
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/anchor-receipt/v1.0.0",
      "title": "KYA-OS Supporting Checkpoint Anchor Receipt v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/anchor-receipt/v1.0.0",
      "path": "/v1/protocol/audit/anchor-receipt/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-component/v1.0.0",
      "title": "KYA-OS Audit Replay Bundle Component v1",
      "description": "One included or explicitly omitted replay-bundle inventory component, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/bundle-component/v1.0.0",
      "path": "/v1/protocol/audit/bundle-component/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-consistency-proof/v1.0.0",
      "title": "KYA-OS Audit Bundle Consistency Proof v1",
      "description": "Ledger-bound RFC 9162 consistency proof used as a replay-bundle component.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/bundle-consistency-proof/v1.0.0",
      "path": "/v1/protocol/audit/bundle-consistency-proof/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-inclusion-proof/v1.0.0",
      "title": "KYA-OS Audit Bundle Inclusion Proof v1",
      "description": "Ledger-bound RFC 9162 inclusion proof used as a replay-bundle component.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/bundle-inclusion-proof/v1.0.0",
      "path": "/v1/protocol/audit/bundle-inclusion-proof/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/bundle-manifest/v1.0.0",
      "title": "KYA-OS Audit Bundle Manifest Core v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/bundle-manifest/v1.0.0",
      "path": "/v1/protocol/audit/bundle-manifest/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/checkpoint/v1.0.0",
      "title": "KYA-OS Audit Checkpoint Core v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/checkpoint/v1.0.0",
      "path": "/v1/protocol/audit/checkpoint/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/consistency-proof/v1.0.0",
      "title": "KYA-OS RFC 9162 Consistency Proof v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/consistency-proof/v1.0.0",
      "path": "/v1/protocol/audit/consistency-proof/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/entry/v1.0.0",
      "title": "KYA-OS Audit Entry Core v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/entry/v1.0.0",
      "path": "/v1/protocol/audit/entry/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/event/v1.0.0",
      "title": "KYA-OS Audit Producer Event v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/event/v1.0.0",
      "path": "/v1/protocol/audit/event/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/inclusion-proof/v1.0.0",
      "title": "KYA-OS RFC 9162 Inclusion Proof v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/inclusion-proof/v1.0.0",
      "path": "/v1/protocol/audit/inclusion-proof/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/ingest-response/v1.0.0",
      "title": "KYA-OS Audit Ingest Response v1",
      "description": "A recorder's committed signed entry and receipt, with the verification outcomes established before acknowledgement.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/ingest-response/v1.0.0",
      "path": "/v1/protocol/audit/ingest-response/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/observation/v1.0.0",
      "title": "KYA-OS Independent Checkpoint Observation Receipt v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/observation/v1.0.0",
      "path": "/v1/protocol/audit/observation/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/receipt/v1.0.0",
      "title": "KYA-OS Audit Recorder Receipt Core v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/receipt/v1.0.0",
      "path": "/v1/protocol/audit/receipt/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/record/v1.0.0",
      "title": "KYA-OS Audit Record",
      "description": "Versioned, portable audit log record summarizing a single verified KYA-OS tool call. Provides a standard, cross-implementation format for compliance and non-repudiation trails (audit.v1).",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/record/v1.0.0",
      "path": "/v1/protocol/audit/record/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/replay-bundle/v1.0.0",
      "title": "KYA-OS Audit Replay Bundle v1",
      "description": "Portable signed-inventory audit replay bundle, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/replay-bundle/v1.0.0",
      "path": "/v1/protocol/audit/replay-bundle/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/signed-bundle-manifest/v1.0.0",
      "title": "KYA-OS Signed Audit Bundle Manifest v1",
      "description": "Replay-bundle manifest core, its digest, and exporter compact JWS, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/signed-bundle-manifest/v1.0.0",
      "path": "/v1/protocol/audit/signed-bundle-manifest/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/signed-checkpoint/v1.0.0",
      "title": "KYA-OS Signed Audit Checkpoint v1",
      "description": "RFC 9162 checkpoint core, its digest, and detached compact JWS, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/signed-checkpoint/v1.0.0",
      "path": "/v1/protocol/audit/signed-checkpoint/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/signed-entry/v1.0.0",
      "title": "KYA-OS Signed Audit Entry v1",
      "description": "Complete recorder-assigned audit entry envelope, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/signed-entry/v1.0.0",
      "path": "/v1/protocol/audit/signed-entry/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/signed-receipt/v1.0.0",
      "title": "KYA-OS Signed Audit Recorder Receipt v1",
      "description": "Recorder receipt core and its detached compact JWS, matching the @kya-os/mcp v1.11.0 runtime contract.",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/signed-receipt/v1.0.0",
      "path": "/v1/protocol/audit/signed-receipt/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-policy/v1.0.0",
      "title": "KYA-OS Out-of-Band Audit Verification Policy v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/verification-policy/v1.0.0",
      "path": "/v1/protocol/audit/verification-policy/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/audit/verification-report/v1.0.0",
      "title": "KYA-OS Audit Verification Report v1",
      "description": "",
      "category": "audit",
      "version": "1.0.0",
      "canonical": "/v1/protocol/audit/verification-report/v1.0.0",
      "path": "/v1/protocol/audit/verification-report/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/authorization/needs-authorization/v1.0.0",
      "title": "KYA-OS Needs-Authorization Error",
      "description": "Error returned when a tool call requires user authorization. The response is itself signed (detached JWS in _meta) so the client can verify the authorizationUrl before trusting it; the client resumes the flow with resumeToken after the user grants authority (SPEC §9.2).",
      "category": "authorization",
      "version": "1.0.0",
      "canonical": "/v1/protocol/authorization/needs-authorization/v1.0.0",
      "path": "/v1/protocol/authorization/needs-authorization/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/delegation/credential/v1.0.0",
      "title": "KYA-OS Delegation Credential",
      "description": "W3C Verifiable Credential containing a KYA-OS delegation with CRISP constraints.",
      "category": "delegation",
      "version": "1.0.0",
      "canonical": "/v1/protocol/delegation/credential/v1.0.0",
      "path": "/v1/protocol/delegation/credential/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/delegation/credential/v1.1.0",
      "title": "KYA-OS Delegation Credential (W3C VC 2.0 + ZCAP-LD profile)",
      "description": "A W3C Verifiable Credential 2.0 whose credentialSubject IS an attenuated ZCAP-LD capability. One credential per delegation HOP; a chain runs root -> ... -> leaf. CRISP attenuation is enforced on resolve, fail-closed: a child's allowedAction MUST be a subset of its parent's; caveats are monotone-narrowing (child MaxAmount <= parent, child ValidUntil <= parent, and a parent caveat may never be silently dropped); the parent's delegate (invoker/controller) MUST be the child's issuer; child.parentCapability MUST reference the parent capability id; the invocationTarget is constant along the chain; depth <= 10; and the ROOT's parentCapability equals its invocationTarget with issuer/invocationTarget = the resource owner / resource. responsibleParty is recomputed as the issuer of the root credential; the leaf invoker is asserted equal to the per-request proof key. This schema is a re-profile of the prior draft, not a new artifact.",
      "category": "delegation",
      "version": "1.1.0",
      "canonical": "/v1/protocol/delegation/credential/v1.1.0",
      "path": "/v1/protocol/delegation/credential/v1.1.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/delegation/status-list/v1.0.0",
      "title": "KYA-OS StatusList2021 Credential",
      "description": "W3C StatusList2021 Verifiable Credential used to publish delegation revocation or suspension state. The interoperable wire format for revocation when delegator and verifier are operationally decoupled (KYA-OS L3).",
      "category": "delegation",
      "version": "1.0.0",
      "canonical": "/v1/protocol/delegation/status-list/v1.0.0",
      "path": "/v1/protocol/delegation/status-list/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/handshake/request/v1.0.0",
      "title": "KYA-OS Handshake Request",
      "description": "Client-initiated handshake request to establish a KYA-OS session with nonce-based replay protection.",
      "category": "handshake",
      "version": "1.0.0",
      "canonical": "/v1/protocol/handshake/request/v1.0.0",
      "path": "/v1/protocol/handshake/request/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/handshake/response/v1.0.0",
      "title": "KYA-OS Handshake Response",
      "description": "Server response to a successful handshake request, establishing session context.",
      "category": "handshake",
      "version": "1.0.0",
      "canonical": "/v1/protocol/handshake/response/v1.0.0",
      "path": "/v1/protocol/handshake/response/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/identity/card/v1.1.0",
      "title": "KYA-OS Entity Card",
      "description": "A typed, DID-anchored identity card for a KYA-OS entity (mcp | agent | client | verifier | human). One canonical card is anchored by a `KyaOsEntityCard` service entry on the entity's did:web DID document and projected onto the four discovery surfaces the ecosystem already indexes (MCP server.json / catalog.json `_meta['org.kya-os/card']`, A2A AgentExtension, NANDA AgentFacts, and the MCP catalog entry). The card asserts identity + type + declared capabilities; everything trust-bearing (accountability, attested capabilities, KYC/KYB) is proven by referenced credentials, not self-claimed (claim-minimalism). The sender-constrained holder-of-key proof (`org.kya-os/proof.v1`) is NEVER on the static card — it rides per-request `_meta` on top (see detached-proof); `proofProfile` only names the profile a verifier should expect.",
      "category": "identity",
      "version": "1.1.0",
      "canonical": "/v1/protocol/identity/card/v1.1.0",
      "path": "/v1/protocol/identity/card/v1.1.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/mcp-extension/settings/v1.0.0",
      "title": "KYA-OS MCP Extension Settings",
      "description": "The settings object declared under capabilities.extensions[\"org.kya-os/decentralized-authority\"] in MCP ClientCapabilities and ServerCapabilities (SEP-2133). All members are optional; an empty object means the extension is supported with default configuration. Unknown members are ignored for forward compatibility. See SPEC-MCP-EXTENSION.md section 3.",
      "category": "mcp-extension",
      "version": "1.0.0",
      "canonical": "/v1/protocol/mcp-extension/settings/v1.0.0",
      "path": "/v1/protocol/mcp-extension/settings/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/proof/detached/v1.0.0",
      "title": "KYA-OS Detached Proof",
      "description": "Cryptographic proof binding an MCP tool request/response pair to an agent's identity and session context.",
      "category": "proof",
      "version": "1.0.0",
      "canonical": "/v1/protocol/proof/detached/v1.0.0",
      "path": "/v1/protocol/proof/detached/v1.0.0.json",
      "mediaType": "application/schema+json"
    },
    {
      "$id": "https://schema.kya-os.org/v1/protocol/well-known/v1.0.0",
      "title": "KYA-OS Discovery Document",
      "description": "Well-known discovery document served at /.well-known/mcp for KYA-OS service discovery.",
      "category": "well-known",
      "version": "1.0.0",
      "canonical": "/v1/protocol/well-known/v1.0.0",
      "path": "/v1/protocol/well-known/v1.0.0.json",
      "mediaType": "application/schema+json"
    }
  ]
}