schemas: add multi-view security SerDes contracts

[mdheller]

Summary

Add the first portable Semantic SerDes schema package for multi-view security, privacy, and replay semantics.

This is the schema foundation needed before TriTRPC, regis-entity-graph, meshrush, and cairnpath-mesh can safely reference View Contracts, Disclosure Modes, Typed Absence, Analytic Integrity, and Revocation Bindings.

Why this belongs here

semantic-serdes owns portable semantic object contracts for events, contexts, surfaces, replay, and cross-boundary interchange. The new multi-view security objects are not transport-specific, graph-runtime-specific, or ontology-authoritative by themselves. They should be serialized here, while:

• ontogenesis owns governed ontology terms and SHACL/JSON-LD semantics.
• policy-fabric owns authored policy, compiled policy plans, decisions, validation reports, and release/replay reports.
• agent-registry owns agent identities, sessions, grants, revocation, and runtime authority.
• TriTRPC owns deterministic authenticated transport and AUX fixture parity.
• regis-entity-graph owns materialized graph consequences.
• meshrush owns graph-operation runtime behavior.
• cairnpath-mesh owns replay/materialization records for view-bounded analysis.

Files to add

Add schemas:

• schemas/view_contract.schema.json
• schemas/disclosure_mode.schema.json
• schemas/policy_decision_summary.schema.json
• schemas/typed_absence.schema.json
• schemas/analytic_integrity.schema.json
• schemas/revocation_binding.schema.json

Add examples:

• examples/view_contract.example.yaml
• examples/disclosure_mode.example.yaml
• examples/policy_decision_summary.example.yaml
• examples/typed_absence.example.yaml
• examples/analytic_integrity.example.yaml
• examples/revocation_binding.example.yaml

Add docs:

• docs/multi-view-security-serdes-v0.1.md

Add CI/validation:

• either extend an existing workflow or add .github/workflows/validate-multi-view-serdes.yml
• run tools/validate_semantic_serdes.py against the new schema/example pairs

Schema contract requirements

ViewContract

Must describe the authority roots and policy context that define a principal's view. Required fields should include:

• view_contract_id
• view_signature
• schema_version
• principal_authority_ref
• policy_decision_ref
• policy_bundle_hash
• purpose
• ontology_ref
• created_at
• revocation_epoch

Optional but supported fields should include:

• agent_registry_ref
• identity_subject_ref
• identity_session_ref
• policy_fabric_ref
• workspace_fingerprint_ref
• environment_fingerprint_ref
• artifact_fingerprint_refs
• allowed_disclosure_modes
• valid_from
• valid_until
• authority_refs

view_signature and policy_bundle_hash should use a stable hash URI shape such as sha256:<64 lowercase hex>.

DisclosureMode

Must distinguish at least:

• HARD_HIDE
• TYPED_ABSENCE
• MASKED
• AGGREGATE_ONLY
• PROOF_ONLY
• DENY

Must also capture:

• existence policy: conceal, reveal boundary, reveal type only, reveal count only
• redaction strategy: drop, stub, mask, bucket, bound
• side-channel profile: strict, bounded, best-effort
• allowed materialization surfaces

PolicyDecisionSummary

Must be a portable summary/ref object, not the policy engine. Required fields should include:

• decision_id
• policy_bundle_hash
• decision_outcome
• purpose
• decided_at
• obligations

It should support outcomes such as ALLOW, DENY, ALLOW_WITH_TRANSFORMS, ESCALATE, and DEFER.

TypedAbsence

Must model hidden-is-not-absent boundaries. Required fields should include:

• typed_absence_id
• boundary_kind
• disclosure_mode
• revealed_shape
• policy_basis
• safe_for_recipient

Boundary kinds should include hidden node, hidden edge, hidden predicate, hidden class/type, hidden attribute, and hidden subgraph.

AnalyticIntegrity

Must make cross-view comparability explicit. Required fields should include:

• analysis_class
• view_sensitivity
• merge_policy
• requires_same_view_signature
• requires_recipient_recompute

View sensitivity should include at least VIEW_STABLE, VIEW_SENSITIVE, and FORBIDDEN_CROSS_VIEW.

RevocationBinding

Must model future-access and recomputation semantics. Required fields should include:

• revocation_binding_id
• revocation_epoch
• authority_ref
• effective_at
• binding_scope
• future_access
• recompute_policy

It must be explicit that revocation controls future platform-mediated access/recompute/materialization; it does not magically erase information already copied outside the platform.

Canonical enum additions

Update canonical_enums.yaml with sections for:

disclosure_mode:
- HARD_HIDE
- TYPED_ABSENCE
- MASKED
- AGGREGATE_ONLY
- PROOF_ONLY
- DENY

existence_policy:
- CONCEAL
- REVEAL_BOUNDARY
- REVEAL_TYPE_ONLY
- REVEAL_COUNT_ONLY

view_sensitivity:
- VIEW_STABLE
- VIEW_SENSITIVE
- FORBIDDEN_CROSS_VIEW

comparability_outcome:
- SAME_VIEW
- RECIPIENT_RECOMPUTE_REQUIRED
- BOUNDS_ONLY
- INCOMPARABLE
- DENIED

redaction_strategy:
- DROP
- STUB
- MASK
- BUCKET
- BOUND

side_channel_profile:
- STRICT
- BOUNDED
- BEST_EFFORT

Acceptance criteria

• New schema/example pairs validate with tools/validate_semantic_serdes.py.
• Docs explain the boundary: Semantic SerDes serializes portable objects; it does not own policy decisions, ontology truth, transport verification, graph runtime, or replay execution.
• The examples include at least one narrower-recipient view case with TYPED_ABSENCE and one hard-hide case with HARD_HIDE.
• The schema package is usable by downstream issues in TriTRPC, regis-entity-graph, meshrush, and cairnpath-mesh.

Suggested local validation command

python -m pip install pyyaml jsonschema
python tools/validate_semantic_serdes.py \
  view_contract.schema.json:examples/view_contract.example.yaml \
  disclosure_mode.schema.json:examples/disclosure_mode.example.yaml \
  policy_decision_summary.schema.json:examples/policy_decision_summary.example.yaml \
  typed_absence.schema.json:examples/typed_absence.example.yaml \
  analytic_integrity.schema.json:examples/analytic_integrity.example.yaml \
  revocation_binding.schema.json:examples/revocation_binding.example.yaml

Context

This issue follows the SocioSphere estate-map update issue for the multi-view security/replay spine. The map issue should record ownership boundaries; this issue lands the first portable schema layer.