Dev

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.20.0"
+  ".": "0.21.0"
 }

CHANGELOG.md

@@ -8,6 +8,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 PRs do **not** edit this file directly. release-please maintains it from the
 Conventional Commit history on `main` (#684).
 
+## [0.21.0](https://github.com/Brad-Edwards/aces/compare/v0.20.0...v0.21.0) (2026-07-14)
+
+
+### Features
+
+* add scoped realization posture cascade ([#766](https://github.com/Brad-Edwards/aces/issues/766)) ([7776866](https://github.com/Brad-Edwards/aces/commit/77768667242a23728a96aeed9294f62fca30831a))
+* define behavioral relation taxonomy and claim discipline ([#770](https://github.com/Brad-Edwards/aces/issues/770)) ([feed07d](https://github.com/Brad-Edwards/aces/commit/feed07d303dbcbbb9bf4230a72ea5ca9c49f279f))
+
+
+### Bug Fixes
+
+* define node service reachability semantics ([#764](https://github.com/Brad-Edwards/aces/issues/764)) ([2c3fa06](https://github.com/Brad-Edwards/aces/commit/2c3fa06a40f69095191b029fcb1062ebfe3b5f60))
+* preserve explicitness provenance at runtime ([#762](https://github.com/Brad-Edwards/aces/issues/762)) ([1b63b2a](https://github.com/Brad-Edwards/aces/commit/1b63b2a0b10dcd80e29b8bad14558ad9c6b706d0))
+* **sdl:** separate runtime contract from observed evidence ([#761](https://github.com/Brad-Edwards/aces/issues/761)) ([69acb69](https://github.com/Brad-Edwards/aces/commit/69acb691435c72f4a831358d7ee2f83ab3fcf663))
+
+
+### Documentation
+
+* rebuild related-work comparison from reproducible evidence ([#765](https://github.com/Brad-Edwards/aces/issues/765)) ([ed9577a](https://github.com/Brad-Edwards/aces/commit/ed9577aecbe65de19953a45744d3bdc219d9af0b))
+
 ## [0.20.0](https://github.com/Brad-Edwards/aces/compare/v0.19.1...v0.20.0) (2026-07-13)
 
 

contracts/concept-authority/controlled-vocabularies-v1.json

@@ -678,6 +678,22 @@
         }
       }
     },
+    "provisioner-domain-profiles": {
+      "title": "Provisioner Domain Profiles",
+      "description": "Provisioner-supported authored identity-domain realization profiles.",
+      "kind": "vocabulary",
+      "governed_scopes": [
+        "capabilities.provisioner.supported_domain_profiles"
+      ],
+      "extension_policy": "governed-extension",
+      "extension_pattern": "^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "terms": {
+        "active_directory": {
+          "title": "Active Directory",
+          "description": "Authored Active Directory controller and domain-join topology realization."
+        }
+      }
+    },
     "orchestrator-supported-sections": {
       "title": "Orchestrator Supported Sections",
       "description": "Orchestrator-supported SDL section vocabulary.",

contracts/concept-authority/reference-models-v1.json

@@ -46,9 +46,33 @@
         "node",
         "groups",
         "auth_method",
+        "domain_ref",
         "disabled"
       ]
     },
+    "scenario-identity-domain": {
+      "title": "Scenario Identity Domain",
+      "description": "Shared reference model for authored identity-domain realization topology.",
+      "concept_family": "identities",
+      "authoritative_schema": {
+        "contract_id": "sdl-authoring-input-v1",
+        "schema_pointer": "#/$defs/IdentityDomain",
+        "instance_path": "identity_domains.*"
+      },
+      "reused_schemas": [
+        {
+          "contract_id": "instantiated-scenario-v1",
+          "schema_pointer": "#/$defs/IdentityDomain",
+          "instance_path": "identity_domains.*"
+        }
+      ],
+      "key_fields": [
+        "profile",
+        "dns_name",
+        "netbios_name",
+        "authority_account_ref"
+      ]
+    },
     "scenario-relationship": {
       "title": "Scenario Relationship",
       "description": "Shared reference model for typed directed relationships between scenario elements.",
@@ -69,7 +93,9 @@
         "type",
         "source",
         "target",
-        "properties"
+        "properties",
+        "domain_controller",
+        "domain_join"
       ]
     },
     "scenario-condition": {

contracts/fixtures/backend-manifest/backend-manifest-v2/valid/stub.json

@@ -145,6 +145,9 @@
         "shell",
         "spn"
       ],
+      "supported_domain_profiles": [
+        "active_directory"
+      ],
       "supported_content_types": [
         "dataset",
         "directory",
@@ -187,6 +190,10 @@
       "family": "identities",
       "scope": "capabilities.provisioner.supported_account_features"
     },
+    {
+      "family": "identities",
+      "scope": "capabilities.provisioner.supported_domain_profiles"
+    },
     {
       "family": "actions-and-events",
       "scope": "capabilities.orchestrator.supported_sections"

contracts/fixtures/concept-authority/controlled-vocabularies-v1/valid/reference.json

@@ -678,6 +678,22 @@
         }
       }
     },
+    "provisioner-domain-profiles": {
+      "title": "Provisioner Domain Profiles",
+      "description": "Provisioner-supported authored identity-domain realization profiles.",
+      "kind": "vocabulary",
+      "governed_scopes": [
+        "capabilities.provisioner.supported_domain_profiles"
+      ],
+      "extension_policy": "governed-extension",
+      "extension_pattern": "^x-[a-z0-9]+(?:-[a-z0-9]+)*:[a-z0-9]+(?:-[a-z0-9]+)*$",
+      "terms": {
+        "active_directory": {
+          "title": "Active Directory",
+          "description": "Authored Active Directory controller and domain-join topology realization."
+        }
+      }
+    },
     "orchestrator-supported-sections": {
       "title": "Orchestrator Supported Sections",
       "description": "Orchestrator-supported SDL section vocabulary.",

contracts/fixtures/concept-authority/reference-models-v1/valid/reference.json

@@ -46,9 +46,33 @@
         "node",
         "groups",
         "auth_method",
+        "domain_ref",
         "disabled"
       ]
     },
+    "scenario-identity-domain": {
+      "title": "Scenario Identity Domain",
+      "description": "Shared reference model for authored identity-domain realization topology.",
+      "concept_family": "identities",
+      "authoritative_schema": {
+        "contract_id": "sdl-authoring-input-v1",
+        "schema_pointer": "#/$defs/IdentityDomain",
+        "instance_path": "identity_domains.*"
+      },
+      "reused_schemas": [
+        {
+          "contract_id": "instantiated-scenario-v1",
+          "schema_pointer": "#/$defs/IdentityDomain",
+          "instance_path": "identity_domains.*"
+        }
+      ],
+      "key_fields": [
+        "profile",
+        "dns_name",
+        "netbios_name",
+        "authority_account_ref"
+      ]
+    },
     "scenario-relationship": {
       "title": "Scenario Relationship",
       "description": "Shared reference model for typed directed relationships between scenario elements.",
@@ -69,7 +93,9 @@
         "type",
         "source",
         "target",
-        "properties"
+        "properties",
+        "domain_controller",
+        "domain_join"
       ]
     },
     "scenario-condition": {

contracts/fixtures/realization-envelope/realization-envelope-v1/valid/generic.json

@@ -12,14 +12,15 @@
   },
   "configuration": {
     "mode": "generic",
-    "configuration_digest": "sha256:2af0fbd4a95b95a3a51d1488f641985c93e4c470baeb188f3e981f8b36327450",
+    "configuration_digest": "sha256:227d7807516ed39ad04acd4eb9fac26d0f0d3d9c81eb42a3cbf25c9215888a8c",
     "architecture": "x86_64",
     "image_policy": "local-qcow2",
     "network_policy": "libvirt-managed",
     "supported_node_types": ["switch", "vm"],
     "supported_os_families": ["linux"],
     "supported_content_types": ["file"],
     "supported_account_features": ["auth_method", "disabled", "groups", "home", "shell"],
+    "supported_domain_profiles": [],
     "supports_acls": true,
     "memory_mib": {"minimum": 128, "maximum": null},
     "vcpus": {"minimum": 1, "maximum": null}
@@ -36,5 +37,5 @@
     {"concern": "service", "disposition": "unsupported", "observation_strength": "none", "mechanism": null, "transformations": []},
     {"concern": "acl", "disposition": "realized", "observation_strength": "driver-reported", "mechanism": "libvirt-nwfilter", "transformations": []}
   ],
-  "digest": "sha256:eb3b54b199249da599cdd59e050612314ed16fe6039630307894ee8d8e2a466f"
+  "digest": "sha256:85136f73d2752c5fdaf8c4219aefc42de756486555c17fe2f4b71a7c042221f0"
 }

contracts/provenance/sdl-lineage-ledger-v1.json

@@ -184,6 +184,38 @@
         }
       ]
     },
+    {
+      "subject_id": "sdl-field:identity_domains",
+      "subject_kind": "top_level_field",
+      "disposition": "current",
+      "authority": {
+        "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+        "pointer": "#/properties/identity_domains",
+        "contract_id": "sdl-authoring-input-v1"
+      },
+      "claims": [
+        {
+          "plane": "semantics",
+          "classification": "aces_native",
+          "source_refs": [],
+          "aces_boundaries": [
+            {
+              "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+              "symbol_or_pointer": "#/properties/identity_domains"
+            }
+          ],
+          "source_boundaries": [],
+          "divergence": "Defined by the current ACES normative contract; external systems may be intellectual precedents but do not define this subject.",
+          "compatibility": "not_applicable",
+          "citation_refs": [],
+          "internal_authority_refs": [
+            "specs/sdl/authored-domain-topology.md",
+            "docs/decisions/adrs/adr-082-authored-identity-domain-topology.md"
+          ],
+          "compatibility_direction": "not_applicable"
+        }
+      ]
+    },
     {
       "subject_id": "sdl-field:action_contracts",
       "subject_kind": "top_level_field",
@@ -2599,6 +2631,36 @@
         }
       ]
     },
+    {
+      "subject_id": "reference-model:scenario-identity-domain",
+      "subject_kind": "reference_model",
+      "disposition": "current",
+      "authority": {
+        "artifact": "contracts/concept-authority/reference-models-v1.json",
+        "pointer": "#/models/scenario-identity-domain"
+      },
+      "claims": [
+        {
+          "plane": "semantics",
+          "classification": "aces_native",
+          "source_refs": [],
+          "aces_boundaries": [
+            {
+              "artifact": "contracts/concept-authority/reference-models-v1.json",
+              "symbol_or_pointer": "#/models/scenario-identity-domain"
+            }
+          ],
+          "source_boundaries": [],
+          "divergence": "Defined by the current ACES normative contract; external systems may be intellectual precedents but do not define this subject.",
+          "compatibility": "not_applicable",
+          "citation_refs": [],
+          "internal_authority_refs": [
+            "specs/sdl/authored-domain-topology.md"
+          ],
+          "compatibility_direction": "not_applicable"
+        }
+      ]
+    },
     {
       "subject_id": "reference-model:scenario-assertion",
       "subject_kind": "reference_model",

contracts/realization-envelopes/libvirt-qemu/generic-v1.json

@@ -12,14 +12,15 @@
   },
   "configuration": {
     "mode": "generic",
-    "configuration_digest": "sha256:2af0fbd4a95b95a3a51d1488f641985c93e4c470baeb188f3e981f8b36327450",
+    "configuration_digest": "sha256:227d7807516ed39ad04acd4eb9fac26d0f0d3d9c81eb42a3cbf25c9215888a8c",
     "architecture": "x86_64",
     "image_policy": "local-qcow2",
     "network_policy": "libvirt-managed",
     "supported_node_types": ["switch", "vm"],
     "supported_os_families": ["linux"],
     "supported_content_types": ["file"],
     "supported_account_features": ["auth_method", "disabled", "groups", "home", "shell"],
+    "supported_domain_profiles": [],
     "supports_acls": true,
     "memory_mib": {"minimum": 128, "maximum": null},
     "vcpus": {"minimum": 1, "maximum": null}
@@ -36,5 +37,5 @@
     {"concern": "service", "disposition": "unsupported", "observation_strength": "none", "mechanism": null, "transformations": []},
     {"concern": "acl", "disposition": "realized", "observation_strength": "driver-reported", "mechanism": "libvirt-nwfilter", "transformations": []}
   ],
-  "digest": "sha256:eb3b54b199249da599cdd59e050612314ed16fe6039630307894ee8d8e2a466f"
+  "digest": "sha256:85136f73d2752c5fdaf8c4219aefc42de756486555c17fe2f4b71a7c042221f0"
 }

contracts/realization-envelopes/libvirt-qemu/guest-certified-appliance-v1.json

@@ -31,6 +31,7 @@
       "home",
       "shell"
     ],
+    "supported_domain_profiles": [],
     "supports_acls": false,
     "memory_mib": {
       "minimum": 64,
@@ -40,7 +41,7 @@
       "minimum": 1,
       "maximum": 2
     },
-    "configuration_digest": "sha256:b33ad469eaf1a47963e49da8adc7376fc22880ac3e6126b427239daa00dc6d99"
+    "configuration_digest": "sha256:fbb560799256b26deb85fead1de2a681f5f93d16a03bb7c3e7d9792fcf88ea6c"
   },
   "concerns": [
     {
@@ -114,5 +115,5 @@
       "transformations": []
     }
   ],
-  "digest": "sha256:8416a600a6f1864e1b80e49fa60eef5f423f9249f2ea7dc56e14d8a669e33e2e"
+  "digest": "sha256:9f5e7b452821febb9e4f160b843dfc76f7d2ace1fb3dd2adb675fc9ce020aaa7"
 }

contracts/realization-envelopes/libvirt-qemu/techvault-appliance-v1.json

@@ -12,14 +12,15 @@
   },
   "configuration": {
     "mode": "techvault-appliance",
-    "configuration_digest": "sha256:227dc29681c61c341291ef4ef30b8c777e166103a5e76a74d87cc2164a7bf5ca",
+    "configuration_digest": "sha256:48ce2b3930c9d1a08df96440efbef6499f96b28bcabd3319fe83372856b0fff5",
     "architecture": "x86_64",
     "image_policy": "generated-initramfs-appliance",
     "network_policy": "generated-appliance-network",
     "supported_node_types": ["switch", "vm"],
     "supported_os_families": ["linux"],
     "supported_content_types": [],
     "supported_account_features": [],
+    "supported_domain_profiles": [],
     "supports_acls": false,
     "memory_mib": {"minimum": 64, "maximum": 128},
     "vcpus": {"minimum": 1, "maximum": 2}
@@ -36,5 +37,5 @@
     {"concern": "service", "disposition": "unsupported", "observation_strength": "none", "mechanism": null, "transformations": []},
     {"concern": "acl", "disposition": "unsupported", "observation_strength": "none", "mechanism": null, "transformations": []}
   ],
-  "digest": "sha256:b0cdf9c60cf42a50782f0d417cd931462c4d630e35e7546734710219477622ed"
+  "digest": "sha256:8af7fad829cecd3a0b91213d4e54097e63b0d519ab3efaf9008b8e53365599f4"
 }