Dev

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.21.0"
+  ".": "0.22.0"
 }

CHANGELOG.md

@@ -8,6 +8,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 PRs do **not** edit this file directly. release-please maintains it from the
 Conventional Commit history on `main` (#684).
 
+## [0.22.0](https://github.com/Brad-Edwards/aces/compare/v0.21.0...v0.22.0) (2026-07-15)
+
+
+### Features
+
+* add realization honesty conformance ([#777](https://github.com/Brad-Edwards/aces/issues/777)) ([5f4e3e7](https://github.com/Brad-Edwards/aces/commit/5f4e3e7ca78d21acc12a1ed563aa7f05b64b391a))
+* **sdl:** add authored identity domain topology ([#768](https://github.com/Brad-Edwards/aces/issues/768)) ([78da8fd](https://github.com/Brad-Edwards/aces/commit/78da8fd2c970714232732767398f3b667cd832eb))
+
+
+### Bug Fixes
+
+* stop claiming unrealized domain support ([#778](https://github.com/Brad-Edwards/aces/issues/778)) ([38ba081](https://github.com/Brad-Edwards/aces/commit/38ba081714b12a4dcc7a5c527e2f1250d80a4d1b))
+
+
+### Documentation
+
+* define participant decision-surface semantics ([#774](https://github.com/Brad-Edwards/aces/issues/774)) ([1fd985b](https://github.com/Brad-Edwards/aces/commit/1fd985bb26ecc73b43189fc36584dfa72a80b941))
+* **sdl:** align prose specification with live contracts ([#775](https://github.com/Brad-Edwards/aces/issues/775)) ([4667c90](https://github.com/Brad-Edwards/aces/commit/4667c901c404860e2bda334557bd452ef27cd1c9))
+
 ## [0.21.0](https://github.com/Brad-Edwards/aces/compare/v0.20.0...v0.21.0) (2026-07-14)
 
 

contracts/concept-authority/controlled-vocabularies-v1.json

@@ -388,6 +388,25 @@
         }
       }
     },
+    "participant-interactive-access-channels": {
+      "title": "Participant Interactive Access Channels",
+      "description": "Closed portable protocol classes for authored participant interactive access.",
+      "kind": "enumeration",
+      "governed_scopes": [
+        "agents.interactive_access.channel"
+      ],
+      "extension_policy": "closed",
+      "terms": {
+        "rdp": {
+          "title": "Remote Desktop Protocol",
+          "description": "Participant access through the Remote Desktop Protocol class without asserting a port or realized listener."
+        },
+        "ssh": {
+          "title": "Secure Shell",
+          "description": "Participant access through the Secure Shell protocol class without asserting a port or realized listener."
+        }
+      }
+    },
     "participant-tool-affordance-expectations": {
       "title": "Participant Tool Affordance Expectations",
       "description": "Governed tool and affordance expectations declared by participant implementations.",

contracts/fixtures/backend-manifest/backend-manifest-v2/valid/stub.json

@@ -165,7 +165,9 @@
         "windows"
       ],
       "supports_accounts": true,
-      "supports_acls": true
+      "supports_acls": true,
+      "supports_generated_artifacts": true,
+      "supports_persistent_volumes": true
     }
   },
   "compatibility": {

contracts/fixtures/concept-authority/controlled-vocabularies-v1/valid/reference.json

@@ -388,6 +388,25 @@
         }
       }
     },
+    "participant-interactive-access-channels": {
+      "title": "Participant Interactive Access Channels",
+      "description": "Closed portable protocol classes for authored participant interactive access.",
+      "kind": "enumeration",
+      "governed_scopes": [
+        "agents.interactive_access.channel"
+      ],
+      "extension_policy": "closed",
+      "terms": {
+        "rdp": {
+          "title": "Remote Desktop Protocol",
+          "description": "Participant access through the Remote Desktop Protocol class without asserting a port or realized listener."
+        },
+        "ssh": {
+          "title": "Secure Shell",
+          "description": "Participant access through the Secure Shell protocol class without asserting a port or realized listener."
+        }
+      }
+    },
     "participant-tool-affordance-expectations": {
       "title": "Participant Tool Affordance Expectations",
       "description": "Governed tool and affordance expectations declared by participant implementations.",

contracts/provenance/sdl-lineage-ledger-v1.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "sdl-lineage-ledger/v1",
-  "reviewed_on": "2026-07-13",
+  "reviewed_on": "2026-07-15",
   "citations": [
     {
       "citation_id": "ocr-sdl-v0.21.2",
@@ -110,6 +110,32 @@
       "license_url": "https://github.com/Open-Cyber-Range/SDL-parser/blob/fe83e8281fc4b954967fbaa5a0d099007ddcb06c/LICENSE",
       "license_evidence_ref": "docs/research/lineage/source-audit-2026-07-12.md#open-cyber-range-sdl"
     },
+    {
+      "source_id": "cyris-v1.2",
+      "kind": "git",
+      "title": "CyRIS",
+      "version_or_edition": "1.2",
+      "canonical_url": "https://github.com/crond-jaist/cyris/tree/5f0d7843fed3dff782f7f62da9f8bcaa9a2a7481",
+      "repository_url": "https://github.com/crond-jaist/cyris",
+      "commit": "5f0d7843fed3dff782f7f62da9f8bcaa9a2a7481",
+      "citation_ref": "cyris-2018",
+      "license_expression": "BSD-3-Clause",
+      "license_url": "https://github.com/crond-jaist/cyris/blob/5f0d7843fed3dff782f7f62da9f8bcaa9a2a7481/LICENSE",
+      "license_evidence_ref": "docs/research/lineage/source-audit-2026-07-12.md#cyris-v12-source-pin"
+    },
+    {
+      "source_id": "cyborg-v3.0",
+      "kind": "git",
+      "title": "CybORG",
+      "version_or_edition": "v3.0",
+      "canonical_url": "https://github.com/cage-challenge/CybORG/tree/a2d03f99e587af153ae0ac50fb94ba6272e4fff2",
+      "repository_url": "https://github.com/cage-challenge/CybORG",
+      "commit": "a2d03f99e587af153ae0ac50fb94ba6272e4fff2",
+      "citation_ref": "cyborg-2021",
+      "license_expression": "MIT",
+      "license_url": "https://github.com/cage-challenge/CybORG/blob/a2d03f99e587af153ae0ac50fb94ba6272e4fff2/LICENSE",
+      "license_evidence_ref": "docs/research/lineage/source-audit-2026-07-12.md#cyborg-v30-source-pin"
+    },
     {
       "source_id": "cacao-v2.0",
       "kind": "standard",
@@ -282,6 +308,43 @@
           ],
           "internal_authority_refs": [],
           "compatibility_direction": "aces_relative_to_source"
+        },
+        {
+          "plane": "semantics",
+          "classification": "adapted",
+          "source_refs": [
+            "cyris-v1.2",
+            "cyborg-v3.0"
+          ],
+          "aces_boundaries": [
+            {
+              "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+              "symbol_or_pointer": "#/$defs/Agent/properties/interactive_access"
+            }
+          ],
+          "source_boundaries": [
+            {
+              "artifact": "CyRIS examples/basic.yml and main/clone_environment.py",
+              "symbol_or_pointer": "guest_settings[].entry_point and VMClone tunnel selection"
+            },
+            {
+              "artifact": "CybORG/Simulator/Scenarios/scenario_files/Scenario1.yaml",
+              "symbol_or_pointer": "Agents.*.starting_sessions[]"
+            }
+          ],
+          "divergence": "ACES adapts explicit participant-local access binding into stable keyed declarations with explicit VM and account references plus a closed SSH/RDP channel. It does not copy either syntax, infer a channel from OS family, represent an established simulator session, expose ports or locators, carry raw credentials, or claim that authored availability was realized.",
+          "compatibility": "none",
+          "citation_refs": [
+            "cyris-2018",
+            "cyborg-2021"
+          ],
+          "internal_authority_refs": [
+            "docs/decisions/adrs/adr-020-declarative-participant-framing-boundaries.md",
+            "docs/decisions/adrs/adr-022-participant-behavior-and-interaction-semantics.md",
+            "docs/decisions/adrs/adr-083-participant-tool-decision-surface-and-exposure-semantics.md",
+            "specs/formal/participant-semantics/README.md"
+          ],
+          "compatibility_direction": "aces_relative_to_source"
         }
       ]
     },
@@ -513,6 +576,37 @@
         }
       ]
     },
+    {
+      "subject_id": "sdl-field:generated_artifacts",
+      "subject_kind": "top_level_field",
+      "disposition": "current",
+      "authority": {
+        "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+        "pointer": "#/properties/generated_artifacts",
+        "contract_id": "sdl-authoring-input-v1"
+      },
+      "claims": [
+        {
+          "plane": "semantics",
+          "classification": "aces_native",
+          "source_refs": [],
+          "aces_boundaries": [
+            {
+              "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+              "symbol_or_pointer": "#/properties/generated_artifacts"
+            }
+          ],
+          "source_boundaries": [],
+          "divergence": "Defined by the current ACES normative contract; external systems may be intellectual precedents but do not define this subject.",
+          "compatibility": "not_applicable",
+          "citation_refs": [],
+          "internal_authority_refs": [
+            "specs/sdl/stateful-resources.md"
+          ],
+          "compatibility_direction": "not_applicable"
+        }
+      ]
+    },
     {
       "subject_id": "sdl-field:entities",
       "subject_kind": "top_level_field",
@@ -1216,6 +1310,37 @@
         }
       ]
     },
+    {
+      "subject_id": "sdl-field:persistent_volumes",
+      "subject_kind": "top_level_field",
+      "disposition": "current",
+      "authority": {
+        "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+        "pointer": "#/properties/persistent_volumes",
+        "contract_id": "sdl-authoring-input-v1"
+      },
+      "claims": [
+        {
+          "plane": "semantics",
+          "classification": "aces_native",
+          "source_refs": [],
+          "aces_boundaries": [
+            {
+              "artifact": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
+              "symbol_or_pointer": "#/properties/persistent_volumes"
+            }
+          ],
+          "source_boundaries": [],
+          "divergence": "Defined by the current ACES normative contract; external systems may be intellectual precedents but do not define this subject.",
+          "compatibility": "not_applicable",
+          "citation_refs": [],
+          "internal_authority_refs": [
+            "specs/sdl/stateful-resources.md"
+          ],
+          "compatibility_direction": "not_applicable"
+        }
+      ]
+    },
     {
       "subject_id": "sdl-field:realization",
       "subject_kind": "top_level_field",

contracts/schema-publication-manifest.json

@@ -42,10 +42,10 @@
       "contract_id": "backend-manifest-v2",
       "schema_path": "contracts/schemas/backend-manifest/backend-manifest-v2.json",
       "stability": "draft",
-      "content_hash": "014178ea05ae875548c1121e11a59cb66215614a63bde35544dd972f0f53420c",
+      "content_hash": "5a1f88f9f7c090c36530a993a9750389ee34b6fd7860a1e7b33972fb2e82dd16",
       "last_change": {
-        "summary": "Added the governed provisioner domain-profile capability dimension for authored identity-domain realization (issue #763).",
-        "content_hash": "014178ea05ae875548c1121e11a59cb66215614a63bde35544dd972f0f53420c"
+        "summary": "Added explicit provisioner support claims for generated artifacts and persistent volumes (issue #780).",
+        "content_hash": "5a1f88f9f7c090c36530a993a9750389ee34b6fd7860a1e7b33972fb2e82dd16"
       }
     },
     {
@@ -190,20 +190,20 @@
       "contract_id": "instantiated-scenario-snapshot-v1",
       "schema_path": "contracts/schemas/sdl/instantiated-scenario-snapshot-v1.json",
       "stability": "draft",
-      "content_hash": "10544c816e9407607d4bbc8002eb23645f2fc5bc6c7e86ca7fbd4ae3f0c6d25e",
+      "content_hash": "46365e6661556673f124fc7b04383c451cf25396d551c564171bb009fa515dc9",
       "last_change": {
-        "summary": "Added authored identity-domain declarations, typed controller and join relationships, and explicit account domain bindings (issue #763).",
-        "content_hash": "10544c816e9407607d4bbc8002eb23645f2fc5bc6c7e86ca7fbd4ae3f0c6d25e"
+        "summary": "Combined typed stateful realization resources (issue #780) with participant interactive-access declarations (issue #805).",
+        "content_hash": "46365e6661556673f124fc7b04383c451cf25396d551c564171bb009fa515dc9"
       }
     },
     {
       "contract_id": "instantiated-scenario-v1",
       "schema_path": "contracts/schemas/sdl/instantiated-scenario-v1.json",
       "stability": "draft",
-      "content_hash": "03aee5d25be44733ef09697b403235189bc91fc65da7bd6ff7ecd8ff6685d72a",
+      "content_hash": "96ece657528da43f97750f56d8e72d1c9f2e504f09d8fa673aa9154db83a59be",
       "last_change": {
-        "summary": "Added authored identity-domain declarations, typed controller and join relationships, and explicit account domain bindings (issue #763).",
-        "content_hash": "03aee5d25be44733ef09697b403235189bc91fc65da7bd6ff7ecd8ff6685d72a"
+        "summary": "Combined typed stateful realization resources (issue #780) with participant interactive-access declarations (issue #805).",
+        "content_hash": "96ece657528da43f97750f56d8e72d1c9f2e504f09d8fa673aa9154db83a59be"
       }
     },
     {
@@ -380,10 +380,10 @@
       "contract_id": "provisioning-plan-v1",
       "schema_path": "contracts/schemas/plans/provisioning-plan-v1.json",
       "stability": "draft",
-      "content_hash": "e3d9a1357af4e49b78d591cca10547a4d0113aee794686e0f8d96e32bb940e49",
+      "content_hash": "c4aef8660b30ee4fbdf29b22180a7da60e1cd42e5a5b087ad3f83c45dc21713c",
       "last_change": {
-        "summary": "Added immutable realization-envelope identity carriage and constrained provisioning operations to canonical provision addresses and resource types.",
-        "content_hash": "e3d9a1357af4e49b78d591cca10547a4d0113aee794686e0f8d96e32bb940e49"
+        "summary": "Added generated-artifact and persistent-volume provisioning resource identities (issue #780).",
+        "content_hash": "c4aef8660b30ee4fbdf29b22180a7da60e1cd42e5a5b087ad3f83c45dc21713c"
       }
     },
     {
@@ -456,10 +456,10 @@
       "contract_id": "sdl-authoring-input-v1",
       "schema_path": "contracts/schemas/sdl/sdl-authoring-input-v1.json",
       "stability": "draft",
-      "content_hash": "27f9ad3203fa48afec0247b7eb8afd376c1acc8dbdac7d88d9e0c96c9b9bf8c3",
+      "content_hash": "b192b76721340ea032d72bba7060c4ddf956e3e88edeca33cf17c74149b77891",
       "last_change": {
-        "summary": "Added authored identity-domain declarations, typed controller and join relationships, and explicit account domain bindings (issue #763).",
-        "content_hash": "27f9ad3203fa48afec0247b7eb8afd376c1acc8dbdac7d88d9e0c96c9b9bf8c3"
+        "summary": "Combined typed stateful realization resources (issue #780) with participant interactive-access declarations (issue #805).",
+        "content_hash": "b192b76721340ea032d72bba7060c4ddf956e3e88edeca33cf17c74149b77891"
       }
     },
     {

contracts/schemas/backend-manifest/backend-manifest-v2.json

@@ -709,6 +709,16 @@
           "default": false,
           "title": "Supports Acls",
           "type": "boolean"
+        },
+        "supports_generated_artifacts": {
+          "default": false,
+          "title": "Supports Generated Artifacts",
+          "type": "boolean"
+        },
+        "supports_persistent_volumes": {
+          "default": false,
+          "title": "Supports Persistent Volumes",
+          "type": "boolean"
         }
       },
       "required": [

contracts/schemas/plans/provisioning-plan-v1.json

@@ -58,8 +58,10 @@
             "account-placement",
             "content-placement",
             "feature-binding",
+            "generated-artifact",
             "network",
-            "node"
+            "node",
+            "persistent-volume"
           ],
           "title": "Resource Type",
           "type": "string"