feat: add LangChain delegated-authority reference profile

[chuks]

Summary

Adds an independent LangChain reference profile for proof-carrying delegated authority over native Streamable HTTP MCP. The platform-neutral reference registry is provided independently by merged PR #67; this PR contains only the LangChain profile and its registry row.

The profile answers one narrow question: when a LangChain agent crosses an MCP or organizational boundary, can the receiver independently verify who authorized that agent for the exact action and which bounds still apply?

What the profile contains

• A real LangChain create_agent graph driven by a deterministic tool-calling model double.
• Native MultiServerMCPClient tools and the public MCP tool-interceptor API.
• A model-visible schema containing only business arguments; keys, challenges, session bindings, and proof bytes remain outside model context.
• Per-call proof injection after tool selection through HTTP headers.
• An independently started receiver that owns trust configuration, reconstructs the operation, consumes a single-use challenge, and verifies before invoking the protected handler.
• Explicit separation between LangChain/LangGraph orchestration, LangSmith authentication and platform-resource authorization, MCP transport, Ratify delegated authority, and receiver policy.

Verification

./scripts/langchain-reference-check.sh

Current result: 21 passed, zero skips, zero xfails. The gate creates a disposable environment, installs exact public package pins, and rejects a Ratify import from the repository SDK.

Coverage includes allow, excessive authority, wrong resource, expiry, revocation, replay, altered operation, wrong agent, hostile root, malformed proof, invalid inputs, bounded pending state, concurrent duplicate request IDs, unauthenticated transport, hidden proof schema, native HTTP MCP execution, and the real LangChain agent loop. Every denial asserts that the protected invocation count does not increase.

Tested pins

• langchain==1.3.14
• langchain-mcp-adapters==0.3.0
• mcp==1.29.0
• ratify-protocol==1.0.0a16

Scope and non-goals

• The receiver and challenge state are in memory and fail closed on restart.
• The protected provisioner is a counter; no cloud resources are created.
• HTTP runs on loopback without production TLS or workload identity.
• Proof headers are an independent integration profile, not a LangChain or MCP standard.
• LangSmith deployment, Agent Server custom auth, durable checkpoints, and live hosted models are not exercised or claimed.
• Protected execution is at-most-once; production retries require an idempotency and result ledger.

This is an independent draft. It is not a LangChain partnership, LangChain-approved integration, or LangChain reference architecture.

Checklist

• DCO sign-off included.
• No protocol, SDK, signable-byte, scope-vocabulary, or canonical-fixture change.
• Exact public dependency pins and published-package gate.
• Receiver-side fail-closed tests with protected-handler evidence.
• Limitations and endorsement status documented.
• Public-facing text contains no private process or tool attribution.

[chuks]

Continuity note: the platform-neutral reference foundation has merged in #67. This existing PR was rebased in place and retargeted from the Google branch to main; it is now fully independent and contains only the LangChain profile, its gate, and its registry row. Post-rebase verification: 21 passed, zero skips, zero xfails.

[chuks]

Final registry note: #68 replaced the shared table with merge-independent, one-file-per-platform entries. This PR now adds references/registry/langchain.md and does not modify the shared registry README. The LangChain profile tree and previously reported 21-test result are unchanged.