{
  "schema": 1,
  "authority": "kotoba-lang/kotoba-lang",
  "status": "distributed-release-gated",
  "identity": {
    "definition": "Definition CID identifies one semantic or checked-KIR definition.",
    "release": "A library-release CID binds an exact namespace head to definitions, raw Wasm artifacts, compile receipts, and reproducibility evidence.",
    "source": "Source CID identifies source bytes when a publication binds them.",
    "build": "Build CID identifies declared build inputs and toolchain conditions.",
    "artifact": "Artifact CID identifies emitted bytes.",
    "alias": "Names, versions, latest refs, and GitHub URLs are discovery or provenance; they are not content identity."
  },
  "surfaces": {
    "inspect": {
      "command": "kotoba library inspect <name|CID|#hash> --store <dir> --namespace <name>",
      "implemented": true,
      "effect": "none"
    },
    "publish-plan": {
      "command": "kotoba library publish --store <dir> --namespace <name>",
      "implemented": true,
      "effect": "none",
      "default-dry-run": true
    },
    "publish-apply": {
      "command": "kotoba library publish --store <dir> --namespace <name> --dry-run false --provider <id>=<https-origin> --provider-token-file <path> --provider <id>=<https-origin> --provider-token-file <path>",
      "implemented": true,
      "mode": "local-signed-ipns",
      "requires": [
        "local-operator-identity",
        "two-distinct-storage-providers",
        "ipns-router"
      ]
    },
    "hosted-passkey-publish": {
      "implemented": true,
      "command": "kotoba library publish --store <dir> --namespace <name> --hosted --dry-run false --provider <id>=<https-origin> --provider-token-file <path> --provider <id>=<https-origin> --provider-token-file <path>",
      "control-origin": "https://kotoba.cloud",
      "identity-origin": "https://auth.kotoba.cloud",
      "endpoint": "https://kotoba.cloud/v1/libraries/publish",
      "authority": [
        "local-publisher-signature",
        "passkey-session"
      ],
      "secret-boundary": "url-fragment-carries-signed-record-only"
    },
    "catalog": {
      "origin": "https://kotoba-lang.org",
      "path": "/libraries/",
      "machine-path": "/.well-known/kotoba-libraries.json"
    },
    "storage": {
      "origin": "https://kotobase.net",
      "purpose": "immutable-cid-blocks-and-receipts",
      "distributed-qualification": {
        "minimum-byte-complete-storage-providers": 2,
        "minimum-delegated-routing-peer-ids": 2,
        "proof-schema": "kotoba.library-availability.v1"
      }
    },
    "verify": {
      "command": "kotoba library verify ipfs://<release-cid> --store <dir> --provider <id>=<https-origin> --provider <id>=<https-origin>",
      "implemented": true,
      "effect": "network-read-and-local-proof"
    },
    "run": {
      "command": "kotoba library run ipfs://<release-cid> --entry <export> --store <dir> --provider <id>=<https-origin> --provider <id>=<https-origin>",
      "implemented": true,
      "effect": "verified-wasm-execution"
    }
  },
  "flow": [
    {
      "step": "inspect",
      "authority": "local-cli",
      "output": [
        "namespace-head-cid",
        "definition-cids",
        "dependency-cids"
      ]
    },
    {
      "step": "bundle",
      "authority": "local-cli",
      "output": [
        "release-cid",
        "wasm-artifact-cids",
        "compile-receipt-cids"
      ]
    },
    {
      "step": "authorize",
      "authority": "publisher-key",
      "output": [
        "publisher-did",
        "signed-head",
        "signed-release-link"
      ]
    },
    {
      "step": "replicate",
      "authority": "independent-storage-providers",
      "output": [
        "byte-complete-provider-observations"
      ]
    },
    {
      "step": "approve",
      "authority": "kotoba-cloud-passkey",
      "output": [
        "stable-principal",
        "active-controller"
      ]
    },
    {
      "step": "name",
      "authority": "kotobase-signature-gated-head",
      "output": [
        "ipns-name",
        "signed-sequence",
        "publication-receipt"
      ]
    },
    {
      "step": "discover",
      "authority": "kotoba-lang-org",
      "output": [
        "catalog-projection",
        "github-provenance"
      ]
    },
    {
      "step": "verify",
      "authority": "local-cli",
      "output": [
        "availability-proof-cid",
        "network-peer-ids"
      ]
    },
    {
      "step": "execute",
      "authority": "local-runtime",
      "output": [
        "verified-wasm-result"
      ]
    },
    {
      "step": "operate",
      "authority": "kotoba-cloud",
      "output": [
        "publication-history",
        "deploy-readiness"
      ]
    }
  ],
  "comparison-required": [
    "library-cid",
    "version-or-ref",
    "workload",
    "target",
    "host",
    "toolchain",
    "sample-count",
    "measurement-time",
    "result-verification",
    "receipt",
    "residual-limit"
  ],
  "negative-claims": [
    "A valid CID does not establish publisher authority.",
    "A GitHub repository or commit does not replace a definition or release CID.",
    "The public catalog is not a runtime dependency and does not grant capabilities.",
    "Passkey approval does not replace the local namespace signature or provider CID digest checks.",
    "One gateway, one storage origin, or one peer is not distributed availability.",
    "IPNI or DHT discovery does not prove storage; every named provider must serve every release byte."
  ]
}