P0: SPEC.md completeness: fold verify, representations, frame identity, and consent scopes into the normative home (restore context-reuse §3)

[macanderson]

⚠️ Blocking contradiction: the verify correlation id

SPEC §9's own normative verify example was validated against this repo's schema/contextgraph-envelope.schema.json and comes back INVALID. The example carries a correlation id; the schema's verify/verified envelopes do not admit one. A normative example that fails the repository's own schema is the single worst state this spec can be in before a freeze — it means the two artifacts a downstream implementer would copy from disagree with each other.

Resolve it one way or the other before the freeze: either add id to verify/verified (a wire change, and therefore not addable later) or strike it from the example. Doing nothing also settles H4 by accident, in the direction that leaves an error reply to a verify uncorrelatable.

---

SPEC.md declares itself the single normative home (SPEC.md:5), but four shipped normative wire surfaces are absent from it:

• The verify/verified exchange (V1–V4): present in the schema (schema/contextgraph-envelope.schema.json:20-24, 125-145) and the wire enum (contextgraph-host/src/wire.rs:86-88), missing from §2.1's envelope vocabulary (SPEC.md:56-57) and from the body of the spec. — folded into SPEC.md in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60
• Frame representations (representation, content_ref, canonical_content_hash, transform, tokenizer_ref): normative in the schema and ADR 0005, but SPEC.md has no representations section at all; B3 is stated only for inline content. — folded into SPEC.md in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60. Residual carried in from Decide context/resolve before the freeze: specify it or cut reference representations — and define B3 for compact/reference frames #50: the schema's tokenizer_ref $comment still contradicts the new normative text.
• Frame identity / content_digest (D1–D4) and usage reports (U1). — frame identity (D1–D4) folded into SPEC.md in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60. Usage reports are still absent from SPEC.md entirely, and the U1 anchor collides with an existing anchor, which breaks the stable-anchor promise SPEC.md makes about itself.
• Consent scopes and receipts (C5/C6): the normative text — docs/context-reuse.md §3 — was destroyed by the PR feat: context/verify — pull-based frame revalidation #38 merge (present at d229ed9, gone at 6851d1d; the doc's headings now jump §2 → §4). The TOC (docs/context-reuse.md:13), the schema (lines 276, 288), the consent-scope conformance check (contextgraph-conformance/src/lib.rs:51,586), and protocol-surface's C5/C6 rows all cite a section that no longer exists. — restored/relocated in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60; the dangling references now resolve

Authority is also triple-claimed: docs/protocol-surface.md:316 calls its own table "the consolidated, authoritative list" while its header (lines 3–7) defers to SPEC.md, and GOVERNANCE.md points at protocol-surface.md#conformance-requirements as the conformance contract. Pick one. — Settled in #60: authority is single. docs/protocol-surface.md and GOVERNANCE.md both defer to SPEC.md.

Small true-ups that belong in the same pass:

• §9's error table (SPEC.md:325-332) lacks a code for H3's version-mismatch "named error", and unsupported_representation (normative in contextgraph-types/src/query.rs:51) is absent — X1 makes unknown codes read as internal ("count against health"), the wrong reaction to a permanent incompatibility. — still open; the two missing ErrorCode variants are tracked alongside P1: Structured error codes on the wire #9.
• verify/verified envelopes carry no correlation id while query/frames/error do (H4) — a correlation-capable provider cannot pipeline verify, and an error reply to a verify is uncorrelatable. Decide before the freeze; adding it later is a wire change. — still open, and now self-contradictory; see the callout at the top of this issue.

Acceptance

• Every surface docs/protocol-surface.md lists as normative appears in SPEC.md. — verify, representations, frame identity and consent scopes all landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60; usage reports (U1) are the last surface still missing.
• context-reuse §3 restored (recoverable from d229ed9) or its content relocated, with all dangling references fixed. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60
• One consistent authority statement across SPEC.md / protocol-surface.md / GOVERNANCE.md. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60

---

The four survivors (2026-07-26)

1. The verify-id contradiction — a normative SPEC example that fails this repo's own schema (see the callout above). Highest priority; it is a wire decision, so it cannot slip past the freeze.
2. Usage reports (U1) — absent from SPEC.md entirely, and the U1 anchor collides with an existing one, breaking the stable-anchor guarantee.
3. The §9 error-table gaps — no code for H3 version-mismatch (incompatible_version), no unsupported_representation. Shares a fix with P1: Structured error codes on the wire #9.
4. The tokenizer_ref schema $comment — contradicts the representations text folded in by Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60. Carried in from Decide context/resolve before the freeze: specify it or cut reference representations — and define B3 for compact/reference frames #50, which closed as decided.

[macanderson]

Folded from the #27 adaptive-context reconciliation (#27 delta table, row A7/D5)

The bundle's frame-representation model (full\|compact\|reference, content_fidelity, canonical_content_hash, content_ref, transform) matches what CGP already implements (ADR 0005) — the reconciliation confirms it's already upstream, so this issue's job is unchanged: get it into SPEC.md. One naming reconciliation to record while doing so: the build prompt's content_hash is CGP's content_digest (already noted in ADR 0005 §"two names for two hashes") — keep CGP's name.

Also in scope here per the delta table: add unsupported_representation (normative in query.rs) and an H3 version-mismatch code to §9's error table, so a permanent incompatibility doesn't read as internal under X1.

[macanderson]

Re-verified 2026-07-26 against origin/main @ 1ee9b1c.

⚠️ Live defect: SPEC §9's own verify example is INVALID against this repo's schema

The §9 example was validated against the repository's own JSON Schema. It fails.

• SPEC.md:444 carries "id": "v1" on the verify envelope.
• SPEC.md:107 limits id to the query / frames / error envelopes only.
• wire.rs:86 has no such field on the verify type.
• The schema sets additionalProperties: false.

So the normative example in the section that defines verification cannot be produced by the reference implementation and is rejected by the reference schema. Removing the id line makes it validate. This is the highest-priority item in the issue: a spec that fails its own machine-checkable contract is the exact failure mode the freeze is supposed to prevent.

What landed (PR #60): most of this issue. Authority is now genuinely single — protocol-surface.md and GOVERNANCE.md both defer to SPEC.md, so the "single normative home" premise holds.

What survives: four items, including a U1 anchor collision that breaks the stable-anchor promise this spec makes elsewhere, and usage reports, which are still absent from SPEC.md entirely despite being a shipped wire surface.

Recommended scope: keep the issue, but rewrite it around the residue rather than the original four-item list — most of that list is done and the body now over-states the gap. Fix the verify-id contradiction first; it is a one-line edit with a schema-verifiable outcome.