Add provenance schema contract for v0.3.0

docs/provenance/README.md

@@ -1,9 +1,11 @@
 # Thinkloom provenance specification
 
-This directory contains the approved Stage 1 normative specification for the Thinkloom 1.0 provenance subsystem.
+This directory contains the approved normative specification and formal Stage 2 contract for the Thinkloom 1.0 provenance subsystem.
 
 - [Stage 1 Normative Specification](STAGE-1-NORMATIVE-SPECIFICATION.md)
 - [State Machines and Recovery Protocols](STATE-MACHINES.md)
 - [Stage 1 Completion Checklist](COMPLETION-CHECKLIST.md)
+- [Stage 2 Completion and Verification](STAGE-2-SCHEMA-PACKAGE.md)
+- [Stage 2 JSON Schema package](../../schemas/provenance/v1/README.md)
 
-These documents govern future schema and implementation work. They do not describe the current 0.2.0 implementation as already compliant.
+Thinkloom 0.3.0 includes the 38-schema Draft 2020-12 package, valid and invalid fixtures, and deterministic conformance vectors. The native writer does not yet implement this contract and must not be represented as conforming until the later implementation and fault-injection stages are complete.

docs/provenance/STAGE-1-NORMATIVE-SPECIFICATION.md

@@ -11,7 +11,7 @@ This specification defines the authority, persistence, integrity, privacy, recov
 
 It supersedes the provenance-specific transaction order, single-ledger layout, mutable-record assumptions, live-database snapshot method, and release-binding sequence in the earlier MVP architecture and implementation plans. It does not supersede their product requirements, native Tauri boundary, preview-first generation model, user-control requirements, accessibility requirements, or prohibition on retained audio.
 
-The current Thinkloom 0.2.0 implementation is not represented as conforming to this specification. Conformance begins only after the Stage 2 schemas, fixtures, native implementation, and required fault-injection tests are complete.
+Thinkloom 0.3.0 includes the formal Stage 2 schemas and verification vectors, but its native writer is not represented as conforming to this specification. Full conformance begins only after the native implementation and required fault-injection tests are complete.
 
 ## 2. Normative language
 

docs/provenance/STAGE-2-SCHEMA-PACKAGE.md

@@ -0,0 +1,57 @@
+# Thinkloom Stage 2 Provenance Schema Package
+
+Status: **Complete for Thinkloom 0.3.0**
+Schema family: **1.0**
+Dialect: **JSON Schema Draft 2020-12**
+Runtime conformance: **Not yet implemented**
+
+## Scope
+
+Stage 2 formalizes the approved provenance architecture without changing native application behavior. It provides deterministic contracts and verification evidence for the later native-writer implementation. Migration support remains deferred until after Thinkloom 1.0.0.
+
+## Package
+
+The machine-readable package is in [`schemas/provenance/v1`](../../schemas/provenance/v1/README.md). `catalog.json` identifies all 38 schemas, the schema and application versions, compatibility, fixture locations, and the generator.
+
+Each schema has:
+
+- one valid canonical fixture;
+- invalid cases for every top-level required field and the closed-object policy;
+- populated nested cases for enum, const, pattern, numeric, string, and array bounds; and
+- explicit conditional failures for protected records and recovery envelopes where ordinary keyword mutation is insufficient.
+
+## Deterministic vectors
+
+The vector suite covers:
+
+- RFC 8785-compatible serialization after Thinkloom Unicode NFC preprocessing;
+- prohibited non-finite, undefined, and NFC-colliding values;
+- exact millisecond UTC timestamps and repository-relative path restrictions;
+- LF-only canonical JSONL, contiguous events, event self-digests, and cross-segment seals;
+- prompt-template, protected-record, event, and release self-digest identities;
+- minimal and full-private retention behavior;
+- device and recovery key envelopes plus key rotation;
+- non-mutating sanitized exports and omission-rule disclosure;
+- deterministic derived indexes;
+- backup and release manifests plus the release-files Merkle root; and
+- all verification statuses and finding severities.
+
+## Verification
+
+Regenerate deterministically:
+
+```powershell
+npm run provenance:schema:generate
+```
+
+Validate schemas, fixtures, and vectors:
+
+```powershell
+npm run provenance:schema:test
+```
+
+The schema tests are also part of `npm test`. Generated output must be committed with its generator and tests. A clean regeneration is required before changing any formal schema or vector.
+
+## Next boundary
+
+Thinkloom 0.3.0 must not claim native provenance conformance. The next implementation stage replaces the MVP persistence path with the approved single-writer protocol and then executes the durable-boundary fault-injection matrix.