feat(openontology): implement OpenOntology Phase 0 + local engine and CLI (#99)

Implements OpenPRD 0001 through Phase 0 (specification, schemas, example,
docs surface) and Phase 1 (local engine, CLI, conformance tests).

Schemas (17 contracts, JSON Schema Draft 2020-12, additionalProperties:false)
  manifest, namespace, entity-type, property, relationship-type, constraint,
  query, action, entity, claim, source, evidence, changeset, review, approval,
  event, package — registered in @logicsrc/validators and exported from
  @logicsrc/schemas under https://logicsrc.com/schemas/openontology/.

@logicsrc/openontology
  - canonical JSON + sha256 package digests; YAML, JSON, NDJSON, and inline
    authoring all compile to the same bytes, so digests are authoring-agnostic
  - id profile: compact / IRI / urn with one canonicalization rule, prefix
    bound by a Namespace object so IRIs reverse unambiguously
  - validation: schema, graph (domain/range, datatypes, dangling refs),
    provenance (source-or-firstParty, agent runId, derivation inputs), policy
    (excerpt limits, licensing, visibility, staleness) and declared
    constraints; four severities, stable codes, text/json/yaml/markdown
  - portable triple-pattern query AST: multi-hop, 14 operators, asOf and
    recordedAsOf, per-status filtering, distinct/order/limit, explanation
    mode, and enforced depth/binding/row limits
  - append-only store: claims are immutable; dispute/retract/supersede append
    status transitions and the effective status is the latest one
  - change sets: 9 operations, atomic pre-flight, conflict detection on stale
    base revisions, semantic diff with duplicate-identity warnings and
    affected-query deltas, per-operation reviewer decisions
  - policy: agents propose but can never apply — the denial keys on actor
    type, so every scope plus high confidence plus --yolo still cannot apply;
    merges need approval, bulk retractions need two, undeclared action side
    effects are denied
  - JSON-LD 1.1 export/import with PROV-O aliases and lossy-field reporting
  - pluggable signature envelope with a jws-ed25519 reference profile and a
    fail-closed trust policy

CLI: logicsrc ontology init|validate|lint|build|inspect, entity, claim, query,
changeset, import, export, audit. Reads take --format, writes default to a
proposal, exit codes are stable for CI.

Example: examples/openontology/ethereum-ecosystem — 12 entity types, 17
relationship types, 63 entities, 169 claims, 25 sources, 31 evidence records,
5 saved queries, every claim lifecycle state, and a pending merge proposal.
All data is fictional; the directory is removable without affecting any core
test.

Docs: docs/openontology{,-governance,-interoperability}.md, a real
/openontology route, homepage + nav + sitemap entries, and a root README
section.

Verification: 112 new tests; full monorepo build and every workspace test
pass; conformance bundle (18 valid + 13 invalid fixtures) runs against the
published schemas alone; Node.js 25 and Bun 1.3 produce byte-identical
digests, revisions, event trails, and query results.

Not included (later PRD phases): MCP resources, REST/SSE, Turso adapter, TUI
and PWA surfaces, RDF/SHACL mappings, source adapters, governed actions.

Refs: prd/0001-add-logicsrc-openontology-spec.md

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/openontology/src/ids.ts

@@ -0,0 +1,76 @@
+/**
+ * The OpenOntology identifier profile.
+ *
+ * PRD open question 1 asked whether ids should be HTTP IRIs, `urn:logicsrc:`
+ * identifiers, or package-qualified compact ids. This implementation permits
+ * all three and defines ONE canonicalization rule, so every form resolves to a
+ * single IRI for export, comparison, and interop:
+ *
+ *   compact   ethereum:person:alice
+ *             -> <namespace>person/alice        (namespace from the manifest)
+ *   IRI       https://example.org/person/alice  -> unchanged
+ *   URN       urn:logicsrc:ethereum:person:alice -> unchanged
+ *
+ * Authoring SHOULD use the compact form: it is short, diffable, and stays
+ * stable when a package moves to a different namespace.
+ */
+
+export type IdForm = "compact" | "iri" | "urn";
+
+const COMPACT_RE = /^[a-z0-9][a-z0-9-]*(:[A-Za-z0-9][A-Za-z0-9._-]*)+$/;
+
+export function idForm(id: string): IdForm | null {
+  if (/^https?:\/\//i.test(id)) return "iri";
+  if (/^urn:[a-z0-9][a-z0-9-]{0,31}:/i.test(id)) return "urn";
+  if (COMPACT_RE.test(id)) return "compact";
+  return null;
+}
+
+export function isValidId(id: string): boolean {
+  return idForm(id) !== null;
+}
+
+/** The prefix of a compact id (`ethereum` in `ethereum:person:alice`), else null. */
+export function idPrefix(id: string): string | null {
+  return idForm(id) === "compact" ? (id.split(":")[0] ?? null) : null;
+}
+
+/**
+ * Canonicalize any accepted id form to a single resolvable IRI.
+ * `namespaces` maps compact prefixes to base IRIs; `defaultNamespace` is the
+ * package's own namespace, used when the prefix is unknown or omitted.
+ */
+export function toIri(
+  id: string,
+  options: { defaultNamespace: string; namespaces?: Record<string, string> }
+): string {
+  const form = idForm(id);
+  if (form === "iri" || form === "urn") return id;
+  if (form !== "compact") {
+    throw new Error(`Not a valid OpenOntology id: ${JSON.stringify(id)}`);
+  }
+
+  const [prefix, ...rest] = id.split(":");
+  const base = options.namespaces?.[prefix as string] ?? options.defaultNamespace;
+  const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+  return `${normalizedBase}${rest.map(encodeURIComponent).join("/")}`;
+}
+
+/** True when a query term is a variable (`?person`) rather than a constant. */
+export function isVariable(term: string): boolean {
+  return typeof term === "string" && term.startsWith("?") && term.length > 1;
+}
+
+/**
+ * Deterministic object ids. Sequence-based rather than random so a build, an
+ * applied change set, and a test run produce byte-identical output under both
+ * Node.js and Bun.
+ */
+export function createIdFactory(prefix: string, start = 1): () => string {
+  let n = start;
+  return () => `${prefix}:${String(n++).padStart(6, "0")}`;
+}
+
+export function revisionId(kind: "data" | "schema", n: number): string {
+  return `${kind}-${String(n).padStart(6, "0")}`;
+}