feat(openontology): implement OpenOntology Phase 0 + local engine and CLI (#99)

Implements OpenPRD 0001 through Phase 0 (specification, schemas, example,
docs surface) and Phase 1 (local engine, CLI, conformance tests).

Schemas (17 contracts, JSON Schema Draft 2020-12, additionalProperties:false)
  manifest, namespace, entity-type, property, relationship-type, constraint,
  query, action, entity, claim, source, evidence, changeset, review, approval,
  event, package — registered in @logicsrc/validators and exported from
  @logicsrc/schemas under https://logicsrc.com/schemas/openontology/.

@logicsrc/openontology
  - canonical JSON + sha256 package digests; YAML, JSON, NDJSON, and inline
    authoring all compile to the same bytes, so digests are authoring-agnostic
  - id profile: compact / IRI / urn with one canonicalization rule, prefix
    bound by a Namespace object so IRIs reverse unambiguously
  - validation: schema, graph (domain/range, datatypes, dangling refs),
    provenance (source-or-firstParty, agent runId, derivation inputs), policy
    (excerpt limits, licensing, visibility, staleness) and declared
    constraints; four severities, stable codes, text/json/yaml/markdown
  - portable triple-pattern query AST: multi-hop, 14 operators, asOf and
    recordedAsOf, per-status filtering, distinct/order/limit, explanation
    mode, and enforced depth/binding/row limits
  - append-only store: claims are immutable; dispute/retract/supersede append
    status transitions and the effective status is the latest one
  - change sets: 9 operations, atomic pre-flight, conflict detection on stale
    base revisions, semantic diff with duplicate-identity warnings and
    affected-query deltas, per-operation reviewer decisions
  - policy: agents propose but can never apply — the denial keys on actor
    type, so every scope plus high confidence plus --yolo still cannot apply;
    merges need approval, bulk retractions need two, undeclared action side
    effects are denied
  - JSON-LD 1.1 export/import with PROV-O aliases and lossy-field reporting
  - pluggable signature envelope with a jws-ed25519 reference profile and a
    fail-closed trust policy

CLI: logicsrc ontology init|validate|lint|build|inspect, entity, claim, query,
changeset, import, export, audit. Reads take --format, writes default to a
proposal, exit codes are stable for CI.

Example: examples/openontology/ethereum-ecosystem — 12 entity types, 17
relationship types, 63 entities, 169 claims, 25 sources, 31 evidence records,
5 saved queries, every claim lifecycle state, and a pending merge proposal.
All data is fictional; the directory is removable without affecting any core
test.

Docs: docs/openontology{,-governance,-interoperability}.md, a real
/openontology route, homepage + nav + sitemap entries, and a root README
section.

Verification: 112 new tests; full monorepo build and every workspace test
pass; conformance bundle (18 valid + 13 invalid fixtures) runs against the
published schemas alone; Node.js 25 and Bun 1.3 produce byte-identical
digests, revisions, event trails, and query results.

Not included (later PRD phases): MCP resources, REST/SSE, Turso adapter, TUI
and PWA surfaces, RDF/SHACL mappings, source adapters, governed actions.

Refs: prd/0001-add-logicsrc-openontology-spec.md

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/openontology/src/runtime-parity.test.ts

@@ -0,0 +1,86 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const DIST = resolve(HERE, "../dist/index.js");
+const EXAMPLE = resolve(HERE, "../../../examples/openontology/ethereum-ecosystem");
+
+/**
+ * Node.js and Bun must produce byte-identical output (R145/R208).
+ *
+ * The engine takes an injected clock and id factory precisely so this can be
+ * asserted rather than hoped for. Runs against the built dist, and skips when
+ * the package has not been built or Bun is not installed.
+ */
+const PROGRAM = `
+import { buildOntologyPackage, canonicalize, createOntologyEngine, loadOntologyPackage, localActor } from ${JSON.stringify(DIST)};
+
+const pkg = loadOntologyPackage(${JSON.stringify(EXAMPLE)});
+const built = buildOntologyPackage(pkg);
+
+let n = 0;
+const engine = createOntologyEngine({
+  package: pkg,
+  actor: localActor("curator@example.org"),
+  clock: () => "2026-07-26T00:00:00Z",
+  idFactory: (kind) => kind + ":" + String(++n).padStart(4, "0")
+});
+
+const changeSet = engine.createOntologyChangeSet({
+  title: "runtime parity",
+  operations: [
+    {
+      op: "assert-claim",
+      value: {
+        subject: "eth:person:avery-lindqvist",
+        predicate: "worksOn",
+        object: { entity: "eth:project:docs-portal" },
+        sources: ["eth:source:roadmap-2026"]
+      }
+    }
+  ]
+});
+engine.approveOntologyChangeSet(changeSet.id);
+const applied = engine.applyOntologyChangeSet(changeSet.id);
+
+console.log(canonicalize({
+  digest: built.digest,
+  revision: applied.revision,
+  events: applied.events.map((e) => ({ id: e.id, type: e.type, at: e.at })),
+  rows: engine.queryOntology("orgs-behind-a-network").rows.map((r) => r.bindings)
+}));
+`;
+
+function bunAvailable(): boolean {
+  try {
+    execFileSync("bun", ["--version"], { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const runnable = existsSync(DIST) && bunAvailable();
+const describeParity = runnable ? describe : describe.skip;
+
+describeParity("Node.js / Bun parity", () => {
+  it("produces an identical digest, revision, event trail, and result set", () => {
+    const dir = mkdtempSync(join(tmpdir(), "openontology-parity-"));
+    const script = join(dir, "parity.mjs");
+    writeFileSync(script, PROGRAM, "utf8");
+
+    try {
+      const fromNode = execFileSync(process.execPath, [script], { encoding: "utf8" }).trim();
+      const fromBun = execFileSync("bun", [script], { encoding: "utf8" }).trim();
+
+      expect(fromBun).toBe(fromNode);
+      expect(JSON.parse(fromNode).revision).toBe("data-000001");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});