# description
The single artifact YSDK adds on top of W3C DID, UCAN v1.0.0, MCP and the W3C Web Application Manifest. Served at /.well-known/ysdk.app.json and signed by the application's DID key. Draft 1, 2026-08-30.

# properties.ysdkVersion.description
The YSDK specification revision this manifest conforms to.

# properties.did.description
The application's decentralized identifier, issued by and resolvable through ydid.org. This is the app's permanent name in the ecosystem. Everything else may change; this SHOULD NOT.

# properties.identity.description
Crypto-agility block. Every cryptographic artifact this app produces MUST carry these identifiers. Required because the classical half of any hybrid is on a deadline (NIST draft IR 8547 after 2035; Australia's ASD after 2030).

# properties.identity.properties.signature.properties.multicodec.description
Registry codepoint, e.g. 0x1212 for mldsa-87-pub. Codepoints are currently draft; record the one used rather than assuming it.

# properties.identity.properties.signature.properties.hybridWith.description
Classical companion algorithm, if hybrid. Null once PQC-only.

# properties.identity.properties.signature.properties.sunsetAfter.description
Date after which the classical half must be gone. Null if not hybrid.

# properties.identity.properties.kdf.description
Only where the app derives keys from a passphrase. Parameters are recorded so a file can always be upgraded lazily; a file that does not say how it was derived can never be upgraded.

# properties.identity.properties.kdf.properties.memoryKiB.description
OWASP floor is 19456 KiB (19 MiB) at t=2, p=1. Values below the floor MUST NOT be written.

# properties.identity.properties.kdf.properties.implementation.description
Runtime matters: pure-JS Argon2 slows only the defender. WASM required.

# properties.app.properties.tagline.description
One sentence a non-technical reader understands.

# properties.app.properties.domain.description
The app's own domain. It MUST run fully here with no YOS present.

# properties.app.properties.webManifest.description
Path to the W3C Web Application Manifest. YSDK does not duplicate what appmanifest defines.

# properties.app.properties.license.description
SPDX identifier. MIT and Apache-2.0 pass the wall; AGPL is prohibited.

# properties.brand.description
Palette is DATA here, never hardcoded in CSS. A room's colour MUST be changeable by editing this manifest alone.

# properties.brand.properties.paletteSource.description
Where the values came from, with fetch date. Never a value copied from a design document.

# properties.brand.properties.contrastVerified.description
True only if verified by an automated check, at every viewport, in both canvas and room interior.

# properties.modes.properties.use.description
Hosted, no download. MUST be supported — an app requiring installation to be evaluated will not be adopted.

# properties.modes.properties.offline.properties.doesNotWorkOffline.description
Stated equally honestly. A blank pane is not a failure state.

# properties.modes.properties.seed.description
Serving other people's traffic on the operator's hardware. Every field here is an obligation, not a hint.

# properties.modes.properties.seed.properties.maxConcurrentPeers.description
Declared AND enforced. A seed accepting more peers than it can serve fails everyone including its operator.

# properties.modes.properties.seed.properties.peerAccessCapabilityGated.description
A seed does not serve anonymous unbounded traffic.

# properties.mcp.description
The harvestable surface. YSDK does not define an RPC protocol — it uses MCP.

# properties.mcp.properties.tools.items.properties.requiresCapability.description
The UCAN capability a caller must hold. Empty string means public.

# properties.mcp.properties.tools.items.properties.sideEffects.description
True if calling it changes state. Consumers surface confirmation for these.

# properties.capabilities.description
UCAN v1.0.0 grammar. YSDK does not define a capability format — it uses UCAN, whose Delegation, Invocation, Promise and Revocation sub-specifications already exist.

# properties.capabilities.properties.grammar.items.properties.resourceScope.description
The granularity a grant can be narrowed to.

# properties.capabilities.properties.revocation.properties.permanent.description
Revocation records are append-only and exempt from every GC horizon. A forgotten revocation re-accepts a compromised credential, silently, forever.

# properties.capabilities.properties.revocation.properties.independentlyVerifiable.description
Verification MUST NOT require trusting the issuer. A revocation only the issuer can confirm is decorative.

# properties.agent.description
L5 only. The agent is an enhancement, never a dependency.

# properties.agent.properties.knowledgePartition.description
Identifier of this app's own partition. Not a shared index.

# properties.agent.properties.appFunctionsWithoutAgent.description
MUST be true and MUST be verified by exercising the app end to end with the agent layer dark.

# properties.agent.properties.delegationCredential.description
The revocable UCAN binding this agent to act for this app. Scoped and expiring.

# properties.upgrade.description
Live and seamless describes the USER's experience. It does not mean unreviewed.

# properties.upgrade.properties.policy.description
automatic-patch: patches inside the declared range may be accepted automatically. Anything changing an interface, capability grammar, cryptographic parameter or permission MUST be explicit regardless of this setting.

# properties.upgrade.properties.rollbackSupported.description
Rollback to the prior pinned version MUST be possible without data loss.

# properties.upgrade.properties.acceptanceLog.description
Every acceptance and rollback recorded with who, what, when.

# properties.ledger.description
L6 only. MEASUREMENT ONLY. This schema does not define, authorise or describe issuance, allocation, sale or distribution of anything of value.

# properties.ledger.properties.distributionDefined.description
Always false. Distribution is out of scope for YSDK and belongs to counsel and a separate instrument.

# properties.conformance.properties.evidence.description
A conformance claim is worth nothing without the run behind it.

# properties.conformance.properties.evidence.properties.revocationObservedRefusingAccess.description
OBSERVED, not tested. A passing test is insufficient evidence for L3.

# properties.conformance.properties.evidence.properties.runsStandaloneWithNoYos.description
Verified by running it that way on a machine that has never seen YOS.

# properties.conformance.properties.evidence.properties.guardsDrilledWithRefusedInput.description
Count of guards proven by feeding them the input they exist to refuse.

# properties.attestations.description
What has ACTUALLY been verified, by whom, when. Absence of an audit is stated plainly rather than omitted.

# properties.attestations.properties.independentSecurityAudit.description
Null means NOT AUDITED. An app MUST NOT claim audited, certified or compliant status unless a third party has said so in writing.

# properties.attestations.properties.notReviewed.description
Stated explicitly. Silence is not permission.