Skip to content

feat(ontology): company directors, roles, delegations, delegated signatures and shareholdings #1191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coodos merged 3 commits into from
Oct 7, 2026
Merged

feat(ontology): company directors, roles, delegations, delegated signatures and shareholdings #1191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
924afdc
feat(ontology): company directors, roles, delegations, delegated sign…
coodos Oct 7, 2026
1179977
fix(ontology): tighten scope, reference, holder, director and revocat…
coodos Oct 7, 2026
e515484
fix(ontology): reject empty references and signatures, whitespace eNa…
coodos Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 46 additions & 1 deletion services/ontology/schemas/company.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,16 @@
"type": "string",
"description": "MetaEnvelope ID of the canonical GroupManifest"
},
"directors": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"description": "eNames of the directors. Any one director may create roles and grant delegations; only an existing director may change this list. The creator is the first director."
},
"legalName": {
"type": "string",
"description": "Registered legal name"
Expand Down Expand Up @@ -62,6 +72,36 @@
"updatedAt": {
"type": "string",
"format": "date-time"
},
"authorization": {
"type": "object",
"description": "The wallet signature, over this record's canonical form (`w3ds-grant/v1`), of the director who set or last changed `directors`: the creator for the first version, then an existing director. The eVault verifies it before accepting the write.",
Comment thread
coodos marked this conversation as resolved.
"properties": {
"signerEName": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"signedPayload": {
"type": "string",
"description": "The exact canonical string that was signed",
"minLength": 1
},
"signature": {
"type": "string",
"minLength": 1
},
"signedAt": {
"type": "string",
"format": "date-time"
}
},
"required": [
"signerEName",
"signedPayload",
"signature",
"signedAt"
],
"additionalProperties": false
}
},
"required": [
Expand All @@ -70,5 +110,10 @@
"createdAt",
"updatedAt"
],
"additionalProperties": false
"additionalProperties": false,
"dependencies": {
"directors": [
"authorization"
]
}
}
74 changes: 74 additions & 0 deletions services/ontology/schemas/delegatedSignature.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"schemaId": "e2736a06-176e-4004-8fda-b40b9a132669",
"title": "DelegatedSignature",
"domain": "governance",
"description": "Audit record of a signature made for a company under a Delegation. Written to the company's eVault by the platform that verified it.",
"type": "object",
"properties": {
"companyEName": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"signerEName": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"delegationId": {
"type": "string",
"description": "MetaEnvelope id of the Delegation used",
"minLength": 1
},
"title": {
"type": "string",
"description": "The signer's title at signing time"
},
"scope": {
"type": "string",
"pattern": "^(ontology:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
"description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
},
"documentHash": {
"type": "string",
"description": "Hash of what was signed, as named in the payload"
Comment thread
coodos marked this conversation as resolved.
},
"session": {
"type": "string"
},
"signedPayload": {
"type": "string",
"description": "The exact `w3ds-sign/v1` string the wallet signed",
"minLength": 1
},
"signature": {
"type": "string",
"minLength": 1
},
"platformEName": {
"type": "string",
"pattern": "^@[^\\s]+$",
"description": "Platform that requested, verified and recorded the signature"
},
"signedAt": {
"type": "string",
"format": "date-time"
},
"createdAt": {
"type": "string",
"format": "date-time"
}
},
"required": [
"companyEName",
"signerEName",
"delegationId",
"scope",
"documentHash",
"signedPayload",
"signature",
"platformEName",
"signedAt",
"createdAt"
],
"additionalProperties": false
}
226 changes: 226 additions & 0 deletions services/ontology/schemas/delegation.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,226 @@
{
"$schema": "http://json-schema.org/draft-07/schema#",
"schemaId": "0b2f15d8-c3f9-4dba-b959-5cfa11272dae",
"title": "Delegation",
"domain": "governance",
"description": "Lets a person sign for a company within some scopes. Either assigns a Role (granted by a director) or narrows a parent Delegation (re-delegation, only when the parent allows it). Lives in the company's eVault and is public so verifiers can check it.",
"type": "object",
"properties": {
"companyEName": {
"type": "string",
"pattern": "^@[^\\s]+$",
"description": "eName of the company eVault"
},
"delegateEName": {
"type": "string",
"pattern": "^@[^\\s]+$",
"description": "Who may sign for the company"
},
"roleId": {
"type": "string",
"description": "MetaEnvelope id of the Role this assigns",
"minLength": 1
},
"parentDelegationId": {
"type": "string",
"description": "MetaEnvelope id of the Delegation this narrows",
"minLength": 1
},
"title": {
"type": "string",
"minLength": 1,
"maxLength": 80
},
"scopes": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"type": "string",
"pattern": "^(ontology:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
"description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
},
"description": "Must be a subset of the role's or parent's scopes"
},
"appLimits": {
"type": "object",
"description": "May only tighten the parent's app limits"
},
"mayRedelegate": {
"type": "boolean"
},
"validFrom": {
"type": "string",
"format": "date-time"
},
"validUntil": {
"type": [
"string",
"null"
],
"format": "date-time"
},
"grantedBy": {
"type": "string",
"pattern": "^@[^\\s]+$",
"description": "The director, or the parent delegation's delegate"
},
"status": {
"type": "string",
"enum": [
"active",
"revoked"
]
},
"revokedAt": {
"type": [
"string",
"null"
],
"format": "date-time"
Comment thread
coodos marked this conversation as resolved.
},
"revokedBy": {
"type": [
"string",
"null"
]
},
"revocationReason": {
"type": [
"string",
"null"
],
Comment thread
coodos marked this conversation as resolved.
"enum": [
"revoked",
"cascade",
null
],
"description": "`cascade` when revoked because a role or parent was revoked or narrowed"
},
"createdAt": {
"type": "string",
"format": "date-time"
},
"updatedAt": {
"type": "string",
"format": "date-time"
},
"authorization": {
"type": "object",
"description": "The wallet signature of the grantor over this record's canonical form (`w3ds-grant/v1`). The eVault verifies it before accepting the write.",
"properties": {
"signerEName": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"signedPayload": {
"type": "string",
"description": "The exact canonical string that was signed",
"minLength": 1
},
"signature": {
"type": "string",
"minLength": 1
},
"signedAt": {
"type": "string",
"format": "date-time"
}
},
"required": [
"signerEName",
"signedPayload",
"signature",
"signedAt"
],
"additionalProperties": false
}
},
"required": [
"companyEName",
"delegateEName",
"title",
"scopes",
"mayRedelegate",
"grantedBy",
"status",
"createdAt",
"updatedAt",
"authorization"
],
"additionalProperties": false,
"allOf": [
{
"oneOf": [
{
"required": [
"roleId"
],
"not": {
"required": [
"parentDelegationId"
]
}
},
{
"required": [
"parentDelegationId"
],
"not": {
"required": [
"roleId"
]
}
}
]
},
{
"if": {
"properties": {
"status": {
"const": "revoked"
}
},
"required": [
"status"
]
},
"then": {
"required": [
"revokedAt",
"revokedBy",
"revocationReason"
],
"properties": {
"revokedAt": {
"type": "string",
"format": "date-time"
},
"revokedBy": {
"type": "string",
"pattern": "^@[^\\s]+$"
},
"revocationReason": {
"enum": [
"revoked",
"cascade"
]
}
}
},
"else": {
"properties": {
"revokedAt": {
"type": "null"
},
"revokedBy": {
"type": "null"
},
"revocationReason": {
"type": "null"
}
}
}
}
]
}
Loading
Loading