# v0.14.2 — Provisioning Lifecycle Records

PEAC records what an external system reports happened when services,
accounts, resources, credentials, payment authorizations, budgets,
subscriptions, domains, or deployments are provisioned through external
providers. Caller systems (agents, agent-driven workflows, control
planes, CLIs, or providers themselves) report what happened; PEAC
records that report through a portable, signed interaction record.

This release adds the provisioning lifecycle extension namespace,
schema validator, conformance corpus, examples, operator recipe, and
related repository hygiene. No new public CLI verb. No new publishable
package. No wire format change. No registry expansion beyond the new
extension namespace and its 10 type URIs.

## Highlights

- New `org.peacprotocol/provisioning-lifecycle` extension namespace
  with 10 `*-observed` receipt-type URIs.
- Schema validator with recursive credential-material walker; 21
  stable error codes under the `provisioning.*` namespace.
- 29-vector cross-language parity corpus that self-describes its
  expected error codes per vector.
- Generic example, concrete sanitized demo, and an operator recipe.
- Repository hygiene: new public-example source gate; package-privacy
  invariant test; CLI command-handler hardening.

## New record surface: provisioning lifecycle

The `org.peacprotocol/provisioning-lifecycle` extension namespace
records observation of provisioning lifecycle events. Ten receipt-type
URIs cover the major event families:

```
org.peacprotocol/provisioning-catalog-observed
org.peacprotocol/provisioning-provider-link-observed
org.peacprotocol/provisioning-account-observed
org.peacprotocol/provisioning-resource-observed
org.peacprotocol/provisioning-credential-observed
org.peacprotocol/provisioning-payment-authorization-observed
org.peacprotocol/provisioning-budget-observed
org.peacprotocol/provisioning-subscription-observed
org.peacprotocol/provisioning-domain-observed
org.peacprotocol/provisioning-deployment-observed
```

The `*-observed` suffix makes the observer scope explicit at the
record-type layer. PEAC records what the issuer reports happened.
Authorization, legal acceptance, credential validation, payment
processing, provider-state claims, settlement, credential-vault
management, and runtime operation remain responsibilities of the
upstream systems and their operators.

The schema validator emits 21 stable error codes under the
`provisioning.*` namespace covering inline-credential rejection,
nested forbidden key names, opaque-ref grammar violations, storage
surface and material redaction enums, event-kind and sub-event closed
enums, scheme-id grammar, unrecognized fields, amount-minor canonical
form, RFC 3339 timestamp formats, ISO 4217 currency, structural
bounds (depth, nodes, string size), the U+FFFD replacement character,
and required-field presence. The recursive credential-material walker
is depth-aware and structure-bounded (default max depth 32, max nodes
10000, max string size 8192 bytes). The pattern panel is
vendor-neutral by design (`jwt_compact`, `bearer_token`,
`pem_private_key`, `env_assignment`,
`connection_string_with_credentials`); provider-prefix scanning belongs
to the public-artifact layer rather than the protocol schema.

## Conformance and parity

Conformance Section 31 `PROV-LIFE-001..010` adds 10 requirement IDs
covering the validator's structured-error contract.

The new parity corpus at
`specs/conformance/parity-corpus/provisioning-lifecycle/` is the first
v0.14.x family that self-describes both wire-envelope acceptance and
extension-level expected error codes. Negative vectors carry
`expected.errors[0].code = "provisioning.<X>"` so cross-language
implementations can read the JSON corpus directly. The wire-envelope
canonical-truth test in `@peac/protocol` filters dotted extension-level
codes via a family-scoped allowlist; unregistered dotted codes throw
a hard error to catch accidental misclassification.

The Go SDK parity loader floor enrols `provisioning-lifecycle` (29
vectors total: 10 positive plus 19 negative).

## Examples and operator recipe

- [`examples/provisioning-lifecycle/`](../../examples/provisioning-lifecycle/)
  — vendor-neutral generic demonstration with one fixture per
  `*-observed` event family, `pnpm issue`, and `pnpm verify`
  scripts.
- [`examples/agent-provisioning-demo/`](../../examples/agent-provisioning-demo/)
  — concrete sanitized demo showing an agent or operator-driven
  provisioning workflow (workspace init, resource provisioning,
  credential issuance, credential rotation) recorded through the
  canonical extension namespace.
- [`docs/SOLUTIONS/verify-agent-provisioning.md`](../SOLUTIONS/verify-agent-provisioning.md)
  — operator recipe for verifying reported provisioning lifecycle
  records offline.

## Repository hygiene

- New `scripts/verify-example-source-gate.mjs` checks committed
  examples, recipes, and parity corpora for live-shaped secrets and
  retired vocabulary. Wired into `scripts/gate.sh` fast and full
  modes.
- New `tests/tooling/workspace-package-privacy.test.ts` enforces
  three invariants on every `@peac/*` workspace package: packages
  with `private!==true` must be listed in
  `scripts/publish-manifest.json packages[]`; packages in the
  manifest must have `private!==true`; private packages must not
  carry `publishConfig`.
- 14 `@peac/*` workspace packages flipped from `private:false` to
  `private:true` to align metadata with the public package surface
  (which stays at 36 publishable packages).
- `@peac/cli` command handlers hardened against file-system-race
  patterns in command-output write paths.
- `packages/mappings/ucp` adds a prototype-pollution regression
  test.
- `integrator-kits/stripe-projects/README.md` modernized to the
  canonical extension namespace and 10 type URIs.

## Public surface

No new CLI command. No public schema or wire-format change. No new
publishable npm package. The 36-package publishable surface is
unchanged from v0.14.1.

## Compatibility

- Wire format: unchanged.
- Public API: additive only (new exports under `@peac/schema` for
  `validateProvisioningLifecycle`, `PROVISIONING_LIFECYCLE_*`, and
  related types; new extension namespace registered in
  `@peac/kernel` generated registries).
- Default observable behavior: unchanged for existing surfaces.

## Validation

`docs/releases/facts.json` records the canonical metric values for
this release.
