# title
KYA-OS Delegation Credential (W3C VC 2.0 + ZCAP-LD profile)

# description
A W3C Verifiable Credential 2.0 whose credentialSubject IS an attenuated ZCAP-LD capability. One credential per delegation HOP; a chain runs root -> ... -> leaf. CRISP attenuation is enforced on resolve, fail-closed: a child's allowedAction MUST be a subset of its parent's; caveats are monotone-narrowing (child MaxAmount <= parent, child ValidUntil <= parent, and a parent caveat may never be silently dropped); the parent's delegate (invoker/controller) MUST be the child's issuer; child.parentCapability MUST reference the parent capability id; the invocationTarget is constant along the chain; depth <= 10; and the ROOT's parentCapability equals its invocationTarget with issuer/invocationTarget = the resource owner / resource. responsibleParty is recomputed as the issuer of the root credential; the leaf invoker is asserted equal to the per-request proof key. This schema is a re-profile of the prior draft, not a new artifact.

# properties.@context.description
JSON-LD context. MUST include the W3C VC 2.0 context 'https://www.w3.org/ns/credentials/v2' as the first element, the ZCAP-LD context 'https://w3id.org/security/zcap/v1', and the KYA-OS delegation namespace 'https://kya-os.org/ns/delegation/v1'.

# properties.id.description
Unique credential identifier (URN or URL).

# properties.issuer.description
Delegator DID (or an issuer object carrying id). For the ROOT credential this is the resource owner and the recomputed responsibleParty.

# properties.validFrom.description
VC 2.0 validity start (replaces the legacy issuanceDate).

# properties.validUntil.description
VC 2.0 validity end (replaces the legacy expirationDate). A child's validUntil MUST be no later than its parent's (monotone-narrowing).

# $defs.ZcapCapability.description
The attenuated ZCAP-LD capability carried as the VC credentialSubject.

# $defs.ZcapCapability.properties.id.description
Capability identifier, typically a 'urn:zcap:*' URN. A child's parentCapability MUST reference this value.

# $defs.ZcapCapability.properties.controller.description
The delegate DID that controls this capability (synonym of invoker).

# $defs.ZcapCapability.properties.invoker.description
The delegate DID authorized to invoke this capability. For the leaf hop this is asserted equal to the per-request proof key (proof.did).

# $defs.ZcapCapability.properties.parentCapability.description
The parent capability id. For the ROOT hop this MUST equal invocationTarget (the resource itself).

# $defs.ZcapCapability.properties.invocationTarget.description
The resource DID/URI this capability authorizes. Constant along the whole chain.

# $defs.ZcapCapability.properties.allowedAction.description
Permitted action strings. A child's allowedAction MUST be a subset of its parent's (no escalation).

# $defs.ZcapCapability.properties.caveats.description
Monotone-narrowing constraints accumulated down the chain.

# $defs.Caveat.description
A monotone-narrowing constraint. A child MUST carry, for every parent caveat, a caveat of the same type that is at least as narrow; unknown caveat types MUST be replicated verbatim (fail-closed).

# $defs.Caveat.properties.type.description
Caveat type, e.g. 'ValidUntil' or 'MaxAmount'.

# $defs.Caveat.properties.date.description
ValidUntil caveat: the expiry; a child's date MUST be <= its parent's.

# $defs.Caveat.properties.limit.description
MaxAmount caveat: a decimal cap; a child's limit MUST be <= its parent's for the same currency.

# $defs.Caveat.properties.currency.description
MaxAmount caveat: the ISO currency code (e.g. 'USD').

# $defs.CredentialStatus.description
W3C Bitstring Status List v1.0 entry (the StatusList2021Entry successor), evaluated through the injected RevocationChecker seam; a revoked ancestor cascades to invalidate the subtree.

# $defs.CredentialStatus.properties.statusListCredential.description
URL of the Bitstring Status List credential.

# $defs.Proof.description
Data Integrity proof over the credential.

# $defs.Proof.properties.proofPurpose.description
Purpose of the proof (e.g., 'assertionMethod').