# description
A typed, DID-anchored identity card for a KYA-OS entity (mcp | agent | client | verifier | human). One canonical card is anchored by a `KyaOsEntityCard` service entry on the entity's did:web DID document and projected onto the four discovery surfaces the ecosystem already indexes (MCP server.json / catalog.json `_meta['org.kya-os/card']`, A2A AgentExtension, NANDA AgentFacts, and the MCP catalog entry). The card asserts identity + type + declared capabilities; everything trust-bearing (accountability, attested capabilities, KYC/KYB) is proven by referenced credentials, not self-claimed (claim-minimalism). The sender-constrained holder-of-key proof (`org.kya-os/proof@1`) is NEVER on the static card — it rides per-request `_meta` on top (see detached-proof); `proofProfile` only names the profile a verifier should expect.

# properties.id.description
The entity's DID. did:web cards are registry-anchored (trust tiers 1-2 + L2 + KYC/KYB eligible); did:key cards are self-asserted (dev/ephemeral; trust from holder-of-key-on-use only).

# properties.entityType.description
The kind of entity. tool/skill are sub-resources (capabilities), not entity types. Named 'entityType' to avoid colliding with the deployment-flavour AgentIdentity.type (development|production).

# properties.kid.description
Key identifier for the entity's signing key (matches a verification method in the DID document and the JWS header kid of its proofs).

# properties.publicKeyJwk.description
Optional inline public key. MUST match the key published in the DID document; omit to require resolution from didDocument.

# properties.capabilities.description
Declared capabilities. Bare strings are L1 (self-declared, unattested); objects with attestations are L2 (capability-attested). tool/skill sub-resources appear here, not as top-level cards.

# properties.conformanceLevel.description
DERIVED, verifier-recomputable summary of the entity's conformance floor: L1 self-declared, L2 capability-attested, L3 holder-of-key + delegation-chain resolution. NOT an independent claim — a verifier recomputes it from capabilities + the live per-request proof.

# properties.responsibleParty.description
DID of the entity ultimately accountable (= root issuerDid of the delegation chain; SPEC Responsible Party). SHOULD be did:web. Verified via delegationRef against the signed DelegationCredential, not self-asserted.

# properties.principal.description
Optional DID of the immediate delegator / authorizing human (the runtime userDid), when it differs from responsibleParty (SPEC Principal).

# properties.delegationRef.description
Reference to the signed DelegationCredential chain backing responsibleParty/principal. Format 'vcId>delId', multi-hop joined with '>'. The DelegationCredential VC is authoritative (ADR-001); KYA-OS-Delegation-Chain/-Granted-Scopes headers are advisory.

# properties.attestations.description
Resolvable, signed credentials about the entity or its responsibleParty (e.g. IdentityVerification = KYC/KYB). Referenced, not inlined; verified via the trusted-issuer + signature + expiry path. Assert the verification fact + level, not raw PII.

# properties.didDocument.description
URL of the entity's DID document (the trust anchor for did:web; integrity derives from domain control). The DID document carries the `KyaOsEntityCard` service entry that anchors this card.

# properties.proofProfile.description
Names the per-request holder-of-key proof profile this entity's requests carry — the stateless, sender-constrained `org.kya-os/proof@1` envelope (distinct from the legacy session-bound ProofMeta). The proof itself is NEVER on this static card; it rides per-request `_meta`. This field only advertises the profile a verifier should expect.

# properties.cimd.description
L1 CIMD (draft-ietf-oauth-client-id-metadata-document) on-ramp coordinates binding the entity's did:web to its OAuth client identity and DID-keyed JWKS.

# properties.revocation.description
W3C Bitstring Status List v1.0 revocation entry for this card's backing credential, evaluated through the injected RevocationChecker seam (live at L3, cached/offline at L2).

# $defs.Capability.description
A declared capability: an L1 bare-string name, or an L2 object carrying attestations.

# $defs.Capability.oneOf[].description
L1: self-declared capability name (unattested).

# $defs.Level2Capability.properties.attestations.description
At least one attestation; the capability is L2 if at least one verifies (signature + trusted issuer + subject + capability match + validity).

# $defs.CapabilityAttestation.properties.vc.description
A CapabilityAttestationCredential — compact VC-JWT string or pre-parsed object. issuer MUST be a trusted issuer (default did:web:example.com); credentialSubject.id MUST equal the card id; credentialSubject.capability MUST equal the capability name; validUntil MUST be in the future.

# $defs.Attestation.properties.type.description
Attestation kind. IdentityVerification is the registry-issued KYC (individual) / KYB (organization) credential.

# $defs.Attestation.properties.vc.description
The signed Verifiable Credential (compact VC-JWT string or object), resolved + verified via the trusted-issuer path. For IdentityVerification: credentialSubject = { id: <subject DID>, subjectType: 'individual'|'organization', verificationLevel: 'basic'|'enhanced'|'loa3', provider }.

# $defs.Attestation.properties.subject.description
DID the attestation is about. For KYC/KYB this is the responsibleParty, not the agent.

# $defs.Attestation.properties.issuer.description
Issuer DID. MUST be in the trusted-issuer allowlist (default did:web:example.com).

# $defs.CimdBinding.description
CIMD on-ramp binding: the client_id ↔ did:web bijection and the DID-keyed JWKS the AS validates private_key_jwt against (so OAuth client-auth IS a DID-key proof, closing L1→L3).

# $defs.CimdBinding.properties.clientId.description
The OAuth client_id — the did:web HTTPS form (did:web:host:a:b ⇄ https://host/a/b). Its origin MUST equal the did:web host and the jwksUri origin (origin-equality, fail-closed).

# $defs.CimdBinding.properties.jwksUri.description
JWKS endpoint that is a mechanical projection of the DID document's verificationMethod[] (Ed25519 → OKP JWK, kid preserved).

# $defs.BitstringStatusListEntry.description
W3C Bitstring Status List v1.0 credentialStatus entry — the StatusList2021Entry successor. `statusListIndex` is an integer expressed as a string per the spec.

# $defs.BitstringStatusListEntry.properties.statusListCredential.description
URL of the Bitstring Status List credential.

# $defs.BitstringStatusListEntry.properties.statusListIndex.description
Index in the status-list bitstring — a non-negative canonical decimal string (no whitespace, hex, or scientific notation), matching the fail-closed runtime parse.