intent: curated adapter registry and consent surface

[mfw78]

Problem. Doc 09 step 6 (PR #132): venue and analyzer trust is publisher trust, which needs provenance infrastructure.

Scope. The curated registry format (platform-signed content hashes) with an update flow. The install-by-ENS escape hatch behind a stronger warning. The consent UX schema (capability combinations, transport scopes, unverifiable-intent quarantine for raw bodies). Publisher display plumbed through the embedding surface.

Dependencies. Guard (#139); the Doc-03 discovery infrastructure.

Notes. Post-grant horizon; the last epic of the intent spine. GitHub files this under milestone M6.

---

Next-train plan

Current state. None of the registry or consent surface exists; it depends on the guard vocabulary (#139) and Doc-03 discovery. Children below are to be filed as native sub-issues.

Children (ordered):

• curated registry format (platform-signed content hashes) + update flow · Wave A · M · deps guard: simulate, analyzers, policy, identity checkpoint nexum-runtime#57
• install-by-ENS escape hatch behind a stronger warning · Wave A · S · deps registry-format
• consent UX schema (capability and transport scopes, unverifiable-intent quarantine) · Wave B · M · deps guard: simulate, analyzers, policy, identity checkpoint nexum-runtime#57
• publisher display through the embedding surface · Wave B · S · deps consent-schema

Blocked by: nullislabs/nexum-runtime#57.

[mfw78]

Demoted from epic to a leaf issue under the second-venue acceptance epic (curated adapter registry and consent surface). No native sub-issues to re-parent.

[mfw78]

Transferred from videre during the 2026-08-06 groom: the architecture decision is that the embedding surface owns consent and distribution trust, and videre keeps at most provenance fields in the adapter manifest. Runtime-side content pinning is covered by the digest verification work in nexum-runtime. Rescope against the shepherd consent surface issues when this becomes live.