docs(specs): thin ceremony circuits and verified extraction

[xgreenx]

Draft follow-up to #3, addressing Green's review.

The governing rule is that a proof authenticates bytes, not semantic fields. Thin circuits check only the closed local patterns the selected profile needs; contracts and the canonical runtime interpret the same authenticated revealed ranges.

What changes

• Hidden transcript ranges use blinded commitments; revealed ranges and commitments must tile the authenticated transcript.
• JSON uses closed local matchers for strings, canonical unsigned integers, and exact boolean literals. Form requests use boundary-aware local field matches rather than an impractical complete grammar proof.
• X/GitHub form-field uniqueness is an explicit, recurring-tested platform-parser assumption. A failed probe makes that profile ineligible.
• Client admission is permissionless. The authenticated client identifier remains available to local policy and consuming contracts, but Registry keeps no OAuth-client allowlist.
• metadataObservedAt orders mutable metadata. Proof validity is independent: Google uses signed exp; X and GitHub use the token-exchange attestation timestamp plus the Registry-owned 3,600-second lifetime.
• Google proves RS256 under an exposed modulus; only the consuming contract checks current Registry membership. The circuit does not consume Registry trust state.
• X and GitHub derive the runtime VerifiedClaim and the on-chain identity from the same authenticated revealed response bytes. No detached identity output or sidecar metadata can override them.
• Endpoint authority, method, and path are authenticated proof inputs checked by the consuming contract, allowing one verifying key across deployments.

Validation

The protocol-spec linter passes with zero errors and zero warnings.

[Wondertan]

Timestamp model after review: the two X/GitHub timestamps have separate owners. The token-exchange attestation is the one-time PKCE/Claim-Digest binding, so proofValidUntil equals tokenAttest.timestamp plus proofLifetime for the platform; the /me or /user attestation timestamp only orders mutable metadata. The second leg cannot substitute or refresh the bearer. Google is simpler: its signed exp already provides the accepted one-hour window and may serve as both the metadata ordering value and proofValidUntil, while the contract independently requires the signing modulus to remain in the active Google set. No Google-specific lifetime parameter or per-key trustedUntil is needed.