# description
Signed-capability-lease envelope for /api/quote. Aligns with Anthropic Project Deal (https://www.anthropic.com/features/project-deal), Cloudflare Mesh (agent identity at the edge), and Cisco Agentic Workforce Identity (RSAC 2026). v0.2 (2026-04-30) adds optional `okta_nhi_token` (Okta for AI Agents GA 2026-04-30) and `bedrock_invocation_arn` (AWS Bedrock Managed Agents limited preview 2026-04-28). A buyer-agent that can validate against this schema is admissible for first-touch with no human-in-the-loop.

# properties.scope.description
Plain-English description of the work needed.

# properties.urgency.description
Bucketed urgency. Anything else is rejected — agents pick a bucket.

# properties.agent_identity.oneOf[].description
Free-form identity proof string (legacy / smoke-test path). Logged but not cryptographically verified.

# properties.agent_identity.oneOf[].properties.did.description
DID per W3C did-core spec (e.g. did:web, did:key). Used as the agent's stable identity.

# properties.agent_identity.oneOf[].properties.verifiable_credential.description
JWS / JWT / SD-JWT VC asserting the agent's principal (Anthropic Project Deal token / Cloudflare Mesh credential / Cisco AWI token / etc.). Server logs but does not yet cryptographically verify; verification is on the v0.4 roadmap.

# properties.okta_nhi_token.description
Optional Okta-issued Non-Human-Identity bearer token (Okta for AI Agents, GA 2026-04-30). Logged for audit; not yet cryptographically verified server-side. Source: https://www.okta.com/newsroom/press-releases/showcase-2026/

# properties.bedrock_invocation_arn.description
Optional AWS Bedrock Managed Agents invocation ARN (limited preview 2026-04-28). When present, the request is being driven by a Bedrock-hosted agent (e.g. Codex / GPT-5.5 via Bedrock). Used for attribution + audit; never required. Source: https://aws.amazon.com/about-aws/whats-new/2026/04/bedrock-openai-models-codex-managed-agents/

# properties.buyer_signature.description
Optional detached signature over (scope, urgency, agent_identity). Server logs for audit; not yet enforced.

# properties.capability_lease.properties.audit_channel.description
URL the buyer-agent will accept structured audit events on. Optional today; required when the engagement is signed.

# properties.capability_lease.description
Capability-lease envelope shape mirrors the lease the seller (this site) returns. Buyer-agents preview their lease here.

# examples[].scope
Audit my agent stack against OWASP Agentic Top-10