repo: make trust-annotations the base; FIDES becomes a scheme, not a sibling

Restructure the incubation into two extensions plus interchangeable data-labelling
schemes, shipped as a stack of three PRs:

- This PR (base): shared scaffolding + the trust-annotations extension.
- action-metadata moves to its own stacked PR.
- The IFC/FIDES work moves out of specification/draft/ entirely — it is one
  data-labelling scheme (ifc.fides.v1) that fills the trust-annotations
  evidenceRef slot, not an extension and not a sibling. It lands in a schemes/
  folder built to hold alternative approaches (data-class, capability tokens,
  cosigning, sequence-shape, attestation) so no single academic model is baked
  into the wire.

README, sep-disposition, related-work, trust-model, open-questions and the
decision log are reframed accordingly (two extensions + a schemes folder; the
range of candidate schemes drawn from the SEP-1913 thread and cited literature).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs/decisions.md

@@ -89,3 +89,31 @@ Resolution. SEP-1862 remains a core/Standards-Track protocol change.
 
 **Rationale.** The 2026-05-28 IG meeting concluded pre-flight is inherently a
 protocol-level change, not an extension.
+
+## 2026-06-16 — FIDES is a scheme, not a sibling extension
+
+**Decision.** Refines the 2026-06-10 "FIDES is a profile" decision. The IFC/FIDES
+work moves out of `specification/draft/` (where it sat next to the two
+extensions) into a `schemes/` folder. There are **two** extensions
+(`trust-annotations`, `action-metadata`); FIDES is **one data-labelling scheme**
+(`ifc.fides.v1`) that fills the `trust-annotations` `evidenceRef` slot.
+
+**Rationale.** FIDES is one model the extension *could* use, not a peer of the
+extensions, and must not be presented as a sibling. The original SEP cites it
+alongside ShardGuard and "Design Patterns for Securing LLM Agents," and the
+SEP-1913 thread adds capability tokens, cosigning, sequence-shape, and
+attestation models — so `schemes/` is a folder for interchangeable approaches,
+with FIDES as the first worked one. This shows the range the open `evidenceRef`
+slot is meant to carry rather than implying IFC is the privileged model.
+
+## 2026-06-16 — Three pull requests, stacked
+
+**Decision.** The work ships as three PRs: `trust-annotations` (the base,
+carrying shared repo scaffolding), `action-metadata` (stacked on the base), and
+the FIDES scheme in `schemes/` (stacked on the base). The two extensions are
+independent; the FIDES scheme depends on `trust-annotations` because it fills
+that extension's `evidenceRef` slot.
+
+**Rationale.** Separate PRs let each piece be reviewed and graduate on its own
+clock. FIDES stacks on `trust-annotations` because a scheme has no meaning
+without the slot it fills.

docs/open-questions.md

@@ -30,7 +30,7 @@ Tracked here rather than in the spec drafts, so the drafts stay non-temporal.
 - Open strings vs. closed enums for `destination` / `source` / `sensitivity`.
 - Does `requiresReview` need a machine-readable *reason* for good client UX?
 
-## ifc-fides
+## ifc-fides (scheme)
 
 - Inline `_meta.ifc` for low-friction adoption vs. always behind `evidenceRef`.
 - GitHub Enterprise `internal` repo visibility → `public`/`private` mapping

docs/related-work.md

@@ -10,11 +10,11 @@ annotation work. Several were surfaced in IG meetings (notably 2026-05-28).
 - [SEP-1862 — Tool Resolution / pre-flight checks](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1862) — core-protocol, composes with these extensions.
 - [SEP-2133 — Extensions](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/seps/2133-extensions.md) — the framework this repo incubates under.
 - [SEP-2127 — Server Cards](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2893) — precedent for the Standards→Extensions Track refactor.
-- [SEP-2787 — Tool Call Attestation](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2787) — candidate `evidenceRef` profile.
+- [SEP-2787 — Tool Call Attestation](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2787) — candidate `evidenceRef` scheme.
 
 ## Research
 
-- **FIDES** — *Information-flow control for LLM agents.* [arXiv:2505.23643](https://arxiv.org/abs/2505.23643). Basis for the `ifc.fides.v1` profile.
+- **FIDES** — *Information-flow control for LLM agents.* [arXiv:2505.23643](https://arxiv.org/abs/2505.23643). Basis for the `ifc.fides.v1` scheme in [`schemes/`](../schemes/).
 - **Design Patterns for Securing LLM Agents** — IBM/Google/Microsoft. [arXiv:2506.08837](https://arxiv.org/abs/2506.08837). Plan-Then-Execute, Dual LLM, Map-Reduce, etc.
 - **Trail of Bits** — prompt-injection via hidden content in GitHub issues. [blog](https://blog.trailofbits.com/2025/08/06/prompt-injection-engineering-for-attackers-exploiting-github-copilot/).
 - **OpenAI Auto Review** — https://alignment.openai.com/auto-review/ (shared in IG chat).
@@ -22,7 +22,7 @@ annotation work. Several were surfaced in IG meetings (notably 2026-05-28).
 ## Implementations & tooling
 
 - [`kapil8811/mcp-trust-annotations`](https://github.com/kapil8811/mcp-trust-annotations) — reference Python SDK PoC for `trust-annotations`.
-- [`github-mcp-server`](https://github.com/github/github-mcp-server) — public MCP server; emitter candidate for `ifc-fides` (knows repo visibility + collaborators).
+- [`github-mcp-server`](https://github.com/github/github-mcp-server) — public MCP server; emitter candidate for the `ifc-fides` scheme (knows repo visibility + collaborators).
 - **Ethyca** data-labeling docs — https://www.ethyca.com/docs (shared in IG chat).
 - **GitHub Next** agentic-workflows research on data labeling — to be documented as issues in this repo (IG action item, @gokhanarkan / @joannakl).
 
@@ -35,4 +35,4 @@ annotation work. Several were surfaced in IG meetings (notably 2026-05-28).
 - **Sequence-shape** policies — marras0914.
 
 These are exactly the models that `evidenceRef`'s open `type` is designed to
-accommodate as profiles.
+accommodate as schemes — see [`schemes/`](../schemes/).

docs/sep-disposition.md

@@ -62,7 +62,10 @@ preference:
 - **(C)** Close 1913 outright and open three fresh Extensions Track SEPs. Loses
   the discussion history's continuity; not preferred.
 
-**Moved into extensions:** `trust-annotations`, `action-metadata`, `ifc-fides`.
+**Moved into extensions:** `trust-annotations`, `action-metadata`.
+**Moved into `schemes/`:** the IFC/FIDES work, as one data-labelling **scheme**
+(`ifc.fides.v1`) that fills the `trust-annotations` `evidenceRef` slot — not an
+extension and not a sibling of the two above.
 **Parked on the umbrella:** `maliciousActivityHint`,
 session-level propagation rules. See [open-questions.md](./open-questions.md).
 
@@ -90,14 +93,14 @@ with it if it lands, but do not block on it.
   for Tools)** — tracked by the IG as discussion items; not part of these
   extensions. Cross-link only.
 - **SEP-2787 (Tool Call Attestation)** and the various attestation/evidence
-  threads — these are natural `evidenceRef` *profile* candidates rather than
+  threads — these are natural `evidenceRef` **scheme** candidates rather than
   competitors. Coordinate so the `evidenceRef.type` registry can list them.
 
 ## Mapping table
 
 | SEP | Title | Proposed disposition | Extension home |
 | :-- | :-- | :-- | :-- |
-| 1913 | Trust & Sensitivity Annotations | Umbrella thread; schema moves to extensions | `trust-annotations` (+ `ifc-fides`) |
+| 1913 | Trust & Sensitivity Annotations | Umbrella thread; schema moves to extensions | `trust-annotations` (+ `schemes/ifc-fides`) |
 | 2061 | Action Security Metadata | **Closed 2026-06-13**; lives as extension | `action-metadata` |
 | 1862 | Tool Resolution (pre-flight) | Stays core / Standards Track | — (composes, no dependency) |
 | 1984 | Comprehensive Tool Annotations | IG discussion item | — |

docs/trust-model.md

@@ -1,7 +1,7 @@
 # Trust model
 
-A single statement of the enforcement model shared by all extensions in this
-repository, so individual specs don't re-litigate it.
+A single statement of the enforcement model shared across this repository's
+extensions and data-labelling schemes, so individual specs don't re-litigate it.
 
 ## Annotations are claims, not guarantees
 
@@ -41,7 +41,7 @@ SEP-1913 thread): rather than blanket-blocking flows a policy engine is unsure
 about, **flag the specific call for user confirmation**. This preserves utility
 while keeping a human on the genuinely risky edges, and is the recommended
 default for `requiresReview` ([`action-metadata`](../specification/draft/action-metadata.mdx))
-and for IFC policy violations ([`ifc-fides`](../specification/draft/ifc-fides.mdx)).
+and for IFC policy violations (the [`ifc-fides`](../schemes/ifc-fides.md) scheme).
 
 ## Cross-domain is the hard case