fix(compliance-cli,schemas): stop making a chain and a payment rail conformance bars

[ucekmez]

Summary

PR 11 of a stacked series. Base is #102. Not for merge without review.

Three manifest fields tied EEP conformance to specific vendor ecosystems.

1. The runner was stricter than the schema. reputation is OPTIONAL in eep-manifest.json, but compliance-cli called fail() when a manifest lacked reputation.contract — an ERC-8004 Ethereum registry:

if (json.reputation && json.reputation.contract) { pass(...) }
else { fail('manifest.reputation (ERC-8004) field present', 'missing or no contract'); }

A publisher with no blockchain involvement could not reach Full conformance.

2. The schema required a payment-rail flag. pqc_ready and x402_enabled were both in the manifest's required array, so every EEP manifest had to declare an x402 flag whether or not it had anything to do with payments.

For a protocol positioning itself as neutral infrastructure — and heading to a standards body at v0.2 — hard-wiring one chain and one payment rail into the conformance bar is a strategic liability rather than a bug.

What changed

• reputation is reported, not required: present → pass with the contract, absent → skip with the reason. On-chain reputation stays fully supported for publishers who use it.
• pqc_ready / x402_enabled move out of required and gain "default": false. A value that is present but not a boolean still fails — this relaxes what must be declared, not what a declaration means.
• §11.6 no longer says a non-PQC node "MUST set pqc_ready: false (not omit the field)". Omission and false are now equivalent, and neither affects conformance at any tier — PQC readiness is a capability a publisher advertises, not a bar it must clear.
• IETF draft updated to match.

Scope

• Spec / schema only
• TypeScript package(s)
• Python package(s)
• Tests / CI
• Docs / examples

Checklist

• I read CONTRIBUTING.md and CODE_OF_CONDUCT.md.
• Tests added or updated where appropriate.
• Breaking change? No. Relaxing required never invalidates a document that was already valid — every deployed manifest keeps validating, and every publisher that passed conformance still passes. The change is strictly permissive: manifests that previously failed may now pass.
• Documentation updated for user-visible behavior.

Verification

Check	Result
tests/	184 passed
@eep-dev/middleware	186 passed
@eep-dev/compliance-cli	73 passed
compliance-cli --fixtures	22 vectors, 0 failed
check-draft-schema-parity	✓ 9 fields, 4 required
codegen-schema-types --check	no drift

Notes for reviewers

The parity gate from #96 paid for itself here. Relaxing the schema's required immediately failed the build:

✗ IETF draft and eep-manifest.json disagree:
  `pqc_ready`: draft says required=true, schema says required=false
  `x402_enabled`: draft says required=true, schema says required=false

That is exactly the drift class this whole series exists to close, caught automatically instead of at IETF review.

Two judgement calls worth confirming:

1. I did relax the schema, not only the CLI. Relaxing required is safe in the strict sense (no previously-valid document becomes invalid), but it is a normative change to a published v0.1 artifact and belongs in the CHANGELOG. If you'd rather keep the schema as-is for 0.1 and only fix the CLI, say so and I'll split it.
2. eep-manifest.json still carries x402, payment_networks and reputation as optional property definitions. I left those alone — offering a field is fine; requiring it was the problem.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ucekmez]

Pushed a fix: tests/cross-impl/test_discovery_manifest.py::test_schema_required_fields asserted the old six-field required set and was failing CI on this branch (and every branch stacked on it).

The test now asserts the four remaining required fields, and additionally pins that pqc_ready/x402_enabled are still defined and still default to false — so relaxing required cannot silently turn into dropping the fields.

My mistake in the original push: I ran tests/cross-impl/test_conformance_fixtures.py but not the rest of that directory. The full suite (52 passed, 3 skipped against a running gate publisher) is green now, and the four downstream PRs have been rebased.