feat(protocol): surface cycles_evidence on ErrorResponse (v0.1.25.5) (#109)

Adds the optional `cycles_evidence` field (CyclesEvidenceRef) to
ErrorResponse, closing the last gap in the lifecycle binding loop
(decide / reserve / commit / release / error).

The `error` artifact wraps any 4xx/5xx ErrorResponse from the four core
runtime endpoints and is the canonical home for non-dry reserve denials
(insufficient budget surfaces as HTTP 409 BUDGET_EXCEEDED, not a 200 with
decision: DENY) — the highest-signal evidence an APS receipt can bind to.
Surfacing the ref in-band lets a denied caller bind its own signed receipt
to the denial and fetch the envelope via getEvidence.

The field is CyclesEvidenceRef, identical to the four success responses;
TRANSPORT METADATA, NOT attested — the `error` artifact's
payload.error.response mirror (drafts/cycles-evidence-v0.1.yaml) keeps
additionalProperties: false and omits it, so the content hash is never
self-referential. Present when the server emitted an `error` envelope for
this response; absent when emission is disabled or for errors raised before
evidence could be emitted. Additive + non-breaking.

- cycles-protocol-v0.yaml: info.version 0.1.25.4 -> 0.1.25.5; cycles_evidence
  on ErrorResponse.
- drafts/cycles-evidence-v0.1.yaml: DELIBERATE OMISSION note on
  ErrorResponseMirror (matches the other four mirrors).
- cycles-spec-index.yaml: runtime_base 0.1.25.5, spec_index 0.1.30.
- changelogs/cycles-protocol-v0.md: v0.1.25.5 entry.
- merged/: regenerated.

Author: amavashev

changelogs/cycles-protocol-v0.md

@@ -6,6 +6,30 @@ New entries are added directly to this file. See `scripts/validate_changelogs.py
 
 ---
 
+## v0.1.25.5 — 2026-06-13
+
+_(revision 2026-06-13 — surface `cycles_evidence` on the error response)_
+
+- Adds the optional `cycles_evidence` field (`CyclesEvidenceRef`) to
+  `ErrorResponse`, closing the last gap in the lifecycle binding loop
+  (decide / reserve / commit / release / **error**). The `error` artifact wraps
+  any 4xx/5xx `ErrorResponse` from the four core runtime endpoints and is the
+  canonical home for non-dry reserve denials — insufficient budget surfaces as
+  HTTP 409 `BUDGET_EXCEEDED`, NOT a 200 with `decision: DENY` (see
+  §ReservationCreateResponse.decision) — which the evidence draft calls the
+  highest-signal evidence an APS receipt can bind to. Surfacing the ref in-band
+  lets a denied caller bind its own signed receipt to the denial and fetch the
+  envelope via `getEvidence`. The field is `CyclesEvidenceRef`, identical in
+  shape/semantics to the four success responses; it is TRANSPORT METADATA, NOT
+  attested (the `error` artifact's `payload.error.response` mirror in
+  `drafts/cycles-evidence-v0.1.yaml` keeps `additionalProperties: false` and
+  omits it, so the content hash is never self-referential). Present when the
+  server emitted an `error` envelope for this response; absent when emission is
+  disabled or for errors raised before evidence could be emitted (e.g. request
+  validation / auth failures). Additive + non-breaking.
+
+---
+
 ## v0.1.25.4 — 2026-06-13
 
 _(revision 2026-06-13 — surface `cycles_evidence` on the decide response)_

cycles-protocol-v0.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: Cycles Budget Authority API
-  version: 0.1.25.4
+  version: 0.1.25.5
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0
@@ -598,6 +598,23 @@ components:
         details:
           type: object
           additionalProperties: true
+        cycles_evidence:
+          $ref: '#/components/schemas/CyclesEvidenceRef'
+          description: >-
+            Reference to the CyclesEvidence envelope emitted for this error
+            (artifact_type `error`). Present when the server emitted an `error`
+            CyclesEvidence record for this response — most importantly the
+            non-dry reserve denials that surface as HTTP 409 `BUDGET_EXCEEDED`
+            (and the other live denial codes), which are the highest-signal
+            evidence an APS receipt can bind to. A denied caller reads
+            `evidence_id` to bind its own signed receipt to this denial, then
+            fetches the envelope at `cycles_evidence_url` (see `getEvidence`).
+            Absent when evidence emission is disabled on the server, or for
+            errors raised before evidence could be emitted (e.g. request
+            validation / auth failures). TRANSPORT METADATA, NOT ATTESTED — as
+            with the success responses, `evidence_id` is computed over the
+            `ErrorResponse` body WITHOUT this field (the `error` artifact's
+            `payload.error.response` mirror omits it); see `CyclesEvidenceRef`.
 
     DecisionEnum:
       type: string

cycles-spec-index.yaml

@@ -63,14 +63,14 @@ spec_family:
     isolation; SDK generators and validator pipelines need a merged artifact.
     The merge_recipes section below defines how to produce those artifacts.
   current_versions:
-    base_runtime: "0.1.25.4"              # + cycles_evidence ref on reserve/commit/release responses (additive)
+    base_runtime: "0.1.25.5"              # + cycles_evidence ref on ErrorResponse (denial evidence, additive)
     base_runtime_semantic_base: "0.1.25"  # frozen wire baseline — evidence revisions are additive, 0.1.25 clients stay compatible
     base_governance: "0.1.25.33"          # + webhook lifecycle EventTypes and per-row Event emission on webhook operations
     base_governance_semantic_base: "0.1.25.9"  # frozen wire baseline
     extension_runtime: "0.1.26"           # untouched — no Event/ErrorResponse redeclaration
     extension_governance: "0.1.27"        # trace_id on redeclared ErrorResponse
     action_kinds: "0.1.27"                # trace_id on redeclared ErrorResponse
-    spec_index: "0.1.29"                  # runtime_base editorial → 0.1.25.4 (+ decide cycles_evidence)
+    spec_index: "0.1.30"                  # runtime_base editorial → 0.1.25.5 (+ cycles_evidence on ErrorResponse)
 
 # ---------------------------------------------------------------------------
 # CANONICAL DOCUMENTS
@@ -85,7 +85,7 @@ documents:
 
   - id: runtime_base
     file: cycles-protocol-v0.yaml
-    version: "0.1.25.4"          # editorial: + cycles_evidence on reserve/commit/release/decide responses
+    version: "0.1.25.5"          # editorial: + cycles_evidence on reserve/commit/release/decide/error responses
     semantic_base: "0.1.25"      # frozen wire baseline — evidence fields are additive/optional
     role: base
     conformance: normative

drafts/cycles-evidence-v0.1.yaml

@@ -959,6 +959,17 @@ components:
         Mirror of `cycles-protocol-v0.yaml#/components/schemas/ErrorResponse`
         — the body of any 4xx/5xx response from the four core
         runtime endpoints.
+
+        DELIBERATE OMISSION — `cycles_evidence`: as with the
+        reserve/commit/release/decision mirrors, the canonical
+        `ErrorResponse` carries an optional `cycles_evidence` ref
+        (added in `cycles-protocol-v0.yaml` v0.1.25.5 so a denied
+        caller gets the `error` envelope id in-band) but it is
+        TRANSPORT METADATA, NOT attested; `additionalProperties: false`
+        forbids it here. The `evidence_id` is computed over this
+        pre-evidence-ref response, so the content hash an `error`
+        envelope's `payload.error.response` carries is never
+        self-referential.
       required: [error, message, request_id]
       additionalProperties: false
       properties:

merged/cycles-openapi-protocol-merged.yaml

@@ -202,6 +202,18 @@ components:
         details:
           type: object
           additionalProperties: true
+        cycles_evidence:
+          $ref: '#/components/schemas/CyclesEvidenceRef'
+          description: Reference to the CyclesEvidence envelope emitted for this error (artifact_type
+            `error`). Present when the server emitted an `error` CyclesEvidence record for this response
+            — most importantly the non-dry reserve denials that surface as HTTP 409 `BUDGET_EXCEEDED`
+            (and the other live denial codes), which are the highest-signal evidence an APS receipt can
+            bind to. A denied caller reads `evidence_id` to bind its own signed receipt to this denial,
+            then fetches the envelope at `cycles_evidence_url` (see `getEvidence`). Absent when evidence
+            emission is disabled on the server, or for errors raised before evidence could be emitted
+            (e.g. request validation / auth failures). TRANSPORT METADATA, NOT ATTESTED — as with the
+            success responses, `evidence_id` is computed over the `ErrorResponse` body WITHOUT this field
+            (the `error` artifact's `payload.error.response` mirror omits it); see `CyclesEvidenceRef`.
     DecisionEnum:
       type: string
       enum: