Crystallize the SDK-Rust SSI upstream dependency program

## Consumer outcome

Make `hyperledger-identus/sdk-rust` the canonical chain-neutral Rust SSI foundation for midnight-identity, NeoPRISM, Lace ID Portal, Oxid, and future consumers. Normalize the SDK-owned `IDR-*` rows from the Oxid `ssi-upstream-dependency-backlog.csv` into a repository-owned, executable backlog with immutable donor evidence and ordered component slices.

This program enables a later, separately governed Apollo deprecation and lets NeoPRISM become smaller by retaining only PRISM/Cardano-specific behavior after generic components are released and adopted. It does not deprecate or mutate either repository in this issue.

## Source snapshot

Observed on 2026-09-03 from the user-supplied local Oxid roadmap artifact `docs/product/ssi-upstream-dependency-backlog.csv`. The file is currently an uncommitted planning artifact in detached worktree revision `b21eb326727cb49aecf3eb47d11a5a8136fce573`, so that revision does not claim to contain it. This issue and its first PR establish the durable SDK-owned copy and provenance record.

Read-only implementation references resolved before issue creation:

| Repository | Role | Inspected default/integration revision |
| --- | --- | --- |
| `hyperledger-identus/apollo` | Kotlin Multiplatform behavioral and compatibility-vector source | `ccee22bcd693e618b9b8ff3e15ed6f9c9156c27c` |
| `hyperledger-identus/neoprism` | Rust crypto, DID Core, PRISM method, resolution HTTP, and Cardano-port source | `8becb225132efb1d9302b2c5f6ed4d87b84e8685` |
| `MediaNoxLabs/midnight-identity` | Rust DID/VC consumer and Midnight-specific adapter owner | `427f8571950c42967a18726cbcbefecc19ef8d79` |
| `input-output-hk/lace-id-portal` | Rust issuer/verifier consumer and protocol evidence source | `804de0a9e58cf48ece3cc6c24b2245bb70bc80f1` |
| `MediaNoxLabs/oxid` | Rust wallet consumer and holder/protocol/port evidence source | `685f9670af4846d52697a4cfeb94779758ae1075` |

All donor and consumer trees remain read-only. Adapted code or fixtures require file-level Apache-2.0 provenance before use.

## Boundary decision

- SDK-Rust owns generic SSI types, cryptographic utilities, protocol engines, ports, validation, and reusable conformance evidence.
- midnight-identity owns reusable Midnight method, Compact contract/runtime, proving, ledger, indexer, and registry adapters; it may depend on SDK-Rust but never Oxid.
- NeoPRISM retains `did:prism`, PRISM operation semantics, Cardano indexing/submission, storage, and node composition after generic modules move upstream.
- Lace ID Portal and Oxid retain application policy, trust decisions, consent, custody, persistence, UI, deployment, and thin adapters.
- Apollo is a cross-language compatibility source. Its independent lifecycle or deprecation is a later governance and migration decision, not an implicit result of copying code.

## First deliverable: executable program contract

- [x] Add a canonical SDK-only CSV containing every `IDR-*` row, preserving priority, target gate, outcome, acceptance evidence, consumer dependency, and commitment class.
- [x] Enrich each row with actual delivery status, existing/new GitHub issue, owner capability/crate, source repositories, normative profile, and blocking predecessor.
- [x] Add an architecture/source matrix that classifies donor surfaces as `extract`, `adapt`, `conformance-only`, or `remain-downstream` and records exact revisions/paths.
- [x] Add an OpenSpec capability governing backlog schema, boundary rules, issue linkage, provenance, and completion evidence.
- [x] Add a deterministic repository check for schema, unique IDs, allowed values, issue references, and SDK ownership.
- [x] Reconcile the blueprint and roadmap with the canonical program; do not claim inherited placeholder crates as delivered.

## Existing component issues to reconcile

- #4 — baseline stabilization subset (`IDR-001` through `IDR-003`, with already-delivered work recorded rather than repeated)
- #9 — crypto convergence (`IDR-004`); split neutral crypto ownership from Apollo branding/deprecation and PRISM legacy compatibility
- #5 — DID Core and DID ports (`IDR-005`, `IDR-006`)
- #6 — credential, presentation, verification, status, and storage vocabulary (`IDR-007` through `IDR-010`, to be decomposed)
- #10 — optional DID Resolution HTTP binding under the DID port program
- #8 — bounded JOSE/JWS subset of `IDR-004` and future OpenID work
- #7 — `IDR-023` OID4VCI

Missing rows receive focused child issues before their implementation. One child issue may cover multiple rows only when it produces one independently testable component contract.

## Delivery order

1. `IDR-001`–`IDR-003`: close governance/architecture/target-matrix evidence gaps.
2. `IDR-004`: stabilize neutral crypto and secret-provider boundaries using the current sdk-rust foundation, NeoPRISM Rust code, and Apollo compatibility vectors.
3. `IDR-005`–`IDR-006`: converge DID Core plus resolver/registrar/dereference ports; keep method and VDR behavior outside the core.
4. `IDR-007`–`IDR-010`: credential, presentation, staged verification, and storage ports.
5. `IDR-011`: immutable consumer candidate with SBOM/provenance/migration policy.
6. `IDR-020` onward: standards-profile slices in dependency order, with exact final/draft versions pinned per issue.

## Program acceptance

- Every SDK-owned CSV row has one durable issue, an OpenSpec contract when qualifying, immutable sources, explicit dependency cone, and objective acceptance commands.
- Generic code no longer needs to be copied independently among the five repositories.
- Two independent consumer-shaped adapters prove every public component before a compatibility commitment.
- No SDK crate depends on Midnight, Compact, Cardano, NeoPRISM, Lace, Oxid, UI, storage implementation, product trust policy, or custody implementation.
- Apollo deprecation and NeoPRISM reduction remain explicit downstream adoption/governance issues after equivalent SDK releases exist.
- Required local and hosted gates are green; the SDK PR targets `develop`. `main` remains unchanged.

Start with docs/product/ssi-upstream-dependency-backlog.csv and the listed source revisions, then compare every IDR-* row with issues #4 through #10. Reconcile the SDK-owned backlog, architecture/source matrix, OpenSpec contract, and repository checks without altering donor repositories. Done means every SDK-owned row has durable issue linkage, provenance, dependencies, and objective acceptance commands.

Written by the indexing model from the issue text.