feat: lawful basis builder, spec compliance check, conserver-direct delivery

[howethomas]

Adapters generated from this template now start with a lawful basis attachment, a schema compliance check they can copy, and the option to deliver straight to a conserver. Until now every generated adapter began non-compliant.

Changes

• Lawful basis builder in vcon_builder.py. LawfulBasisConfig reads LAWFUL_BASIS, LAWFUL_BASIS_PURPOSE, LAWFUL_BASIS_JURISDICTION, LAWFUL_BASIS_EXPIRATION, LAWFUL_BASIS_PROOF_MECHANISM and LAWFUL_BASIS_PROOF_DESCRIPTION from the environment, a YAML vcon.lawful_basis: block, or both (resolve(), env wins per field). An invalid basis raises ValueError at load. add_lawful_basis() emits {purpose: "lawful_basis", start, party, dialog, mediatype: "application/json", encoding: "json", body: <JSON value>} and adds "lawful_basis" to extensions. Unset: one warning per process, nothing added. No basis is ever defaulted in code. vcon-lib's add_lawful_basis_attachment() is deliberately not used; 0.9.6's output is missing the required start field and mediatype.
• finalize_vcon() removes the empty meta: {} / metadata: {} that vcon-lib 0.9.6 puts on every dialog. Both delivery classes call it before serialising, so generated adapters cannot forget it.
• Spec compliance test tests/test_spec_compliance.py. assert_spec_compliant(vcon_dict, schema_path) validates against the official schema and checks the non-negotiables: no mimetype, every attachment has purpose/start/party/dialog, body is a string unless encoding: "json" (see the -04 section below), no empty meta/metadata/group/redacted. Written to be copied into other repos. The schema is vendored under tests/schema/ from ietf-wg-vcon/draft-ietf-vcon-vcon-core at fdcf2f5f420b726f7e70d16683ba0977d4610a1f, source recorded in tests/schema/SOURCE.md.
• Conserver-direct delivery (delivery.mode: conserver): POST {CONSERVER_URL}/vcon with repeated ingress_lists query params (checked against the vcon-server API route) and a configurable token header, default x-conserver-api-token. Shares the webhook's retry, backoff and dead-letter code.
• Docs. Stale build_new() docstring corrected. README marks TranscriptionProvider and JWS signing as not implemented. USAGE.md and config.example.yaml cover the lawful basis, finalize_vcon() and delivery mode.

-04

The template retargeted from draft-ietf-vcon-vcon-core-02 to -04 (published 2026-09-07); the vCon syntax parameter stays "0.4.0". The one rule that changed: with encoding: "json", body is the JSON value itself (object/array/number/bool/null), not a json.dumps() string (-04 §2.3.2, CDDL body: any). The vendored schema already permitted this and needed no change. add_lawful_basis() now writes the raw dict as body. Readers accept both shapes through a new json_body(attachment) helper, so vCons built under the old -02 reading (including this template's own earlier commits) still read back correctly. assert_spec_compliant() now also fails a body that's a string under encoding: "json", catching accidental double-encoding.

Verification

• pytest -q in a fresh venv: 49 passed (14 on main).
• The sample vCon, lawful basis included, validates against the vendored schema. With finalize_vcon() stubbed out, the compliance test fails, so it does not pass by construction.
• ruff clean. mypy strict shows the same three missing-stub errors as main and nothing new.

Not in this PR

• lawful_basis is not added to critical. Regulated adapters may want that.
• The extension doc in vcon-docs still spells the attachment type and the top-level field must_understand; this template follows the core draft (purpose, critical).

Refs CON-1081

🤖 Generated with Claude Code