docs: ODIS role-capability statement + executable walkthrough notebooks

.github/workflows/pr-check.yml

@@ -259,11 +259,32 @@ jobs:
 
       - name: Install notebook execution deps
         shell: bash
-        run: pip install --quiet --upgrade pytest nbmake ipykernel highflame cryptography "PyJWT>=2.8"
+        run: pip install --quiet --upgrade pytest nbmake ipykernel highflame cryptography "PyJWT>=2.8" requests
 
-      - name: Execute the quickstart notebook against the live server
+      # Committed outputs must never contain credential material: raw JWTs,
+      # zeroid API keys, or private keys. Guards the ODIS walkthroughs' policy
+      # of printing decoded claims / selected fields only.
+      - name: Lint committed notebook outputs for credential material
         shell: bash
-        run: pytest --nbmake --nbmake-timeout=300 examples/zeroid_quickstart.ipynb -v
+        # git ls-files (not a shell glob) so a moved/renamed notebook dir can
+        # never silently disarm the lint: grep exit 2 (error) fails the step
+        # instead of reading as "no match", and an empty file list is an error.
+        run: |
+          files=$(git ls-files 'examples/**/*.ipynb' 'examples/*.ipynb')
+          if [ -z "$files" ]; then
+            echo "::error::no committed notebooks found — lint target list is broken"; exit 1
+          fi
+          status=0
+          grep -InE 'eyJ[A-Za-z0-9_-]{20,}|zid_(sk|rt)_[A-Za-z0-9_-]{20,}|BEGIN[A-Z ]*PRIVATE KEY' $files || status=$?
+          if [ "$status" -eq 0 ]; then
+            echo "::error::credential-looking material found in committed notebook(s)"; exit 1
+          elif [ "$status" -ne 1 ]; then
+            echo "::error::credential lint failed to run (grep exit $status)"; exit "$status"
+          fi
+
+      - name: Execute the quickstart + ODIS notebooks against the live server
+        shell: bash
+        run: pytest --nbmake --nbmake-timeout=300 examples/zeroid_quickstart.ipynb examples/odis/odis-walkthrough.ipynb examples/odis/odis-walkthrough-sdk.ipynb -v
 
       - name: Dump zeroid logs on failure
         if: failure()

README.md

@@ -160,6 +160,8 @@ Prefer a runnable walkthrough after installing the SDK? Open the [ZeroID Quickst
 
 Want a LangChain-specific intro? Open the [Scope-Aware Tools notebook](examples/langchain/scope_aware_tools.ipynb) to see the same agent gain or lose tool access purely by changing its ZeroID token.
 
+Mapping ZeroID to the [ODIS draft](https://github.com/cosai-oasis/ws4-odis/blob/main/RFCs/ODIS.md) (CoSAI/OASIS WS4)? The [role-capability statement](docs/odis/role-capability-statement.md) grades every Layer 1–2 requirement against code and tests, and the [ODIS walkthrough notebooks](examples/odis/) run the same story — Agent Registration Record → Agent Runtime Credential → Delegation Record → cascade revocation — against a local instance with real outputs.
+
 **Run ZeroID locally** (Docker — 30 seconds):
 
 ```bash
@@ -955,6 +957,8 @@ References: [OpenID Agentic AI](https://openid.net/wp-content/uploads/2025/10/Id
 
 The extensions ZeroID layers on these baseline specs — the additional JWT claims, the CIBA `group_hint` parameter, the DPoP `bh` claim, RFC 8693 attenuation/depth semantics, the WIMSE URI scheme, reserved-claims gating, CAE signal types, and the non-standard endpoints — are specified normatively in [`docs/spec/zeroid-oauth-extensions.md`](docs/spec/zeroid-oauth-extensions.md).
 
+How the whole stack maps onto the CoSAI/OASIS **ODIS** draft (Layers 1–2, native mode), including the requirements ZeroID does *not* meet, is in [`docs/odis/role-capability-statement.md`](docs/odis/role-capability-statement.md), with executable companions in [`examples/odis/`](examples/odis/).
+
 | Standard | RFC / Spec | Used For |
 |----------|-----------|----------|
 | OAuth 2.1 | RFC 6749 + BCP | Foundational auth framework |