docs(protocol-landscape): add Tenzro TDIP integration mapping + example

[hilarl]

docs(protocol-landscape): add Tenzro TDIP integration mapping + example

Motivation

The current protocol-landscape/ section maps VI to commerce-protocol
peers (UCP/AP2 in protocols.md, plus the cross-protocol glossary). The
Tenzro Decentralized Identity Protocol (TDIP) is an identity-rooted
protocol — a unified W3C-DID-method specification (did:tenzro)
covering both human and machine (AI agent) identities with first-class
delegation primitives (DelegationScope + runtime SpendingPolicy).

TDIP and VI address adjacent layers of the same authorization problem:

• TDIP supplies the on-chain registry, identity primitives, and
  enforcement hooks (enforce_operation).
• VI supplies the off-chain, portable, selective-disclosure
  credential format that proves user intent for a particular purchase
  without a registry round-trip.

A merchant in a TDIP-rooted purchase needs evidence that the buyer
agent was authorized, but the merchant may not have RPC access to the
Tenzro Ledger or may want a locally-verifiable record for audit. VI
gives the merchant exactly that. Symmetrically, TDIP gives VI a
registry-anchored root of trust that propagates revocation reliably.

This PR documents the relationship between the two, with a worked
Python example that exercises both layers.

Why this content belongs in protocol-landscape/, not spec/

Per CONTRIBUTING.md:

The core spec (spec/) must not reference any specific transport
protocol (AP2, ACP, etc.). Protocol-specific mappings belong in
protocol-landscape/.

TDIP is a Tenzro-specific protocol, so a TDIP↔VI mapping belongs in
protocol-landscape/ alongside the existing UCP/AP2 and ACP mappings.
The VI core specification stays untouched.

What's in this PR

protocol-landscape/tenzro-tdip.md (new)

Mirrors the structure of the existing protocols.md:

• Summary of TDIP and what it covers.
• Core Relationship — TDIP supplies identity primitives, VI supplies
  the off-chain credential format that AP2-style architectures call
  for but don't prescribe.
• Mapping Table — VI L1/L2/L3a/L3b → TDIP equivalents.
• What VI Adds to a TDIP-Rooted Flow — three properties that
  carry over directly: off-chain verifiability, selective disclosure,
  per-purchase constraint enforcement.
• Integration Points — concrete bindings for identity, agent
  identity, runtime enforcement composition, and cross-protocol
  carriage (UCP/AP2 mandates extension; ACP extension fields).
• Why TDIP and VI Both Exist — the "registry round-trip" rationale.

examples/tenzro_tdip_flow.py (new)

A self-contained example that demonstrates VI ↔ TDIP composition.
Mocks the on-chain TDIP primitives (DelegationScope,
SpendingPolicy, IdentityRegistry) so the example runs without a
live Tenzro Ledger node, while exercising the real VI L1→L2→L3
chain. Verification at step 6 checks all four ceilings:

1. VI chain validity (verify_chain)
2. VI per-purchase constraints (check_constraints)
3. TDIP DelegationScope::enforce_operation
4. TDIP SpendingPolicy::check

All four MUST pass for the purchase to proceed. The example asserts
each, so pytest examples/tenzro_tdip_flow.py is a green test.

Files

protocol-landscape/tenzro-tdip.md       # new, ~140 lines
examples/tenzro_tdip_flow.py            # new, ~370 lines

No changes to spec/. No changes to src/. No changes to existing
protocol-landscape/ pages.

Tests

• pytest clean against this PR.
• python examples/tenzro_tdip_flow.py runs end-to-end and prints the
  same banner-formatted output as autonomous_flow.py.
• Re-uses the existing examples/helpers.py for keys / merchants /
  catalog — no new test-data dependencies.

SDK consistency

No SDK changes are required; the example uses only the existing
verifiable_intent SDK surface. The TDIP primitives are mocked
locally in the example file. A note in tenzro-tdip.md references
the upstream Rust reference implementation in
tenzro/tenzro-network::crates/tenzro-identity for readers who want
the real on-chain version.

Protocol-agnostic language

The VI core spec (spec/) is unchanged. All TDIP-specific language
lives only in protocol-landscape/tenzro-tdip.md and the example.

DCO sign-off

All commits in this PR carry Signed-off-by: Hilal Agil <eng@tenzro.com>.

AI assistance disclosure

Per the project's contribution norms: parts of the wording in this PR
description, the tenzro-tdip.md document, and code comments in the
example were prepared with AI assistance from Claude Code. All
technical decisions, the mapping itself, and final wording were
reviewed and authored by the human author (Hilal Agil,
eng@tenzro.com). The TDIP reference implementation in
tenzro/tenzro-network was developed independently.

Checklist

• PR title in Conventional Commits format:
  docs(protocol-landscape): add Tenzro TDIP integration mapping.
• Every commit Signed-off-by (DCO).
• No changes to spec/ (TDIP-specific content stays in
  protocol-landscape/).
• pytest clean against the change.
• Example exercised end-to-end and asserts all four ceilings pass.
• No new SDK changes required; verifiable_intent surface is
  unchanged.

[hilarl]

Withdrawing.