From 21873032c44f349c6c99798f2674c42a14e08058 Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Mon, 26 Oct 2026 23:51:31 -0500 Subject: [PATCH] Two authority-at-dispatch READMEs now match their records The fetch-route request carries the run URL and the generic criterion target-ack; the full marker first appears in the signed terminal receipt. In the served run, binding_veto and approval_unavailable each created a job that ended without an executor; the other refusals created no job. Run files and their checksums are unchanged. Co-Authored-By: Claude Opus 5.5 --- .../2026-10-24-fetch-route/README.md | 13 +++++++++---- .../2026-10-24-fetch-route/SHA256SUMS | 2 +- .../2026-10-24-served/README.md | 6 +++--- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/README.md b/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/README.md index c90cbe3..b236e11 100644 --- a/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/README.md +++ b/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/README.md @@ -2,8 +2,9 @@ One job created through the released hosted MCP on 2026-10-24 at 17:47 UTC, on service revision `18433a48d74af913550de7a018f02c7c724cc1c9` with hosted MCP `0.1.7`. The job's one permitted action -was a fetch of a public URL carrying a marker generated for this run. Every file here was produced by -that run and is unedited. Checksums are in [`SHA256SUMS`](./SHA256SUMS). +was a fetch of a public URL unique to this run, which answered with a marker generated for it. +The six numbered files and `health-at-run.json` were produced by that run and are unedited. +Checksums are in [`SHA256SUMS`](./SHA256SUMS). This answers the request in [agentrust-io/integrations#333](https://github.com/agentrust-io/integrations/issues/333) for a @@ -64,7 +65,10 @@ object, in this key order. ``` Fields outside it, here `runNowFirst` and the `criteria` alias, are not committed. The run-unique URL -and marker are inside `prompt`, so the decision commits to them. +is inside `prompt`, so the decision commits to it. The marker is not in the request. +`acceptance.criterion` carries only the generic value `target-ack`, so the decision does not commit +to the marker. The full marker, `target-ack 6b86b1f0cd3adaced3f1`, first appears in the signed +terminal receipt, as the text the job returned. ## Check it @@ -92,7 +96,8 @@ node verify.mjs request. Two jobs sent with identical requests would share a digest. The run-unique URL is what makes this one distinct. 2. **Executor to target.** The fetch is a plain GET with no executor signature. Target ingress is - tied to the job only by the run-unique URL and marker in the prompt. + tied to the job only by the run-unique URL in the prompt. The marker the target served comes back + in the signed receipt; nothing signed before the fetch commits to it. 3. **Service responses.** The create response, the job record and the health response are what the service returned. They are not signed records. diff --git a/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/SHA256SUMS b/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/SHA256SUMS index 50eb608..6f0ded0 100644 --- a/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/SHA256SUMS +++ b/public/evidence/aaif/authority-at-dispatch/2026-10-24-fetch-route/SHA256SUMS @@ -6,4 +6,4 @@ 34688c283148a0524b550666fa74839b38410c26fd63425734a2753ba89f040c 6-terminal-receipt.json b6849d19f65356cb3da0a1d0d4e840c1e1244830c9c2a637641f0cf7cf468616 health-at-run.json d1919890e1d5ff3c5da0f552c90e09ef672e514c7f2dc3e35c91276358c926a6 verify.mjs -57dcce249c71c083f43f70f25bae4bf24d0904a201a664da3f4c181c43aeceed README.md +f8bdb8c18f0cdb1066f6d02e7290bdff290e8adf8a13ecb3ee6455790c6ab249 README.md diff --git a/public/evidence/aaif/authority-at-dispatch/2026-10-24-served/README.md b/public/evidence/aaif/authority-at-dispatch/2026-10-24-served/README.md index 7ea7a40..43cefc0 100644 --- a/public/evidence/aaif/authority-at-dispatch/2026-10-24-served/README.md +++ b/public/evidence/aaif/authority-at-dispatch/2026-10-24-served/README.md @@ -13,16 +13,16 @@ stays at its own commit. | --- | --- | | Cases | 8 of 8 passed, no errors | | Signed records | 17, every one verified offline | -| Requests that should have been refused | all refused before a job was created | +| Requests that should have been refused | none ran. `binding_veto` and `approval_unavailable` each created a job that ended without an executor; every other refusal came before a job was created | | Control | `stale_authority` also includes a valid request, and that one ran and completed | | Reading the records | no account needed. Each record is link-only, so the link is the access | | Case | What it tests | Result | | --- | --- | --- | | `hosted_allow` | the permission covers the job | ran and completed | -| `binding_veto` | the job needs something the permission leaves out | refused before anything ran | +| `binding_veto` | the job needs something the permission leaves out | a job was created and refused before any executor ran; it ended failed | | `approval_reachable` | the job needs approval, and the operator approves | held, then ran | -| `approval_unavailable` | the job needs approval, and nobody answers | never ran. A late approval was refused too | +| `approval_unavailable` | the job needs approval, and nobody answers | a job was created and held. The owner cancelled it, so it never ran. A late approval was refused too | | `revoke_before_dispatch` | permission revoked, then used again | refused, and no job was created | | `expiry_before_dispatch` | permission used after it expires | refused, and no job was created | | `stale_authority` | revoked permission reused twice, plus a valid request | both refusals held, and the valid request ran |