# Vercy AI instruction - YAML 1.2 (JSON-compatible) { "vercy": "1.0-draft", "publication": { "status": "published", "adjudicationStatus": "reviewable-draft", "publishableCanonical": false, "generatedAt": "2026-10-21T17:00:26Z", "synthesisSha256": "8108b764195b273a205f84948f137f160fd97e2459792dd4dcf3639830210b1d", "providerMode": "single-provider-waiver", "providers": [ "Codex" ], "waivedProviders": [ "Claude", "Grok" ] }, "metaModel": { "id": "WM-AI-016", "registryId": "vr.wm-ai-016", "name": "Agent Handoff Message", "version": "0.1.0", "previousVersions": [], "entryKind": "entity", "family": "World Models", "category": "Information and virtual systems", "industry": [ "Cross-industry" ], "domain": [ "INF.AI.HND" ], "tags": [ "agent", "handoff", "message", "inf.ai.hnd" ], "status": "published" }, "canonicalUrl": "https://ver.cy/models/wm-ai-016-agent-handoff-message/", "sourceUrl": "https://github.com/ver-cy/world-models/tree/feat/mega-model-registry/research/runs/wm-ai-016", "model": { "registry_id": "vr.wm-ai-016", "model_id": "WM-AI-016", "name": "Agent Handoff Message", "entry_kind": "entity", "purpose": "Describe an identified communication that proposes or conveys a bounded task or context transfer between agents, with recipient-specific evidence and explicit authority references.", "scope_statement": "One logical handoff message and its governed representations. Sending, receiving and responding are separately evidenced occurrences. The message can exist before delivery or acceptance and may transfer context without a task. This format-neutral research proposal is not an execution engine or a grant of authority.", "in_scope": [ "Message identity, intent, participant bindings and correlation references", "Selected context, remaining work, constraints, uncertainty and artifact access descriptions", "Recipient-specific receipt and acceptance evidence references, expiry, supersession and interoperability losses" ], "out_of_scope": [ "Agent run execution, scheduling, task state machines, cost accounting and compensation", "Issuing, expanding, revoking or enforcing delegation mandates or credentials", "Agent configuration, tool definitions, full conversation or memory stores and authoritative audit trails", "Transport delivery, external artifact retrieval, operational security enforcement and domain-specific dangerous instructions" ], "boundary_notes": [ { "neighbor": "WM-AI-004 AI Inference / Agent Run", "distinction": "Registry parent is a candidate contextual alignment, not inheritance: a message is not a run. Carry optional originating and receiving run references; execution and task lifecycle remain externally mastered.", "source_refs": [ "SRC-001", "SRC-003" ] }, { "neighbor": "WM-AI-015 Agent Delegation Mandate", "distinction": "Reference an applicable mandate or record that no delegated action is requested. A handoff request, recipient acceptance or role label never issues or widens authority.", "source_refs": [ "SRC-003", "SRC-004", "SRC-002" ] }, { "neighbor": "WM-AI-005 Prompt / Agent Configuration", "distinction": "Instructions and configuration remain external versioned masters. Transferred context is untrusted data and cannot silently replace the receiving agent policy.", "source_refs": [ "SRC-006", "SRC-002" ] }, { "neighbor": "WM-AI-017 Tool Description", "distinction": "Optional tool or capability references express requirements only; this message owns neither tool interface definitions nor invocation permissions.", "source_refs": [ "SRC-001", "SRC-002" ] }, { "neighbor": "A2A task, message and artifact", "distinction": "A2A supplies a candidate communication mapping. Local handoff purpose, offer acceptance and work-transfer meaning require a declared application profile; A2A task artifacts retain their own identities.", "source_refs": [ "SRC-001" ] } ] }, "sources": [ { "id": "SRC-001", "title": "A2A Protocol Specification", "organization": "A2A project", "url": "https://a2a-protocol.org/v1.0.0/specification/", "version_or_date": "1.0.0; selected sections accessed 2026-10-21", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Sections 3.3.1, 3.4, 3.6 and 4.1 separate message, task, context, parts and optional duplicate detection. Handoff intent and acceptance are local profile proposals, not a universal A2A operation." }, { "id": "SRC-002", "title": "MCP Security Best Practices", "organization": "MCP project", "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices", "version_or_date": "2025-11-25 URL redirects to versioned tutorial; current-version gate open", "source_type": "first-party-doc", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Token passthrough, trust boundaries and scope minimization support credential separation. MCP is an adjacent authorization and tool-access alignment, not a handoff protocol." }, { "id": "SRC-003", "title": "PROV-O: The PROV Ontology", "organization": "W3C", "url": "https://www.w3.org/TR/prov-o/", "version_or_date": "W3C Recommendation 2013-04-30", "source_type": "ontology", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Entity, activity, derivation, attribution, revision and qualified delegation support message lineage. Provenance assertions do not prove truth or confer authorization." }, { "id": "SRC-004", "title": "RFC 8693: OAuth 2.0 Token Exchange", "organization": "IETF", "url": "https://www.rfc-editor.org/rfc/rfc8693", "version_or_date": "RFC 8693, January 2020", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Sections 1.1 and 2 distinguish delegation, impersonation, subject and actor, with audience and scope requests. Token issuance and trust decisions remain outside this model." }, { "id": "SRC-005", "title": "Trace Context", "organization": "W3C", "url": "https://www.w3.org/TR/trace-context/", "version_or_date": "W3C Recommendation 2021-11-23", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Trace correlation and sections 6-7 privacy/security support separating telemetry identifiers from message and authorization identity." }, { "id": "SRC-006", "title": "LLM Prompt Injection Prevention Cheat Sheet", "organization": "OWASP", "url": "https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html", "version_or_date": "Living guidance accessed 2026-10-21; revision not pinned", "source_type": "first-party-doc", "primary_source": true, "authority_tier": 2, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Structured separation of instructions and data, least privilege and human oversight inform policy-level handling of untrusted transferred context. No prevention guarantee is claimed." }, { "id": "SRC-007", "title": "RFC 3339: Date and Time on the Internet: Timestamps", "organization": "IETF", "url": "https://www.rfc-editor.org/rfc/rfc3339", "version_or_date": "RFC 3339, July 2002", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Section 5.6 provides timestamp syntax. Clock uncertainty, expiry decisions and event-versus-ingestion distinctions are local profile responsibilities." }, { "id": "SRC-008", "title": "CloudEvents Specification", "organization": "CNCF CloudEvents project", "url": "https://github.com/cloudevents/spec/blob/v1.0.2/cloudevents/spec.md", "version_or_date": "v1.0.2; event specversion remains 1.0", "source_type": "standard", "primary_source": true, "authority_tier": 1, "accessed_at": "2026-10-21T16:59:05Z", "relevance": "Required id and source attributes distinguish scoped event identity and retransmitted duplicates. Optional event-envelope alignment does not supply exactly-once effects or handoff semantics." } ], "structure": { "bundles": [ { "id": "bundle-identity", "name": "Message identity", "description": "Proposed message concern: message identity.", "rationale": "Groups distinct questions about message identity within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005", "SRC-008" ], "layers": [ { "id": "layer-envelope", "name": "Logical identity and representation", "description": "Preserve one logical communication across authorized representations and delivery attempts. A changed offer or materially changed payload needs a new message linked to the earlier one; it is not an invisible retry.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ], "findings": [ { "id": "finding-message-identity", "name": "Scoped message identity", "description": "Preserve one logical communication across authorized representations and delivery attempts. A changed offer or materially changed payload needs a new message linked to the earlier one; it is not an invisible retry.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ], "questions": [ { "id": "q-message-identity-1", "text": "Which master namespace and identifier distinguish this message from its task, run and delivery attempts?", "kind": "identity", "answer_data": [ "master_system", "message_id", "namespace", "attempt_refs" ] }, { "id": "q-message-identity-2", "text": "What declared handoff intent distinguishes a context notice, work offer, continuation, return or cancellation request?", "kind": "classification", "answer_data": [ "intent_code", "intent_scheme_version", "requested_effect" ] }, { "id": "q-message-identity-3", "text": "How is reuse of the same message identifier with different content detected and quarantined?", "kind": "validation", "answer_data": [ "representation_digest", "comparison_basis", "conflict_disposition" ] }, { "id": "q-message-identity-4", "text": "Which predecessor does a corrected or superseding message identify without rewriting the original?", "kind": "lifecycle", "answer_data": [ "predecessor_ref", "relation_type", "change_reason" ] } ], "data_elements": [ { "id": "data-message-identity-identity-binding", "name": "Identity binding", "description": "Authoritative namespace-qualified logical message identifier.", "value_kind": "identifier", "cardinality": "1", "required": true, "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ] }, { "id": "data-message-identity-intent", "name": "Intent", "description": "Profile-defined intent; unknown values are not guessed.", "value_kind": "code", "cardinality": "1", "required": true, "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ] }, { "id": "data-message-identity-representations", "name": "Representations", "description": "Representation IDs, versions, digests and delivery-attempt references.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ] } ], "artifacts": [ { "id": "artifact-message-identity", "name": "Message envelope", "description": "Candidate governed representation of scoped message identity. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-correlation", "name": "Participants and correlation", "description": "Bind sender, intended recipient and represented principal to governed identities. Context, task, trace and run references serve different purposes and are never interchangeable evidence of access.", "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ], "findings": [ { "id": "finding-participant-binding", "name": "Participants and conversation bindings", "description": "Bind sender, intended recipient and represented principal to governed identities. Context, task, trace and run references serve different purposes and are never interchangeable evidence of access.", "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ], "questions": [ { "id": "q-participant-binding-1", "text": "Which sender, intended recipient and represented principal are bound to this transfer?", "kind": "relationship", "answer_data": [ "sender_ref", "recipient_refs", "principal_ref", "binding_evidence_ref" ] }, { "id": "q-participant-binding-2", "text": "Which context, task and run identifiers are related, and which are deliberately absent?", "kind": "composition", "answer_data": [ "context_ref", "task_refs", "origin_run_ref", "receiving_run_ref", "absence_reason" ] }, { "id": "q-participant-binding-3", "text": "Who is accountable for the message record and who owns the referenced work after a reported acceptance?", "kind": "ownership", "answer_data": [ "record_custodian_role", "work_owner_ref", "assignment_evidence_ref" ] }, { "id": "q-participant-binding-4", "text": "Which trust-domain and tenant bindings prevent a trace or conversation identifier from granting access?", "kind": "security", "answer_data": [ "tenant_binding", "trust_domain", "authentication_evidence_ref", "trace_ref" ] } ], "data_elements": [ { "id": "data-participant-binding-participants", "name": "Participants", "description": "Role-tagged external identities; a role name alone is not authentication.", "value_kind": "collection", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ] }, { "id": "data-participant-binding-correlations", "name": "Correlations", "description": "Typed context, task, run, reply and trace references.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ] }, { "id": "data-participant-binding-custody", "name": "Custody", "description": "Accountable message-record custodian role binding.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ] } ], "artifacts": [ { "id": "artifact-participant-binding", "name": "Participant and correlation manifest", "description": "Candidate governed representation of participants and conversation bindings. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-003", "SRC-004", "SRC-005" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "bundle-work-context", "name": "Transferred work and context", "description": "Proposed message concern: transferred work and context.", "rationale": "Groups distinct questions about transferred work and context within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "layers": [ { "id": "layer-work", "name": "Work intent and limits", "description": "Describe the bounded remainder and response expected by the sender. Distinguish completed assertions from verified results and proposed actions from authorized actions. Work planning and execution stay external.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "findings": [ { "id": "finding-remaining-work", "name": "Remaining work and expected response", "description": "Describe the bounded remainder and response expected by the sender. Distinguish completed assertions from verified results and proposed actions from authorized actions. Work planning and execution stay external.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ], "questions": [ { "id": "q-remaining-work-1", "text": "What goal, remaining work and explicit exclusions are communicated to the recipient?", "kind": "definition", "answer_data": [ "goal_summary", "remaining_work", "exclusions", "task_definition_ref" ] }, { "id": "q-remaining-work-2", "text": "Which completed-work assertions are supported by result references and which remain unverified?", "kind": "evidence", "answer_data": [ "completion_assertions", "evidence_refs", "verification_state" ] }, { "id": "q-remaining-work-3", "text": "What deliverable, response format and acceptance criteria does this offer request?", "kind": "requirement", "answer_data": [ "deliverable_ref", "response_schema_ref", "acceptance_criteria", "reply_ref" ] }, { "id": "q-remaining-work-4", "text": "Which stated time, cost or tool constraints are only requested limits pending external authorization?", "kind": "constraint", "answer_data": [ "requested_limits", "units", "authority_ref", "enforcement_owner_ref" ] } ], "data_elements": [ { "id": "data-remaining-work-work-summary", "name": "Work summary", "description": "Goal and bounded remainder, allowing a context-only transfer with no requested work.", "value_kind": "object", "cardinality": "1", "required": true, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "data-remaining-work-result-claims", "name": "Result claims", "description": "Claim, evidence, author and verification status.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "data-remaining-work-response-contract", "name": "Response contract", "description": "Requested response shape, limits and criteria; not executable scheduling.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] } ], "artifacts": [ { "id": "artifact-remaining-work", "name": "Work transfer brief", "description": "Candidate governed representation of remaining work and expected response. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-snapshot", "name": "Selected context and uncertainty", "description": "Carry the minimum selected context or stable references needed for the declared purpose. Preserve source, version, uncertainty, truncation and omitted material; a summary does not establish completeness or require disclosure of private internal reasoning.", "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ], "findings": [ { "id": "finding-context-selection", "name": "Context snapshot and omissions", "description": "Carry the minimum selected context or stable references needed for the declared purpose. Preserve source, version, uncertainty, truncation and omitted material; a summary does not establish completeness or require disclosure of private internal reasoning.", "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ], "questions": [ { "id": "q-context-selection-1", "text": "Which source revisions and selection process produced the context snapshot or summary?", "kind": "provenance", "answer_data": [ "source_refs", "source_versions", "selection_activity_ref", "summary_author_ref" ] }, { "id": "q-context-selection-2", "text": "What uncertainties, contradictions and missing dependencies could change the receiving agent interpretation?", "kind": "quality", "answer_data": [ "uncertainties", "contradictions", "missing_dependencies", "confidence_basis" ] }, { "id": "q-context-selection-3", "text": "Which purpose and recipient view justify included context and document deliberate omissions?", "kind": "privacy", "answer_data": [ "purpose", "recipient_view", "minimization_basis", "omission_reasons" ] }, { "id": "q-context-selection-4", "text": "At what observation time was the context valid and what freshness condition requires rechecking it?", "kind": "temporal", "answer_data": [ "observed_at", "source_effective_at", "freshness_rule", "recheck_owner_ref" ] } ], "data_elements": [ { "id": "data-context-selection-snapshot", "name": "Snapshot", "description": "Selected content or references, versions and purpose; no hidden reasoning requirement.", "value_kind": "object", "cardinality": "1", "required": true, "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ] }, { "id": "data-context-selection-gaps", "name": "Known gaps", "description": "Omissions, truncation, unresolved contradictions and unavailable dependencies.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ] }, { "id": "data-context-selection-freshness", "name": "Freshness", "description": "Observed/effective times and a profile-defined freshness rule.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ] } ], "artifacts": [ { "id": "artifact-context-selection", "name": "Context selection manifest", "description": "Candidate governed representation of context snapshot and omissions. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-003", "SRC-006", "SRC-001" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "bundle-payload", "name": "Payload and evidence", "description": "Proposed message concern: payload and evidence.", "rationale": "Groups distinct questions about payload and evidence within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-001", "SRC-002", "SRC-003", "SRC-005", "SRC-007" ], "layers": [ { "id": "layer-parts", "name": "Payload references and integrity", "description": "Describe typed inline parts and external artifacts with identity, integrity and permitted resolution requirements. Referenced artifacts remain in their master systems; a URL or digest is neither access permission nor proof of safe content.", "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ], "findings": [ { "id": "finding-payload-manifest", "name": "Parts and artifact resolution", "description": "Describe typed inline parts and external artifacts with identity, integrity and permitted resolution requirements. Referenced artifacts remain in their master systems; a URL or digest is neither access permission nor proof of safe content.", "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ], "questions": [ { "id": "q-payload-manifest-1", "text": "Which ordered content parts are inline and which reference independently mastered artifacts?", "kind": "composition", "answer_data": [ "part_order", "part_kind", "media_type", "artifact_ref", "artifact_version" ] }, { "id": "q-payload-manifest-2", "text": "What authorization and expiry conditions govern each recipient attempt to resolve an artifact?", "kind": "access", "answer_data": [ "recipient_ref", "resolution_policy_ref", "access_expiry", "access_evidence_ref" ] }, { "id": "q-payload-manifest-3", "text": "What digest, size or schema evidence detects missing, altered or incompatible content?", "kind": "validation", "answer_data": [ "digest_algorithm", "digest", "byte_count", "schema_ref", "validation_result_ref" ] }, { "id": "q-payload-manifest-4", "text": "How should an unavailable, quarantined or expired artifact be represented without silently replacing it?", "kind": "exception", "answer_data": [ "availability_state", "failure_reason", "alternative_ref", "recipient_decision_ref" ] } ], "data_elements": [ { "id": "data-payload-manifest-parts", "name": "Parts", "description": "Typed content descriptors or references with media type and order.", "value_kind": "collection", "cardinality": "1..n", "required": true, "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ] }, { "id": "data-payload-manifest-integrity", "name": "Integrity descriptors", "description": "Digest algorithm, bytes and representation version, scoped to exact content.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ] }, { "id": "data-payload-manifest-resolution", "name": "Resolution constraints", "description": "Recipient view, policy reference, expiry and observed availability.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ] } ], "artifacts": [ { "id": "artifact-payload-manifest", "name": "Payload manifest", "description": "Candidate governed representation of parts and artifact resolution. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-003", "SRC-002" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-lineage", "name": "Claim attribution and continuity", "description": "Keep message authorship, generation activity, derivation and observations distinct. Evidence may be disputed or incomplete. Referenced audit records and traces retain their own authority and retention rules.", "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ], "findings": [ { "id": "finding-provenance-record", "name": "Message lineage and evidence", "description": "Keep message authorship, generation activity, derivation and observations distinct. Evidence may be disputed or incomplete. Referenced audit records and traces retain their own authority and retention rules.", "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ], "questions": [ { "id": "q-provenance-record-1", "text": "Who authored or generated this representation and from which source entities was it derived?", "kind": "provenance", "answer_data": [ "author_ref", "generation_activity_ref", "derived_from_refs" ] }, { "id": "q-provenance-record-2", "text": "What evidence supports a claimed handoff occurrence and who attested or observed it?", "kind": "evidence", "answer_data": [ "occurrence_ref", "attestation_ref", "observer_ref", "evidence_status" ] }, { "id": "q-provenance-record-3", "text": "How are creation, dispatch, receipt and ingestion times distinguished when clocks disagree?", "kind": "temporal", "answer_data": [ "created_at", "dispatch_evidence_ref", "receipt_evidence_ref", "ingested_at", "clock_uncertainty" ] }, { "id": "q-provenance-record-4", "text": "Which provenance links are asserted, verified, disputed or missing rather than treated as proof of truth?", "kind": "quality", "answer_data": [ "link_ref", "assertion_state", "verification_basis", "dispute_ref" ] } ], "data_elements": [ { "id": "data-provenance-record-lineage", "name": "Lineage", "description": "Typed derivation, generation, attribution and revision links.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ] }, { "id": "data-provenance-record-evidence-index", "name": "Evidence index", "description": "Master audit or receipt references and their observed evidentiary status.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ] }, { "id": "data-provenance-record-time-observations", "name": "Time observations", "description": "Event and ingestion times, observers and uncertainty.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ] } ], "artifacts": [ { "id": "artifact-provenance-record", "name": "Lineage and evidence index", "description": "Candidate governed representation of message lineage and evidence. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-003", "SRC-005", "SRC-007" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "bundle-authority", "name": "Authority and trust", "description": "Proposed message concern: authority and trust.", "rationale": "Groups distinct questions about authority and trust within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-002", "SRC-003", "SRC-004", "SRC-005", "SRC-006" ], "layers": [ { "id": "layer-mandate", "name": "Mandate and principal binding", "description": "Reference an existing mandate, policy or authorization decision for requested action and access. Keep actor and subject distinguishable. Transfer no bearer credentials in context; authorization evaluation, token exchange and revocation execution remain external.", "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ], "findings": [ { "id": "finding-authority-reference", "name": "Bounded authority reference", "description": "Reference an existing mandate, policy or authorization decision for requested action and access. Keep actor and subject distinguishable. Transfer no bearer credentials in context; authorization evaluation, token exchange and revocation execution remain external.", "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ], "questions": [ { "id": "q-authority-reference-1", "text": "Which mandate or policy authorizes this sender to request this recipient action on behalf of the stated principal?", "kind": "authority", "answer_data": [ "mandate_ref", "version", "actor_ref", "principal_ref", "decision_ref" ] }, { "id": "q-authority-reference-2", "text": "Which audience, scope, expiry and redelegation limits constrain the requested action?", "kind": "constraint", "answer_data": [ "audience", "scope_refs", "valid_until", "redelegation_rule_ref" ] }, { "id": "q-authority-reference-3", "text": "How are credential material and authorization references kept separate in the transferred context?", "kind": "security", "answer_data": [ "credential_exclusion_rule", "secure_channel_ref", "reference_type", "inspection_evidence_ref" ] }, { "id": "q-authority-reference-4", "text": "What unresolved or revoked authority evidence requires the recipient to defer or refuse action?", "kind": "exception", "answer_data": [ "authority_state", "revocation_observed_at", "refusal_reason", "review_route_ref" ] } ], "data_elements": [ { "id": "data-authority-reference-authority-binding", "name": "Authority binding", "description": "External mandate/policy version and decision reference; absent for context-only no-action transfer where allowed.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ] }, { "id": "data-authority-reference-limits", "name": "Authority limits", "description": "Reported audience, scope and validity limits with source references.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ] }, { "id": "data-authority-reference-authority-status", "name": "Authority observation", "description": "Observed status and recheck requirement; not an authorization engine.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ] } ], "artifacts": [ { "id": "artifact-authority-reference", "name": "Authority binding statement", "description": "Candidate governed representation of bounded authority reference. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-trust", "name": "Untrusted context handling", "description": "Label content trust and instruction provenance. Receiving policies decide how to use context and when to require qualified human review. Context cannot override policy, elevate permissions or establish that a hazardous action is safe.", "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ], "findings": [ { "id": "finding-trust-policy", "name": "Recipient trust and escalation policy", "description": "Label content trust and instruction provenance. Receiving policies decide how to use context and when to require qualified human review. Context cannot override policy, elevate permissions or establish that a hazardous action is safe.", "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ], "questions": [ { "id": "q-trust-policy-1", "text": "Which parts are untrusted data or external instructions and how are they separated from receiving policy?", "kind": "security", "answer_data": [ "part_ref", "trust_label", "instruction_origin", "receiver_policy_ref" ] }, { "id": "q-trust-policy-2", "text": "Which recipient view hides secrets, sensitive payloads and correlation metadata not needed for the purpose?", "kind": "access", "answer_data": [ "recipient_view_ref", "redacted_fields", "disclosure_basis", "metadata_filter" ] }, { "id": "q-trust-policy-3", "text": "What policy condition requires human review, refusal or escalation before acting on the handoff?", "kind": "decision", "answer_data": [ "trigger", "review_role", "decision_ref", "allowed_response" ] }, { "id": "q-trust-policy-4", "text": "How are suspicious or policy-conflicting parts quarantined while retaining safe evidence references?", "kind": "exception", "answer_data": [ "part_ref", "quarantine_state", "safe_evidence_ref", "notification_policy_ref" ] } ], "data_elements": [ { "id": "data-trust-policy-trust-labels", "name": "Trust labels", "description": "Per-part provenance and trust labels; not a safety certificate.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ] }, { "id": "data-trust-policy-disclosure-view", "name": "Disclosure view", "description": "Recipient and purpose-scoped access profile.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ] }, { "id": "data-trust-policy-escalation", "name": "Escalation policy", "description": "External review, refusal or quarantine policy and responsible role.", "value_kind": "reference", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ] } ], "artifacts": [ { "id": "artifact-trust-policy", "name": "Trust and disclosure assessment", "description": "Candidate governed representation of recipient trust and escalation policy. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "bundle-receipt", "name": "Receipt and continuation evidence", "description": "Proposed message concern: receipt and continuation evidence.", "rationale": "Groups distinct questions about receipt and continuation evidence within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-001", "SRC-003", "SRC-007", "SRC-008" ], "layers": [ { "id": "layer-response", "name": "Receipt and acceptance distinction", "description": "Record observations and external evidence for receipt, acceptance, refusal, clarification or unknown disposition per recipient. These are application-profile concepts. A transport success, silence or task status alone does not prove ownership transfer.", "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ], "findings": [ { "id": "finding-recipient-disposition", "name": "Recipient disposition evidence", "description": "Record observations and external evidence for receipt, acceptance, refusal, clarification or unknown disposition per recipient. These are application-profile concepts. A transport success, silence or task status alone does not prove ownership transfer.", "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ], "questions": [ { "id": "q-recipient-disposition-1", "text": "What is known about each intended recipient receipt separately from acceptance of the offered work?", "kind": "state", "answer_data": [ "recipient_ref", "receipt_state", "acceptance_state", "evidence_refs" ] }, { "id": "q-recipient-disposition-2", "text": "Who may attest acceptance and which exact message and offer revision does that attestation cover?", "kind": "authority", "answer_data": [ "attestor_ref", "authority_ref", "message_ref", "offer_digest", "response_ref" ] }, { "id": "q-recipient-disposition-3", "text": "What clarification, partial acceptance or refusal is reported and what work remains with the sender?", "kind": "process", "answer_data": [ "response_kind", "accepted_scope", "excluded_scope", "remaining_owner_ref" ] }, { "id": "q-recipient-disposition-4", "text": "Which external assignment or continuation record establishes the effect of an accepted handoff?", "kind": "event", "answer_data": [ "assignment_ref", "receiving_run_ref", "effect_observed_at", "verification_state" ] } ], "data_elements": [ { "id": "data-recipient-disposition-dispositions", "name": "Recipient dispositions", "description": "Per-recipient states with evidence, unknown allowed.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ] }, { "id": "data-recipient-disposition-response-binding", "name": "Response bindings", "description": "Reply ID, original message digest, accepted scope and attestor.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ] }, { "id": "data-recipient-disposition-continuation", "name": "Continuation evidence", "description": "External assignment or run references; no local execution state machine.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ] } ], "artifacts": [ { "id": "artifact-recipient-disposition", "name": "Recipient disposition record", "description": "Candidate governed representation of recipient disposition evidence. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-recovery", "name": "Retry, expiry and supersession", "description": "Retain attempt references and unknown outcomes without promising exactly-once delivery or effects. A2A permits rather than guarantees send idempotency. Cancellation requests and superseding messages do not retract already observed execution.", "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ], "findings": [ { "id": "finding-delivery-ambiguity", "name": "Delivery ambiguity and stale offers", "description": "Retain attempt references and unknown outcomes without promising exactly-once delivery or effects. A2A permits rather than guarantees send idempotency. Cancellation requests and superseding messages do not retract already observed execution.", "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ], "questions": [ { "id": "q-delivery-ambiguity-1", "text": "How are retries of one unchanged message distinguished from new offers and superseding communications?", "kind": "lifecycle", "answer_data": [ "message_ref", "attempt_refs", "retry_key_scope", "supersedes_ref" ] }, { "id": "q-delivery-ambiguity-2", "text": "What expiry, deadline and clock-skew policy applies to a delayed acceptance or stale context?", "kind": "temporal", "answer_data": [ "offer_expires_at", "deadline_ref", "clock_skew_rule", "late_response_policy" ] }, { "id": "q-delivery-ambiguity-3", "text": "What recorded state preserves an uncertain delivery or conflicting recipient response for reconciliation?", "kind": "exception", "answer_data": [ "uncertainty_state", "conflicting_response_refs", "reconciliation_owner_ref" ] }, { "id": "q-delivery-ambiguity-4", "text": "Which external authority decides cancellation or compensation after work may already have started?", "kind": "constraint", "answer_data": [ "cancellation_request_ref", "task_owner_ref", "decision_ref", "effect_evidence_ref" ] } ], "data_elements": [ { "id": "data-delivery-ambiguity-attempts", "name": "Attempts", "description": "External delivery observations and retry/deduplication key scope.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ] }, { "id": "data-delivery-ambiguity-expiry", "name": "Expiry policy", "description": "Offer expiry, time basis and late-response policy.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ] }, { "id": "data-delivery-ambiguity-recovery", "name": "Recovery references", "description": "Supersession, cancellation request and reconciliation evidence; no undo guarantee.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ] } ], "artifacts": [ { "id": "artifact-delivery-ambiguity", "name": "Delivery reconciliation record", "description": "Candidate governed representation of delivery ambiguity and stale offers. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-008", "SRC-007" ] } ], "inline_only_rationale": null } ] } ] }, { "id": "bundle-governance", "name": "Interoperability and record governance", "description": "Proposed message concern: interoperability and record governance.", "rationale": "Groups distinct questions about interoperability and record governance within the message boundary; referenced masters retain their own operations.", "source_refs": [ "SRC-001", "SRC-003", "SRC-005", "SRC-006", "SRC-008" ], "layers": [ { "id": "layer-profile", "name": "Profile and compatibility", "description": "Pin the adopted message profile, protocol version and extension semantics. A2A, CloudEvents, PROV-O and Trace Context map distinct concerns. Unsupported critical extensions or lossy field projections require explicit disposition.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ], "findings": [ { "id": "finding-profile-mapping", "name": "Profile mapping and validation", "description": "Pin the adopted message profile, protocol version and extension semantics. A2A, CloudEvents, PROV-O and Trace Context map distinct concerns. Unsupported critical extensions or lossy field projections require explicit disposition.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ], "questions": [ { "id": "q-profile-mapping-1", "text": "Which protocol version, application profile and extension vocabulary define this handoff representation?", "kind": "interoperability", "answer_data": [ "protocol_version", "profile_ref", "profile_version", "extension_uris" ] }, { "id": "q-profile-mapping-2", "text": "Which required fields and semantic constraints were checked for this exact representation?", "kind": "validation", "answer_data": [ "schema_ref", "constraint_set_ref", "representation_digest", "validation_evidence_ref" ] }, { "id": "q-profile-mapping-3", "text": "What meaning is lost when mapping message roles, intent, parts or identifiers between bindings?", "kind": "quality", "answer_data": [ "mapping_version", "field_losses", "unsupported_values", "disposition" ] }, { "id": "q-profile-mapping-4", "text": "Which acceptance fixtures must pass before claiming operational interoperability?", "kind": "requirement", "answer_data": [ "fixture_set_ref", "tested_versions", "results_ref", "unresolved_failures" ] } ], "data_elements": [ { "id": "data-profile-mapping-profile", "name": "Profile binding", "description": "Pinned application semantics and protocol version.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ] }, { "id": "data-profile-mapping-mapping", "name": "Mapping description", "description": "Mapping version and loss report; a conceptual mapping is not conformance.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ] }, { "id": "data-profile-mapping-validation-evidence", "name": "Validation evidence", "description": "Schema/semantic test references and exact representation digest.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ] } ], "artifacts": [ { "id": "artifact-profile-mapping", "name": "Profile and conformance report", "description": "Candidate governed representation of profile mapping and validation. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-001", "SRC-008", "SRC-003", "SRC-005" ] } ], "inline_only_rationale": null } ] }, { "id": "layer-retention", "name": "Custody and disposition", "description": "Govern only local message representations, recipient views and evidence references. Custodians define retention and erasure by applicable policy. Revision continuity must not require indefinite retention of sensitive payloads.", "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ], "findings": [ { "id": "finding-record-disposition", "name": "Record continuity and disposal", "description": "Govern only local message representations, recipient views and evidence references. Custodians define retention and erasure by applicable policy. Revision continuity must not require indefinite retention of sensitive payloads.", "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ], "questions": [ { "id": "q-record-disposition-1", "text": "Which policy determines retention periods and holds for message payloads, metadata and cached references?", "kind": "retention", "answer_data": [ "policy_ref", "record_class", "retention_trigger", "hold_refs" ] }, { "id": "q-record-disposition-2", "text": "How can recipient copies or cached payloads be erased while preserving permitted minimal continuity evidence?", "kind": "privacy", "answer_data": [ "copy_inventory_ref", "erasure_scope", "minimal_tombstone", "confirmation_refs" ] }, { "id": "q-record-disposition-3", "text": "Which custodian may correct metadata or retire a local record without altering external task or mandate masters?", "kind": "ownership", "answer_data": [ "custodian_role", "mutation_scope", "external_master_refs" ] }, { "id": "q-record-disposition-4", "text": "How are superseded, redacted or disposed representations resolved for authorized readers?", "kind": "lifecycle", "answer_data": [ "record_state", "replacement_ref", "redaction_reason", "resolution_policy_ref" ] } ], "data_elements": [ { "id": "data-record-disposition-custody-policy", "name": "Custody policy", "description": "Accountable role and retention/access policy binding.", "value_kind": "reference", "cardinality": "1", "required": true, "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ] }, { "id": "data-record-disposition-disposition", "name": "Disposition metadata", "description": "Policy-authorized erasure, hold and minimal tombstone details.", "value_kind": "object", "cardinality": "0..1", "required": false, "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ] }, { "id": "data-record-disposition-copy-links", "name": "Copy links", "description": "Recipient/cache copy references subject to independent custodian policy.", "value_kind": "collection", "cardinality": "0..n", "required": false, "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ] } ], "artifacts": [ { "id": "artifact-record-disposition", "name": "Record disposition manifest", "description": "Candidate governed representation of record continuity and disposal. May be a section in a shared message package rather than a separate file.", "media_or_form": [ "Structured record", "Human-readable view" ], "serial": true, "identity_strategy": "Authoritative master-system artifact ID first; otherwise governed IRI, then Dimension-assigned UUID or ULID. Bind to message ID, representation version and digest. Time is metadata, not identity.", "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ] } ], "inline_only_rationale": null } ] } ] } ] }, "functions": [ { "id": "function-compose-envelope", "name": "Compose a local handoff draft", "description": "Proposed, unimplemented operation. Create a local draft with selected context, recipient bindings and requested effect.", "inputs": [ "Master message identity", "Authorized input references", "Recipient view", "Pinned profile" ], "outputs": [ "Draft record or refusal report" ], "preconditions": [ "Record-creation authority is verified", "External references remain scoped and unresolved facts are labeled" ], "effects": [ "Writes a local draft only; does not send or assign work" ], "source_refs": [ "SRC-001", "SRC-003", "SRC-006" ] }, { "id": "function-validate-envelope", "name": "Validate a local representation", "description": "Proposed, unimplemented operation. Check local shape, reference consistency, required profile fields and declared constraints.", "inputs": [ "Representation and digest", "Pinned schema and profile", "Available validation evidence" ], "outputs": [ "Validation report with pass, fail or unresolved checks" ], "preconditions": [ "Read access to the representation", "Pinned versions are available" ], "effects": [ "Records validation evidence only; does not grant permission or certify content truth" ], "source_refs": [ "SRC-001", "SRC-008", "SRC-002" ] }, { "id": "function-project-recipient-view", "name": "Prepare a recipient view", "description": "Proposed, unimplemented operation. Produce a minimized local view under an existing disclosure policy.", "inputs": [ "Message representation", "Recipient identity", "Disclosure policy and authorization evidence" ], "outputs": [ "Recipient view with redaction manifest or refusal" ], "preconditions": [ "Disclosure decision is externally authorized", "No credential material is included" ], "effects": [ "Creates a local projection and provenance link; does not transmit or broaden access" ], "source_refs": [ "SRC-006", "SRC-002", "SRC-005" ] }, { "id": "function-link-disposition", "name": "Link recipient disposition evidence", "description": "Proposed, unimplemented operation. Bind a reported receipt or acceptance to the exact message and recipient.", "inputs": [ "Message digest", "External response evidence", "Recipient binding" ], "outputs": [ "Disposition observation or unresolved-conflict record" ], "preconditions": [ "Evidence source and mutation role are identified", "Receipt, acceptance and task completion remain distinct" ], "effects": [ "Appends a local evidence reference; does not assign work, execute tasks or treat silence as acceptance" ], "source_refs": [ "SRC-001", "SRC-003", "SRC-007" ] }, { "id": "function-record-supersession", "name": "Record message supersession", "description": "Proposed, unimplemented operation. Link a newly authored message to a prior offer without changing its historical payload.", "inputs": [ "New message identity", "Prior message reference", "Change reason", "Expected local revision" ], "outputs": [ "Supersession link or concurrency conflict" ], "preconditions": [ "Authorized local editor", "Both message identities and versions are explicit" ], "effects": [ "Updates local continuity metadata only; cannot cancel downstream execution or revoke a mandate" ], "source_refs": [ "SRC-003", "SRC-001", "SRC-008" ] }, { "id": "function-record-disposition-plan", "name": "Record local disposal disposition", "description": "Proposed, unimplemented operation. Record approved retention or erasure instructions and observed execution evidence.", "inputs": [ "Policy decision reference", "Local record/copy scope", "Hold state", "Custodian role" ], "outputs": [ "Disposition record or refusal with unresolved holds" ], "preconditions": [ "Custodian authorization and applicable policy are evidenced", "Active holds and copy owners are checked" ], "effects": [ "Records a plan or evidence locally; deletion execution belongs to the adopting Dimension record custodian and does not delete external masters" ], "source_refs": [ "SRC-003", "SRC-006", "SRC-005" ] } ], "composition": [ { "target": "WM-AI-004", "relation": "REFERENCE", "purpose": "Optional origin/continuation run binding; candidate registry parent is not adopted as inheritance. Execution stays external.", "required": false, "source_refs": [ "SRC-001", "SRC-003" ] }, { "target": "WM-AI-015", "relation": "REFERENCE", "purpose": "Conditional mandate binding for delegated action. Does not own issuance, scope evaluation or revocation.", "required": false, "source_refs": [ "SRC-004", "SRC-002", "SRC-003" ] }, { "target": "WM-AI-005", "relation": "REFERENCE", "purpose": "Optional pinned receiving instruction/configuration profile; transferred context cannot overwrite it.", "required": false, "source_refs": [ "SRC-006", "SRC-002" ] }, { "target": "WM-AI-017", "relation": "REFERENCE", "purpose": "Optional capability or tool-description requirements without owning interfaces or permissions.", "required": false, "source_refs": [ "SRC-001", "SRC-002" ] }, { "target": "A2A 1.0.0", "relation": "ALIGN", "purpose": "Conceptual message/task/part mapping with application-specific handoff semantics and declared losses.", "required": false, "source_refs": [ "SRC-001" ] }, { "target": "PROV-O", "relation": "ALIGN", "purpose": "Attribution, derivation and qualified delegation evidence, without proof of authority.", "required": false, "source_refs": [ "SRC-003" ] }, { "target": "CloudEvents 1.0.2", "relation": "ALIGN", "purpose": "Optional occurrence envelope for delivery/receipt observations; event identity is separate from message identity.", "required": false, "source_refs": [ "SRC-008" ] }, { "target": "W3C Trace Context", "relation": "ALIGN", "purpose": "Optional telemetry correlation with privacy limits; never an authorization or message identity substitute.", "required": false, "source_refs": [ "SRC-005" ] } ], "serviceLayers": { "dimension": { "owner_package_requirements": [ "Assign an accountable deployer or record custodian role, not a commercial owner name.", "Pin the message profile, namespace, versions, source master bindings and receiving policy.", "Declare recipient views, permitted purposes, retention and authority recheck rules.", "Provide storage, interface and process bindings without implying an implemented runtime." ], "namespace_guidance": "Use a Dimension-controlled namespace for message and representation IDs. Keep external task, run, mandate, event and trace IDs typed and scoped to their masters.", "registry_links": [ "vr.wm-ai-016", "WM-AI-004 optional reference", "WM-AI-015 conditional reference" ] }, "canon_and_patch": { "canonicalization_rules": [ "This research is a noncanonical reviewable draft. Instance canonicalization requires a pinned profile and master custodian.", "Preserve original content digest and source revision. Serialization order or whitespace normalization must not silently invalidate integrity evidence." ], "patch_rules": [ "Require authorized role, purpose, expected revision and reason for local metadata changes.", "A materially changed offer or payload creates a new logical message and supersession reference. Retain evidence of observed responses subject to retention policy." ], "compatibility_rules": [ "Pin protocol and profile versions; report unsupported critical extensions and semantic mapping losses.", "Never translate transport receipt into acceptance, acceptance into task completion, or a provenance relation into permission." ] }, "artifact_rules": { "identity_priority": [ "Authoritative master-system identifier", "Governed global identifier or IRI", "Dimension-assigned UUID or ULID" ], "timestamp_rule": "Use RFC 3339 timestamps with seconds and an explicit offset or Z. Separate event time from observation and ingestion time; record uncertainty and clock-skew rules rather than manufacturing order.", "serial_naming_rule": "Use stable message and artifact IDs with explicit representation revisions. Dates are metadata and never the sole identity.", "integrity_rule": "Record algorithm and digest for exact bytes or a declared canonical representation. Integrity proves matching content only, not truth, authority or safety. Redacted views receive their own identities and derivation links." }, "policies": [ "Only the selected purpose and authorized recipient view justify context disclosure; exclude credentials and private internal reasoning.", "Treat external content as untrusted data. Policy-level review handles suspicious instructions; this model specifies no harmful operational procedures.", "Recheck external mandate, audience and access constraints before action. Receipt or role labels never confer authority.", "Independent external review, direct source checks, deployment profiles and executable conformance remain holds." ], "crud": { "read": [ "Resolve typed references only under recipient and purpose-scoped access. Show unknown, disputed, expired and redacted states." ], "create": [ "An authorized custodian creates a logical message with identity, intent, participants, selected context and pinned profile; no implicit send." ], "update": [ "Append evidence observations under revision control; material payload changes produce a new message and supersession link." ], "delete": [ "The adopting Dimension record custodian executes policy-authorized retention and deletion for local payloads and caches after hold checks.", "Keep only permitted minimal tombstones and evidence links. Do not delete referenced task, run, mandate or artifact masters; request their custodians to act under their own policies." ] }, "roles": [ { "name": "Accountable deployer", "responsibilities": [ "Approves the profile and governing policy; does not receive automatic access to every payload." ] }, { "name": "Sending agent", "responsibilities": [ "Prepares bounded context and evidence under authority; labels unknowns." ] }, { "name": "Receiving agent", "responsibilities": [ "Records dispositions and validates its own authority before action." ] }, { "name": "Record custodian", "responsibilities": [ "Controls revisions, recipient views, retention and disposition." ] }, { "name": "Qualified reviewer", "responsibilities": [ "Resolves policy exceptions and contested handoff evidence." ] } ], "access": { "default_rule": "Deny access unless an authorized recipient, purpose and scope are established; filter sensitive metadata as well as payloads.", "scopes": [ "bundle", "layer", "finding", "artifact" ], "exceptions": [ "An explicit policy-authorized review path may permit scoped access with reason, expiry and recorded approval; no blanket emergency bypass." ], "audit_requirements": [ "Link read, projection, correction and disposition observations to the external audit master with actor, purpose, time and representation ID.", "Keep secrets and unnecessary payload content out of logs and trace metadata." ] }, "agents_bootstrap": { "filename": "AGENTS.md", "required_fields": [ "Name", "Type", "Specification URL", "Storage type URL", "Interface URL", "Processes URL" ], "read_order": [ "Read the nearest owner/Dimension policy and this AGENTS.md.", "Read spec.yaml, all holds and the pinned application profile.", "Resolve external mandates, run/task bindings and recipient access before any authorized operational action." ] } }, "coverage": { "claim": "Source-grounded proposed structure for one identified agent handoff communication, preserving distinct message, occurrence, task, run and mandate identities. Separate local no-tools self-audit completed. Selected source review supports the boundary, while independent review, source/version verification, adopting profiles and executable conformance remain holds. This is a noncanonical reviewable draft.", "confidence": "medium", "checklist": [ { "dimension": "identity", "status": "covered", "notes": "Logical message, representation, attempt and external master identities are distinct." }, { "dimension": "lifecycle", "status": "covered", "notes": "Drafting, observation, supersession and disposal are local; task execution is delegated." }, { "dimension": "relationships", "status": "covered", "notes": "Run, mandate, configuration and tool references retain external ownership." }, { "dimension": "temporal", "status": "covered", "notes": "Observation, ingestion, expiry and clock uncertainty are explicit." }, { "dimension": "provenance", "status": "covered", "notes": "Authorship and derivation do not certify truth or authority." }, { "dimension": "ownership", "status": "covered", "notes": "Record custody is distinct from work ownership and represented principal." }, { "dimension": "validation", "status": "gap", "notes": "Research schema validation is available; nested instance schemas and executable fixtures remain unimplemented." }, { "dimension": "access", "status": "covered", "notes": "Per-recipient purpose and scope govern content and metadata." }, { "dimension": "retention and deletion", "status": "covered", "notes": "Profile-owned local disposition and minimal tombstones preserve external masters." }, { "dimension": "interoperability", "status": "gap", "notes": "Conceptual mappings only; profile and protocol fixtures must be pinned and tested." }, { "dimension": "direct properties", "status": "covered", "notes": "Intent, content descriptors, trust, time and reported disposition; no physical measurements apply to the message." }, { "dimension": "recognition and observation", "status": "covered", "notes": "Evidence-bound observations distinguish receipt and acceptance; unknown is a valid state." }, { "dimension": "capabilities and actions", "status": "covered", "notes": "Six local proposed record operations have preconditions and effects; no delivery or execution implementation." }, { "dimension": "source verification", "status": "gap", "notes": "Selected web-service content was read for eight primary documents. Direct HTTP not attempted under the owner-reported sandbox block; versions and errata require coordinator checks." } ], "known_omissions": [ "Independent external provider review is absent under the owner-authorized waiver.", "Direct HTTP responses, body hashes, current errata and exact revisions of living guidance are not verified.", "Nested field schemas, concrete vocabulary values, acceptance-state transitions and adversarial fixtures require an adopting profile.", "No runtime implementation, distributed ownership transaction, exactly-once guarantee, security certification or universal legal retention rule is supplied.", "Alternative emerging handoff specifications and domain profiles have not been exhaustively surveyed." ], "conflicts": [], "regional_assumptions": [ "Format-neutral technical draft; deployment jurisdiction, data-residency, confidentiality, licensing and retention obligations require qualified local review.", "No universal transfer of legal responsibility is inferred from agent acceptance." ], "adversarial_checks": [ "Reused message ID with changed payload must remain a conflict, not a harmless retry.", "Transport success and silence cannot establish recipient acceptance or completed work.", "Forged context, trace or role identifiers cannot substitute for authentication or mandate evidence.", "Expired artifact access and stale mandate evidence cannot silently become current authority.", "A cancellation request cannot prove downstream work was undone.", "Sensitive erasure must not be defeated by an unqualified immutable-history rule." ] }, "researchAdjudication": { "providerMode": "single-provider-waiver", "activeProviders": [ "codex" ], "waivedProviders": [ "claude", "grok" ], "providerPolicy": { "contract_version": "1.0.0", "mode": "single-provider-waiver", "effective_at": "2026-09-06T00:00:00Z", "scope": "Canonical single-stream subject-model research after the six-workstream consolidation", "active_providers": [ "codex" ], "waived_providers": [ { "provider": "claude", "authorized_by": "repository owner", "authorized_at": "2026-09-06T00:00:00Z", "reason": "Claude produced no result on prior 1800-second and 900-second attempts and again timed out on bounded 600-second Sonnet and 300-second Haiku passes. The owner prioritized completion over provider availability." }, { "provider": "grok", "authorized_by": "repository owner", "authorized_at": "2026-09-06T00:00:00Z", "reason": "The repository owner authorized completion without Grok when Grok is unavailable, slow or schema-invalid. Grok may still be attempted as a bounded supplemental reviewer, but its failure never blocks a valid Claude plus no-tools result." } ], "review_rule": "Codex may complete source-grounded fallback research after bounded Claude and Grok attempts fail. It requires a separate no-tools adversarial audit and remains reviewable-draft with a visible absence-of-external-review hold.", "supplemental_provider_attempts": [ { "provider": "claude", "required": false, "maximum_attempts": 1, "failure_policy": "record-and-continue", "admission_rule": "Use only a locally schema-valid result whose sources and boundaries survive adjudication." }, { "provider": "grok", "required": false, "maximum_attempts": 1, "failure_policy": "record-and-continue", "admission_rule": "Use only a locally schema-valid result whose sources and boundaries survive adjudication." } ] }, "boundaryDecision": { "entry_kind": "entity", "status": "accepted", "rationale": "The root is an identified communication that can exist before delivery and persist through observations and supersession. Dispatch and receipt are separate occurrences. The registry standalone-mm value classifies the record plane. Candidate parent WM-AI-004 is reconciled as an optional run reference, not inheritance or ownership of execution." }, "decisions": [ { "concept": "Message entity versus handoff event", "disposition": "accepted", "rationale": "Logical message identity is stable across delivery attempts and views. Treating the root as an occurrence would obscure messages that were drafted but never delivered." }, { "concept": "Run parent and neighbor ownership", "disposition": "qualified", "rationale": "Registry parent WM-AI-004 is contextual rather than inherited. Run execution, mandate enforcement, configuration and tool descriptions retain external masters; no relationship-ledger row supplies a stronger binding." }, { "concept": "Message identifiers and retries", "disposition": "accepted", "rationale": "The identity finding distinguishes unchanged retries from changed offers and detects conflicting content under one identifier. Separate representation and occurrence IDs prevent accidental merging." }, { "concept": "Participants and correlation", "disposition": "accepted", "rationale": "Sender, recipient, represented principal and record custodian are distinct. Context and trace identifiers remain references and cannot authenticate an agent or grant access." }, { "concept": "Transferred work and selected context", "disposition": "accepted with limits", "rationale": "Work assertions carry evidence and uncertainty. Selected context exposes omissions and freshness without claiming completeness or requiring private internal reasoning." }, { "concept": "Payload and lineage", "disposition": "accepted", "rationale": "External artifact identities, access conditions and provenance remain separate. A digest proves matching representation bytes, not safety, authority or truth; unavailable references remain visible." }, { "concept": "Optional mandate for context-only transfers", "disposition": "qualified", "rationale": "A no-action context transfer need not instantiate a delegation mandate. When action is requested, the applicable external mandate or policy and current audience/scope limits must be evidenced." }, { "concept": "Trust labels and credential separation", "disposition": "accepted as policy", "rationale": "Untrusted content cannot replace recipient policy. Credentials are excluded from context and enforcement stays outside the message model; labels do not certify safety." }, { "concept": "Receipt, acceptance and assignment effect", "disposition": "separated", "rationale": "Transport receipt, recipient acceptance and work ownership changes have distinct evidence. Silence or a task status cannot establish the entire chain. Partial acceptance remains a local profile proposal." }, { "concept": "Exactly-once and cancellation guarantees", "disposition": "rejected", "rationale": "A2A send idempotency is optional and an event identity rule is not an execution guarantee. Unknown delivery remains unresolved; cancellation requests cannot establish rollback of external work." }, { "concept": "Local functions and retention", "disposition": "accepted as proposed only", "rationale": "All six operations maintain local records under preconditions. External custodians execute deletion and master lifecycle changes; continuity permits policy-authorized erasure instead of perpetual payload retention." }, { "concept": "Operational profile and conformance", "disposition": "deferred", "rationale": "Candidate data groups do not constitute nested instance schemas, ownership arbitration, state machines or executable mappings. These gaps prevent operational assurance but do not contradict the research draft." }, { "concept": "Source evidence limits", "disposition": "limited", "rationale": "Eight documents supplied selected readable web evidence. Direct HTTP was not attempted under the owner-reported sandbox restriction, and current versions, living revisions and errata remain unverified." }, { "concept": "Provider independence", "disposition": "waived and held", "rationale": "Claude and Grok were skipped with zero attempts. This frozen local Codex semantic self-audit adds no external facts and cannot represent independent second-provider review." } ], "publicationHolds": [ "Independent external review is absent under the owner-authorized single-provider waiver. Claude and Grok were skipped with zero attempts; the separate local Codex no-tools self-audit is not independent review.", "Direct source HTTP checks were not attempted under the owner-reported sandbox restriction: no status or body hash was measured and zero HTTP 200 responses were measured. Selected web-service content was reviewed; current versions, errata and living-guidance revision pins remain unverified. The coordinator must run check_sources.py and complete claim/version review.", "Adopting profiles must define recipient acceptance, multi-recipient work assignment, authority rechecks, expiry, clock uncertainty, privacy, jurisdiction, licensing and retention obligations. No universal legal responsibility transfer or operational security assurance is claimed.", "Nested instance schemas, controlled vocabularies, pinned neighbor bindings, A2A/CloudEvents/PROV-O/Trace Context mappings and adversarial conformance fixtures remain incomplete. The six functions are unimplemented local record operations; no runtime delivery, exactly-once or execution guarantee exists.", "Independent external review was explicitly waived by the repository owner; this codex-only result remains a reviewable draft." ], "deferredResearch": [ "Verify all source responses, redirects, current versions, errata and exact living-guidance revisions; record claim-level evidence rather than treating HTTP success as substantive verification.", "Develop an adopting profile and nested schemas with fixtures for changed-content retries, lost replies, partial acceptance, concurrent recipients, stale mandates, expired artifacts, redaction and lawful disposal.", "Restore independent external review before canonical or publishable-draft promotion." ] }, "statistics": { "sources": 8, "bundles": 6, "layers": 12, "findings": 12, "questions": 48, "artifacts": 12, "functions": 6 } }