Jev caller_attribution: stamp ownership and signing #94

New issue

Closed

opened 2026-10-04 19:14:13 +02:00 by clawdie · 1 comment

clawdie commented

2026-10-04 19:14:13 +02:00

Owner

Jev caller_attribution: stamp ownership and signing

Summary

agent-skills PR #37 adds a caller_attribution field to Jev results. It is
attribution only: not a cryptographic signature, bounded and charset-checked,
and rejected if it looks like a credential. This issue records who owns the
attribution once it must become an attested signature.

Decision (proposed)

Hermes agent key  -> signs the attribution (the key lives with the invoking agent)
Colibri           -> stamps the attribution at task-correlation time,
                     from the authenticated identity
Jev               -> only proposes (answers/confidence); never grants authority,
                     and its output is never a signature

Why

A caller-supplied, unverified label risks being read as authority. A Jev probe
on the #37 design returned: authority_confusion_risk 0.88,
attribution_only_safe 0.53 (below the 0.69 threshold), stamp_owner =
colibri, risk 2.06 (~2, needs review before use).
docs/plans/JEV-DECISION-GATE.md §6/§7: confidence describes the model
response; identity, authorization, freshness, and deterministic checks stay
outside Jev, and projections require provenance.

Caveat: the Jev numbers above are priors about a model response, not evidence
authority. Deterministic checks and human review decide.

Scope

In: the field name, the stamp owner, and where the signature is bound to the
authenticated identity.
Out: the cryptographic scheme, key management, evidence-packet hashing, and
policy version (separate follow-ups).

Refs

agent-skills PR #37 (caller_attribution), agent-skills PR #38 (jev.env fix)
colibri #93 point 3 (Jev confidence must not become evidence authority)
docs/plans/JEV-DECISION-GATE.md §6, §7

# Jev caller_attribution: stamp ownership and signing ## Summary agent-skills PR #37 adds a `caller_attribution` field to Jev results. It is attribution only: not a cryptographic signature, bounded and charset-checked, and rejected if it looks like a credential. This issue records who owns the attribution once it must become an attested signature. ## Decision (proposed) ```text Hermes agent key -> signs the attribution (the key lives with the invoking agent) Colibri -> stamps the attribution at task-correlation time, from the authenticated identity Jev -> only proposes (answers/confidence); never grants authority, and its output is never a signature ``` ## Why - A caller-supplied, unverified label risks being read as authority. A Jev probe on the #37 design returned: `authority_confusion_risk` 0.88, `attribution_only_safe` 0.53 (below the 0.69 threshold), `stamp_owner` = `colibri`, `risk` 2.06 (~2, needs review before use). - `docs/plans/JEV-DECISION-GATE.md` §6/§7: confidence describes the model response; identity, authorization, freshness, and deterministic checks stay outside Jev, and projections require provenance. > Caveat: the Jev numbers above are priors about a model response, not evidence > authority. Deterministic checks and human review decide. ## Scope - In: the field name, the stamp owner, and where the signature is bound to the authenticated identity. - Out: the cryptographic scheme, key management, evidence-packet hashing, and policy version (separate follow-ups). ## Refs - agent-skills PR #37 (`caller_attribution`), agent-skills PR #38 (jev.env fix) - colibri #93 point 3 (Jev confidence must not become evidence authority) - `docs/plans/JEV-DECISION-GATE.md` §6, §7

clawdie commented

2026-10-06 21:37:04 +02:00

Author

Owner

Contract recorded and merged: b7e74ba — docs: record caller_attribution ownership and defer the attestation design (PR #124).

JEV-DECISION-GATE.md §7.1: caller_attribution is self-declared provenance metadata produced by the invoking Jev client — not authentication, authorization, a cryptographic signature, or operator approval. Colibri owns the policy contract for any future verified identity/attestation field; none is introduced, and no runtime implementation is implied. Jev output never grants or raises authority (§9).
credentials.md: the same statement for caller_attribution, linked to §7.

Deferred, not decided here: the field name, trusted principal, signer, key ownership, signing direction, algorithm, key management, and verification mechanics — tracked in #125.

Ownership (split): agent-skills produces the self-declared field; Colibri owns the policy/provenance contract and future evidence interpretation; the attestation design ( #125 ) owns signer, key, algorithm, and verification.

Closing as resolved by the contract update.

Contract recorded and merged: **b7e74ba** — `docs: record caller_attribution ownership and defer the attestation design` (PR #124). - `JEV-DECISION-GATE.md` **§7.1**: `caller_attribution` is self-declared provenance metadata produced by the invoking Jev client — not authentication, authorization, a cryptographic signature, or operator approval. Colibri owns the policy contract for any future verified identity/attestation field; none is introduced, and no runtime implementation is implied. Jev output never grants or raises authority (§9). - `credentials.md`: the same statement for `caller_attribution`, linked to §7. **Deferred, not decided here:** the field name, trusted principal, signer, key ownership, signing direction, algorithm, key management, and verification mechanics — tracked in #125. **Ownership (split):** agent-skills produces the self-declared field; Colibri owns the policy/provenance contract and future evidence interpretation; the attestation design ( #125 ) owns signer, key, algorithm, and verification. Closing as resolved by the contract update.

clawdie closed this issue

2026-10-06 21:37:04 +02:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

clawdie/colibri#94

No description provided.

Rows
Columns