docs(spec): define execution action binding v1 - #627
Conversation
Signed-off-by: Altru.dev <altrudevelop@gmail.com>
|
🔴 Contributor Check: HIGH
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:HIGH
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
imran-siddique
left a comment
imran-siddique
left a comment
There was a problem hiding this comment.
Approving. All five points from #588 are here, and the two that were actually open, the domain tag and the version discriminator, are inside the hashed bytes rather than beside them, which was the whole ruling.
Verified the vectors independently rather than reading them. Used the rfc8785 package as an oracle with no cmcp code in the path, so the corpus is not checking itself:
- All five computable vectors reproduce exactly:
EAB-001,EAB-002,EAB-003,EAB-004,EAB-005. - The recorded
jcs_utf8bytes match a fresh canonicalization byte for byte in every case. EAB-006is the refusal case andsha512is rejected as specified.- Domain separation and version separation both change the digest, so those two vectors demonstrate the property rather than asserting it.
Fixing the expected JCS bytes in the file, alongside the digests, is what makes this reproducible by someone who disagrees with our implementation. That is the right shape for a contract vector set.
One gap, recorded rather than blocking: the corpus cannot discriminate the ordering rule. There is no character above U+FFFF anywhere in the file, and for all six vectors RFC 8785's output is byte-identical to a naive json.dumps(sort_keys=True). 工具 in EAB-002 is BMP, so it exercises multibyte UTF-8 encoding but not the place where JCS and a code-point sort diverge, which is UTF-16 code-unit ordering across the surrogate boundary. A verifier implementing the wrong ordering passes all six of these.
That is an addition rather than a correction, and it is the same gap measured in trace-spec last week, where 23 of 24 delegation-link vectors were sub-BMP and therefore satisfied by a correct canonicalizer and an incorrect one alike. Filed separately so it does not hold this.
Scope discipline is right too: docs and vectors only, no runtime activation, no admission-path change, and the 1 versus 1.0 witness explicitly retained as a governing-semantics question rather than treated as proof the binding must distinguish them.
3 participants
Closes #588.
What
Records the five points Imran ruled on in #588 as one normative execution-action binding contract:
sha256andsha384accepted, other algorithms refused.agent_id,action_type,action_scope, andaction_timestamp.domain: "cmcp.execution-action-binding".version: 1.The document keeps correlation, logical-operation identity, replay permission, and external outcome evidence distinct. Same binding may enter retry/correlation classification subject to terminal-state rules; a changed binding under the same
(authenticated agent identity, execution_id)is refused before upstream invocation.Vectors
Adds a companion machine-readable vector set covering:
工具) + SHA-256;1versus1.0semantic-adjudication witness, explicitly retained as a governing-semantics question rather than automatic proof the binding must distinguish the two.The expected JCS bytes and digests are fixed in the file so an independent implementation can reproduce them without using the implementation under test as its oracle.
Scope
Docs/spec and vectors only. No runtime activation, registry integration, admission-path change, terminal-state/audit transaction change, or exactly-once claim. #565 remains the owner of integration, durable terminal/audit consistency, crash/recovery, and replay evidence.
Base:
69355037325927f28045686d548d3ea78d80ab6e(the exactmainrevision Imran used for the ruling).DCO: signed off. AI-assistance disclosure: ChatGPT assisted with ruling reconciliation, contract drafting, vector construction, and exact-revision preparation.
altrudevreviewed the bounded claim and remains responsible for the contribution.