Review request: is there already a normative mechanism for authorization → S0 → execution → S1 closure?

[altrudev]

I’ve been testing a narrow assurance boundary across TRACE, Agent Manifest, and cA2A.

The question is:

When valid authority, approval, action-binding, policy, and execution-related evidence all exist, what additional evidence is required before an independent verifier can establish that the authorized state transition actually occurred?

The current experiments distinguish:

• CLOSED — sufficient trusted evidence establishes the transition
• FAILED — trusted evidence establishes a contradiction
• INDETERMINATE — evidence is insufficient to establish either result

The work does not assume that TRACE, Agent Manifest, or cA2A are deficient. In the pinned material I tested, each system appears to draw a reasonable boundary around what it proves.

The unresolved composition layer is:

authorization
    ↓
exact predecessor state S0
    ↓
exact executed action
    ↓
execution outcome
    ↓
trusted successor observation S1
    ↓
replay / uniqueness evidence
    ↓
transition predicate

I built an experimental profile called STBP v0.1 — State-Transition Binding Profile to test whether that missing join can be represented minimally without turning existing assurance systems into application-state stores.

The review artifact now includes:

• pinned TRACE, Agent Manifest, and cA2A revisions
• independently verified adapters
• adversarial conformance tests
• cross-system composition tests
• a reference verifier
• a real Git-backed S0 → S1 transition
• explicit replay evidence
• 64/64 frozen-snapshot tests passing
• governed DSR execution
• independently verified DSR result signature
• DDC radial ALLOW
• Parallax causal assessment ALLOW

Frozen review snapshot:

altrudev/authorization-transition-closure

Branch:

stbp-v0.1-review-snapshot

The question I want reviewers to falsify is:

Does an existing normative mechanism already bind authorization to an exact predecessor resource state and bind execution to a trusted successor state, with explicit replay semantics and an evaluable transition predicate?

If the answer is yes, I want to narrow or retire STBP rather than duplicate existing work.

I would especially appreciate review on four points:

1. Is there an existing TRACE, cA2A, Agent Manifest, RATS/EAT, SCITT, or related primitive that already closes this gap?
2. Am I interpreting any upstream assurance boundary too narrowly or too strongly?
3. Can any STBP field be removed without losing the distinction between CLOSED, FAILED, and INDETERMINATE?
4. Is there a counterexample where this three-state transition-closure model breaks down?

This is an experimental technical artifact, not a standards proposal. The objective at this stage is adversarial review, not adoption.

Repository:

https://github.com/altrudev/authorization-transition-closure

Recommended starting points:

• SNAPSHOT-v0.1.md
• docs/research-note-v0.1.md
• docs/adr/0001-state-transition-binding-profile.md
• analysis/interoperability-report-v0.1.md

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[imran-siddique]

Answering the falsification question, which is the right question to ask first and has a definite answer.

No existing normative mechanism closes it, and the gap is declared rather than overlooked. docs/integration/pic-trace-bridge-v1.md already says what the nearest primitive does and does not do: it binds the authorization to the call and its execution evidence "without claiming that TRACE proves the real-world outcome of the call." That sentence is the boundary your profile sits outside, and it was written deliberately.

Four things with receipts, so you can narrow STBP against measurements rather than against my summary.

1. The closest existing mechanism is the PIC/TRACE bridge, and it stops exactly where your question starts. authorization.tool_call_digest binds the exact executed call by RFC 8785 digest. transcript.before.tool_call is bound the same way as of #333, merged today. transcript.after is checked only for being a JSON object (intent_bridge.py:248). So the slot for a successor observation exists in the artifact and carries no binding whatsoever, and there is no predicate over the pair. The profile is also informative, not normative, which answers the "normative" half of your question directly.

2. Nothing in TRACE provides replay or uniqueness evidence. What exists bounds when, not how many times: iat freshness with a 24 hour maximum age and 5 minute skew tolerance, an optional challenge-nonce echoed in runtime.nonce, and authorized_at/expires_at on the bridge. A validity window is not one-shot consumption, and no mechanism marks an authorization spent.

3. One correction, in case your report reads the boundary too strongly. TRACE does have a predecessor/successor binding primitive. It applies to the evidence chain rather than to resource state: a GapDisclosure's previous_receipt_hash MUST name a chain element that is present, and the next element emitted after resumption MUST name the disclosure, so an unsealed disclosure covers nothing. If STBP says TRACE has no such primitive at all, that is too strong. The shape you want already exists here, over a different subject.

4. Your INDETERMINATE is #279, reached from the other side. That issue exists because six threads needed a first-class way to say "not established" rather than being forced to choose between a false value and a failed validation. You arrived at the same primitive from composition rather than from verification. That convergence is the most useful thing in this thread, and I would rather see your three-state distinction argued in #279, where it strengthens a case that is already open, than carried only in an external profile.

On your question 4, a counterexample. The model breaks where S1 is observed by the party that executed. The transition predicate is then self-certified, and CLOSED becomes indistinguishable from a claim of closure. Your "trusted successor observation" carries an independence requirement that the diagram does not state. A real Git-backed S0 to S1 transition is exactly this case when the executing agent holds the push credential, which is worth checking against your own snapshot before it reads as validation.

On your question 3, and on scope. Whether an STBP field can be removed without losing the three-state distinction needs your repository, and reviewing a 64-test external snapshot field by field is not something I am taking on here. What would change that is a proposal against TRACE rather than against STBP.

The narrow thing worth proposing, since you asked whether to narrow or retire. transcript.after carrying no binding is a defect in our own profile whatever STBP does. A proposal to bind it, with a stated rule for what a verifier can conclude from the pair and what it cannot, is small, evaluable on its merits, and lands in a profile that already exists. STBP wholesale is not that. Send the first and I will review it properly.

[altrudev]

I narrowed this to the PIC/TRACE surface you identified and opened #338: successor-observation binding plus explicit verifier conclusion rules, without carrying STBP wholesale into TRACE. It separates integrity of transcript.after from evidentiary sufficiency, treats the not-established case per #279, and includes the executor/observer independence counterexample as a policy condition rather than a universal rule.