Record the operator's authorship on quick-tier staked contracts#1264
Merged
Conversation
The quick tier's acceptance IS the operator's launch argv floor, but the staking helper hardcoded ModelProposal authority onto every Required requirement row — an operator-authored contract was recorded as a model's proposal. Harmless to today's metrics (no reducer or admission rule keys on a Required row's authority), but it misstates provenance on a durable ledger, and the spec-compiler arc builds on this distinction being honest. BuildStakedRequirements now takes the Required rows' authority from the caller that knows the lane: the supervisor spawn passes ModelProposal (its specs are the plan-author model's), and the workflow lane reads the task's new AcceptanceAuthority — stamped by the projection builder as a SIBLING config key (never a field inside the potentially model-authored acceptance object), parsed through a C2-posture allowlist (exactly "Operator"; anything else, including a typo, under-claims to the ModelProposal default). NA rows stay ServerPolicy regardless — the exemption is the server's policy whoever authored the contract. Contract hashes are untouched (the hash projects instruction/acceptance/expectsChanges only).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
SupervisorUnitContract.BuildStakedRequirementsno longer hardcodesModelProposalonto Required rows — the authority comes from the caller that knows the lane. The quick tier's acceptance is the OPERATOR's launch argv floor and now stakes asOperator; supervisor plan subtasks stayModelProposal; plan-map items (planner-authored) fold to theModelProposaldefault. NA rows stayServerPolicyregardless — the exemption is the server's policy whoever authored the contract.AgentTask.AcceptanceAuthority(null-omitted) is stamped from a SIBLING config key (acceptanceAuthority) the projection builder writes — never a field inside the acceptance object, so a model-authored plan-map item spec has no path to mint its own authority. The node parses it through a C2-posture allowlist: exactly"Operator"reads Operator; anything else — missing, case-typo,"ServerPolicy", garbage — reads null → staked asModelProposal. Authority is only ever under-claimed, never inflated.CompletionReducer.cs:29and NA-pairing at:191only), and contract hashes are untouched (AgentAcceptanceContract.Hashprojectsinstruction/acceptance/expectsChangesonly). This is provenance honesty on the durable ledger, recorded now while volume is low.ModelProposal— an under-claim, never an inflation.Test plan
AcceptanceAuthority=Operator+ read-only declaration → Required acceptance row stakes Operator while NA rows stay ServerPolicy, over real Postgres through the realAgentRunServicestaking path; the existing no-provenance dispatch test now also pins the ModelProposal default