jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs #285

Merged

dcharlot merged 1 commit from feat/jcp-model-in-caveat into main 2026-10-17 09:22:11 -04:00

Conversation 0 Commits 1 Files changed 19 +167 -6

dcharlot commented 2026-10-17 04:21:24 -04:00

Owner

Copy link

What was missing

A grant's capability names one resource by content address. When that resource is an inference endpoint, the model it runs is chosen inside the payload, and the decision point sees only the payload's hash. So a grant could authorize "this endpoint", but never "this endpoint, running these models".

PayloadIs comes close, but it makes the grant single-use. JCP enforced a model's integrity (refuse the wrong bytes) but not authorization over which model runs.

What this adds

• Frame.model: Option<ContentId>: the content address of the model the action runs. The dispatching runtime fills it in, because it knows what it will load. When absent, it is omitted from the encoding, so frames, and every receipt and vector over them, keep their bytes.
• Caveat::ModelIn(Vec<ContentId>): the frame must name one of these models.
  • It fails closed. A frame naming no model is denied caveat-unsatisfied, so a dispatcher that does not say what it will run cannot exercise the grant.
  • A delegate narrows the set by adding a smaller ModelIn beside the inherited one. Both must hold, so the intersection governs.
  • This is authorization by content address, not a registry (SPEC §12): the grant names the bytes it permits.
• SPEC: §4.9 and §6 describe both, and the C24 conformance check covers ModelIn.
• Call sites: every Frame literal in the repository gains model: None. That is 28 sites across jcp-rs, joule-code-rs, joule-ui-rs, jouleclaw-rs and sandbox-rs.

Checked

On the build host:

• jcp-rs: 496 tests pass, including the three new ones. The conformance suite passes all checks, including C24 with ModelIn.
• Vectors: every vector gen-vectors writes is byte-identical to the published jcp/conformance/v1.
• Downstream: all eight workspaces that depend on jcp-schema pass cargo check --all-targets. jouleclaw-jcp, joule-code-jcp, sandbox-jcp and joule-ui pass their tests.
• Mutations: letting a frame with no model pass, and encoding an absent model, each fail tests.
• Clippy: nothing new. Its two warnings (std::slice::from_ref) are in a jcp-runtime test that predates this change.

The first consumer to fill model should be a dispatcher that picks its model before dispatch, such as mesh's routes. That is a follow-up.

🤖 Generated with Claude Code

## What was missing A grant's capability names one `resource` by content address. When that resource is an inference endpoint, the model it runs is chosen inside the payload, and the decision point sees only the payload's hash. So a grant could authorize "this endpoint", but never "this endpoint, running these models". `PayloadIs` comes close, but it makes the grant single-use. JCP enforced a model's *integrity* (refuse the wrong bytes) but not *authorization* over which model runs. ## What this adds - **`Frame.model: Option<ContentId>`:** the content address of the model the action runs. The dispatching runtime fills it in, because it knows what it will load. When absent, it is omitted from the encoding, so frames, and every receipt and vector over them, keep their bytes. - **`Caveat::ModelIn(Vec<ContentId>)`:** the frame must name one of these models. - It **fails closed.** A frame naming no model is denied `caveat-unsatisfied`, so a dispatcher that does not say what it will run cannot exercise the grant. - A delegate narrows the set by adding a smaller `ModelIn` beside the inherited one. Both must hold, so the intersection governs. - This is authorization by content address, not a registry (SPEC §12): the grant names the bytes it permits. - **SPEC:** §4.9 and §6 describe both, and the C24 conformance check covers `ModelIn`. - **Call sites:** every `Frame` literal in the repository gains `model: None`. That is 28 sites across jcp-rs, joule-code-rs, joule-ui-rs, jouleclaw-rs and sandbox-rs. ## Checked On the build host: - **jcp-rs:** 496 tests pass, including the three new ones. The conformance suite passes all checks, including C24 with `ModelIn`. - **Vectors:** every vector `gen-vectors` writes is byte-identical to the published `jcp/conformance/v1`. - **Downstream:** all eight workspaces that depend on jcp-schema pass `cargo check --all-targets`. jouleclaw-jcp, joule-code-jcp, sandbox-jcp and joule-ui pass their tests. - **Mutations:** letting a frame with no model pass, and encoding an absent model, each fail tests. - **Clippy:** nothing new. Its two warnings (`std::slice::from_ref`) are in a jcp-runtime test that predates this change. The first consumer to fill `model` should be a dispatcher that picks its model before dispatch, such as mesh's routes. That is a follow-up. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-10-17 04:21:24 -04:00

jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs ... 289d584b02

A grant's capability names one resource by content address. When that
resource is an inference endpoint, the model it runs was chosen inside the
payload, and the decision point sees only the payload's hash. So a grant
could authorize "this endpoint" but never "this endpoint, running these
models". Only PayloadIs came close, and it makes the grant single-use. JCP
enforced a model's integrity (refuse wrong bytes) but not authorization
over which model runs.

- `Frame.model: Option<ContentId>` is the content address of the model the
  action runs. The dispatching runtime fills it, since it knows what it will
  load. It is omitted from the encoding when absent, so frames and every
  receipt and vector over them keep their bytes.
- `Caveat::ModelIn(Vec<ContentId>)` requires the frame to name one of these
  models. It fails closed: a frame naming no model is denied
  `caveat-unsatisfied`, so a dispatcher that does not say what it will run
  cannot exercise the grant. A delegate narrows the set by adding a smaller
  ModelIn beside the inherited one; both must hold, so the intersection
  governs. This is authorization by content address, not a registry
  (SPEC §12).
- SPEC §4.9 and §6 describe both, and C24's conformance check now covers
  ModelIn.
- Every Frame literal in the repository gains `model: None`. That is 28
  sites across jcp-rs, joule-code-rs, joule-ui-rs, jouleclaw-rs and
  sandbox-rs.

Checked on the build host:
- jcp-rs: 496 tests pass, and the conformance suite passes all checks,
  including C24 with ModelIn.
- Every vector gen-vectors writes is byte-identical to the published one.
- All eight workspaces that depend on jcp-schema pass `cargo check
  --all-targets`. The consumers jouleclaw-jcp, joule-code-jcp, sandbox-jcp
  and joule-ui pass their tests.
- Mutations: letting a frame with no model pass, and encoding an absent
  model, each fail tests.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit a000718b0f into main 2026-10-17 09:22:11 -04:00

dcharlot referenced this pull request from a commit 2026-10-17 09:22:12 -04:00

Merge pull request 'jcp: a ModelIn caveat says which model a grant authorizes, and the frame names the model it runs' (#285) from feat/jcp-model-in-caveat into main

dcharlot referenced this pull request 2026-10-17 09:34:13 -04:00

mesh: a grant is decided by JCP's runtime, so expiry, caveats, the model and spend bind #294

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!285

No description provided.