The group-work layer: everything an orchestrator, a team of workers, or a pair
of partnering agents needs, enforced by the same deterministic runtime.
- Delegation control (SPEC §4.4): grants carry delegate_depth — absent =
unlimited, 0 = leaf-only. Depth narrows every hop (child = parent − 1);
attenuate() refuses delegation of a leaf-only grant and verify_chain()
refuses forged deepening. An orchestrator's workers cannot mint sub-workers.
- Sharded budgets (SPEC §4.5): shard() splits a grant into siblings whose
budgets MUST sum within the parent — one shard per enforcement point, each
enforced locally. Distributed budget state with no consensus: conservation
by mint-time arithmetic. Receipt-settled channels noted as OPTIONAL profile.
- Identity continuity (SPEC §2.1): KERI-style pre-committed rotation. KeyEvent
log where rotation N is signed by the NEW current key, which must hash to
event N−1's next_hash. A thief holding the current key cannot rotate the
identity away; an owner who lost it still can. Identity = inception DID,
stable for life. Trust roots made normative: enforcement points are
configured with the root issuers they honor (authorized_keys shape, no CA).
- Threshold actors (SPEC §2.2): jcp-threshold (10th crate) — FROST (RFC 9591)
k-of-n Ed25519. The group key is an ordinary did:key, so a 2-of-3 team
issues, holds, delegates, and signs wire requests with nothing else in JCP
changing. The two-agent rule for irreversible actions, refused by
arithmetic, not policy.
- Caller-signed wire (SPEC §11): WireRequest now carries the caller's Ed25519
signature over its canonical bytes; the endpoint authenticates from the
request itself, denies impersonation bad-signature, and seals the refusal.
A threshold aggregate signs the same field, indistinguishable on the wire.
- Receipt stream as WAL + group accounting (SPEC §8.1–§8.2): extract() parses
a verified envelope's signed core; replay_spend() + Runtime::restore()
rebuild a crashed enforcement point's budget state from its own sealed
output; aggregate() keys a team's receipts by (grant, subject) for
per-worker cost attribution from evidence, counting (not skipping) receipts
that fail verification.
Conformance grows to C1–C14 (threshold caller over the wire, runtime restored
from its own receipts, depth/shard/rotation invariants). SPEC bumped to
v0.2.0 draft; published vectors unchanged byte-for-byte. 58 tests, clippy
clean.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
76b55fc4d2