Every sealed interaction now names the principal that fired it. The actor
is a required field on Interaction, a required argument to run_interaction,
and is bound into the signed canonical core — so an interaction can no
longer be attributed to a different principal without breaking the chain.
Human and agent are traced identically (a did:key either way); the standard
draws no distinction. An unauthenticated host attributes fires to its own
session principal — joule-ui-serve defaults this to the host's own did:key
(derived from its signing key) and exposes with_session_actor for
deployments that authenticate the caller.
The canonical-core profile tag is bumped joule-ui/interaction/1 -> /2,
since the actor is now part of the signed preimage; the two cores are
distinct bytes and never collide. SPEC §7.1 + C2/C3 updated, conformance
v1 vectors regenerated, examples and the conformance harness pass an actor.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
079fabafe8