spec(aactr): publish ar.action.v1 (AActR) as 15th receipt family#1
Merged
Conversation
Adds the Anchored Action Receipts spec — the receipt an autonomous agent/ automation mints when it acts on a workspace's behalf, with optional mandate binding (credential_id + caveats_consumed). Closes the gap where the public spec listed 14 families but the agent-relevant action receipt was absent. - action/v1.md: full ar.action.v1 spec (shipped shape incl. §4.4 mandate binding) - README + llms.txt: 14 -> 15 family members - registry.md: ar.action.v1 shipped row + v1.2 kind=decision; FamilySlug union stays 14 (AActR is a Status-List/continuity non-consumer, chip 15 only) - family-consistency.md: chip 15, TSA OPTIONAL, subject null, SL non-consumer regression check: grep -n 'action' anchors/envelope/src/continuity.ts confirms FamilySlug union excludes action (non-consumer) — spec text matches shipped source. Signed-off-by: Dekimu <ops@dekimu.com>
Records the delegation path { depth, leaf_key, root_credential_id } when a
sub-agent acted under an attenuated sub-mandate, beyond the single root
credential_id. Issuer-asserted descriptive metadata — §4.5 + §6 state a
stateless single-receipt verifier cannot cross-check the chain actually existed
(same honesty bound as credential_id); no new crypto. Binding-integrity:
orphan / no_caveats / root_mismatch / depth>=1. Additive, backward-compatible.
Also repointed two dangling '§9' refs (§1, §4.4) to §6 (Verification surface) —
the spec has no §9; §6 is where the stateless-verifier limitation lives.
regression check: grep -n '§9' action/v1.md (now none)
Signed-off-by: Dekimu <ops@dekimu.com>
Adds the stable per-agent principal to ar.action.v1: a new optional agent_id body field (mandate root-bound agentId / verifiedAgentId), distinct from per-mandate credential_id and per-tenant iss. Issuer-asserted metadata (same honest boundary as credential_id/delegation_chain — a stateless verifier cannot re-derive it). Integrity rules: agent_id.invalid / agent_id.orphan. Closes AIUC-1 A003.3 identity-granularity on the receipt side. Signed-off-by: Dekimu <ops@dekimu.com>
sergideki
force-pushed
the
spec/aactr-action-family
branch
from
June 19, 2026 21:53
238beba to
c604aa3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the Anchored Action Receipts spec — the receipt an autonomous agent/automation mints when it acts on a workspace's behalf, with optional mandate binding (`credential_id` + `caveats_consumed`).
Why: the public spec listed 14 families but the agent-relevant action receipt was absent. An agent fetching the spec to learn the format it must produce/verify couldn't find `ar.action.v1`. This is the keystone of the anchors agent-readiness slice.
Contents
Verification: spec text grounded directly in shipped source (`body.ts` / `verify-single.ts`), not the 2026-06-07 design doc (which predates the mandate-binding fields). Confirmed `envelope/src/continuity.ts` `FamilySlug` excludes `action`.
🤖 Generated with Claude Code