Uh oh!
There was an error while loading. Please reload this page.
feat(schemas): Model Plane provider classification + review-hardening (resolves #243) - #246
Merged
Conversation
11 tasks
There was a problem hiding this comment.
Pull request overview
This PR updates the SourceOS spec’s Model Plane contracts to (1) keep the five-class AgentPassport.agent_class model intact by explicitly composing provider identity via InferenceProvider.passportRef, and (2) add schema-enforced “review-hardening” constraints for ledger tamper-evidence and biometric boundary refusals.
Changes:
- Add
InferenceProvider.passportRefto link a provider record to its host-processAgentPassportwithout introducing a newagent_class(ADR-0017 / issue #243 resolution). - Require
ledgerPrevHashfor any non-genesis ledger entry (ledgerSeq >= 1) acrossInferenceReceipt,EscalationDecision, andAdapterPromotionDecision. - Enforce a biometric hard boundary in
EscalationDecision(biometric category ⇒verdict: refused+refusalReason: biometric-boundary) and add a corresponding refused example.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| schemas/README.md | Updates Model Plane schema catalog narrative to reflect provider composition + new schema “teeth”. |
| schemas/InferenceReceipt.json | Adds ledgerPrevHash requirement for non-genesis (ledgerSeq >= 1) receipts. |
| schemas/InferenceProvider.json | Adds optional passportRef (AgentPassport URN) to make provider↔passport composition explicit. |
| schemas/EscalationDecision.json | Adds biometric-boundary enforcement and non-genesis ledgerPrevHash requirement. |
| schemas/AdapterPromotionDecision.json | Adds non-genesis ledgerPrevHash requirement. |
| examples/escalation-decision.refused-biometric.json | New example demonstrating mandatory refusal for biometric sensitivity. |
| docs/adr/0017-model-plane-provider-classification-and-hardening.md | New ADR capturing the #243 decision + hardening rationale. |
| CHANGELOG.md | Records the provider classification decision + hardening changes under Unreleased. |
| - **`AdapterPromotionDecision`** — adapter promotion as a human-governed decision, never an automatic OS update. Enumerates every contributing `OverrideEvent` (the property Apple's loop lacks), and a `promoted` verdict is schema-impossible without a verified signature, per-event training consent, all eval gates passing (including an adversarial-poisoning probe), a named human promoter, and a mandatory rollback target (SEAM-016, SEAM-017). Governs *model* (LoRA) adapters — distinct from `AdapterDescriptor` (connector/actuation adapters). | ||
| All three carry an optional `ledgerPrevHash` (hash-chain the append-only ledgerso an enumerated contribution list cannot be retroactively rewritten) and, on the receipt, an optional `confidenceMethod` (the escalation trigger is self-reported — recording the method makes it auditable). | ||
| All three hash-chain the append-only ledger: `ledgerPrevHash` is required for any non-genesis entry (`ledgerSeq >= 1`), so an enumerated contribution list cannot be retroactively rewritten; the receipt also carries an optional `confidenceMethod` (the escalation trigger is self-reported — recording the method makes it auditable). A model-serving daemon is not a new agent class — it is a `system_core` host process (its `AgentPassport`) plus an `InferenceProvider` record, linked via `InferenceProvider.passportRef` (ADR-0017). |
ContributorAuthor
There was a problem hiding this comment.
Fixed — took the stronger option: ledgerSeq is now required on both EscalationDecision and AdapterPromotionDecision (InferenceReceipt already required it), so all three are ledger-bound (SEAM-011) and the hash-chain gate can't be dodged by omitting the sequence. README wording is now accurate. Negative tests added.
… (T7-5/#243) Resolves#243 without a 6th agent_class: model daemon = system_core passport + InferenceProvider record, linked via new optional InferenceProvider.passportRef. Adds design-review teeth to T7 provenance schemas (verified both ways): - ledger hash-chain: ledgerPrevHash required for non-genesis entries (seq>=1) on InferenceReceipt/EscalationDecision/AdapterPromotionDecision (finding #4) - biometric hard boundary: EscalationDecision with a biometric sensitiveCategory is schema-forced to refused/biometric-boundary (finding #7) New example escalation-decision.refused-biometric.json. See ADR-0017.
mdhellerforce-pushed
the
feat/t7-review-hardening
branch
from
August 2, 2026 18:40
d8cd235 to
20c9008Compare…PromotionDecision Address Copilot: the hash-chain gate keyed on ledgerSeq>=1 could be dodged by omitting ledgerSeq entirely (it was optional in these two). These are ledger entries (SEAM-011 ledger-bound), so ledgerSeq is now required in all three provenance types (InferenceReceipt already required it); the README claim that all three hash-chain the ledger is now accurate. Negative tests added.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves#243 (part of #241) and closes the schema-expressible design-review findings.
#243 — no 6th
agent_classA model-serving daemon is a
system_corehost process (itsAgentPassport) plus anInferenceProviderrecord — the two compose. Made concrete with a new optionalInferenceProvider.passportRef(urn:srcos:agent-passport:). Keeps the five-class model (ADR-0014) intact. Seedocs/adr/0017-....Review-hardening teeth (verified both ways)
InferenceReceipt/EscalationDecision/AdapterPromotionDecisionnow require a non-nullledgerPrevHashfor any non-genesis entry (ledgerSeq >= 1;seq 0exempt).EscalationDecisionwith abiometricsensitivity category is schema-forced torefused/biometric-boundary— embeddings never cross a boundary under any grant. New exampleexamples/escalation-decision.refused-biometric.json.Validation
seq:0exempt; 5/5 teeth tests pass; duplicate-$idclean.Non-schema findings (router-vs-confidence text, served==receipt reconciliation, T0 trust concentration) are being filed separately for SHACL/conformance/spec follow-up — nothing stranded.