Unchanged in substance: agents built only by certified constructors, under versioned rulesets, in an attested act of creation that roots identity — governance answered at birth, not inferred at runtime. A rogue agent is an unsigned agent.
What the verification adds: the foundation is better than assumed, and the ceiling is precisely located. Creation is already constitutive in the frozen V1 spec — "no witness, no mint" is law, both tiers durably record creation before use, and attested mode with its fleet-wide fail-closed rule is a frozen refusal mechanism available now. What does not exist yet: a verdict that says "attested at birth" (it can only say "invalid"), a per-delegation generation limit, and a GRANTHA policy grammar concrete enough to pin a ruleset version. The first two sit behind the wire freeze — a new signing-context version, not a V2 amendment; the third is an absence, not a freeze — the policy language is scoped, not drafted. So the pattern ships in two stages: governed construction v0 from frozen machinery today, and verdict-legible construction at the next wire version.
Unchanged from v0.1: runtime oversight of a haphazardly built agent is attestation-after-the-fact — the same epistemic position FORAY was built to end. The answer is certifying construction, not inspecting behavior.
As v0.1, with enforcement states now verified:
Constructor authority as a GRANTHA grant. Verified: shape yes, machinery not yet. The atom maps cleanly — construction class as resource-scope, ruleset version as a carried condition — and the only stated boundary position (holder reference is "human-or-autonomous only") constrains the holder slot, not resource-scope, so class-as-resource is unblocked. But the scope grammar is deferred and its field reserved-not-specified; the narrowing scope-algebra a version pin needs is deferred; version-ordering predicates are unscoped; and the grant-check answer carries no cause codes, so a version mismatch is indistinguishable from a clamp. The requirement lands in GRANTHA's next design pass (its own scope note names the concrete grammar as that pass), and this investigation supplies its first hard consumer case.
Construction as a FORAY transaction. Unchanged — the grammar can describe the birth; nothing in the verification touched or troubled it.
The creation signature roots the Stele Agentic ID. Verified, stronger than assumed. Both tiers root in a recorded creation: registration and mint each durably record before responding or returning, no first-assertion bootstrap exists anywhere, and the Observance Law makes an unwitnessed mint not a mint — creation is constitutive, not incidental. The caveat that matters: the verify path is present-tense — it walks signatures to the current statement and never reads the creation record; binding an identity back to its recorded birth is the Reconciler's work, event-driven, after the fact. Detection, not prevention. Section 5 carries the consequence.
The ruleset as a governed specification. Unchanged — record-side work the methodology already owns; no spec dependency.
The base case is the Operator. Unchanged — and the verification found it already embodied: the depth ceiling is Operator-set per root, and attested mode is an environmental posture the Operator chooses. The human root is not an aspiration to add; it is where the frozen spec already puts the levers.
Unchanged from v0.1.
The signature warrants the harness, not the cognition — and today, enforcement of the signature is fail-closed while legibility of it is not. The frozen machinery rejects, fleet-wide and regardless of a verifier's local mode, any attestation-required credential lacking a valid witness signature. That is real prevention. What no verdict can yet do is distinguish — the verdict input set is closed to four terms, so birth attestation surfaces only as "credential invalid" or as an off-books-mint detection event yielding SUSPECT. An estate can refuse the unsigned today; it cannot yet ask its verdict layer "was this one attested at birth?" as a first-class question. The boundary's honest statement gains a clause: the signature is enforced at the chain walk and legible only at the audit layer, until the next wire version.
Spawning is construction — and the generation limit is priced. No per-delegation generation field exists in V1 or V2; the levers are a per-root, Operator-set, tree-wide depth ceiling (one to eight, default four). The model already knows narrowing-per-hop — delegated counter ranges nest and cannot widen — so the pattern has an exact precedent, but adding it to generations is a signed-payload change: a new signing-context version under the wire freeze, explicitly not V2-amendable. The near-term workaround — one registered root per construction class, so the per-root ceiling applies per class — is a registration-topology convention no spec currently sanctions, and this investigation recommends proposing it to the Agentic ID arc rather than adopting it informally.
Today — governed construction v0, from frozen machinery. An estate that (a) runs attested mode, so every mint is witness-co-signed and the fail-closed rule rejects unattested credentials everywhere; (b) registers constructor roots under Operator-set depth ceilings, one root per construction class as a stated convention; (c) records each construction as a FORAY transaction referencing the ruleset version; and (d) binds births at the audit layer, where the Reconciler flags off-books mints into SUSPECT verdicts — has the refusal property in substance: the unsigned cannot act, and the improperly born are detected and downgraded. The prevention is at the chain walk; the birth-audit is after the fact; both are real and available.
Next — verdict-legible construction, at the wire boundary. A new signing-context version carries: birth attestation as a first-class verdict input (reopening the closed input set), and a per-delegation generation field with subset enforcement on the counter-range precedent. GRANTHA's concrete policy grammar lands the version-pin and cause-code needs in its own next pass. At that point "was this agent properly constructed, under which ruleset, with how many generations remaining" is answerable at check time — prevention-grade end to end.
The two-stage shape is a strength in the standards motion, not a compromise: stage one is demonstrable against frozen, dated, cited requirements — which is precisely the register evaluators and framework bodies trust.
Unchanged from v0.1 — with one addition the verification licenses: the supply-chain analogy now has its enforcement analog on paper. Signed-builds-verified-before-execution maps to attestation-required-rejected-without-witness, fleet-wide, fail-closed — a frozen requirement, not a roadmap line.
Unchanged — plus: not a request to reopen the wire freeze. The freeze's discipline (field-set changes route to a new signing-context version, never an in-place edit) is the same append-not-amend principle the record runs on, and this investigation's asks queue for that boundary rather than pressing against it.
| # | v0.1 assumed | Verified finding |
|---|---|---|
| 1 | Identity chains might root in creation | They do, constitutively — durable record before use on both tiers; no witness, no mint. Caveat: the verify path never reads the creation record; birth-binding is Reconciler detection. |
| 2 | The verdict might express signature-verified-at-birth | Enforcement yes — frozen, fleet-wide, fail-closed. Verdict input no — the input set is closed; birth attestation collapses into credential-invalid or an off-books detection event. First-class legibility is a new-signing-context change. |
| 3 | Hop-chain depth might carry delegation-generation limits | No representation — one Operator-set per-root ceiling only. Exact narrowing precedent exists for counter ranges; generalizing it is a wire change. Per-class-root topology is the unsanctioned workaround, to be proposed, not assumed. |
| 4 | GRANTHA grants might scope class + ruleset version | Shape clean, machinery absent — scope grammar and narrowing algebra deferred, version predicates unscoped, no cause codes. The holder-slot boundary position does not block class-as-resource. This case feeds GRANTHA's next design pass. |
Cross-cutting: findings 2 and 3 terminate at the same wall — signed-payload field-set changes route to a new signing-context version, confirmed standing through V2. Finding 4 terminates at an absence, not a freeze. The report itself is filed alongside this investigation; its citations are the evidence base for every claim above.
D-1 — Adopt the pattern, two-staged. Governed construction v0 (frozen machinery + conventions) as the stated architecture now; verdict-legible construction as the named target at the next wire version. Recommendation: adopt. D-2 — File the three requirements with their owners. (a) Birth attestation as a verdict input and (b) the per-delegation generation field → the Stele Agentic ID arc's next-signing-context backlog; (c) construction-class scoping, version-pin predicates, and cause codes → GRANTHA's concrete-grammar design pass; plus the per-class-root topology convention proposed to the Agentic ID arc for sanction. Recommendation: file all four as written requirements, not conversation — this is what the record is for. D-3 — Flagship the standards motion at stage-one strength. The outward claim rests on the frozen, citable requirements (constitutive creation; fail-closed attestation; Operator-held levers), with stage two stated as committed direction. Recommendation: adopt; boundary one's sharpened clause travels with every appearance of the claim.