Core
attestation
The property that an agent action can be verified, from a single signed object, to have happened and been authorized. An action is attested when both claims hold and verify offline.
Attested Action Envelope (AAE)
The atomic verifiable object: a signed, per-agent hash-chained record binding an action to its authorization. Carries
agent_id, action (verb/resource/params), policy_id, outcome (authorized/denied/conditional), prev_hash, issued_at, pubkey, and sig — Ed25519 over the JCS-canonical body. Implemented by sm-aae.chain
The per-agent linkage formed by each envelope naming its predecessor via
prev_hash. Deleting or reordering an agent's envelopes breaks the chain — its authorization history is tamper-evident.receipt
The occurrence artifact for claim (a) — that an action happened. Portable, cryptographically signed. Implemented by
sm-arp (Agency Receipt Protocol).permit
A pre-action authorization verdict for claim (b) — that an action was allowed. Implemented by
sm-aae; refusals are first-class signed artifacts.grant
The principal-signed delegation behind a permit — what an agent may do, for how long, under what limits. Implemented by
sm-dat (Delegated Authority Token).Companion — subject corroboration
Terms belonging to the separate corroboration layer that establishes whether the subject an action was performed against was truthful. Consumes attested actions; distinct from the envelope's two claims.
corroboration
Establishing agreement about a subject by asking multiple independent sources, from multiple vantages, the same question — and treating any disagreement as a signal.
quilt
The corroborated-discovery construction from the paper The Quilt That Checks Itself: a fabric of multi-source claims about subjects that checks itself for divergence.
verdict (AGREE / DIVERGENT / INSUFFICIENT)
The result of a corroboration sweep.
AGREE: the decisive sources agree. DIVERGENT: sources disagree. INSUFFICIENT: fewer than two decisive claims to compare.sweeping party
The identity that performs a corroboration sweep and signs the resulting record, recorded in the
sweeping_party_identity field.