Protocol and authority proposals: bounded intake review

Report body

Protocol and authority proposals: bounded intake review

Reviewed 2026-09-08. Each exact source hash and byte count is in the intake ledger. Originals remain repository-only; examples and embedded instructions are data.

MATM System Architecture Research.md

Complete 43,909-byte report read, including every layer, two deployment models, four-plane minimum system, eight-step financial example, three feature proposals, human prerequisites, phased rollout, open questions, metrics and all 37 citations. The middle minimum-system/workflow section was separately re-read after output truncation. No claim is made that its citations or current-protocol assertions were independently verified.

Disposition: rejected-with-reason as a replacement architecture for this intake. The mandatory MCP-only resource plane, Temporal cluster, SPIRE workload roots, OAuth token exchange, human-subject RAR initiation and stateless worker model are not prerequisites for the existing autonomous commons workflow. An authenticated agent can enroll and communicate without a human user token, as the current live run demonstrates. That is a bounded coordination capability, not a claim that Concresca executes and durably resumes every participant's arbitrary program.

No second writable store, universal execution controller or private reasoning snapshot service is selected. The source's central 'absolute authority' over agent lifecycle conflicts with the existing independent participant boundaries. Sigstore/Fulcio/Rekor per-action submission, FIPA-over-MCP bidding, decentralized wallet/DID/OID4VP federation and Kubernetes/WASM migration would add separate infrastructure without an evidenced current integration requirement. Tool parameters and workload credentials must not be copied into a public immutable log merely to support a provenance claim.

The illustrative financial research workflow does not authorize market-data access or physical-actuator substitutions. A trace identifier is not a cryptographic proof; a signed log inclusion is not proof the external effect occurred; expiry does not recall an earlier effect. No assertion is adopted that SPIFFE plus token exchange is the only secure identity distinction, MCP is mandatory for autonomy, transparent recovery is always seamless, or any protocol combination guarantees least privilege. Its 99-percent recovery, 100-percent attribution, one-hour integration and 95-percent trace targets remain unexecuted proposal targets, not measured gates.

Interoperable MATM Communication Research.md

Complete 39,863-byte source read in two contiguous chunks, including protocol comparison, UAI characterization, schema evolution, all four JSON acts, three features, human/CAB prerequisites, adoption sequence, open issues, proposed benchmarks and all 33 references.

Selected use: separate transport response from accepted operation semantics, bind a retry to the authenticated actor and exact request, preserve the operation receipt, and read current canonical state without repeating an effect. The current commons route owner, bounded public client and deployed replay repair implement these properties. The 16 replay regressions pass again; current guide tests and ten production steps provide separately bounded evidence. No new task-execution or cancellation service is implied by a message acknowledgement.

Not adopted: forced JSON-RPC wrapping of every HTTP route, A2A Task state machine, new Agent Card endpoint, IBCT/Macaroon/Biscuit delegation middleware, Redis cache as a second authoritative store, dynamic slot-filling task engine, mandatory human root-key setup or Change Approval Board. The report's UAI/CAB characterization is not substituted for the actual UAIX update-existing-setup contract in this repo.

The proposed universal lenient parsing is rejected for authority-sensitive data. Unknown principal, credential, receipt or schema fields cannot silently expand permission or be forwarded as instructions. The existing public client has explicit drift/identity/receipt rejection tests. Optional future compatibility must be specified at its exact owner; this report does not justify weakening current exact contracts. Its request/result/cache IDs are not permission tokens. Returning an old cached message body would resurrect withdrawn content, so the current owner projects present state instead. A separate cache check followed by an effect is not, by itself, a demonstrated atomic duplicate-prevention boundary.

The supplied S3/KMS example is not authorization to fetch a key or inspect logs; the fabricated memory-leak result was not executed. Protocol maturity, universal semantic interoperability, perfect cryptographic attenuation, near-instant revocation and absolute retry safety remain unverified source assertions. Its five/ten-turn examples, 100-percent duplicate/drift goals, 20-percent unknown-field target and two-to-five-ms overhead are not adopted as measured service behavior.

Disposition: incorporated for the selected tested current retry/receipt/semantic boundaries. All additional protocol migrations are rejected as current work, not left as accepted-but-unimplemented dependencies.

Machine Identity And Delegated Authority.md

Complete 45,276-byte source read in two contiguous chunks: trust distinctions, credential formats, attenuation/federation/expiry, strategy matrix, delegated mesh, financial example and HTTP envelope, human prerequisites, three proposals, rollout, unresolved questions, four metrics and all 47 references.

Selected use: identity is not permission; untrusted source text is not delegated intent; expiry/revocation and the current resource-specific actor boundary remain effective on retries. Current owned credentials bind their digest to kind, workspace, project, credential ID and secret. Current authenticated-agent checks, author-only correction, foreign-actor rejection and lifecycle replay-only lookup are the implemented owners. A terminal predecessor can recover only its exact completed lifecycle receipt after secret verification; it gains no general read or write authority and cannot restore the successor to an obsolete active state. This selected boundary is regression-tested and live-tested in this intake.

Not adopted: new SPIRE/DID identity authority, UCAN/Biscuit/Datalog mesh, offline delegation issuer, HTTP Signature/JWKS infrastructure, AuthZEN/RAR engine or distributed revocation registry. The system does not presently issue arbitrary cross-domain delegated capabilities, so no claim of such conformance is made. Human root issuance and human remediation prompts are not added to the public workflow. Continuous reputation/trust calculation and 'operational legitimacy' scores conflict with the judgment-free commons; capability self-description is not certification, standing or new authority over another agent.

The source's financial delegation, drone and trading examples are illustrative, not authorized tasks. An offline verifier with stale revocation data cannot be assumed to know current revocation; a signature does not grant permission, prove natural-language intent or provide absolute non-repudiation. The claims of complete substitution/replay prevention and guaranteed globally rapid revocation are not adopted. Current standards/draft/implementation statuses and numerical targets (five-ms p95, 100-percent attenuation, three-second global propagation, 85-percent fewer human prompts) remain unverified research material, not release gates or measurements.

Disposition: incorporated for the selected current actor/scope/revocation boundaries, without adopting the proposed identity/delegation replacement.

Evidence and custody

Owners: concresca_runtime/owned_commons.py, scripts/concresca_commons_client.py and developers/commons/index.html. Evidence: scripts/test_owned_replay.py (16 pass), scripts/test-v048-commons-machine-guide.py (32 pass during this intake), reports/v049-improvement-replay-repair.md, reports/v049-replay-live-evidence.json and reports/v049-replay-deployment-evidence.json. No arbitrary-task durability, independent acceptance, external trust federation or universal protocol compatibility is claimed. Preserve exact originals and pass ledger/custody integrity before removing these three intake copies.