Add AI Agent Decision predicate

[bengunvl]

Proposes a new predicate type for decisions made by automated agents in the supply chain, following the predicate template and the vetting process in the New Predicate Guidelines.

The gap

Supply chains increasingly contain decisions no human made. An agent triages a vulnerability report and closes it as not exploitable. An agent approves a dependency bump. An agent decides a failing test is flaky and re-runs it.

Each of those changes what ships. None produces an attestation today, so a policy engine that can verify how an artifact was built cannot ask who or what decided it should be built that way.

Why not the existing predicates

• SLSA Provenance records builder, source and parameters, not a judgement made during the process. Agent metadata could go in internalParameters, but that field is explicitly unstructured and not meant to carry claims a verifier acts on.
• Test Result records what a harness concluded. A decision is not a pass or fail; it has a rationale, a confidence, and sometimes a human who overruled it.
• SCAI Report is the closest fit and is deliberately general enough to express much of this. I have said so in the document rather than arguing it away, because it is the strongest objection to this PR. The case for a distinct type is that decisions have a recurring shape worth standardising rather than re-deriving per producer, and that SCAI has no equivalent of the record field, which binds an attestation to a tamper-evident sequence of earlier decisions. If maintainers judge that insufficient, I would rather hear it than have a redundant predicate merged.

What the predicate adds

A Context Passport integrity block alongside the decision. That gives two independent checks answering different questions: envelope signature verification establishes who issued the attestation, while recomputing the hashes establishes that the decision has not been rewritten since it was made, including by whoever signed the attestation.

Context Passport is CC0, archived at 10.5281/zenodo.22153488, with Apache-2.0 reference implementations in Python and TypeScript and a CC0 conformance suite. Verification needs only SHA-256 and an RFC 8785 canonicalizer: no network, no account, no trust in the issuer.

Notes

• The type URI is under contextpassport.com rather than in-toto.io. If this is accepted and maintainers prefer the in-toto namespace, I will follow up with the redirects-list PR described in the guidelines.
• The parsing rules call out the monotonic principle explicitly, because it is load-bearing here: an absent humanOversight object asserts nothing, and a policy requiring human review must demand the field be present and true rather than infer anything from its absence.
• No protobuf definition included yet. Happy to add one to match your conventions if the predicate is accepted.
• The example is a complete statement, as the template requires, and it parses as valid JSON.