feat(governance): authorize delegated agent contributions

[adrianwebb]

Outcome

Adds human-owned standing project contribution authorizations and exact-head API-signed agent attestations, replacing repeated agent staging-PR human affirmation with a one-time project grant.

Work authority

• Work item / Issue: Platform ledger CONTRIBUTION-AUTH-001
• Proposal / decision: user-approved delegated project authorization architecture
• Assignment / checkpoint: bootstrap implementation; no standing authorization has been created
• Actor: Codex primary implementation agent
• Human authority: @havensadrian
• Agent / capacity provider: contract implementation only
• Exact base ref: staging f5132e5
• Exact head ref: codex/project-contribution-authorization d8ed36c

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

1. Human owner plans and reviews exact grant text, scope, and digest once per project authorization generation.
2. Apply requires the unchanged confirmation digest and creates a new generation.
3. Agent receipt issuance re-reads assignment, agent, provider, project, and active grant.
4. PR validation reads policy and AGENTS.md from the exact base SHA and verifies Ed25519 receipts.
5. CLI and Agent integration project the public record and managed body block.

Status: API implementation complete; hosted/cross-package checks and bootstrap canary pending.

Changes and commits

• ecea896 — durable routes/custody, signing, exact assignment validation, two-mode PR policy, definitions, and guidance.
• 09cb530 — bind the exact SDK authorization bundle contract.
• 43a0739 — resolve the successful producer run that owns the exact-head SDK artifact.
• d8ed36c — add exact acceptance statuses and guarantee coverage for all five contribution routes.

Verification

• Authorization service, API integration, licensing contract, and shipped-definition suites: 4 files / 8 tests passed.

• npm run build:dist — passed.

• npm run check:file-lengths — passed.

• Workflow YAML parse and git diff --check — passed.

• Contract/package route matrices: 3 files / 33 tests passed.

• Full local API acceptance, including all five new route matrices: passed.

• Hosted exact-head checks: pending.

• I ran the narrowest relevant package verification and documented checks that remain.

Risk and rollback

No standing grant is created by this PR. Mutations require an authenticated human team owner and exact confirmation digest; agent receipts require matching assignment/provider/agent facts. The trusted PR workflow executes no PR checkout and reads policy/guidance from the base SHA. Revert with companion SDK/CLI/Agent changes before issuing a grant.

Completion summary

API custody now separates human legal authorization from agent operational attestation. The initial base-policy projection and one project-level human approval remain; routine authorized staging PRs will not require human affirmation.

Contribution grant (bootstrap state)

This draft intentionally does not request repeated per-PR affirmation. The one-time bootstrap transition and standing project authorization remain unissued.

• I have read CONTRIBUTING.md, have the right to submit this contribution, and grant the rights described there, including the right to offer my contribution under the project's AGPL and alternative commercial licenses.

Agent contribution attestation

Pending — the first trusted base policy has not been human-authorized or projected.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.