Export signed agent-run provenance for Launchplane attestations #441

Goal

Expose a signed, machine-verifiable Every Code agent-run provenance assertion that Launchplane can use to prove an engineering attestation came from a real independent reviewer run rather than caller-supplied identity text.

Context

Launchplane issue cbusillo/launchplane#2001 implemented an exact-head attestation prototype and passed its local gates, but independent security review found that one trusted submitter can fabricate distinct run_id, thread_id, and model_family payloads. Identifiers alone do not prove independent execution or model-family diversity.

The existing agent-identity Ed25519 assertion concepts, agent/thread IDs, model selection, root session identity, and agent manager lifecycle should be reused. Every Code must export provenance; it must not own Launchplane approval policy.

Scope

• Add a structured agent-run provenance assertion containing root session ID, agent/thread/run ID, role (implementer or reviewer), exact repository identity, PR number where available, exact head SHA, selected model and trusted model family, task/request identity, issued/expiry timestamps, nonce/challenge, and transcript or review-evidence digest.
• Sign the canonical assertion with an Every Code runtime identity that Launchplane can verify without trusting fields supplied by the calling workflow.
• Bind assertions to a one-time Launchplane challenge or audience so they cannot be replayed across repositories, PRs, heads, or services.
• Ensure two reviewer assertions can be proven to come from distinct agent runs and, when required, distinct trusted model families.
• Provide a narrow CLI/helper or structured event export for agents and skills to submit; do not add product approval, Owner, GitHub status, or merge policy to Every Code.
• Preserve no-human-impersonation: the assertion represents the agent/runtime only.

Acceptance Criteria

• Launchplane can verify signature, issuer, audience, expiry, nonce, repository, PR, head SHA, role, run/thread identity, model, and model family without trusting duplicated request-body claims.
• One runtime assertion cannot be replayed for another target or used as both implementer and reviewer evidence.
• Two-review diversity cannot be satisfied by editing payload strings or replaying one signed run.
• The export is stable for CLI/skill consumption and does not require transcript disclosure; only a digest is exposed.
• Tests cover signature failure, stale/expired assertion, wrong audience/target/head, replay, role mismatch, duplicate run, and model-family tampering.
• ./build-fast.sh passes cleanly with no warnings.

Finish Line

Every Code emits a signed exact-run provenance assertion that Launchplane can verify as independent implementer and reviewer evidence.

Next Action

Design the smallest assertion around the existing code-rs/agent-identity and agent-manager IDs, then add a verifier test vector for Launchplane before implementing the export surface.