agent-evidence-vectors v0.37.0

Predicate types this host answers for

A predicateType is the one string a third party writes inside the bytes they sign. Stripping it invalidates their own signature, so it cannot be changed after publication and it cannot be allowed to stop resolving: a verifier that dereferences a type URI and is handed a 404 has no way to tell a type that was never published from one that was withdrawn, and both readings are wrong.

This file is the list of type URIs under https://probityai.github.io/agent-evidence-vectors/predicate/, and the site build reads it rather than carrying a list of its own. A URI added to a signed payload and not added here is a URI that will 404 the first time somebody checks it, which is the defect this file exists to make visible in review.

Each entry says which of two kinds it is, and the distinction is the point:

Defined here

predicate/v1/observed-effect

The predicate carries an observed effect of an execution, separately from the claim an executor makes about it, so that a consumer recomputes the effect from carried bytes instead of accepting an asserted one.

predicate/v1/signature-coverage

The predicate carries one signed structure: the source as readers see it with repeats kept, the signed payload with its signature, the keys declared outside the signature, and the paths a consumer reads. The signature input must determine everything a reader can read: two records that read differently may not share one.

predicate/v1/evidence-state

The predicate carries one system's declared evidence state, a code of the vocabulary term evidence_state (ES0 to ES8), beside the observations that ground it. The state is the highest code whose entry condition the observations meet; a declared code that differs is refused, and a silence is declared clean (ES1) only over measured coverage.

predicate/v1/incident-evidence-cell

The predicate carries one coded cell of an incident decision table inside an in-toto Statement v1 whose subjects are the source documents the cell was coded from. The cell names its table, row and column, an evidence_state code URI, a response_function value, a support label, and either the value it records or an empty marker; an empty cell is labelled unknown. The producer signs the Statement in a DSSE envelope with its own key, and the record's doesNotAssert says the signature shows who coded the cell, not that the cell is true.

predicate/v1/monitor-coverage

The predicate carries one monitor's verdict over one window: the monitor's vantage and the channels it reads, the collector-side coverage count, an effect another source observed, and the verdict with its decision and effective-action counts. A clean verdict stands only on complete collector coverage of the channel the effect used, and a claim that a defence reduced harm needs at least one effective action.

predicate/v1/containment-journal

The predicate carries one multi-agent run as a hash-chained journal: the starting communication graph, each delivery between agents, each containment decision with the edges it removed and added, each fallback with its declared failure posture, and each restart, assessment, restoration and response, and from revision 1.1 each retrieval with its inclusion path to the attested snapshot and each tool call with its refusal and grant chain, beside the defence's claims about the run. Every claim is recomputed from the entries: a cut edge that still delivers under an enforcing router, a return without an external score below its threshold, a closure claimed over an advisory topology, an isolated agent's tool call that was not refused, or an admitted document outside the snapshot is refused.

predicate/v1/blast-radius-receipt

The predicate carries the reach of one agent through a containment journal it names by run, head digest and entry count: the agents it reached from one entry on through deliveries the router did not drop, and the deliveries and tool calls that reach involved. It is judged only beside an allowed journal, and a reach that leaves an agent out or adds one is refused.

predicate/v1/propagation-step

The predicate carries one hop's attribution between two agents: the message log, the digest chain the attribution cites, each agent's exposures to outside sources and when the receiver acted. Propagation needs a connected chain that reaches the receiver before it acted; a shared exposure with no edge is a common cause, never propagation.

predicate/v1/uncertain-effect

The predicate carries one runtime's trail for an operation whose reply may have been lost: its attempts and their replies, the leases they were sent under, the effect owner's reconciliation answers and ledger count, the reservation held for it and the outcome the runtime reported, so a consumer can tell a settled effect from an unknown one and a safe resend from a duplicate.

predicate/v1/decision-client-failure-modes

The predicate carries one decision a client took when it asked a decision point whether an action may run: the request, the client's mode and timeout, the facts of the exchange (reached, timed out, HTTP status, whether the body parsed and the verdict it carried), the condition, outcome and basis the client recorded, and whether the action was performed, so a consumer can tell a policy decision from a fallback and an allow from a fault read as one.

predicate/v1/refusal-reason-priority

The predicate carries one attestation response and the facts it answered over: which conditions of the closed refusal vocabulary applied, the observation the answer relied on, any diagnostic read, and at the lease instant the boundary the deployment declared. The reason must be the first applicable value of the list, none when no condition applies, with null as the only permit; the observation member stays null when the relied-on observation is absent or not fresh, and a diagnostic read neither authorizes nor renews. Records are from draft-li-rttp-iqa-addressing-02 sections 6.1, 7.2, 8.1 and 8.2.

predicate/v1/evaluation-claim

The predicate carries an evaluation claim in which every coordinate is present (applicability, population, vantage, bytes, epoch, settlement), each a value or not applicable under a reason the profile pinned by the relying party's acceptance rule authorises, so that a case nobody ran is never read as a pass.

predicate/v1/self-reported-record

The predicate carries an agent's own record of a session, with each field declaring whether a substrate observation covers it or the record's own attesting key alone, so a consumer can tell the observed fields from the self-asserted ones.

predicate/v1/peer-verification

The statement a second party signs when it checked a conformance requirement itself: the vector, the requirement, and the client run or retained transcript it used. A verdict record names it by digest to lift witness_scope above SELF; the runner cannot write one.

predicate/v1/incident-action-authorization

Record R1 of the restoration evidence profile: who authorized one incident response action, the role each named party held, the kind of grant the authorizer acted on, and whether the authority was committed before the action ran.

predicate/v1/revocation-sweep

Record R2 of the restoration evidence profile: the credential population a revocation sweep ran over, its partition into revoked, retained and unassessed, and the coverage the producer claims, so that a claim wider than the partition is visible from the record alone.

predicate/v1/re-enable-decision

Record R3 of the restoration evidence profile: one decision to resume, stage or keep restricting a stopped agent system, its approvers, and for every evidence slot either a digest or an explicit statement that it was not addressed.

predicate/v1/joint-authority

Record R4 of the restoration evidence profile: which party may act on which asset when an incident spans organisations, under what kind of grant, and which indicators they share.

predicate/v1/revocation-boundary

For one declared sink and test window, whether an effect from a task in flight committed after a credential revocation took effect, with the counts a reader needs to judge it. It names no mechanism.

predicate/v1/control-decision

The predicate carries one policy decision as a host records it: the SHA-256 of the RFC 8785 bytes of the context the decision point judged, the digests of the policy manifest and bundle it ran, and the verdict as the runtime returned it. A consumer replays the disclosed context and policy itself, and a record whose digests or verdict the replay does not reproduce is refused.

Registered here

predicate/v1/kernel-substrate

predicate/v2/kernel-substrate

predicate/v2/launch-chain

predicate/v1/agent-audit-record

predicate/v2/agent-audit-record

predicate/v1/govops-trace-record

predicate/v1/evidence-scope-disclosure

predicate/v1/launch-chain

predicate/v1/ml-bom

predicate/v1/quotation-fidelity

predicate/v1/scorecard-verdict

predicate/v1/security-verdict

predicate/v1/signed-evidence

predicate/v1/static-scan-verdict

predicate/v1/substrate-integrity

predicate/v1/sut-provenance

predicate/v2/a2a-mesh-scorecard

predicate/v2/mesh-quiescence

The entries in this section are registrations, not specifications. Their field definitions are normative where they are published, which is not here, and no count, field list or wire form on this page may be read as authoritative for them.

Types served from another host

Types defined in this directory with a URI under https://w3id.org/agent-evidence/predicate/v1/ are served from a persistent identifier namespace that is not this repository. The site build here publishes no page for them, and the scan in scripts/predicate-uri-gate.py does not cover that host. scripts/build_predicate_pages.py writes their pages under pages/predicate/v1/, the organisation Pages site serves those pages at the targets of the w3id.org rules, and scripts/check_uris_resolve.py --network requests every one of them each day. Each document is the authority for its type.

spec/predicates/done-records.md defines the records both read and no type URI.