docs(agent-commit/v0.2): document ResourceDescriptor byproduct pattern

[tomjwxf]

Picks up your comment on #1 and your edit on SLSA #1594 about using
ResourceDescriptor references (not inlined content) for additional
attestations produced by identities distinct from the builder. All changes
are additive to v0.2, no breaking changes to the observation byproduct
schema.

What this changes

#	Change	Where
1	New ### Referenced attestations subsection in the Byproducts section	agent-commit/v0.2/index.md
2	A decision-receipts ResourceDescriptor entry added to the coordinator + implementer JSON example alongside the observed-* entries	Example section
3	Parsing rule: byproduct entries with both digest and uri SHOULD be treated as ResourceDescriptor references, routed by annotations.predicateType	Parsing Rules section
4	Design Rationale subsection explaining trust-domain separation	Design Rationale
5	Additive changelog entry	Changelog

Why this addresses your architectural question

Your comment on #1 named the right issue: "what you are trying to do for a decision-receipt is being driven from a different identity." The ResourceDescriptor pattern resolves this cleanly:

• The builder's DSSE signature covers only the builder's assertions, not the referenced attestation's content.
• The referenced attestation is signed by its own identity (supervisor hook, runtime telemetry service, third-party auditor).
• The builder records {digest, uri, predicateType, signerRole} so a verifier can fetch and validate the referenced attestation independently.
• Substitution is detected by digest mismatch.

For decision receipts specifically: the receipt is signed by a supervisor hook (the PreToolUse interceptor in the agent host), using a key the agent process cannot access. The supervisor is in the enforcement path by the host's wiring, not by the agent's cooperation. Different identity, different key, same subject.

Example

The worked example now carries a decision-receipts entry alongside the observed-* entries:

{
  "name": "decision-receipts",
  "digest": { "sha256": "a8f3c9d2..." },
  "uri": "oci://ghcr.io/org/agent-session/run-coord-issue-42/receipts:sha256-a8f3c9d2",
  "annotations": {
    "predicateType": "https://in-toto.io/attestation/decision-receipt/v1",
    "signerRole": "supervisor-hook",
    "chainLength": 47,
    "genesisReceiptHash": "sha256:a8f3c9d2e1b7465f",
    "finalReceiptHash": "sha256:e4d61f7a09b8cd34"
  }
}

The predicateType URI points at the in-toto predicate proposal #549. If that URI changes during in-toto review, this reference can update without a schema change.

What I did not change

• Observation byproduct schema (observed-network, observed-filesystem, observed-process) is untouched.
• External / internal parameters, subagent model, builder, metadata are untouched.
• Threat-model section is untouched.

The pattern is purely additive: the buildType gains a documented way to reference external attestations without modifying what is already there.

Open questions

Happy to iterate on any of these:

1. signerRole naming. Open to signer, producer, attester, whatever fits. I used signerRole because it is a role, not an identity.
2. Predicate type URI. If feat(predicates): Decision Receipt predicate for agent governance attestations in-toto/attestation#549 settles on a different URI, we update the example to match.
3. Version bump. I kept the changes in v0.2 since they are additive. Happy to split into a v0.3 tag if you would rather keep v0.2 frozen at the timestamp addition.
4. Reference to in-toto ResourceDescriptor spec. I linked to https://github.com/in-toto/attestation/blob/main/spec/v1/resource_descriptor.md. If you prefer the SLSA provenance link or a different canonical reference, happy to update.

Refs

• Issue Proposal: decision-receipts byproduct type for agent-commit v0.1 #1 (this repo): your comment about the ResourceDescriptor approach
• slsa-framework/slsa#1594: SLSA-for-agents discussion (your edit to the comment introduced this pattern there too)
• in-toto/attestation#549: decision-receipt predicate proposal

Thanks for the careful architectural read — the decision-receipts design is materially better with the ResourceDescriptor separation than with the inline version I proposed initially.

[arewm]

In the process of pushing a new v0.3, I also modified every commit by adding sign-offs. That resulted in the closure of this PR.

https://refs.arewm.com/agent-commit/v0.3/

[tomjwxf]

Thanks @arewm, glad the pattern landed in v0.3. Worth adding a reference to #1 and #2 in the Design Rationale for traceability?