A signature grants the reach of the steward who gives it: only a person signs, no agent reaches a key, nobody widens their own mandate, and what lies in another steward's surface is asked of that steward
Superseded
Context
ADR-066 says WHO signs — a person, out of band, against a public key kept as data — and ADR-063 says the terms of a Work Order are owned outside the worker. Neither says HOW FAR a signature reaches, and on 2026-09-22, in the consumer that exercises governed delivery the hardest (DD-eca, block 7), four gaps were measured:
1. ONE KEY SIGNS FOR EVERY RESPONSIBILITY. Each level carries a single `.governance/witness.pub`. A Work Order that changes a template and the style sheet it must obey is ratified by the same key that ratifies the style sheet. The separation between the one who implements and the one who governs a colour, a token or an ADR exists only as prose. DD-eca had rejected a `principals/` directory for this reason's opposite (one witness was simpler); the principal reopened that on 2026-09-22 with a decision: ONE KEY PER AUTHORITY, even while one person holds them all.
2. REACH IS A HAND-WRITTEN PATH LIST THAT NOBODY READS. `Sow._Contract` carries `scope` and `exclude`; `exclude` has no reader anywhere in the protocol (no module and no witness mentions it) and DD-eca's gate reads only `scope`. A Work Order can therefore forget to exclude, or exclude less in order to reach more, and nothing notices.
3. NOTHING KEEPS A KEY OUT OF AN AGENT'S REACH. ADR-120 recorded that the ratifying secret key is a 0600 file under the same user every agent process runs as; the same day, the agent's own SSH keys were measured to carry no passphrase. A passphrase is not custody: nothing today prevents an agent from reading `~/.minisign/` or running `minisign -S`. The principal rejected host permissions (Claude Code deny rules) as the mechanism: they give no guarantee and do not travel to other environments. The mechanism is the principal's to find, and it does not yet exist.
4. A CROSSING IS SILENTLY ABSORBED OR SILENTLY BLOCKED. When a change needs a file another responsibility governs, the executor either widens its own scope (fox-authors-the-contract, ADR-063) or stops without saying whom to ask. Neither leaves a record a person can act on.
The principal set six principles, recorded here as the decision's floor:
P1 Only a human signs. No agent signs, with a person's key or with one of its own. P2 Signing keys are out of any agent's reach, by mechanism — not by a key's passphrase. P3 Nothing is self-granted: no actor widens its own authorization, under any pretext. This is the last safeguard against drift, against third parties and against injected intentions. P4 The agent leaves a trace (which session, what it did). A trace authorizes nothing. P5 A signature authorizes a declared reach: which surfaces, which aspects, how much slack. It is a gradient that moves with context and task, and moving it is signing again. P6 Outside the reach, stop and ask ANOTHER authority — neither higher nor lower, other — which authorizes and takes responsibility. A question of roles, not of hierarchy.
The principal's example: a signature may allow moving a button and scaling its font and size, but not changing its shape or its colours, which the style sheet governs with its own authority.
Decision
A SIGNATURE CARRIES THE REACH OF THE STEWARD WHO GIVES IT. «Steward» names an authority of this kind; «authority» already carries other senses in this protocol (domain authority, context authority, the AUTHORITY side of a bond), and the glossary's `warrant` is evidence for admitting a result, not a reach.
(1) A REGISTRY OF PEER STEWARDS. `ontology/schemas/stewards.ncl` types it: each steward declares its responsibility, its SURFACES (paths, with wo-gate's scope semantics), its ASPECTS (claims it imposes inside files another steward owns, each with a check), and the PUBLIC key it ratifies with, tagged with its scheme (ADR-047; only ed25519 is measured). Surfaces are disjoint by contract — one surface, one steward — so every crossing has exactly one steward to answer it. Adoption is opt-in: a registry applies `Stewards` to itself, as a SOW applies `Sow`. The registry holds public keys only.
(2) A SOW NAMES ITS STEWARD. `Sow.steward` is optional. With no registry, verification is today's: the level's `witness.pub`. Once a registry exists, a SOW that names no steward does not verify, and one that names a steward verifies against THAT steward's key and no other — a valid signature by another steward is a refusal, not a pass.
(3) EXCLUSION IS COMPUTED, NOT WRITTEN. The reach of a SOW is its steward's surfaces; everything else is another steward's. `mandate crossings` reports each path a change touches outside that reach, with the steward that owns it — or none, which means the registry must name one before anyone can act there. A hand-written `exclude` stays in the SOW schema for compatibility and is not the mechanism.
(4) CROSSING IS ASKING. A change in another steward's surface, or one that breaks another steward's aspect, is not done. The executor records a REQUEST (`stewards.ncl` `Request`: what, why, from which SOW, in which session) addressed to that steward, unsigned — a trace, not an authorization. The other steward answers by signing a SOW that covers the change, or by not signing it.
(5) NOBODY WIDENS THEIR OWN MANDATE. A SOW whose scope reaches the steward registry or the governance tree (SOWs, signatures, receipts) is reported by `mandate self-grants` and refused by a gate that consumes it: a mandate never covers what defines it.
(6) A TRACE, NEVER A SIGNATURE, FROM ANYTHING THAT CANNOT SIGN. An agent or a service leaves one trace entry per turn (`stewards.ncl` `TraceEntry`: session, actor, SOW exercised, files touched, contract verdicts, open requests), append-only and unsigned. The record is closed: it cannot carry a signature field and so cannot pose as one. A receipt a person signs may cite it.
(7) KEYS ARE OUT OF AN AGENT'S REACH BY MECHANISM. Recorded as a Hard constraint that is NOT gateable yet: the mechanism does not exist, host permissions were rejected, and a check an agent runs to prove it cannot reach a key is a check it could run to reach it. Agents read public keys to verify, and nothing else.
`reflection/modules/mandate.nu` implements (2), (3) and (5) and never signs. Gates consume it; the first consumer is DD-eca's `wo-gate`, under its own Work Order.
WHAT THIS DOES NOT DECIDE: how P2 is enforced, where requests and traces are stored in a consumer, and how a multi-level constellation composes registries (wo-gate's union of members is not modelled).
Constraints
- Hard No protocol module or script invokes minisign to sign or to generate a key; signatures are made by a person, out of band (ADR-066). A signing command may be PRINTED for a person to run, never executed.
- Hard No agent process can read a signing secret key or invoke a signature with one; the denial is a mechanism outside the agent's control, not a passphrase and not the agent's host configuration.
- Hard A SOW whose contract scope reaches the steward registry or the governance tree is reported by `mandate self-grants`, naming the contract, the scope entry and the term it reaches; a SOW whose scope does not is not reported.
- Hard With a steward registry, a SOW verifies only against the public key of the steward it names: a valid signature by another steward is refused, and a SOW that names no steward is refused.
- Hard Given a registry, a steward and the paths a change touches, `mandate crossings` reports every path outside that steward's surfaces with the steward that owns it (null when none does), and nothing for a path inside.
- Soft A trace entry is a closed, unsigned record: `TraceEntry` accepts a plain entry and rejects one carrying a signature field.
Alternatives considered
- One witness key that signs while declaring on whose behalf — rejected: The separation would be declared inside the signed bytes and enforced by nothing: any holder of the key could declare any steward. The principal chose one key per authority.
- Keep reach as a hand-written scope/exclude list per contract — rejected: `exclude` has no reader, and a list the worker writes is a list the worker can shorten. Computing the exclusion from the registry removes the input the worker could game.
- Let an agent sign with a key of its own — rejected: P1. It crosses a line nobody knows how to govern: an agent key is a key an agent can use, and the trace it would sign is exactly what a trace must not become — an authorization.
- Deny key access through the agent host's permission rules — rejected: Rejected by the principal on 2026-09-22: no guarantee and not portable to other environments. A deny rule an agent's host enforces is also a rule the agent's environment can change.
- A hierarchy of authorities, where a higher one may sign for a lower one — rejected: P6: it is a matter of roles and responsibility, not rank. A higher key that signs for the style sheet takes a responsibility it does not hold and makes the steward who does hold it redundant.
Anti-patterns
- A SOW whose scope covers its own terms — The worker's SOW names the registry, the governance tree or its own file in a scope, so its signature authorizes changing what bounds it.
- Another steward's surface changed under this steward's signature — A change needs a file another steward governs and the executor makes it, reasoning that the contracts still pass. The signature that covered the work never covered that file.
- An agent's record read as permission — An agent signs its trace, or a trace is cited as if it authorized what it records.
Perspectives