Who is who is the authority's: a project pins one public key, reads attestations offline, and names who commits in every new SOW

Context

ADR-066 made governed delivery enforcing: a SOW is done only behind a person's out-of-band signature, verified against a public key the project keeps (`.governance/witness.pub`). ADR-121 tried to say how far a signature reaches, twice, and was rejected twice before acceptance: its first text bound one key to each steward (identity mixed with authority), its rewrite kept persons, roles and assignments in a registry inside the repository. Both kept in the repository the thing that must not be there: HOW THE PIECES COMBINE — who is which person, which key is theirs, which hat they hold, who may do what. Whoever can write the repository (an agent included) could then grant themselves a hat or pose as someone else. The invariant the principal set is that a signature, the action it awaits and the responsibility it carries cannot be forged or usurped.

Measured while building the replacement (2026-09-23), against a real authority — signatio's daemon, run from its own repository in a throwaway stack, not an imitation: - every answer, log entry and attestation it emits verifies OFFLINE with its one public key; - a statement written by ontoref in JCS (RFC 8785) is accepted, and the same statement in any other encoding is refused — the two implementations agree byte for byte; - a key revoked after it attested leaves what it attested valid, and signs nothing new.

Two findings shaped the rest. A SOW without a policy hides the question it exists to answer — who commits — and its implicit policy (one witness key for everything) is the model this leaves behind; a signature nobody would refuse is a formality, not a commitment. And the authority's own repository cannot be governed by the authority: an outage or a defect of it would block the very order that repairs it. The authority's protocol is its implementation's (signatio's ADR-001: a generic core and a profile per consumer); this record states what ontoref, as a consumer, holds to.

Revised 2026-09-24, before acceptance: the first text provided the protocol as a domain of its own, `authority`, discovered through a provider's manifest or declared by a command. Signing, verifying and authorizing a person's act is how `gov` EXERCISES governance — the capability ontoref gives a governed project — not a second domain beside it; and «authority» already names the AUTHORITY side of every domain relation (code/domains/README.md). The domain is withdrawn and the provider is declared only.

Decision

WHO IS WHO LIVES IN AN EXTERNAL AUTHORITY; A PROJECT DECLARES ITS PIECES AND READS WHAT THE AUTHORITY ATTESTED, OFFLINE, WITH THE ONE KEY IT PINS.

(1) A PROJECT HOLDS NO IDENTITY BINDING. It declares its pieces — hats, rules, policies — in its repository. Persons, their public keys, their hats per project and what they may do are the authority's: its protocol (`protocol.ncl`) is imported from the provider the project DECLARES (`signauthz.provider.root_cmd` in the project's config: a command each host resolves, for an installed pack — never a path, since the file is versioned) and applied to ontoref's registered profile (`authority-profile.ncl`) by the client, `code/ontology/schemas/authority.ncl`. The provider's own manifest names the schema directory (`schema_path`, relative to the root the command printed) and declares no domain. There is no domain `authority` and no discovery: a provider nobody declared is not a provider, and a command that does not resolve refuses, saying which. `principals.ncl` survives only as the historical shape those records inherited; no stage reads a registry of people.

(2) ONE PINNED KEY, CHOSEN OUT OF BAND. A governance level registers with the authority (`ontoref authority register`): the authority's public key arrives by the level's declared out-of-band channel and is pinned BEFORE anything is asked; every answer — the token included — is verified with it. Keys are kept as a history (`<level>/authority/pins.json`): a rotation is announced signed by the old key and the new, and enters only by a person's confirmation. The pinned keys are the only public keys the project keeps.

(3) TOKEN FIRST; AN ANSWER THAT DOES NOT VERIFY IS NOT AN ANSWER. Nothing is asked without a short-lived token (≤ 900 s) proved by a client whose proof is a command the project declares — nobody in ontoref knows where a key is. Expiry is renewed once; a refused renewal refuses the operation. Without an authority — undeclared, unregistered, unreachable — every stage that moves a SOW is refused, saying which; reading what was attested keeps working.

(4) VERIFY ONCE, CHECK FOREVER. The authority verifies a person's signature once and returns an attestation it signs (subject digest, scope, proof; no person's identity inside). ontoref keeps it beside what was signed (`<file>.<KEYID>.attestation.json`) and every later reading — status, verify, a gate — checks it offline: under the pinned keys, over these exact bytes, for this project and SOW, in a scheme the policy accepts. The evidence is the attestation; the ledger remains a trace that grants nothing.

(5) EVERY STAGE ASKS FIRST AND RECORDS AFTER. Review, request, collect and land ask the authority to Authorize and Record the outcome linked to that decision; whom to ask comes from its Holders; a person's own act is never granted to an agent or a service.

(6) NO NEW SOW WITHOUT A POLICY. A new order names who commits (at least one 'Mandatory party); the refutation blocks a draft without one. A change nobody would refuse is not an order — the gate absorbs it as trace. Orders signed before policies existed stay valid and are only read: with `witness.pub` until a one-time migration has the authority attest each old signature under the reserved `witness` hat, then from those attestations.

(7) A LEVEL THAT MUST NOT DEPEND ON AN AUTHORITY SAYS SO, AND GETS LESS. A level that cannot be governed by an authority (the authority's own repository) declares itself offline (`<level>/authority/offline.ncl`: why, and its key). It takes only the minimal policy — one 'Mandatory party holding the veto, 'Consent, 'Limit checks — signed with that key; any party that would need hats someone attests is refused. The exception is declared per level, never a relaxation of the rule for all.

(8) THE AUTHORITY IS A CAPABILITY OF `gov`, OPTIONAL. `gov` declares its implementation as a requirement — `signatio`, `required = false` — whose `impact` names what stops without it: the stages that move a SOW with a policy. The domain and everything else in it keep working. A project uses it by installing the pack and declaring the provider; nothing in ontoref installs it, and no project's protocol requires it. The project configures the capability in its `signauthz` section — the provider, the endpoint, the clients (authority.ncl ClientConfig). What it talks to keeps the role's name: the authority — the `authority` verb, `<level>/authority/` with its pins and registration, authority.ncl. Neither names a domain.

Constraints

• Hard No ratification stage reads a registry of persons, keys or hat assignments from the repository.
• Hard A decision or a log entry that allows a person's own act to an agent or a service is refused by the contract, whatever the authority answered; an entry of such an act carries the person's attestation.
• Hard ontoref's profile `ontoref-work-orders` meets the core's Profile, imported from the declared provider and never copied; it equals the provider's test copy and reproduces what ontoref enforces — its actions, acts and reserved witness hat, and its statements case by case, the core being stricter only where named.
• Hard The client imports the authority's protocol from the one provider the project's config declares by a command, the schema directory named by that provider's manifest; nothing is discovered, and every failure to resolve says which.
• Hard ontoref declares no domain `authority`, and the client resolves the protocol by no domain probe.
• Hard gov declares its implementation as the requirement `signatio` with `required = false` and an impact that names the stages it stops.
• Hard Every answer of the authority is used only after its signature verifies with a pinned key; without an authority the stages that move a SOW are refused, saying which.
• Hard A SOW with a policy is ratified only by attestations admitted offline under the level's pinned keys, over its exact bytes; a forged ledger, an edited attestation, one for another SOW or one by a retired key moves nothing.
• Hard The refutation blocks a new SOW draft that declares no ratification policy.
• Hard A level declared offline ratifies with no authority, and only the minimal policy: one 'Mandatory party holding the veto under 'Consent, plus 'Limit checks, signed with the level's declared key.
• Soft The migration presents each signature made before policies once, under the reserved witness hat, keeps the attestation beside the file, and never presents a signature that does not verify.
• Soft The governed-delivery mode verifies receipts and signatures through ontoref's verification of attestations, not against witness.pub.

Alternatives considered

• One key per steward (ADR-121, first text) — rejected: Mixes identity with authority: one person with five responsibilities holds five keys and names on every signature which hat signed, with no real separation — all five keys are the same person's.
• Persons, roles and assignments in a registry in the repository (ADR-121, rewrite) — rejected: The registry is a file whoever writes the repository can edit; the self-grant it is meant to prevent is one commit away.
• An imitation of the authority for tests — rejected: A copy of another component's behaviour that drifts from the original (the ADR-074 shape). The real daemon, built from its repository into a throwaway stack, is the oracle.
• Pinning the authority's key from its first answer (trust on first use) — rejected: The first answer is exactly what an impostor would send. The key is received by the declared out-of-band channel and pinned before anything is asked.
• Keeping SOWs without a policy as a lighter path — rejected: It keeps the one-key-for-everything model alive under another name and hides who commits. What nobody would refuse is absorbed as trace instead.
• The authority governs its own repository — rejected: Circular: an outage or a defect of the authority would block the order that repairs it. A level declared offline, bounded to the minimal policy, answers the case without weakening the rule elsewhere.
• A domain `authority`, provided by the implementation and discovered through its manifest (this record's first text) — rejected: It makes a second domain of what is gov's exercise, and gives a domain the name the domain model already uses for every domain's own side. Discovery also required a rule for two providers that disagree; a single declared command needs none.

Anti-patterns

• A registry of people returns to the repository — A convenience (a hat map, a key list, a principals file) reappears in the project because asking the authority is slower. It is the self-grant surface this record removes.
• A level declared offline to skip the authority — The offline declaration is used by a level that could depend on an authority, because it is simpler. Its policies then collapse to one key for everything — the model left behind.
• The authority returns as a domain — A domain `authority` (or any id for the same capability) is declared so the provider can be found without being declared. It splits gov's exercise across two domains and reopens the question of which provider wins.

Related ADRs

ADR-121 · ADR-066 · ADR-063 · ADR-047 · ADR-074 · ADR-098 · ADR-102 · ADR-117 · ADR-119