|
| 1 | +{ |
| 2 | + "$schema": "https://json-schema.org/draft/2020-12/schema", |
| 3 | + "$id": "https://github.com/agentic-workforce-framework/schemas/v1/trust-subject.schema.json", |
| 4 | + "title": "TrustSubject", |
| 5 | + "description": "Accountable trust subject for every unit of agentic work. The trust subject is what AWF actually scores, replacing the V4.3 assumption that every runtime exposes a stable agent identity. The subject_type is determined by what the runtime exposes (agent, subagent, role_profile, session, graph_node, human_runtime, or task), not by what we would prefer it to expose. Trust subjects are runtime-scoped, workspace-isolated, and immutable once created (archive, never delete). See DESIGN-02 (Trust Subject Model) for the full specification.", |
| 6 | + "version": "1.0", |
| 7 | + "type": "object", |
| 8 | + "required": [ |
| 9 | + "id", |
| 10 | + "subject_type", |
| 11 | + "runtime_provider", |
| 12 | + "subject_key", |
| 13 | + "workspace_id", |
| 14 | + "created_at" |
| 15 | + ], |
| 16 | + "properties": { |
| 17 | + "id": { |
| 18 | + "type": "string", |
| 19 | + "format": "uuid", |
| 20 | + "description": "Immutable UUID primary key. Once assigned, this value never changes. Failure records and capability profiles reference this id. To retire a subject, set archived_at — do not delete." |
| 21 | + }, |
| 22 | + "subject_type": { |
| 23 | + "type": "string", |
| 24 | + "enum": [ |
| 25 | + "agent", |
| 26 | + "subagent", |
| 27 | + "role_profile", |
| 28 | + "session", |
| 29 | + "graph_node", |
| 30 | + "human_runtime", |
| 31 | + "task" |
| 32 | + ], |
| 33 | + "description": "Which of the seven trust subject types this row represents. Determined by what the runtime exposes: agent (named agent with stable identity, e.g. Claude Code, Cursor, OpenClaw), subagent (spawned within a session), role_profile (Codex worker/explorer/custom roles), session (Devin, Multica — runtime exposes no internal agent structure), graph_node (LangGraph node/edge with embedded AWF governance), human_runtime (human + runtime pair for IDE-assisted work), task (lowest-granularity fallback when no higher subject type is identifiable)." |
| 34 | + }, |
| 35 | + "runtime_provider": { |
| 36 | + "type": "string", |
| 37 | + "enum": [ |
| 38 | + "claude_code", |
| 39 | + "codex", |
| 40 | + "cursor", |
| 41 | + "openclaw", |
| 42 | + "devin", |
| 43 | + "multica", |
| 44 | + "langgraph" |
| 45 | + ], |
| 46 | + "description": "Runtime that produces sessions for this subject. Trust does not transfer across runtimes — the same logical agent on a new runtime starts PROVISIONAL. Implementations may extend this enum when onboarding additional runtimes; doing so does not loosen the per-runtime isolation rule." |
| 47 | + }, |
| 48 | + "subject_key": { |
| 49 | + "type": "string", |
| 50 | + "pattern": "^[a-z0-9_-]+(::[a-z0-9_-]+)+$", |
| 51 | + "maxLength": 200, |
| 52 | + "description": "Stable, deterministic identity string for this subject. Same runtime + same config MUST produce the same subject_key. Construction rules: (1) all lowercase; (2) components separated by '::'; (3) no spaces — use hyphens within a component; (4) include only components stable across sessions for this subject_type; (5) maximum 200 characters. Patterns by subject_type — agent: {runtime}::agent::{agent_name}::{workspace}::{repo}; subagent: {runtime}::subagent::{parent_agent_id}::{task_class}::{workspace}::{repo}::{session_id}; role_profile: codex::{role}::{workspace}::{repo}::{task_type}::{risk_lane}::{sandbox_mode}::{skill_set}; session: {runtime}::session::{workspace}::{task_type}::{playbook_or_config}; graph_node: langgraph::{graph_id}::{node_name}::{workspace}; human_runtime: {runtime}::human::{human_actor_id}::{workspace}::{task_type}; task: {runtime}::task::{workspace}::{task_class}::{work_item_id}. Unique per (workspace_id, runtime_provider, subject_key)." |
| 53 | + }, |
| 54 | + "workspace_id": { |
| 55 | + "type": "string", |
| 56 | + "format": "uuid", |
| 57 | + "description": "Workspace this subject belongs to. Trust is workspace-isolated: history accumulated in workspace A does not count toward workspace B, even for the same subject_key string." |
| 58 | + }, |
| 59 | + "repo": { |
| 60 | + "type": ["string", "null"], |
| 61 | + "description": "Repository scope for this subject. Required for agent and role_profile subject_types when the workspace contains multiple repos — trust must not bleed across repos. Null for subject_types where repo is not part of the key (session, graph_node, task)." |
| 62 | + }, |
| 63 | + "task_type": { |
| 64 | + "type": ["string", "null"], |
| 65 | + "description": "Task classification this subject is scoped to (e.g. frontend-bugfix, auth-change, database-migration). Part of the subject_key for role_profile, session, and human_runtime types. A subject trusted for one task_type starts PROVISIONAL for a new task_type — see cross-runtime trust rule 4 in DESIGN-02." |
| 66 | + }, |
| 67 | + "risk_lane": { |
| 68 | + "type": ["string", "null"], |
| 69 | + "description": "Risk lane this subject operates in (e.g. low-risk, medium-risk, high-risk, restricted). Part of the subject_key for role_profile so that the same role at different risk lanes has separate trust history." |
| 70 | + }, |
| 71 | + "sandbox_mode": { |
| 72 | + "type": ["string", "null"], |
| 73 | + "description": "Sandbox/permission mode the subject runs under (e.g. read-only, workspace-write, full-access). Part of the trust identity for role_profile — a workspace-write role and a read-only role are different subjects even with otherwise identical configuration." |
| 74 | + }, |
| 75 | + "skill_set": { |
| 76 | + "type": ["array", "null"], |
| 77 | + "items": { "type": "string" }, |
| 78 | + "description": "Skill bundle composition for this subject (e.g. ['frontend-skill'], ['awf-risk-plan']). Part of the subject_key for role_profile. Changes to skill_set composition are a material configuration change and trigger config_hash recomputation." |
| 79 | + }, |
| 80 | + "human_actor_id": { |
| 81 | + "type": ["string", "null"], |
| 82 | + "format": "uuid", |
| 83 | + "description": "Required and non-null when subject_type is 'human_runtime' — identifies the human driving the IDE-assisted session. Null for all other subject_types. Trust for human_runtime subjects tracks human+runtime productivity patterns and is used for analytics, not autonomy gating." |
| 84 | + }, |
| 85 | + "config_hash": { |
| 86 | + "type": ["string", "null"], |
| 87 | + "description": "Hash of the underlying configuration (agent instruction file, role TOML, Devin playbook content, skill_set composition) captured at subject creation. Recomputed by the adapter at each session start and compared. When it changes: trust_subject_id remains stable, confidence_band resets to LOW unless the change is verified cosmetic (whitespace, comments, formatting), and a new entry is logged in subject metadata." |
| 88 | + }, |
| 89 | + "subject_version": { |
| 90 | + "type": ["string", "null"], |
| 91 | + "description": "Human-readable version label for the subject configuration. Bumped for cosmetic changes that keep config_hash unchanged, and also recorded alongside config_hash changes for audit readability." |
| 92 | + }, |
| 93 | + "archived_at": { |
| 94 | + "type": ["string", "null"], |
| 95 | + "format": "date-time", |
| 96 | + "description": "ISO 8601 timestamp when this subject was retired. Subjects are never deleted — archiving preserves history and keeps existing failure records and capability profiles intact. Null while the subject is active." |
| 97 | + }, |
| 98 | + "created_at": { |
| 99 | + "type": "string", |
| 100 | + "format": "date-time", |
| 101 | + "description": "ISO 8601 timestamp when the subject row was created." |
| 102 | + } |
| 103 | + }, |
| 104 | + "additionalProperties": false, |
| 105 | + "$defs": { |
| 106 | + "trustLevel": { |
| 107 | + "type": "string", |
| 108 | + "enum": ["PROVISIONAL", "RESTRICTED", "STANDARD", "HIGH", "PROBATION"], |
| 109 | + "description": "Autonomy tier derived from total D1-D4 score across recent sessions, attached to the trust subject (not to a session). PROVISIONAL (<60): read-only analysis, every task needs human approval — new subjects always start here. RESTRICTED (60-74): draft plans and draft PRs only, human reviews before merge, 3+ sessions to exit. STANDARD (75-89): PR creation allowed after CI, no high-risk files without approval, 5+ sessions at STANDARD to reach HIGH. HIGH (90-100): low-risk task lane, human merge approval still required (Invariant 5 — never waived). PROBATION (any session <40): immediate demotion regardless of prior tier, 3 consecutive clean sessions required to exit. Lives on trust_capability_profiles, not on the trust_subject row itself — defined here for cross-schema reuse." |
| 110 | + }, |
| 111 | + "evidenceStrength": { |
| 112 | + "type": "string", |
| 113 | + "enum": ["E0", "E1", "E2", "E3"], |
| 114 | + "description": "Strength of evidence backing a trust assessment. E0: post-hoc / session-outcome only (Devin, Multica when AWF runs above it). E1: session-outcome plus surfaced telemetry. E2: per-decision evidence from runtime hooks. E3: full per-action evidence including pre-tool and post-tool hook coverage. Lives on trust_capability_profiles — defined here for cross-schema reuse." |
| 115 | + } |
| 116 | + } |
| 117 | +} |
0 commit comments