Summary

  • A 26 October individual draft proposes two typed digest references beside a release or agent-action statement: one for the decision record, one for the action-binding attachment.
  • Matching hashes can tie the approved specification to the attempted deployment. An approver’s signature can identify a signer; the signer’s claimed authority still needs an independent check.

The build system can answer a tidy question: which bytes did it make? A SCITT transparency service can register a signed statement about them. Its receipt can help another party verify inclusion. None of these artifacts names the person who decided this particular build should leave the building.

That gap is the subject of Laurent Lemonnier’s new proposal. It is an individual Internet-Draft, not a selected SCITT standard. The proposal adds references to two separate documents that travel with, or can be retrieved for, a release statement. A decision record carries the choice and its stated reasons. An action-binding attachment tracks the specification through proposal, review, approval, request, permission recheck, attempt and result. Each reference has a declared type and digest. The draft gives the decision record and attachment different digest rules; calling both “a hash” would erase a check the verifier needs.

The draft’s worked release is deliberately concrete. Its proposed specification names the build, the artifact digest, the bill of materials, a migration and a rollback. A release manager approves that specification; a deploy job later asks to act on it. If the artifact digest changes between approval and attempt, the attachment exposes the swap. The example is a test case, not a report of a real deployment.

A signature adds a human edge, but only the edge it actually signs. Where the approver signs the outcome stage, a verifier can map that key to a person under its own trust policy. The charter reference saying that person had authority is still the issuer’s statement until the verifier checks the permission system or another independent record. The attachment also reports what it says the reviewer was shown; it cannot open the reviewer’s eyes retroactively.

The draft makes a similar distinction for the log. A receipt over a witness checkpoint records inclusion at a tree size. It supplies no registration time and, in this version, no check that the decision log grew consistently. So the useful product is a set of separate answers: these bytes matched, this person signed, this authority was checked, this release was attempted. A single green “approved” badge would hide which of those questions nobody asked.