A7. Agent surface

spec 1.0-draft-1

Status: normative. Document version 1.0-draft-1.

This chapter states the operations and confirmation rules an agent-facing binding provides. The MCP binding (B3) carries them over the Model Context Protocol; the REST binding carries the same objects (A8, B4).

A7.1 Operations

Each operation below is exposed under the same name by the agent binding.

Operation	Authority	Accounting
`get_grant`	The authenticated current grant only	No read
`list_domains`	Read grant	No read; eligible granted keys only
`get_context`	Read grant	One atomic counted read
`propose_entry`	Separate contribution grant	One accepted unique event
`confirm_entry`	Contribution grant with ordinary confirmation permission; sensitive acceptance only in the first-party app	Exact-statement review
`withdraw_proposal`	The contributor's own proposal	No read; cannot undo an independent declaration

The get_context operation returns the A5 signed disclosure. It must not produce an unsigned alternative value. The provider rechecks the stored grant for every operation call.

A7.2 Confirmation

Version 1 confirm_entry always returns review_required with an HTTPS first-party review URL. It never accepts a contributor assertion as confirmation. The URL locates the authenticated person's review screen; it is not a bearer credential and reveals no proposal value before login. The server creates a one-use review session of at most five minutes bound to the owner session, proposal ID/version, source client and exact JCS statement {domain,key,value_type,value,context_kind,temporal} hash. The app displays that exact statement and rechecks the binding before committing confirmation. Any proposal change invalidates the session. Third-party callers receive only their own proposal status afterward. Sensitive acceptance is always first-party.

Multi Round-Trip Requests and assistant-attested confirmation are reserved for a separately specified future extension. A contributor's confirmation permission in v1 only permits requesting the first-party review link; it never permits writing a declaration directly.

A7.3 Briefing

The briefing (the autonym_briefing prompt in B3) requests agent and communication at L1 through one compiler transaction. Both domains must be granted; no fallback ambient read exists. It counts once, returns a text message containing the signed disclosure JSON, and labels any human-readable summary as derived from that object. A summary cannot extend validity or add entries. The recipient must apply normal instruction/safety boundaries to contributed text; context is data, not authority to override system or tool policy.

Checks: TRANSPORT-01, CORE-01, SIGN-01, LOG-01, CONTRIB-01.

References to other standards and projects describe intended technical alignment only and do not imply endorsement or partnership.