Agent-native delivery v2: execution provenance, bounded autonomy, and runtime feedback #163

Context

LiteShip already has the correct operational bones:

• an internal SHA-256-addressed ChangeIntent with sponsor, hypothesis, affected surface, guardrails, reversibility, actor class, uncertainty, source SHA, and GitHub repository identity;
• an affected plan derived from the package/check graph;
• independently verified delivery-evidence and release receipts;
• CurePackets, ShipCapsules, SBOM/VEX, and generated agent context.

This issue is the remaining agent-native layer identified after comparing that implementation with the CI/CD research synthesis. It extends the existing owners; it does not create a parallel DevOps product.

Goal

Upgrade the existing internal change/delivery record so an independently verifying party can answer:

• which agent execution produced a change;
• which human sponsored it;
• which model, tools, scopes, budgets, and context governed the run;
• which actions were taken;
• which autonomy level permitted each action;
• which approvals remained human-owned;
• how production outcomes feed new executable scars back into the same evidence graph.

Required design

1. Extend the existing ChangeIntent/delivery-evidence schema through its current owner rather than adding a package or registry.
2. Record agent execution provenance, at minimum:
   • stable execution identity;
   • sponsoring human/GitHub identity;
   • model/provider identity;
   • granted tool scopes and write/network/release authority;
   • bounded compute/time/token budgets where available;
   • prompt/context/tool-policy digests without persisting secrets or raw private context;
   • an addressed action/result trace.
3. Define explicit autonomy levels separating propose, edit, execute, approve policy, and release.
4. Preserve separation of duties: an agent or workflow cannot self-approve high-risk policy, standards, identity, trust-boundary, or release changes.
5. Derive required authority from change intent plus the existing package/check/runtime graph; filenames alone are insufficient.
6. Bind the resulting evidence bundle to the exact source SHA and declare missing/unavailable provenance explicitly.
7. Feed admitted incidents, regressions, and runtime outcomes into CurePackets, permanent cheap scars, benchmarks, and docs/check projections through existing owners.

Negative controls

The admission layer must fail closed for:

• missing sponsor or execution identity;
• forged or mutated action/evidence bytes;
• stale or foreign source SHA;
• self-approval of a protected change;
• tool use outside the declared scope;
• omitted mandatory check/evidence edge;
• an evidence bundle that cannot be reconstructed independently;
• secrets or raw private prompts leaking into the durable record.

Non-goals

• Not a merge blocker for PR Pre-1.0 LiteShip surface reset and A+ assurance foundation #161.
• No 26th package.
• No public Change Passport or new DevOps ontology.
• No replacement CI pipeline or vendor platform.
• No model-authored verdict authority; deterministic controls and human ownership retain the gavel.
• No committed per-PR prose form.

Acceptance

• One versioned extension of the existing internal schemas and owners.
• Property/negative tests cover every refusal above.
• The packed/standalone verifier reconstructs the verdict without trusting the producer.
• CLI/MCP/operator projections expose bounded status without leaking private context.
• Runtime/incident feedback can create an addressed reproducer and promote it into the cheap replay lane.