Problem
#8136's threat table left one threat covered by neither reproducibility nor attestation: T3 — the recorded human-override history itself being dishonest. Attestation proves computation ("this exact code ran over data with this checksum"), not data provenance ("the recorded overrides are what the humans actually decided"). Closing T3 needs provenance at event-capture time: receipts verifiable by the humans whose overrides they record (e.g. capture-time signing, countersignature, or anchoring — the design space is open). #8136 explicitly deferred this: "only worth filing if hosted customers actually demand it." This issue is the tracked home for that deferral so the gap is legible on the roadmap rather than rediscovered.
Requirements
⚠️ Demand-triggered — do not start this work on a schedule. The trigger is the first hosted tenant (or an equivalent trust requirement from the network) asking for provenance guarantees beyond attested execution. Until then this issue holds the problem statement only.
Deliverables
Links & Resources
Boundaries
Research/design only; no implementation under this issue. Closing the parent epic does not require this issue if the trigger never fires — it can be closed not-planned with a dated rationale instead.
maintainer-only — trust-architecture research.
Problem
#8136's threat table left one threat covered by neither reproducibility nor attestation: T3 — the recorded human-override history itself being dishonest. Attestation proves computation ("this exact code ran over data with this checksum"), not data provenance ("the recorded overrides are what the humans actually decided"). Closing T3 needs provenance at event-capture time: receipts verifiable by the humans whose overrides they record (e.g. capture-time signing, countersignature, or anchoring — the design space is open). #8136 explicitly deferred this: "only worth filing if hosted customers actually demand it." This issue is the tracked home for that deferral so the gap is legible on the roadmap rather than rediscovered.
Requirements
Deliverables
Links & Resources
packages/loopover-engine/src/calibration/signal-tracking.ts(HumanOverrideEvent— the record needing provenance)Boundaries
Research/design only; no implementation under this issue. Closing the parent epic does not require this issue if the trigger never fires — it can be closed not-planned with a dated rationale instead.
maintainer-only — trust-architecture research.