# openspec/changes/wf-trust-packet/proposal.md

## Why

Security reviews ask for proof that people control what AI agents do. Teams answer with screenshots and a policy PDF, and the reviewer has to take their word for it. The review is often the slowest step in a larger deal. Evidence a reviewer can verify on their own shortens it and stands up later in an audit.

## What Changes

- Add the `trust-packet` workflow to the PromptReports workflow library, run by the workflow runner as an agent acting for a person.
- PromptCompute: Export approvals, signed (today: Planned).
- RepoOps: Export incidents, causes, recoveries and lessons, signed (today: Planned).
- CommitOps: Export promises made and kept, signed (today: Planned).
- AI Source of Truth: Check every item against the public record (today: Built).
- PromptCompute: A person approves sharing it outside the company (today: Built).
- PromptReports: Publish a verify page for the whole packet (today: Planned).
- Gate `file.share.external`, `data.export.bulk` through PromptCompute approvals; each gated step runs only after `verifyResume` passes, with `final_args`.
- Write a signed record at the end of each run and count one workflow request.

## Impact

- Products: PromptCompute, RepoOps, CommitOps, AI Source of Truth, PromptReports.
- Outside the family: None beyond the family.
- State: Partly built. The AI Source of Truth packet check and the trust center are live. Three signed sections are still to build.
- Plan row: LDG-2272.

# openspec/changes/wf-trust-packet/tasks.md

## 1. Connect and authorize

- [ ] 1.1 Confirm the org has a connection for each of: PromptCompute, RepoOps, CommitOps, AI Source of Truth, PromptReports. Stop and tell the user which is missing.
- [ ] 1.2 Get a PromptReports ID agent token for each product the run calls (RFC 8693 exchange). Where a product does not accept ID tokens yet, use its connect key.
- [ ] 1.3 Register policy for `file.share.external`, `data.export.bulk` with `require_approval` as the default.

## 2. Build the steps

- [ ] 2.1 PromptCompute: Export approvals, signed. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.2 RepoOps: Export incidents, causes, recoveries and lessons, signed. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.3 CommitOps: Export promises made and kept, signed. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.
- [ ] 2.4 AI Source of Truth: Check every item against the public record.
- [ ] 2.5 PromptCompute: A person approves sharing it outside the company.
- [ ] 2.6 PromptReports: Publish a verify page for the whole packet. Blocked: this part is Planned; until it ships, record the step's evidence as `missing` and continue.

## 3. Verify and record

- [ ] 3.1 Run a dry run with the user's inputs: Buyer = Contoso Health; Period = Last 90 days; Sections = Approvals, incidents, promises, corrections.
- [ ] 3.2 Run it once for real; approve each gate as the user.
- [ ] 3.3 Measure the outcomes: Days from questionnaire to signed-off review; Items in the packet a reviewer can verify: target 100%; Follow-up questions per review.
- [ ] 3.4 Confirm the run left a signed record with a task id and one workflow request counted.

# openspec/changes/wf-trust-packet/specs/workflow-trust-packet/spec.md

## ADDED Requirements

### Requirement: Each item is checkable

Every item in the packet SHALL carry a signature and a link a reviewer can check without a PromptReports account.

#### Scenario: Each item is checkable

- **WHEN** a reviewer changes one item in the export
- **THEN** the verify page shows that item as failed and names it

### Requirement: The packet leaves only with approval

The share step SHALL run only after a person approves file.share.external for the named buyer.

#### Scenario: The packet leaves only with approval

- **WHEN** the buyer name on the approval differs from the run's input
- **THEN** the step refuses with args_mismatch

### Requirement: Evidence stays honest

Each step SHALL report what it saw as measured, inferred or missing, and SHALL never report missing as measured.

#### Scenario: A product part is not built

- **WHEN** a step depends on a part that is Planned or Proposed
- **THEN** the step records `missing`, names the part, and the approval card shows the gap

### Requirement: One run is one workflow request

The runner SHALL count one workflow request when the first step starts, and SHALL NOT count retries, resumes or dry runs.

#### Scenario: A gated step resumes after two days

- **WHEN** a person approves a step and the run resumes
- **THEN** the org's usage does not change