board: B-155 — on-behalf-of delegation model for gateway.md

docs/evidence/backlog.md

@@ -40,6 +40,7 @@ row per line, appended, so two runs closing two rows do not land on the same lin
 | B-133 | **`governance.md`'s four-boundary table put per-tool authorisation at the moment of invocation, and never named the stronger control one layer earlier.** Schema gating was §3's rule and argued as assembly hygiene rather than as safety; nothing said a tool absent from the schema cannot be argued for or probed, that sub-agent isolation needs `message_history = None` beside the filtering, or that an approval system without persistence converts itself into no approval system. | 2026-08-31 harness-engineering harvest, queue position 8 (ARCH) | 2 | 0 | 1 | **2.0** | **closed 2026-08-31, shipped in v0.22.0** — *The cheapest control is absence*, with both isolation mechanisms, the 40%-to-under-5% context figures, and the rule underneath them (**eager for what you own and always need, lazy for what is foreign and might not be used**). Approval fatigue filed as a safety failure that leaves clean logs. |
 | B-134 | **§7 named four things to instrument and no format to carry them, and the obvious standard omits two of the four.** `grep -ri opentelemetry` over the pack returned one table cell in `agent-interop/references/mcp.md`. Meanwhile `gen_ai.evaluation.result` has no attribute for who produced a score — the field §7 requires by name — and the conventions carry no cost attribute at all while splitting usage across eleven token fields. | 2026-08-31 harness-engineering harvest, observability bundle (10 findings, one source) | 2 | 0 | 2 | **1.0** | **closed 2026-09-01, shipped in v0.23.0** — `references/otel-genai.md`: the span-name formulas and closed 17-value operation enum, the two Required attributes that make conformance a weak floor, the missing scorer field with OpenInference's `annotation.annotator_kind` as the extension to carry, the three content tiers and the upload hook that runs independently of opt-in **and** of the sampling decision, the eleven token attributes with the both-directions cost error, the disjoint OpenInference/OpenLLMetry vocabularies under one trace id, and the three senses of *replay*. Status recorded honestly: the spec moved repositories, its Schema URL reads `TODO`, and every `gen_ai.*` attribute is Development. |
 | B-135 | **The family audit asked for a debulk of two bodies at capacity, and the debulk was declined rather than done blind.** Wave AUDIT-WAVE-0906 flagged `agent-orchestrator/SKILL.md` and `agent-evals/SKILL.md` as near the working limit — re-measured at this commit by `audit_skill.py --house`: **4655/4750** (98.0%) and **4631/4750** (97.5%), both `0 GAP`. The family precedent (B-141 class) is that manufacturing headroom with no pending edit is negative-value work: room bought today is spent by nobody, and a trim chosen without the edit it serves cuts on the wrong line. B-129 already records the durable half — this body is at capacity and the remedy is a split, a routing decision. Debulk belongs to the release that next edits these bodies, priced into that release rather than shipped as its own. | family audit 2026-09-06, wave AUDIT-WAVE-0906 | 1 | 0 | 2 | **0.5** | **open.** Deliberately not scheduled: the trigger is the next edit to either body, and whichever release brings that edit pays the displacement (or executes B-129's split) as part of its own work. |
+| B-155 | **`agent-interop/references/gateway.md` names per-caller authorisation and per-hop policy (`:49`, `:108`) but no on-behalf-of model.** Nothing says how authority travels down a chain of agents. Fabric's delegation model (ADR-0144, CO-258) asks the doctrine to describe it: one issuer mints a short delegation JWT carrying an RFC 8693 `act` chain, one audience, capabilities, an effect ceiling and a grant; the callee verifies it offline against published JWKS; calls go direct, with no proxy in the path; `approval/1` and the common refusal codes apply. Doctrine only, no product change. Write it once the plan lands on Fabric main, citing that commit instead of the branch. | peer request fabric-workspace-91, 2026-10-11; plan `passioncode-ai/fabric@32046d14:docs/evidence/plans/2026-10-11-delegation-model/README.md` (branch agent/release-040-wave1) | 3 | 0 | 2 | **1.5** | open — waits for the Fabric plan on main |
 
 ## Open, and why