feat: add reviewer identity and separation of duties

[safal207]

What changed

Adds Reviewer Identity & Separation of Duties v0.1 on top of Trusted Workflow Governance from #215.

Sigstore provenance ACCEPT
        ↓
workflow governance ACCEPT
        ↓
server-controlled reviewer identities + exact approval bundle
        ↓
author / organization / control / payment separation
        ↓
ACCEPT / HOLD / BLOCK / CHALLENGE
        ↓
reviewer-gated Control Cloud receipt

Why

A reviewer count alone does not establish independence. Two approvals may belong to the author, the same organization, a shared controlling entity, or the same payout account.

The high-assurance path now requires all four server-side conditions:

provenance_cryptographically_verified_by_api: true
governance_trust_verified_by_api: true
reviewer_identity_verified_by_api: true
separation_of_duties_verified_by_api: true

Identity registry

Each strict reviewer record pins stable reviewer and GitHub identities, identity provider/subject, organization, control and payment clusters, roles, active window, evidence digest, independence attestation, and authority_granted: false. Suspensions are separate records rather than silent identity edits.

Approval bundle

Every approval binds the exact governance decision root, signer workflow and SHA, reviewer identity subject, statement and identity-evidence digests, timestamp, decision, and conflict declaration.

Decision model

• ACCEPT: identity, role, evidence, freshness, quorum, and every separation gate pass.
• HOLD: potentially recoverable evidence is missing.
• BLOCK: self-approval, author affiliation, shared control/payment cluster, suspension, evidence mismatch, or REJECT vote.
• CHALLENGE: identity evidence is ambiguous.

Fail-closed reason codes include author_self_approval, author_organization_conflict, author_control_cluster_conflict, author_payment_cluster_conflict, reviewer_control_cluster_collision, reviewer_payment_cluster_collision, reviewer_identity_suspended, identity_evidence_mismatch, and reviewer_rejected.

Reviewer-gated ingestion

control-cloud/ingestion/separated_ingest.py derives the reviewer decision path solely from the exact governance-decision root. Before delegating to governed append it rejects missing, symlinked, escaped, stale, non-ACCEPT, or mismatched decisions. The client cannot submit a trusted boolean or choose the decision path.

Identity-change response

The read-only checker returns PROPOSE_SUSPEND when observed identity, organization, control cluster, payment cluster, or evidence digest differs from the pinned record. It performs no GitHub, credential, registry, payment, deployment, or authority mutation.

Validation

The SHA-pinned workflow runs 31 focused tests and strict schema checks, proves a two-organization/two-control-cluster/two-payment-cluster ACCEPT, checks reviewer gate ordering, blocks self-approval/control collision/suspension, emits read-only PROPOSE_SUSPEND, and keyless-attests the exact reviewer decision and separated receipt.

Reference identities are synthetic and do not establish real-world independence.

Honest boundary

payments_executed: false
insurance_provided: false
deployment_performed: false
authority_granted: false
repository_write_performed: false
credential_revocation_performed: false

This layer does not perform KYC, KYB, sanctions screening, beneficial-owner, employer, or payment-account ownership verification. Production requires authenticated identity issuance, evidence refresh, immutable administration, incident response, and independent security review.

Stacked PR

Base: agent/proofpath-trusted-workflow-governance-v0.1 / #215

Final diff: exactly 12 product files. Bootstrap payloads and temporary workflows are absent.

No merge is performed by this PR.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 93da59ce-d895-477e-a1e1-7edf6d0188a5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final source head: 4e7a206bc8ea4e486318c77ab13f089017f4ab80

Pull-request workflow subject: a0e8952a30746fdb83e643843eaadce693e6c2ff

ProofPath Reviewer Separation run #2

Run 30722614170 passed on GitHub-hosted runners.

• 31 focused reviewer-identity, separation-of-duties, ingestion-binding, mutation, and security tests passed.
• All four strict JSON schemas and the reference identity registry parsed successfully.
• Two synthetic reviewers from two organizations, two control clusters, and two payment clusters produced ACCEPT.
• Reviewer identities, roles, evidence digests, active windows, approval freshness, governance binding, author separation, organization diversity, control-cluster separation, and payment-cluster separation were checked.
• The reviewer gate was proven to execute before delegated append.
• Author self-approval returned BLOCK / author_self_approval.
• A shared reviewer control cluster returned BLOCK / reviewer_control_cluster_collision.
• An effective reviewer suspension returned BLOCK / reviewer_identity_suspended.
• A changed reviewer organization returned read-only PROPOSE_SUSPEND with repository_write_performed: false.
• The exact reviewer decision and exact separated receipt were keyless-attested.
• No authentication headers, tenant registry, secrets, payment credentials, or identity-source credentials were uploaded.

Positive verified state

decision: ACCEPT
reviewer_identity_verified: true
separation_of_duties_verified: true
author_separation_verified: true
organization_separation_verified: true
control_cluster_separation_verified: true
payment_cluster_separation_verified: true
verified_reviewer_count: 2
verified_organization_count: 2

Verified roots:

reviewer separation decision root:
sha256:1c5d73235855bbf3e09f8f6ba490d5bf2d652817648fb2e2578a95aa9e325cd4

separated receipt root:
sha256:dc7d6ffd2a3af1c0ba0a68b87fe3e66d7b7ab6c4f4512a6afdbb2a3158f1b208

identity registry digest:
sha256:10faa37541d0cfa945a4f864eed114472b5a34d24606dd47330abbf3b8ae9d68

approval bundle digest:
sha256:1f7419f124ba17b054e651ec52b1aec516a1d323c7c979554b4786045b635097

The separated receipt requires all four server-side assurances:

provenance_cryptographically_verified_by_api: true
governance_trust_verified_by_api: true
reviewer_identity_verified_by_api: true
separation_of_duties_verified_by_api: true

Negative evidence

author self-approval:
BLOCK / author_self_approval
root: sha256:68850a2431dc1453f8cc423e42771224c871991521bb6707008deae52338c3f5

reviewer control-cluster collision:
BLOCK / reviewer_control_cluster_collision
root: sha256:5850ee3c7da648ea337eb7dac14e8941d12dbb02844a0ef4ba22c0550c735958

suspended reviewer:
BLOCK / reviewer_identity_suspended
root: sha256:036a487081c0c0bacabcb051d691f5fb6ae2f0acdd72f5aad5abe9a7f44ff3ee

identity change response:
PROPOSE_SUSPEND
repository_write_performed: false

Attested subjects

reviewer-decision.json
sha256:92e7346b8a836fd5a7458eb55713b45cd94e63e25a11ae344f0d91ebd1fd719e
GitHub attestation: 38364211
Rekor log index: 2315337451

separated-receipt.json
sha256:d3acf2076c2257601972c97a3da59d1d55a0a519421ced473c1af38c20bed44f
GitHub attestation: 38364213
Rekor log index: 2315337760

Evidence artifact:

name: proofpath-reviewer-separation-30722614170
artifact ID: 8825333733
SHA-256: f6bf6eb193905182afb2109f902c56c9366df5c4932ca27368defbf6ad5626ad
size: 6876 bytes
expires: 2026-08-15T23:05:10Z

Existing stack regressions

All applicable workflows passed on the same final source head:

• ProofPath Control Cloud Ingestion run Community experiment L1: Run local gateway demo #15 (30722614177).
• ProofPath Control Cloud run Community experiment L3: Try to break the model boundary #17 (30722614178).
• ProofPath Deploy Guard run Add Compute Witness Rust integration spike #66 (30722614187).
• Rust run #355 (30722614176).

Trusted Workflow Governance from #215 was already validated and was unchanged by this PR, so its path-filtered workflow did not need to rerun.

Honest boundary

payments_executed: false
insurance_provided: false
deployment_performed: false
authority_granted: false
repository_write_performed: false
credential_revocation_performed: false

The conformance identities and organizations are synthetic. This proves deterministic enforcement of identity bindings and separation rules; it does not establish real-world reviewer independence, KYC/KYB, beneficial ownership, employment, sanctions status, or payment-account ownership.

The conformance workflow validates the separated receipt and proves reviewer-gate-before-append delegation. It does not claim that this new reference layer performed a production persistent write or granted operational authority.