fledge delegation-manifest validate: enforce scope ceilings on agent-to-agent delegation

[0xLeif]

Origin: book club review of the CorvidLabs books. A keypair proves an agent identity, not that a human authorized the task it carries. When an orchestrator delegates to a sub-agent, nothing today checks that the delegated scope was actually sanctioned, or that it does not exceed the parent agent authority. (Books: Building Agents ch12 "When agents talk to agents" / "Validating what the caller claims".)

Proposal

Add fledge delegation-manifest validate: read a signed JSON delegation manifest and fail fast if it is malformed or over-scoped.

Manifest fields

• issuing agent ID
• delegated agent ID
• permitted task types
• scope ceiling
• expiry
• human-authorization reference (traces to the human who sanctioned the delegation)

Checks

• All fields present and signature valid.
• Delegated scope does not exceed the issuer declared ceiling.
• Not expired.
• Authorization reference resolves to a real human sanction.

Acceptance criteria

• Validates a manifest at the moment a delegated message is acted on.
• Rejects over-scoped or unauthorized delegations before execution.
• --json output; usable inside the agent loop.

Filed from the book club review; tracked for later work.

[0xLeif]

Update from the author interview: the load-bearing rule is scope only ever narrows. A sub-agent can never be granted more than the agent that spawned it; the parent ceiling is a hard cap, enforced at the moment the work is invoked, not after the fact. Authority flows downhill and loses height at every hand-off, never gains it (capability-minus-privilege applied to the chain). The signed manifest proves a human sanctioned the chain; the capped scope bounds the damage any bad link can do to whatever the link above it already had.