Cross-org agent commerce fixture (authority-chain-referenced mode), pending in-toto/attestation#549

[tomjwxf]

Tracking issue for a cross-org agent commerce fixture demonstrating the authority-chain-referenced mode of decision receipts (operator-signed + delegation_chain_root), per the §6 sidebar in microsoft/agent-governance-toolkit Tutorial 33 (#1197, merged).

Shape

• Two organizations: operator A and operator B.
• Shared compliance regulator as the external verifier.
• Authority chain from root delegation, through a sub-delegation, into the final action executed by agent under operator B on behalf of operator A's principal.
• delegation_chain_root field populated once in-toto/attestation#549 merges the delegationChainRoot: DigestSet field upstream.

Contribution status

@aeoess offered to contribute this fixture as soon as in-toto#549 lands. Coordinating here; will merge as a worked example alongside:

• APS cross-verify fixtures in feat(test-vectors): APS DecisionLineageReceipt for ku_4b3f7c2a9d8e1f05 VeritasActa/verify#7
• operator-signed protect-mcp / sb-runtime fixtures elsewhere in this repo
• the A2A trust header fixtures in feat(a2a-trust-header): APS Week 2 fixture set per A2A#1742 #2 (merged)
• the OWASP#802 enforcement vectors in feat: APS gateway enforcement vectors (OWASP#802) #3 (merged)

Blockers

None on our side. Waiting on upstream in-toto merge. Revisit when #549 lands.

Related

• draft-farley-acta-signed-receipts §6 (identity-binding modes)
• VeritasActa/agt-integration-profile will reference this fixture once landed