Check an AI disclosure

# Proposal: Check an AI disclosure

## Why
AI disclosures are usually a sentence in a footer that anyone can add or remove. A record is a signed statement, fixed in time, of which model the publisher says it used and who stood behind the file.

## What Changes
- Hash the exact file you received and look it up.
- Read the record's `model`, `creator` and `edited_by` fields and the publisher's key.
- Check the verdict, the publisher's verified identities, and the same-operator label.
- Export a bundle if you need to show the check to someone else.


## Capabilities
### New Capabilities
- `ai-disclosure-check`: Hash the file you were given and read the signed model and publisher fields on its asset page.

## Impact
- External service: AI Source of Truth at https://aisourceoftruth.com. Every call here is an anonymous read: no account, no token, and the registry logs no reader identity.
- Routes used: `GET /v1/model/assess?asset={sha256}`, `GET /r/{digest}?format=json`, `GET /v1/keys/{publisher}`, `POST /v1/export`.
- No PromptReports product is required.
- Source of this plan: https://aisourceoftruth.com/use-cases/check-ai-disclosure (CC0). Regenerate it with `curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/check-ai-disclosure/openspec?lang=http'`.

# Design: Check an AI disclosure

## Context
Compliance tools, journalists, editors and due-diligence agents reviewing a vendor or a deal. AI disclosures are usually a sentence in a footer that anyone can add or remove. A record is a signed statement, fixed in time, of which model the publisher says it used and who stood behind the file.

## Where it sits in your agent
Call it from the review step that reads an incoming file, before the agent writes its finding. Quote the signed fields; never paraphrase them into a stronger claim.

Over MCP, point the agent at `https://aisourceoftruth.com/mcp` (Streamable HTTP, JSON-RPC 2.0; read tools need no token). The tools this change uses: `lookup`, `resolve_record`, `get_keys`, `export_bundle`.

## Decisions
- Treat the registry as a source of facts about records, never about the world. Show what it says, with the digest, and do not turn a verdict into a quality score.
- If the registry cannot be reached, treat the answer as unknown (the same as `check`), never as `rely`, and retry later.
- Keep content private: send hashes. Never put personal data in a record; it is public and permanent.

## Calls
### GET /v1/model/assess?asset={sha256}
rely, check or do_not_rely for the newest record about a file, with the reasons.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess?asset={sha256}'
```

### GET /r/{digest}?format=json
one record: publisher, key, model, log position and verdict.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/r/{digest}?format=json'
```

### GET /v1/keys/{publisher}
the publisher's keys, with when each was active or revoked.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/keys/{publisher}'
```

### POST /v1/export
an offline bundle with proofs and timestamps for up to 100 records.

```sh
curl -s -X POST 'https://aisourceoftruth.com/v1/export' \
  -H 'Content-Type: application/json' \
  --data '{"digests":["{digest}"]}'
```

## What this does not prove
- A record shows what the publisher stated about the model. It cannot show that no other tool was used.
- No record is not proof of human authorship. It means nobody published a record.

# Tasks: Check an AI disclosure

## 1. Configure
- [ ] 1.1 Set `AISOT_ORIGIN=https://aisourceoftruth.com` in the agent's environment.
- [ ] 1.2 Optional: add the MCP server `https://aisourceoftruth.com/mcp` to the agent's MCP config.

## 2. Build
- [ ] 2.1 Hash the file: Hash the file exactly as you received it. People can drop it on /lookup, which hashes it in the browser and uploads nothing.
- [ ] 2.2 Get the verdict and record: Assess the hash, then read the record it names. (`GET /v1/model/assess?asset={sha256}`)
- [ ] 2.3 Read the disclosure fields: `model` is the publisher's statement of the model used. `edited_by` lists the people or desks who edited it. `same_operator: true` means the publisher and the registry share an operator, so weigh the record as first-party. (`GET /r/{digest}?format=json`)
- [ ] 2.4 Check the signer: Confirm the signing key was active when the record was signed, and look for verified identities such as a domain. (`GET /v1/keys/{publisher}`)
- [ ] 2.5 Keep the evidence: Export a bundle so a reviewer can check the same answer offline with verify.mjs. (`POST /v1/export`)

## 3. Verify against the live registry
- [ ] 3.1 Hash the file: The hash matches the asset digest on the record.
- [ ] 3.2 Get the verdict and record: The answer names a record and a verdict.
- [ ] 3.3 Read the disclosure fields: The report quotes the fields exactly as signed.
- [ ] 3.4 Check the signer: The key appears as active at the record's signing time.
- [ ] 3.5 Keep the evidence: `node verify.mjs bundle.json` passes on the exported bundle.

## 4. Done when
- [ ] 4.1 A disclosure finding cites a record digest instead of a screenshot.
- [ ] 4.2 Reviewers can rerun the check offline from the exported bundle.

# ai-disclosure-check Specification

## ADDED Requirements

### Requirement: Disclosure findings quote signed fields
The review tool SHALL report the record's `model`, `creator` and signing key exactly as signed, with the record digest.

#### Scenario: Record found
- **WHEN** a reviewed file has a record
- **THEN** the finding lists model, publisher, key and digest, and the same-operator label when set

#### Scenario: No record
- **WHEN** assess answers `not_found`
- **THEN** the finding says no record exists and makes no claim about authorship