Cite a source and recheck it later

# Proposal: Cite a source and recheck it later

## Why
Within a few years most answers an agent gives will rest on sources it fetched. A URL is a weak citation: the page behind it can change, move or be corrected, and the agent has no way to tell. A record digest pins the exact text and its signer, and the registry tracks every correction and seal on it from then on.

## What Changes
- When the agent fetches a source, it hashes the bytes it read and asks the registry for the newest record about that file.
- It stores the record digest next to the quote, the same way it stores the URL.
- Before it reuses the quote, or when a user asks, it calls assess on the digest and acts on the verdict: rely, check or do_not_rely.
- A source with no record is not wrong. It is unattested, and the agent says so.
- Add CommitOps: When a cited claim backs a customer promise, link the record to that promise in CommitOps so a later correction reaches the promise.

## Capabilities
### New Capabilities
- `source-citations`: Save a digest with every quote. One assess call before reuse says rely or do not rely, and why.

## Impact
- External service: AI Source of Truth at https://aisourceoftruth.com. Every call here is an anonymous read: no account, no token, and the registry logs no reader identity.
- Routes used: `GET /v1/model/assess?asset={sha256}`, `GET /v1/model/assess/{digest}`, `GET /v1/model/changes?entity=record:{digest}&cursor={cursor}`.
- PromptReports products: CommitOps (optional; the change works without them).
- Source of this plan: https://aisourceoftruth.com/use-cases/cite-sources (CC0). Regenerate it with `curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/cite-sources/openspec?lang=http&with=commitops'`.

# Design: Cite a source and recheck it later

## Context
Research agents, answer engines and assistants that quote web pages, reports or datasets. Within a few years most answers an agent gives will rest on sources it fetched. A URL is a weak citation: the page behind it can change, move or be corrected, and the agent has no way to tell. A record digest pins the exact text and its signer, and the registry tracks every correction and seal on it from then on.

## Where it sits in your agent
Put the hash and lookup in the tool that fetches sources, and the recheck in the step that assembles the final answer. Cache a `rely` verdict for the life of one answer, not longer.

Over MCP, point the agent at `https://aisourceoftruth.com/mcp` (Streamable HTTP, JSON-RPC 2.0; read tools need no token). The tools this change uses: `lookup`, `assess`, `get_model_changes`.

## Decisions
- Treat the registry as a source of facts about records, never about the world. Show what it says, with the digest, and do not turn a verdict into a quality score.
- If the registry cannot be reached, treat the answer as unknown (the same as `check`), never as `rely`, and retry later.
- Keep content private: send hashes. Never put personal data in a record; it is public and permanent.

## Calls
### GET /v1/model/assess?asset={sha256}
rely, check or do_not_rely for the newest record about a file, with the reasons.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess?asset={sha256}'
```

### GET /v1/model/assess/{digest}
rely, check or do_not_rely for one record, with the reasons.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/assess/{digest}'
```

### GET /v1/model/changes?entity=record:{digest}&cursor={cursor}
every state change for one record since the last cursor you read.

```sh
curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/model/changes?entity=record:{digest}&cursor={cursor}'
```

## With the PromptReports products
- **CommitOps** (https://aisourceoftruth.com/p/commitops) keeps the ledger of what a company promised its customers, and can tie a promise to the record that shows it shipped. In this change: When a cited claim backs a customer promise, link the record to that promise in CommitOps so a later correction reaches the promise.

## What this does not prove
- A record shows who signed a file and when. It does not show that the file is true.
- `rely` means no correction, seal or revoked key is on record as of the checkpoint named. It is not a quality score.

# Tasks: Cite a source and recheck it later

## 1. Configure
- [ ] 1.1 Set `AISOT_ORIGIN=https://aisourceoftruth.com` in the agent's environment.
- [ ] 1.2 Optional: add the MCP server `https://aisourceoftruth.com/mcp` to the agent's MCP config.

## 2. Build
- [ ] 2.1 Hash what you read: Take SHA-256 over the exact bytes the agent fetched and used, before any cleanup or summarizing. Store it as lowercase hex.
- [ ] 2.2 Find the record: Ask assess for the newest record about that hash. A 404 or `not_found` means no publisher has attested this file: keep the URL citation and mark it unattested. (`GET /v1/model/assess?asset={sha256}`)
- [ ] 2.3 Store the digest with the quote: Save `record` (the record digest) and the checkpoint `as_of.tree_size` with the citation. That pair is enough to recheck the source at any later time.
- [ ] 2.4 Recheck before reuse: Before quoting again, call assess on the stored digest. `rely`: use it. `check`: read the reasons (an erratum, an upstream correction, a key revoked since) and tell the user. `do_not_rely`: drop it or say why it is unsafe. (`GET /v1/model/assess/{digest}`)
- [ ] 2.5 Watch long-lived citations: For citations you keep, such as a knowledge base, poll the change feed per record and recheck when anything changes. (`GET /v1/model/changes?entity=record:{digest}&cursor={cursor}`)

## 3. PromptReports products
- [ ] 3.1 CommitOps: When a cited claim backs a customer promise, link the record to that promise in CommitOps so a later correction reaches the promise.

## 4. Verify against the live registry
- [ ] 4.1 Hash what you read: The same file always gives the same 64 hex characters.
- [ ] 4.2 Find the record: A known asset returns `verdict` and `record`; an unknown one returns `not_found`.
- [ ] 4.3 Store the digest with the quote: Every stored citation that had a record carries its digest.
- [ ] 4.4 Recheck before reuse: A sealed or corrected test record changes the agent's answer.
- [ ] 4.5 Watch long-lived citations: A new erratum on a watched record shows up in the next poll.

## 5. Done when
- [ ] 5.1 Every citation that has a record carries a digest a reader can open.
- [ ] 5.2 A correction or seal on a source changes the agent's next answer, with the reason.
- [ ] 5.3 The agent can say which of its sources are attested and which are not.

# source-citations Specification

## ADDED Requirements

### Requirement: Citations carry a record digest
The agent SHALL store the record digest and checkpoint size with every citation whose source has a record on AI Source of Truth.

#### Scenario: Attested source
- **WHEN** the agent cites a file whose hash has a record
- **THEN** the stored citation includes the record digest and `as_of.tree_size`

#### Scenario: Unattested source
- **WHEN** assess answers `not_found`
- **THEN** the citation keeps the URL and is marked unattested

### Requirement: Recheck before reuse
The agent SHALL call assess on a stored digest before reusing its citation, and SHALL NOT present a `do_not_rely` source as reliable.

#### Scenario: Corrected source
- **WHEN** assess answers `check` with an `erratum` reason
- **THEN** the agent tells the user the source was corrected and links the record

#### Scenario: Sealed source
- **WHEN** assess answers `do_not_rely` with `sealed`
- **THEN** the agent drops the quote and says why