parameter_overrides has no layer attribution, and metadata.evaluator cannot supply it

[rocklambros]

modifications.json says this about itself:

The provenance of values introduced by 'parameter_overrides' is not defined in v0.1.

So this is a request to close a known deferral rather than a defect report, and an argument for closing it in v0.2 rather than letting it drift.

parameter_overrides replaces tool call arguments. A replaced argument is a value the Guardian introduced into an execution path, and nothing on the wire records where it came from.

The obvious answer, that metadata.evaluator already says which layer decided, does not hold. evaluator is an enum of deterministic, agent, composite, and it sits on the decision rather than on the modification. A decision carries one evaluator value and may carry many overrides, so the attribution is one-to-many at best. And composite exists precisely for the case where both layers contributed, which makes decision-level attribution insufficient by construction rather than by omission. When evaluator is composite, the schema is saying some of this decision came from the model and some did not, and offering no way to tell which part is which.

Why it matters. The two-layer Guardian architecture depends on the deterministic layer being authoritative and the agent layer being constrained. That constraint is enforceable only if a consumer can tell the two apart. A rewritten tool argument that originated in the agent layer is a model-authored value entering an execution path, and a runtime cannot implement "reject agent-layer overrides on high-risk capabilities" because it cannot tell which layer produced the override.

The specification takes this seriously everywhere else. post-compact.json requires derived_from on a summary and states that no amount of LLM processing launders untrusted-classified data into trusted-classified data. skill-load.json carries a digest rather than a digest_verified boolean so the Guardian can verify the binding itself instead of trusting the framework. Both arguments transfer to an overridden argument without modification.

Shape, attached to the override rather than the decision: each entry in parameter_overrides carries the authoring layer, drawn from the same deterministic / agent / composite vocabulary metadata.evaluator already uses, so the enum is reused rather than invented. Optional in the base schema, consistent with how provenance is handled, and a candidate for the acs-provenance strict variants where it would become required.

Open question worth settling first. Discussion #115 argues the chain should commit the full decision record, including the disposition, the rules that fired, and the inputs relied on. If that lands, layer attribution is a field in that record rather than a field in modifications. Worth deciding which of the two carries it before either is built.

Alternative considered and rejected: leaving it deployment-defined, which is the v0.1 position. Defensible for v0.1 and getting harder to hold now that the reference Guardian is being built and adapters are landing. Each implementation that ships without this makes one up. The HKDF situation in #118 is the same shape one step further along: an underspecified detail becomes a de facto profile set by whoever implements first.