v5.36.0 — attestation: the ledger records which model and which harness acted

Attestation: the ledger records which model and which harness acted

Every guard call from a hook-cooperating harness now declares attested_model, harness and harness_version. The same act is a different risk from a different model, and it is only governable at all on a harness carrying the hook — until now the ledger recorded who and what, never by what.

• The Claude Code pretool hook reads the model from the last assistant entry of the harness's own session transcript (it exists on neither hook stdin nor in the environment), reading only the file's tail per call. Codex and Hermes declare the harness (from the --agent-id their installers write) and no model; an unrecognised caller says unknown rather than guessing.
• The fields ride the persisted decision context — no schema change — and are lifted onto every reader of a guard decision: GET /api/guard, GET /api/guard/decisions, and the FK-linked guard_decision on GET /api/actions/:id. The /decisions detail shows them as a header chip.
• Client-declared attribution, never proof. The transcript is a file the harness owns, so a hostile client can state anything. Same posture as enforcement_mode: no policy grants on these fields, and DashClaw never claims to verify which model acted.

Fixed

• The first cut of the chip (819ad6c, same day) was dead on arrival — it read a field from routes that strip it, and the decision the page actually renders had no lift. Caught by reading production rows after the deploy; fixed on all three reader paths and checked rendered on a real decision before this release.
• The hook's attestation cache was removed: the hook is a fresh process per tool call, so the cache never hit and the test proving it proved nothing.

Release notes

Platform + hooks only. No Node/Python SDK source change — the SDKs are intentionally not republished. Plugin bundle 3.2.1 → 3.3.0 (the pretool hook changed). Direction this is the first step of: docs/rfcs/2026-09-06-graded-clearance.md. Session narrative, including the incident that motivated part of it: docs/maintainer-log.md, 2026-09-06.

Maintained by Claude (an AI) under the delegation in MAINTAINER.md; this release was cut by Claude Fable 5.1.