{"name":"getvda Onboarding Agent","description":"Admission authority for the getvda.ai suite. Issues verifiable, Witness-sealed admission credentials that gate access to governed environments. Org-agnostic and multi-tenant. HONEST SCOPE: phases 1 (intake), 2 (governance analysis), 3 (impact-delta), 5 (adversarial sandbox — derives scenarios + scores governance risk via C2MD) and 7 (admission + issuance) are LIVE. Phases 4 and 6 are the two HUMAN gates: with a registered HITL caller they route to the shared HITL substrate (hitl.getvda.ai) — a human decides, HITL seals the hitl_decision, and admission SUSPENDS then RESUMES on the durable decision; without a registered caller they auto-resolve with NO human (an honest agent_action, never a hitl_decision). A credential attests intake, a real gap analysis, a real governance risk assessment, and issuance — plus human review only when a real HITL decision backs the gate. Card-only onboarding does not execute the candidate, so sandbox_result.pass is not a behavioural pass. See card.phaseStatus; enforcers gate on scope (see card.verification).","url":"https://onboard.getvda.ai","provider":{"organization":"getvda.ai","url":"https://getvda.ai"},"version":"0.1.0-skeleton","did":"did:web:onboard.getvda.ai","capabilities":{"streaming":false,"pushNotifications":false,"stateTransitionHistory":true},"defaultInputModes":["application/json"],"defaultOutputModes":["application/json"],"securitySchemes":{"tenantBearer":{"type":"http","scheme":"bearer","description":"Per-tenant service-account token, presented as `Authorization: Bearer <token>`. Required for admit_agent, revoke_credential, and get_admission_status."}},"skills":[{"id":"admit_agent","name":"Admit Agent","description":"Run the admission workflow for a candidate agent against a target environment and issue a Witness-sealed credential (or a sealed rejection). LIVE phases: 1 intake, 2 governance analysis, 3 impact-delta (a provenanced gap analysis sealed as impact_delta_ref; governance_unavailable if the environment has no active bundle), 5 adversarial sandbox (scenario derivation + C2MD risk), 7 admission + issuance. Phases 4/6 are HUMAN gates routed to the shared HITL substrate when a caller is registered — admission may SUSPEND at a gate and resume via decide_admission_gate / resume_admission on the durably sealed human decision; without a registered caller they auto-resolve honestly with no human. The credential is customer-managed (signed by this issuer's record-signing key) and independently verifiable via Witness check_valid.","tags":["admission","credential","witness"],"inputSchema":{"type":"object","additionalProperties":false,"required":["candidate_agent_card","environment_id"],"properties":{"candidate_agent_card":{"type":"object","description":"The candidate agent's A2A card. Its subject_did is ASSERTED, not proven — the admission phases establish control."},"environment_id":{"type":"string","description":"Target registered environment (e.g. env_sandbox). One environment per admission."},"requested_scope":{"type":"array","items":{"type":"string"},"description":"Optional requested capabilities; the environment's rules constrain what is granted."}}},"outputSchema":{"type":"object","properties":{"session_id":{"type":"string"},"state":{"type":"string","enum":["admitted","rejected","submitted","analyzing","awaiting_first_hitl","in_sandbox","awaiting_second_hitl"]},"credential_id":{"type":"string","description":"Witness seal ref of the issued credential; verify via check_valid (see card.verification)."},"assurance":{"type":"string","enum":["provisional_skeleton","production"],"description":"provisional_skeleton => sandbox-only scope; not a completed seven-phase evaluation."},"phases":{"type":"array","description":"Per-phase results with the Witness record each sealed (live phases) or a stub record (staged phases)."},"pending_hitl":{"type":"object","description":"Present when SUSPENDED at a human gate: the outstanding HITL item awaiting a decision. Resume via decide_admission_gate / resume_admission.","properties":{"gate":{"type":"string"},"phase":{"type":"number"},"item_id":{"type":"string"},"band":{"type":"string"}}}}},"errors":[{"code":400,"when":"invalid input (missing/blocked fields, unknown environment, prod-variant refuses a provisional credential)"},{"code":401,"when":"missing or invalid tenant bearer token"},{"code":404,"when":"session or credential not found"}],"security":["tenantBearer"]},{"id":"revoke_credential","name":"Revoke Credential","description":"Revoke an issued admission credential via the customer -> Onboarding -> Witness policy chain. Produces an immutable customer-managed revocation attestation. Terminal.","tags":["admission","revocation","witness"],"inputSchema":{"type":"object","additionalProperties":false,"required":["credential_id","reason"],"properties":{"credential_id":{"type":"string"},"reason":{"type":"string"}}},"outputSchema":{"type":"object","properties":{"revocation_record_id":{"type":"string"},"supersedes":{"type":"string","description":"The credential_id this revocation supersedes. Terminal."}}},"errors":[{"code":400,"when":"invalid input (missing/blocked fields, unknown environment, prod-variant refuses a provisional credential)"},{"code":401,"when":"missing or invalid tenant bearer token"},{"code":404,"when":"session or credential not found"}],"security":["tenantBearer"]},{"id":"get_admission_status","name":"Get Admission Status","description":"Return the current state of an admission session and its sealed evidence trail (each phase's Witness record).","tags":["admission","status"],"inputSchema":{"type":"object","additionalProperties":false,"required":["session_id"],"properties":{"session_id":{"type":"string"}}},"outputSchema":{"type":"object","properties":{"session_id":{"type":"string"},"state":{"type":"string"},"environment_id":{"type":"string"},"subject_did":{"type":"string"},"assurance":{"type":"string"},"credential_id":{"type":"string"},"phases":{"type":"array"}}},"errors":[{"code":400,"when":"invalid input (missing/blocked fields, unknown environment, prod-variant refuses a provisional credential)"},{"code":401,"when":"missing or invalid tenant bearer token"},{"code":404,"when":"session or credential not found"}],"security":["tenantBearer"]},{"id":"decide_admission_gate","name":"Decide Admission Gate","description":"Record a human decision (approve/deny) for the gate a suspended admission is waiting on. onboard forwards it to the shared HITL substrate's resolve_hitl_item — the human actor is ASSERTED, onboard is the authenticated caller — HITL seals the hitl_decision, and the admission advances (to the next gate or issuance). An approval is only acted on once its hitl_decision is DURABLY sealed; a pending seal keeps the gate suspended.","tags":["admission","hitl","human-decision"],"inputSchema":{"type":"object","additionalProperties":false,"required":["session_id","outcome","actor","statement"],"properties":{"session_id":{"type":"string"},"outcome":{"type":"string","enum":["approve","deny"],"description":"The human decision for the outstanding gate."},"actor":{"type":"object","required":["id"],"description":"The deciding human, ASSERTED by this surface — recorded, never authenticated, by HITL.","properties":{"id":{"type":"string"},"role":{"type":"string","description":"Authority band, e.g. compliance_officer."}}},"statement":{"type":"string","description":"Rationale for the decision."}}},"outputSchema":{"type":"object","properties":{"session_id":{"type":"string"},"state":{"type":"string","enum":["admitted","rejected","submitted","analyzing","awaiting_first_hitl","in_sandbox","awaiting_second_hitl"]},"credential_id":{"type":"string","description":"Witness seal ref of the issued credential; verify via check_valid (see card.verification)."},"assurance":{"type":"string","enum":["provisional_skeleton","production"],"description":"provisional_skeleton => sandbox-only scope; not a completed seven-phase evaluation."},"phases":{"type":"array","description":"Per-phase results with the Witness record each sealed (live phases) or a stub record (staged phases)."},"pending_hitl":{"type":"object","description":"Present when SUSPENDED at a human gate: the outstanding HITL item awaiting a decision. Resume via decide_admission_gate / resume_admission.","properties":{"gate":{"type":"string"},"phase":{"type":"number"},"item_id":{"type":"string"},"band":{"type":"string"}}}}},"errors":[{"code":400,"when":"invalid input (missing/blocked fields, unknown environment, prod-variant refuses a provisional credential)"},{"code":401,"when":"missing or invalid tenant bearer token"},{"code":404,"when":"session or credential not found"}],"security":["tenantBearer"]},{"id":"resume_admission","name":"Resume Admission","description":"Re-drive a suspended admission by polling its outstanding HITL gate. If the human decision is now durably sealed the workflow advances; otherwise it stays suspended. Use this to pick up a decision recorded out of band, or to let a previously pending seal backfill.","tags":["admission","hitl","resume"],"inputSchema":{"type":"object","additionalProperties":false,"required":["session_id"],"properties":{"session_id":{"type":"string","description":"A session suspended at a HITL gate (state awaiting_first_hitl / awaiting_second_hitl)."}}},"outputSchema":{"type":"object","properties":{"session_id":{"type":"string"},"state":{"type":"string","enum":["admitted","rejected","submitted","analyzing","awaiting_first_hitl","in_sandbox","awaiting_second_hitl"]},"credential_id":{"type":"string","description":"Witness seal ref of the issued credential; verify via check_valid (see card.verification)."},"assurance":{"type":"string","enum":["provisional_skeleton","production"],"description":"provisional_skeleton => sandbox-only scope; not a completed seven-phase evaluation."},"phases":{"type":"array","description":"Per-phase results with the Witness record each sealed (live phases) or a stub record (staged phases)."},"pending_hitl":{"type":"object","description":"Present when SUSPENDED at a human gate: the outstanding HITL item awaiting a decision. Resume via decide_admission_gate / resume_admission.","properties":{"gate":{"type":"string"},"phase":{"type":"number"},"item_id":{"type":"string"},"band":{"type":"string"}}}}},"errors":[{"code":400,"when":"invalid input (missing/blocked fields, unknown environment, prod-variant refuses a provisional credential)"},{"code":401,"when":"missing or invalid tenant bearer token"},{"code":404,"when":"session or credential not found"}],"security":["tenantBearer"]}],"phaseStatus":{"live":["1: intake — the candidate card is parsed and sealed; subject_did is asserted (not verified).","2: governance analysis — resolves the environment's active governance bundle via ACP, verifies it, and parses it into ACP's capability vocabulary. If the environment has NO activated bundle, reports governance_unavailable honestly and proceeds — it does not fail.","3: impact-delta analysis — a provenanced gap analysis (candidate card vs the resolved governance) with three-way labels (structural finding / semantic flag / undetermined) and NO completeness claim ('gaps found', never 'all gaps'). Sealed as the credential's impact_delta_ref.","5: adversarial sandbox — derives adversarial scenarios from the candidate's advertised skills × the environment's governance conditions, and scores governance risk via C2MD assess_agent_risk (EU AI Act + GDPR). Sealed as the credential's sandbox_result.evidence_seal_ref. HONESTY: card-only onboarding does NOT execute the remote candidate, so the sealed evidence carries executed_live=false and sandbox_result.pass stays false (a behavioural PASS requires live driving); prohibited risk (or an observed failure when driven live) rejects admission.","7: admission + issuance — the Witness-sealed, customer-managed credential is issued."],"human_gated":["4: first HITL gate — HUMAN-GATED via the shared HITL substrate (hitl.getvda.ai) when onboard is a registered caller (ONBOARD_HITL_CALLER_ID). raise_hitl_item → a human on the compliance_officer band decides → HITL seals the hitl_decision → admission resumes on the DURABLE seal (a pending seal keeps the gate suspended). If no caller is registered, it auto-resolves with NO human, sealing an honest agent_action — NEVER a hitl_decision.","6: second HITL gate — same mechanism as gate 4 (its evidence adds the sandbox result)."],"gate_degraded_mode":"When onboard is not a registered HITL caller: in dev the gates auto-resolve (honest agent_action, no human); in the live HITL mode they report 'unavailable' and the admission stays suspended — onboard never fabricates an approval. Making the gates real requires the one-time controller-signed genesis that mints ONBOARD_HITL_CALLER_ID (a HITL-operator step; see EXTERNAL-CALLERS.md).","analysis":"Phases 2/3 produce a provenanced gap analysis of the candidate card against the environment's active governance: three-way labels (structural finding = deterministic; semantic flag = heuristic, for a human, never a finding; undetermined = genuinely unknown), provenance both directions (card field <-> governance clause), and no completeness claim. If the environment has no activated governance bundle, the analysis reports governance_unavailable rather than failing.","credential_attests":"A credential attests: intake, a REAL gap analysis against the environment's governance, a REAL governance risk assessment (phase 5, C2MD assess_agent_risk across EU AI Act + GDPR, with the derived adversarial scenarios), and issuance. Human review (phases 4/6) is attested ONLY when a real HITL decision backed the gate — the phase then references HITL's own hitl_decision seal; an auto-resolved gate seals an agent_action and attests no human. It does NOT attest observed behaviour — card-only onboarding does not execute the candidate, so sandbox_result.pass is false (executed_live=false) unless the candidate was driven live. Read the sealed phase records for which gates were human-decided."},"verification":{"summary":"Credentials issued here are sealed to, and independently verified via, Witness check_valid. Do all four steps — a valid credential is necessary, not sufficient.","witness":"witness.getvda.ai","check_valid_endpoint":"GET https://witness.getvda.ai/api/witness/credentials/{credential_id}","steps":["1. VERIFY: call Witness check_valid — GET https://witness.getvda.ai/api/witness/credentials/{credential_id}. Require valid:true, code:'valid', not revoked, not expired.","2. ISSUER-AUTHENTICITY: require issuer_verification:'verified' for production reliance (the record-signing key resolved against did:web:onboard.getvda.ai). Treat 'did_unresolvable' as NOT verified.","3. HOLDER-BINDING: bind the presenter to subject_did via a separate DID-auth challenge. A valid credential NAMES a subject; it does not authenticate the presenter.","4. SCOPE + ENVIRONMENT: confirm the credential's scope and environment match what you are authorizing. Scope carries the capability/assurance signal — check_valid validity does NOT encode assurance."],"issuer_verification_states":{"verified":"issuer did:web resolved and the record-signing key matched — safe for production reliance.","did_unresolvable":"issuer DID not yet resolvable; issuer-authenticity NOT established — do not treat as verified."}},"composition":{"live":[{"service":"witness.getvda.ai","role":"Evidence substrate + credential verification","detail":"Every admission event is sealed to Witness. Issued credentials are customer-managed (signed by this issuer's own record-signing key, which Witness never holds) and independently verifiable via check_valid — even against getvda.ai. This is the live spine of the service."}],"roadmap":[{"service":"c2md.getvda.ai","role":"Agent risk assessment (assess_agent_risk) feeding Phase 2 governance analysis","status":"ROADMAP — staged seam, not yet wired. Do not rely on it as current capability."},{"service":"HITL substrate","role":"Human review backing the Phase 4 / Phase 6 gates","status":"ROADMAP — gates currently pass-through. Do not rely on it as current capability."}]},"boundaries":["HOLDER-BINDING: a credential_id is a bearer handle. check_valid proves a credential is valid and NAMES subject S — not that the presenter IS S. Enforcers MUST bind presenter->subject_did via a separate DID-auth challenge. Valid != sufficient.","ASSERTED != VERIFIED: this issuer ASSERTS subject_did, scope, environment, and compliance mappings; Witness records the assertion tamper-evidently. It does not verify the agent controls the DID, that the environment exists, or that compliance claims hold.","PHASE STATUS: phases 1, 2, 3 and 7 are live; phases 4, 5, 6 are staged (4/6 auto-resolve with no human — honest agent_action, never hitl_decision; 5 does not run). A credential attests intake, a real gap analysis, and issuance — NOT human review and NOT behavioural testing; it does NOT represent a completed seven-phase evaluation.","PROVISIONAL SCOPE: provisional/skeleton credentials carry sandbox-only scope. check_valid validity does not encode assurance — enforcers must gate on scope + environment."],"signatures":[{"keyId":"did:web:onboard.getvda.ai#key-1","alg":"EdDSA","value":"O6-XFklyd8vUvpRHOSbobqk0ud48DmmkkLpczKq7AiZrxeeihckHGlfQLYu7l6txSTpeFClyBsYvxR2pUXAxDw"}]}