Spec gap: no way to author a composition-only manifest where the model is unknowable #256

Where this came from

Building an agent-integrity check for GitHub Copilot in agentrust-io/integrations#68. It measures what a repository contributes to an agent's composition: .github/copilot-instructions.md, .github/instructions/**, AGENTS.md anywhere in the tree, .github/skills/*, .claude/skills/*, .agents/skills/*, and MCP config. Those files decide how the coding agent behaves, they arrive by pull request, and they are reviewable.

It cannot emit an Agent Manifest, and I think the reason is a genuine gap rather than a limitation of the integration.

The problem

Level 0 requires all artifact bindings (section on levels: "Software-only | All artifact bindings"), and artifacts.model_identity is artifact 4.

A repository cannot know the model. Copilot's model is chosen at session time by the user's plan and settings. The same repository serves every model a user might select, and the composition the repository contributes is identical across all of them. model_hash is unavailable, and so is provider / model_id / version in any truthful form.

The obvious workarounds are all dishonest in a way this project usually refuses:

• provider: github, model_id: copilot describes a product, not a model.
• model_id: unknown asserts a binding to a thing named "unknown".
• Omitting the artifact makes the manifest non-conformant at every level.

So the integration currently emits nothing and claims no integrates_with, which I would rather fix in the spec than paper over in the integration.

The part that suggests the spec already half-agrees

The verification result vocabulary (section 5.2) is:

"model_identity": "MATCH | PROVIDER_ASSERTED | MISMATCH | NOT_BOUND  -- REQUIRED",

NOT_BOUND exists for every artifact in that result object. But there is no legal way to author a manifest that produces it, because every level requires all bindings present. A verifier can report a state no conformant manifest can reach.

That reads like an internal inconsistency rather than a missing feature.

What I would propose

Three options, roughly in order of how much I like them.

1. A composition-only profile. A manifest that binds a stated subset of artifacts and declares which ones it deliberately does not bind, with verification returning NOT_BOUND for those. Something like:

{
  "@type": "AgentManifest",
  "profile": "composition-only",
  "unbound_artifacts": ["model_identity", "decision_trace", "memory_baseline"],
  "artifacts": { "system_prompt": {...}, "tool_manifest": {...}, "policy_bundle": {...} }
}

The declaration is the point: an unbound artifact is stated, not silently absent, so a verifier can tell "this manifest does not cover the model" from "this manifest is malformed". That is the same distinction we ended up needing in the capture engines, where an unmeasured category had to be labelled rather than rendered as zero.

2. model_attestation_type: "unbound" alongside the existing hash-bound and provider-asserted, with provider / model_id / version nullable in that mode only. Smaller change, and it slots into machinery that already exists. Less general: the same problem applies to decision_trace and memory_baseline for a repository-scoped manifest, and this only fixes the model.

3. Leave the spec alone and say composition-only manifests are out of scope. Also a fine answer. If so, it is worth stating explicitly, because the natural reading of "Agent Manifest describes what an agent IS" invites exactly the attempt I just made.

Why it might matter beyond this one integration

Anything that inspects a repository rather than a running agent hits this: a CI check, a policy gate on a pull request, a marketplace scanning a published skill. Those are all "here is the composition, the model is chosen later by whoever runs it". If that class is in scope for agent-manifest, it needs a way to say so.

Happy to implement whichever direction you prefer.