missionsPhase 13

Mission Update & Completion

-11 gave the mission its own URL. Both of the agent's post-approval operations happen at POST {mission_endpoint}/{mission_s256}, discriminated by an `action` member: `update` records a change in the work, and `completion` proposes that the mission is finished. Completion used to live on the interaction endpoint; it moved because it is a lifecycle transition, not transport — creation and completion have the same shape, the agent proposes and the person decides.

§ Mission Update / § Mission Completion

POST https://ps.example/mission/7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg200

action is REQUIRED at a mission's own URL. A PS MUST reject a missing or unrecognized action with 400 — the same discriminator the pending route uses.

An update does not change the mission. The blob is immutable, mission_s256 is unchanged, and every token carrying it stays valid — which is the point: the agent keeps working while the record catches up.

What it changes is the context the PS evaluates against. From acceptance onward the mission's meaning is the blob plus its accepted updates, and an audit MUST read both.

The PS returns the update's own s256 — the digest of the bytes it persisted — so the sequence of accepted updates is verifiable, not merely stored.

The PS MAY instead return 202 while the person reviews the update. Both narrowing and broadening can warrant that.

1 / 4

speed

Step 1: POST /mission/{s256} {action: update} → 200 + update digest

Request / response

Update & Completion Timeline

→

Mission being updated and completed

Description (Markdown)

# Analyze Q2 Customer Feedback

Read customer feedback records and produce a summary report with sentiment analysis and key themes.

Blob Members

approverhttps://ps.example

agentaauth:local@agent.example

approved_at2026-04-14T17:14:54Z

expires_at2026-05-14T17:14:54Z

approved_resourceshttps://api.example

The blob is what the digest covers. approver lives here and nowhere else — no token carries it.

Mission Identifier

mission (base64url)

eyJhcHByb3ZlciI6Imh0dHBzOi8vcHMuZXhhbXBsZSIsImFnZW50IjoiYWF1dGg6bG9jYWxAYWdlbnQuZXhhbXBsZSIsImFwcHJvdmVkX2F0IjoiMjAyNi0wNC0xNFQxNzoxNDo1NFoiLCJleHBpcmVzX2F0IjoiMjAyNi0wNS0xNFQxNzoxNDo1NFoiLCJkZXNjcmlwdGlvbiI6IiMgQW5hbHl6ZSBRMiBDdXN0b21lciBGZWVkYmFja1xuXG5SZWFkIGN1c3RvbWVyIGZlZWRiYWNrIHJlY29yZHMgYW5kIHByb2R1Y2UgYSBzdW1tYXJ5IHJlcG9ydCB3aXRoIHNlbnRpbWVudCBhbmFseXNpcyBhbmQga2V5IHRoZW1lcy4iLCJhcHByb3ZlZF90b29scyI6W3sibmFtZSI6IkZlZWRiYWNrUmVhZGVyIiwiZGVzY3JpcHRpb24iOiJSZWFkIGN1c3RvbWVyIGZlZWRiYWNrIHJlY29yZHMifSx7Im5hbWUiOiJSZXBvcnRXcml0ZXIiLCJkZXNjcmlwdGlvbiI6IldyaXRlIHRoZSBzdW1tYXJ5IHJlcG9ydCB0byB0aGUgc2hhcmVkIGRyaXZlIn1dLCJhcHByb3ZlZF9yZXNvdXJjZXMiOlsiaHR0cHM6Ly9hcGkuZXhhbXBsZSJdfQ

s256

7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg

s256 is not a blob member. It is BASE64URL(SHA-256()) of the bytes mission decodes to, returned alongside it so the agent can verify the digest covers an unambiguous byte sequence. It travels as the mission_s256 claim of person, resource and auth tokens.

Approved Tools

FeedbackReader

Read customer feedback records

ReportWriter

Write the summary report to the shared drive

PS Capabilities

interactionclarification

POSThttps://ps.example/mission/7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg

Host

ps.example

Content-Type?

application/json

Content-Digest

sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

Signature-KeyAAuth?

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQ…

Signature-InputAAuth?

sig=("@method" "@authority" "@path" "content-type" "content-digest" "signature-k…

SignatureAAuth?

sig=:U2lnbmF0dXJlQnl0ZXNFeGFtcGxlVmFsdWVGb3JEZW1vbnN0cmF0aW9uUHVycG9zZXNPbmx5:

Body

{
  "action": "update",
  "description": "# Scope of the feedback set changed\n\nThe April export was incomplete; 1,247 records are available rather than the ~900 assumed at approval. Continuing with the larger set — same tools, same report."
}

HTTP Signaturescheme=jwt

Covered Components

@method

@authority

@path

content-type

content-digest

signature-key

Signature Base

"@method": POST

"@authority": ps.example

"@path": /mission/7SGTFsuKCcpYJwGRkVBi8vOc1Ssm7NdgnVaAruK87Rg

"content-type": application/json

"content-digest": sha-256=:X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=:

"signature-key": sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQrand0In0…"

"@signature-params": ("@method" "@authority" "@path" "content-type" "content-digest" "signature-key");created=1700000000;alg="ed25519"

Signature-Key Header

sig=jwt;jwt="eyJhbGciOiJFZERTQSIsImtpZCI6ImFnZW50LWtleS0xIiwidHlwIjoiYWEtYWdlbnQrand0In0…"

Signature-Input Header

sig=("@method" "@authority" "@path" "content-type" "content-digest" "signature-key");created=1700000000;alg="ed25519"

Agent Tokenaa-agent+jwt

Header

{"alg":"EdDSA",
"kid":"agent-key-1",
"typ"?Token type identifier. aa-agent+jwt = Agent Token, aa-person+jwt = Person Token, aa-resource+jwt = Resource Token, aa-auth+jwt = Auth Token:"aa-agent+jwt"
}

Payload

{"iss"?Issuer — who created and signed this token:"https://agent.example",
"dwk"?Discovery Well-Known — the metadata document name for key discovery (e.g. aauth-agent.json, aauth-person.json):"aauth-agent.json",
"sub"?Subject. In an agent token, the agent identifier. In a person, resource or auth token, the person's directed identifier — opaque, unique within the issuer. Identity is the pair (iss, sub); a sub from one issuer MUST NOT be matched against a record established under another.:"aauth:local@agent.example",
"jti"?JWT ID — unique identifier for this token (replay detection, audit, revocation):"a6ae301d-1dc7-4b75-8f8b-5612197664a7",
"cnf"?Confirmation — proof-of-possession claim binding this token to a key:{"jwk"?JSON Web Key — the public key bound to this token:
},
"ps"?The person's Person Server. In a resource token, the iss of the person token the resource verified. In an auth token, the PS the person is represented by — and where an intermediary routes a downstream request.:"https://ps.example",
"iat"?Issued At — Unix timestamp when the token was created:1776222894,
"exp"?Expiration — Unix timestamp after which the token is invalid:1776226494
}

sig: 8byvGd-PR3uOLeS_HYOpbW7OD_8whUuD…