feat: Provenance gains email + agent.onBehalfOf — cross-rung identity (F5 SLICE-2, #14)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/model.ts

@@ -25,10 +25,25 @@ export interface Anchor {
   fingerprint: Fingerprint;
 }
 
-/** The reusable author field (spec §6.3). `agent` only present when kind=agent. */
+/**
+ * The reusable author field (contract §3.3). `agent` only present when
+ * kind=agent. F5 (spec §6.3, fork c): `email` is the cross-rung join key —
+ * git's own identity model (forges map email → account); `onBehalfOf` records
+ * the operator a machine acted for (rfc-app#46 §6.5 made data).
+ */
 export type Provenance =
-  | { kind: "human"; id: string }
-  | { kind: "agent"; id: string; agent: { sdk: string; model: string; sessionId: string } };
+  | { kind: "human"; id: string; email?: string }
+  | {
+      kind: "agent";
+      id: string;
+      email?: string;
+      agent: {
+        sdk: string;
+        model: string;
+        sessionId: string;
+        onBehalfOf?: { id: string; email?: string };
+      };
+    };
 
 export interface Message {
   id: string;
@@ -107,9 +122,27 @@ export function newId(prefix: string): string {
 }
 
 function serializeProvenance(p: Provenance): Record<string, unknown> {
-  return p.kind === "agent"
-    ? { kind: p.kind, id: p.id, agent: { sdk: p.agent.sdk, model: p.agent.model, sessionId: p.agent.sessionId } }
-    : { kind: p.kind, id: p.id };
+  const known: Record<string, unknown> = {
+    kind: p.kind,
+    id: p.id,
+    ...(p.email !== undefined ? { email: p.email } : {}),
+  };
+  if (p.kind === "agent") {
+    known.agent = {
+      sdk: p.agent.sdk,
+      model: p.agent.model,
+      sessionId: p.agent.sessionId,
+      ...(p.agent.onBehalfOf !== undefined
+        ? {
+            onBehalfOf: {
+              id: p.agent.onBehalfOf.id,
+              ...(p.agent.onBehalfOf.email !== undefined ? { email: p.agent.onBehalfOf.email } : {}),
+            },
+          }
+        : {}),
+    };
+  }
+  return known;
 }
 
 /**