Concepts
RoE and consent
The recorded authorisation to scan, and the bounds it sets.
An attestation (its rules are the RoE, rules of engagement) is the recorded authorisation to scan and the bounds that authorisation sets:
scope_hosts- the hosts the scan may touch.excluded_paths- paths it must not.safe_mode- non-destructive by default.destructive_allowed- the explicit opt-in for destructive checks.
An attestation records who accepted which named terms version and when. It is bound to the session principal - never to a client-supplied signer.
Consent is derived from adding an asset
Consent to the named terms is accepted once per workspace. Because an attestation cannot be minted without a consent row, "an attestation exists" implies "consent existed", by construction. You are not asked to re-consent on every scan.
The terms text behind the version identifier is a standing pre-GA placeholder; the version identifier is what is recorded and enforced today.