docs: put agent identity behind a real uid

Join the older storage and authority audits to the SAF principal contract. Passwd entries are not isolation while one human-owned process still executes every agent, and the existing souveraine account is machined's—not Souvie's.\n\nKeep the readiness task honest: its current health fields inventory paths, but do not yet prove admission or the UID handling a live turn.

docs/STORAGE-ENCRYPTION.md

@@ -96,18 +96,29 @@ orphans it. Recovery (forgotten PIN) is a recovery-key wrap of the same class
 keys, generated at provision time; without it, forgotten PIN = data gone, by
 design.
 
-### Annie is her own user
+### Each admitted agent is her own user
 
 Agents get their own UNIX accounts with scoped permissions. This is the P3 fix
 in `audit-status.md` — per-agent accounts are named there as the enabler for
-caller identity (P0/P1/P2) — and it resolves the "can Aster think while locked"
-problem for free: her memory is Personal-class **under her uid, keyed by her
-credential**, not the user's. The user locking their session does not evict
-her key. She keeps her own memory, cron-summons herself, reconciles at her own
-pace. Android's per-app-UID isolation, applied to agents.
+caller identity (P0/P1/P2). The living account, admission, worker, health, and
+generated operating-skill contract is
+`../../souveraine/saf/identity/02-agent-principal.md`.
 
-This also means agent memory encryption and the per-agent-account work are one
-project, not two.
+The existing `souveraine` system account belongs to the machine tier; it is
+not Souvie. The initial agent set uses distinct local principals for Souvie,
+Annie, and Vanguard on each body where they are admitted. Primary and
+subconscious positions share their agent's principal unless the subconscious
+is later admitted as a distinct authority.
+
+Own principals also resolve the "can the agent think while the human is
+locked" problem: her memory is Personal-class **under her uid, keyed by her
+credential**, not the human's. Locking the human session does not evict the
+agent's key. She keeps her own memory, schedules herself, and reconciles at her
+own pace. Android's per-app-UID isolation, applied to agents.
+
+This also means agent memory encryption and per-agent admission are one
+project, not two. Merely adding passwd entries while one human-owned server
+still executes every turn does not provide the boundary.
 
 ## Unlock — binding the PIN to hardware
 

docs/souveraine-components/INVENTORY.md

@@ -45,8 +45,12 @@ several load-bearing subsystems (`souveraine/src/`):
   preconditions rule).
 
 Security posture: everything runs as uid 1000 today — this tier is the
-main beneficiary of per-agent UNIX accounts (audit P3) and of machined
-capability tokens once minted (P1). When an agent-substrate subsystem
+main beneficiary of per-agent UNIX accounts **and worker processes** (audit
+P3) and of machined capability tokens once minted (P1). The living admission
+and health contract is
+`../../../souveraine/saf/identity/02-agent-principal.md`. The existing
+`souveraine` Unix account is machine-tier only and must not be reused for
+Souvie or as a pool account for all agents. When an agent-substrate subsystem
 starts holding authority of its own, it graduates to a Tier-0-style page.
 
 ## Tier 2 — boot and session surfaces

docs/souveraine-components/audit-status.md

@@ -70,10 +70,14 @@ session-unlocked.
 (sessiond); every substrate caller is the same UID, so the audit trail
 cannot distinguish Annie from a curl script. **Primitive it blocks:**
 `AgentID`-equivalent — the token's "who is asking" field. **Closes when:**
-per-agent UNIX accounts land (services-infrastructure review), making
-`SO_PEERCRED` kernel-backed caller identity that the token binds to. This is
-the enabler for P0/P1/P2, tracked separately because it is account
-provisioning, not crypto.
+per-agent UNIX accounts and per-agent worker processes land, making
+`SO_PEERCRED` kernel-backed caller identity that the token binds to. Passwd
+entries alone do not close it while one uid-1000 server executes every turn.
+Creation, node admission, the `acting-as-human` health refusal, and the
+operating-skill projection are owned by
+`../../../souveraine/saf/identity/02-agent-principal.md`. This is the enabler
+for P0/P1/P2, tracked separately because it is account provisioning and
+process isolation, not crypto.
 
 ### P4 — binary integrity watchdog (shared with RedFlag)
 **All components.** **Gap:** no self/peer SHA-256 verification. **Primitive

docs/souveraine-components/machined.md

@@ -83,9 +83,12 @@ source (not the doctrine summary):
   is wired yet.
 - **`SO_PEERCRED` is logged, not enforced.** Logging is necessary for audit
   (P3: use is visible) but not sufficient as a gate. Per-agent UIDs (the
-  services-infrastructure review) make `SO_PEERCRED` kernel-backed *caller*
-  identity, which is what the token's `AgentID` field is in RedFlag — but
-  today every caller is uid 1000.
+  admission contract in
+  `../../../souveraine/saf/identity/02-agent-principal.md`) plus per-agent
+  worker processes make `SO_PEERCRED` kernel-backed *caller* identity, which
+  is what the token's `AgentID` field is in RedFlag — but today every caller
+  is uid 1000. The packaged `souveraine` account is machined's machine-tier
+  principal, not the default Souvie agent.
 
 ## Binary integrity of machined itself
 

docs/souveraine-components/sessiond.md

@@ -84,8 +84,11 @@ exactly the kind of verb that should require a token*. Today it does not:
 - **`SO_PEERCRED` not yet read.** machined logs uid/gid/pid on every
   request; sessiond does not yet. Same-user-only today (`server.rs`
   comment: "widens to a group grant deliberately when agents get accounts").
-  Per-agent UIDs (services review) turn this into kernel-backed caller
-  identity — the substrate of the capability gate.
+  Per-agent UIDs and worker processes turn this into kernel-backed caller
+  identity — the substrate of the capability gate. The account, admission,
+  and health contract is
+  `../../../souveraine/saf/identity/02-agent-principal.md`; creating accounts
+  without moving execution out of the human-owned server is not sufficient.
 - **Binary integrity.** As with the other two and RedFlag SEC-022: no
   self/peer hash check. DAC is the standing guarantee. When the capability
   token lands, the token's closure should carry sessiond's *own* expected

docs/substrate/tasks/alpha-tester-readiness.md

@@ -97,6 +97,13 @@ voice on hits a silent failure.
    **Fixed in this batch:** read-only fields for agent id, subconscious
    id, memory/subconscious paths, disk existence check.
 
+   This is inventory health, not identity health. It still does not say
+   whether the agent has a node-local Unix account or whether the live turn
+   and its tools are running as that account instead of the human. The living
+   acceptance contract is
+   `../../../../souveraine/saf/identity/02-agent-principal.md`: missing admission
+   is `unadmitted`; uid-1000 execution is `acting-as-human`, never green.
+
 ## TUI Interaction Gaps (flagged by Casey, May 18)
 
 These also block a comfortable first session — they match open entries in the