The content identity of an operator Attestation (signing is deferred — the id
is stable now so an Elevation edge can name it before the verifier lands).
Acyclicity invariant (must hold when the real attestation body lands). A
Grant names its AttestationId (via Derivation::Elevation), so the
grant’s CID depends on the attestation’s CID. The attestation body must
therefore not include the child GrantId it authorizes — that would
create the cycle GrantId → AttestationId → GrantId, which is uncomputable
under content addressing (neither CID can be formed without the other). The
attestation binds upward and sideways only: the parent GrantId, the
child’s AuthorityId (the authority the elevation grants, which exists
independently of the grant), and any operator context — never the child grant
id. The dependency DAG stays acyclic.
The underlying content id (read-only). Construction is deliberately narrow
while attestations are deferred: an AttestationId will be produced by a
future Attestation::id(); deserialization is the only external path today.