@axtary/actionpass 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,10 +1,25 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { decodeProtectedHeader, SignJWT, jwtVerify, } from "jose";
+import { lock } from "proper-lockfile";
+import { decodeProtectedHeader, calculateJwkThumbprint, importJWK, SignJWT, jwtVerify, } from "jose";
 import { z } from "zod";
+import { ActionPassStatusClaimSchema, } from "./status-list.js";
+import { ActionProvenanceSchema, } from "./provenance.js";
+import { analyzePostgresSelect } from "./postgres.js";
+import { explainDecision, } from "./explain.js";
+import { AXTARY_DEV_SIGNING_KEY_ENV, devKeypair, } from "./dev-key.js";
+export * from "./caep.js";
+export * from "./dev-key.js";
+export * from "./explain.js";
+export * from "./postgres.js";
+export * from "./provenance.js";
+export * from "./status-list.js";
 export const ACTION_SCHEMA_VERSION = "axtary.action.v0";
-export const ACTIONPASS_VERSION = "axtary.actionpass.v0";
+export const ACTIONPASS_V0_VERSION = "axtary.actionpass.v0";
+export const ACTIONPASS_V1_VERSION = "axtary.actionpass.v1";
+export const ACTIONPASS_V2_VERSION = "axtary.actionpass.v2";
+export const ACTIONPASS_VERSION = ACTIONPASS_V0_VERSION;
 export const APPROVAL_ARTIFACT_VERSION = "axtary.approval.v0";
 export const ACTIONPASS_REVOCATION_VERSION = "axtary.actionpass_revocation.v0";
 export const ACTIONPASS_TRUST_STORE_VERSION = "axtary.actionpass_trust_store.v0";
@@ -13,6 +28,9 @@ export const LEDGER_PROVIDER_EVIDENCE_VERSION = "axtary.ledger_provider_evidence
 export const LEDGER_EXECUTION_OUTCOME_VERSION = "axtary.ledger_execution_outcome.v0";
 export const DEFAULT_EXPIRES_IN_SECONDS = 600;
 export const DEFAULT_SIGNING_ALGORITHM = "ES256";
+export const DPOP_PROOF_TYP = "dpop+jwt";
+export const DEFAULT_DPOP_MAX_AGE_SECONDS = 60;
+export const DEFAULT_DPOP_CLOCK_SKEW_SECONDS = 5;
 const JsonValueSchema = z.lazy(() => z.union([
     z.string(),
     z.number().finite(),
@@ -21,6 +39,13 @@ const JsonValueSchema = z.lazy(() => z.union([
     z.array(JsonValueSchema),
     z.record(z.string(), JsonValueSchema),
 ]));
+export const BudgetAmountSchema = z.record(z.string().min(1), z.number().finite().nonnegative());
+export const ActionBudgetSchema = z.object({
+    reservationId: z.string().min(1),
+    cost: BudgetAmountSchema,
+    limit: BudgetAmountSchema,
+    commitStatus: z.enum(["pending", "committed", "rolled_back"]),
+});
 export const AxtaryDecisionSchema = z.enum(["allow", "deny", "step_up"]);
 export const NormalizedActionSchema = z.object({
     schemaVersion: z.literal(ACTION_SCHEMA_VERSION).default(ACTION_SCHEMA_VERSION),
@@ -46,15 +71,18 @@ export const NormalizedActionSchema = z.object({
         serverIdentity: z.string().min(1),
         schemaVersion: z.string().min(1),
         definitionHash: z.string().min(1),
+        // Optional signed-publisher provenance (MCP signed definitions, M5.5).
+        // Absent for hash-only (unsigned) tools, so existing actions hash
+        // identically; present, they bind publisher identity + version lineage
+        // into the ActionPass and ledger.
+        publisher: z.string().min(1).optional(),
+        publisherKeyId: z.string().min(1).optional(),
+        semver: z.string().min(1).optional(),
+        priorDefinitionHash: z.string().min(1).optional(),
     })
         .optional(),
-    budget: z
-        .object({
-        reservationId: z.string().min(1).optional(),
-        limit: z.record(z.string(), JsonValueSchema).optional(),
-        commitStatus: z.enum(["pending", "committed", "rolled_back"]).optional(),
-    })
-        .optional(),
+    provenance: ActionProvenanceSchema.optional(),
+    budget: ActionBudgetSchema.optional(),
 });
 export const PolicyDecisionSchema = z.object({
     decision: AxtaryDecisionSchema,
@@ -70,10 +98,37 @@ export const PolicyDecisionSchema = z.object({
         maxFilesChanged: z.number().int().nonnegative(),
         blockedPaths: z.array(z.string().min(1)),
     }),
+    rule: z
+        .object({
+        id: z.string().min(1),
+        matchedRuleIds: z.array(z.string().min(1)).default([]),
+    })
+        .optional(),
+    obligations: z
+        .object({
+        requiredApproverRoles: z.array(z.string().min(1)).default([]),
+        timeWindow: z
+            .object({
+            startHourUtc: z.number().int().min(0).max(23),
+            endHourUtc: z.number().int().min(0).max(23),
+            daysOfWeek: z.array(z.number().int().min(0).max(6)).default([]),
+        })
+            .optional(),
+        rateLimit: z
+            .object({
+            ruleId: z.string().min(1),
+            maxActions: z.number().int().positive(),
+            windowSeconds: z.number().int().positive(),
+            scope: z.enum(["actor", "tool", "resource", "tenant"]),
+        })
+            .optional(),
+    })
+        .optional(),
 });
 export const ApprovalSchema = z.object({
     mode: z.enum(["none", "human", "policy_override"]),
     approvedBy: z.string().min(1).optional(),
+    approverRoles: z.array(z.string().min(1)).optional(),
     approvalArtifact: z.string().min(1).optional(),
     approvalArtifactHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
     actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
@@ -85,6 +140,7 @@ export const ApprovalArtifactSchema = z.object({
     id: z.string().min(1),
     mode: z.enum(["human", "policy_override"]),
     approvedBy: z.string().min(1),
+    approverRoles: z.array(z.string().min(1)).optional(),
     approvedAt: z.string().datetime(),
     actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
     payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
@@ -94,8 +150,7 @@ export const ApprovalArtifactSchema = z.object({
     reason: z.string().min(1).optional(),
     expiresAt: z.string().datetime().optional(),
 });
-export const ActionPassClaimsSchema = z.object({
-    apv: z.literal(ACTIONPASS_VERSION),
+const ActionPassBaseClaimsSchema = z.object({
     iss: z.string().min(1),
     sub: z.string().min(1),
     aud: z.union([z.string().min(1), z.array(z.string().min(1))]),
@@ -116,6 +171,8 @@ export const ActionPassClaimsSchema = z.object({
     reasons: z.array(z.string().min(1)),
     policy: PolicyDecisionSchema.shape.policy,
     payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    provenanceHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    budget: ActionBudgetSchema.optional(),
     approval: ApprovalSchema.optional(),
     audit: z.object({
         traceId: z.string().min(1),
@@ -123,6 +180,50 @@ export const ActionPassClaimsSchema = z.object({
         ledgerHash: z.string().min(1).nullable(),
     }),
 });
+export const ActionPassV0ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V0_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+});
+export const ActionPassV1ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V1_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+    cnf: z.object({
+        jkt: z.string().min(1),
+    }),
+    delegation: z
+        .object({
+        depth: z.number().int().positive(),
+        rootPassId: z.string().min(1),
+    })
+        .optional(),
+});
+export const ActionPassV2ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V2_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+    cnf: z.object({
+        jkt: z.string().min(1),
+    }),
+    delegation: z
+        .object({
+        depth: z.number().int().positive(),
+        rootPassId: z.string().min(1),
+    })
+        .optional(),
+    status: ActionPassStatusClaimSchema,
+});
+export const ActionPassClaimsSchema = z.union([
+    ActionPassV0ClaimsSchema,
+    ActionPassV1ClaimsSchema,
+    ActionPassV2ClaimsSchema,
+]);
+export const DpopProofClaimsSchema = z.object({
+    htm: z.string().min(1),
+    htu: z.string().url(),
+    iat: z.number().int().positive(),
+    jti: z.string().min(1),
+    ath: z.string().min(1),
+    nonce: z.string().min(1).optional(),
+});
 export const ActionPassRevocationSchema = z.object({
     schemaVersion: z.literal(ACTIONPASS_REVOCATION_VERSION),
     passId: z.string().min(1),
@@ -167,10 +268,12 @@ export const LedgerProviderSchema = z.enum([
     "slack",
     "linear",
     "docs",
+    "drive",
     "mcp",
     "aws",
     "gcp",
     "jira",
+    "postgres",
 ]);
 export const LedgerProviderEvidenceDiffSchema = z.object({
     provider: LedgerProviderSchema,
@@ -200,6 +303,117 @@ export const LedgerProviderEvidenceSchema = z.object({
     fieldChanges: z.array(LedgerProviderEvidenceFieldChangeSchema).default([]),
     diff: LedgerProviderEvidenceDiffSchema.optional(),
 });
+export const GitHubNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "rest", "app"]).default("fake"),
+    tokenEnv: z.string().min(1).default("GITHUB_TOKEN"),
+    apiBaseUrl: z.string().url().default("https://api.github.com"),
+    userAgent: z.string().min(1).default("axtary-local-proxy"),
+    appId: z.string().min(1).optional(),
+    appIdEnv: z.string().min(1).default("AXTARY_GITHUB_APP_ID"),
+    installationId: z.string().min(1).optional(),
+    installationIdEnv: z
+        .string()
+        .min(1)
+        .default("AXTARY_GITHUB_INSTALLATION_ID"),
+    privateKeyEnv: z
+        .string()
+        .min(1)
+        .default("AXTARY_GITHUB_APP_PRIVATE_KEY"),
+});
+export const DEFAULT_GITHUB_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    tokenEnv: "GITHUB_TOKEN",
+    apiBaseUrl: "https://api.github.com",
+    userAgent: "axtary-local-proxy",
+    appIdEnv: "AXTARY_GITHUB_APP_ID",
+    installationIdEnv: "AXTARY_GITHUB_INSTALLATION_ID",
+    privateKeyEnv: "AXTARY_GITHUB_APP_PRIVATE_KEY",
+};
+export const LinearNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "graphql"]).default("fake"),
+    tokenEnv: z.string().min(1).default("LINEAR_API_KEY"),
+    apiUrl: z.string().url().default("https://api.linear.app/graphql"),
+});
+export const DEFAULT_LINEAR_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    tokenEnv: "LINEAR_API_KEY",
+    apiUrl: "https://api.linear.app/graphql",
+};
+export const JiraNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "rest"]).default("fake"),
+    auth: z.enum(["api_token", "oauth"]).default("api_token"),
+    tokenEnv: z.string().min(1).default("JIRA_API_TOKEN"),
+    emailEnv: z.string().min(1).default("JIRA_EMAIL"),
+    siteUrl: z.string().url().default("https://example.atlassian.net"),
+    cloudId: z.string().min(1).optional(),
+    cloudIdEnv: z.string().min(1).default("AXTARY_JIRA_CLOUD_ID"),
+});
+export const DEFAULT_JIRA_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    auth: "api_token",
+    tokenEnv: "JIRA_API_TOKEN",
+    emailEnv: "JIRA_EMAIL",
+    siteUrl: "https://example.atlassian.net",
+    cloudIdEnv: "AXTARY_JIRA_CLOUD_ID",
+};
+export const PostgresNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["off", "postgres"]).default("off"),
+    dsnEnv: z.string().min(1).default("AXTARY_POSTGRES_DSN"),
+    allowedTables: z.array(z.string().min(1)).default([]),
+    allowedFunctions: z.array(z.string().min(1)).default([]),
+    requireRls: z.boolean().default(true),
+    maxRows: z.number().int().positive().max(10_000).default(100),
+    statementTimeoutMs: z.number().int().positive().default(5_000),
+    lockTimeoutMs: z.number().int().positive().default(1_000),
+    idleTransactionTimeoutMs: z.number().int().positive().default(5_000),
+});
+export const DEFAULT_POSTGRES_NATIVE_CONNECTOR_CONFIG = {
+    mode: "off",
+    dsnEnv: "AXTARY_POSTGRES_DSN",
+    allowedTables: [],
+    allowedFunctions: [],
+    requireRls: true,
+    maxRows: 100,
+    statementTimeoutMs: 5_000,
+    lockTimeoutMs: 1_000,
+    idleTransactionTimeoutMs: 5_000,
+};
+export const DriveNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["off", "rest"]).default("off"),
+    tokenEnv: z.string().min(1).default("AXTARY_DRIVE_ACCESS_TOKEN"),
+    selectedFileId: z.string().min(1).optional(),
+    apiBaseUrl: z
+        .string()
+        .url()
+        .default("https://www.googleapis.com/drive/v3"),
+    allowedMimeTypes: z
+        .array(z.string().min(1))
+        .default([
+        "application/vnd.google-apps.document",
+        "text/plain",
+        "text/markdown",
+        "text/html",
+        "text/csv",
+        "application/json",
+        "application/xml",
+    ]),
+    maxReadBytes: z.number().int().positive().max(10_000_000).default(100_000),
+});
+export const DEFAULT_DRIVE_NATIVE_CONNECTOR_CONFIG = {
+    mode: "off",
+    tokenEnv: "AXTARY_DRIVE_ACCESS_TOKEN",
+    apiBaseUrl: "https://www.googleapis.com/drive/v3",
+    allowedMimeTypes: [
+        "application/vnd.google-apps.document",
+        "text/plain",
+        "text/markdown",
+        "text/html",
+        "text/csv",
+        "application/json",
+        "application/xml",
+    ],
+    maxReadBytes: 100_000,
+};
 export const LedgerExecutionOutcomeSchema = z
     .object({
     schemaVersion: z.literal(LEDGER_EXECUTION_OUTCOME_VERSION),
@@ -211,15 +425,50 @@ export const LedgerExecutionOutcomeSchema = z
     resourceLabel: z.string().min(1).optional(),
     failureReason: z.string().min(1).optional(),
     errorClass: z.string().min(1).optional(),
+    // Approval↔execution equivalence proof: when the executed action carried
+    // approval evidence, the runtime stamps the hash the approval was bound
+    // to and the hash of the payload it actually executed. Both fields are
+    // present together or not at all; export verification fails closed on an
+    // incomplete pair, on `executedPayloadHash` disagreeing with the record's
+    // own hash-chained `payloadHash`, and on `approved !== executed`.
+    approvedPayloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    executedPayloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
     sideEffectProof: z.record(z.string(), JsonValueSchema).default({}),
 })
     .strict();
+export const DelegationLedgerEdgeSchema = z.object({
+    parentPassId: z.string().min(1),
+    childPassId: z.string().min(1),
+    depth: z.number().int().positive(),
+    rootPassId: z.string().min(1),
+});
+export const BudgetLedgerEventSchema = z.object({
+    reservationId: z.string().min(1).nullable(),
+    scope: z.string().min(1),
+    status: z.enum(["denied", "pending", "committed", "rolled_back"]),
+    expiresAt: z.string().datetime().nullable(),
+    cost: BudgetAmountSchema,
+    limit: BudgetAmountSchema,
+    committedBefore: BudgetAmountSchema,
+    committedAfter: BudgetAmountSchema,
+    reservedAfter: BudgetAmountSchema,
+});
+export const LedgerAuditContextSchema = z.object({
+    tenant: z.string().min(1).nullable(),
+    agentId: z.string().min(1),
+    humanOwner: z.string().min(1),
+    taskId: z.string().min(1),
+    tool: z.string().min(1),
+    resource: z.string().min(1),
+});
 export const LedgerRecordSchema = z.object({
     schemaVersion: z.literal(LEDGER_SCHEMA_VERSION),
     id: z.string().min(1),
     occurredAt: z.string().datetime(),
+    auditContext: LedgerAuditContextSchema.optional(),
     actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
     payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    provenanceHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
     decision: AxtaryDecisionSchema,
     reasons: z.array(z.string().min(1)),
     policy: PolicyDecisionSchema.shape.policy,
@@ -227,6 +476,8 @@ export const LedgerRecordSchema = z.object({
     executionOutcome: LedgerExecutionOutcomeSchema.optional(),
     traceId: z.string().min(1).optional(),
     actionPassId: z.string().min(1).nullable(),
+    delegation: DelegationLedgerEdgeSchema.optional(),
+    budget: BudgetLedgerEventSchema.optional(),
     correlationId: z.string().min(1).optional(),
     previousLedgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
     ledgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
@@ -358,6 +609,7 @@ export function createApprovalArtifact(input) {
         id: input.id ?? `approval_${randomUUID()}`,
         mode: input.mode,
         approvedBy: input.approvedBy,
+        approverRoles: input.approverRoles,
         approvedAt: (input.approvedAt ?? new Date()).toISOString(),
         actionHash: hashAction(action),
         payloadHash: hashPayload(action.capability.payload),
@@ -374,6 +626,7 @@ export function createApprovalArtifact(input) {
         approval: {
             mode: artifact.mode,
             approvedBy: artifact.approvedBy,
+            approverRoles: artifact.approverRoles,
             approvedAt: artifact.approvedAt,
             approvalArtifact: artifact.id,
             approvalArtifactHash: artifactHash,
@@ -383,6 +636,122 @@ export function createApprovalArtifact(input) {
     };
 }
 export async function issueActionPass(input) {
+    return issueActionPassProfile(input, ACTIONPASS_V0_VERSION);
+}
+export async function issueActionPassV1(input) {
+    const publicJwk = publicOnlyJwk(input.holderPublicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    return (await issueActionPassProfile(input, ACTIONPASS_V1_VERSION, jkt));
+}
+export async function issueActionPassV2(input) {
+    const publicJwk = publicOnlyJwk(input.holderPublicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    return (await issueActionPassProfile(input, ACTIONPASS_V2_VERSION, jkt));
+}
+export async function delegateActionPassV1(input) {
+    const delegationNow = input.now ?? input.parentChain.at(-1)?.currentDate ?? new Date();
+    const verifiedChain = await verifyDelegationChain({
+        chain: input.parentChain,
+        currentDate: delegationNow,
+        revocation: input.revocation,
+    });
+    if (!verifiedChain.valid) {
+        throw new Error(verifiedChain.reason);
+    }
+    const parentClaims = verifiedChain.claims.at(-1);
+    const parentAction = verifiedChain.actions.at(-1);
+    if (!parentClaims || !parentAction) {
+        throw new Error("delegation_parent_required");
+    }
+    const childAction = parseNormalizedAction(input.childAction);
+    if (input.tenant !== parentClaims.tenant) {
+        throw new Error("delegation_scope_broadened");
+    }
+    const attenuationError = validateDelegationAttenuation(parentAction, childAction);
+    if (attenuationError) {
+        throw new Error(attenuationError);
+    }
+    const depth = parentClaims.delegation
+        ? parentClaims.delegation.depth + 1
+        : 1;
+    const rootPassId = parentClaims.delegation?.rootPassId ?? parentClaims.jti;
+    const now = delegationNow;
+    const requestedTtl = input.expiresInSeconds ?? input.childDecision.constraints.expiresInSeconds;
+    const parentRemainingTtl = parentClaims.exp - toNumericDate(now);
+    if (parentRemainingTtl < 1) {
+        throw new Error("delegation_parent_expired");
+    }
+    const issued = await issueActionPassV1({
+        ...input,
+        action: childAction,
+        decision: input.childDecision,
+        holderPublicJwk: input.childHolderPublicJwk,
+        parentPassId: parentClaims.jti,
+        delegation: {
+            depth,
+            rootPassId,
+        },
+        expiresInSeconds: Math.min(requestedTtl, parentRemainingTtl),
+    });
+    const delegation = DelegationLedgerEdgeSchema.parse({
+        parentPassId: parentClaims.jti,
+        childPassId: issued.claims.jti,
+        depth,
+        rootPassId,
+    });
+    return {
+        ...issued,
+        delegation,
+    };
+}
+export async function delegateActionPassV2(input) {
+    const delegationNow = input.now ?? input.parentChain.at(-1)?.currentDate ?? new Date();
+    const verifiedChain = await verifyDelegationChain({
+        chain: input.parentChain,
+        currentDate: delegationNow,
+        revocation: input.revocation,
+    });
+    if (!verifiedChain.valid)
+        throw new Error(verifiedChain.reason);
+    if (verifiedChain.claims.some((claims) => claims.apv !== ACTIONPASS_V2_VERSION)) {
+        throw new Error("delegation_requires_actionpass_v2");
+    }
+    const parentClaims = verifiedChain.claims.at(-1);
+    const parentAction = verifiedChain.actions.at(-1);
+    const childAction = parseNormalizedAction(input.childAction);
+    if (input.tenant !== parentClaims.tenant) {
+        throw new Error("delegation_scope_broadened");
+    }
+    const attenuationError = validateDelegationAttenuation(parentAction, childAction);
+    if (attenuationError)
+        throw new Error(attenuationError);
+    const depth = parentClaims.delegation
+        ? parentClaims.delegation.depth + 1
+        : 1;
+    const rootPassId = parentClaims.delegation?.rootPassId ?? parentClaims.jti;
+    const parentRemainingTtl = parentClaims.exp - toNumericDate(delegationNow);
+    if (parentRemainingTtl < 1)
+        throw new Error("delegation_parent_expired");
+    const requestedTtl = input.expiresInSeconds ?? input.childDecision.constraints.expiresInSeconds;
+    const issued = await issueActionPassV2({
+        ...input,
+        action: childAction,
+        decision: input.childDecision,
+        holderPublicJwk: input.childHolderPublicJwk,
+        parentPassId: parentClaims.jti,
+        delegation: { depth, rootPassId },
+        status: input.childStatus,
+        expiresInSeconds: Math.min(requestedTtl, parentRemainingTtl),
+    });
+    const delegation = DelegationLedgerEdgeSchema.parse({
+        parentPassId: parentClaims.jti,
+        childPassId: issued.claims.jti,
+        depth,
+        rootPassId,
+    });
+    return { ...issued, delegation };
+}
+async function issueActionPassProfile(input, version, holderJkt) {
     const action = parseNormalizedAction(input.action);
     const decision = PolicyDecisionSchema.parse(input.decision);
     if (decision.decision !== "allow") {
@@ -392,7 +761,7 @@ export async function issueActionPass(input) {
     const issuedAt = toNumericDate(now);
     const expiresInSeconds = input.expiresInSeconds ?? decision.constraints.expiresInSeconds;
     const expiresAt = issuedAt + expiresInSeconds;
-    const passId = `ap_${randomUUID()}`;
+    const passId = input.passId ?? `ap_${randomUUID()}`;
     const actionHash = hashAction(action);
     const payloadHash = hashPayload(action.capability.payload);
     const approval = bindApproval({
@@ -404,7 +773,7 @@ export async function issueActionPass(input) {
         now,
     });
     const claims = ActionPassClaimsSchema.parse({
-        apv: ACTIONPASS_VERSION,
+        apv: version,
         iss: input.issuer,
         sub: action.actor.agentId,
         aud: action.capability.resource,
@@ -425,6 +794,19 @@ export async function issueActionPass(input) {
         reasons: decision.reasons,
         policy: decision.policy,
         payloadHash,
+        provenanceHash: action.provenance
+            ? hashProvenance(action.provenance)
+            : undefined,
+        budget: action.budget,
+        cnf: holderJkt ? { jkt: holderJkt } : undefined,
+        delegation: (version === ACTIONPASS_V1_VERSION || version === ACTIONPASS_V2_VERSION) &&
+            "delegation" in input &&
+            input.delegation
+            ? input.delegation
+            : undefined,
+        status: version === ACTIONPASS_V2_VERSION && "status" in input
+            ? input.status
+            : undefined,
         approval,
         audit: {
             traceId: input.traceId ?? `trace_${randomUUID()}`,
@@ -441,7 +823,197 @@ export async function issueActionPass(input) {
         .sign(input.signingKey);
     return { token, claims };
 }
+export async function createDpopProof(input) {
+    const publicJwk = publicOnlyJwk(input.publicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    const claims = DpopProofClaimsSchema.parse({
+        htm: normalizeDpopMethod(input.method),
+        htu: normalizeDpopUri(input.uri),
+        iat: toNumericDate(input.now ?? new Date()),
+        jti: input.proofId ?? `dpop_${randomUUID()}`,
+        ath: computeDpopAccessTokenHash(input.actionPass),
+        nonce: input.nonce,
+    });
+    const proof = await new SignJWT(claims)
+        .setProtectedHeader({
+        alg: input.algorithm ?? DEFAULT_SIGNING_ALGORITHM,
+        typ: DPOP_PROOF_TYP,
+        jwk: publicJwk,
+    })
+        .sign(input.signingKey);
+    return { proof, claims, jkt };
+}
+export class InMemoryDpopReplayStore {
+    entries = new Map();
+    consume(proofId, expiresAt, currentDate = new Date()) {
+        const now = currentDate.getTime();
+        for (const [id, expiry] of this.entries) {
+            if (expiry <= now) {
+                this.entries.delete(id);
+            }
+        }
+        if (this.entries.has(proofId)) {
+            return false;
+        }
+        this.entries.set(proofId, expiresAt.getTime());
+        return true;
+    }
+}
+/**
+ * Durable, inter-process replay store for DPoP proof `jti`s. A proof captured
+ * before a restart stays rejected after restart, for as long as it remains
+ * inside its own time window. Entries live only until their proof expires, so
+ * the on-disk set stays bounded to the in-flight window rather than growing
+ * unboundedly.
+ *
+ * This is a single-file local store, not a cross-host distributed one: it
+ * defends one machine's verifiers (shared across handlers/processes on that
+ * host). Authenticated cross-host distribution is out of scope here.
+ *
+ * Durability mirrors the local ledger: a `proper-lockfile` lease serializes the
+ * read-modify-write so `consume` is atomic across processes, appended lines are
+ * `fsync`ed before the lease releases, and the file is compacted in place once
+ * expired lines outnumber live ones so it cannot grow without bound.
+ */
+export class FileDpopReplayStore {
+    filePath;
+    options;
+    constructor(filePath, options = {}) {
+        this.filePath = filePath;
+        this.options = options;
+    }
+    async consume(proofId, expiresAt, currentDate = new Date()) {
+        await mkdir(dirname(this.filePath), { recursive: true });
+        const release = await this.acquireLock();
+        try {
+            const now = currentDate.getTime();
+            const { live, deadCount } = await this.readLiveEntries(now);
+            if (live.has(proofId)) {
+                return false;
+            }
+            live.set(proofId, expiresAt.getTime());
+            // Compact when expired tombstones dominate, otherwise append O(1). This
+            // keeps the file proportional to the in-flight proof window.
+            if (deadCount > live.size) {
+                await this.compact(live);
+            }
+            else {
+                await this.append({ i: proofId, e: expiresAt.getTime() });
+            }
+            return true;
+        }
+        finally {
+            await release();
+        }
+    }
+    async acquireLock() {
+        const lockOptions = this.options.lock ?? {};
+        let compromisedReason = null;
+        const release = await lock(this.filePath, {
+            realpath: false,
+            lockfilePath: `${this.filePath}.lock`,
+            stale: lockOptions.staleMs ?? 10_000,
+            update: lockOptions.updateMs ?? 5_000,
+            retries: {
+                retries: lockOptions.retries ?? 100,
+                factor: 1.2,
+                minTimeout: lockOptions.minTimeoutMs ?? 10,
+                maxTimeout: lockOptions.maxTimeoutMs ?? 100,
+            },
+            onCompromised: (error) => {
+                compromisedReason = error.message;
+            },
+        });
+        if (compromisedReason !== null) {
+            await release();
+            throw new Error(`dpop_replay_store_lock_compromised:${compromisedReason}`);
+        }
+        return release;
+    }
+    async readLiveEntries(now) {
+        const live = new Map();
+        let deadCount = 0;
+        let text;
+        try {
+            text = await readFile(this.filePath, "utf8");
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ENOENT") {
+                return { live, deadCount };
+            }
+            throw error;
+        }
+        for (const line of text.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                // A torn final line from a crash mid-append is ignored; the lease
+                // holder rewrites a clean file on the next compaction.
+                deadCount += 1;
+                continue;
+            }
+            if (typeof entry?.i !== "string" ||
+                typeof entry?.e !== "number" ||
+                entry.e <= now) {
+                deadCount += 1;
+                continue;
+            }
+            // Last write wins for a repeated id; the older line becomes a tombstone.
+            if (live.has(entry.i)) {
+                deadCount += 1;
+            }
+            live.set(entry.i, entry.e);
+        }
+        return { live, deadCount };
+    }
+    async append(entry) {
+        const handle = await open(this.filePath, "a", 0o600);
+        try {
+            await handle.chmod(0o600);
+            await handle.writeFile(`${JSON.stringify(entry)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async compact(live) {
+        const lines = [...live.entries()]
+            .map(([i, e]) => `${JSON.stringify({ i, e })}\n`)
+            .join("");
+        const tmpPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        let renamed = false;
+        try {
+            const handle = await open(tmpPath, "wx", 0o600);
+            try {
+                await handle.writeFile(lines, "utf8");
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await rename(tmpPath, this.filePath);
+            renamed = true;
+        }
+        finally {
+            if (!renamed) {
+                await rm(tmpPath, { force: true });
+            }
+        }
+    }
+}
 export async function verifyActionPass(input) {
+    return verifyActionPassInternal(input, true);
+}
+export async function verifyActionPassArtifact(input) {
+    return verifyActionPassInternal(input, false);
+}
+async function verifyActionPassInternal(input, requireDpop) {
     try {
         const action = parseNormalizedAction(input.action);
         const verificationKey = await resolveVerificationKey(input);
@@ -461,6 +1033,14 @@ export async function verifyActionPass(input) {
                 reason: bindingError,
             };
         }
+        if ((claims.apv === ACTIONPASS_V1_VERSION ||
+            claims.apv === ACTIONPASS_V2_VERSION) &&
+            requireDpop) {
+            const dpopError = await validateDpopProof(input, claims);
+            if (dpopError) {
+                return { valid: false, reason: dpopError };
+            }
+        }
         const revocationError = await validateRevocation(input, claims);
         if (revocationError) {
             return {
@@ -468,6 +1048,12 @@ export async function verifyActionPass(input) {
                 reason: revocationError,
             };
         }
+        if (claims.apv === ACTIONPASS_V2_VERSION) {
+            const statusError = await validateDistributedStatus(input, claims);
+            if (statusError) {
+                return { valid: false, reason: statusError };
+            }
+        }
         return {
             valid: true,
             claims,
@@ -481,6 +1067,61 @@ export async function verifyActionPass(input) {
         };
     }
 }
+export async function verifyDelegationChain(input) {
+    if (input.chain.length === 0) {
+        return { valid: false, reason: "delegation_parent_required" };
+    }
+    const claims = [];
+    const actions = [];
+    for (let index = 0; index < input.chain.length; index += 1) {
+        const entry = input.chain[index];
+        const revocation = input.revocation;
+        const verified = await verifyActionPassInternal({
+            ...entry,
+            currentDate: input.currentDate ??
+                input.chain.at(-1)?.currentDate ??
+                entry.currentDate,
+            revokedPassIds: revocation?.revokedPassIds ?? entry.revokedPassIds,
+            revocations: revocation?.revocations ?? entry.revocations,
+            isRevoked: revocation?.isRevoked ?? entry.isRevoked,
+            getStatus: revocation?.getStatus ?? entry.getStatus,
+        }, index === input.chain.length - 1);
+        if (!verified.valid) {
+            return verified;
+        }
+        if (verified.claims.apv !== ACTIONPASS_V1_VERSION &&
+            verified.claims.apv !== ACTIONPASS_V2_VERSION) {
+            return { valid: false, reason: "delegation_requires_actionpass_v1" };
+        }
+        const action = parseNormalizedAction(entry.action);
+        const currentClaims = verified.claims;
+        if (index === 0) {
+            if (currentClaims.audit.parentPassId !== null ||
+                currentClaims.delegation !== undefined) {
+                return { valid: false, reason: "delegation_chain_root_invalid" };
+            }
+        }
+        else {
+            const parentClaims = claims[index - 1];
+            const parentAction = actions[index - 1];
+            const expectedDepth = index;
+            const expectedRootPassId = claims[0].jti;
+            if (currentClaims.apv !== parentClaims.apv ||
+                currentClaims.audit.parentPassId !== parentClaims.jti ||
+                currentClaims.delegation?.depth !== expectedDepth ||
+                currentClaims.delegation.rootPassId !== expectedRootPassId) {
+                return { valid: false, reason: "delegation_chain_link_invalid" };
+            }
+            const attenuationError = validateDelegationAttenuation(parentAction, action);
+            if (attenuationError) {
+                return { valid: false, reason: attenuationError };
+            }
+        }
+        claims.push(currentClaims);
+        actions.push(action);
+    }
+    return { valid: true, claims, actions };
+}
 export function revokeActionPass(input) {
     return ActionPassRevocationSchema.parse({
         schemaVersion: ACTIONPASS_REVOCATION_VERSION,
@@ -571,8 +1212,19 @@ export function recordDecision(input) {
         schemaVersion: LEDGER_SCHEMA_VERSION,
         id: `ledger_${randomUUID()}`,
         occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        auditContext: {
+            tenant: action.actor.tenant ?? null,
+            agentId: action.actor.agentId,
+            humanOwner: action.actor.humanOwner,
+            taskId: action.intent.taskId,
+            tool: action.capability.tool,
+            resource: action.capability.resource,
+        },
         actionHash,
         payloadHash,
+        provenanceHash: action.provenance
+            ? hashProvenance(action.provenance)
+            : undefined,
         decision: decision.decision,
         reasons: decision.reasons,
         policy: decision.policy,
@@ -580,6 +1232,12 @@ export function recordDecision(input) {
         executionOutcome: input.executionOutcome,
         traceId,
         actionPassId: input.actionPassId ?? null,
+        delegation: input.delegation
+            ? DelegationLedgerEdgeSchema.parse(input.delegation)
+            : undefined,
+        budget: input.budget
+            ? BudgetLedgerEventSchema.parse(input.budget)
+            : undefined,
         correlationId: input.correlationId ?? undefined,
         previousLedgerHash: input.previousLedgerHash ?? null,
     };
@@ -588,55 +1246,558 @@ export function recordDecision(input) {
         ledgerHash: hashJson(recordWithoutHash),
     });
 }
+/**
+ * Canonical reason token marking a ledger record as the tamper-evident
+ * revocation event for its pass. Matches the forensics `cascade_containment`
+ * convention (spec §9.5) and the trust-store revocation authority (spec §7).
+ */
+export const REVOCATION_LEDGER_REASON = "actionpass_revoked";
+/**
+ * Build a tamper-evident revocation event for a previously recorded pass. The
+ * event is a `deny` record naming the pass with `actionpass_revoked`, reusing
+ * the revoked record's action/payload hashes, policy, and audit context so the
+ * revocation is bound to the exact action it cancels. It carries no delegation
+ * edge or budget event (those describe the original action, not the
+ * revocation). The durable enforcement authority remains the trust store (§7);
+ * this record is the auditable logbook entry, not the enforcement source.
+ */
+export function recordActionPassRevocationEvent(input) {
+    const source = LedgerRecordSchema.parse(input.revokedRecord);
+    if (!source.actionPassId) {
+        throw new Error("revocation_requires_action_pass_id");
+    }
+    const reasons = [REVOCATION_LEDGER_REASON];
+    if (input.revokedBy)
+        reasons.push(`revoked_by:${input.revokedBy}`);
+    if (input.reason)
+        reasons.push(`revocation_reason:${input.reason}`);
+    const recordWithoutHash = {
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        id: `ledger_${randomUUID()}`,
+        occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        auditContext: source.auditContext,
+        actionHash: source.actionHash,
+        payloadHash: source.payloadHash,
+        provenanceHash: source.provenanceHash,
+        decision: "deny",
+        reasons,
+        policy: source.policy,
+        traceId: `trace_${randomUUID()}`,
+        actionPassId: source.actionPassId,
+        correlationId: source.actionPassId,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+    };
+    return LedgerRecordSchema.parse({
+        ...recordWithoutHash,
+        ledgerHash: hashJson(recordWithoutHash),
+    });
+}
 export function hashPayload(payload) {
     return hashJson(JsonValueSchema.parse(payload));
 }
+export function hashProvenance(provenance) {
+    return hashJson(ActionProvenanceSchema.parse(provenance));
+}
+function validateDelegationAttenuation(parent, child) {
+    const parentRemaining = parent.intent.maxDelegationDepth ?? 0;
+    const childRemaining = child.intent.maxDelegationDepth ?? 0;
+    if (parentRemaining < 1 || childRemaining > parentRemaining - 1) {
+        return "delegation_depth_exceeded";
+    }
+    if (child.actor.humanOwner !== parent.actor.humanOwner ||
+        child.actor.tenant !== parent.actor.tenant ||
+        child.intent.taskId !== parent.intent.taskId ||
+        child.capability.tool !== parent.capability.tool ||
+        child.capability.resource !== parent.capability.resource ||
+        stableStringify(child.toolDefinition) !==
+            stableStringify(parent.toolDefinition) ||
+        !isJsonScopeSubset(child.capability.payload, parent.capability.payload, []) ||
+        !areConstraintsAttenuated(parent.capability.constraints, child.capability.constraints)) {
+        return "delegation_scope_broadened";
+    }
+    return null;
+}
+function isJsonScopeSubset(child, parent, path) {
+    if (stableStringify(child) === stableStringify(parent)) {
+        return true;
+    }
+    if (typeof child === "string" && typeof parent === "string") {
+        return isPathLikeKey(path.at(-1)) && isPathInsideScope(child, parent);
+    }
+    if (Array.isArray(child) && Array.isArray(parent)) {
+        return child.every((childEntry) => parent.some((parentEntry) => isJsonScopeSubset(childEntry, parentEntry, path)));
+    }
+    if (isJsonObject(child) && isJsonObject(parent)) {
+        return Object.entries(child).every(([key, value]) => key in parent &&
+            isJsonScopeSubset(value, parent[key], [...path, key]));
+    }
+    return false;
+}
+function areConstraintsAttenuated(parent, child) {
+    if (!parent) {
+        return true;
+    }
+    if (!child) {
+        return false;
+    }
+    return Object.entries(parent).every(([key, value]) => key in child &&
+        stableStringify(child[key]) === stableStringify(value));
+}
+function isPathLikeKey(key) {
+    return Boolean(key && /(path|file|directory|prefix)/i.test(key));
+}
+function isPathInsideScope(child, parent) {
+    if (parent.endsWith("/**")) {
+        const prefix = parent.slice(0, -2);
+        return child.startsWith(prefix);
+    }
+    if (parent.endsWith("/")) {
+        return child.startsWith(parent);
+    }
+    return false;
+}
 export function hashAction(action) {
     return hashJson(parseNormalizedAction(action));
 }
+export const GITHUB_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "github",
+    connector: "github-rest",
+    mode: "rest",
+    configSchema: GitHubNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_GITHUB_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: [
+        "contents:write",
+        "metadata:read",
+        "pull_requests:write",
+        "checks:write",
+        "issues:write",
+    ],
+    smokeCheck: "GET /user + X-Accepted-GitHub-Permissions",
+    tools: [
+        {
+            capability: {
+                id: "github-pr-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create pull request",
+                tool: "github.pull_requests.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "title",
+                    "baseBranch",
+                    "filesChanged",
+                    "testsPassed",
+                    "touchesProduction",
+                ],
+                approvalTriggers: [
+                    "protected path",
+                    "production impact",
+                    "base branch mismatch",
+                    "missing tests",
+                    "large file set",
+                ],
+                credentialBoundary: "GitHub token stays in the proxy/adapter; the agent receives an ActionPass-bound result.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubPullRequestEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-content-read",
+                provider: "github",
+                connector: "github-rest",
+                label: "Read repository content",
+                tool: "github.contents.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["path", "ref"],
+                approvalTriggers: ["denied secret or production path"],
+                credentialBoundary: "Repository content is fetched by the adapter after policy checks deny protected paths.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubContentEvidence(action, payload, "content_read"),
+        },
+        {
+            capability: {
+                id: "github-branch-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create branch",
+                tool: "github.branches.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["branch", "baseBranch", "sha", "allowExisting"],
+                approvalTriggers: ["base branch mismatch"],
+                credentialBoundary: "Branch creation runs through the proxy and is bound to the same ActionPass verification path.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubBranchEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-content-write",
+                provider: "github",
+                connector: "github-rest",
+                label: "Write repository content",
+                tool: "github.contents.write",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: ["path", "branch", "message", "sha", "content"],
+                approvalTriggers: ["protected path"],
+                credentialBoundary: "File content is never written until policy and ActionPass verification both pass.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubContentEvidence(action, payload, "content_write"),
+        },
+        {
+            capability: {
+                id: "github-review-comment-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create inline review comment",
+                tool: "github.pull_request_review_comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "pullNumber",
+                    "body",
+                    "commitId",
+                    "path",
+                    "line",
+                    "side",
+                ],
+                approvalTriggers: ["protected path review"],
+                credentialBoundary: "The exact inline comment target and body are authorized before GitHub receives the write.",
+                smokeCheck: "GET /user + Pull requests: write",
+            },
+            normalizeEvidence: (action, payload) => githubReviewCommentEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-check-run-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create check run",
+                tool: "github.check_runs.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: [
+                    "name",
+                    "headSha",
+                    "status",
+                    "conclusion",
+                    "output",
+                ],
+                approvalTriggers: [],
+                credentialBoundary: "Check name, commit SHA, status, conclusion, and output are payload-bound before execution.",
+                smokeCheck: "GET /user + Checks: write",
+            },
+            normalizeEvidence: (action, payload) => githubCheckRunEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-issue-comment-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create issue comment",
+                tool: "github.issue_comments.create",
+                operation: "external_message",
+                status: "supported",
+                supportedModes: ["rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueNumber", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "The exact issue number and outbound comment body are bound into the ActionPass.",
+                smokeCheck: "GET /user + Issues: write",
+            },
+            normalizeEvidence: (action, payload) => githubIssueCommentEvidence(action, payload),
+        },
+    ],
+};
+export const LINEAR_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "linear",
+    connector: "linear-graphql",
+    mode: "graphql",
+    configSchema: LinearNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_LINEAR_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["read", "write"],
+    smokeCheck: "viewer",
+    tools: [
+        {
+            capability: {
+                id: "linear-issue-read",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Read issue",
+                tool: "linear.issues.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey"],
+                approvalTriggers: [],
+                credentialBoundary: "Linear API key stays adapter-side; policy pins issue access by project key.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "issue_read"),
+        },
+        {
+            capability: {
+                id: "linear-comment-create",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Create issue comment",
+                tool: "linear.comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "Linear comments execute only through proxy policy and ActionPass verification.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "comment_create"),
+        },
+        {
+            capability: {
+                id: "linear-issue-update",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Update issue",
+                tool: "linear.issues.update",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "issueKey",
+                    "projectKey",
+                    "status",
+                    "title",
+                    "description",
+                    "priority",
+                ],
+                approvalTriggers: ["protected status"],
+                credentialBoundary: "Issue mutations stay behind adapter credentials and project/status policy checks.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "issue_update"),
+        },
+    ],
+};
+export const JIRA_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "jira",
+    connector: "jira-rest",
+    mode: "rest",
+    configSchema: JiraNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_JIRA_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["read:jira-work", "write:jira-work"],
+    smokeCheck: "GET /myself",
+    tools: [
+        {
+            capability: {
+                id: "jira-issue-read",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Read issue",
+                tool: "jira.issues.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey"],
+                approvalTriggers: [],
+                credentialBoundary: "Jira credentials stay adapter-side; policy pins issue access by project key.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "issue_read"),
+        },
+        {
+            capability: {
+                id: "jira-comment-create",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Create issue comment",
+                tool: "jira.comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "Jira comments are converted to Atlassian Document Format only after policy and ActionPass verification.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "comment_create"),
+        },
+        {
+            capability: {
+                id: "jira-issue-update",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Update issue",
+                tool: "jira.issues.update",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "issueKey",
+                    "projectKey",
+                    "status",
+                    "title",
+                    "description",
+                    "priorityId",
+                ],
+                approvalTriggers: ["protected status"],
+                credentialBoundary: "Jira field edits and workflow transitions execute only after exact-payload authorization.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "issue_update"),
+        },
+    ],
+};
+export const POSTGRES_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "postgres",
+    connector: "postgres-native",
+    mode: "postgres",
+    configSchema: PostgresNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_POSTGRES_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: [
+        "LOGIN role",
+        "SELECT on allowed tables",
+        "NOBYPASSRLS",
+        "read-only transactions",
+    ],
+    smokeCheck: "SELECT current_database/current_user + transaction_read_only + table RLS metadata",
+    tools: [
+        {
+            capability: {
+                id: "postgres-query-select",
+                provider: "postgres",
+                connector: "postgres-native",
+                label: "Run scoped SELECT",
+                tool: "postgres.query.select",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["postgres"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["statement", "parameters", "maxRows"],
+                approvalTriggers: ["unpredicated table scan"],
+                credentialBoundary: "The DSN stays in the local adapter; only the exact parameterized SELECT and bounded result cross the authorization boundary.",
+                smokeCheck: "current role/database, read-only state, and RLS metadata for configured tables",
+            },
+            normalizeEvidence: (action, payload) => postgresSelectEvidence(action, payload),
+        },
+    ],
+};
+export const DRIVE_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "drive",
+    connector: "google-drive-rest",
+    mode: "rest",
+    configSchema: DriveNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_DRIVE_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["https://www.googleapis.com/auth/drive.file"],
+    smokeCheck: "GET selected file metadata including isAppAuthorized (no content)",
+    tools: [
+        {
+            capability: {
+                id: "drive-file-read",
+                provider: "drive",
+                connector: "google-drive-rest",
+                label: "Read selected Drive file",
+                tool: "drive.files.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["rest"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["fileId", "maxBytes"],
+                approvalTriggers: [
+                    "file not policy-scoped",
+                    "file not selected through Google Picker",
+                    "byte limit exceeded",
+                ],
+                credentialBoundary: "The OAuth token and file content stay in the local enforcement plane; only a Picker-authorized, policy-scoped file can be returned.",
+                smokeCheck: "selected-file metadata and provider isAppAuthorized state",
+            },
+            normalizeEvidence: (action, payload) => driveFileReadEvidence(action, payload),
+        },
+    ],
+};
+export const NATIVE_CONNECTOR_GOVERNANCE_REGISTRY = [
+    GITHUB_NATIVE_CONNECTOR_GOVERNANCE,
+    LINEAR_NATIVE_CONNECTOR_GOVERNANCE,
+    JIRA_NATIVE_CONNECTOR_GOVERNANCE,
+    POSTGRES_NATIVE_CONNECTOR_GOVERNANCE,
+    DRIVE_NATIVE_CONNECTOR_GOVERNANCE,
+];
+const providerEvidenceNormalizers = new Map([
+    [
+        "slack.chat.postMessage",
+        (action, payload) => slackMessageEvidence(action, payload),
+    ],
+    [
+        "docs.documents.search",
+        (action, payload) => docsEvidence(action, payload, "document_search"),
+    ],
+    [
+        "docs.documents.read",
+        (action, payload) => docsEvidence(action, payload, "document_read"),
+    ],
+    ["mcp.tool.call", (action, payload) => mcpEvidence(action, payload)],
+    [
+        "aws.identity.get",
+        (action, payload) => awsEvidence(action, payload, "identity_get"),
+    ],
+    [
+        "aws.s3.objects.list",
+        (action, payload) => awsEvidence(action, payload, "s3_objects_list"),
+    ],
+    [
+        "gcp.projects.get",
+        (action, payload) => gcpEvidence(action, payload, "project_get"),
+    ],
+    [
+        "gcp.storage.objects.list",
+        (action, payload) => gcpEvidence(action, payload, "storage_objects_list"),
+    ],
+    ...NATIVE_CONNECTOR_GOVERNANCE_REGISTRY.flatMap((descriptor) => descriptor.tools.map((tool) => [
+        tool.capability.tool,
+        tool.normalizeEvidence,
+    ])),
+]);
 export function providerEvidenceForAction(actionInput) {
     const action = parseNormalizedAction(actionInput);
-    const payload = action.capability.payload;
-    switch (action.capability.tool) {
-        case "github.pull_requests.create":
-            return githubPullRequestEvidence(action, payload);
-        case "github.contents.read":
-            return githubContentEvidence(action, payload, "content_read");
-        case "github.contents.write":
-            return githubContentEvidence(action, payload, "content_write");
-        case "github.branches.create":
-            return githubBranchEvidence(action, payload);
-        case "slack.chat.postMessage":
-            return slackMessageEvidence(action, payload);
-        case "linear.issues.read":
-            return linearIssueEvidence(action, payload, "issue_read");
-        case "linear.comments.create":
-            return linearIssueEvidence(action, payload, "comment_create");
-        case "linear.issues.update":
-            return linearIssueEvidence(action, payload, "issue_update");
-        case "jira.issues.read":
-            return issueTrackerEvidence(action, payload, "jira", "issue_read");
-        case "jira.comments.create":
-            return issueTrackerEvidence(action, payload, "jira", "comment_create");
-        case "jira.issues.update":
-            return issueTrackerEvidence(action, payload, "jira", "issue_update");
-        case "docs.documents.search":
-            return docsEvidence(action, payload, "document_search");
-        case "docs.documents.read":
-            return docsEvidence(action, payload, "document_read");
-        case "mcp.tool.call":
-            return mcpEvidence(action, payload);
-        case "aws.identity.get":
-            return awsEvidence(action, payload, "identity_get");
-        case "aws.s3.objects.list":
-            return awsEvidence(action, payload, "s3_objects_list");
-        case "gcp.projects.get":
-            return gcpEvidence(action, payload, "project_get");
-        case "gcp.storage.objects.list":
-            return gcpEvidence(action, payload, "storage_objects_list");
-        default:
-            return undefined;
-    }
+    return providerEvidenceNormalizers.get(action.capability.tool)?.(action, action.capability.payload);
 }
 export function hashJson(value) {
     return `sha256:${createHash("sha256")
@@ -659,15 +1820,33 @@ function validatePassBinding(claims, action, payloadHash) {
     if (claims.intent.taskId !== action.intent.taskId) {
         return "task_id_mismatch";
     }
+    if (stableStringify(claims.intent) !== stableStringify(action.intent)) {
+        return "intent_mismatch";
+    }
     if (claims.capability.tool !== action.capability.tool) {
         return "tool_mismatch";
     }
     if (claims.capability.resource !== action.capability.resource) {
         return "resource_mismatch";
     }
+    if (stableStringify(claims.capability.constraints) !==
+        stableStringify(action.capability.constraints)) {
+        return "constraints_mismatch";
+    }
+    if (stableStringify(claims.budget) !== stableStringify(action.budget)) {
+        return "budget_mismatch";
+    }
     if (claims.payloadHash !== payloadHash) {
         return "payload_hash_mismatch";
     }
+    const provenanceHash = action.provenance
+        ? hashProvenance(action.provenance)
+        : undefined;
+    if (claims.provenanceHash !== provenanceHash) {
+        return action.provenance
+            ? "provenance_hash_mismatch"
+            : "unexpected_provenance_hash";
+    }
     if (claims.approval?.payloadHash && claims.approval.payloadHash !== payloadHash) {
         return "approval_payload_hash_mismatch";
     }
@@ -676,6 +1855,100 @@ function validatePassBinding(claims, action, payloadHash) {
     }
     return null;
 }
+async function validateDpopProof(input, claims) {
+    if (!input.dpopProof)
+        return "dpop_proof_required";
+    if (!input.dpopMethod)
+        return "dpop_method_required";
+    if (!input.dpopUri)
+        return "dpop_uri_required";
+    try {
+        const header = decodeProtectedHeader(input.dpopProof);
+        if (header.typ !== DPOP_PROOF_TYP)
+            return "dpop_type_mismatch";
+        if (!header.jwk || typeof header.jwk !== "object") {
+            return "dpop_public_jwk_required";
+        }
+        const proofJwk = publicOnlyJwk(header.jwk);
+        const algorithm = header.alg;
+        const algorithms = input.dpopAlgorithms ?? [DEFAULT_SIGNING_ALGORITHM];
+        if (!algorithms.includes(algorithm))
+            return "dpop_algorithm_not_allowed";
+        const key = await importJWK(proofJwk, algorithm);
+        const { payload } = await jwtVerify(input.dpopProof, key, {
+            algorithms,
+            currentDate: input.currentDate,
+        });
+        const proof = DpopProofClaimsSchema.parse(payload);
+        const proofJkt = await calculateJwkThumbprint(proofJwk, "sha256");
+        if (proofJkt !== claims.cnf.jkt)
+            return "dpop_key_mismatch";
+        if (proof.htm !== normalizeDpopMethod(input.dpopMethod)) {
+            return "dpop_method_mismatch";
+        }
+        if (proof.htu !== normalizeDpopUri(input.dpopUri)) {
+            return "dpop_uri_mismatch";
+        }
+        if (proof.ath !== computeDpopAccessTokenHash(input.token)) {
+            return "dpop_actionpass_hash_mismatch";
+        }
+        if (input.dpopNonce !== undefined && proof.nonce !== input.dpopNonce) {
+            return "dpop_nonce_mismatch";
+        }
+        const nowSeconds = toNumericDate(input.currentDate ?? new Date());
+        const maxAge = input.dpopMaxAgeSeconds ?? DEFAULT_DPOP_MAX_AGE_SECONDS;
+        const skew = input.dpopClockSkewSeconds ?? DEFAULT_DPOP_CLOCK_SKEW_SECONDS;
+        if (proof.iat > nowSeconds + skew)
+            return "dpop_proof_from_future";
+        if (proof.iat < nowSeconds - maxAge - skew)
+            return "dpop_proof_stale";
+        if (!input.dpopReplayStore)
+            return "dpop_replay_store_required";
+        const accepted = await input.dpopReplayStore.consume(proof.jti, new Date((proof.iat + maxAge + skew) * 1000), input.currentDate);
+        if (!accepted)
+            return "dpop_replay_detected";
+        return null;
+    }
+    catch (error) {
+        return error instanceof Error && error.message.startsWith("dpop_")
+            ? error.message
+            : "dpop_proof_invalid";
+    }
+}
+export function computeDpopAccessTokenHash(token) {
+    return createHash("sha256").update(token, "ascii").digest("base64url");
+}
+export function normalizeDpopMethod(method) {
+    const normalized = method.trim().toUpperCase();
+    if (!normalized)
+        throw new Error("dpop_method_required");
+    return normalized;
+}
+export function normalizeDpopUri(uri) {
+    const parsed = new URL(uri);
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+}
+export function actionPassDpopTarget(actionInput) {
+    const action = parseNormalizedAction(actionInput);
+    return {
+        method: "POST",
+        uri: `https://local.axtary.dev/actions/${encodeURIComponent(action.capability.tool)}`,
+    };
+}
+function publicOnlyJwk(jwk) {
+    if (!jwk.kty || jwk.kty === "oct") {
+        throw new Error("dpop_public_jwk_invalid");
+    }
+    const publicJwk = { ...jwk };
+    for (const member of ["d", "p", "q", "dp", "dq", "qi", "oth", "k"]) {
+        if (member in publicJwk) {
+            throw new Error("dpop_public_jwk_invalid");
+        }
+    }
+    return publicJwk;
+}
 async function readTrustStore(filePath) {
     const text = await readTrustStoreFile(filePath);
     if (!text.trim()) {
@@ -691,6 +1964,7 @@ async function writeTrustStore(filePath, data) {
     await writeFile(tmpPath, `${JSON.stringify(data, null, 2)}\n`, {
         encoding: "utf8",
         flag: "wx",
+        mode: 0o600,
     });
     await rename(tmpPath, filePath);
 }
@@ -752,7 +2026,13 @@ async function validateRevocation(input, claims) {
         }
     }
     if (input.isRevoked) {
-        const result = await input.isRevoked(claims);
+        let result;
+        try {
+            result = await input.isRevoked(claims);
+        }
+        catch {
+            return "actionpass_revocation_check_failed";
+        }
         if (result === true) {
             return "actionpass_revoked";
         }
@@ -762,6 +2042,27 @@ async function validateRevocation(input, claims) {
     }
     return null;
 }
+async function validateDistributedStatus(input, claims) {
+    if (!input.getStatus) {
+        return "actionpass_status_check_required";
+    }
+    let status;
+    try {
+        status = await input.getStatus(claims);
+    }
+    catch {
+        return "actionpass_status_check_failed";
+    }
+    if (status === 0)
+        return null;
+    if (status === 1)
+        return "actionpass_revoked";
+    if (status === 2)
+        return "actionpass_suspended";
+    if (typeof status === "string" && status.length > 0)
+        return status;
+    return "actionpass_status_invalid";
+}
 function bindApproval(input) {
     const approval = input.approval
         ? ApprovalSchema.parse(input.approval)
@@ -803,6 +2104,7 @@ function bindApproval(input) {
     return ApprovalSchema.parse({
         mode: approval?.mode ?? artifact.mode,
         approvedBy: approval?.approvedBy ?? artifact.approvedBy,
+        approverRoles: approval?.approverRoles ?? artifact.approverRoles,
         approvedAt: approval?.approvedAt ?? artifact.approvedAt,
         approvalArtifact: approval?.approvalArtifact ?? artifact.id,
         approvalArtifactHash: artifactHash,
@@ -813,12 +2115,16 @@ function bindApproval(input) {
 export function validateApprovalArtifact(artifactInput, actionInput, now = new Date()) {
     const artifact = ApprovalArtifactSchema.parse(artifactInput);
     const action = parseNormalizedAction(actionInput);
-    if (artifact.actionHash !== hashAction(action)) {
-        return "approval_action_hash_mismatch";
-    }
+    // Payload before action: a swapped payload changes both hashes, and the
+    // payload mismatch is the precise, demoable reason. Matches the verify-time
+    // claim order and spec §6; the action-hash check still catches every
+    // non-payload mutation.
     if (artifact.payloadHash !== hashPayload(action.capability.payload)) {
         return "approval_payload_hash_mismatch";
     }
+    if (artifact.actionHash !== hashAction(action)) {
+        return "approval_action_hash_mismatch";
+    }
     if (artifact.taskId !== action.intent.taskId) {
         return "approval_task_id_mismatch";
     }
@@ -913,6 +2219,103 @@ function githubBranchEvidence(action, payload) {
         }),
     });
 }
+function githubReviewCommentEvidence(action, payload) {
+    const path = getString(payload.path) ?? "unknown";
+    const pullNumber = getNumber(payload.pullNumber);
+    const line = getNumber(payload.line);
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "pull_request_review_comment_create",
+        resource: providerResource("github", "pull_request_line", `${action.capability.resource}:pull:${pullNumber ?? "unknown"}:${path}:${line ?? "unknown"}`),
+        normalized: compactJsonRecord({
+            pullNumber,
+            commitId: getString(payload.commitId),
+            path,
+            line,
+            side: getString(payload.side),
+            startLine: getNumber(payload.startLine),
+            startSide: getString(payload.startSide),
+            body: redactCredentialLikeText(getString(payload.body) ?? ""),
+        }),
+    });
+}
+function githubCheckRunEvidence(action, payload) {
+    const name = getString(payload.name) ?? "unknown";
+    const headSha = getString(payload.headSha) ?? "unknown";
+    const output = isJsonObject(payload.output) ? payload.output : {};
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "check_run_create",
+        resource: providerResource("github", "commit", `${action.capability.resource}:${headSha}`, name),
+        normalized: compactJsonRecord({
+            name,
+            headSha,
+            status: getString(payload.status),
+            conclusion: getString(payload.conclusion),
+            detailsUrl: getString(payload.detailsUrl),
+            externalId: getString(payload.externalId),
+            outputTitle: getString(output.title),
+            outputSummary: redactCredentialLikeText(getString(output.summary) ?? ""),
+        }),
+    });
+}
+function githubIssueCommentEvidence(action, payload) {
+    const issueNumber = getNumber(payload.issueNumber);
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "issue_comment_create",
+        resource: providerResource("github", "issue", `${action.capability.resource}:issue:${issueNumber ?? "unknown"}`),
+        normalized: compactJsonRecord({
+            issueNumber,
+            body: redactCredentialLikeText(getString(payload.body) ?? ""),
+        }),
+    });
+}
+function postgresSelectEvidence(action, payload) {
+    const statement = typeof payload.statement === "string" ? payload.statement : "";
+    const analysis = analyzePostgresSelect(statement);
+    const parameters = Array.isArray(payload.parameters) ? payload.parameters : [];
+    const maxRows = typeof payload.maxRows === "number" && Number.isInteger(payload.maxRows)
+        ? payload.maxRows
+        : null;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "postgres",
+        tool: action.capability.tool,
+        operation: "query_select",
+        resource: providerResource("postgres", "database", action.capability.resource),
+        normalized: {
+            statementHash: analysis.ok ? analysis.analysis.statementHash : null,
+            predicateHash: analysis.ok ? analysis.analysis.predicateHash : null,
+            tables: analysis.ok ? analysis.analysis.tables : [],
+            functions: analysis.ok ? analysis.analysis.functions : [],
+            parameterCount: analysis.ok ? analysis.analysis.parameterCount : 0,
+            parameterHash: hashPayload(parameters),
+            maxRows,
+        },
+    });
+}
+function driveFileReadEvidence(action, payload) {
+    const fileId = getString(payload.fileId) ?? "unknown";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "drive",
+        tool: action.capability.tool,
+        operation: "file_read",
+        resource: providerResource("drive", "file", `drive:file:${fileId}`, fileId),
+        normalized: compactJsonRecord({
+            fileId,
+            scope: "https://www.googleapis.com/auth/drive.file",
+            maxBytes: getNumber(payload.maxBytes),
+        }),
+    });
+}
 function slackMessageEvidence(action, payload) {
     const channel = getString(payload.channel) ?? "unknown";
     const message = getString(payload.text) ?? getString(payload.message) ?? "";
@@ -937,9 +2340,6 @@ function slackMessageEvidence(action, payload) {
         }),
     });
 }
-function linearIssueEvidence(action, payload, operation) {
-    return issueTrackerEvidence(action, payload, "linear", operation);
-}
 function issueTrackerEvidence(action, payload, provider, operation) {
     const issueKey = getString(payload.issueKey) ?? getString(payload.issueId) ?? "unknown";
     const projectKey = getString(payload.projectKey) ?? issueKey.split("-", 1)[0];
@@ -956,11 +2356,12 @@ function issueTrackerEvidence(action, payload, provider, operation) {
             status: getString(payload.status),
             stateId: getString(payload.stateId),
             priority: getNumber(payload.priority),
+            priorityId: getString(payload.priorityId),
             commentBody: operation === "comment_create"
                 ? redactCredentialLikeText(getString(payload.body) ?? "")
                 : null,
         }),
-        fieldChanges: linearFieldChanges(payload),
+        fieldChanges: issueTrackerFieldChanges(payload),
     });
 }
 function docsEvidence(action, payload, operation) {
@@ -1089,13 +2490,14 @@ function changedFilesFromPayload(payload) {
         .filter((path) => Boolean(path));
     return [...new Set([...getStringArray(payload.filesChanged), ...changes])];
 }
-function linearFieldChanges(payload) {
+function issueTrackerFieldChanges(payload) {
     return [
         fieldChange("title", payload.fromTitle, payload.title),
         fieldChange("description", payload.fromDescription, payload.description),
         fieldChange("status", payload.fromStatus, payload.status),
         fieldChange("stateId", payload.fromStateId, payload.stateId),
         fieldChange("priority", payload.fromPriority, payload.priority),
+        fieldChange("priorityId", payload.fromPriorityId, payload.priorityId),
     ].filter((change) => change !== null);
 }
 function fieldChange(field, before, after) {
@@ -1187,7 +2589,9 @@ function canonicalize(value) {
     if (isPlainObject(value)) {
         return Object.fromEntries(Object.entries(value)
             .filter(([, entryValue]) => entryValue !== undefined)
-            .sort(([left], [right]) => left.localeCompare(right))
+            // UTF-16 code unit order per RFC 8785 (JCS); locale-sensitive sorts
+            // would make hashes non-portable across environments.
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
             .map(([key, entryValue]) => [key, canonicalize(entryValue)]));
     }
     return value;
@@ -1201,4 +2605,262 @@ function isPlainObject(value) {
 function isNodeError(error) {
     return error instanceof Error && "code" in error;
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// SDK facade (PRD §8.2)
+//
+// The ergonomic developer entry point. It exposes the five PRD verbs —
+// `authorize`, `verify`, `record`, `revoke`, `explain` — over a flat request
+// shape and delegates to the tested core functions above. It adds no new
+// authorization logic and changes no token/ledger/policy shape; it only maps the
+// flat request to a NormalizedAction, threads a local hash-linked ledger head,
+// and promotes the deterministic reason prose (`explainDecision`).
+//
+// Keys: if no signing key is configured, the facade resolves a persistent dev
+// keypair (`devKeypair()` — env-backed or a 0600 local keyring file) so the
+// quickstart runs with zero key plumbing and its passes verify across process
+// restarts. Configure { signingKey, verificationKey } (or a hosted issuer) for
+// production.
+// ─────────────────────────────────────────────────────────────────────────────
+export const AXTARY_DEFAULT_ISSUER = "axtary-dev";
+export const AXTARY_DEFAULT_TENANT = "local";
+export const AXTARY_DEFAULT_RUNTIME = "sdk";
+function isNormalizedActionShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "actor" in value &&
+        "capability" in value &&
+        "intent" in value);
+}
+function isAuthorizeResultShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "action" in value &&
+        "decision" in value &&
+        typeof value.decision === "object");
+}
+function isAxtaryPassShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "token" in value &&
+        "claims" in value);
+}
+export class Axtary {
+    issuer;
+    tenant;
+    runtime;
+    defaultPolicy;
+    algorithm;
+    quiet;
+    configuredSigningKey;
+    configuredKeyId;
+    configuredVerificationKey;
+    keyPath;
+    signerPromise;
+    ledgerHead = null;
+    revocations = new Map();
+    constructor(config = {}) {
+        this.issuer = config.issuer ?? AXTARY_DEFAULT_ISSUER;
+        this.tenant = config.tenant ?? AXTARY_DEFAULT_TENANT;
+        this.runtime = config.runtime ?? AXTARY_DEFAULT_RUNTIME;
+        this.defaultPolicy = config.policy;
+        this.algorithm = config.algorithm ?? DEFAULT_SIGNING_ALGORITHM;
+        this.quiet = config.quiet ?? false;
+        this.configuredSigningKey = config.signingKey;
+        this.configuredKeyId = config.signingKeyId;
+        this.configuredVerificationKey = config.verificationKey;
+        this.keyPath = config.keyPath;
+    }
+    /** Current local ledger head (hash of the last record this instance wrote). */
+    get ledgerHash() {
+        return this.ledgerHead;
+    }
+    async resolveSigner() {
+        if (!this.signerPromise) {
+            this.signerPromise = (async () => {
+                if (this.configuredSigningKey) {
+                    return {
+                        signingKey: this.configuredSigningKey,
+                        keyId: this.configuredKeyId,
+                        verificationKey: this.configuredVerificationKey,
+                        algorithm: this.algorithm,
+                    };
+                }
+                const dev = await devKeypair({ path: this.keyPath });
+                if (!this.quiet) {
+                    const origin = dev.source === "env"
+                        ? `from ${AXTARY_DEV_SIGNING_KEY_ENV}`
+                        : `at ${dev.path}`;
+                    console.warn("[axtary] No signing key configured — issuing ActionPasses with a " +
+                        `persistent local dev key (${origin}). These passes verify across ` +
+                        "process restarts on this machine. Pass { signingKey, " +
+                        "verificationKey } to createAxtary() (or use a hosted issuer) for " +
+                        "production.");
+                }
+                return {
+                    signingKey: dev.signingKey,
+                    keyId: dev.signingKeyId,
+                    verificationKey: dev.verificationKey,
+                    algorithm: dev.algorithm,
+                };
+            })();
+        }
+        return this.signerPromise;
+    }
+    toNormalizedAction(request) {
+        if (isNormalizedActionShape(request)) {
+            return parseNormalizedAction(request);
+        }
+        return parseNormalizedAction({
+            schemaVersion: ACTION_SCHEMA_VERSION,
+            actor: {
+                agentId: request.agent,
+                humanOwner: request.human,
+                runtime: request.runtime ?? this.runtime,
+                tenant: request.tenant ?? this.tenant,
+            },
+            intent: {
+                taskId: request.task ?? `task_${randomUUID()}`,
+                declaredGoal: request.intent,
+                maxDelegationDepth: request.maxDelegationDepth,
+            },
+            capability: {
+                tool: request.tool,
+                resource: request.resource,
+                payload: request.payload ?? {},
+                constraints: request.constraints,
+            },
+            toolDefinition: request.toolDefinition,
+            provenance: request.provenance,
+            budget: request.budget,
+        });
+    }
+    /**
+     * Decide an action and, for an allow, issue an ActionPass. Always returns a
+     * decision (the policy evaluation is keyless); a deny/step-up returns
+     * `pass: null`. Threads the local ledger head so successive calls chain.
+     */
+    async authorize(request, options = {}) {
+        const signer = await this.resolveSigner();
+        const action = this.toNormalizedAction(request);
+        const result = await authorize({
+            action,
+            issuer: this.issuer,
+            tenant: this.tenant,
+            signingKey: signer.signingKey,
+            keyId: signer.keyId,
+            algorithm: signer.algorithm,
+            policy: options.policy ?? this.defaultPolicy,
+            approval: options.approval,
+            approvalArtifact: options.approvalArtifact,
+            previousLedgerHash: this.ledgerHead,
+            now: options.now,
+        });
+        this.ledgerHead = result.ledger.ledgerHash;
+        return {
+            status: result.decision.decision,
+            decision: result.decision,
+            reasons: result.decision.reasons,
+            explanation: explainDecision(result.decision),
+            payloadHash: result.payloadHash,
+            action: result.action,
+            pass: result.actionPass,
+            ledger: result.ledger,
+        };
+    }
+    /**
+     * Verify a previously issued pass against an action. Accepts an authorize
+     * result, a pass object, or a raw token; the action defaults to the result's
+     * action when one is supplied. Fails closed for a pass this instance revoked.
+     */
+    async verify(pass, action) {
+        let token;
+        let actionInput = action;
+        if (typeof pass === "string") {
+            token = pass;
+        }
+        else if (isAuthorizeResultShape(pass)) {
+            token = pass.pass?.token ?? null;
+            actionInput = actionInput ?? pass.action;
+        }
+        else if (isAxtaryPassShape(pass)) {
+            token = pass.token;
+        }
+        else {
+            token = null;
+        }
+        if (!token) {
+            return { valid: false, reason: "actionpass_not_issued" };
+        }
+        if (!actionInput) {
+            return { valid: false, reason: "verify_requires_action" };
+        }
+        const signer = await this.resolveSigner();
+        if (!signer.verificationKey) {
+            return { valid: false, reason: "verification_key_required" };
+        }
+        return verifyActionPass({
+            token,
+            action: this.toNormalizedAction(actionInput),
+            verificationKey: signer.verificationKey,
+            issuer: this.issuer,
+            algorithms: [signer.algorithm],
+            revocations: this.revocations.values(),
+        });
+    }
+    /**
+     * Append an execution result to the local ledger, chained after the decision
+     * record from `authorize`. Returns the tamper-evident record; durable
+     * persistence is the proxy/CLI's responsibility.
+     */
+    record(input) {
+        const action = this.toNormalizedAction(input.action);
+        const passId = typeof input.pass === "string"
+            ? input.pass
+            : (input.pass?.claims.jti ?? null);
+        const executionOutcome = input.outcome
+            ? LedgerExecutionOutcomeSchema.parse({
+                schemaVersion: LEDGER_EXECUTION_OUTCOME_VERSION,
+                ...input.outcome,
+            })
+            : undefined;
+        const record = recordDecision({
+            action,
+            decision: input.decision,
+            actionPassId: passId,
+            executionOutcome,
+            previousLedgerHash: input.previousLedgerHash ?? this.ledgerHead,
+            correlationId: input.correlationId ?? passId,
+        });
+        this.ledgerHead = record.ledgerHash;
+        return record;
+    }
+    /**
+     * Revoke a pass by id. The revocation is held in this instance so a later
+     * `verify` of that pass fails closed. Durable cross-process revocation is the
+     * CLI/trust-store path (`axtary revoke`).
+     */
+    revoke(passId, options = {}) {
+        const revocation = revokeActionPass({
+            passId,
+            revokedBy: options.revokedBy,
+            reason: options.reason,
+            revokedAt: options.revokedAt,
+        });
+        this.revocations.set(passId, revocation);
+        return revocation;
+    }
+    /** Deterministic, human-readable explanation of a decision (no model call). */
+    explain(decision) {
+        const policyDecision = isAuthorizeResultShape(decision)
+            ? decision.decision
+            : decision;
+        return explainDecision(policyDecision);
+    }
+}
+/** Create an Axtary SDK instance. */
+export function createAxtary(config = {}) {
+    return new Axtary(config);
+}
+/** Default Axtary SDK instance (PRD §8.2 `import { axtary }`). */
+export const axtary = createAxtary();
 //# sourceMappingURL=index.js.map