@coderifts/agent-guard 9.5.0 → 9.6.0

package/README.md

@@ -250,6 +250,41 @@ const { tools, registry_report, composition_assurance, receipt_thread } = withCo
 // register ONLY `tools`. Receipt carry-forward is default-on (`receipt_thread`).
 ```
 
+### Native execution grant (`executionGrant`, 9.6.0)
+
+`withCodeRifts` 9.5.0 could not request a grant: its authorize sent four
+fields and the factory received `decision_result`, so a top-level
+`execution_grant` was dropped. The interim app-side wrap
+(`withExecutionGrantClient` / `takeGrant()`) worked but was **last-authorize**
+— overlapping tool calls could hand a tool the wrong grant.
+
+9.6.0 closes that natively. Default **OFF** (absent config is byte-identical
+to 9.5.0). A host on 9.6.0 does **not** need `withExecutionGrantClient`.
+
+```typescript
+const { tools } = withCodeRifts({
+  tools: rawTools, // execute(args, { execution_grant }) — 2nd arg is THIS call's grant
+  client,
+  operation: 'merge',
+  executionGrant: {
+    enabled: true,
+    // Optional. Return the ATOMIC nonce for THIS call (customer executor
+    // state-challenge). A throw fails the call closed
+    // (EXECUTION_GRANT_NONCE_UNRESOLVABLE) — never a grant-less proceed.
+    resolveStateNonce: async ({ artifactId, toolName, args }) =>
+      challengeNonceFor(artifactId),
+  },
+});
+```
+
+`guardToolCall` factory 3rd argument is the same `{ execution_grant }` object,
+scoped to that invocation. Allow-class authorize that requested a grant and
+does not receive one fails closed (`EXECUTION_GRANT_MISSING` /
+`SIGNER_UNAVAILABLE`). After a grant was requested, `failPolicy: 'open'`
+does not OPEN_PASSTHROUGH grant-less — the call fails closed with the
+server's reason. The outcome records `{ requested, arrived }` only —
+not the token. Not a verdict input; not a preimage field.
+
 Honesty (do not over-claim):
 
 - **Freshness** is ACTIVE only because STRICT sets `requireFreshness` **and** you supplied

package/dist/cjs/execution-grant.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Native execution-grant helpers (9.6.0).
+ *
+ * Grant request is per guardToolCall invocation (local vars). The token is not
+ * a verdict input and is not folded into any fingerprint preimage.
+ */
+export type ExecutionGrantConfig = {
+    enabled: true;
+    resolveStateNonce?: (ctx: {
+        artifactId: string | null;
+        toolName: string;
+        args: unknown;
+    }) => string | Promise<string>;
+};
+export type ExecutionGrantObservation = {
+    requested: boolean;
+    arrived: boolean;
+};
+export type ExecutionGrantCallContext = {
+    execution_grant: string | null;
+};
+export declare function isExecutionGrantEnabled(config: {
+    executionGrant?: ExecutionGrantConfig;
+} | null | undefined): boolean;
+export declare function readExecutionGrantToken(response: unknown): string | null;
+export declare function firstArtifactId(artifacts: unknown): string | null;
+/** True when the thrown authorize error carries the named SIGNER_UNAVAILABLE code. */
+export declare function isSignerUnavailableError(err: unknown): boolean;
+export declare function resolveStateNonceForCall(config: {
+    executionGrant?: ExecutionGrantConfig;
+}, call: {
+    toolName: string;
+    arguments?: unknown;
+    artifacts?: unknown;
+}, artifacts: unknown): Promise<{
+    ok: true;
+    nonce?: string;
+} | {
+    ok: false;
+}>;
+//# sourceMappingURL=execution-grant.d.ts.map

package/dist/cjs/execution-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}

package/dist/cjs/execution-grant.js

@@ -0,0 +1,66 @@
+"use strict";
+/**
+ * Native execution-grant helpers (9.6.0).
+ *
+ * Grant request is per guardToolCall invocation (local vars). The token is not
+ * a verdict input and is not folded into any fingerprint preimage.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isExecutionGrantEnabled = isExecutionGrantEnabled;
+exports.readExecutionGrantToken = readExecutionGrantToken;
+exports.firstArtifactId = firstArtifactId;
+exports.isSignerUnavailableError = isSignerUnavailableError;
+exports.resolveStateNonceForCall = resolveStateNonceForCall;
+function isExecutionGrantEnabled(config) {
+    return !!(config && config.executionGrant && config.executionGrant.enabled === true);
+}
+function readExecutionGrantToken(response) {
+    if (!response || typeof response !== 'object')
+        return null;
+    const g = response.execution_grant;
+    return typeof g === 'string' && g.length > 0 ? g : null;
+}
+function firstArtifactId(artifacts) {
+    if (!Array.isArray(artifacts))
+        return null;
+    for (const a of artifacts) {
+        if (a && typeof a === 'object' && typeof a.id === 'string') {
+            const id = String(a.id).trim();
+            if (id)
+                return id;
+        }
+    }
+    return null;
+}
+/** True when the thrown authorize error carries the named SIGNER_UNAVAILABLE code. */
+function isSignerUnavailableError(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    if (e.code === 'SIGNER_UNAVAILABLE')
+        return true;
+    if (e.body && e.body.code === 'SIGNER_UNAVAILABLE')
+        return true;
+    return false;
+}
+async function resolveStateNonceForCall(config, call, artifacts) {
+    const resolver = config.executionGrant && config.executionGrant.resolveStateNonce;
+    if (typeof resolver !== 'function')
+        return { ok: true };
+    try {
+        const raw = await resolver({
+            artifactId: firstArtifactId(artifacts) || firstArtifactId(call.artifacts),
+            toolName: call.toolName,
+            args: call.arguments,
+        });
+        if (raw == null || raw === '')
+            return { ok: true };
+        if (typeof raw !== 'string')
+            return { ok: false };
+        return { ok: true, nonce: raw };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=execution-grant.js.map

package/dist/cjs/execution-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.js","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAoBH,0DAEC;AAED,0DAIC;AAED,0CASC;AAGD,4DAMC;AAED,4DAmBC;AAjDD,SAAgB,uBAAuB,CAAC,MAAoE;IAC1G,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAI,QAA0C,CAAC,eAAe,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAgB,eAAe,CAAC,SAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,EAAE,GAAG,MAAM,CAAE,CAAoB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAAoD,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,wBAAwB,CAC5C,MAAiD,EACjD,IAAoE,EACpE,SAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAClF,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC;YACzB,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cjs/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AA+ZhC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA+Y1B"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAgchC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAqc1B"}

package/dist/cjs/guard.js

@@ -25,6 +25,7 @@ const cas_attestation_js_1 = require("./cas-attestation.js");
 const monitoring_delivery_js_1 = require("./monitoring-delivery.js");
 const monitoring_attestation_js_1 = require("./monitoring-attestation.js");
 const policy_js_1 = require("./policy.js");
+const execution_grant_js_1 = require("./execution-grant.js");
 // Per-config breaker state (time-window; not consecutive).
 const breakers = new WeakMap();
 const nowMs = () => Date.now();
@@ -83,7 +84,12 @@ function breakerTripped(config) {
     s.fails = s.fails.filter((x) => t - x < win);
     return s.fails.length >= (config.maxUnavailablePerWindow ?? 3);
 }
-function classifyError(err, config) {
+function requestAsksForGrant(request) {
+    return !!(request
+        && typeof request === 'object'
+        && request.include_execution_grant === true);
+}
+function classifyError(err, config, grantRequested = false) {
     const e = err;
     const name = e?.name;
     const status = e?.status ?? e?.body?.status;
@@ -97,6 +103,11 @@ function classifyError(err, config) {
         return { cause: 'REQUEST_REJECTED', integrity: true };
     if (status === 400 || status === 401 || status === 409)
         return { cause: 'REQUEST_REJECTED', integrity: true };
+    // SIGNER_UNAVAILABLE is grant-path only. Gating keeps grant-OFF 5xx as SERVER_ERROR (9.5.0).
+    // Naked 503 while THIS request asked for a grant is the signer-off class, not availability.
+    if (grantRequested && ((0, execution_grant_js_1.isSignerUnavailableError)(err) || status === 503)) {
+        return { cause: 'SIGNER_UNAVAILABLE', integrity: true };
+    }
     if (typeof status === 'number' && status >= 500)
         return { cause: 'SERVER_ERROR', integrity: false };
     if (name === 'TypeError' || /fetch failed|network|ENOTFOUND|ECONNREFUSED|EAI_AGAIN/i.test(String(e?.message)))
@@ -130,7 +141,7 @@ async function preflightWithRetry(config, request) {
             return { ok: true, response };
         }
         catch (err) {
-            last = classifyError(err, config);
+            last = classifyError(err, config, requestAsksForGrant(request));
             if (last.integrity)
                 return { ok: false, ...last }; // integrity: never retry
         }
@@ -167,30 +178,34 @@ async function verifyEnvelope(config, envelope) {
 }
 // ── Outcome builders (keep the discriminated union satisfied) ────────────────────
 // Every path attaches proof + freshness + conditional_write bases (guard-produced only).
-async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
     emit(config, { type: 'execution_started', at: iso(), action: approved.action, decisionId: approved.envelope.decision_id });
     try {
-        const result = await factory(approved.envelope, redacted);
+        const result = grantCtx
+            ? await factory(approved.envelope, redacted, grantCtx)
+            : await factory(approved.envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: true, result, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
     }
     catch (error) {
         emit(config, { type: 'factory_error', at: iso(), action: approved.action });
         const base = { executionAttempted: true, executed: false, enforced: true, error, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation, grantObs);
     }
 }
-async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
     emit(config, { type: 'execution_started', at: iso() });
     try {
-        const result = await factory(envelope, redacted);
+        const result = grantCtx
+            ? await factory(envelope, redacted, grantCtx)
+            : await factory(envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: false, result, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
     }
     catch (error) {
         emit(config, { type: 'factory_error', at: iso() });
         const base = { executionAttempted: true, executed: false, enforced: false, error, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation, grantObs);
     }
 }
 function attachPolicyPresence(outcome, config) {
@@ -207,7 +222,7 @@ function coverageSnap(config) {
 function coverageOutcomeFieldsFrom(s) {
     return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
 }
-function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
     const commit_observation = {
         status: 'not_observed', observed_at: iso(), host_attestation: 'absent',
     };
@@ -229,10 +244,11 @@ function blocked(config, verdict, preflighted, freshness, conditional_write, mon
         ...(monitoring_delivery ? { monitoring_delivery } : {}),
         ...(monitoring_attestation ? { monitoring_attestation } : {}),
         ...coverageOutcomeFieldsFrom(cov),
+        ...(grantObs ? { execution_grant: grantObs } : {}),
     };
     return attachPolicyPresence(out, config);
 }
-async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation) {
+async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs) {
     const enabled = config.requireCommitObservation !== false;
     const commit_observation = await (0, commit_observation_js_1.observeCommit)({
         enabled,
@@ -307,6 +323,7 @@ async function finishExecuted(config, base, freshness, conditional_write, redact
                 : {}),
         } : {}),
         ...coverageOutcomeFieldsFrom(cov),
+        ...(grantObs ? { execution_grant: grantObs } : {}),
     };
     return attachPolicyPresence(out, config);
 }
@@ -459,17 +476,33 @@ async function guardToolCall(call, executeFactory, config, callContext) {
     // previous_receipt: host-supplied only (GuardConfig.previousReceipt). Never hardcoded-undefined
     // forever — when the host provides a prior token (string or getter), thread it so the issuer can
     // hash it into the signed `prev` slot. The guard does not retain or advance the value.
+    //
+    // executionGrant (9.6.0): per-invocation locals — never stored on GuardConfig (shared across
+    // overlapping calls). Default OFF is this object without include_execution_grant (9.5.0 shape).
     const request = {
         artifacts: detection.artifacts,
         context: { operation: config.operation ?? 'tool_call', environment: config.environment, audience: config.audience },
         previous_receipt: resolvePreviousReceipt(config),
         idempotency_key: undefined,
     };
+    let grantObs;
+    let grantForCall = null;
+    if ((0, execution_grant_js_1.isExecutionGrantEnabled)(config)) {
+        grantObs = { requested: true, arrived: false };
+        const nonceRes = await (0, execution_grant_js_1.resolveStateNonceForCall)(config, redacted, detection.artifacts);
+        if (!nonceRes.ok) {
+            breakerRecord(config);
+            return closedIntegrity(config, 'EXECUTION_GRANT_NONCE_UNRESOLVABLE', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
+        }
+        request.include_execution_grant = true;
+        if (nonceRes.nonce)
+            request.state_nonce = nonceRes.nonce;
+    }
     // request-attributable payload cap => PAYLOAD_TOO_LARGE (integrity) => closed.
     const cap = config.maxPayloadBytes ?? 1_000_000;
     if (Buffer.byteLength(JSON.stringify(request), 'utf8') > cap) {
         breakerRecord(config);
-        return closedIntegrity(config, 'PAYLOAD_TOO_LARGE', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'PAYLOAD_TOO_LARGE', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     emit(config, { type: 'preflight_start', at: iso() });
     const pf = await preflightWithRetry(config, request);
@@ -482,14 +515,22 @@ async function guardToolCall(call, executeFactory, config, callContext) {
         if (pf.integrity) {
             emit(config, { type: 'breaker_tripped', at: iso(), cause: pf.cause });
             const v = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-            return blocked(config, v, false, basis, cw);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
         }
         // availability
         const availCause = pf.cause;
+        // A grant was requested for THIS call: never OPEN_PASSTHROUGH / LKG-execute without a token.
+        // failPolicy 'open' remains the 9.5.0 opt-in only when the grant path is off.
+        if (grantObs && grantObs.requested) {
+            if (breakerTripped(config))
+                emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
+            const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
+        }
         if (failPolicy === 'open' && !breakerTripped(config)) {
             emit(config, { type: 'preflight_unavailable', at: iso(), cause: availCause, action: 'CONTINUE' });
             const v = unavailableVerdict({ cause: availCause, failPolicy: 'open', resolution: 'OPEN_PASSTHROUGH', action: 'CONTINUE' }, count);
-            return runUnenforced(config, executeFactory, null, v, false, redacted, basis, cw);
+            return runUnenforced(config, executeFactory, null, v, false, redacted, basis, cw, undefined, undefined, undefined, grantObs);
         }
         if (failPolicy === 'lkg') {
             const lkg = await tryLkg(config, inputFp);
@@ -503,31 +544,31 @@ async function guardToolCall(call, executeFactory, config, callContext) {
         if (breakerTripped(config))
             emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-        return blocked(config, v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
     }
     // We have a response. Read the decision (envelope-first) and verify the receipt.
     const rd = (0, read_decision_js_1.readDecision)(pf.response);
     // PRESENT but unrecognised action — halt with its own code before any decision map or reconcile.
     if (rd.reason === 'EXECUTION_ACTION_UNRECOGNISED') {
         breakerRecord(config);
-        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // Missing EA on v2 / non-legacy-1.0 — reuse closedIntegrity halt arm, cause UNREADABLE_DECISION.
     // executed:false, enforced:false (blocked()). Never remap to CONTINUE.
     if (rd.reason === 'UNREADABLE_DECISION') {
         breakerRecord(config);
-        return closedIntegrity(config, 'UNREADABLE_DECISION', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'UNREADABLE_DECISION', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     if (!rd.envelope) {
         // Known action but no envelope => integrity => closed.
         breakerRecord(config);
-        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     const envelope = rd.envelope;
     // Past unrecognised early-return: action is a closed ExecutionAction (or we treat non-closed as integrity).
     if (!(0, read_decision_js_1.isClosedAction)(rd.executionAction)) {
         breakerRecord(config);
-        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     const closedAction = rd.executionAction;
     // 5. expiry check before honoring any decision.
@@ -544,7 +585,7 @@ async function guardToolCall(call, executeFactory, config, callContext) {
     // signature. Both trip the breaker and STOP — the guard NEVER executes off an unbound receipt.
     if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
         breakerRecord(config);
-        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // ── Client-side authorization gate (P0-b/c): mirror §106/§111/§115 before honoring any action. ──
     // Threat model (bounded): without a receipt, fields including execution_action are not
@@ -557,21 +598,34 @@ async function guardToolCall(call, executeFactory, config, callContext) {
     const gate = (0, enforcement_gate_js_1.evaluateEnvelope)(pf.response, envelope, closedAction, detection.artifacts);
     if (gate.verdict === 'fail-closed') {
         breakerRecord(config);
-        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     if (gate.verdict === 'block-strict') {
         // A real (or stricter-reconciled) BLOCK / REQUIRE_APPROVAL — clean block; the factory never runs.
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
         return gate.decision === 'BLOCK'
-            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw)
-            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw);
+            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs)
+            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs);
     }
     const kind = gate.kind; // 'ALLOW' | 'MONITOR' — allow-class, safe, non-degraded, artifact-bound.
+    // Native grant: allow-class authorize that requested a grant must RECEIVE one.
+    // BLOCK/RA never mint a grant — missing token there is not EXECUTION_GRANT_MISSING.
+    if (grantObs && grantObs.requested) {
+        grantForCall = (0, execution_grant_js_1.readExecutionGrantToken)(pf.response);
+        grantObs = { requested: true, arrived: !!grantForCall };
+        if (!grantForCall) {
+            breakerRecord(config);
+            return closedIntegrity(config, 'EXECUTION_GRANT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
+        }
+    }
+    const grantCtx = grantObs
+        ? { execution_grant: grantForCall }
+        : undefined;
     // An expired decision cannot be honored fresh => closed (integrity: wrong-time state).
     if (expired) {
         breakerRecord(config);
-        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // MONITOR gate: host must ASSERT monitoring is wired (monitoringSinkWired === true) AND supply
     // onEvent. Presence of a function alone is not enough — () => {} used to unlock this gate while
@@ -625,20 +679,20 @@ async function guardToolCall(call, executeFactory, config, callContext) {
         });
         if (sinkWired && monitoringDelivery.status === 'not_delivered' && (0, monitoring_delivery_js_1.monitoringDeliveryFailClosed)(config)) {
             breakerRecord(config);
-            return closedIntegrity(config, 'MONITORING_UNWIRED', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation);
+            return closedIntegrity(config, 'MONITORING_UNWIRED', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
         }
     }
     // Freshness re-check immediately before any execution (ACTIVE assessment uses preflight befores).
     const { basis: freshBasis, blockCause: freshBlock } = freshnessFor(config, redacted, fctx, detection.artifacts);
     if (freshBlock === 'FRESHNESS_REQUIRED' || freshBlock === 'FRESHNESS_FAILED') {
         breakerRecord(config);
-        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // Conditional-write re-check immediately before enforced execution (same conjunct class as freshness).
     const { basis: cwBasis, blockCause: cwBlock } = conditionalWriteFor(config, redacted, cwctx);
     if (cwBlock === 'CONDITIONAL_WRITE_REQUIRED') {
         breakerRecord(config);
-        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // observeOnly is an EXPLICIT report-only opt-in: execute but never enforce (the one sanctioned
     // unenforced-execution mode alongside failPolicy=open; both are documented opt-ins, not the default).
@@ -647,14 +701,14 @@ async function guardToolCall(call, executeFactory, config, callContext) {
         const verdict = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     // Advisory CWM (sink WAS wired): delivery failed but failPolicy/observeOnly said not to block.
     // Proceed unenforced with the reason visible. Unwired MONITOR still falls through to
     // MONITORING_UNWIRED (CE-CC-04). ENFORCING not_delivered already returned closedIntegrity.
     if (kind === 'MONITOR' && sinkWired && monitoringDelivery && monitoringDelivery.status === 'not_delivered') {
         const degraded = { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     // ── enforced ⟺ executed INVARIANT (contract-triggering path): execute ONLY when we can ENFORCE. ──
     // enforceable = a bound-verified receipt AND (MONITOR) a wired sink. Anything else FAILS CLOSED —
@@ -683,7 +737,7 @@ async function guardToolCall(call, executeFactory, config, callContext) {
             const offVerdict = kind === 'ALLOW'
                 ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
                 : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-            return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+            return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const et = (0, execution_time_fingerprint_js_1.checkExecutionTimeFingerprint)({
             artifacts: detection.artifacts,
@@ -697,7 +751,7 @@ async function guardToolCall(call, executeFactory, config, callContext) {
             const unmeasurable = (0, execution_time_fingerprint_js_1.isUnmeasurableExecutionStateReason)(et.reason);
             if (execStateMode === true) {
                 breakerRecord(config);
-                return closedIntegrity(config, unmeasurable ? 'EXECUTION_STATE_UNMEASURABLE' : 'EXECUTION_STATE_DRIFT', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+                return closedIntegrity(config, unmeasurable ? 'EXECUTION_STATE_UNMEASURABLE' : 'EXECUTION_STATE_DRIFT', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
             }
             // warn opt-down: emit, then run unenforced — a measured mismatch is not an enforced run.
             if (unmeasurable) {
@@ -724,23 +778,23 @@ async function guardToolCall(call, executeFactory, config, callContext) {
             const warnVerdict = kind === 'ALLOW'
                 ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
                 : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-            return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+            return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const approved = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified: true }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified: true };
-        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     breakerRecord(config);
-    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation);
+    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
 }
-function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery, monitoring_attestation) {
+function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery, monitoring_attestation, grantObs) {
     const count = (breakers.get(config)?.fails.length) ?? 1;
     emit(config, { type: 'breaker_tripped', at: iso(), cause });
     const v = unavailableVerdict({ cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
     const { basis } = freshnessFor(config, redacted, fctx, arts);
     const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
-    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation);
+    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
 }
 function isExpired(envelope) {
     const exp = envelope.expires_at;