@coderifts/agent-guard 9.5.0 → 9.7.0

package/dist/esm/coverage-attestation.js

@@ -0,0 +1,141 @@
+/**
+ * cr.coverage.attest.v1 issuance (guard side).
+ *
+ * Wire/signing input MIRRORS app src/verdict-core/coverage-attestation.js. The guard SIGNS via a
+ * host-provided sign(bytes) callback — never a raw key in config. CodeRifts never holds the
+ * coverage private key. Custody model copied from tryIssueMonitoringAttestation, deliberately:
+ * one custody story for every host-signed artifact, not a second one per envelope.
+ *
+ * Observation-side only. Signer throw/empty → omit the token; never unsigned.
+ *
+ * ── THE PAYLOAD DECISION, and it is the point of this module ────────────────────────────────
+ * A signed statement must not assert more than the guard measured.
+ *
+ * The guard's own class vocabulary is WIDER than the envelope's, deliberately:
+ *   guard    UNKNOWN_OUTSIDE_SCOPE | INCOMPLETE_OBSERVED | COMPLETE_OBSERVED
+ *   envelope UNKNOWN_OUTSIDE_SCOPE | INCOMPLETE_OBSERVED          (no COMPLETE, by design)
+ *
+ * Half B absent (host never reported total dispatches): the guard knows governed_calls and
+ * nothing else. The token carries UNKNOWN_OUTSIDE_SCOPE and OMITS total_calls entirely. It does
+ * not default the total to governed_calls, and it does not send zero — absence is not zero, and a
+ * signed zero would be a lie with a signature on it.
+ *
+ * Guard COMPLETE_OBSERVED maps to envelope INCOMPLETE_OBSERVED. Not a downgrade for its own sake:
+ * the envelope's two classes encode "totals known" vs "totals unknown", and the app kernel rejects
+ * a COMPLETE payload as malformed rather than coercing it, because from inside the process the
+ * ABSENCE of an ungoverned call is unprovable. The numbers carry the finding — an empty
+ * ungoverned_tools tells the reader everything the host reported was governed, without a signed
+ * claim of completeness that we cannot back.
+ */
+'use strict';
+export const COVERAGE_ATTEST_VERSION = 'cr.coverage.attest.v1';
+export const COVERAGE_ATTEST_SIGNING_PREFIX = 'crcovattest.v1';
+export const COVERAGE_ATTEST_ENVELOPE_TAG = 'cr.coverage.attest.v1';
+/** Envelope classes. Intentionally two — there is no COMPLETE to emit. */
+const ENVELOPE_CLASSES = ['INCOMPLETE_OBSERVED', 'UNKNOWN_OUTSIDE_SCOPE'];
+/** NUL joins the tool-name list inside one pipe field, so a name can never forge a field. */
+const NUL = '\x1f';
+function scalar(v) {
+    return v == null ? '' : String(v);
+}
+function canonicalUngoverned(list) {
+    return Array.isArray(list) ? list.map((s) => String(s)).join(NUL) : '';
+}
+export function coverageAttestSigningInput(body) {
+    const parts = [
+        COVERAGE_ATTEST_SIGNING_PREFIX,
+        scalar(body.kid),
+        scalar(body.session_id),
+        scalar(body.observed_class),
+        body.governed_calls != null ? String(body.governed_calls) : '',
+        body.total_calls != null ? String(body.total_calls) : '',
+        canonicalUngoverned(body.ungoverned_tools),
+        scalar(body.decision_id),
+        scalar(body.receipt_digest),
+        scalar(body.observed_at),
+    ];
+    return parts.join('|');
+}
+function b64url(buf) {
+    return buf.toString('base64url');
+}
+/** True when the host reported Half B (total dispatches), so a total may be asserted. */
+function hasHalfB(cov) {
+    return cov.class !== 'UNKNOWN_OUTSIDE_SCOPE'
+        && typeof cov.total_calls === 'number';
+}
+/**
+ * Issue a cr.coverage.attest.v1 token from a coverage snapshot. Returns undefined when config is
+ * absent, the snapshot is unusable, or the host signer throws — never an unsigned token.
+ */
+export async function tryIssueCoverageAttestation(args) {
+    const cfg = args.config;
+    if (!cfg || typeof cfg.kid !== 'string' || !cfg.kid || typeof cfg.signer !== 'function') {
+        return undefined;
+    }
+    if (typeof cfg.sessionId !== 'string' || cfg.sessionId.length === 0)
+        return undefined;
+    const cov = args.coverage;
+    if (!cov || typeof cov !== 'object')
+        return undefined;
+    if (typeof cov.governed_calls !== 'number' || !Number.isInteger(cov.governed_calls) || cov.governed_calls < 0) {
+        return undefined;
+    }
+    const halfB = hasHalfB(cov);
+    const observed_class = halfB ? 'INCOMPLETE_OBSERVED' : 'UNKNOWN_OUTSIDE_SCOPE';
+    if (!ENVELOPE_CLASSES.includes(observed_class))
+        return undefined;
+    const body = {
+        v: COVERAGE_ATTEST_VERSION,
+        kid: cfg.kid,
+        session_id: cfg.sessionId,
+        observed_class,
+        governed_calls: cov.governed_calls,
+        observed_at: args.now || new Date().toISOString().replace(/\.\d{3}Z$/, 'Z'),
+    };
+    if (halfB) {
+        const withTotals = cov;
+        // A statement claiming more governed than dispatched is not a coverage statement — the app
+        // kernel rejects it as malformed, so refuse to mint it rather than emit a token that fails.
+        if (!Number.isInteger(withTotals.total_calls) || withTotals.total_calls < cov.governed_calls) {
+            return undefined;
+        }
+        body.total_calls = withTotals.total_calls;
+        body.ungoverned_tools = Array.isArray(withTotals.ungoverned_tools)
+            ? withTotals.ungoverned_tools.map((s) => String(s))
+            : [];
+    }
+    // else: total_calls and ungoverned_tools are OMITTED. Not zero. Not defaulted.
+    if (typeof args.decisionId === 'string' && args.decisionId)
+        body.decision_id = args.decisionId;
+    if (typeof args.receiptDigest === 'string' && args.receiptDigest)
+        body.receipt_digest = args.receiptDigest;
+    const input = Buffer.from(coverageAttestSigningInput(body), 'utf8');
+    let sig;
+    try {
+        sig = await cfg.signer(input);
+    }
+    catch {
+        return undefined;
+    }
+    if (sig == null)
+        return undefined;
+    const sigBuf = Buffer.isBuffer(sig) ? sig : Buffer.from(sig);
+    if (sigBuf.length === 0)
+        return undefined;
+    return [
+        COVERAGE_ATTEST_ENVELOPE_TAG,
+        cfg.kid,
+        b64url(Buffer.from(JSON.stringify(body), 'utf8')),
+        b64url(sigBuf),
+    ].join('|');
+}
+export function kidFromCoverageAttestation(token) {
+    if (typeof token !== 'string' || token.length === 0)
+        return null;
+    const parts = token.split('|');
+    if (parts.length !== 4 || parts[0] !== COVERAGE_ATTEST_ENVELOPE_TAG)
+        return null;
+    return parts[1] || null;
+}
+//# sourceMappingURL=coverage-attestation.js.map

package/dist/esm/coverage-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-attestation.js","sourceRoot":"","sources":["../../src/coverage-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,YAAY,CAAC;AAIb,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AAC/D,MAAM,CAAC,MAAM,8BAA8B,GAAG,gBAAgB,CAAC;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAU,CAAC;AAEnF,6FAA6F;AAC7F,MAAM,GAAG,GAAG,MAAM,CAAC;AAenB,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAA6B;IACtE,MAAM,KAAK,GAAG;QACZ,8BAA8B;QAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC3B,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;QAC9D,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;QACxD,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;KACzB,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,yFAAyF;AACzF,SAAS,QAAQ,CAAC,GAAqB;IACrC,OAAO,GAAG,CAAC,KAAK,KAAK,uBAAuB;WACvC,OAAQ,GAAiC,CAAC,WAAW,KAAK,QAAQ,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAMjD;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAC9G,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB,CAAC;IAC/E,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAC;IAExF,MAAM,IAAI,GAA4B;QACpC,CAAC,EAAE,uBAAuB;QAC1B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,cAAc;QACd,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,WAAW,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;KAC5E,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,GAAoE,CAAC;QACxF,2FAA2F;QAC3F,4FAA4F;QAC5F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;YAC7F,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QAC1C,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAChE,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnD,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IACD,+EAA+E;IAE/E,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;IAC/F,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa;QAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC;IAE3G,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1C,OAAO;QACL,4BAA4B;QAC5B,GAAG,CAAC,GAAG;QACP,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC;KACf,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAgC;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IACjF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC1B,CAAC"}

package/dist/esm/execution-grant.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Native execution-grant helpers (9.6.0).
+ *
+ * Grant request is per guardToolCall invocation (local vars). The token is not
+ * a verdict input and is not folded into any fingerprint preimage.
+ */
+export type ExecutionGrantConfig = {
+    enabled: true;
+    resolveStateNonce?: (ctx: {
+        artifactId: string | null;
+        toolName: string;
+        args: unknown;
+    }) => string | Promise<string>;
+};
+export type ExecutionGrantObservation = {
+    requested: boolean;
+    arrived: boolean;
+};
+export type ExecutionGrantCallContext = {
+    execution_grant: string | null;
+};
+export declare function isExecutionGrantEnabled(config: {
+    executionGrant?: ExecutionGrantConfig;
+} | null | undefined): boolean;
+export declare function readExecutionGrantToken(response: unknown): string | null;
+export declare function firstArtifactId(artifacts: unknown): string | null;
+/** True when the thrown authorize error carries the named SIGNER_UNAVAILABLE code. */
+export declare function isSignerUnavailableError(err: unknown): boolean;
+export declare function resolveStateNonceForCall(config: {
+    executionGrant?: ExecutionGrantConfig;
+}, call: {
+    toolName: string;
+    arguments?: unknown;
+    artifacts?: unknown;
+}, artifacts: unknown): Promise<{
+    ok: true;
+    nonce?: string;
+} | {
+    ok: false;
+}>;
+//# sourceMappingURL=execution-grant.d.ts.map

package/dist/esm/execution-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.d.ts","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,IAAI,CAAC;IACd,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE;QACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,OAAO,CAAC;KACf,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErH;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASjE;AAED,sFAAsF;AACtF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAM9D;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,oBAAoB,CAAA;CAAE,EACjD,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EACpE,SAAS,EAAE,OAAO,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAevD"}

package/dist/esm/execution-grant.js

@@ -0,0 +1,59 @@
+/**
+ * Native execution-grant helpers (9.6.0).
+ *
+ * Grant request is per guardToolCall invocation (local vars). The token is not
+ * a verdict input and is not folded into any fingerprint preimage.
+ */
+export function isExecutionGrantEnabled(config) {
+    return !!(config && config.executionGrant && config.executionGrant.enabled === true);
+}
+export function readExecutionGrantToken(response) {
+    if (!response || typeof response !== 'object')
+        return null;
+    const g = response.execution_grant;
+    return typeof g === 'string' && g.length > 0 ? g : null;
+}
+export function firstArtifactId(artifacts) {
+    if (!Array.isArray(artifacts))
+        return null;
+    for (const a of artifacts) {
+        if (a && typeof a === 'object' && typeof a.id === 'string') {
+            const id = String(a.id).trim();
+            if (id)
+                return id;
+        }
+    }
+    return null;
+}
+/** True when the thrown authorize error carries the named SIGNER_UNAVAILABLE code. */
+export function isSignerUnavailableError(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    if (e.code === 'SIGNER_UNAVAILABLE')
+        return true;
+    if (e.body && e.body.code === 'SIGNER_UNAVAILABLE')
+        return true;
+    return false;
+}
+export async function resolveStateNonceForCall(config, call, artifacts) {
+    const resolver = config.executionGrant && config.executionGrant.resolveStateNonce;
+    if (typeof resolver !== 'function')
+        return { ok: true };
+    try {
+        const raw = await resolver({
+            artifactId: firstArtifactId(artifacts) || firstArtifactId(call.artifacts),
+            toolName: call.toolName,
+            args: call.arguments,
+        });
+        if (raw == null || raw === '')
+            return { ok: true };
+        if (typeof raw !== 'string')
+            return { ok: false };
+        return { ok: true, nonce: raw };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=execution-grant.js.map

package/dist/esm/execution-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-grant.js","sourceRoot":"","sources":["../../src/execution-grant.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,MAAM,UAAU,uBAAuB,CAAC,MAAoE;IAC1G,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAiB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,CAAC,GAAI,QAA0C,CAAC,eAAe,CAAC;IACtE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAsB,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjF,MAAM,EAAE,GAAG,MAAM,CAAE,CAAoB,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,EAAE;gBAAE,OAAO,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAAoD,CAAC;IAC/D,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAiD,EACjD,IAAoE,EACpE,SAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAClF,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC;YACzB,UAAU,EAAE,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/esm/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AA+ZhC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CA+Y1B"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EACV,WAAW,EAAE,YAAY,EACT,kBAAkB,EAAE,cAAc,EAEnD,MAAM,YAAY,CAAC;AAYpB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,wBAAwB,CAAC;AAgchC;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EACnC,IAAI,EAAE,kBAAkB,EACxB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,EACjC,MAAM,EAAE,WAAW,EACnB,WAAW,CAAC,EAAE,oBAAoB,GAAG,2BAA2B,GAC/D,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAqc1B"}

package/dist/esm/guard.js

@@ -22,6 +22,7 @@ import { buildCasAttestation, evaluateCasEvidence, isExecuteIfUnchangedOutcome,
 import { deliverMonitoring, monitoringDeliveryFailClosed, } from './monitoring-delivery.js';
 import { tryIssueMonitoringAttestation } from './monitoring-attestation.js';
 import { observePolicyPresence } from './policy.js';
+import { isExecutionGrantEnabled, isSignerUnavailableError, readExecutionGrantToken, resolveStateNonceForCall, } from './execution-grant.js';
 // Per-config breaker state (time-window; not consecutive).
 const breakers = new WeakMap();
 const nowMs = () => Date.now();
@@ -80,7 +81,12 @@ function breakerTripped(config) {
     s.fails = s.fails.filter((x) => t - x < win);
     return s.fails.length >= (config.maxUnavailablePerWindow ?? 3);
 }
-function classifyError(err, config) {
+function requestAsksForGrant(request) {
+    return !!(request
+        && typeof request === 'object'
+        && request.include_execution_grant === true);
+}
+function classifyError(err, config, grantRequested = false) {
     const e = err;
     const name = e?.name;
     const status = e?.status ?? e?.body?.status;
@@ -94,6 +100,11 @@ function classifyError(err, config) {
         return { cause: 'REQUEST_REJECTED', integrity: true };
     if (status === 400 || status === 401 || status === 409)
         return { cause: 'REQUEST_REJECTED', integrity: true };
+    // SIGNER_UNAVAILABLE is grant-path only. Gating keeps grant-OFF 5xx as SERVER_ERROR (9.5.0).
+    // Naked 503 while THIS request asked for a grant is the signer-off class, not availability.
+    if (grantRequested && (isSignerUnavailableError(err) || status === 503)) {
+        return { cause: 'SIGNER_UNAVAILABLE', integrity: true };
+    }
     if (typeof status === 'number' && status >= 500)
         return { cause: 'SERVER_ERROR', integrity: false };
     if (name === 'TypeError' || /fetch failed|network|ENOTFOUND|ECONNREFUSED|EAI_AGAIN/i.test(String(e?.message)))
@@ -127,7 +138,7 @@ async function preflightWithRetry(config, request) {
             return { ok: true, response };
         }
         catch (err) {
-            last = classifyError(err, config);
+            last = classifyError(err, config, requestAsksForGrant(request));
             if (last.integrity)
                 return { ok: false, ...last }; // integrity: never retry
         }
@@ -164,30 +175,34 @@ async function verifyEnvelope(config, envelope) {
 }
 // ── Outcome builders (keep the discriminated union satisfied) ────────────────────
 // Every path attaches proof + freshness + conditional_write bases (guard-produced only).
-async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+async function runEnforced(config, factory, approved, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
     emit(config, { type: 'execution_started', at: iso(), action: approved.action, decisionId: approved.envelope.decision_id });
     try {
-        const result = await factory(approved.envelope, redacted);
+        const result = grantCtx
+            ? await factory(approved.envelope, redacted, grantCtx)
+            : await factory(approved.envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: true, result, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
     }
     catch (error) {
         emit(config, { type: 'factory_error', at: iso(), action: approved.action });
         const base = { executionAttempted: true, executed: false, enforced: true, error, verdict: approved, preflighted: true };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation, grantObs);
     }
 }
-async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+async function runUnenforced(config, factory, envelope, verdict, preflighted, redacted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantCtx, grantObs) {
     emit(config, { type: 'execution_started', at: iso() });
     try {
-        const result = await factory(envelope, redacted);
+        const result = grantCtx
+            ? await factory(envelope, redacted, grantCtx)
+            : await factory(envelope, redacted);
         const base = { executionAttempted: true, executed: true, enforced: false, result, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs);
     }
     catch (error) {
         emit(config, { type: 'factory_error', at: iso() });
         const base = { executionAttempted: true, executed: false, enforced: false, error, verdict, preflighted };
-        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation);
+        return finishExecuted(config, base, freshness, conditional_write, redacted, undefined, monitoring_delivery, monitoring_attestation, grantObs);
     }
 }
 function attachPolicyPresence(outcome, config) {
@@ -204,7 +219,7 @@ function coverageSnap(config) {
 function coverageOutcomeFieldsFrom(s) {
     return s.coverageObserved ? { coverage_observed: s.coverageObserved } : {};
 }
-function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation) {
+function blocked(config, verdict, preflighted, freshness, conditional_write, monitoring_delivery, monitoring_attestation, grantObs) {
     const commit_observation = {
         status: 'not_observed', observed_at: iso(), host_attestation: 'absent',
     };
@@ -226,10 +241,11 @@ function blocked(config, verdict, preflighted, freshness, conditional_write, mon
         ...(monitoring_delivery ? { monitoring_delivery } : {}),
         ...(monitoring_attestation ? { monitoring_attestation } : {}),
         ...coverageOutcomeFieldsFrom(cov),
+        ...(grantObs ? { execution_grant: grantObs } : {}),
     };
     return attachPolicyPresence(out, config);
 }
-async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation) {
+async function finishExecuted(config, base, freshness, conditional_write, redacted, result, monitoring_delivery, monitoring_attestation, grantObs) {
     const enabled = config.requireCommitObservation !== false;
     const commit_observation = await observeCommit({
         enabled,
@@ -304,6 +320,7 @@ async function finishExecuted(config, base, freshness, conditional_write, redact
                 : {}),
         } : {}),
         ...coverageOutcomeFieldsFrom(cov),
+        ...(grantObs ? { execution_grant: grantObs } : {}),
     };
     return attachPolicyPresence(out, config);
 }
@@ -456,17 +473,33 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
     // previous_receipt: host-supplied only (GuardConfig.previousReceipt). Never hardcoded-undefined
     // forever — when the host provides a prior token (string or getter), thread it so the issuer can
     // hash it into the signed `prev` slot. The guard does not retain or advance the value.
+    //
+    // executionGrant (9.6.0): per-invocation locals — never stored on GuardConfig (shared across
+    // overlapping calls). Default OFF is this object without include_execution_grant (9.5.0 shape).
     const request = {
         artifacts: detection.artifacts,
         context: { operation: config.operation ?? 'tool_call', environment: config.environment, audience: config.audience },
         previous_receipt: resolvePreviousReceipt(config),
         idempotency_key: undefined,
     };
+    let grantObs;
+    let grantForCall = null;
+    if (isExecutionGrantEnabled(config)) {
+        grantObs = { requested: true, arrived: false };
+        const nonceRes = await resolveStateNonceForCall(config, redacted, detection.artifacts);
+        if (!nonceRes.ok) {
+            breakerRecord(config);
+            return closedIntegrity(config, 'EXECUTION_GRANT_NONCE_UNRESOLVABLE', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
+        }
+        request.include_execution_grant = true;
+        if (nonceRes.nonce)
+            request.state_nonce = nonceRes.nonce;
+    }
     // request-attributable payload cap => PAYLOAD_TOO_LARGE (integrity) => closed.
     const cap = config.maxPayloadBytes ?? 1_000_000;
     if (Buffer.byteLength(JSON.stringify(request), 'utf8') > cap) {
         breakerRecord(config);
-        return closedIntegrity(config, 'PAYLOAD_TOO_LARGE', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'PAYLOAD_TOO_LARGE', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     emit(config, { type: 'preflight_start', at: iso() });
     const pf = await preflightWithRetry(config, request);
@@ -479,14 +512,22 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         if (pf.integrity) {
             emit(config, { type: 'breaker_tripped', at: iso(), cause: pf.cause });
             const v = unavailableVerdict({ cause: pf.cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-            return blocked(config, v, false, basis, cw);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
         }
         // availability
         const availCause = pf.cause;
+        // A grant was requested for THIS call: never OPEN_PASSTHROUGH / LKG-execute without a token.
+        // failPolicy 'open' remains the 9.5.0 opt-in only when the grant path is off.
+        if (grantObs && grantObs.requested) {
+            if (breakerTripped(config))
+                emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
+            const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
+            return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
+        }
         if (failPolicy === 'open' && !breakerTripped(config)) {
             emit(config, { type: 'preflight_unavailable', at: iso(), cause: availCause, action: 'CONTINUE' });
             const v = unavailableVerdict({ cause: availCause, failPolicy: 'open', resolution: 'OPEN_PASSTHROUGH', action: 'CONTINUE' }, count);
-            return runUnenforced(config, executeFactory, null, v, false, redacted, basis, cw);
+            return runUnenforced(config, executeFactory, null, v, false, redacted, basis, cw, undefined, undefined, undefined, grantObs);
         }
         if (failPolicy === 'lkg') {
             const lkg = await tryLkg(config, inputFp);
@@ -500,31 +541,31 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         if (breakerTripped(config))
             emit(config, { type: 'breaker_tripped', at: iso(), cause: availCause });
         const v = unavailableVerdict({ cause: availCause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
-        return blocked(config, v, false, basis, cw);
+        return blocked(config, v, false, basis, cw, undefined, undefined, grantObs);
     }
     // We have a response. Read the decision (envelope-first) and verify the receipt.
     const rd = readDecision(pf.response);
     // PRESENT but unrecognised action — halt with its own code before any decision map or reconcile.
     if (rd.reason === 'EXECUTION_ACTION_UNRECOGNISED') {
         breakerRecord(config);
-        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // Missing EA on v2 / non-legacy-1.0 — reuse closedIntegrity halt arm, cause UNREADABLE_DECISION.
     // executed:false, enforced:false (blocked()). Never remap to CONTINUE.
     if (rd.reason === 'UNREADABLE_DECISION') {
         breakerRecord(config);
-        return closedIntegrity(config, 'UNREADABLE_DECISION', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'UNREADABLE_DECISION', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     if (!rd.envelope) {
         // Known action but no envelope => integrity => closed.
         breakerRecord(config);
-        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     const envelope = rd.envelope;
     // Past unrecognised early-return: action is a closed ExecutionAction (or we treat non-closed as integrity).
     if (!isClosedAction(rd.executionAction)) {
         breakerRecord(config);
-        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'EXECUTION_ACTION_UNRECOGNISED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     const closedAction = rd.executionAction;
     // 5. expiry check before honoring any decision.
@@ -541,7 +582,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
     // signature. Both trip the breaker and STOP — the guard NEVER executes off an unbound receipt.
     if (config.verifyReceipts !== false && !receiptVerified && envelope.receipt?.token) {
         breakerRecord(config);
-        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, bindResult.cause ?? 'RECEIPT_UNVERIFIED', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // ── Client-side authorization gate (P0-b/c): mirror §106/§111/§115 before honoring any action. ──
     // Threat model (bounded): without a receipt, fields including execution_action are not
@@ -554,21 +595,34 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
     const gate = evaluateEnvelope(pf.response, envelope, closedAction, detection.artifacts);
     if (gate.verdict === 'fail-closed') {
         breakerRecord(config);
-        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, gate.cause, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     if (gate.verdict === 'block-strict') {
         // A real (or stricter-reconciled) BLOCK / REQUIRE_APPROVAL — clean block; the factory never runs.
         const { basis } = freshnessFor(config, redacted, fctx, detection.artifacts);
         const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
         return gate.decision === 'BLOCK'
-            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw)
-            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw);
+            ? blocked(config, { kind: 'BLOCK', action: 'STOP', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs)
+            : blocked(config, { kind: 'APPROVAL', action: 'REQUEST_APPROVAL', envelope, receiptVerified }, true, basis, cw, undefined, undefined, grantObs);
     }
     const kind = gate.kind; // 'ALLOW' | 'MONITOR' — allow-class, safe, non-degraded, artifact-bound.
+    // Native grant: allow-class authorize that requested a grant must RECEIVE one.
+    // BLOCK/RA never mint a grant — missing token there is not EXECUTION_GRANT_MISSING.
+    if (grantObs && grantObs.requested) {
+        grantForCall = readExecutionGrantToken(pf.response);
+        grantObs = { requested: true, arrived: !!grantForCall };
+        if (!grantForCall) {
+            breakerRecord(config);
+            return closedIntegrity(config, 'EXECUTION_GRANT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
+        }
+    }
+    const grantCtx = grantObs
+        ? { execution_grant: grantForCall }
+        : undefined;
     // An expired decision cannot be honored fresh => closed (integrity: wrong-time state).
     if (expired) {
         breakerRecord(config);
-        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, 'SCHEMA_INVALID', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // MONITOR gate: host must ASSERT monitoring is wired (monitoringSinkWired === true) AND supply
     // onEvent. Presence of a function alone is not enough — () => {} used to unlock this gate while
@@ -622,20 +676,20 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         });
         if (sinkWired && monitoringDelivery.status === 'not_delivered' && monitoringDeliveryFailClosed(config)) {
             breakerRecord(config);
-            return closedIntegrity(config, 'MONITORING_UNWIRED', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation);
+            return closedIntegrity(config, 'MONITORING_UNWIRED', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
         }
     }
     // Freshness re-check immediately before any execution (ACTIVE assessment uses preflight befores).
     const { basis: freshBasis, blockCause: freshBlock } = freshnessFor(config, redacted, fctx, detection.artifacts);
     if (freshBlock === 'FRESHNESS_REQUIRED' || freshBlock === 'FRESHNESS_FAILED') {
         breakerRecord(config);
-        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, freshBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // Conditional-write re-check immediately before enforced execution (same conjunct class as freshness).
     const { basis: cwBasis, blockCause: cwBlock } = conditionalWriteFor(config, redacted, cwctx);
     if (cwBlock === 'CONDITIONAL_WRITE_REQUIRED') {
         breakerRecord(config);
-        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts);
+        return closedIntegrity(config, cwBlock, failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
     }
     // observeOnly is an EXPLICIT report-only opt-in: execute but never enforce (the one sanctioned
     // unenforced-execution mode alongside failPolicy=open; both are documented opt-ins, not the default).
@@ -644,14 +698,14 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
         const verdict = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runUnenforced(config, executeFactory, envelope, verdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     // Advisory CWM (sink WAS wired): delivery failed but failPolicy/observeOnly said not to block.
     // Proceed unenforced with the reason visible. Unwired MONITOR still falls through to
     // MONITORING_UNWIRED (CE-CC-04). ENFORCING not_delivered already returned closedIntegrity.
     if (kind === 'MONITOR' && sinkWired && monitoringDelivery && monitoringDelivery.status === 'not_delivered') {
         const degraded = { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runUnenforced(config, executeFactory, envelope, degraded, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     // ── enforced ⟺ executed INVARIANT (contract-triggering path): execute ONLY when we can ENFORCE. ──
     // enforceable = a bound-verified receipt AND (MONITOR) a wired sink. Anything else FAILS CLOSED —
@@ -680,7 +734,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
             const offVerdict = kind === 'ALLOW'
                 ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
                 : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-            return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+            return runUnenforced(config, executeFactory, envelope, offVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const et = checkExecutionTimeFingerprint({
             artifacts: detection.artifacts,
@@ -694,7 +748,7 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
             const unmeasurable = isUnmeasurableExecutionStateReason(et.reason);
             if (execStateMode === true) {
                 breakerRecord(config);
-                return closedIntegrity(config, unmeasurable ? 'EXECUTION_STATE_UNMEASURABLE' : 'EXECUTION_STATE_DRIFT', failPolicy, fctx, cwctx, redacted, detection.artifacts);
+                return closedIntegrity(config, unmeasurable ? 'EXECUTION_STATE_UNMEASURABLE' : 'EXECUTION_STATE_DRIFT', failPolicy, fctx, cwctx, redacted, detection.artifacts, undefined, undefined, grantObs);
             }
             // warn opt-down: emit, then run unenforced — a measured mismatch is not an enforced run.
             if (unmeasurable) {
@@ -721,23 +775,23 @@ export async function guardToolCall(call, executeFactory, config, callContext) {
             const warnVerdict = kind === 'ALLOW'
                 ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified }
                 : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified };
-            return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+            return runUnenforced(config, executeFactory, envelope, warnVerdict, true, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
         }
         const approved = kind === 'ALLOW'
             ? { kind: 'ALLOW', action: 'CONTINUE', envelope, receiptVerified: true }
             : { kind: 'MONITOR', action: 'CONTINUE_WITH_MONITORING', envelope, receiptVerified: true };
-        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation);
+        return runEnforced(config, executeFactory, approved, redacted, freshBasis, cwBasis, monitoringDelivery, monitoringAttestation, grantCtx, grantObs);
     }
     breakerRecord(config);
-    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation);
+    return closedIntegrity(config, receiptVerified ? 'MONITORING_UNWIRED' : 'RECEIPT_MISSING', failPolicy, fctx, cwctx, redacted, detection.artifacts, monitoringDelivery, monitoringAttestation, grantObs);
 }
-function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery, monitoring_attestation) {
+function closedIntegrity(config, cause, failPolicy, fctx, cwctx, redacted, arts, monitoring_delivery, monitoring_attestation, grantObs) {
     const count = (breakers.get(config)?.fails.length) ?? 1;
     emit(config, { type: 'breaker_tripped', at: iso(), cause });
     const v = unavailableVerdict({ cause, failPolicy, resolution: 'CLOSED', action: 'STOP' }, count);
     const { basis } = freshnessFor(config, redacted, fctx, arts);
     const { basis: cw } = conditionalWriteFor(config, redacted, cwctx);
-    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation);
+    return blocked(config, v, false, basis, cw, monitoring_delivery, monitoring_attestation, grantObs);
 }
 function isExpired(envelope) {
     const exp = envelope.expires_at;