@decionis/agent-safe-pipeline 0.1.3 → 0.1.4

package/dist/execution/AuthorizationVerifier.js

@@ -2,26 +2,61 @@ import { z } from "zod";
 import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
 import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
 import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
-const ConsumeResponseSchema = z
-    .object({
+const boundedIdentifier = z
+    .string()
+    .min(1)
+    .max(200)
+    .refine(hasNoControlCharacters, { message: "IDENTIFIER_INVALID" });
+const intentHash = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const CLAIM_TOKEN_PATTERN = /^[\w-]{43,128}$/;
+/**
+ * Mirrors `ExecutionTokenResponse` and `ExecutionTokenClaims` in the Decionis
+ * OpenAPI contract. Claims are declared `additionalProperties: true`, and the
+ * live response carries revalidation fields beyond the documented envelope, so
+ * unknown fields are tolerated; authority is established only by the positive
+ * assertions checked below, never by an extra field.
+ */
+const ClaimResponseSchema = z.looseObject({
     valid: z.literal(true),
-    claims: z
-        .object({
-        jti: z.string().min(1).max(200),
-        decision_id: z.string().min(1).max(200),
-        dossier_id: z.string().min(1).max(200),
+    reason_codes: z.array(boundedIdentifier).max(50).optional(),
+    should_execute: z.boolean().optional(),
+    claims: z.looseObject({
+        iss: boundedIdentifier,
+        sub: boundedIdentifier.optional(),
+        aud: z.string().min(1).max(500).optional(),
+        org_id: z.string().uuid(),
+        dossier_id: boundedIdentifier,
+        decision_id: boundedIdentifier,
+        action: boundedIdentifier,
+        decision: z.literal("allow"),
+        scope: z.literal("execute"),
+        binding: z.looseObject({ intent_hash: intentHash }),
+        jti: boundedIdentifier,
+        iat: z.number().int(),
+        nbf: z.number().int(),
         exp: z.number().int().positive(),
-        binding: z.object({ intent_hash: z.string().regex(/^sha256:[0-9a-f]{64}$/) }).strict(),
-    })
-        .strict(),
-})
-    .strict();
+    }),
+    claim_token: z.string().regex(CLAIM_TOKEN_PATTERN).nullable().optional(),
+    claim_lease_expires_at: z.string().datetime().nullable().optional(),
+});
+const FinalizeResponseSchema = z.looseObject({
+    finalized: z.boolean(),
+    reason_codes: z.array(boundedIdentifier).max(50).optional(),
+});
 const MAX_RESPONSE_BYTES = 100 * 1024;
+/**
+ * Claims a Decionis execution grant through `/v1/execution/claim-token`
+ * immediately before dispatch and finalizes the attempt through
+ * `/v1/execution/finalize-token` afterwards, so commit evidence joins the
+ * Decision Dossier chain.
+ */
 export class DecionisGrantVerifier {
     baseUrl;
     apiKey;
     timeoutMs;
     fetchImpl;
+    /** Claim material is keyed by the frozen authorization it belongs to and never exposed. */
+    claims = new WeakMap();
     constructor(options) {
         this.baseUrl = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback === true);
         this.apiKey = options.apiKey;
@@ -36,10 +71,11 @@ export class DecionisGrantVerifier {
             decision.intentHash !== captured.intentHash) {
             return null;
         }
+        const commitCorrelationId = captured.intent.intentId;
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
-            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/consume-token`, {
+            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/claim-token`, {
                 method: "POST",
                 headers: {
                     authorization: `Bearer ${this.apiKey}`,
@@ -49,7 +85,11 @@ export class DecionisGrantVerifier {
                     execution_token: decision.authorization.token,
                     intent_hash: captured.intentHash,
                     intent: CanonicalIntentHasher.bindingOf(captured.intent),
+                    // A Presence-bound decision is re-verified by the authority at claim
+                    // time, so the same evidence must accompany the claim.
+                    ...(decision.evidence === undefined ? {} : { evidence: decision.evidence }),
                     consumed_by: captured.intent.actor.id,
+                    commit_correlation_id: commitCorrelationId,
                 }),
                 signal: controller.signal,
             });
@@ -58,24 +98,38 @@ export class DecionisGrantVerifier {
             const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
             if (text === null)
                 return null;
-            const parsed = ConsumeResponseSchema.parse(JSON.parse(text));
-            const claimExpiryMs = parsed.claims.exp * 1_000;
+            const parsed = ClaimResponseSchema.parse(JSON.parse(text));
+            const claims = parsed.claims;
+            const claimExpiryMs = claims.exp * 1_000;
             const decisionExpirySeconds = Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000);
-            if (parsed.claims.binding.intent_hash !== captured.intentHash ||
-                parsed.claims.decision_id !== decision.decisionId ||
-                parsed.claims.dossier_id !== decision.dossierId ||
-                parsed.claims.exp !== decisionExpirySeconds ||
+            const audience = `${captured.intent.downstreamTarget.system}:${captured.intent.downstreamTarget.operation}`;
+            if (parsed.should_execute === false ||
+                typeof parsed.claim_token !== "string" ||
+                claims.binding.intent_hash !== captured.intentHash ||
+                claims.decision_id !== decision.decisionId ||
+                claims.dossier_id !== decision.dossierId ||
+                claims.org_id !== captured.intent.tenantId ||
+                claims.sub !== captured.intent.actor.id ||
+                claims.action !== captured.intent.action ||
+                (claims.aud !== undefined && claims.aud !== audience) ||
+                claims.exp !== decisionExpirySeconds ||
                 claimExpiryMs <= Date.now() ||
                 claimExpiryMs > Date.parse(captured.intent.expiresAt)) {
                 return null;
             }
-            return Object.freeze({
-                decisionId: parsed.claims.decision_id,
-                dossierId: parsed.claims.dossier_id,
-                grantId: parsed.claims.jti,
-                intentHash: parsed.claims.binding.intent_hash,
-                expiresAt: new Date(parsed.claims.exp * 1_000).toISOString(),
+            const authorization = Object.freeze({
+                decisionId: claims.decision_id,
+                dossierId: claims.dossier_id,
+                grantId: claims.jti,
+                intentHash: claims.binding.intent_hash,
+                expiresAt: new Date(claims.exp * 1_000).toISOString(),
             });
+            this.claims.set(authorization, {
+                executionToken: decision.authorization.token,
+                claimToken: parsed.claim_token,
+                commitCorrelationId,
+            });
+            return authorization;
         }
         catch {
             return null;
@@ -84,5 +138,52 @@ export class DecionisGrantVerifier {
             clearTimeout(timeout);
         }
     }
+    async finalize(input) {
+        const claim = this.claims.get(input.authorization);
+        if (claim === undefined)
+            return "PENDING";
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/finalize-token`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${this.apiKey}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    execution_token: claim.executionToken,
+                    claim_token: claim.claimToken,
+                    outcome: input.outcome,
+                    commit_correlation_id: claim.commitCorrelationId,
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                return "PENDING";
+            const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
+            if (text === null)
+                return "PENDING";
+            const parsed = FinalizeResponseSchema.parse(JSON.parse(text));
+            if (!parsed.finalized)
+                return "PENDING";
+            this.claims.delete(input.authorization);
+            return "RECORDED";
+        }
+        catch {
+            return "PENDING";
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+function hasNoControlCharacters(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    return true;
 }
 //# sourceMappingURL=AuthorizationVerifier.js.map

package/dist/execution/AuthorizationVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAmB3E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACvF,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAUtC,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,EAAE;gBAClF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACtC,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YAChD,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACzD,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACjD,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBAC3C,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;gBACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;gBACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW;gBAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AA0C3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC7D,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAgBtC;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAE5E,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,uDAAuD;oBACvD,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC3E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;aACpB,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;iBACjD,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/execution/SafeExecutor.d.ts

@@ -1,25 +1,90 @@
 import type { GateDecision } from "../decision/DecisionAuthority.js";
+import type { AuditRecorder } from "../audit/AuditRecorder.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
 import type { ActionRegistry } from "./ActionRegistry.js";
-import type { AuthorizationVerifier, VerifiedAuthorization } from "./AuthorizationVerifier.js";
-export type ExecutionBlockReason = "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID";
+import type { AuthorizationVerifier, ExecutionFinalization, VerifiedAuthorization } from "./AuthorizationVerifier.js";
+export type ExecutionBlockReason = "DECISION_NOT_AUTHORITATIVE" | "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID" | "RECOVERY_BINDING_MISMATCH" | "AUDIT_UNAVAILABLE";
+export type ExecutionPreDispatchFailureReason = "HANDLER_FAILED_BEFORE_DISPATCH" | "AUDIT_UNAVAILABLE";
+export interface ExecutionRecoveryReference extends VerifiedAuthorization {
+    readonly version: "agent-safe.recovery/1";
+    readonly idempotencyKey: string;
+}
+export interface ExecutionBlockedResult {
+    readonly outcome: "BLOCKED";
+    readonly executed: false;
+    readonly reason: ExecutionBlockReason;
+    readonly result: null;
+    readonly authorization: null;
+}
+export interface ProviderOutcomeUnknownResult {
+    readonly outcome: "UNKNOWN_AFTER_DISPATCH";
+    readonly executed: null;
+    readonly reason: "PROVIDER_OUTCOME_UNKNOWN";
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+    readonly recovery: ExecutionRecoveryReference;
+}
+/**
+ * Every outcome that consumed a grant reports whether the attempt's commit
+ * evidence reached the authority. Finalization is evidence, not authority;
+ * it never changes `outcome` or `executed`.
+ */
 export type SafeExecutionResult<TResult = unknown> = {
+    readonly outcome: "COMPLETED";
     readonly executed: true;
+    readonly recovered: false;
+    readonly result: TResult;
+    readonly authorization: VerifiedAuthorization;
+    readonly finalization: ExecutionFinalization;
+} | ExecutionBlockedResult | {
+    readonly outcome: "FAILED_BEFORE_DISPATCH";
+    readonly executed: false;
+    readonly reason: ExecutionPreDispatchFailureReason;
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+    readonly finalization: ExecutionFinalization;
+} | (ProviderOutcomeUnknownResult & {
+    readonly finalization: ExecutionFinalization;
+});
+export type ExecutionReconciliationResult<TResult = unknown> = {
+    readonly outcome: "COMPLETED";
+    readonly executed: true;
+    readonly recovered: true;
     readonly result: TResult;
     readonly authorization: VerifiedAuthorization;
 } | {
+    readonly outcome: "DEFINITELY_NOT_EXECUTED";
     readonly executed: false;
-    readonly reason: ExecutionBlockReason;
+    readonly recovered: true;
+    readonly reason: "PROVIDER_CONFIRMED_NOT_EXECUTED";
     readonly result: null;
-    readonly authorization: null;
-};
+    readonly authorization: VerifiedAuthorization;
+} | ExecutionBlockedResult | ProviderOutcomeUnknownResult;
 export declare class SafeExecutor {
     private readonly registry;
     private readonly verifier;
+    private readonly audit?;
     private readonly hasher;
-    constructor(registry: ActionRegistry, verifier: AuthorizationVerifier);
+    constructor(registry: ActionRegistry, verifier: AuthorizationVerifier, audit?: AuditRecorder | undefined);
     run<TResult = unknown>(captured: CapturedIntent, decision: GateDecision): Promise<SafeExecutionResult<TResult>>;
+    /**
+     * Reports the attempt outcome to the verifier's authority. A missing,
+     * failing, or malformed finalization can never alter the execution result.
+     */
+    private finalize;
+    private static finalizationCode;
+    reconcile<TResult = unknown>(captured: CapturedIntent, recovery: ExecutionRecoveryReference): Promise<ExecutionReconciliationResult<TResult>>;
+    /**
+     * Observational artifacts carry an explicit non-authoritative marker. They
+     * must never be interpreted as a `GateDecision`, even after an unsafe cast
+     * or a JSON round trip.
+     */
+    private static isAuthoritativeDecision;
     private intentConforms;
-    private static blocked;
+    private block;
+    private failedBeforeDispatch;
+    private record;
+    private static recoveryReference;
+    private static authorizationFrom;
 }
 //# sourceMappingURL=SafeExecutor.d.ts.map

package/dist/execution/SafeExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE/F,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B,CAAC;AAEN,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAGnC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGrC,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA8CxC,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}
+{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EACV,qBAAqB,EAErB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC5B,4BAA4B,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,mBAAmB,CAAC;AAExB,MAAM,MAAM,iCAAiC,GAC3C,gCAAgC,GAAG,mBAAmB,CAAC;AAEzD,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,sBAAsB,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,CAAC,4BAA4B,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEtF,MAAM,MAAM,6BAA6B,CAAC,OAAO,GAAG,OAAO,IACvD;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IALzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAGnC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,aAAa,YAAA;IAG3B,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAuJxC;;;OAGG;YACW,QAAQ;IAqBtB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAIlB,SAAS,CAAC,OAAO,GAAG,OAAO,EACtC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAuElD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAQtC,OAAO,CAAC,cAAc;YAeR,KAAK;YAkBL,oBAAoB;YA6BpB,MAAM;IAOpB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAWhC,OAAO,CAAC,MAAM,CAAC,iBAAiB;CASjC"}

package/dist/execution/SafeExecutor.js

@@ -2,23 +2,44 @@ import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
 export class SafeExecutor {
     registry;
     verifier;
+    audit;
     hasher = new CanonicalIntentHasher();
-    constructor(registry, verifier) {
+    constructor(registry, verifier, audit) {
         this.registry = registry;
         this.verifier = verifier;
+        this.audit = audit;
     }
     async run(captured, decision) {
+        const startedAt = Date.now();
+        // Stryker disable next-line all: Audit payload mapping is covered by lifecycle event assertions.
+        const intentRecorded = await this.record({ eventType: "INTENT_CAPTURED", captured });
+        // An observational artifact (shadow observation, serialized audit event) is
+        // rejected before it is recorded or inspected as if it were a decision.
+        if (!SafeExecutor.isAuthoritativeDecision(decision)) {
+            return await this.block(captured, undefined, "DECISION_NOT_AUTHORITATIVE", startedAt);
+        }
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        const decisionRecorded = await this.record({
+            eventType: decision.failClosed ? "AUTHORITY_FAILED_CLOSED" : "AUTHORITY_DECISION",
+            captured,
+            decision,
+        });
+        // Stryker restore all
+        if (this.audit?.requiresDeliveryBeforeExecution === true &&
+            (!intentRecorded || !decisionRecorded)) {
+            return await this.block(captured, decision, "AUDIT_UNAVAILABLE", startedAt);
+        }
         if (decision.verdict !== "ALLOW" || decision.failClosed) {
-            return SafeExecutor.blocked("DECISION_NOT_ALLOW");
+            return await this.block(captured, decision, "DECISION_NOT_ALLOW", startedAt);
         }
         if (decision.intentHash !== captured.intentHash) {
-            return SafeExecutor.blocked("INTENT_BINDING_MISMATCH");
+            return await this.block(captured, decision, "INTENT_BINDING_MISMATCH", startedAt);
         }
-        if (decision.authorization === null) {
-            return SafeExecutor.blocked("AUTHORIZATION_MISSING");
+        if (decision.authorization === null || typeof decision.authorization !== "object") {
+            return await this.block(captured, decision, "AUTHORIZATION_MISSING", startedAt);
         }
         if (!this.intentConforms(captured)) {
-            return SafeExecutor.blocked("INTENT_CONFORMANCE_FAILED");
+            return await this.block(captured, decision, "INTENT_CONFORMANCE_FAILED", startedAt);
         }
         this.registry.validate(captured);
         let authorization;
@@ -26,10 +47,11 @@ export class SafeExecutor {
             authorization = await this.verifier.verifyAndConsume(captured, decision);
         }
         catch {
-            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
+            return await this.block(captured, decision, "AUTHORIZATION_INVALID", startedAt);
+        }
+        if (authorization === null) {
+            return await this.block(captured, decision, "AUTHORIZATION_INVALID", startedAt);
         }
-        if (authorization === null)
-            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
         const authorizationExpiry = Date.parse(authorization.expiresAt);
         if (authorization.decisionId !== decision.decisionId ||
             authorization.dossierId !== decision.dossierId ||
@@ -39,19 +61,182 @@ export class SafeExecutor {
                 Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000) ||
             authorizationExpiry <= Date.now() ||
             authorizationExpiry > Date.parse(captured.intent.expiresAt)) {
-            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
+            return await this.block(captured, decision, "AUTHORIZATION_INVALID", startedAt);
         }
         if (!this.intentConforms(captured)) {
-            return SafeExecutor.blocked("INTENT_CONFORMANCE_FAILED");
+            return await this.block(captured, decision, "INTENT_CONFORMANCE_FAILED", startedAt);
+        }
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        const grantRecorded = await this.record({
+            eventType: "GRANT_CONSUMED",
+            captured,
+            decision,
+            authorization,
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        if (this.audit?.requiresDeliveryBeforeExecution === true && !grantRecorded) {
+            return await this.failedBeforeDispatch(captured, decision, authorization, "AUDIT_UNAVAILABLE", startedAt);
+        }
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        const executionRecorded = await this.record({
+            eventType: "EXECUTION_STARTED",
+            captured,
+            decision,
+            authorization,
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        if (this.audit?.requiresDeliveryBeforeExecution === true && !executionRecorded) {
+            return await this.failedBeforeDispatch(captured, decision, authorization, "AUDIT_UNAVAILABLE", startedAt);
         }
-        let result;
+        const attempt = await this.registry.executeTracked(captured, authorization);
+        if (attempt.status === "FAILED_BEFORE_DISPATCH") {
+            return await this.failedBeforeDispatch(captured, decision, authorization, "HANDLER_FAILED_BEFORE_DISPATCH", startedAt);
+        }
+        if (attempt.status === "UNKNOWN_AFTER_DISPATCH") {
+            const finalization = await this.finalize(captured, decision, authorization, "INDETERMINATE");
+            const result = {
+                outcome: "UNKNOWN_AFTER_DISPATCH",
+                executed: null,
+                reason: "PROVIDER_OUTCOME_UNKNOWN",
+                result: null,
+                authorization,
+                recovery: SafeExecutor.recoveryReference(captured, authorization),
+                finalization,
+            };
+            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+            await this.record({
+                eventType: "EXECUTION_OUTCOME_UNKNOWN",
+                captured,
+                decision,
+                authorization,
+                reasonCodes: [result.reason, SafeExecutor.finalizationCode(finalization)],
+                durationMs: Date.now() - startedAt,
+            });
+            // Stryker restore all
+            return result;
+        }
+        const finalization = await this.finalize(captured, decision, authorization, "COMMITTED");
+        const result = {
+            outcome: "COMPLETED",
+            executed: true,
+            recovered: false,
+            result: attempt.result,
+            authorization,
+            finalization,
+        };
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType: "EXECUTION_COMPLETED",
+            captured,
+            decision,
+            authorization,
+            reasonCodes: [SafeExecutor.finalizationCode(finalization)],
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        return result;
+    }
+    /**
+     * Reports the attempt outcome to the verifier's authority. A missing,
+     * failing, or malformed finalization can never alter the execution result.
+     */
+    async finalize(captured, decision, authorization, outcome) {
+        const finalize = this.verifier.finalize;
+        if (finalize === undefined)
+            return "UNSUPPORTED";
         try {
-            result = (await this.registry.execute(captured, authorization));
+            const status = await finalize.call(this.verifier, {
+                captured,
+                decision,
+                authorization,
+                outcome,
+            });
+            return status === "RECORDED" ? "RECORDED" : "PENDING";
         }
         catch {
-            throw new Error("ACTION_EXECUTION_FAILED");
+            return "PENDING";
+        }
+    }
+    static finalizationCode(finalization) {
+        return `COMMIT_FINALIZATION_${finalization}`;
+    }
+    async reconcile(captured, recovery) {
+        const startedAt = Date.now();
+        if (recovery.version !== "agent-safe.recovery/1" ||
+            recovery.intentHash !== captured.intentHash ||
+            recovery.idempotencyKey !== captured.intent.idempotencyKey ||
+            !this.intentConforms(captured)) {
+            return await this.block(captured, undefined, "RECOVERY_BINDING_MISMATCH", startedAt);
+        }
+        const reconciliation = await this.registry.reconcile(captured, recovery.idempotencyKey);
+        const authorization = SafeExecutor.authorizationFrom(recovery);
+        if (reconciliation.status === "COMPLETED") {
+            const result = {
+                outcome: "COMPLETED",
+                executed: true,
+                recovered: true,
+                result: reconciliation.result,
+                authorization,
+            };
+            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+            await this.record({
+                eventType: "RECONCILIATION_COMPLETED",
+                captured,
+                authorization,
+                durationMs: Date.now() - startedAt,
+            });
+            // Stryker restore all
+            return result;
         }
-        return { executed: true, result, authorization };
+        if (reconciliation.status === "NOT_EXECUTED") {
+            const result = {
+                outcome: "DEFINITELY_NOT_EXECUTED",
+                executed: false,
+                recovered: true,
+                reason: "PROVIDER_CONFIRMED_NOT_EXECUTED",
+                result: null,
+                authorization,
+            };
+            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+            await this.record({
+                eventType: "RECONCILIATION_NOT_EXECUTED",
+                captured,
+                authorization,
+                reasonCodes: [result.reason],
+                durationMs: Date.now() - startedAt,
+            });
+            // Stryker restore all
+            return result;
+        }
+        const result = {
+            outcome: "UNKNOWN_AFTER_DISPATCH",
+            executed: null,
+            reason: "PROVIDER_OUTCOME_UNKNOWN",
+            result: null,
+            authorization,
+            recovery,
+        };
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType: "RECONCILIATION_UNKNOWN",
+            captured,
+            authorization,
+            reasonCodes: [result.reason],
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        return result;
+    }
+    /**
+     * Observational artifacts carry an explicit non-authoritative marker. They
+     * must never be interpreted as a `GateDecision`, even after an unsafe cast
+     * or a JSON round trip.
+     */
+    static isAuthoritativeDecision(decision) {
+        const candidate = decision;
+        return candidate.authority !== "OBSERVATIONAL" && candidate.mode !== "SHADOW";
     }
     intentConforms(captured) {
         let recomputed = null;
@@ -66,8 +251,59 @@ export class SafeExecutor {
             recomputed.canonicalIntent === captured.canonicalIntent &&
             recomputed.byteLength === captured.byteLength);
     }
-    static blocked(reason) {
-        return { executed: false, reason, result: null, authorization: null };
+    async block(captured, decision, reason, startedAt) {
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType: "EXECUTION_BLOCKED",
+            captured,
+            ...(decision === undefined ? {} : { decision }),
+            reasonCodes: [reason],
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        return { outcome: "BLOCKED", executed: false, reason, result: null, authorization: null };
+    }
+    async failedBeforeDispatch(captured, decision, authorization, reason, startedAt) {
+        // The grant was consumed but no side effect was attempted.
+        const finalization = await this.finalize(captured, decision, authorization, "FAILED");
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType: "EXECUTION_FAILED_BEFORE_DISPATCH",
+            captured,
+            decision,
+            authorization,
+            reasonCodes: [reason, SafeExecutor.finalizationCode(finalization)],
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        return {
+            outcome: "FAILED_BEFORE_DISPATCH",
+            executed: false,
+            reason,
+            result: null,
+            authorization,
+            finalization,
+        };
+    }
+    async record(input) {
+        // Stryker disable next-line BooleanLiteral: The value is irrelevant when no audit policy exists.
+        return this.audit === undefined ? true : await this.audit.record(input);
+    }
+    static recoveryReference(captured, authorization) {
+        return Object.freeze({
+            version: "agent-safe.recovery/1",
+            ...authorization,
+            idempotencyKey: captured.intent.idempotencyKey,
+        });
+    }
+    static authorizationFrom(recovery) {
+        return Object.freeze({
+            decisionId: recovery.decisionId,
+            dossierId: recovery.dossierId,
+            grantId: recovery.grantId,
+            intentHash: recovery.intentHash,
+            expiresAt: recovery.expiresAt,
+        });
     }
 }
 //# sourceMappingURL=SafeExecutor.js.map