@decionis/agent-safe-pipeline 0.1.4 → 0.3.0

package/dist/testing/LocalAuthority.js

@@ -15,7 +15,7 @@
  * Grants, claims, escalations, and commit outcomes are synthetic in-memory
  * state. Nothing here is a real policy, tenant, or credential.
  */
-import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { createHash, createPublicKey, generateKeyPairSync, randomBytes, randomUUID, sign, verify, } from "node:crypto";
 import { createServer } from "node:http";
 import { z } from "zod";
 import { readBody } from "./LocalPresence.js";
@@ -28,6 +28,16 @@ const MAX_RECORDED_BODY_CHARS = 4_096;
 const SOCKET_TIMEOUT_MS = 10_000;
 const GRANT_TTL_MS = 60_000;
 const CLAIM_LEASE_MS = 30_000;
+/** The issuer the fixture's grants and attestations name; a provider double checks it. */
+export const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
+/** Where the fixture publishes its attestation key, at the path Decionis documents. */
+export const LOCAL_AUTHORITY_JWKS_PATH = "/.well-known/decionis-execution-grant-jwks.json";
+export const CLAIM_ATTESTATION_TYPE = "decionis-claim-attestation+jwt";
+/** The protected header `typ` of a verifying provider's effect receipt (VP-3). */
+export const EFFECT_RECEIPT_TYPE = "decionis-effect-receipt+jwt";
+const COMPACT_JWS = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+/** The profile the fixture digests parameters under; the only one the pipeline reproduces. */
+const JCS_PROFILE = "RFC8785/JCS";
 const boundedId = z.string().trim().min(1).max(200);
 const sha256Digest = z.string().regex(/^sha256:[0-9a-f]{64}$/);
 const roleId = z.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/);
@@ -60,6 +70,7 @@ const IntentBindingSchema = z.strictObject({
         operation: boundedId,
         endpoint: z.string().min(1).max(500).optional(),
     }),
+    expected_effect_digest: sha256Digest.optional(),
 });
 const EvidenceSchema = z.strictObject({
     humanApproval: z
@@ -70,6 +81,61 @@ const EvidenceSchema = z.strictObject({
     })
         .optional(),
 });
+/** `boundedIdentifier` from the Decionis `EffectEvidence` contract, verbatim. */
+const boundedEffectIdentifier = z.string().trim().min(1).max(500);
+/**
+ * Protocol 1.1 `EffectEvidence`, mirrored from the Decionis shared contract
+ * including its `CONFIRMED` refinements: a confirmed observation may not rest
+ * on a bare downstream acknowledgement, must name an observer with a version,
+ * must have observed exactly the expected effect at a stated time, and must
+ * carry a digest or a reference for the observation itself.
+ */
+const EffectEvidenceSchema = z
+    .strictObject({
+    version: z.literal("1.0"),
+    status: z.enum(["CONFIRMED", "UNCONFIRMED"]),
+    observation_method: z.enum([
+        "DOWNSTREAM_ACK",
+        "READ_AFTER_WRITE",
+        "EVENT_CONFIRMATION",
+        "STATE_RECONCILIATION",
+        "SIGNED_RECEIPT",
+        "EXTERNAL_ATTESTATION",
+        "HUMAN_VALIDATION",
+    ]),
+    observer: z
+        .strictObject({
+        id: boundedEffectIdentifier,
+        version: boundedEffectIdentifier.nullable(),
+    })
+        .nullable(),
+    expected_effect_digest: sha256Digest,
+    observed_effect_digest: sha256Digest.nullable(),
+    observed_at: z.iso.datetime().nullable(),
+    evidence_digest: sha256Digest.nullable(),
+    evidence_reference: boundedEffectIdentifier.nullable(),
+    execution_correlation_id: boundedEffectIdentifier,
+})
+    .superRefine((evidence, context) => {
+    if (evidence.status !== "CONFIRMED")
+        return;
+    const fail = (message) => {
+        context.addIssue({ code: "custom", message });
+    };
+    if (evidence.observation_method === "DOWNSTREAM_ACK")
+        fail("EFFECT_METHOD_INSUFFICIENT");
+    if (evidence.observer === null || evidence.observer.version === null) {
+        fail("EFFECT_OBSERVER_REQUIRED");
+    }
+    if (evidence.observed_effect_digest !== evidence.expected_effect_digest) {
+        fail("EFFECT_OBSERVED_DIGEST_MISMATCH");
+    }
+    if (evidence.observed_at === null)
+        fail("EFFECT_OBSERVED_AT_REQUIRED");
+    if (evidence.evidence_digest === null && evidence.evidence_reference === null) {
+        fail("EFFECT_EVIDENCE_ARTIFACT_REQUIRED");
+    }
+});
 const ManagedEscalationRequestSchema = z.strictObject({
     mode: z.literal("MANAGED"),
     approver: z
@@ -112,8 +178,36 @@ const FinalizeRequestSchema = z.strictObject({
     outcome: z.enum(["COMMITTED", "FAILED", "INDETERMINATE"]),
     commit_correlation_id: boundedId,
     downstream_evidence: z.record(z.string(), z.unknown()).optional(),
+    // Deliberately unvalidated here: the hosted route answers malformed effect
+    // evidence with a 409 and a reason code, not with a 400 request rejection,
+    // so the shape is checked where that answer is produced.
+    effect_evidence: z.unknown().optional(),
+    // The provider's receipt: only its shape is a request error. What it says
+    // is verified and recorded, never a reason to refuse the finalization.
+    effect_receipt: z.string().min(1).max(20_000).regex(COMPACT_JWS).optional(),
+});
+/** `ExecutionProviderKeyRegistrationRequest`: the public half of an Ed25519 key. */
+const ProviderKeyRegistrationSchema = z.strictObject({
+    org_id: z.uuid().optional(),
+    kid: boundedId,
+    issuer: z.string().trim().min(1).max(500),
+    algorithm: z.literal("EdDSA"),
+    public_jwk: z.strictObject({
+        kty: z.literal("OKP"),
+        crv: z.literal("Ed25519"),
+        x: z.string().regex(/^[\w-]{43}$/),
+        kid: z.string().optional(),
+        alg: z.literal("EdDSA").optional(),
+        use: z.literal("sig").optional(),
+    }),
+    label: z.string().max(200).optional(),
 });
 const BINDING_KEYS = Object.keys(IntentBindingSchema.shape);
+function effectStatus(value) {
+    return value === "EFFECTED" || value === "REFUSED" || value === "INDETERMINATE" ? value : null;
+}
+/** The organization a provisioned synthetic workspace belongs to. */
+export const LOCAL_AUTHORITY_PROVISIONAL_ORG_ID = "00000000-0000-4000-8000-000000000008";
 /**
  * Independent canonicalization: keys sorted by UTF-16 code unit, values encoded
  * with JSON.stringify semantics. This deliberately does not import the
@@ -163,12 +257,25 @@ export class LocalAuthority {
     grants = new Map();
     /** Managed escalations keyed by their opaque identifier. */
     escalations = new Map();
+    /** The verifying providers' receipt keys, by `kid`, as `/v1/execution/provider-keys` registers them. */
+    providerKeys = new Map();
     apiKey;
     presence;
     legacyVerifyReceipt;
     policy;
     managedApproverId;
+    trustedEffectObserverIds;
     clock;
+    attestationKey;
+    /** The `kid` the fixture's attestations name; a provider double looks it up in the JWKS. */
+    attestationKeyId = "synthetic-exec-grant-1";
+    /**
+     * A drill knob: when set, the next claim binds a digest over parameters
+     * other than the ones captured, which is what a tampered or mismatched
+     * authority looks like from the executor's side, and what BEAP-L3-BND-01
+     * says the executor must refuse.
+     */
+    misbindNextPayloadDigest = false;
     overrides = {
         enforce: [],
         status: [],
@@ -178,17 +285,174 @@ export class LocalAuthority {
     managedByIntent = new Map();
     nextManagedLifecycle = null;
     decisions = 0;
+    /** Every decision minted, by dossier id, for `GET /v1/protocol/dossiers/{id}`. */
+    dossiers = new Map();
+    verificationLinks;
     server = null;
     port = 0;
     constructor(options = {}) {
         if (process.env.NODE_ENV === "production")
             throw new Error("LOCAL_DOUBLE_FORBIDDEN");
         this.apiKey = options.apiKey ?? LOCAL_AUTHORITY_API_KEY;
+        this.verificationLinks = options.verificationLinks === true;
         this.presence = options.presence;
         this.legacyVerifyReceipt = options.verifyReceipt;
         this.policy = options.policy ?? defaultPolicy;
         this.managedApproverId = options.managedApproverId ?? "synthetic-managed-approver";
+        this.trustedEffectObserverIds = options.trustedEffectObserverIds ?? [];
         this.clock = options.clock ?? Date.now;
+        const keys = generateKeyPairSync("ed25519");
+        this.attestationKey = {
+            privateKey: keys.privateKey,
+            publicJwk: keys.publicKey.export({ format: "jwk" }),
+        };
+    }
+    /** The fixture's JWKS, as `GET /.well-known/decionis-execution-grant-jwks.json` serves it. */
+    get jwks() {
+        return {
+            keys: [
+                { ...this.attestationKey.publicJwk, kid: this.attestationKeyId, alg: "EdDSA", use: "sig" },
+            ],
+        };
+    }
+    /**
+     * A compact JWS over the claim, signed the way Decionis signs one: EdDSA,
+     * the grant key, the attestation type in the protected header. Built with
+     * `node:crypto` alone so the fixture stays an independent implementation.
+     */
+    attest(grant, claimValidatedAt, leaseExpiresAt) {
+        const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+        const now = Math.floor(this.clock() / 1_000);
+        const claims = {
+            iss: LOCAL_AUTHORITY_ISSUER,
+            sub: grant.jti,
+            org_id: grant.tenantId,
+            dossier_id: grant.dossierId,
+            decision_id: grant.decisionId,
+            binding: {
+                intent_hash: grant.intentHash,
+                execution_payload_digest: grant.payloadDigest,
+                execution_payload_canonicalization_profile: JCS_PROFILE,
+                ...(grant.expectedEffectDigest === null
+                    ? {}
+                    : { expected_effect_digest: grant.expectedEffectDigest }),
+                execution_nonce: grant.nonce,
+                execution_correlation_id: grant.correlationId ?? "",
+            },
+            claim_token_digest: `sha256:${createHash("sha256")
+                .update(grant.claimToken ?? "", "utf8")
+                .digest("hex")}`,
+            claim_validated_at: claimValidatedAt,
+            jti: randomUUID(),
+            iat: now,
+            nbf: now,
+            exp: Math.floor(Date.parse(leaseExpiresAt) / 1_000),
+        };
+        const header = encode({
+            alg: "EdDSA",
+            kid: this.attestationKeyId,
+            typ: CLAIM_ATTESTATION_TYPE,
+        });
+        const payload = encode(claims);
+        const signature = sign(null, Buffer.from(`${header}.${payload}`, "ascii"), this.attestationKey.privateKey);
+        return `${header}.${payload}.${signature.toString("base64url")}`;
+    }
+    /**
+     * Registers the public half of a provider's receipt key, as the hosted
+     * `POST /v1/execution/provider-keys` does; a test or a demo provider calls
+     * it directly rather than over HTTP.
+     */
+    registerProviderKey(input) {
+        this.providerKeys.set(input.kid, {
+            kid: input.kid,
+            issuer: input.issuer,
+            publicKey: createPublicKey({ key: input.publicJwk, format: "jwk" }),
+            label: input.label ?? null,
+        });
+    }
+    /**
+     * Reads a receipt the way the hosted authority does: the protected header
+     * names an Ed25519 key the organisation registered; the signature verifies
+     * under it; the issuer is the one registered with the key and the audience
+     * is this authority; and the claims describe this grant and this claim,
+     * through `sub`, the decision and dossier ids and the digest of the claim
+     * token being finalized. Anything else is recorded with its code, and the
+     * finalization proceeds regardless.
+     */
+    readEffectReceipt(token, grant, claimToken) {
+        const record = (code, partial = {}) => ({
+            token,
+            verified: code === "EFFECT_RECEIPT_VERIFIED",
+            verification_code: code,
+            provider_key_id: null,
+            issuer: null,
+            effect_status: null,
+            effect_digest: null,
+            effect_reference: null,
+            effected_at: null,
+            ...partial,
+        });
+        const [encodedHeader = "", encodedPayload = "", encodedSignature = ""] = token.split(".");
+        let header;
+        let payload;
+        try {
+            header = JSON.parse(Buffer.from(encodedHeader, "base64url").toString("utf8"));
+            payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
+        }
+        catch {
+            return record("EFFECT_RECEIPT_MALFORMED");
+        }
+        if (header.alg !== "EdDSA" ||
+            header.typ !== EFFECT_RECEIPT_TYPE ||
+            typeof header.kid !== "string" ||
+            header.kid.length === 0) {
+            return record("EFFECT_RECEIPT_MALFORMED");
+        }
+        const key = this.providerKeys.get(header.kid);
+        if (key === undefined) {
+            return record("EFFECT_RECEIPT_KEY_UNKNOWN", { provider_key_id: header.kid });
+        }
+        const known = { provider_key_id: key.kid, issuer: key.issuer };
+        const signed = Buffer.from(`${encodedHeader}.${encodedPayload}`, "ascii");
+        if (!verify(null, signed, key.publicKey, Buffer.from(encodedSignature, "base64url")) ||
+            payload.iss !== key.issuer ||
+            payload.aud !== LOCAL_AUTHORITY_ISSUER) {
+            return record("EFFECT_RECEIPT_SIGNATURE_INVALID", known);
+        }
+        const effect = typeof payload.effect === "object" && payload.effect !== null
+            ? payload.effect
+            : null;
+        const status = effectStatus(effect?.status);
+        const digest = effect?.digest;
+        const effectedAt = effect?.effected_at;
+        if (typeof payload.sub !== "string" ||
+            typeof payload.decision_id !== "string" ||
+            typeof payload.dossier_id !== "string" ||
+            typeof payload.claim_token_digest !== "string" ||
+            typeof payload.jti !== "string" ||
+            typeof payload.iat !== "number" ||
+            status === null ||
+            (digest !== undefined && !sha256Digest.safeParse(digest).success) ||
+            typeof effectedAt !== "string" ||
+            Number.isNaN(Date.parse(effectedAt))) {
+            return record("EFFECT_RECEIPT_MALFORMED", known);
+        }
+        const described = {
+            ...known,
+            effect_status: status,
+            effect_digest: typeof digest === "string" ? digest : null,
+            effect_reference: typeof effect?.reference === "string" ? effect.reference : null,
+            effected_at: new Date(effectedAt).toISOString(),
+        };
+        const claimTokenDigest = `sha256:${createHash("sha256").update(claimToken, "utf8").digest("hex")}`;
+        if (payload.sub !== grant.jti ||
+            payload.decision_id !== grant.decisionId ||
+            payload.dossier_id !== grant.dossierId ||
+            payload.claim_token_digest !== claimTokenDigest ||
+            (typeof payload.intent_hash === "string" && payload.intent_hash !== grant.intentHash)) {
+            return record("EFFECT_RECEIPT_BINDING_MISMATCH", described);
+        }
+        return record("EFFECT_RECEIPT_VERIFIED", described);
     }
     get baseUrl() {
         return `${LOOPBACK_ORIGIN}:${this.port}`;
@@ -249,9 +513,38 @@ export class LocalAuthority {
             record.body = truncate(raw);
             return this.send(res, record, 400, { error: "REQUEST_MALFORMED" });
         }
+        // The verification keys are public, as Decionis's are: a provider double
+        // fetches them with no credential to the authority at all.
+        if (req.method === "GET" && url.pathname === LOCAL_AUTHORITY_JWKS_PATH) {
+            return this.send(res, record, 200, this.jwks);
+        }
+        // The public lane: a workspace minted with no account, as the hosted
+        // authority mints one, with this double's own key as the raw key.
+        if (req.method === "POST" && url.pathname === "/v1/public/agents/provision") {
+            return this.send(res, record, 201, {
+                org_id: LOCAL_AUTHORITY_PROVISIONAL_ORG_ID,
+                raw_key: this.apiKey,
+                provisional: true,
+                limits: {
+                    requests_per_minute: 10,
+                    workspaces_per_network_per_day: 5,
+                    governed_decisions_per_month: 50,
+                },
+                claim: { note: "synthetic workspace on loopback; there is nothing to claim" },
+                next: {},
+            });
+        }
         if (req.headers.authorization !== `Bearer ${this.apiKey}`) {
             return this.send(res, record, 401, { error: "UNAUTHORIZED" });
         }
+        const dossierLookup = url.pathname.match(/^\/v1\/protocol\/dossiers\/([^/]+)$/);
+        if (req.method === "GET" && dossierLookup !== null) {
+            const minted = this.dossiers.get(decodeURIComponent(dossierLookup[1] ?? ""));
+            if (minted === undefined || url.searchParams.get("org_id") !== minted.request.tenant_id) {
+                return this.send(res, record, 404, { error: "DOSSIER_NOT_FOUND" });
+            }
+            return this.send(res, record, 200, this.dossierRecord(minted.request, minted.decision));
+        }
         const escalationLookup = url.pathname.match(/^\/v1\/authority\/escalations\/([^/]+)$/);
         if (req.method === "GET" && escalationLookup !== null) {
             return this.respond(res, record, "status", this.managedStatus(decodeURIComponent(escalationLookup[1] ?? "")));
@@ -265,6 +558,8 @@ export class LocalAuthority {
             return this.send(res, record, 415, { error: "UNSUPPORTED_MEDIA_TYPE" });
         }
         switch (url.pathname) {
+            case "/v1/execution/provider-keys":
+                return this.send(res, record, ...this.registerProviderKeyRoute(record));
             case "/v1/authority/enforce-and-bind":
                 return this.respond(res, record, "enforce", this.enforceAndBind(record));
             case "/v1/execution/claim-token":
@@ -276,6 +571,31 @@ export class LocalAuthority {
                 return this.send(res, record, 404, { error: "NOT_FOUND" });
         }
     }
+    /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
+    registerProviderKeyRoute(record) {
+        const parsed = ProviderKeyRegistrationSchema.safeParse(record.body);
+        if (!parsed.success)
+            return [400, { error: "INVALID_BODY" }];
+        const body = parsed.data;
+        this.registerProviderKey({
+            kid: body.kid,
+            issuer: body.issuer,
+            publicJwk: { kty: body.public_jwk.kty, crv: body.public_jwk.crv, x: body.public_jwk.x },
+            ...(body.label === undefined ? {} : { label: body.label }),
+        });
+        return [
+            201,
+            {
+                service: "decionis",
+                kid: body.kid,
+                issuer: body.issuer,
+                algorithm: "EdDSA",
+                label: body.label ?? null,
+                created_at: new Date(this.clock()).toISOString(),
+                revoked_at: null,
+            },
+        ];
+    }
     enforceAndBind(record) {
         const parsed = AuthorityRequestSchema.safeParse(record.body);
         if (!parsed.success)
@@ -293,12 +613,78 @@ export class LocalAuthority {
         this.decisions += 1;
         const decision = this.baseDecision(request, evaluation.status, [evaluation.reasonCode]);
         if (evaluation.status === "ESCALATE" && request.escalation?.mode === "MANAGED") {
-            return { status: 200, body: this.openManaged(request, decision) };
+            return { status: 200, body: this.remember(request, this.openManaged(request, decision)) };
         }
         if (evaluation.status !== "ALLOW" || request.mode !== "ENFORCEMENT") {
-            return { status: 200, body: decision };
+            return { status: 200, body: this.remember(request, decision) };
         }
-        return { status: 200, body: this.grantDecision(request, decision, evaluation.approval) };
+        return {
+            status: 200,
+            body: this.remember(request, this.grantDecision(request, decision, evaluation.approval)),
+        };
+    }
+    /** Keeps a minted decision for its dossier route, with the envelope when links are on. */
+    remember(request, decision) {
+        const dossierId = decision["dossier_id"];
+        if (typeof dossierId !== "string")
+            return decision;
+        const linked = this.verificationLinks
+            ? {
+                ...decision,
+                verification: {
+                    verification_page_url: `${this.baseUrl}/verify/${dossierId}?sig=synthetic`,
+                    verification_url: `${this.baseUrl}/v1/public/decision-dossiers/${dossierId}/verify?sig=synthetic`,
+                    link_expires_at: new Date(this.clock() + 24 * 60 * 60 * 1_000).toISOString(),
+                    signature_scheme: "synthetic",
+                },
+            }
+            : decision;
+        this.dossiers.set(dossierId, { request, decision: linked });
+        return linked;
+    }
+    /**
+     * The persisted record, shaped as `GET /v1/protocol/dossiers/{id}` returns
+     * it: a payload with the routing decision, the inputs and a proof bundle
+     * naming this double's key. The artifacts are not signed; the record says
+     * so in its issuer tier, and nothing here claims otherwise.
+     */
+    dossierRecord(request, decision) {
+        const generatedAt = new Date(this.clock()).toISOString();
+        return {
+            service: "synthetic-authority",
+            protocol_version: "synthetic",
+            dossier: {
+                dossier_payload: {
+                    schema_version: "decionis.decision_dossier/2.0",
+                    dossier_id: decision["dossier_id"],
+                    generated_at: generatedAt,
+                    routing_decision: {
+                        decision_id: decision["decision_id"],
+                        outcome: decision["status"],
+                        authority: decision["authority_classification"],
+                        policy_version: decision["policy_version"],
+                        reason_codes: decision["reason_codes"],
+                    },
+                    inputs_snapshot: {
+                        tenant_id: request.tenant_id,
+                        actor_id: request.actor.id,
+                        action: request.action.type,
+                        target: request.action.resource,
+                    },
+                    portable_artifact: { issuer_context: { tier: "synthetic_loopback" } },
+                    integrity: {
+                        proof_bundle: {
+                            bundle_type: "decionis.decision_dossier.proof_bundle",
+                            version: "2.0",
+                            issued_at: generatedAt,
+                            algorithm: "Ed25519",
+                            key_id: this.attestationKeyId,
+                            artifacts: [],
+                        },
+                    },
+                },
+            },
+        };
     }
     /** Policy plus evidence handling: a valid receipt turns an escalation into an allow. */
     evaluate(request) {
@@ -380,9 +766,12 @@ export class LocalAuthority {
             expiresAt,
             nonce: randomBytes(32).toString("base64url"),
             bindingDigest,
+            payloadDigest: hashBinding(request.action.parameters),
+            expectedEffectDigest: request.expected_effect_digest ?? null,
             receiptDossierId: approval?.receiptDossierId ?? null,
             claimed: false,
             claimToken: null,
+            receipt: null,
             correlationId: null,
             consumedBy: null,
             finalized: null,
@@ -648,6 +1037,13 @@ export class LocalAuthority {
             return rejected("GRANT_EXPIRED");
         if (grant.intentHash !== parsed.data.intent_hash)
             return rejected("GRANT_BINDING_MISMATCH");
+        // Unreachable while the commitment stays inside the intent hash — a
+        // divergence is already an `INTENT_HASH_MISMATCH` from the independent
+        // re-hash above. Kept because the hosted route checks the committed value
+        // itself, and a double that only checked the hash would stop proving that.
+        if ((intent.data.expected_effect_digest ?? null) !== grant.expectedEffectDigest) {
+            return rejected("GRANT_BINDING_MISMATCH");
+        }
         if (grant.receiptDossierId !== null &&
             parsed.data.evidence?.humanApproval?.receiptDossierId !== grant.receiptDossierId) {
             return rejected("PRESENCE_APPROVAL_STALE");
@@ -658,6 +1054,15 @@ export class LocalAuthority {
         grant.claimToken = randomBytes(32).toString("base64url");
         grant.correlationId = parsed.data.commit_correlation_id ?? intent.data.intent_id;
         grant.consumedBy = parsed.data.consumed_by ?? null;
+        const claimValidatedAt = new Date(this.clock()).toISOString();
+        const leaseExpiresAt = new Date(this.clock() + CLAIM_LEASE_MS).toISOString();
+        // The drill knob: an authority that bound a digest over other parameters.
+        // It is consumed by one claim, so the executor's refusal is the one
+        // observation and the next proposal sees an honest authority again.
+        const payloadDigest = this.misbindNextPayloadDigest
+            ? hashBinding({ ...intent.data.action.parameters, synthetic_tamper: true })
+            : grant.payloadDigest;
+        this.misbindNextPayloadDigest = false;
         return {
             status: 200,
             body: {
@@ -667,7 +1072,7 @@ export class LocalAuthority {
                 verdict: "ALLOW",
                 reason_codes: [],
                 claims: {
-                    iss: "synthetic-authority",
+                    iss: LOCAL_AUTHORITY_ISSUER,
                     sub: grant.actorId,
                     aud: grant.audience,
                     org_id: grant.tenantId,
@@ -680,8 +1085,13 @@ export class LocalAuthority {
                     binding: {
                         intent_hash: grant.intentHash,
                         execution_binding_digest: grant.bindingDigest,
+                        execution_payload_digest: payloadDigest,
+                        execution_payload_canonicalization_profile: JCS_PROFILE,
                         execution_nonce: grant.nonce,
                         execution_correlation_id: grant.correlationId,
+                        ...(grant.expectedEffectDigest === null
+                            ? {}
+                            : { expected_effect_digest: grant.expectedEffectDigest }),
                     },
                     jti: grant.jti,
                     iat: grant.issuedAt,
@@ -689,7 +1099,9 @@ export class LocalAuthority {
                     exp: grant.expiresAt,
                 },
                 claim_token: grant.claimToken,
-                claim_lease_expires_at: new Date(this.clock() + CLAIM_LEASE_MS).toISOString(),
+                claim_validated_at: claimValidatedAt,
+                claim_lease_expires_at: leaseExpiresAt,
+                claim_attestation: this.attest({ ...grant, payloadDigest }, claimValidatedAt, leaseExpiresAt),
                 evidence: { nonce_claim_state: "CLAIMED", commit_correlation_id: grant.correlationId },
             },
         };
@@ -713,18 +1125,109 @@ export class LocalAuthority {
         }
         if (grant.finalized !== null)
             return rejected("NONCE_REPLAY_DETECTED");
+        // The receipt is read first and recorded whatever it says; when the grant
+        // named the effect it expected and the executor supplied no observation of
+        // its own, a verified receipt with a digest stands in as SIGNED_RECEIPT
+        // evidence by the provider's key, exactly as the hosted route reads it.
+        const receipt = parsed.data.effect_receipt === undefined
+            ? null
+            : this.readEffectReceipt(parsed.data.effect_receipt, grant, parsed.data.claim_token);
+        let supplied = parsed.data.effect_evidence;
+        if (supplied === undefined &&
+            receipt?.verified === true &&
+            grant.expectedEffectDigest !== null &&
+            receipt.effect_digest !== null) {
+            supplied = {
+                version: "1.0",
+                status: receipt.effect_status === "EFFECTED" &&
+                    receipt.effect_digest === grant.expectedEffectDigest &&
+                    parsed.data.outcome === "COMMITTED"
+                    ? "CONFIRMED"
+                    : "UNCONFIRMED",
+                observation_method: "SIGNED_RECEIPT",
+                observer: { id: receipt.provider_key_id, version: EFFECT_RECEIPT_TYPE },
+                expected_effect_digest: grant.expectedEffectDigest,
+                observed_effect_digest: receipt.effect_digest,
+                observed_at: receipt.effected_at,
+                evidence_digest: `sha256:${createHash("sha256").update(receipt.token, "utf8").digest("hex")}`,
+                evidence_reference: receipt.effect_reference,
+                execution_correlation_id: parsed.data.commit_correlation_id,
+            };
+        }
+        // The hosted authority refuses the whole finalization for evidence it
+        // cannot bind, in exactly this order, before the commit transition.
+        let evidence;
+        if (supplied !== undefined) {
+            const parsedEvidence = EffectEvidenceSchema.safeParse(supplied);
+            if (!parsedEvidence.success)
+                return rejected(malformedEffectEvidenceReason(supplied));
+            evidence = parsedEvidence.data;
+            if (evidence.execution_correlation_id !== parsed.data.commit_correlation_id) {
+                return rejected("EXECUTION_CORRELATION_MISMATCH");
+            }
+            if (grant.expectedEffectDigest === null) {
+                return rejected("EFFECT_EXPECTED_BINDING_UNAVAILABLE");
+            }
+            if (evidence.expected_effect_digest !== grant.expectedEffectDigest) {
+                return rejected("EFFECT_EXPECTED_DIGEST_MISMATCH");
+            }
+            if (evidence.status === "CONFIRMED" && parsed.data.outcome !== "COMMITTED") {
+                return rejected("EFFECT_EVIDENCE_OUTCOME_MISMATCH");
+            }
+            if (evidence.status === "CONFIRMED") {
+                // A verified receipt's key is an observer for this finalization only.
+                const trusted = [
+                    ...this.effectObserverIds(),
+                    ...(receipt?.verified === true && receipt.provider_key_id !== null
+                        ? [receipt.provider_key_id]
+                        : []),
+                ];
+                if (trusted.length === 0) {
+                    return rejected("EFFECT_OBSERVER_PROVENANCE_UNAVAILABLE");
+                }
+                if (evidence.observer === null || !trusted.includes(evidence.observer.id)) {
+                    return rejected("EFFECT_OBSERVER_PROVENANCE_MISMATCH");
+                }
+            }
+        }
         grant.finalized = parsed.data.outcome;
+        grant.receipt = receipt;
+        // Byte-for-byte the hosted success body: the commit's own decision-chain
+        // evidence is queued, not yet recorded, so a successful finalization still
+        // carries `COMMIT_EVIDENCE_PENDING`.
         return {
             status: 200,
             body: {
                 finalized: true,
                 outcome: parsed.data.outcome,
-                evidence_recorded: true,
-                effect_status: "NOT_OBSERVED",
-                reason_codes: [],
+                evidence_durably_queued: true,
+                decision_chain_evidence_recorded: false,
+                evidence_recorded: false,
+                effect_evidence_recorded: evidence !== undefined,
+                effect_confirmation: evidence?.status === "CONFIRMED" ? "CONFIRMED" : "UNCONFIRMED",
+                ...(receipt === null
+                    ? {}
+                    : {
+                        effect_receipt: {
+                            verified: receipt.verified,
+                            verification_code: receipt.verification_code,
+                            provider_key_id: receipt.provider_key_id,
+                            recorded: true,
+                        },
+                    }),
+                reason_codes: ["COMMIT_EVIDENCE_PENDING"],
             },
         };
     }
+    /**
+     * The hosted route never trusts the allowlist alone: it returns at most the
+     * caller's own authenticated API-key identity, so a confirmed observation
+     * must name the identity that presented the credential. This double has one
+     * credential, so that credential is its identity.
+     */
+    effectObserverIds() {
+        return this.trustedEffectObserverIds.includes(this.apiKey) ? [this.apiKey] : [];
+    }
     /** Recomputes the hash independently and applies the contract's time rules. */
     assertBinding(request, record) {
         const recomputed = hashBinding(bindingOf(request));
@@ -789,6 +1292,25 @@ export class LocalAuthority {
             status === "FAILED");
     }
 }
+/**
+ * The hosted route maps an unparseable observation to a 409 reason code rather
+ * than a request rejection, and singles out a `CONFIRMED` observation whose
+ * observer version is missing, because that is a provenance failure rather than
+ * a malformed body.
+ */
+function malformedEffectEvidenceReason(supplied) {
+    const candidate = asRecord(supplied);
+    const observer = asRecord(candidate.observer);
+    if (candidate.version === "1.0" &&
+        candidate.status === "CONFIRMED" &&
+        (typeof observer.version !== "string" || observer.version.trim().length === 0)) {
+        return "EFFECT_OBSERVER_PROVENANCE_UNAVAILABLE";
+    }
+    return "EFFECT_EVIDENCE_INVALID";
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null ? value : {};
+}
 function headerString(value) {
     if (typeof value === "string")
         return value;