@emilia-protocol/gate 0.14.0 → 0.15.1

package/dist/proposal-to-effect.js

@@ -6,12 +6,15 @@
  * Authority remains in EP-RECEIPT-v1 and the relying party's pinned AEB
  * requirement; consequence custody remains in Gate and its durable stores.
  */
+import crypto from 'node:crypto';
 import { beginReceiptApproval, pollReceiptApproval, approvalActionHash, validateApprovalAuthorization, validateCaidSelector, validateRequiredFields, } from '@emilia-protocol/require-receipt/acquisition';
 import { aebReservationKey, authorizeAebExecutionDurable, digestAeb, pinnedConfigDigest, reconcileAebExecutionDurable, verifyAebEvaluation, } from '@emilia-protocol/verify/aeb-adapter-contract';
 import { actionDigest as aecActionDigest } from '@emilia-protocol/verify/evidence-chain';
 export const PROPOSAL_TO_EFFECT_VERSION = 'EMILIA-PROPOSAL-TO-EFFECT-v1';
 const CAID_PATTERN = /^caid:1:[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*\.[1-9][0-9]*:[a-z0-9]+(?:-[a-z0-9]+)*:[A-Za-z0-9_-]{43}$/;
 const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9:_.@/-]{2,255}$/;
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+const PROPOSAL_INTEGRITY_DOMAIN = `${PROPOSAL_TO_EFFECT_VERSION}:INTEGRITY\0`;
 function isPlainObject(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
@@ -26,6 +29,41 @@ function assertIdentifier(value, name) {
         throw new Error(`${name}_invalid`);
     }
 }
+function validDigest(value) {
+    return typeof value === 'string' && DIGEST_PATTERN.test(value);
+}
+function canonicalInstant(value) {
+    if (typeof value !== 'string')
+        return NaN;
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed) || new Date(parsed).toISOString() !== value)
+        return NaN;
+    return parsed;
+}
+function exactKeys(value, keys) {
+    if (!isPlainObject(value))
+        return false;
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    return actual.length === expected.length && expected.every((key, index) => key === actual[index]);
+}
+function secureConsequenceStore(store) {
+    return store !== null && typeof store === 'object'
+        && store.durable === true && store.ownershipFenced === true
+        && store.compareAndSwap === true && store.atomicEvidenceBinding === true
+        && typeof store.reserve === 'function' && typeof store.transition === 'function'
+        && typeof store.reconcile === 'function' && typeof store.read === 'function';
+}
+function normalizedCurrentStatus(value) {
+    return exactKeys(value, [
+        'checked_at', 'expires_at', 'revocation_checked', 'revoked', 'consumed',
+        ...(isPlainObject(value) && Object.hasOwn(value, 'unavailable') ? ['unavailable'] : []),
+    ]) && typeof value.checked_at === 'string' && Number.isFinite(Date.parse(value.checked_at))
+        && typeof value.expires_at === 'string' && Number.isFinite(Date.parse(value.expires_at))
+        && typeof value.revocation_checked === 'boolean' && typeof value.revoked === 'boolean'
+        && typeof value.consumed === 'boolean'
+        && (value.unavailable === undefined || typeof value.unavailable === 'boolean');
+}
 function assertProfile(profile) {
     if (!isPlainObject(profile))
         throw new Error('proposal_profile_invalid');
@@ -85,8 +123,8 @@ function assertSameObject(left, right, reason) {
 function exactProposalKeys(proposal) {
     const expected = [
         '@version', 'action', 'action_digest', 'aeb', 'aeb_action_digest', 'authorization',
-        'caid', 'challenge', 'created_at', 'expires_at', 'initiator_id', 'operation_id',
-        'profile_id', 'proposal_id',
+        'caid', 'challenge', 'consequence', 'created_at', 'expires_at', 'initiator_id',
+        'integrity', 'operation_id', 'profile_id', 'proposal_id',
     ].sort();
     const actual = Object.keys(proposal).sort();
     return expected.length === actual.length && expected.every((key, index) => key === actual[index]);
@@ -135,11 +173,104 @@ export function createProposalToEffect(options) {
     }
     if (!options.aeb?.config || !options.aeb.adapters || !options.aeb.store
         || typeof options.aeb.resolve_artifacts !== 'function'
+        || typeof options.aeb.currentStatusResolver !== 'function'
+        || typeof options.aeb.statusVerifier !== 'function'
         || typeof options.aeb.verify_provider_evidence !== 'function') {
         throw new Error('proposal_aeb_configuration_required');
     }
+    if (!(options.proposal_integrity?.hmac_sha256_key instanceof Uint8Array)
+        || options.proposal_integrity.hmac_sha256_key.byteLength < 32) {
+        throw new Error('proposal_integrity_configuration_required');
+    }
+    if (!options.consequence)
+        throw new Error('proposal_consequence_configuration_required');
+    assertIdentifier(options.consequence.tenant_id, 'proposal_tenant_id');
+    assertIdentifier(options.consequence.provider_id, 'proposal_provider_id');
+    assertIdentifier(options.consequence.provider_account_id, 'proposal_provider_account_id');
+    assertIdentifier(options.consequence.environment, 'proposal_environment');
+    assertIdentifier(options.consequence.executor_id, 'proposal_executor_id');
+    if (!secureConsequenceStore(options.consequence.store)
+        || (options.consequence.create_attempt_id !== undefined
+            && typeof options.consequence.create_attempt_id !== 'function')) {
+        throw new Error('proposal_consequence_store_required');
+    }
     const now = options.now ?? Date.now;
     const configDigest = pinnedConfigDigest(options.aeb.config);
+    const integrityKey = Buffer.from(options.proposal_integrity.hmac_sha256_key);
+    const consequenceContext = Object.freeze({
+        tenant_id: options.consequence.tenant_id,
+        provider_id: options.consequence.provider_id,
+        provider_account_id: options.consequence.provider_account_id,
+        environment: options.consequence.environment,
+        executor_id: options.consequence.executor_id,
+    });
+    // Active owner capabilities never become enumerable response/error data.
+    // The same-process service can recover a handle from the exact object; after
+    // restart it must use the durable store's separately authorized recovery API.
+    const reconciliationHandles = new WeakMap();
+    function rememberReconciliationHandle(target, reference) {
+        reconciliationHandles.set(target, reference);
+        return target;
+    }
+    function getReconciliationHandle(target) {
+        const reference = reconciliationHandles.get(target);
+        return reference ? clone(reference) : null;
+    }
+    function currentTime() {
+        const value = now();
+        if (!Number.isSafeInteger(value) || !Number.isFinite(new Date(value).getTime())) {
+            throw new Error('proposal_time_invalid');
+        }
+        return value;
+    }
+    async function reconcileAebWithRecovery(key, outcome, authorization) {
+        let result = await reconcileAebExecutionDurable(options.aeb.store, key, outcome);
+        const recoveryStore = options.aeb.store;
+        if (result.state === 'RECONCILIATION_REQUIRED'
+            && authorization !== undefined
+            && typeof recoveryStore.claimReservation === 'function'
+            && await recoveryStore.claimReservation(key, authorization).catch(() => false)) {
+            result = await reconcileAebExecutionDurable(options.aeb.store, key, outcome);
+        }
+        return result;
+    }
+    function requestDigestFor(proposal) {
+        return digestAeb({
+            domain: `${PROPOSAL_TO_EFFECT_VERSION}:REQUEST`,
+            ...consequenceContext,
+            proposal_id: proposal.proposal_id,
+            operation_id: proposal.operation_id,
+            initiator_id: proposal.initiator_id,
+            profile_id: proposal.profile_id,
+            action: proposal.action,
+            action_digest: proposal.action_digest,
+            aeb_action_digest: proposal.aeb_action_digest,
+            caid: proposal.caid,
+            created_at: proposal.created_at,
+            expires_at: proposal.expires_at,
+            challenge: proposal.challenge,
+            authorization: proposal.authorization,
+            aeb: proposal.aeb,
+        });
+    }
+    function integrityMac(unsignedProposal) {
+        return crypto.createHmac('sha256', integrityKey)
+            .update(PROPOSAL_INTEGRITY_DOMAIN)
+            .update(digestAeb(unsignedProposal))
+            .digest('base64url');
+    }
+    function proposalIntegrityValid(proposal) {
+        if (!exactKeys(proposal.integrity, ['alg', 'value'])
+            || proposal.integrity.alg !== 'HMAC-SHA256'
+            || typeof proposal.integrity.value !== 'string'
+            || !/^[A-Za-z0-9_-]{43}$/.test(proposal.integrity.value))
+            return false;
+        const unsigned = clone(proposal);
+        delete unsigned.integrity;
+        const actual = Buffer.from(proposal.integrity.value, 'base64url');
+        const expected = Buffer.from(integrityMac(unsigned), 'base64url');
+        return actual.length === expected.length && crypto.timingSafeEqual(actual, expected);
+    }
     function profileFor(id) {
         if (typeof id !== 'string' || !options.profiles[id])
             throw new Error('proposal_profile_not_pinned');
@@ -151,11 +282,9 @@ export function createProposalToEffect(options) {
         assertIdentifier(input?.initiator_id, 'proposal_initiator_id');
         const profile = profileFor(input?.profile_id);
         const normalized = canonicalizeForProfile(profile, input.action);
-        const createdAtMs = now();
-        if (!Number.isFinite(createdAtMs))
-            throw new Error('proposal_time_invalid');
+        const createdAtMs = currentTime();
         const actionDigest = approvalActionHash(normalized.action);
-        return clone({
+        const base = {
             '@version': PROPOSAL_TO_EFFECT_VERSION,
             proposal_id: input.proposal_id,
             operation_id: input.operation_id,
@@ -179,6 +308,17 @@ export function createProposalToEffect(options) {
                 pinned_config_digest: configDigest,
                 consumption_nonce: proposalToEffectConsumptionNonce(input.operation_id, configDigest),
             },
+        };
+        const unsigned = {
+            ...base,
+            consequence: {
+                ...consequenceContext,
+                request_digest: requestDigestFor(base),
+            },
+        };
+        return clone({
+            ...unsigned,
+            integrity: { alg: 'HMAC-SHA256', value: integrityMac(unsigned) },
         });
     }
     function verifyProposal(input, { allowExpired = false } = {}) {
@@ -186,6 +326,8 @@ export function createProposalToEffect(options) {
             || input['@version'] !== PROPOSAL_TO_EFFECT_VERSION) {
             throw new Error('proposal_shape_invalid');
         }
+        if (!proposalIntegrityValid(input))
+            throw new Error('proposal_integrity_invalid');
         const proposal = input;
         assertIdentifier(proposal.proposal_id, 'proposal_id');
         assertIdentifier(proposal.operation_id, 'proposal_operation_id');
@@ -201,11 +343,16 @@ export function createProposalToEffect(options) {
         if (digestAeb(normalized.action) !== proposal.aeb_action_digest) {
             throw new Error('proposal_aeb_action_digest_mismatch');
         }
-        if (!Number.isFinite(Date.parse(proposal.created_at)) || !Number.isFinite(Date.parse(proposal.expires_at))
-            || Date.parse(proposal.expires_at) <= Date.parse(proposal.created_at)) {
+        const createdAtMs = canonicalInstant(proposal.created_at);
+        const expiresAtMs = canonicalInstant(proposal.expires_at);
+        if (!Number.isFinite(createdAtMs) || !Number.isFinite(expiresAtMs))
             throw new Error('proposal_time_invalid');
-        }
-        if (!allowExpired && now() >= Date.parse(proposal.expires_at))
+        if (expiresAtMs - createdAtMs !== profile.ttl_sec * 1000)
+            throw new Error('proposal_ttl_mismatch');
+        const decisionTime = currentTime();
+        if (createdAtMs > decisionTime)
+            throw new Error('proposal_created_in_future');
+        if (!allowExpired && decisionTime >= expiresAtMs)
             throw new Error('proposal_expired');
         assertSameObject(proposal.authorization, profile.authorization, 'proposal_authorization_mismatch');
         if (!isPlainObject(proposal.aeb)
@@ -217,6 +364,16 @@ export function createProposalToEffect(options) {
         if (proposal.aeb.consumption_nonce !== proposalToEffectConsumptionNonce(proposal.operation_id, configDigest)) {
             throw new Error('proposal_aeb_nonce_mismatch');
         }
+        if (!exactKeys(proposal.consequence, [
+            'tenant_id', 'provider_id', 'provider_account_id', 'environment', 'executor_id', 'request_digest',
+        ]) || proposal.consequence.tenant_id !== consequenceContext.tenant_id
+            || proposal.consequence.provider_id !== consequenceContext.provider_id
+            || proposal.consequence.provider_account_id !== consequenceContext.provider_account_id
+            || proposal.consequence.environment !== consequenceContext.environment
+            || proposal.consequence.executor_id !== consequenceContext.executor_id
+            || proposal.consequence.request_digest !== requestDigestFor(proposal)) {
+            throw new Error('proposal_consequence_binding_mismatch');
+        }
         const expectedChallenge = {
             action: profile.action_type,
             action_hash: proposal.action_digest,
@@ -233,10 +390,15 @@ export function createProposalToEffect(options) {
         if (record.operation_id !== proposal.operation_id
             || record.consumption_nonce !== proposal.aeb.consumption_nonce
             || record.initiator_id !== proposal.initiator_id
+            || record.executor_id !== proposal.consequence.executor_id
             || record.requirement_ref !== proposal.aeb.requirement_ref
             || record.caid !== proposal.caid) {
             return { valid: false, reason: 'aeb_evaluation_binding_mismatch', record };
         }
+        if (record.verdict === 'SATISFIED'
+            && record.composition?.action_digest !== expectedAebCompositionDigest(proposal)) {
+            return { valid: false, reason: 'aeb_evaluation_binding_mismatch', record };
+        }
         let artifacts;
         try {
             artifacts = await options.aeb.resolve_artifacts({ proposal: clone(proposal), evaluation: clone(record) });
@@ -244,19 +406,62 @@ export function createProposalToEffect(options) {
         catch {
             return { valid: false, reason: 'aeb_artifact_resolution_failed', record };
         }
-        const checked = verifyAebEvaluation(record, {
+        const decisionNow = new Date(currentTime()).toISOString();
+        const currentStatuses = {};
+        for (const leg of record.legs ?? []) {
+            try {
+                const statusArtifact = await options.aeb.currentStatusResolver({
+                    proposal: clone(proposal),
+                    evaluation: clone(record),
+                    leg: clone(leg),
+                });
+                if (statusArtifact === undefined || statusArtifact === null) {
+                    return { valid: false, reason: 'aeb_current_status_refused', record };
+                }
+                const status = await options.aeb.statusVerifier({
+                    status_artifact: clone(statusArtifact),
+                    expected: {
+                        tenant_id: proposal.consequence.tenant_id,
+                        executor_id: proposal.consequence.executor_id,
+                        operation_id: proposal.operation_id,
+                        caid: proposal.caid,
+                        artifact_ref: leg.artifact_ref,
+                        evidence_digest: leg.evidence_digest,
+                        replay_unit: leg.replay_unit,
+                    },
+                    now: decisionNow,
+                });
+                if (!status?.valid || status.outcome !== 'current_not_revoked'
+                    || !normalizedCurrentStatus(status.status)
+                    || status.status.revocation_checked !== true || status.status.revoked !== false
+                    || status.status.consumed !== false || status.status.unavailable === true) {
+                    return { valid: false, reason: 'aeb_current_status_refused', record };
+                }
+                currentStatuses[leg.artifact_ref] = clone(status.status);
+            }
+            catch {
+                return { valid: false, reason: 'aeb_current_status_refused', record };
+            }
+        }
+        if (record.legs.length === 0 || Object.keys(currentStatuses).length !== record.legs.length) {
+            return { valid: false, reason: 'aeb_current_status_refused', record };
+        }
+        const verificationOptions = {
+            mode: 'execution',
             config: options.aeb.config,
             adapters: options.aeb.adapters,
             artifacts,
-            now: new Date(now()).toISOString(),
-        });
-        if (!checked.valid || record.verdict !== 'SATISFIED'
+            expected_action: clone(proposal.action),
+            executor_id: proposal.consequence.executor_id,
+            current_statuses: currentStatuses,
+            now: decisionNow,
+        };
+        const checked = verifyAebEvaluation(record, verificationOptions);
+        if (!checked.valid || checked.execution_authorizing !== true
+            || record.verdict !== 'SATISFIED'
             || record.authority_constraints?.one_time_consumption !== true) {
             return { valid: false, reason: 'aeb_evaluation_refused', record, checked };
         }
-        if (record.composition?.action_digest !== expectedAebCompositionDigest(proposal)) {
-            return { valid: false, reason: 'aeb_evaluation_binding_mismatch', record, checked };
-        }
         return { valid: true, reason: null, record, checked };
     }
     function gateInput(proposal, profile, receipt, record) {
@@ -266,6 +471,12 @@ export function createProposalToEffect(options) {
                 operation_id: proposal.operation_id,
                 initiator_id: proposal.initiator_id,
                 aeb_requirement_ref: proposal.aeb.requirement_ref,
+                tenant_id: proposal.consequence.tenant_id,
+                provider_id: proposal.consequence.provider_id,
+                provider_account_id: proposal.consequence.provider_account_id,
+                environment: proposal.consequence.environment,
+                executor_id: proposal.consequence.executor_id,
+                request_digest: proposal.consequence.request_digest,
             },
             receipt,
             observedAction: clone(proposal.action),
@@ -280,6 +491,9 @@ export function createProposalToEffect(options) {
         if (!evaluation.valid || !evaluation.record) {
             return refusal(evaluation.reason || 'aeb_evaluation_refused', { aeb: evaluation.checked ?? null });
         }
+        if (!evaluation.checked?.valid || evaluation.checked.execution_authorizing !== true) {
+            return refusal('aeb_execution_verification_required', { aeb: evaluation.checked ?? null });
+        }
         const preparedGateInput = gateInput(proposal, profile, input.receipt, evaluation.record);
         const preflight = await options.gate.check({ ...preparedGateInput, consumptionMode: 'none' });
         if (preflight.allow !== true) {
@@ -289,7 +503,7 @@ export function createProposalToEffect(options) {
             return refusal('gate_profile_not_receipt_guarded', { authorization: preflight });
         }
         const reservation = await authorizeAebExecutionDurable(evaluation.record, {
-            verified: true,
+            verification: evaluation.checked,
             local_authorization: true,
             store: options.aeb.store,
         });
@@ -297,36 +511,160 @@ export function createProposalToEffect(options) {
             return refusal(reservation.reason === 'consumption_conflict' ? 'aeb_consumption_conflict' : reservation.reason, { aeb: reservation });
         }
         const key = reservation.reservation_key;
+        let attemptId;
         try {
-            const result = await options.gate.run(preparedGateInput, async (authorization) => effect({
-                action: clone(proposal.action),
-                proposal: clone(proposal),
-                authorization: clone(authorization),
-            }));
+            attemptId = options.consequence.create_attempt_id
+                ? await options.consequence.create_attempt_id({
+                    tenant_id: proposal.consequence.tenant_id,
+                    request_digest: proposal.consequence.request_digest,
+                })
+                : `attempt:${crypto.randomUUID()}`;
+            assertIdentifier(attemptId, 'proposal_attempt_id');
+        }
+        catch {
+            await options.aeb.store.release(key).catch(() => false);
+            return refusal('consequence_attempt_allocation_failed');
+        }
+        const binding = {
+            tenant_id: proposal.consequence.tenant_id,
+            provider_id: proposal.consequence.provider_id,
+            provider_account_id: proposal.consequence.provider_account_id,
+            environment: proposal.consequence.environment,
+            attempt_id: attemptId,
+            request_digest: proposal.consequence.request_digest,
+        };
+        let reservedAttempt;
+        try {
+            reservedAttempt = await options.consequence.store.reserve(clone(binding));
+        }
+        catch {
+            await options.aeb.store.release(key).catch(() => false);
+            return refusal('consequence_attempt_store_unavailable');
+        }
+        if (!reservedAttempt?.reserved || typeof reservedAttempt.owner !== 'string'
+            || reservedAttempt.owner.length < 1 || reservedAttempt.owner.length > 1024) {
+            await options.aeb.store.release(key).catch(() => false);
+            const reason = reservedAttempt.reserved === false
+                ? reservedAttempt.reason : 'consequence_attempt_conflict';
+            return refusal(reason);
+        }
+        const attempt = {
+            ...binding,
+            owner: reservedAttempt.owner,
+        };
+        const attemptRef = {
+            tenant_id: attempt.tenant_id,
+            attempt_id: attempt.attempt_id,
+            owner: attempt.owner,
+        };
+        const attemptCustody = { state: 'RESERVED' };
+        const transition = async (change) => {
+            try {
+                const changed = await options.consequence.store.transition({
+                    ...attemptRef,
+                    ...change,
+                });
+                if (changed === true)
+                    attemptCustody.state = change.next_state;
+                return changed === true;
+            }
+            catch {
+                return false;
+            }
+        };
+        if (!await transition({ expected_state: 'RESERVED', next_state: 'INVOKING' })) {
+            await options.aeb.store.release(key).catch(() => false);
+            return refusal('consequence_attempt_transition_conflict');
+        }
+        let callbackEntered = false;
+        const freeze = async () => (attemptCustody.state === 'INDETERMINATE'
+            || (attemptCustody.state === 'INVOKING'
+                && await transition({ expected_state: 'INVOKING', next_state: 'INDETERMINATE' })));
+        const attachAttempt = (thrown, outcome) => {
+            const error = thrown && (typeof thrown === 'object' || typeof thrown === 'function')
+                ? thrown : new Error(String(thrown));
+            error.proposalToEffect = {
+                ...(isPlainObject(error.proposalToEffect) ? error.proposalToEffect : {}),
+                ...(outcome ? { outcome } : {}),
+                reservation_key: key,
+                attempt: clone(binding),
+                attempt_state: attemptCustody.state,
+            };
+            return rememberReconciliationHandle(error, attemptRef);
+        };
+        try {
+            const result = await options.gate.run(preparedGateInput, async (authorization) => {
+                callbackEntered = true;
+                return effect({
+                    action: clone(proposal.action),
+                    proposal: clone(proposal),
+                    authorization: clone(authorization),
+                    attempt: clone(binding),
+                });
+            });
+            if (!await freeze()) {
+                throw attachAttempt(new Error('consequence_attempt_freeze_failed'), 'indeterminate');
+            }
             if (result?.ok !== true) {
-                await options.aeb.store.release(key);
+                if (callbackEntered) {
+                    return rememberReconciliationHandle(refusal(result?.authorization?.reason || result?.reason || 'gate_refused', {
+                        authorization: result?.authorization ?? null,
+                        consequence: { state: 'INDETERMINATE', attempt: clone(binding) },
+                    }), attemptRef);
+                }
+                if (!await transition({ expected_state: 'INDETERMINATE', next_state: 'RELEASED' })) {
+                    return rememberReconciliationHandle(refusal('consequence_attempt_transition_conflict', {
+                        consequence: { state: 'INDETERMINATE', attempt: clone(binding) },
+                    }), attemptRef);
+                }
+                await options.aeb.store.release(key).catch(() => false);
                 return refusal(result?.authorization?.reason || result?.reason || 'gate_refused', {
                     authorization: result?.authorization ?? null,
+                    consequence: { state: 'RELEASED', attempt: clone(binding) },
+                });
+            }
+            if (!callbackEntered) {
+                if (await transition({ expected_state: 'INDETERMINATE', next_state: 'RELEASED' })) {
+                    await options.aeb.store.release(key).catch(() => false);
+                }
+                const response = refusal('gate_effect_not_invoked', {
+                    consequence: { state: attemptCustody.state, attempt: clone(binding) },
                 });
+                return attemptCustody.state === 'INDETERMINATE'
+                    ? rememberReconciliationHandle(response, attemptRef) : response;
             }
-            const committed = await reconcileAebExecutionDurable(options.aeb.store, key, 'COMMITTED');
+            const committed = await reconcileAebWithRecovery(key, 'COMMITTED');
             if (committed.state !== 'CONSUMED') {
                 const error = new Error('aeb_consumption_commit_failed');
                 error.code = 'EMILIA_PROPOSAL_TO_EFFECT_COMMIT_FAILED';
-                error.proposalToEffect = { outcome: 'executed', reservation_key: key };
-                throw error;
+                throw attachAttempt(error, 'indeterminate');
+            }
+            if (!await transition({ expected_state: 'INDETERMINATE', next_state: 'COMMITTED' })) {
+                throw attachAttempt(new Error('consequence_attempt_commit_failed'), 'executed');
             }
-            return { ...result, proposal: clone(proposal), aeb: committed };
+            return {
+                ...result,
+                proposal: clone(proposal),
+                aeb: committed,
+                consequence: { state: 'COMMITTED', attempt: clone(binding) },
+            };
         }
         catch (error) {
             const outcome = error?.proposalToEffect?.outcome ?? error?.emiliaGateOutcome?.outcome;
-            if (outcome === 'executed') {
-                await reconcileAebExecutionDurable(options.aeb.store, key, 'COMMITTED');
+            if (attemptCustody.state === 'INVOKING')
+                await freeze();
+            if (attemptCustody.state === 'INDETERMINATE' && outcome === 'executed') {
+                const committed = await reconcileAebWithRecovery(key, 'COMMITTED');
+                if (committed.state === 'CONSUMED') {
+                    await transition({ expected_state: 'INDETERMINATE', next_state: 'COMMITTED' });
+                }
             }
-            else if (outcome !== 'indeterminate') {
-                await options.aeb.store.release(key);
+            else if (attemptCustody.state === 'INDETERMINATE' && !callbackEntered && outcome !== 'indeterminate') {
+                if (await transition({ expected_state: 'INDETERMINATE', next_state: 'RELEASED' })) {
+                    await options.aeb.store.release(key).catch(() => false);
+                }
             }
-            throw error;
+            throw attachAttempt(error, callbackEntered ? (outcome || 'indeterminate') : outcome);
         }
     }
     async function reconcile(input) {
@@ -337,26 +675,57 @@ export function createProposalToEffect(options) {
         if (record.operation_id !== proposal.operation_id
             || record.consumption_nonce !== proposal.aeb.consumption_nonce
             || record.initiator_id !== proposal.initiator_id
+            || record.executor_id !== proposal.consequence.executor_id
             || record.requirement_ref !== proposal.aeb.requirement_ref
             || record.caid !== proposal.caid) {
             return refusal('aeb_evaluation_binding_mismatch');
         }
-        const artifacts = await options.aeb.resolve_artifacts({ proposal: clone(proposal), evaluation: clone(record) });
-        const historical = verifyAebEvaluation(record, {
+        if (record.composition?.action_digest !== expectedAebCompositionDigest(proposal)) {
+            return refusal('aeb_evaluation_binding_mismatch');
+        }
+        let artifacts;
+        try {
+            artifacts = await options.aeb.resolve_artifacts({ proposal: clone(proposal), evaluation: clone(record) });
+        }
+        catch {
+            return refusal('aeb_artifact_resolution_failed');
+        }
+        const historicalOptions = {
+            mode: 'historical',
             config: options.aeb.config,
             adapters: options.aeb.adapters,
             artifacts,
-            now: record.evaluated_at,
-        });
+            expected_action: clone(proposal.action),
+            executor_id: proposal.consequence.executor_id,
+        };
+        const historical = verifyAebEvaluation(record, historicalOptions);
         if (!historical.valid)
             return refusal('aeb_evaluation_refused', { aeb: historical });
         if (record.verdict !== 'SATISFIED'
             || record.authority_constraints?.one_time_consumption !== true) {
             return refusal('aeb_evaluation_refused', { aeb: historical });
         }
-        if (record.composition?.action_digest !== expectedAebCompositionDigest(proposal)) {
-            return refusal('aeb_evaluation_binding_mismatch');
+        if (!isPlainObject(input?.attempt)
+            || input.attempt.tenant_id !== proposal.consequence.tenant_id
+            || typeof input.attempt.attempt_id !== 'string'
+            || !IDENTIFIER_PATTERN.test(input.attempt.attempt_id)
+            || typeof input.attempt.owner !== 'string'
+            || input.attempt.owner.length < 1 || input.attempt.owner.length > 1024) {
+            return refusal('consequence_attempt_binding_mismatch');
         }
+        const attemptRef = {
+            tenant_id: proposal.consequence.tenant_id,
+            attempt_id: input.attempt.attempt_id,
+            owner: input.attempt.owner,
+        };
+        const publicAttempt = {
+            tenant_id: proposal.consequence.tenant_id,
+            provider_id: proposal.consequence.provider_id,
+            provider_account_id: proposal.consequence.provider_account_id,
+            environment: proposal.consequence.environment,
+            attempt_id: attemptRef.attempt_id,
+            request_digest: proposal.consequence.request_digest,
+        };
         let provider;
         try {
             provider = await options.aeb.verify_provider_evidence({
@@ -365,26 +734,198 @@ export function createProposalToEffect(options) {
                     operation_id: proposal.operation_id,
                     caid: proposal.caid,
                     action_digest: proposal.aeb_action_digest,
+                    tenant_id: proposal.consequence.tenant_id,
+                    request_digest: proposal.consequence.request_digest,
+                    provider_id: proposal.consequence.provider_id,
+                    provider_account_id: proposal.consequence.provider_account_id,
+                    environment: proposal.consequence.environment,
+                    attempt_id: attemptRef.attempt_id,
                 },
             });
         }
         catch {
             return refusal('provider_evidence_unverified');
         }
-        if (!provider?.valid || (provider.outcome !== 'COMMITTED' && provider.outcome !== 'NOT_COMMITTED')) {
+        const observedAtMs = typeof provider?.observed_at === 'string'
+            ? Date.parse(provider.observed_at) : NaN;
+        const proposalCreatedAtMs = Date.parse(proposal.created_at);
+        if (!provider?.valid || !['COMMITTED', 'NOT_COMMITTED', 'ESCALATED'].includes(provider.outcome ?? '')
+            || typeof provider.evidence_id !== 'string' || !IDENTIFIER_PATTERN.test(provider.evidence_id)
+            || !Number.isFinite(observedAtMs) || observedAtMs < proposalCreatedAtMs
+            || observedAtMs > currentTime()
+            || !validDigest(provider.evidence_digest)) {
             return refusal(provider?.reason || 'provider_evidence_unverified');
         }
+        if (provider.tenant_id !== proposal.consequence.tenant_id
+            || provider.request_digest !== proposal.consequence.request_digest
+            || provider.provider_id !== proposal.consequence.provider_id
+            || provider.provider_account_id !== proposal.consequence.provider_account_id
+            || provider.environment !== proposal.consequence.environment
+            || provider.attempt_id !== attemptRef.attempt_id
+            || provider.operation_id !== proposal.operation_id
+            || provider.caid !== proposal.caid
+            || provider.action_digest !== proposal.aeb_action_digest) {
+            return refusal('provider_evidence_binding_mismatch');
+        }
+        const providerOutcome = provider.outcome;
+        const evidence = {
+            operation_id: proposal.operation_id,
+            caid: proposal.caid,
+            action_digest: proposal.aeb_action_digest,
+            tenant_id: proposal.consequence.tenant_id,
+            provider_id: proposal.consequence.provider_id,
+            provider_account_id: proposal.consequence.provider_account_id,
+            environment: proposal.consequence.environment,
+            attempt_id: attemptRef.attempt_id,
+            request_digest: proposal.consequence.request_digest,
+            evidence_id: provider.evidence_id,
+            observed_at: provider.observed_at,
+            outcome: providerOutcome,
+            evidence_digest: provider.evidence_digest,
+        };
+        const terminalState = providerOutcome === 'COMMITTED'
+            ? 'COMMITTED' : providerOutcome === 'NOT_COMMITTED' ? 'RELEASED' : 'ESCALATED';
         const key = aebReservationKey(record);
-        const reconciled = await reconcileAebExecutionDurable(options.aeb.store, key, provider.outcome);
-        if (reconciled.state === 'RECONCILIATION_REQUIRED') {
-            return refusal(reconciled.reason, { state: reconciled.state });
+        // For a committed real-world effect, consume replay authority before the
+        // attempt becomes terminal. A failed AEB commit leaves the attempt
+        // INDETERMINATE and therefore repairable, never terminal split-brain.
+        const preTerminalAeb = providerOutcome === 'COMMITTED'
+            ? await reconcileAebWithRecovery(key, 'COMMITTED', input.aeb_recovery_authorization)
+            : null;
+        if (providerOutcome === 'COMMITTED' && preTerminalAeb?.state !== 'CONSUMED') {
+            return refusal('aeb_consumption_reconciliation_failed', {
+                state: 'INDETERMINATE',
+                consequence: { state: 'INDETERMINATE', attempt: clone(publicAttempt) },
+                aeb: preTerminalAeb,
+            });
+        }
+        let attemptReconciled = false;
+        try {
+            attemptReconciled = await options.consequence.store.reconcile({
+                ...attemptRef,
+                expected_state: 'INDETERMINATE',
+                next_state: terminalState,
+                evidence: clone(evidence),
+            });
+        }
+        catch {
+            return refusal('consequence_attempt_store_unavailable');
+        }
+        if (!attemptReconciled)
+            return refusal('consequence_attempt_not_indeterminate');
+        const reconciled = providerOutcome === 'ESCALATED'
+            ? { state: 'RECONCILIATION_REQUIRED', retry_allowed: false, reason: 'execution_escalated' }
+            : providerOutcome === 'COMMITTED'
+                ? preTerminalAeb
+                : await reconcileAebWithRecovery(key, providerOutcome, input.aeb_recovery_authorization);
+        if (providerOutcome !== 'ESCALATED' && reconciled.state === 'RECONCILIATION_REQUIRED') {
+            return refusal('aeb_consumption_reconciliation_failed', {
+                state: terminalState,
+                consequence: { state: terminalState, attempt: clone(publicAttempt) },
+                aeb: reconciled,
+            });
+        }
+        return {
+            ok: true,
+            state: terminalState,
+            outcome: providerOutcome,
+            evidence_digest: provider.evidence_digest,
+            reservation_key: key,
+            consequence: { state: terminalState, attempt: clone(publicAttempt) },
+            aeb: reconciled,
+        };
+    }
+    /**
+     * Converge legacy or crash-window terminal consequence state with the AEB
+     * reservation. This never invokes an effect and trusts only the signed
+     * proposal/evaluation plus the durable consequence store's terminal state.
+     */
+    async function repairAeb(input) {
+        const { proposal } = verifyProposal(input?.proposal, { allowExpired: true });
+        if (!isPlainObject(input?.evaluation))
+            return refusal('aeb_evaluation_missing');
+        const record = input.evaluation;
+        if (record.operation_id !== proposal.operation_id
+            || record.consumption_nonce !== proposal.aeb.consumption_nonce
+            || record.initiator_id !== proposal.initiator_id
+            || record.executor_id !== proposal.consequence.executor_id
+            || record.requirement_ref !== proposal.aeb.requirement_ref
+            || record.caid !== proposal.caid
+            || record.composition?.action_digest !== expectedAebCompositionDigest(proposal)) {
+            return refusal('aeb_evaluation_binding_mismatch');
+        }
+        let artifacts;
+        try {
+            artifacts = await options.aeb.resolve_artifacts({ proposal: clone(proposal), evaluation: clone(record) });
+        }
+        catch {
+            return refusal('aeb_artifact_resolution_failed');
+        }
+        const historicalOptions = {
+            mode: 'historical',
+            config: options.aeb.config,
+            adapters: options.aeb.adapters,
+            artifacts,
+            expected_action: clone(proposal.action),
+            executor_id: proposal.consequence.executor_id,
+        };
+        const historical = verifyAebEvaluation(record, historicalOptions);
+        if (!historical.valid || record.verdict !== 'SATISFIED'
+            || record.authority_constraints?.one_time_consumption !== true) {
+            return refusal('aeb_evaluation_refused', { aeb: historical });
+        }
+        if (!exactKeys(input?.attempt, [
+            'tenant_id', 'provider_id', 'provider_account_id', 'environment',
+            'attempt_id', 'request_digest',
+        ])) {
+            return refusal('consequence_attempt_binding_mismatch');
+        }
+        const attempt = input.attempt;
+        if (attempt.tenant_id !== proposal.consequence.tenant_id
+            || attempt.provider_id !== proposal.consequence.provider_id
+            || attempt.provider_account_id !== proposal.consequence.provider_account_id
+            || attempt.environment !== proposal.consequence.environment
+            || attempt.request_digest !== proposal.consequence.request_digest
+            || typeof attempt.attempt_id !== 'string' || !IDENTIFIER_PATTERN.test(attempt.attempt_id)) {
+            return refusal('consequence_attempt_binding_mismatch');
+        }
+        let snapshot;
+        try {
+            snapshot = await options.consequence.store.read(clone(attempt));
+        }
+        catch {
+            return refusal('consequence_attempt_store_unavailable');
+        }
+        if (!snapshot)
+            return refusal('consequence_attempt_not_found');
+        if (!['COMMITTED', 'RELEASED', 'ESCALATED'].includes(snapshot.state)) {
+            return refusal('consequence_attempt_not_terminal', { state: snapshot.state });
+        }
+        if (snapshot.state === 'ESCALATED') {
+            return {
+                ok: true,
+                state: 'ESCALATED',
+                consequence: { state: 'ESCALATED', attempt: clone(attempt) },
+                aeb: { state: 'RECONCILIATION_REQUIRED', retry_allowed: false, reason: 'execution_escalated' },
+            };
+        }
+        const key = aebReservationKey(record);
+        const outcome = snapshot.state === 'COMMITTED' ? 'COMMITTED' : 'NOT_COMMITTED';
+        const repaired = await reconcileAebWithRecovery(key, outcome, input.aeb_recovery_authorization);
+        const expectedState = outcome === 'COMMITTED' ? 'CONSUMED' : 'AVAILABLE';
+        if (repaired.state !== expectedState) {
+            return refusal('aeb_consumption_repair_failed', {
+                state: snapshot.state,
+                consequence: { state: snapshot.state, attempt: clone(attempt) },
+                aeb: repaired,
+            });
         }
         return {
             ok: true,
-            state: reconciled.state,
-            outcome: provider.outcome,
-            evidence_digest: provider.evidence_digest ?? null,
+            state: snapshot.state,
+            consequence: { state: snapshot.state, attempt: clone(attempt) },
             reservation_key: key,
+            aeb: repaired,
         };
     }
     async function beginApproval(input) {
@@ -417,6 +958,8 @@ export function createProposalToEffect(options) {
         pollApproval,
         execute,
         reconcile,
+        repairAeb,
+        getReconciliationHandle,
     });
 }
 export default {