@nullsquare/agent-authority 0.4.0 → 0.4.2

package/docs/task-leases.md

@@ -32,6 +32,12 @@ Human-approved task
   authority roots
         |
  authorized execution
+        |
+        +--> ALLOW receipt
+        +--> exact output hash evidence
+        |
+        v
+ trusted adapter extractor
         |
         v
   derived facts
@@ -64,7 +70,60 @@ Examples:
 - customer ID discovered from an authorized support-ticket lookup;
 - order ID discovered from an authorized customer lookup.
 
-In v0.4, a derived fact must reference an `ALLOW` receipt from the same mission. It may also reference existing parent facts.
+A derived fact must reference an `ALLOW` receipt from the same Task Lease and at least one parent authority fact.
+
+Agent Authority now exposes two derivation modes:
+
+- `derive()` — compatibility path where the trusted host supplies both `value` and `selector`;
+- `deriveFromEvidence()` — stricter path where the host does **not** supply the authority value.
+
+For provider-derived authority, prefer `deriveFromEvidence()`.
+
+### Execution evidence
+
+After an allowed `guard.run()` effect succeeds, the guard returns:
+
+```js
+{
+  output,
+  receipt,
+  evidence
+}
+```
+
+The execution-evidence record binds:
+
+- the receipt ID and receipt hash;
+- mission and Task Lease identity;
+- service and action;
+- request hash;
+- a hash of the exact returned output.
+
+If downstream code changes the output and tries to reuse the original evidence, derivation fails with `evidence_output_mismatch`.
+
+This is an integrity mechanism inside the trusted host/runtime boundary. It is **not** provider-signed remote attestation.
+
+### Trusted adapter extractor
+
+The adapter extractor identifies which normalized provider-output field may become authority.
+
+For Gmail, the current extractor accepts only a `gmail:thread.read` receipt and selects:
+
+```text
+output.sender_email
+```
+
+The extractor returns only an ID and selector. It does not return the authority value.
+
+Task Lease resolves the selector itself after checking the execution evidence. This prevents ordinary host code from doing this:
+
+```text
+Gmail returned customer@example.com
+host claims attacker@example.com
+while reusing the original Gmail receipt
+```
+
+The stricter path rejects output/evidence substitution rather than recording the host's claimed value.
 
 ### Binding
 
@@ -74,7 +133,7 @@ A binding narrows an otherwise permitted action to the exact value held by an au
 {
   service: 'calendar',
   action: 'event.create',
-  context_field: 'attendee',
+  context_field: 'attendee_email',
   fact_id: 'fact:requester-email'
 }
 ```
@@ -87,7 +146,7 @@ If it has value `customer@example.com`, this request can proceed:
 {
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: 'customer@example.com' }
+  context: { attendee_email: 'customer@example.com' }
 }
 ```
 
@@ -97,7 +156,7 @@ This request does not proceed automatically:
 {
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: 'other@example.com' }
+  context: { attendee_email: 'other@example.com' }
 }
 ```
 
@@ -126,12 +185,13 @@ lease authority <= mission authority
 
 Authority may stay the same or shrink. It must never grow silently.
 
-## Example
+## Evidence-verified Gmail -> Calendar example
 
 ```js
 import { AuthorityRuntime } from '@nullsquare/agent-authority';
 import { createTaskLease } from '@nullsquare/agent-authority/task-lease';
 import { createTaskLeaseGuard } from '@nullsquare/agent-authority/guard';
+import { gmailThreadSenderAuthorityExtractor } from '@nullsquare/agent-authority/providers/google';
 
 const lease = createTaskLease({
   mission,
@@ -143,7 +203,7 @@ const lease = createTaskLease({
     {
       service: 'calendar',
       action: 'event.create',
-      context_field: 'attendee',
+      context_field: 'attendee_email',
       fact_id: 'fact:sender-email'
     }
   ]
@@ -157,30 +217,29 @@ const guard = createTaskLeaseGuard({
 const read = await guard.run({
   service: 'gmail',
   action: 'thread.read',
-  context: { thread: 'thread:demo-91' }
+  context: { thread_id: 'thread:demo-91' }
 }, () => gmail.readThread('thread:demo-91'));
 
-lease.derive({
+const senderFact = lease.deriveFromEvidence({
   fact_id: 'fact:sender-email',
   kind: 'email.address',
-  value: read.output.sender,
   from: ['fact:thread'],
   receipt: read.receipt,
-  selector: 'output.sender'
+  evidence: read.evidence,
+  output: read.output,
+  extractor: gmailThreadSenderAuthorityExtractor
 });
 
 await guard.run({
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: read.output.sender }
-}, () => calendar.createEvent({ attendee: read.output.sender }));
+  context: { attendee_email: senderFact.value }
+}, () => calendar.createEvent({ attendee: senderFact.value }));
 ```
 
-Run the self-contained example:
+Notice that `deriveFromEvidence()` has no `value` argument. The fact value comes from the exact output already bound to the authorized read.
 
-```bash
-npm run demo:task-lease
-```
+The older `derive()` API remains available for integrations that have not adopted the evidence contract yet. Facts created through that API record `derivation_mode: host-trusted` so audit code can distinguish the weaker path.
 
 ## Task completion
 
@@ -207,36 +266,44 @@ requested new resource
 authority_delta_required
 ```
 
-The existing approval store can handle the human decision. Automatically applying approved deltas to a live Task Lease is a later milestone; v0.4 deliberately stops at the safe enforcement signal.
+The existing approval store can handle the human decision. Automatically applying approved deltas to a live Task Lease is a later milestone; the current implementation deliberately stops at the safe enforcement signal.
 
 ## Current security properties
 
-The v0.4 implementation tests that:
+The implementation tests that:
 
 - a bound action cannot run before its fact exists;
-- derived facts require an `ALLOW` receipt;
-- the receipt must belong to the same mission;
+- derived facts require an `ALLOW` receipt from the same mission and Task Lease;
 - explicit mission denies cannot be overridden by lease bindings;
 - an exact derived resource can execute;
 - a different resource becomes an authority delta and the effect does not run;
 - completed and expired leases stop execution;
-- Task Lease receipts include the lease ID and lease hash.
+- Task Lease receipts include the lease ID and lease hash;
+- successful guarded effects produce output-bound execution evidence;
+- `deriveFromEvidence()` ignores any caller-supplied `value` and resolves the trusted selector itself;
+- modified provider output is rejected;
+- modified execution evidence is rejected;
+- execution evidence cannot be replayed under another receipt or Task Lease;
+- the Gmail extractor rejects the wrong service/action;
+- dangerous selector paths such as `__proto__` fail closed.
 
 ## Current limitations
 
 This is still a validation implementation.
 
-1. **Extraction trust:** the trusted host/adapter supplies the derived value and selector. Agent Authority records lineage but does not yet cryptographically prove that the selected output field contained that value.
-2. **In-memory lease state:** TaskLease instances are currently process-local. Durable lease persistence/recovery is not implemented yet.
-3. **Top-level binding fields:** v0.4 binds top-level request context fields only. Nested JSON-path policy is intentionally deferred.
-4. **Step-up application:** authority deltas are surfaced but approved deltas are not yet automatically applied back into the lease.
-5. **Adapter semantics:** providers still need trustworthy mappings from an external operation to `service`, `action`, and resource context fields.
+1. **Trusted host/adapter boundary:** execution evidence is produced by Agent Authority around the host effect, not signed by Gmail, Calendar, or another provider. A malicious host that can bypass or replace Agent Authority remains outside the guarantee.
+2. **Provider attestation:** output hashes prove consistency with what the guarded effect returned; they do not cryptographically prove what the remote provider emitted on the wire.
+3. **Source invalidation:** a source resource changing later does not yet invalidate already-derived facts automatically.
+4. **In-memory lease state:** TaskLease instances are currently process-local. Durable lease persistence/recovery is not implemented yet.
+5. **Top-level binding fields:** bindings target top-level request context fields. A general nested policy language is intentionally deferred.
+6. **Step-up application:** authority deltas are surfaced but approved deltas are not yet automatically applied back into the lease.
+7. **Adapter semantics:** each provider still needs a reviewed operation -> authority-field mapping. The Google sender extractor is the first concrete contract.
 
-These constraints are deliberate. The next work should be driven by real integrations rather than by adding a general policy language.
+These constraints are deliberate. The project should improve the evidence contract from real provider cases rather than build a universal semantic policy language.
 
 ## Validation target
 
-The product thesis is validated when the same Task Lease can safely govern a real multi-step workflow across more than one execution transport, for example:
+The longer-term product thesis is validated when the same Task Lease can safely govern a real multi-step workflow across more than one execution transport, for example:
 
 ```text
 one human task

package/examples/live-google-cross-provider.js

@@ -0,0 +1,261 @@
+import { AuthorityRuntime } from '../src/index.js';
+import {
+  AuthorityApprovalRequiredError,
+  AuthorityDeniedError,
+  createTaskLeaseGuard
+} from '../src/guard.js';
+import {
+  gmailThreadSenderAuthorityExtractor,
+  gmailThreadSenderEmail
+} from '../src/providers/google.js';
+import { createTaskLease } from '../src/task-lease.js';
+
+const token = process.env.GOOGLE_ACCESS_TOKEN;
+const threadId = process.env.AA_GOOGLE_GMAIL_THREAD_ID;
+const calendarId = process.env.AA_GOOGLE_CALENDAR_ID || 'primary';
+const expectedSender = process.env.AA_GOOGLE_EXPECTED_SENDER?.trim().toLowerCase() || null;
+
+if (!token) throw new Error('GOOGLE_ACCESS_TOKEN is required for live Google validation');
+if (!threadId) throw new Error('AA_GOOGLE_GMAIL_THREAD_ID is required for live Google validation');
+
+const now = Date.now();
+const startTime = new Date(now + 10 * 60_000).toISOString();
+const endTime = new Date(now + 25 * 60_000).toISOString();
+const marker = `Agent Authority live Google validation ${new Date(now).toISOString()}`;
+
+const mission = {
+  version: '0.1',
+  mission_id: `mission:live-google-cross-provider:${now}`,
+  principal: { id: 'user:google-validation' },
+  agent: { id: 'agent:google-cross-provider-validation' },
+  objective: 'Read one authorized Gmail thread and create one Calendar event only for the sender discovered from that thread',
+  resources: [
+    {
+      service: 'gmail',
+      allow: ['thread.read'],
+      deny: ['message.send', 'message.delete', 'thread.delete'],
+      constraints: { thread_id: [threadId] }
+    },
+    {
+      service: 'calendar',
+      allow: ['event.create'],
+      deny: ['event.delete', 'calendar.delete'],
+      constraints: { calendar_id: [calendarId] }
+    }
+  ],
+  constraints: { expires_at: new Date(now + 15 * 60_000).toISOString() }
+};
+
+const lease = createTaskLease({
+  mission,
+  request: 'Schedule one temporary validation event with the sender in the approved Gmail thread',
+  roots: [
+    {
+      fact_id: 'fact:gmail-thread',
+      kind: 'gmail.thread',
+      value: threadId,
+      source: 'validation-task'
+    },
+    {
+      fact_id: 'fact:calendar',
+      kind: 'google.calendar',
+      value: calendarId,
+      source: 'validation-task'
+    }
+  ],
+  bindings: [
+    {
+      service: 'gmail',
+      action: 'thread.read',
+      context_field: 'thread_id',
+      fact_id: 'fact:gmail-thread'
+    },
+    {
+      service: 'calendar',
+      action: 'event.create',
+      context_field: 'calendar_id',
+      fact_id: 'fact:calendar'
+    },
+    {
+      service: 'calendar',
+      action: 'event.create',
+      context_field: 'attendee_email',
+      fact_id: 'fact:sender-email'
+    }
+  ],
+  expires_at: new Date(now + 10 * 60_000).toISOString()
+});
+
+const guard = createTaskLeaseGuard({ lease, runtime: new AuthorityRuntime() });
+const providerHeaders = {
+  accept: 'application/json',
+  authorization: `Bearer ${token}`,
+  'content-type': 'application/json',
+  'user-agent': 'agent-authority-live-google-validation/0.4'
+};
+
+let providerReadCalls = 0;
+let providerMutationCalls = 0;
+let cleanupCalls = 0;
+let createdEventId = null;
+
+async function googleResponse(url, options = {}) {
+  const response = await fetch(url, {
+    ...options,
+    headers: { ...providerHeaders, ...(options.headers || {}) }
+  });
+  const text = await response.text();
+  let body = null;
+  if (text) {
+    try { body = JSON.parse(text); } catch { body = text; }
+  }
+  if (!response.ok) {
+    throw new Error(`Google API ${response.status}: ${typeof body === 'string' ? body.slice(0, 300) : JSON.stringify(body).slice(0, 300)}`);
+  }
+  return body;
+}
+
+async function readAuthorizedThread() {
+  return guard.run(
+    {
+      service: 'gmail',
+      action: 'thread.read',
+      context: { thread_id: threadId }
+    },
+    async () => {
+      providerReadCalls += 1;
+      const query = new URLSearchParams({ format: 'metadata' });
+      query.append('metadataHeaders', 'From');
+      const thread = await googleResponse(
+        `https://gmail.googleapis.com/gmail/v1/users/me/threads/${encodeURIComponent(threadId)}?${query}`
+      );
+      const sender = gmailThreadSenderEmail(thread);
+      return {
+        provider: 'gmail',
+        thread_id: thread.id,
+        sender_email: sender.email,
+        sender_raw: sender.raw,
+        sender_message_id: sender.message_id,
+        message_count: Array.isArray(thread.messages) ? thread.messages.length : 0
+      };
+    }
+  );
+}
+
+async function createCalendarEvent(attendeeEmail, suffix) {
+  const request = {
+    service: 'calendar',
+    action: 'event.create',
+    context: {
+      calendar_id: calendarId,
+      attendee_email: attendeeEmail,
+      start_time: startTime,
+      end_time: endTime,
+      summary: `${marker} — ${suffix}`,
+      transparency: 'transparent',
+      visibility: 'private',
+      send_updates: 'none'
+    }
+  };
+
+  return guard.run(request, async () => {
+    providerMutationCalls += 1;
+    const event = await googleResponse(
+      `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(calendarId)}/events?sendUpdates=none`,
+      {
+        method: 'POST',
+        body: JSON.stringify({
+          summary: request.context.summary,
+          description: 'Temporary event created by the Agent Authority live Gmail → Calendar validation. Cleanup deletes it after the proof.',
+          start: { dateTime: startTime },
+          end: { dateTime: endTime },
+          attendees: [{ email: attendeeEmail }],
+          transparency: 'transparent',
+          visibility: 'private'
+        })
+      }
+    );
+    return { event_id: event.id, html_link: event.htmlLink || null };
+  });
+}
+
+async function cleanupEvent(eventId) {
+  cleanupCalls += 1;
+  const response = await fetch(
+    `https://www.googleapis.com/calendar/v3/calendars/${encodeURIComponent(calendarId)}/events/${encodeURIComponent(eventId)}?sendUpdates=none`,
+    { method: 'DELETE', headers: providerHeaders }
+  );
+  if (!response.ok && response.status !== 404) {
+    const body = await response.text();
+    throw new Error(`Google Calendar cleanup ${response.status}: ${body.slice(0, 300)}`);
+  }
+}
+
+try {
+  console.log(`Task root Gmail thread: ${threadId}`);
+  console.log(`Task root Calendar: ${calendarId}`);
+  console.log('1. Read the approved Gmail thread through the Task Lease');
+  const discovered = await readAuthorizedThread();
+  console.log(`   ALLOW -> Gmail returned sender ${discovered.output.sender_email}`);
+
+  if (expectedSender && discovered.output.sender_email !== expectedSender) {
+    throw new Error(`expected sender ${expectedSender}, got ${discovered.output.sender_email}`);
+  }
+
+  const senderFact = lease.deriveFromEvidence({
+    fact_id: 'fact:sender-email',
+    kind: 'email.address',
+    from: ['fact:gmail-thread'],
+    receipt: discovered.receipt,
+    evidence: discovered.evidence,
+    output: discovered.output,
+    extractor: gmailThreadSenderAuthorityExtractor
+  });
+  console.log(`2. Evidence-verified authority -> Calendar attendee ${senderFact.value}`);
+
+  const allowed = await createCalendarEvent(senderFact.value, 'authorized');
+  createdEventId = allowed.output.event_id;
+  console.log(`3. ALLOW -> real Calendar event mutation executed (${createdEventId})`);
+
+  try {
+    await createCalendarEvent('blocked@example.invalid', 'must-never-run');
+    throw new Error('unrelated attendee mutation unexpectedly executed');
+  } catch (error) {
+    if (!(error instanceof AuthorityApprovalRequiredError) || error.code !== 'authority_delta_required') {
+      throw error;
+    }
+    console.log('4. STEP-UP -> unrelated attendee blocked before Calendar provider mutation');
+  }
+
+  if (providerMutationCalls !== 1) {
+    throw new Error(`expected exactly one task-side Calendar mutation before completion, got ${providerMutationCalls}`);
+  }
+
+  lease.complete('live Gmail to Calendar validation complete');
+  try {
+    await createCalendarEvent(senderFact.value, 'must-not-run-after-completion');
+    throw new Error('post-completion Calendar mutation unexpectedly executed');
+  } catch (error) {
+    if (!(error instanceof AuthorityDeniedError) || error.code !== 'task_lease_completed') {
+      throw error;
+    }
+    console.log('5. DENY -> post-completion Calendar mutation blocked');
+  }
+
+  if (providerReadCalls !== 1) {
+    throw new Error(`expected exactly one Gmail provider read, got ${providerReadCalls}`);
+  }
+  if (providerMutationCalls !== 1) {
+    throw new Error(`expected exactly one Calendar provider mutation after blocked attempts, got ${providerMutationCalls}`);
+  }
+
+  console.log('PASS -> a sender discovered from real Gmail became evidence-verified exact authority for one real Calendar mutation');
+  console.log('PASS -> unrelated and post-completion attempts caused zero additional Calendar provider mutations');
+} finally {
+  if (createdEventId) {
+    await cleanupEvent(createdEventId);
+    console.log(`Cleanup -> deleted temporary Calendar event ${createdEventId} outside the agent authority proof`);
+  }
+  console.log(`Provider calls observed before cleanup: gmail_reads=${providerReadCalls}, calendar_task_mutations=${providerMutationCalls}`);
+  console.log(`Harness cleanup calls: ${cleanupCalls}`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nullsquare/agent-authority",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Task-bounded authority runtime for AI agents: give agents tasks, not standing account permissions.",
   "license": "Apache-2.0",
   "type": "module",
@@ -35,12 +35,13 @@
     "demo:task-lease": "node examples/task-lease-demo.js",
     "demo:live-github": "node examples/live-github-task-lease.js",
     "demo:live-derived-github": "node examples/live-github-derived-mutation.js",
+    "demo:live-google": "node examples/live-google-cross-provider.js",
     "demo:mcp-upstream": "node examples/validation-mcp-upstream.js",
     "demo:guard": "node examples/direct-guard.js",
     "test": "node --test test/*.test.js",
     "test:ai-sdk": "node --test test/integrations/ai-sdk.integration.mjs",
     "test:coverage": "node --experimental-test-coverage --test test/*.test.js",
-    "check:syntax": "node --check src/index.js && node --check src/connections.js && node --check src/execution.js && node --check src/providers/github.js && node --check src/storage.js && node --check src/runtime-env.js && node --check src/sdk.js && node --check src/server.js && node --check src/cli.js && node --check src/agent-auth.js && node --check src/approvals.js && node --check src/idempotency.js && node --check src/keys.js && node --check src/harness-bridge.js && node --check src/guard.js && node --check src/task-lease.js && node --check src/mcp-gateway.js && node --check src/mcp-remote.js && node --check src/mcp-server.js && node --check src/integrations/ai-sdk.js && node --check examples/validation-mcp-upstream.js && node --check examples/direct-guard.js && node --check examples/task-lease-demo.js && node --check examples/live-github-task-lease.js && node --check examples/live-github-derived-mutation.js",
+    "check:syntax": "node --check src/index.js && node --check src/authority-evidence.js && node --check src/connections.js && node --check src/execution.js && node --check src/providers/github.js && node --check src/providers/google.js && node --check src/storage.js && node --check src/runtime-env.js && node --check src/sdk.js && node --check src/server.js && node --check src/cli.js && node --check src/agent-auth.js && node --check src/approvals.js && node --check src/idempotency.js && node --check src/keys.js && node --check src/harness-bridge.js && node --check src/guard.js && node --check src/task-lease.js && node --check src/mcp-gateway.js && node --check src/mcp-remote.js && node --check src/mcp-server.js && node --check src/integrations/ai-sdk.js && node --check examples/validation-mcp-upstream.js && node --check examples/direct-guard.js && node --check examples/task-lease-demo.js && node --check examples/live-github-task-lease.js && node --check examples/live-github-derived-mutation.js && node --check examples/live-google-cross-provider.js",
     "check:package": "npm pack --dry-run",
     "check": "npm run check:syntax && npm test && npm run demo:task-lease && npm run check:package"
   },
@@ -59,6 +60,7 @@
     ".": "./src/index.js",
     "./agent-auth": "./src/agent-auth.js",
     "./approvals": "./src/approvals.js",
+    "./authority-evidence": "./src/authority-evidence.js",
     "./connections": "./src/connections.js",
     "./execution": "./src/execution.js",
     "./guard": "./src/guard.js",
@@ -71,7 +73,8 @@
     "./sdk": "./src/sdk.js",
     "./storage": "./src/storage.js",
     "./task-lease": "./src/task-lease.js",
-    "./providers/github": "./src/providers/github.js"
+    "./providers/github": "./src/providers/github.js",
+    "./providers/google": "./src/providers/google.js"
   },
   "files": ["src", "docs", "examples", "README.md", "LICENSE", "SECURITY.md", "ROADMAP.md", "CONTRIBUTING.md"],
   "repository": { "type": "git", "url": "git+https://github.com/Null-Square/agent-authority.git" },

package/src/authority-evidence.js

@@ -0,0 +1,146 @@
+import { hashObject } from './index.js';
+
+const FORBIDDEN_SELECTOR_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+
+function evidenceError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function requireReceipt(receipt) {
+  if (!receipt?.receipt_id) throw evidenceError('evidence_receipt_required', 'execution evidence requires a receipt');
+  if (!receipt?.receipt_hash) throw evidenceError('evidence_receipt_hash_required', 'execution evidence requires a receipt hash');
+  if (receipt.decision !== 'allow') {
+    throw evidenceError('evidence_receipt_not_authorized', 'execution evidence can only be created for an ALLOW receipt');
+  }
+  return receipt;
+}
+
+function unsignedEvidence(evidence = {}) {
+  const { evidence_hash: _evidenceHash, ...unsigned } = evidence;
+  return unsigned;
+}
+
+function hashExecutionOutput(output) {
+  return hashObject({
+    output_type: output === null ? 'null' : typeof output,
+    output
+  });
+}
+
+/**
+ * Bind the exact output returned by an authorized effect to its decision receipt.
+ *
+ * This is integrity evidence, not remote attestation. It prevents downstream code
+ * from silently swapping the output object while still claiming the original
+ * Agent Authority receipt as provenance.
+ */
+export function createExecutionEvidence({ receipt, output } = {}) {
+  requireReceipt(receipt);
+  const evidence = {
+    version: '0.1',
+    type: 'execution-output',
+    receipt_id: receipt.receipt_id,
+    receipt_hash: receipt.receipt_hash,
+    mission_id: receipt.mission_id,
+    task_lease_id: receipt.task_lease_id || null,
+    service: receipt.service,
+    action: receipt.action,
+    request_hash: receipt.request_hash,
+    output_hash: hashExecutionOutput(output)
+  };
+  return { ...evidence, evidence_hash: hashObject(evidence) };
+}
+
+export function verifyExecutionEvidence({ receipt, output, evidence } = {}) {
+  requireReceipt(receipt);
+  if (!evidence || typeof evidence !== 'object') {
+    throw evidenceError('execution_evidence_required', 'derived authority requires execution evidence');
+  }
+  if (evidence.type !== 'execution-output' || evidence.version !== '0.1') {
+    throw evidenceError('execution_evidence_invalid', 'unsupported execution evidence format');
+  }
+  if (hashObject(unsignedEvidence(evidence)) !== evidence.evidence_hash) {
+    throw evidenceError('execution_evidence_tampered', 'execution evidence hash does not match its contents');
+  }
+  if (evidence.receipt_id !== receipt.receipt_id || evidence.receipt_hash !== receipt.receipt_hash) {
+    throw evidenceError('evidence_receipt_mismatch', 'execution evidence belongs to another receipt');
+  }
+  if (evidence.mission_id !== receipt.mission_id) {
+    throw evidenceError('evidence_mission_mismatch', 'execution evidence belongs to another mission');
+  }
+  if ((evidence.task_lease_id || null) !== (receipt.task_lease_id || null)) {
+    throw evidenceError('evidence_lease_mismatch', 'execution evidence belongs to another task lease');
+  }
+  if (evidence.service !== receipt.service || evidence.action !== receipt.action) {
+    throw evidenceError('evidence_operation_mismatch', 'execution evidence operation does not match its receipt');
+  }
+  if (evidence.request_hash !== receipt.request_hash) {
+    throw evidenceError('evidence_request_mismatch', 'execution evidence request does not match its receipt');
+  }
+  if (hashExecutionOutput(output) !== evidence.output_hash) {
+    throw evidenceError('evidence_output_mismatch', 'provider output no longer matches the authorized execution evidence');
+  }
+  return evidence;
+}
+
+export function resolveEvidenceSelector(output, selector) {
+  if (typeof selector !== 'string' || selector.trim() === '') {
+    throw evidenceError('selector_required', 'trusted extractor must provide a selector');
+  }
+
+  let normalized = selector.trim();
+  if (normalized === 'output') return output;
+  if (normalized.startsWith('output.')) normalized = normalized.slice('output.'.length);
+
+  const segments = normalized.split('.');
+  if (segments.length === 0 || segments.some((segment) => !segment || FORBIDDEN_SELECTOR_SEGMENTS.has(segment))) {
+    throw evidenceError('selector_invalid', 'trusted extractor selector contains an invalid path segment');
+  }
+
+  let current = output;
+  for (const segment of segments) {
+    if (current === null || current === undefined || typeof current !== 'object') {
+      throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} does not resolve against provider output`);
+    }
+    if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+      throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} does not resolve against provider output`);
+    }
+    current = current[segment];
+  }
+
+  if (current === undefined) {
+    throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} resolved to undefined`);
+  }
+  return current;
+}
+
+/**
+ * Execute the small trusted-adapter extraction contract.
+ *
+ * Extractors choose which already-normalized output field is authority-relevant;
+ * they do not supply the value. TaskLease resolves the selector itself so the
+ * caller cannot substitute a different value while keeping the same evidence.
+ */
+export function runAuthorityExtractor({ extractor, receipt, output } = {}) {
+  if (typeof extractor !== 'function') {
+    throw evidenceError('trusted_extractor_required', 'deriveFromEvidence requires a trusted adapter extractor');
+  }
+
+  const descriptor = extractor({ receipt, output: structuredClone(output) });
+  if (!descriptor || typeof descriptor !== 'object') {
+    throw evidenceError('trusted_extractor_invalid', 'trusted adapter extractor must return a descriptor');
+  }
+  if (typeof descriptor.extractor_id !== 'string' || descriptor.extractor_id.trim() === '') {
+    throw evidenceError('trusted_extractor_id_required', 'trusted adapter extractor must provide extractor_id');
+  }
+  if (typeof descriptor.selector !== 'string' || descriptor.selector.trim() === '') {
+    throw evidenceError('selector_required', 'trusted adapter extractor must provide selector');
+  }
+
+  return {
+    extractor_id: descriptor.extractor_id.trim(),
+    selector: descriptor.selector.trim()
+  };
+}