@nullsquare/agent-authority 0.4.1 → 0.4.2

package/README.md

@@ -8,9 +8,9 @@
 
 **Agent Authority turns a human-approved task into temporary execution authority, then keeps that authority bounded as the agent discovers resources, crosses tools, and performs side effects.**
 
-[Task Leases](docs/task-leases.md) · [Validate](docs/validation.md) · [Integration contract](docs/integration-contract.md) · [CLI](docs/cli.md) · [Architecture](docs/architecture.md) · [Roadmap](ROADMAP.md) · [Contributing](CONTRIBUTING.md)
+[Task Leases](docs/task-leases.md) · [Validate](docs/validation.md) · [Google proof](docs/live-google-validation.md) · [Integration contract](docs/integration-contract.md) · [CLI](docs/cli.md) · [Architecture](docs/architecture.md) · [Roadmap](ROADMAP.md) · [Contributing](CONTRIBUTING.md)
 
-> **Status: public pre-alpha / v0.4.0 Developer Preview.** Published on npm as `@nullsquare/agent-authority`. The repository has a working policy runtime, protocol-neutral guard, Task Lease prototype with provenance-bound derived facts, approvals, revocation, idempotency, credential isolation, MCP v2 gateway, GitHub brokered execution, CI and CodeQL. It is not production-ready yet.
+> **Status: public pre-alpha / v0.4.1 Developer Preview.** Published on npm as `@nullsquare/agent-authority`. The repository has a working policy runtime, protocol-neutral guard, Task Lease prototype with provenance-bound derived facts, approvals, revocation, idempotency, credential isolation, MCP v2 gateway, GitHub and Google provider integrations, CI and CodeQL. It is not production-ready yet.
 
 </div>
 
@@ -152,6 +152,8 @@ The demo performs this flow without provider credentials:
 
 The side-effect callbacks for blocked actions never run.
 
+The repository also includes a real Gmail → Calendar validation path and a reusable Google provider adapter. See [Live Gmail → Calendar validation](docs/live-google-validation.md).
+
 ## Minimal developer API
 
 ```js
@@ -269,6 +271,7 @@ The long-term validation target is the **same Task Lease and authority lineage a
 - AES-256-GCM local encrypted secret store
 - safe reconnect cleanup
 - GitHub brokered execution without returning the token to the agent
+- Google REST provider mappings for Gmail thread reads and Calendar event mutations
 - short-lived signed local agent-instance tokens
 - local CLI/daemon
 
@@ -278,6 +281,7 @@ The long-term validation target is the **same Task Lease and authority lineage a
 - Node 20 and Node 22 CI
 - coverage run
 - package checks
+- clean-consumer npm registry verification
 - CodeQL
 
 ## What is different from OAuth, IAM and MCP authorization?

package/ROADMAP.md

@@ -77,19 +77,22 @@ Build only what the real M1 workflow proves necessary.
 
 **Success criterion:** a Task Lease survives daemon/process restarts without gaining authority or losing its provenance lineage.
 
-## M3 — Trustworthy derived facts
+## M3 — Trustworthy derived facts — first slice in progress
 
-Today the trusted host/adapter supplies the derived value and selector. This is an explicit v0.4 limitation.
+The first real Gmail -> Calendar integration showed that recording a host-supplied value plus selector was too weak for the strongest derived-authority claim. The compatibility `derive()` path remains host-trusted; new provider work should prefer execution-bound evidence and reviewed adapter extractors.
 
-- [ ] define a small adapter contract for extracting authority-relevant fields from provider results
-- [ ] bind derived fact records to provider/result evidence where practical
-- [ ] adversarial tests for forged extraction, confused-deputy mappings and stale facts
-- [ ] conformance fixture for operation -> resource-context mappings
-- [ ] define invalidation rules when a source resource changes
+- [x] define a small trusted-adapter extractor contract for authority-relevant normalized provider fields
+- [x] bind successful guarded outputs to the exact ALLOW receipt, request and output hash
+- [x] add `TaskLease.deriveFromEvidence()` so the caller cannot provide the authority value
+- [x] migrate Gmail sender -> Calendar attendee derivation to the evidence-verified path
+- [x] adversarial tests for value substitution, output/evidence tampering, receipt replay, cross-lease reuse, wrong-operation extraction and dangerous selectors
+- [ ] define provider/result attestation stronger than a trusted host output hash where practical
+- [ ] conformance fixtures for reviewed operation -> authority-field mappings across multiple providers
+- [ ] define freshness/invalidation rules when a source resource changes
 
 Do **not** build a general semantic policy language unless real integrations require it.
 
-**Success criterion:** an adapter cannot claim a value was derived from an authorized operation without satisfying the documented extraction/evidence contract.
+**Success criterion:** provider-derived authority cannot be established through the strict path unless the exact guarded output, ALLOW receipt and reviewed extractor contract agree on the selected value. Stronger provider attestation and source invalidation remain separate follow-on problems.
 
 ## M4 — Same task, multiple transports
 
@@ -147,7 +150,7 @@ Only after operational evidence.
 
 ## Research questions
 
-1. What is the smallest trustworthy representation of an authority-relevant derived fact?
+1. What provider-side or transport-side evidence can strengthen output integrity without turning Agent Authority into an attestation protocol?
 2. How should an approved authority delta update a running task without opening a broader wildcard permission?
 3. How should source-data changes invalidate downstream derived authority?
 4. What provider/tool metadata is required to map operations to resource context reliably?

package/docs/evidence.md

@@ -10,9 +10,55 @@ This page records the strongest properties the repository currently demonstrates
 
 The guarantee applies to effects that actually pass through the Agent Authority enforcement boundary. A separate unguarded provider path is outside this guarantee.
 
+## Execution-bound derived authority
+
+The strict derived-authority path now binds provider-derived authority to the exact output returned by an authorized `guard.run()` effect.
+
+A successful guarded effect returns three relevant records:
+
+```text
+ALLOW receipt
+    +
+exact effect output
+    |
+    v
+execution evidence
+(receipt + request + output hash)
+    |
+    v
+reviewed adapter extractor
+(selector only, no value)
+    |
+    v
+TaskLease.deriveFromEvidence()
+    |
+    v
+derived authority fact
+```
+
+`deriveFromEvidence()` does not accept the derived authority value. The trusted adapter extractor chooses a reviewed selector, and Task Lease resolves that selector itself only after verifying the execution evidence.
+
+`test/authority-evidence.test.js` attacks this boundary directly and proves that:
+
+- caller-supplied value substitution does not control the resulting fact;
+- modified provider output is rejected with `evidence_output_mismatch`;
+- modified execution-evidence contents are rejected;
+- evidence cannot be replayed under a second ALLOW receipt;
+- a receipt/evidence chain from another Task Lease is rejected;
+- the Gmail sender extractor rejects the wrong provider operation;
+- dangerous selector paths such as `__proto__` fail closed.
+
+The legacy `TaskLease.derive()` API remains for compatibility and records `derivation_mode: host-trusted`. New provider-derived authority should prefer `deriveFromEvidence()`, which records `derivation_mode: execution-evidence-v1`, extractor ID, source output hash, and execution-evidence hash.
+
+### Boundary of this claim
+
+Execution evidence is an integrity mechanism inside the trusted host/runtime boundary. It proves that the value selected for strict derivation came from the exact output object bound to that Agent Authority receipt.
+
+It does **not** prove that Gmail, GitHub, or another provider cryptographically signed that output, and it does not protect a malicious host that bypasses or replaces the Agent Authority enforcement path. Stronger provider/transport attestation remains open M3 work.
+
 ## Cross-provider derived authority — Gmail → Calendar
 
-Agent Authority now includes a real Google provider mapping, an adversarial cross-provider test, a live validation script, and an opt-in GitHub Actions workflow.
+Agent Authority includes a real Google provider mapping, an adversarial cross-provider test, a live validation script, and an opt-in GitHub Actions workflow.
 
 The task shape is:
 
@@ -22,9 +68,11 @@ one Gmail thread
         |
         v
 ALLOW Gmail thread.read
+        |
+        +--> output-bound execution evidence
         |
         v
-discover sender email
+trusted Gmail sender extractor
         |
         v
 derive fact: sender_email
@@ -57,19 +105,21 @@ A controlled self-test was exercised against the connected NullSquare Gmail and
 
 No unrelated external person was invited. The smoke test establishes that the concrete Gmail and Calendar operations used by the validation are available and compatible with the intended data shape.
 
-The live connected-account smoke is not presented as a public CI proof of the repository script. The Task Lease zero-call assertions are separately executable in `test/google-cross-provider.test.js`, and `.github/workflows/live-google-validation.yml` is provided for a rerunnable provider-backed proof once repository Google OAuth secrets are configured.
+The live connected-account smoke is not presented as a public CI proof of the repository script. The Task Lease zero-call and execution-evidence assertions are separately executable in `test/google-cross-provider.test.js` and `test/authority-evidence.test.js`, and `.github/workflows/live-google-validation.yml` is provided for a rerunnable provider-backed proof once repository Google OAuth secrets are configured.
 
 ### Executable local/CI assertions
 
 `test/google-cross-provider.test.js` proves deterministically that:
 
 - the approved Gmail thread callback runs exactly once;
-- its sender becomes a same-lease derived authority fact;
+- its sender becomes a same-lease `execution-evidence-v1` authority fact;
 - one Calendar mutation for that sender runs exactly once;
 - a different attendee produces `authority_delta_required` and the Calendar callback is not invoked;
 - after lease completion, the previously valid attendee produces `task_lease_completed` and the Calendar callback is not invoked again.
 
-`test/google-provider.test.js` separately validates the Google REST mappings, metadata-only Gmail sender extraction, Calendar attendee body, default `sendUpdates=none`, credential redaction, unsupported-action failure, and mutation classification.
+`test/google-provider.test.js` validates the Google REST mappings, metadata-only Gmail sender extraction, Calendar attendee body, default `sendUpdates=none`, credential redaction, unsupported-action failure, and mutation classification.
+
+`test/google-authority-extractor.test.js` separately verifies that the reviewed Gmail extractor only accepts canonical `gmail:thread.read` sender output and that the Google adapter advertises it only for the supported authority mapping.
 
 ### Public workflow
 
@@ -89,9 +139,10 @@ The connected GitHub tool does not expose repository Actions-secret management,
 
 ### What this proves
 
-Taken together, the deterministic Task Lease test plus the controlled provider smoke show that:
+Taken together, the deterministic Task Lease tests plus the controlled provider smoke show that:
 
 - the Gmail → Calendar derived-authority shape is implemented, not just diagrammed;
+- strict derivation binds the sender to the exact guarded Gmail output before it becomes authority;
 - the exact attendee binding is enforced before the Calendar mutation callback;
 - provider operations exist and work against real Gmail and Calendar accounts;
 - cleanup can keep the live proof reversible and self-contained.
@@ -99,9 +150,10 @@ Taken together, the deterministic Task Lease test plus the controlled provider s
 ### What this does not prove yet
 
 - a public GitHub Actions run has executed the full repository live script;
-- host-side extraction of `sender_email` is cryptographically attested by Gmail;
+- `sender_email` is cryptographically attested by Gmail rather than integrity-bound to the trusted host's guarded output;
 - the agent cannot bypass Agent Authority if it independently holds a Google credential;
 - Task Lease state is durable across process failure;
+- source-data changes automatically invalidate downstream facts;
 - the refresh-token setup is production credential onboarding.
 
 See [Live Gmail → Calendar validation](live-google-validation.md).
@@ -178,7 +230,7 @@ The temporary validation comment is deleted by test-harness cleanup after the pr
 
 ### What this does not prove
 
-- the host/adapter's extraction of `output.number` is cryptographically verified;
+- the current GitHub example has migrated to a reviewed evidence extractor contract;
 - an agent cannot bypass Agent Authority if it independently possesses the provider credential or another unguarded provider path;
 - Task Lease state is durable across process failure;
 - the current prototype is ready for adversarial production use.
@@ -209,7 +261,8 @@ The test suite also covers:
 - receipts from another mission are rejected;
 - receipts from another Task Lease are rejected;
 - parent lineage is required;
-- a trusted extraction selector must be recorded;
+- legacy host-trusted derivation records its extraction selector;
+- strict execution-evidence derivation rejects substitution/replay/tampering cases;
 - explicit mission deny rules remain the ceiling;
 - lease expiry and mission expiry are enforced against a consistent evaluation clock.
 
@@ -225,7 +278,7 @@ Current pull requests run:
 - coverage;
 - live GitHub read validation;
 - live derived GitHub mutation validation for trusted in-repository branches;
-- Google provider and cross-provider adversarial tests;
+- Google provider, extractor, cross-provider and execution-evidence adversarial tests;
 - CodeQL.
 
 The live Google provider mutation workflow is manual because it requires repository-owned Google OAuth secrets. It should be added to the public evidence list after its first successful run.

package/docs/npm-release.md

@@ -13,17 +13,19 @@ Before any publication:
 After publication, verify from a fresh project with:
 
 ```bash
-npm install @nullsquare/agent-authority@0.4.0
+npm install @nullsquare/agent-authority@0.4.1
 ```
 
 Then run the same consumer smoke flow through the registry-installed package. Registry verification is part of the release gate; a successful `npm publish` command alone is not sufficient.
 
+The repository also includes `.github/workflows/verify-npm-registry.yml`, which verifies registry visibility and a clean consumer install. For v0.4.1 it additionally verifies the public `@nullsquare/agent-authority/providers/google` export.
+
 ## npm vs GitHub release surfaces
 
 Publishing to the public npm registry does not automatically create either a GitHub Release or a GitHub Packages entry.
 
 - **npm registry** — `npm publish --access public` publishes `@nullsquare/agent-authority` to `registry.npmjs.org` / npmjs.com. This is the package users install with `npm install`.
-- **GitHub Releases** — a separate GitHub object, normally backed by a Git tag such as `v0.4.0`. A release must be created explicitly or by release automation.
+- **GitHub Releases** — a separate GitHub object, normally backed by a Git tag such as `v0.4.1`. A release must be created explicitly or by release automation.
 - **GitHub Packages** — a separate package registry. It only appears when the package is published to GitHub's npm registry (`npm.pkg.github.com`); publishing to npmjs.com does not populate it.
 
 Agent Authority currently uses npmjs.com as its public package registry. Therefore an empty GitHub **Packages** section is expected unless the project intentionally adopts dual publication. A GitHub **Release** is still useful for source-release discoverability and should track published versions, but it is independent from npm publication.

package/docs/task-leases.md

@@ -32,6 +32,12 @@ Human-approved task
   authority roots
         |
  authorized execution
+        |
+        +--> ALLOW receipt
+        +--> exact output hash evidence
+        |
+        v
+ trusted adapter extractor
         |
         v
   derived facts
@@ -64,7 +70,60 @@ Examples:
 - customer ID discovered from an authorized support-ticket lookup;
 - order ID discovered from an authorized customer lookup.
 
-In v0.4, a derived fact must reference an `ALLOW` receipt from the same mission. It may also reference existing parent facts.
+A derived fact must reference an `ALLOW` receipt from the same Task Lease and at least one parent authority fact.
+
+Agent Authority now exposes two derivation modes:
+
+- `derive()` — compatibility path where the trusted host supplies both `value` and `selector`;
+- `deriveFromEvidence()` — stricter path where the host does **not** supply the authority value.
+
+For provider-derived authority, prefer `deriveFromEvidence()`.
+
+### Execution evidence
+
+After an allowed `guard.run()` effect succeeds, the guard returns:
+
+```js
+{
+  output,
+  receipt,
+  evidence
+}
+```
+
+The execution-evidence record binds:
+
+- the receipt ID and receipt hash;
+- mission and Task Lease identity;
+- service and action;
+- request hash;
+- a hash of the exact returned output.
+
+If downstream code changes the output and tries to reuse the original evidence, derivation fails with `evidence_output_mismatch`.
+
+This is an integrity mechanism inside the trusted host/runtime boundary. It is **not** provider-signed remote attestation.
+
+### Trusted adapter extractor
+
+The adapter extractor identifies which normalized provider-output field may become authority.
+
+For Gmail, the current extractor accepts only a `gmail:thread.read` receipt and selects:
+
+```text
+output.sender_email
+```
+
+The extractor returns only an ID and selector. It does not return the authority value.
+
+Task Lease resolves the selector itself after checking the execution evidence. This prevents ordinary host code from doing this:
+
+```text
+Gmail returned customer@example.com
+host claims attacker@example.com
+while reusing the original Gmail receipt
+```
+
+The stricter path rejects output/evidence substitution rather than recording the host's claimed value.
 
 ### Binding
 
@@ -74,7 +133,7 @@ A binding narrows an otherwise permitted action to the exact value held by an au
 {
   service: 'calendar',
   action: 'event.create',
-  context_field: 'attendee',
+  context_field: 'attendee_email',
   fact_id: 'fact:requester-email'
 }
 ```
@@ -87,7 +146,7 @@ If it has value `customer@example.com`, this request can proceed:
 {
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: 'customer@example.com' }
+  context: { attendee_email: 'customer@example.com' }
 }
 ```
 
@@ -97,7 +156,7 @@ This request does not proceed automatically:
 {
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: 'other@example.com' }
+  context: { attendee_email: 'other@example.com' }
 }
 ```
 
@@ -126,12 +185,13 @@ lease authority <= mission authority
 
 Authority may stay the same or shrink. It must never grow silently.
 
-## Example
+## Evidence-verified Gmail -> Calendar example
 
 ```js
 import { AuthorityRuntime } from '@nullsquare/agent-authority';
 import { createTaskLease } from '@nullsquare/agent-authority/task-lease';
 import { createTaskLeaseGuard } from '@nullsquare/agent-authority/guard';
+import { gmailThreadSenderAuthorityExtractor } from '@nullsquare/agent-authority/providers/google';
 
 const lease = createTaskLease({
   mission,
@@ -143,7 +203,7 @@ const lease = createTaskLease({
     {
       service: 'calendar',
       action: 'event.create',
-      context_field: 'attendee',
+      context_field: 'attendee_email',
       fact_id: 'fact:sender-email'
     }
   ]
@@ -157,30 +217,29 @@ const guard = createTaskLeaseGuard({
 const read = await guard.run({
   service: 'gmail',
   action: 'thread.read',
-  context: { thread: 'thread:demo-91' }
+  context: { thread_id: 'thread:demo-91' }
 }, () => gmail.readThread('thread:demo-91'));
 
-lease.derive({
+const senderFact = lease.deriveFromEvidence({
   fact_id: 'fact:sender-email',
   kind: 'email.address',
-  value: read.output.sender,
   from: ['fact:thread'],
   receipt: read.receipt,
-  selector: 'output.sender'
+  evidence: read.evidence,
+  output: read.output,
+  extractor: gmailThreadSenderAuthorityExtractor
 });
 
 await guard.run({
   service: 'calendar',
   action: 'event.create',
-  context: { attendee: read.output.sender }
-}, () => calendar.createEvent({ attendee: read.output.sender }));
+  context: { attendee_email: senderFact.value }
+}, () => calendar.createEvent({ attendee: senderFact.value }));
 ```
 
-Run the self-contained example:
+Notice that `deriveFromEvidence()` has no `value` argument. The fact value comes from the exact output already bound to the authorized read.
 
-```bash
-npm run demo:task-lease
-```
+The older `derive()` API remains available for integrations that have not adopted the evidence contract yet. Facts created through that API record `derivation_mode: host-trusted` so audit code can distinguish the weaker path.
 
 ## Task completion
 
@@ -207,36 +266,44 @@ requested new resource
 authority_delta_required
 ```
 
-The existing approval store can handle the human decision. Automatically applying approved deltas to a live Task Lease is a later milestone; v0.4 deliberately stops at the safe enforcement signal.
+The existing approval store can handle the human decision. Automatically applying approved deltas to a live Task Lease is a later milestone; the current implementation deliberately stops at the safe enforcement signal.
 
 ## Current security properties
 
-The v0.4 implementation tests that:
+The implementation tests that:
 
 - a bound action cannot run before its fact exists;
-- derived facts require an `ALLOW` receipt;
-- the receipt must belong to the same mission;
+- derived facts require an `ALLOW` receipt from the same mission and Task Lease;
 - explicit mission denies cannot be overridden by lease bindings;
 - an exact derived resource can execute;
 - a different resource becomes an authority delta and the effect does not run;
 - completed and expired leases stop execution;
-- Task Lease receipts include the lease ID and lease hash.
+- Task Lease receipts include the lease ID and lease hash;
+- successful guarded effects produce output-bound execution evidence;
+- `deriveFromEvidence()` ignores any caller-supplied `value` and resolves the trusted selector itself;
+- modified provider output is rejected;
+- modified execution evidence is rejected;
+- execution evidence cannot be replayed under another receipt or Task Lease;
+- the Gmail extractor rejects the wrong service/action;
+- dangerous selector paths such as `__proto__` fail closed.
 
 ## Current limitations
 
 This is still a validation implementation.
 
-1. **Extraction trust:** the trusted host/adapter supplies the derived value and selector. Agent Authority records lineage but does not yet cryptographically prove that the selected output field contained that value.
-2. **In-memory lease state:** TaskLease instances are currently process-local. Durable lease persistence/recovery is not implemented yet.
-3. **Top-level binding fields:** v0.4 binds top-level request context fields only. Nested JSON-path policy is intentionally deferred.
-4. **Step-up application:** authority deltas are surfaced but approved deltas are not yet automatically applied back into the lease.
-5. **Adapter semantics:** providers still need trustworthy mappings from an external operation to `service`, `action`, and resource context fields.
+1. **Trusted host/adapter boundary:** execution evidence is produced by Agent Authority around the host effect, not signed by Gmail, Calendar, or another provider. A malicious host that can bypass or replace Agent Authority remains outside the guarantee.
+2. **Provider attestation:** output hashes prove consistency with what the guarded effect returned; they do not cryptographically prove what the remote provider emitted on the wire.
+3. **Source invalidation:** a source resource changing later does not yet invalidate already-derived facts automatically.
+4. **In-memory lease state:** TaskLease instances are currently process-local. Durable lease persistence/recovery is not implemented yet.
+5. **Top-level binding fields:** bindings target top-level request context fields. A general nested policy language is intentionally deferred.
+6. **Step-up application:** authority deltas are surfaced but approved deltas are not yet automatically applied back into the lease.
+7. **Adapter semantics:** each provider still needs a reviewed operation -> authority-field mapping. The Google sender extractor is the first concrete contract.
 
-These constraints are deliberate. The next work should be driven by real integrations rather than by adding a general policy language.
+These constraints are deliberate. The project should improve the evidence contract from real provider cases rather than build a universal semantic policy language.
 
 ## Validation target
 
-The product thesis is validated when the same Task Lease can safely govern a real multi-step workflow across more than one execution transport, for example:
+The longer-term product thesis is validated when the same Task Lease can safely govern a real multi-step workflow across more than one execution transport, for example:
 
 ```text
 one human task

package/examples/live-google-cross-provider.js

@@ -4,7 +4,10 @@ import {
   AuthorityDeniedError,
   createTaskLeaseGuard
 } from '../src/guard.js';
-import { gmailThreadSenderEmail } from '../src/providers/google.js';
+import {
+  gmailThreadSenderAuthorityExtractor,
+  gmailThreadSenderEmail
+} from '../src/providers/google.js';
 import { createTaskLease } from '../src/task-lease.js';
 
 const token = process.env.GOOGLE_ACCESS_TOKEN;
@@ -128,6 +131,7 @@ async function readAuthorizedThread() {
       );
       const sender = gmailThreadSenderEmail(thread);
       return {
+        provider: 'gmail',
         thread_id: thread.id,
         sender_email: sender.email,
         sender_raw: sender.raw,
@@ -198,17 +202,18 @@ try {
     throw new Error(`expected sender ${expectedSender}, got ${discovered.output.sender_email}`);
   }
 
-  lease.derive({
+  const senderFact = lease.deriveFromEvidence({
     fact_id: 'fact:sender-email',
     kind: 'email.address',
-    value: discovered.output.sender_email,
     from: ['fact:gmail-thread'],
     receipt: discovered.receipt,
-    selector: 'output.sender_email'
+    evidence: discovered.evidence,
+    output: discovered.output,
+    extractor: gmailThreadSenderAuthorityExtractor
   });
-  console.log(`2. Derived authority -> Calendar attendee ${discovered.output.sender_email}`);
+  console.log(`2. Evidence-verified authority -> Calendar attendee ${senderFact.value}`);
 
-  const allowed = await createCalendarEvent(discovered.output.sender_email, 'authorized');
+  const allowed = await createCalendarEvent(senderFact.value, 'authorized');
   createdEventId = allowed.output.event_id;
   console.log(`3. ALLOW -> real Calendar event mutation executed (${createdEventId})`);
 
@@ -228,7 +233,7 @@ try {
 
   lease.complete('live Gmail to Calendar validation complete');
   try {
-    await createCalendarEvent(discovered.output.sender_email, 'must-not-run-after-completion');
+    await createCalendarEvent(senderFact.value, 'must-not-run-after-completion');
     throw new Error('post-completion Calendar mutation unexpectedly executed');
   } catch (error) {
     if (!(error instanceof AuthorityDeniedError) || error.code !== 'task_lease_completed') {
@@ -244,7 +249,7 @@ try {
     throw new Error(`expected exactly one Calendar provider mutation after blocked attempts, got ${providerMutationCalls}`);
   }
 
-  console.log('PASS -> a sender discovered from real Gmail became exact derived authority for one real Calendar mutation');
+  console.log('PASS -> a sender discovered from real Gmail became evidence-verified exact authority for one real Calendar mutation');
   console.log('PASS -> unrelated and post-completion attempts caused zero additional Calendar provider mutations');
 } finally {
   if (createdEventId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nullsquare/agent-authority",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Task-bounded authority runtime for AI agents: give agents tasks, not standing account permissions.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,7 +41,7 @@
     "test": "node --test test/*.test.js",
     "test:ai-sdk": "node --test test/integrations/ai-sdk.integration.mjs",
     "test:coverage": "node --experimental-test-coverage --test test/*.test.js",
-    "check:syntax": "node --check src/index.js && node --check src/connections.js && node --check src/execution.js && node --check src/providers/github.js && node --check src/providers/google.js && node --check src/storage.js && node --check src/runtime-env.js && node --check src/sdk.js && node --check src/server.js && node --check src/cli.js && node --check src/agent-auth.js && node --check src/approvals.js && node --check src/idempotency.js && node --check src/keys.js && node --check src/harness-bridge.js && node --check src/guard.js && node --check src/task-lease.js && node --check src/mcp-gateway.js && node --check src/mcp-remote.js && node --check src/mcp-server.js && node --check src/integrations/ai-sdk.js && node --check examples/validation-mcp-upstream.js && node --check examples/direct-guard.js && node --check examples/task-lease-demo.js && node --check examples/live-github-task-lease.js && node --check examples/live-github-derived-mutation.js && node --check examples/live-google-cross-provider.js",
+    "check:syntax": "node --check src/index.js && node --check src/authority-evidence.js && node --check src/connections.js && node --check src/execution.js && node --check src/providers/github.js && node --check src/providers/google.js && node --check src/storage.js && node --check src/runtime-env.js && node --check src/sdk.js && node --check src/server.js && node --check src/cli.js && node --check src/agent-auth.js && node --check src/approvals.js && node --check src/idempotency.js && node --check src/keys.js && node --check src/harness-bridge.js && node --check src/guard.js && node --check src/task-lease.js && node --check src/mcp-gateway.js && node --check src/mcp-remote.js && node --check src/mcp-server.js && node --check src/integrations/ai-sdk.js && node --check examples/validation-mcp-upstream.js && node --check examples/direct-guard.js && node --check examples/task-lease-demo.js && node --check examples/live-github-task-lease.js && node --check examples/live-github-derived-mutation.js && node --check examples/live-google-cross-provider.js",
     "check:package": "npm pack --dry-run",
     "check": "npm run check:syntax && npm test && npm run demo:task-lease && npm run check:package"
   },
@@ -60,6 +60,7 @@
     ".": "./src/index.js",
     "./agent-auth": "./src/agent-auth.js",
     "./approvals": "./src/approvals.js",
+    "./authority-evidence": "./src/authority-evidence.js",
     "./connections": "./src/connections.js",
     "./execution": "./src/execution.js",
     "./guard": "./src/guard.js",

package/src/authority-evidence.js

@@ -0,0 +1,146 @@
+import { hashObject } from './index.js';
+
+const FORBIDDEN_SELECTOR_SEGMENTS = new Set(['__proto__', 'prototype', 'constructor']);
+
+function evidenceError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function requireReceipt(receipt) {
+  if (!receipt?.receipt_id) throw evidenceError('evidence_receipt_required', 'execution evidence requires a receipt');
+  if (!receipt?.receipt_hash) throw evidenceError('evidence_receipt_hash_required', 'execution evidence requires a receipt hash');
+  if (receipt.decision !== 'allow') {
+    throw evidenceError('evidence_receipt_not_authorized', 'execution evidence can only be created for an ALLOW receipt');
+  }
+  return receipt;
+}
+
+function unsignedEvidence(evidence = {}) {
+  const { evidence_hash: _evidenceHash, ...unsigned } = evidence;
+  return unsigned;
+}
+
+function hashExecutionOutput(output) {
+  return hashObject({
+    output_type: output === null ? 'null' : typeof output,
+    output
+  });
+}
+
+/**
+ * Bind the exact output returned by an authorized effect to its decision receipt.
+ *
+ * This is integrity evidence, not remote attestation. It prevents downstream code
+ * from silently swapping the output object while still claiming the original
+ * Agent Authority receipt as provenance.
+ */
+export function createExecutionEvidence({ receipt, output } = {}) {
+  requireReceipt(receipt);
+  const evidence = {
+    version: '0.1',
+    type: 'execution-output',
+    receipt_id: receipt.receipt_id,
+    receipt_hash: receipt.receipt_hash,
+    mission_id: receipt.mission_id,
+    task_lease_id: receipt.task_lease_id || null,
+    service: receipt.service,
+    action: receipt.action,
+    request_hash: receipt.request_hash,
+    output_hash: hashExecutionOutput(output)
+  };
+  return { ...evidence, evidence_hash: hashObject(evidence) };
+}
+
+export function verifyExecutionEvidence({ receipt, output, evidence } = {}) {
+  requireReceipt(receipt);
+  if (!evidence || typeof evidence !== 'object') {
+    throw evidenceError('execution_evidence_required', 'derived authority requires execution evidence');
+  }
+  if (evidence.type !== 'execution-output' || evidence.version !== '0.1') {
+    throw evidenceError('execution_evidence_invalid', 'unsupported execution evidence format');
+  }
+  if (hashObject(unsignedEvidence(evidence)) !== evidence.evidence_hash) {
+    throw evidenceError('execution_evidence_tampered', 'execution evidence hash does not match its contents');
+  }
+  if (evidence.receipt_id !== receipt.receipt_id || evidence.receipt_hash !== receipt.receipt_hash) {
+    throw evidenceError('evidence_receipt_mismatch', 'execution evidence belongs to another receipt');
+  }
+  if (evidence.mission_id !== receipt.mission_id) {
+    throw evidenceError('evidence_mission_mismatch', 'execution evidence belongs to another mission');
+  }
+  if ((evidence.task_lease_id || null) !== (receipt.task_lease_id || null)) {
+    throw evidenceError('evidence_lease_mismatch', 'execution evidence belongs to another task lease');
+  }
+  if (evidence.service !== receipt.service || evidence.action !== receipt.action) {
+    throw evidenceError('evidence_operation_mismatch', 'execution evidence operation does not match its receipt');
+  }
+  if (evidence.request_hash !== receipt.request_hash) {
+    throw evidenceError('evidence_request_mismatch', 'execution evidence request does not match its receipt');
+  }
+  if (hashExecutionOutput(output) !== evidence.output_hash) {
+    throw evidenceError('evidence_output_mismatch', 'provider output no longer matches the authorized execution evidence');
+  }
+  return evidence;
+}
+
+export function resolveEvidenceSelector(output, selector) {
+  if (typeof selector !== 'string' || selector.trim() === '') {
+    throw evidenceError('selector_required', 'trusted extractor must provide a selector');
+  }
+
+  let normalized = selector.trim();
+  if (normalized === 'output') return output;
+  if (normalized.startsWith('output.')) normalized = normalized.slice('output.'.length);
+
+  const segments = normalized.split('.');
+  if (segments.length === 0 || segments.some((segment) => !segment || FORBIDDEN_SELECTOR_SEGMENTS.has(segment))) {
+    throw evidenceError('selector_invalid', 'trusted extractor selector contains an invalid path segment');
+  }
+
+  let current = output;
+  for (const segment of segments) {
+    if (current === null || current === undefined || typeof current !== 'object') {
+      throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} does not resolve against provider output`);
+    }
+    if (!Object.prototype.hasOwnProperty.call(current, segment)) {
+      throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} does not resolve against provider output`);
+    }
+    current = current[segment];
+  }
+
+  if (current === undefined) {
+    throw evidenceError('selector_unresolved', `trusted extractor selector ${selector} resolved to undefined`);
+  }
+  return current;
+}
+
+/**
+ * Execute the small trusted-adapter extraction contract.
+ *
+ * Extractors choose which already-normalized output field is authority-relevant;
+ * they do not supply the value. TaskLease resolves the selector itself so the
+ * caller cannot substitute a different value while keeping the same evidence.
+ */
+export function runAuthorityExtractor({ extractor, receipt, output } = {}) {
+  if (typeof extractor !== 'function') {
+    throw evidenceError('trusted_extractor_required', 'deriveFromEvidence requires a trusted adapter extractor');
+  }
+
+  const descriptor = extractor({ receipt, output: structuredClone(output) });
+  if (!descriptor || typeof descriptor !== 'object') {
+    throw evidenceError('trusted_extractor_invalid', 'trusted adapter extractor must return a descriptor');
+  }
+  if (typeof descriptor.extractor_id !== 'string' || descriptor.extractor_id.trim() === '') {
+    throw evidenceError('trusted_extractor_id_required', 'trusted adapter extractor must provide extractor_id');
+  }
+  if (typeof descriptor.selector !== 'string' || descriptor.selector.trim() === '') {
+    throw evidenceError('selector_required', 'trusted adapter extractor must provide selector');
+  }
+
+  return {
+    extractor_id: descriptor.extractor_id.trim(),
+    selector: descriptor.selector.trim()
+  };
+}

package/src/guard.js

@@ -1,3 +1,5 @@
+import { createExecutionEvidence } from './authority-evidence.js';
+
 export class AuthorityDeniedError extends Error {
   constructor({ result, receipt }) {
     super(result?.reason || 'action denied by Agent Authority');
@@ -25,6 +27,10 @@ export class AuthorityApprovalRequiredError extends Error {
  * authority boundary returns ALLOW. A guard can use either a static mission or
  * a TaskLease. Task leases add provenance-bound restrictions without changing
  * the host application's credential ownership.
+ *
+ * Successful effects also return execution evidence binding the exact output
+ * hash to the ALLOW receipt. TaskLease.deriveFromEvidence() can use that record
+ * with a trusted adapter extractor so callers do not provide derived values.
  */
 export class AuthorityGuard {
   constructor({ mission, lease, runtime, onDecision } = {}) {
@@ -66,7 +72,8 @@ export class AuthorityGuard {
     }
 
     const output = await effect();
-    return { output, result: evaluation.result, receipt: evaluation.receipt };
+    const evidence = createExecutionEvidence({ receipt: evaluation.receipt, output });
+    return { output, result: evaluation.result, receipt: evaluation.receipt, evidence };
   }
 }
 

package/src/providers/google.js

@@ -42,6 +42,37 @@ export function gmailThreadSenderEmail(thread) {
   throw providerError('gmail_sender_missing', 'Gmail thread does not contain a usable From header');
 }
 
+/**
+ * Trusted authority-extraction contract for the normalized Gmail thread output.
+ *
+ * The extractor chooses the authority-relevant selector only. It never returns
+ * the value itself; TaskLease resolves output.sender_email after verifying the
+ * guard's execution evidence. This prevents host code from substituting another
+ * email while retaining the original Gmail receipt/evidence chain.
+ */
+export function gmailThreadSenderAuthorityExtractor({ receipt, output } = {}) {
+  if (receipt?.service !== 'gmail' || receipt?.action !== 'thread.read') {
+    throw providerError(
+      'trusted_extractor_operation_mismatch',
+      'Gmail sender authority extractor only accepts gmail:thread.read receipts'
+    );
+  }
+
+  const raw = typeof output?.sender_email === 'string' ? output.sender_email.trim() : '';
+  const normalized = extractEmailAddress(raw);
+  if (!normalized || normalized !== raw) {
+    throw providerError(
+      'trusted_extractor_output_invalid',
+      'normalized Gmail output does not contain a canonical sender_email'
+    );
+  }
+
+  return {
+    extractor_id: 'google.gmail.thread.sender-email.v1',
+    selector: 'output.sender_email'
+  };
+}
+
 function validateSendUpdates(value) {
   const normalized = value || 'none';
   if (!SEND_UPDATES.has(normalized)) {
@@ -197,5 +228,11 @@ export function createGoogleProviderAdapter({
 
   adapter.validateRequest = (request) => operationFor(request);
   adapter.isMutation = (request) => MUTATING_ACTIONS.has(request?.action);
+  adapter.authorityExtractor = (request, kind = 'email.address') => {
+    if (request?.service === 'gmail' && request?.action === 'thread.read' && kind === 'email.address') {
+      return gmailThreadSenderAuthorityExtractor;
+    }
+    return null;
+  };
   return adapter;
 }

package/src/task-lease.js

@@ -1,5 +1,10 @@
 import { randomUUID } from 'node:crypto';
 import { assertMission, createReceipt, hashObject, matchPattern } from './index.js';
+import {
+  resolveEvidenceSelector,
+  runAuthorityExtractor,
+  verifyExecutionEvidence
+} from './authority-evidence.js';
 
 function authorityError(code, message) {
   const error = new Error(message);
@@ -95,6 +100,12 @@ export class TaskLease {
     return structuredClone(fact);
   }
 
+  /**
+   * Legacy host-trusted derivation path.
+   *
+   * The caller supplies both value and selector. Keep this API for compatibility,
+   * but prefer deriveFromEvidence() for authority-relevant provider outputs.
+   */
   derive({ fact_id, kind = 'opaque', value, from = [], receipt, selector } = {}) {
     if (!fact_id) throw new Error('derived fact_id is required');
     if (value === undefined) throw new Error('derived value is required');
@@ -125,6 +136,7 @@ export class TaskLease {
       value,
       provenance: {
         type: 'derived',
+        derivation_mode: 'host-trusted',
         from: parents,
         task_lease_id: this.lease_id,
         receipt_id: receipt.receipt_id,
@@ -140,6 +152,71 @@ export class TaskLease {
     return structuredClone(fact);
   }
 
+  /**
+   * Strict derivation path for provider data.
+   *
+   * The caller cannot supply the authority value. A trusted adapter extractor
+   * identifies one normalized output selector, TaskLease resolves that selector
+   * itself, and execution evidence proves the output still matches the exact
+   * ALLOW receipt returned by guard.run().
+   */
+  deriveFromEvidence({
+    fact_id,
+    kind = 'opaque',
+    from = [],
+    receipt,
+    evidence,
+    output,
+    extractor
+  } = {}) {
+    if (!fact_id) throw new Error('derived fact_id is required');
+    if (this.facts.has(fact_id)) throw authorityError('fact_exists', `authority fact ${fact_id} already exists`);
+    if (!receipt) throw authorityError('receipt_required', 'derived authority requires an authorized source receipt');
+    if (receipt.decision !== 'allow') throw authorityError('receipt_not_authorized', 'derived authority requires an ALLOW receipt');
+    if (receipt.mission_id !== this.mission.mission_id) {
+      throw authorityError('receipt_mission_mismatch', 'source receipt belongs to another mission');
+    }
+    if (receipt.task_lease_id !== this.lease_id) {
+      throw authorityError('receipt_lease_mismatch', 'source receipt belongs to another task lease');
+    }
+
+    const parents = [...new Set(from)];
+    if (parents.length === 0) {
+      throw authorityError('parent_fact_required', 'derived authority must descend from at least one existing task authority fact');
+    }
+    for (const parentId of parents) {
+      if (!this.facts.has(parentId)) throw authorityError('parent_fact_missing', `authority fact ${parentId} does not exist`);
+    }
+
+    verifyExecutionEvidence({ receipt, output, evidence });
+    const extraction = runAuthorityExtractor({ extractor, receipt, output });
+    const value = resolveEvidenceSelector(output, extraction.selector);
+
+    const fact = {
+      fact_id,
+      kind,
+      value,
+      provenance: {
+        type: 'derived',
+        derivation_mode: 'execution-evidence-v1',
+        from: parents,
+        task_lease_id: this.lease_id,
+        receipt_id: receipt.receipt_id,
+        receipt_hash: receipt.receipt_hash,
+        source_service: receipt.service,
+        source_action: receipt.action,
+        source_request_hash: receipt.request_hash,
+        selector: extraction.selector,
+        extractor_id: extraction.extractor_id,
+        source_output_hash: evidence.output_hash,
+        execution_evidence_hash: evidence.evidence_hash
+      },
+      created_at: new Date().toISOString()
+    };
+    this.facts.set(fact_id, fact);
+    return structuredClone(fact);
+  }
+
   bind(binding) {
     const normalized = validateBinding(binding);
     this.bindings.push(normalized);