@suveren/gateway 0.19.5 → 0.20.1

package/node_modules/@hap/core/src/gatekeeper.ts

@@ -1,330 +1,174 @@
 /**
- * Gatekeeper — Stateless Verification for Bounded Execution
+ * Gatekeeper — local (Phase 1) verification for bounded execution (v0.7).
  *
- * Supports both v0.3 (frameSchema / frame_hash) and v0.4 (boundsSchema + contextSchema /
- * bounds_hash + context_hash).
- *
- * v0.3 flow (§8.6):
- *   1. Resolve profile from frame
- *   2. Recompute frame_hash
- *   3. For each required domain: find attestation, verify signature, verify frame_hash, verify TTL
- *   4. Check bounds: max → actual <= bound, enum → actual in allowed
- *   5. Return { approved } or { approved: false, errors: [...] }
- *
- * v0.4 flow:
+ * protocol.md → *Validation Steps* (Phase 1, never reaches the wire):
  *   1. Resolve profile from bounds.profile
- *   2. Recompute bounds_hash and context_hash
- *   3. For each required domain: find attestation, verify signature, verify bounds_hash + context_hash, verify TTL
- *   4. Check bounds (from boundsSchema), check context constraints (from contextSchema)
- *   5. Resolve cumulative fields, check cumulative limits
- *   6. Return { approved } or { approved: false, errors: [...] }
+ *   2. Recompute bounds_hash and scope_hash
+ *   3. For each mandate: decode, verify AS signature, verify version,
+ *      verify bounds_hash / scope_hash / profile_hash, verify expiry
+ *   4. Check actionType registry membership
+ *   5. Check per_transaction bounds and enum capability flags locally
+ *      (Enforcement Authority: this is what makes per_transaction
+ *      compromise-resistant — *Enforcement classes*)
+ *   6. Check scope constraints (enum, subset, requiredFor) locally — the AS
+ *      never sees scope plaintext, so the Gatekeeper is the sole enforcer
+ *   7. Return { approved } or { approved: false, errors: [...] }
+ *
+ * What this module deliberately does NOT do (protocol.md → *Enforcement
+ * Authority*, *Migration from v0.6* semantic change 9): enforce
+ * `cumulative_sum` / `cumulative_count` bounds. "Local cumulative
+ * enforcement is removed, not merely deprecated: a Gatekeeper MUST NOT
+ * refuse an execution on a cumulative bound from its own records" — only
+ * the Authority Server's ticket history is authoritative for a running
+ * total across every Gatekeeper exercising the bucket. v0.3/v0.4's
+ * frame-based path is retired entirely (CLAUDE.md "Decided by the owner").
  */
 
-import {
-  decodeAttestationBlob,
-  verifyAttestationSignature,
-  checkAttestationExpiry,
-  verifyFrameHash,
-  verifyBoundsHash,
-  verifyContextHash,
-  isV4Attestation,
-} from './attestation';
-import { computeFrameHash, computeBoundsHash, computeContextHash } from './frame';
+import { decodeMandateBlob, verifyMandateSignature, checkMandateExpiry, validateMandateOwners } from './mandate';
+import { canonicalBounds, canonicalScope, computeBoundsHash, computeScopeHash, CanonicalValueError } from './frame';
+import { computeProfileHash } from './profile';
 import { getProfile } from './profiles';
+import { HapError, type HapErrorCode } from './errors';
+import { PROTOCOL_VERSION } from './versions';
 import type {
   GatekeeperRequest,
   GatekeeperResult,
   GatekeeperError,
   AgentProfile,
   AgentBoundsParams,
-  AgentContextParams,
-  ExecutionLogQuery,
-  CumulativeFieldDef,
+  AgentScopeParams,
+  MandatePayload,
+  Mandate,
   ProfileBoundsField,
-  BoundType,
 } from './types';
 
+/** Options for {@link verify}. */
+export interface VerifyOptions {
+  /** Restricts mandate-signature verification to these Authority Server
+   * DIDs — protocol.md → *Ticket Verification* step 1 applies identically
+   * to mandates: "a verifier MUST reject a [...] whose issuer it does not
+   * trust." Omitted → any issuer that resolves a valid did:key is accepted
+   * (appropriate for a Gatekeeper that has not yet pinned an AS). */
+  trustedIssuers?: readonly string[];
+  now?: number;
+}
+
 /**
- * Verify an execution request against attested authorization.
+ * Verify an execution request against the mandates supplied.
  *
- * For v0.4 profiles (have boundsSchema), the `frame` param is interpreted as `bounds`,
- * and the optional `context` param is used for the context hash check.
- *
- * For v0.3 profiles (have frameSchema only), existing logic is used unchanged.
- *
- * @param request - The frame/bounds, attestations, execution values, and optional context
- * @param publicKeyHex - The SP's public key in hex (cached locally by MCP server)
- * @param now - Current timestamp in seconds (for testing)
- * @param executionLog - Optional execution log for resolving cumulative fields
+ * @param request bounds, mandate blobs, execution values, and optional scope
  */
-export async function verify(
-  request: GatekeeperRequest,
-  publicKeyHex: string,
-  now: number = Math.floor(Date.now() / 1000),
-  executionLog?: ExecutionLogQuery,
-): Promise<GatekeeperResult> {
-  const errors: GatekeeperError[] = [];
+export async function verify(request: GatekeeperRequest, opts: VerifyOptions = {}): Promise<GatekeeperResult> {
+  const now = opts.now ?? Math.floor(Date.now() / 1000);
 
-  // 1. Resolve profile from frame/bounds
-  const profileId = request.frame.profile;
+  // 1. Resolve profile from bounds.profile.
+  const profileId = request.bounds.profile;
   if (typeof profileId !== 'string') {
-    return { approved: false, errors: [{ code: 'INVALID_PROFILE', message: 'Missing profile in frame' }] };
+    return { approved: false, errors: [{ code: 'PROFILE_NOT_FOUND', message: 'Missing profile in bounds' }] };
   }
-
   const profile = getProfile(profileId);
   if (!profile) {
-    return { approved: false, errors: [{ code: 'INVALID_PROFILE', message: `Unknown profile: ${profileId}` }] };
+    return { approved: false, errors: [{ code: 'PROFILE_NOT_FOUND', message: `Unknown profile: ${profileId}` }] };
   }
 
-  // Detect v0.4 vs v0.3 based on profile schema
-  const isV4Profile = !!profile.boundsSchema;
-
-  if (isV4Profile) {
-    return verifyV4(request, profile, publicKeyHex, now, executionLog);
-  } else {
-    return verifyV3(request, profile, publicKeyHex, now, executionLog, errors);
+  // Fail closed when there is nothing to verify. A `for` loop over an empty
+  // (or missing) mandates array runs zero times and collects zero errors —
+  // "no errors" is not the same as "verified".
+  if (!Array.isArray(request.mandates) || request.mandates.length === 0) {
+    return { approved: false, errors: [{ code: 'MALFORMED_MANDATE', message: 'No mandate supplied — nothing to verify' }] };
   }
-}
 
-/**
- * Fail closed when there is nothing to verify.
- *
- * The attestation loop below is a `for` over `request.attestations`. With an
- * empty (or missing) array it runs zero times, pushes zero errors, and control
- * falls through to the bounds check — which happily approves a call whose
- * signature, bounds_hash, and TTL were never checked. "No errors" is not the
- * same as "verified"; an absent attestation is the one case where silence must
- * read as refusal.
- */
-function noAttestationSupplied(request: GatekeeperRequest): boolean {
-  return !Array.isArray(request.attestations) || request.attestations.length === 0;
-}
+  // 2. Recompute bounds_hash and scope_hash from what the caller holds.
+  const bounds = request.bounds as AgentBoundsParams;
+  const scope: AgentScopeParams | undefined = request.scope;
 
-/** Built fresh per call so a caller cannot mutate a shared error array. */
-function noAttestationResult(): GatekeeperResult {
-  return {
-    approved: false,
-    errors: [{ code: 'MALFORMED_ATTESTATION', message: 'No attestation supplied — nothing to verify' }],
-  };
-}
-
-// ─── v0.3 Verification ────────────────────────────────────────────────────────
-
-async function verifyV3(
-  request: GatekeeperRequest,
-  profile: AgentProfile,
-  publicKeyHex: string,
-  now: number,
-  executionLog: ExecutionLogQuery | undefined,
-  errors: GatekeeperError[],
-): Promise<GatekeeperResult> {
-  if (noAttestationSupplied(request)) return noAttestationResult();
-
-  let expectedFrameHash: string;
+  let expectedBoundsHash: string;
   try {
-    expectedFrameHash = computeFrameHash(request.frame, profile);
+    expectedBoundsHash = computeBoundsHash(bounds, profile);
   } catch (err) {
-    return { approved: false, errors: [{ code: 'FRAME_MISMATCH', message: `Frame hash computation failed: ${err}` }] };
-  }
-
-  // Verify attestations (domains come from SP group config in v0.4, not from profile)
-  const requiredDomains: string[] = [];
-  const coveredDomains = new Set<string>();
-
-  for (const blob of request.attestations) {
-    let attestation;
-    try {
-      attestation = decodeAttestationBlob(blob);
-    } catch {
-      errors.push({ code: 'MALFORMED_ATTESTATION', message: 'Failed to decode attestation blob' });
-      continue;
-    }
-
-    try {
-      await verifyAttestationSignature(attestation, publicKeyHex);
-    } catch {
-      errors.push({ code: 'INVALID_SIGNATURE', message: 'Attestation signature verification failed' });
-      continue;
-    }
-
-    try {
-      verifyFrameHash(attestation, expectedFrameHash);
-    } catch {
-      errors.push({ code: 'FRAME_MISMATCH', message: 'Attestation frame_hash does not match computed frame_hash' });
-      continue;
+    if (err instanceof CanonicalValueError) {
+      return { approved: false, errors: [{ code: err.code, field: err.field, message: err.message }] };
     }
+    return { approved: false, errors: [{ code: 'BOUNDS_HASH_MISMATCH', message: `Bounds hash computation failed: ${err}` }] };
+  }
 
+  // Scope hash is only recomputed when scope is explicitly provided. Scope
+  // CONSTRAINTS (enum/subset/requiredFor) are always enforced below against
+  // whatever scope and execution values the caller supplies; this is a
+  // separate, stricter hash-identity check against the held mandate.
+  let expectedScopeHash: string | undefined;
+  if (scope && Object.keys(scope).length > 0) {
     try {
-      checkAttestationExpiry(attestation.payload, now);
-    } catch {
-      const domainNames = (attestation.payload.resolved_domains ?? []).map(d => d.domain).join(', ');
-      errors.push({ code: 'TTL_EXPIRED', message: `Attestation for domain "${domainNames}" has expired` });
-      continue;
-    }
-
-    for (const rd of attestation.payload.resolved_domains ?? []) {
-      coveredDomains.add(rd.domain);
+      expectedScopeHash = computeScopeHash(scope, profile);
+    } catch (err) {
+      if (err instanceof CanonicalValueError) {
+        return { approved: false, errors: [{ code: err.code, field: err.field, message: err.message }] };
+      }
+      return { approved: false, errors: [{ code: 'SCOPE_HASH_MISMATCH', message: `Scope hash computation failed: ${err}` }] };
     }
   }
 
-  for (const domain of requiredDomains) {
-    if (!coveredDomains.has(domain)) {
-      errors.push({ code: 'DOMAIN_NOT_COVERED', message: `Required domain "${domain}" not covered by any valid attestation` });
-    }
-  }
+  const expectedProfileHash = computeProfileHash(profile);
 
+  // 3. Verify every mandate blob.
+  const errors: GatekeeperError[] = [];
+  for (const blob of request.mandates) {
+    const mandateErrors = await verifyOneMandate(blob, {
+      expectedBoundsHash,
+      expectedScopeHash,
+      expectedProfileHash,
+      trustedIssuers: opts.trustedIssuers,
+      now,
+    });
+    errors.push(...mandateErrors);
+  }
   if (errors.length > 0) {
     return { approved: false, errors };
   }
 
-  // Resolve cumulative fields
-  if (executionLog && profile.executionContextSchema?.fields) {
-    const cumulativeErrors = resolveCumulativeFields(request, profile, executionLog, now);
-    if (cumulativeErrors.length > 0) {
-      return { approved: false, errors: cumulativeErrors };
+  // 4. actionType registry membership — checked before any bound is read
+  // (protocol.md → required-refusals vector "no-action-type": "Checked
+  // before any bound is read").
+  const actionType = typeof request.execution.action_type === 'string' ? request.execution.action_type : undefined;
+  const registry = profile.boundsSchema?.actionTypes;
+  if (registry && registry.length > 0) {
+    if (actionType === undefined || !registry.includes(actionType)) {
+      return {
+        approved: false,
+        errors: [{
+          code: 'INVALID_ACTION_TYPE',
+          field: 'action_type',
+          message: `action_type ${JSON.stringify(actionType)} is not in profile ${profile.id}'s actionTypes registry [${registry.join(', ')}]`,
+        }],
+      };
     }
   }
 
-  // Check bounds using frameSchema
-  const boundsErrors = checkBoundsFromFrameSchema(request, profile);
+  // 5. per_transaction bounds and enum capability flags, locally.
+  const boundsErrors = checkBounds(request, profile, actionType);
   if (boundsErrors.length > 0) {
     return { approved: false, errors: boundsErrors };
   }
 
-  return { approved: true };
-}
-
-// ─── v0.4 Verification ────────────────────────────────────────────────────────
-
-async function verifyV4(
-  request: GatekeeperRequest,
-  profile: AgentProfile,
-  publicKeyHex: string,
-  now: number,
-  executionLog: ExecutionLogQuery | undefined,
-): Promise<GatekeeperResult> {
-  if (noAttestationSupplied(request)) return noAttestationResult();
-
-  const errors: GatekeeperError[] = [];
-
-  // In v0.4 the `frame` param carries bounds; `context` carries context params
-  const bounds = request.frame as AgentBoundsParams;
-  const context: AgentContextParams | undefined = request.context;
-
-  // Compute expected hashes
-  let expectedBoundsHash: string;
-  let expectedContextHash: string | undefined;
-
-  try {
-    expectedBoundsHash = computeBoundsHash(bounds, profile);
-  } catch (err) {
-    return { approved: false, errors: [{ code: 'BOUNDS_MISMATCH', message: `Bounds hash computation failed: ${err}` }] };
-  }
-
-  // Context hash is only computed when context is explicitly provided.
-  // At execution time, context is not re-verified — it was checked at authorization time.
-  if (context && Object.keys(context).length > 0) {
-    try {
-      expectedContextHash = computeContextHash(context, profile);
-    } catch (err) {
-      return { approved: false, errors: [{ code: 'CONTEXT_MISMATCH', message: `Context hash computation failed: ${err}` }] };
-    }
-  }
-
-  // Verify attestations (domains come from SP group config, not profile)
-  const requiredDomains: string[] = [];
-  const coveredDomains = new Set<string>();
-
-  for (const blob of request.attestations) {
-    let attestation;
-    try {
-      attestation = decodeAttestationBlob(blob);
-    } catch {
-      errors.push({ code: 'MALFORMED_ATTESTATION', message: 'Failed to decode attestation blob' });
-      continue;
-    }
-
-    try {
-      await verifyAttestationSignature(attestation, publicKeyHex);
-    } catch {
-      errors.push({ code: 'INVALID_SIGNATURE', message: 'Attestation signature verification failed' });
-      continue;
-    }
-
-    // Verify bounds hash
-    try {
-      verifyBoundsHash(attestation, expectedBoundsHash);
-    } catch {
-      errors.push({ code: 'BOUNDS_MISMATCH', message: 'Attestation bounds_hash does not match computed bounds_hash' });
-      continue;
-    }
-
-    // Verify context hash (only when context was provided and hash was computed)
-    if (isV4Attestation(attestation) && expectedContextHash) {
-      try {
-        verifyContextHash(attestation, expectedContextHash);
-      } catch {
-        errors.push({ code: 'CONTEXT_MISMATCH', message: 'Attestation context_hash does not match computed context_hash' });
-        continue;
-      }
-    }
-
-    try {
-      checkAttestationExpiry(attestation.payload, now);
-    } catch {
-      const domainNames = (attestation.payload.resolved_domains ?? []).map(d => d.domain).join(', ');
-      errors.push({ code: 'TTL_EXPIRED', message: `Attestation for domain "${domainNames}" has expired` });
-      continue;
-    }
-
-    for (const rd of attestation.payload.resolved_domains ?? []) {
-      coveredDomains.add(rd.domain);
-    }
-  }
-
-  for (const domain of requiredDomains) {
-    if (!coveredDomains.has(domain)) {
-      errors.push({ code: 'DOMAIN_NOT_COVERED', message: `Required domain "${domain}" not covered by any valid attestation` });
-    }
-  }
-
-  if (errors.length > 0) {
-    return { approved: false, errors };
-  }
-
-  // v0.4 bounds check — single pass that dispatches on each field's
-  // boundType.kind. Replaces the two-pass (resolveCumulativeFields +
-  // checkBoundsFromBoundsSchema) approach, which used name-pattern
-  // heuristics and silently failed when ctx field names didn't round-trip
-  // through `${fieldName}_max`.
-  const v4BoundsErrors = checkBoundsV4(request, profile, executionLog, now);
-  if (v4BoundsErrors.length > 0) {
-    return { approved: false, errors: v4BoundsErrors };
-  }
-
-  // Check context constraints using contextSchema.
-  // Fail closed: if the profile declares enforceable context constraints but
-  // no declared context was supplied, reject — the SP cannot enforce these
-  // (it only holds context_hash), so skipping the check would silently
-  // bypass scope restrictions like allowed_recipients / allowed_domains.
-  if (profile.contextSchema && Object.keys(profile.contextSchema.fields).length > 0) {
-    const enforceableFields = Object.entries(profile.contextSchema.fields)
+  // 6. Scope constraints — the sole enforcer, since the AS only ever holds scope_hash.
+  if (profile.scopeSchema && Object.keys(profile.scopeSchema.fields).length > 0) {
+    const enforceableFields = Object.entries(profile.scopeSchema.fields)
       .filter(([, def]) => def.constraint?.enforceable?.length);
 
-    if (enforceableFields.length > 0 && !context) {
+    if (enforceableFields.length > 0 && !scope) {
       return {
         approved: false,
         errors: [{
           code: 'BOUND_EXCEEDED',
-          message: `Declared context required for constraint enforcement but not provided. Fields: ${enforceableFields.map(([n]) => n).join(', ')}`,
+          message: `Declared scope required for constraint enforcement but not provided. Fields: ${enforceableFields.map(([n]) => n).join(', ')}`,
         }],
       };
     }
 
-    if (context) {
-      const contextErrors = checkContextConstraints(context, request.execution, profile);
-      if (contextErrors.length > 0) {
-        return { approved: false, errors: contextErrors };
+    if (scope) {
+      const scopeErrors = checkScopeConstraints(scope, request.execution, profile);
+      if (scopeErrors.length > 0) {
+        return { approved: false, errors: scopeErrors };
       }
     }
   }
@@ -332,158 +176,84 @@ async function verifyV4(
   return { approved: true };
 }
 
-// ─── Bounds Checking ─────────────────────────────────────────────────────────
-
-/**
- * Check execution values against authorization frame bounds (v0.3).
- * Uses the profile's frameSchema constraint definitions.
- */
-function checkBoundsFromFrameSchema(request: GatekeeperRequest, profile: AgentProfile): GatekeeperError[] {
-  const errors: GatekeeperError[] = [];
-
-  if (!profile.frameSchema) return errors;
+// ─── Mandate Verification ────────────────────────────────────────────────────
 
-  for (const [fieldName, fieldDef] of Object.entries(profile.frameSchema.fields)) {
-    if (!fieldDef.constraint) continue;
-
-    const constraint = fieldDef.constraint;
-
-    for (const enforceType of constraint.enforceable) {
-      if (enforceType === 'max') {
-        const execField = fieldName.replace(/_max$/, '');
-        const boundValue = request.frame[fieldName];
-        const actualValue = request.execution[execField];
+interface MandateCheckOptions {
+  expectedBoundsHash: string;
+  expectedScopeHash: string | undefined;
+  expectedProfileHash: string;
+  trustedIssuers: readonly string[] | undefined;
+  now: number;
+}
 
-        if (actualValue === undefined) continue;
+/** The canonical code a thrown value names, from a {@link HapError} or from
+ * this package's `"CODE: message"` convention (mandate.ts, ticket.ts). */
+function codeFromThrown(err: unknown): HapErrorCode {
+  if (err instanceof HapError) return err.code;
+  if (err instanceof Error) {
+    const [prefix] = err.message.split(':');
+    return prefix as HapErrorCode;
+  }
+  return 'MALFORMED_MANDATE';
+}
 
-        if (typeof boundValue !== 'number' || typeof actualValue !== 'number') {
-          errors.push({
-            code: 'BOUND_EXCEEDED',
-            field: execField,
-            message: `Bound check requires numeric values for "${execField}"`,
-            bound: boundValue,
-            actual: actualValue,
-          });
-          continue;
-        }
+async function verifyOneMandate(blob: string, opts: MandateCheckOptions): Promise<GatekeeperError[]> {
+  let mandate: Mandate;
+  try {
+    mandate = decodeMandateBlob(blob);
+  } catch (err) {
+    return [{ code: 'MALFORMED_MANDATE', message: (err as Error).message }];
+  }
 
-        if (actualValue > boundValue) {
-          errors.push({
-            code: 'BOUND_EXCEEDED',
-            field: execField,
-            message: `Value ${actualValue} exceeds authorized maximum of ${boundValue}`,
-            bound: boundValue,
-            actual: actualValue,
-          });
-        }
-      }
+  if (mandate.payload.version !== PROTOCOL_VERSION) {
+    return [{
+      code: 'VERSION_UNSUPPORTED',
+      message: `mandate version ${JSON.stringify(mandate.payload.version)} is not verifiable by this Gatekeeper (verifies ${PROTOCOL_VERSION} only)`,
+    }];
+  }
 
-      if (enforceType === 'enum') {
-        const boundValue = request.frame[fieldName];
-        const actualValue = request.execution[fieldName];
+  try {
+    await verifyMandateSignature(mandate, { trustedIssuers: opts.trustedIssuers });
+  } catch (err) {
+    return [{ code: codeFromThrown(err), message: (err as Error).message }];
+  }
 
-        if (actualValue === undefined) continue;
+  try {
+    checkMandateExpiry(mandate.payload, opts.now);
+  } catch (err) {
+    return [{ code: codeFromThrown(err), message: (err as Error).message }];
+  }
 
-        const allowed = typeof boundValue === 'string'
-          ? boundValue.split(',').map(s => s.trim())
-          : [String(boundValue)];
+  try {
+    validateMandateOwners(mandate.payload);
+  } catch (err) {
+    return [{ code: codeFromThrown(err), message: (err as Error).message }];
+  }
 
-        const actualStr = String(actualValue);
+  const errors: GatekeeperError[] = [];
+  const payload: MandatePayload = mandate.payload;
 
-        if (!allowed.includes(actualStr)) {
-          errors.push({
-            code: 'BOUND_EXCEEDED',
-            field: fieldName,
-            message: `Value "${actualStr}" not in authorized values [${allowed.join(', ')}]`,
-            bound: boundValue,
-            actual: actualValue,
-          });
-        }
-      }
-    }
+  if (payload.bounds_hash !== opts.expectedBoundsHash) {
+    errors.push({ code: 'BOUNDS_HASH_MISMATCH', message: 'Mandate bounds_hash does not match the recomputed bounds_hash' });
+  }
+  if (opts.expectedScopeHash !== undefined && payload.scope_hash !== opts.expectedScopeHash) {
+    errors.push({ code: 'SCOPE_HASH_MISMATCH', message: 'Mandate scope_hash does not match the recomputed scope_hash' });
+  }
+  if (payload.profile_hash !== opts.expectedProfileHash) {
+    errors.push({ code: 'PROFILE_HASH_MISMATCH', message: 'Mandate profile_hash does not match the Gatekeeper\'s provisioned profile bytes' });
   }
 
   return errors;
 }
 
-/**
- * v0.4 bounds enforcement — dispatches on each bound field's declared
- * `boundType.kind` with no name-pattern heuristics. This is the single
- * source of truth for client-side bounds checking in v0.4.
- *
- * Why this replaces the old two-function approach:
- *
- *   checkBoundsFromBoundsSchema (old) stripped "_max" from the bound name
- *   to guess the execution context field, which required a fixed naming
- *   convention (e.g., "amount_max" → "amount"). Profiles that used other
- *   conventions silently failed to enforce.
- *
- *   resolveCumulativeFields (old) appended "_max" to the cumulative
- *   execution context field name to find its corresponding bound, which
- *   required ANOTHER fixed naming convention (e.g., "amount_daily" →
- *   "amount_daily_max"). Profiles where the ctx field added a "_count_"
- *   infix (write_count_daily → write_daily_max, not
- *   write_count_daily_max) silently failed too.
- *
- * The new function ignores ctx field names entirely and reads
- * enforcement semantics from `fieldDef.boundType`:
- *
- *   per_transaction  — compares `execution[of] <= bound`
- *   cumulative_sum   — sumByWindow(of, window) + execution[of] <= bound
- *   cumulative_count — sumByWindow('_count', window) + 1 <= bound
- *   enum             — bound value must be in the allowed set (attest-time
- *                      validation; not an execution-time check)
- */
-/**
- * Does this bound govern the action being attempted?
- *
- * Cumulative totals are scoped by (profileId, path) only, so without this every
- * cumulative_count bound on a profile sees the same running count. On customers
- * — which declares both write_daily_max and delete_daily_max — the smaller
- * delete limit would count writes and block them.
- *
- * Preferred answer is the profile's declared `appliesTo`. Absent that, fall back
- * to the field-name convention (`delete_daily_max` → `delete`), matching how the
- * Authority Server selects bounds so the two enforcement points cannot disagree.
- *
- * Fails CLOSED: when the action type is unknown, or the bound's name implies no
- * particular action, the bound is enforced.
- */
-function boundGovernsAction(
-  fieldName: string,
-  fieldDef: ProfileBoundsField,
-  bt: BoundType,
-  actionType: string | undefined,
-): boolean {
-  if (fieldDef.appliesTo) {
-    return actionType ? fieldDef.appliesTo.includes(actionType) : true;
-  }
-
-  // The name convention only ever disambiguated count bounds; sums are governed
-  // by their `of` field and stay unfiltered, as at the Authority Server.
-  if (bt.kind !== 'cumulative_count' || !actionType) return true;
-
-  const prefix = fieldName.replace(/_(?:daily|monthly|weekly)_max$/, '');
-  const namedForAnAction = prefix !== fieldName;
-  const matches = prefix === actionType || prefix.startsWith('transaction');
-  return !namedForAnAction || matches;
-}
+// ─── Bounds Checking (per_transaction, enum) ─────────────────────────────────
 
 /**
- * Which action types' executions count toward this cumulative bound's running
- * total. `undefined` means all of them.
- *
- * `boundGovernsAction` decides whether a bound applies to the current call; this
- * decides what the bound's total is made of. Both are needed: selecting the right
- * bound and then feeding it the profile's combined total is still wrong — sales'
- * "orders per day" was checked only on orders, but counted every quote and send.
- * Consumption is partitioned by action type (*Cumulative Tracking* rule 4), as
- * the Authority Server already does.
- *
- * Same answer, same order of preference as `boundGovernsAction`: the declared
- * `appliesTo`; else, for a count bound named for an action (`delete_daily_max`),
- * that action; else every action type. Exported so display surfaces report the
- * same totals the gate enforces.
+ * Which action types' executions count toward this cumulative bound's
+ * running total — `undefined` means all of them. Display-only now that
+ * local cumulative enforcement is removed (protocol.md → *Enforcement
+ * Authority*: cumulative bounds are AS-only). Exported so a gateway's own
+ * usage display partitions totals the same way the Authority Server does.
  */
 export function boundActionTypes(
   fieldName: string,
@@ -499,69 +269,56 @@ export function boundActionTypes(
   return [prefix];
 }
 
-function checkBoundsV4(
+/**
+ * Local bounds enforcement — `per_transaction` and `enum` only.
+ * `cumulative_sum` / `cumulative_count` fields are skipped entirely: they
+ * are AS-only (*Enforcement Authority*), and the Gatekeeper's own
+ * (incomplete, single-Gatekeeper) history is not authoritative for them.
+ */
+function checkBounds(
   request: GatekeeperRequest,
   profile: AgentProfile,
-  executionLog: ExecutionLogQuery | undefined,
-  now: number,
+  actionType: string | undefined,
 ): GatekeeperError[] {
   const errors: GatekeeperError[] = [];
   if (!profile.boundsSchema) return errors;
 
-  const bounds = request.frame as AgentBoundsParams;
-  const profileId = String(bounds.profile ?? profile.id);
-  const actionType = typeof request.execution.action_type === 'string'
-    ? request.execution.action_type
-    : undefined;
-  // Prefer the explicit request path. `frame.path` is retained only as a
-  // fallback for callers that legitimately declare `path` in their profile's
-  // boundsSchema; for every shipped profile it is absent, which is exactly why
-  // this silently resolved to "" and disabled the cumulative gate entirely.
-  const path = request.path ?? (bounds.path ? String(bounds.path) : '');
+  const bounds = request.bounds as AgentBoundsParams;
 
   for (const [fieldName, fieldDef] of Object.entries(profile.boundsSchema.fields)) {
-    if (fieldName === 'profile' || fieldName === 'path') continue;
+    if (fieldName === 'profile') continue;
 
     const boundValue = bounds[fieldName];
     if (boundValue === undefined) continue;
 
     const bt = fieldDef.boundType;
     if (!bt) {
-      // v0.4 requires boundType on every non-metadata bound field. A
-      // missing boundType is a profile authoring bug — fail closed on
-      // enforcement rather than silently skipping (which is what caused
-      // the write_daily_max display bug in the first place).
+      // A missing boundType is a profile authoring bug — fail closed on
+      // enforcement rather than silently skipping.
       errors.push({
-        code: 'BOUND_EXCEEDED',
+        code: 'PROFILE_INVALID',
         field: fieldName,
-        message: `Profile ${profile.id} bound "${fieldName}" has no boundType — enforcement semantics undefined. Add boundType to the profile's boundsSchema.`,
+        message: `Profile ${profile.id} bound "${fieldName}" has no boundType — enforcement semantics undefined.`,
         bound: boundValue,
         actual: boundValue,
       });
       continue;
     }
 
-    if (!boundGovernsAction(fieldName, fieldDef, bt, actionType)) continue;
-
     switch (bt.kind) {
       case 'per_transaction': {
         const actual = request.execution[bt.of];
 
         // `requiredFor`: for a listed action_type, absence (or a non-numeric
-        // value) is a denial, not a skip — see BoundType.per_transaction's
-        // doc comment for why. Unlisted action types, or no `requiredFor` at
-        // all, keep the pre-existing skip-on-absence behaviour below.
+        // value) is a denial, not a skip. Unlisted action types, or no
+        // `requiredFor` at all, keep skip-on-absence behaviour below.
         const engaged = !!bt.requiredFor?.length
           && actionType !== undefined
           && bt.requiredFor.includes(actionType);
 
         if (engaged) {
-          // `null` is treated as "missing", not as the number 0 — JSON has no
-          // undefined, so a value lost somewhere upstream (an unmapped
-          // connector field serialized through JSON) commonly arrives as
-          // null. `Number(null) === 0` would otherwise read as "an amount of
-          // zero was declared and is within bound", which is the exact
-          // silent-pass this feature exists to close.
+          // `null` is "missing", not the number 0 — a value lost upstream
+          // must not silently read as "amount 0, within bound".
           const missing = actual === undefined || actual === null;
           const numericActual = missing ? NaN : (typeof actual === 'number' ? actual : Number(actual));
           const missingOrNonNumeric = missing || Number.isNaN(numericActual);
@@ -606,76 +363,11 @@ function checkBoundsV4(
         break;
       }
 
-      case 'cumulative_sum': {
-        if (typeof boundValue !== 'number') {
-          errors.push({
-            code: 'CUMULATIVE_LIMIT_EXCEEDED',
-            field: bt.of,
-            message: `Cumulative bound "${fieldName}" must be numeric`,
-            bound: boundValue,
-            actual: 0,
-          });
-          break;
-        }
-        if (!executionLog) break;
-
-        const runningTotal = executionLog.sumByWindow(
-          profileId, path, bt.of, bt.window, now, boundActionTypes(fieldName, fieldDef),
-        );
-        const currentRaw = request.execution[bt.of];
-        const current = typeof currentRaw === 'number'
-          ? currentRaw
-          : (currentRaw !== undefined ? Number(currentRaw) : 0);
-        const total = runningTotal + current;
-
-        if (total > boundValue) {
-          errors.push({
-            code: 'CUMULATIVE_LIMIT_EXCEEDED',
-            field: bt.of,
-            message: `Cumulative ${bt.window} sum of ${bt.of} (${total}) exceeds limit of ${boundValue} for ${fieldName}`,
-            bound: boundValue,
-            actual: total,
-          });
-        }
-        break;
-      }
-
-      case 'cumulative_count': {
-        if (typeof boundValue !== 'number') {
-          errors.push({
-            code: 'CUMULATIVE_LIMIT_EXCEEDED',
-            field: fieldName,
-            message: `Cumulative count bound "${fieldName}" must be numeric`,
-            bound: boundValue,
-            actual: 0,
-          });
-          break;
-        }
-        if (!executionLog) break;
-
-        const runningCount = executionLog.sumByWindow(
-          profileId, path, '_count', bt.window, now, boundActionTypes(fieldName, fieldDef),
-        );
-        const total = runningCount + 1;
-
-        if (total > boundValue) {
-          errors.push({
-            code: 'CUMULATIVE_LIMIT_EXCEEDED',
-            field: fieldName,
-            message: `Cumulative ${bt.window} count (${total}) exceeds limit of ${boundValue} for ${fieldName}`,
-            bound: boundValue,
-            actual: total,
-          });
-        }
-        break;
-      }
-
       case 'enum': {
-        // Enum bounds are capability flags. The stored bound value must
-        // be in the allowed set (a profile authoring check, really
-        // belongs at attestation time). They are NOT compared against
-        // runtime execution here — tool-proxy gates tool calls against
-        // the manifest's required value before they reach the gatekeeper.
+        // Enum bounds are capability flags, validated at mandate time. They
+        // are NOT compared against runtime execution here — tool-proxy gates
+        // tool calls against the manifest's required value before they
+        // reach the Gatekeeper.
         if (typeof boundValue === 'string' && !bt.values.includes(boundValue)) {
           errors.push({
             code: 'BOUND_EXCEEDED',
@@ -687,37 +379,43 @@ function checkBoundsV4(
         }
         break;
       }
+
+      case 'cumulative_sum':
+      case 'cumulative_count':
+        // AS-only (protocol.md → *Enforcement Authority*). A Gatekeeper
+        // MUST NOT refuse on these from its own records.
+        break;
     }
   }
 
   return errors;
 }
 
+// ─── Scope Constraints ───────────────────────────────────────────────────────
+
 /**
- * Check context param values against contextSchema enum constraints (v0.4).
- * Context enum fields constrain the allowed values in execution.
+ * Check scope param values against scopeSchema enum/subset constraints.
+ * Scope enum fields constrain the allowed values in execution.
  */
-function checkContextConstraints(
-  context: AgentContextParams,
+function checkScopeConstraints(
+  scope: AgentScopeParams,
   execution: Record<string, string | number>,
   profile: AgentProfile,
 ): GatekeeperError[] {
   const errors: GatekeeperError[] = [];
 
-  if (!profile.contextSchema) return errors;
+  if (!profile.scopeSchema) return errors;
 
-  for (const [fieldName, fieldDef] of Object.entries(profile.contextSchema.fields)) {
+  for (const [fieldName, fieldDef] of Object.entries(profile.scopeSchema.fields)) {
     if (!fieldDef.constraint) continue;
 
-    // A constrained dimension that the call does not expose cannot be checked.
-    // Skipping is only safe when the action does not engage that dimension —
-    // deleting a draft has no recipients. When it DOES engage it, silence must
-    // not read as compliance: an absent value means the Gatekeeper cannot show
-    // the call is in scope, and an unverifiable send is exactly what the scope
-    // exists to prevent. The profile declares which actions engage the field.
+    // A constrained dimension that the call does not expose cannot be
+    // checked. Skipping is only safe when the action does not engage that
+    // dimension — deleting a draft has no recipients. When it DOES engage
+    // it, silence must not read as compliance.
     const requiredFor = fieldDef.constraint.requiredFor;
     if (requiredFor?.length) {
-      const boundValue = context[fieldName];
+      const boundValue = scope[fieldName];
       const actualValue = execution[fieldName];
       const actionType = execution['action_type'];
       const constrained = boundValue !== undefined && boundValue !== '';
@@ -739,8 +437,7 @@ function checkContextConstraints(
 
     for (const enforceType of fieldDef.constraint.enforceable) {
       if (enforceType === 'enum') {
-        // The context field value is the allowed value; execution must match
-        const boundValue = context[fieldName];
+        const boundValue = scope[fieldName];
         const actualValue = execution[fieldName];
 
         if (actualValue === undefined) continue;
@@ -755,7 +452,7 @@ function checkContextConstraints(
           errors.push({
             code: 'BOUND_EXCEEDED',
             field: fieldName,
-            message: `Value "${actualStr}" not in authorized context values [${allowed.join(', ')}]`,
+            message: `Value "${actualStr}" not in authorized scope values [${allowed.join(', ')}]`,
             bound: boundValue,
             actual: actualValue,
           });
@@ -763,7 +460,7 @@ function checkContextConstraints(
       }
 
       if (enforceType === 'subset') {
-        const boundValue = context[fieldName];
+        const boundValue = scope[fieldName];
         const actualValue = execution[fieldName];
 
         if (boundValue === undefined || boundValue === '') continue;
@@ -788,81 +485,3 @@ function checkContextConstraints(
 
   return errors;
 }
-
-// ─── Cumulative Fields ────────────────────────────────────────────────────────
-
-/**
- * Resolve cumulative fields by querying the execution log, then check their bounds.
- *
- * For each cumulative field in the execution context schema:
- * 1. Query the execution log for the running total within the window
- * 2. Add the current call's contribution (field value or +1 for _count)
- * 3. Inject the resolved value into request.execution
- * 4. Check against the corresponding bounds field (fieldName + "_max")
- */
-function resolveCumulativeFields(
-  request: GatekeeperRequest,
-  profile: AgentProfile,
-  executionLog: ExecutionLogQuery,
-  now: number,
-): GatekeeperError[] {
-  const errors: GatekeeperError[] = [];
-
-  // Profile ID comes from bounds (v0.4) or frame (v0.3)
-  const profileId = String(request.frame.profile);
-
-  // For v0.4, the bounds source (request.frame) holds the cumulative max fields
-  const boundsOrFrame = request.frame;
-
-  for (const [fieldName, fieldDef] of Object.entries(profile.executionContextSchema.fields)) {
-    if (fieldDef.source !== 'cumulative') continue;
-
-    const cumDef = fieldDef as CumulativeFieldDef;
-    const { cumulativeField, window: windowType } = cumDef;
-
-    const path = request.frame.path ? String(request.frame.path) : '';
-    const runningTotal = executionLog.sumByWindow(profileId, path, cumulativeField, windowType, now);
-
-    let currentContribution: number;
-    if (cumulativeField === '_count') {
-      currentContribution = 1;
-    } else {
-      const val = request.execution[cumulativeField];
-      currentContribution = typeof val === 'number' ? val : (val !== undefined ? Number(val) : 0);
-    }
-
-    const cumulativeValue = runningTotal + currentContribution;
-
-    // Inject resolved value into execution for downstream inspection
-    request.execution[fieldName] = cumulativeValue;
-
-    // Check against bound — convention: cumulative field "X_daily" → bound "X_daily_max"
-    const boundFieldName = fieldName + '_max';
-    const boundValue = boundsOrFrame[boundFieldName];
-
-    if (boundValue === undefined) continue;
-
-    if (typeof boundValue !== 'number') {
-      errors.push({
-        code: 'CUMULATIVE_LIMIT_EXCEEDED',
-        field: fieldName,
-        message: `Cumulative bound requires numeric value for "${boundFieldName}"`,
-        bound: boundValue,
-        actual: cumulativeValue,
-      });
-      continue;
-    }
-
-    if (cumulativeValue > boundValue) {
-      errors.push({
-        code: 'CUMULATIVE_LIMIT_EXCEEDED',
-        field: fieldName,
-        message: `Cumulative ${windowType} value ${cumulativeValue} exceeds limit of ${boundValue}`,
-        bound: boundValue,
-        actual: cumulativeValue,
-      });
-    }
-  }
-
-  return errors;
-}