@suveren/gateway 0.19.5 → 0.20.1

package/dist/mcp-server/http.mjs

@@ -16,6 +16,7 @@ import {
   fingerprintOf,
   formatDateTime,
   glossaryUsage,
+  issuerFromPublicKeyHex,
   mandateFields,
   parseCaseAttrs,
   parseElements,
@@ -30,7 +31,7 @@ import {
   sanitizeReport,
   suggestedFilename,
   ticketFields
-} from "./chunk-ZRRZFGRL.mjs";
+} from "./chunk-APIQIEUA.mjs";
 
 // bin/http.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -848,20 +849,40 @@ var SPClient = class {
     return data.publicKey;
   }
   /**
-   * Get all attestations for a frame hash.
+   * GET /api/as/compat — what this Authority Server speaks (protocol.md ->
+   * Version negotiation). Unauthenticated, so a gateway can check it at
+   * startup before any session exists (V7: fail closed when the AS does
+   * not list our protocol version among `supportedVersions`, rather than
+   * discovering it call-by-call once a tool is actually invoked).
    */
-  async getAttestations(authorizationId) {
-    const res = await this.fetch(`/api/attestations?authorization_id=${encodeURIComponent(authorizationId)}`);
-    if (!res.ok) throw new Error(`SP attestations request failed: ${res.status}`);
+  async getCompat() {
+    const res = await this.fetch("/api/as/compat");
+    if (!res.ok) throw new Error(`SP compat request failed: ${res.status}`);
     return res.json();
   }
   /**
-   * Get pending attestations for a domain.
+   * Get all mandates for an authorization id.
+   *
+   * v0.7: moved from GET /api/attestations (which now answers 410) to
+   * GET /api/mandates.
+   */
+  async getAttestations(authorizationId) {
+    const res = await this.fetch(`/api/mandates?authorization_id=${encodeURIComponent(authorizationId)}`);
+    if (!res.ok) throw new Error(`SP mandates request failed: ${res.status}`);
+    const body = await res.json();
+    return { ...body, attestations: body.mandates ?? body.attestations ?? [] };
+  }
+  /**
+   * Get pending mandates for a domain.
+   *
+   * v0.7: moved from GET /api/attestations/pending (which now answers 410)
+   * to GET /api/mandates/pending.
    */
   async getPendingAttestations(domain) {
-    const res = await this.fetch(`/api/attestations/pending?domain=${encodeURIComponent(domain)}`);
+    const res = await this.fetch(`/api/mandates/pending?domain=${encodeURIComponent(domain)}`);
     if (!res.ok) throw new Error(`SP pending request failed: ${res.status}`);
-    return res.json();
+    const data = await res.json();
+    return data.pending;
   }
   /**
    * Request a signed receipt from the SP.
@@ -890,7 +911,7 @@ var SPClient = class {
       const isLast = attempt === maxAttempts;
       let res;
       try {
-        res = await this.fetch("/api/as/receipt", { method: "POST", body });
+        res = await this.fetch("/api/as/ticket", { method: "POST", body });
       } catch (err) {
         lastError = err;
         if (isLast) throw err;
@@ -914,7 +935,7 @@ var SPClient = class {
         throw new SPReceiptError(message, res.status, respBody);
       }
       return {
-        receipt: respBody.receipt,
+        receipt: respBody.ticket,
         idempotent: respBody.idempotent === true
       };
     }
@@ -989,7 +1010,7 @@ var SPClient = class {
 };
 
 // src/lib/attestation-cache.ts
-import { decodeAttestationBlob } from "@hap/core";
+import { decodeMandateBlob } from "@hap/core";
 var AsKeyMismatchError = class extends Error {
   constructor(message) {
     super(message);
@@ -1018,6 +1039,19 @@ var AttestationCache = class {
   /** Cache of authorizations by path (e.g., "payment-routine") */
   authorizations = /* @__PURE__ */ new Map();
   lastSync = 0;
+  /**
+   * Re-approval UX (V9/item 9) — authorization ids the AS has told us, via a
+   * VERSION_UNSUPPORTED ticket refusal, carry only pre-0.7 mandate blobs.
+   * Learned lazily (only once an execution is actually attempted under
+   * them — nothing proactively re-verifies every cached blob's version),
+   * never cleared explicitly: re-approving replaces the authorization with
+   * a NEW id (the existing edit/replace ceremony), so the flagged id
+   * simply drops out of the active set on its own once revoked. In-memory
+   * only, same lifetime as the cache it annotates — a restart re-learns it
+   * on the next attempted execution, which is the gateway's only source for
+   * this fact to begin with.
+   */
+  reapprovalNeeded = /* @__PURE__ */ new Set();
   /**
    * Get the SP public key, fetching from SP if not cached or expired, then —
    * when a pin exists for this exact AS URL — verifying the live key still
@@ -1044,6 +1078,21 @@ var AttestationCache = class {
     }
     return this.spPublicKey;
   }
+  /**
+   * The pinned Authority Server, as a `did:key` — what hap-core 0.12's
+   * `verifyMandateSignature` / `verifyTicketSignature` take as
+   * `trustedIssuers` (they resolve the verification key from the artifact's
+   * OWN `issuer` DID, never from a key supplied alongside it — protocol.md ->
+   * *Ticket Verification* step 1). This derives the same did:key from the
+   * same pinned hex key {@link getPublicKey} already enforces, so a mandate
+   * or ticket whose signature verifies under a DIFFERENT key — even one that
+   * encodes a valid did:key of its own — still fails: the issuer named on the
+   * artifact must BE the pinned key, not merely resolve to some key.
+   */
+  async getTrustedIssuer() {
+    const hex = await this.getPublicKey();
+    return issuerFromPublicKeyHex(hex);
+  }
   /**
    * Get a cached authorization by path. If not cached, returns null.
    * Use syncAuthorization() to fetch from SP.
@@ -1080,7 +1129,7 @@ var AttestationCache = class {
     const firstBlob = result.attestations[0]?.blob;
     if (firstBlob) {
       try {
-        const payload = decodeAttestationBlob(firstBlob).payload;
+        const payload = decodeMandateBlob(firstBlob).payload;
         signedCommitmentMode = payload.commitment_mode;
         subjects = payload.subjects;
       } catch {
@@ -1091,7 +1140,8 @@ var AttestationCache = class {
       authorizationId: result.authorization_id,
       boundsHash: result.bounds_hash,
       // content fingerprint (undefined for pre-v0.4 records)
-      contextHash: result.context_hash,
+      contextHash: result.scope_hash,
+      // v0.7: wire field renamed context_hash -> scope_hash
       profileId: result.profile_id,
       path: result.profile_id,
       frame: bounds,
@@ -1148,6 +1198,15 @@ var AttestationCache = class {
   invalidate(path) {
     this.authorizations.delete(path);
   }
+  /** Flag an authorization as needing re-approval (V9/item 9) — see
+   *  {@link reapprovalNeeded}'s doc comment. */
+  markNeedsReapproval(authorizationId) {
+    this.reapprovalNeeded.add(authorizationId);
+  }
+  /** Whether this authorization was flagged by {@link markNeedsReapproval}. */
+  needsReapproval(authorizationId) {
+    return this.reapprovalNeeded.has(authorizationId);
+  }
 };
 
 // src/lib/gate-store.ts
@@ -1640,6 +1699,12 @@ import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, writeFileSync a
 import { homedir as homedir4 } from "os";
 import { dirname as dirname5, join as join7 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
+var ArchiveWriteError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ArchiveWriteError";
+  }
+};
 var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join7(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
@@ -2030,7 +2095,7 @@ var MCPGatekeeper = class {
         result: {
           approved: false,
           errors: [{
-            code: "DOMAIN_NOT_COVERED",
+            code: "MANDATE_NOT_FOUND",
             message: `No active authorization for "${authorizationPath}". A decision owner must grant authority via the Authority UI.`
           }]
         },
@@ -2043,16 +2108,16 @@ var MCPGatekeeper = class {
         result: {
           approved: false,
           errors: [{
-            code: "DOMAIN_NOT_COVERED",
+            code: "COVERAGE_INSUFFICIENT",
             message: `Authorization "${authorizationPath}" is pending. Missing domains: ${missing.join(", ")}`
           }]
         },
         authorization: auth
       };
     }
-    let publicKeyHex;
+    let trustedIssuer;
     try {
-      publicKeyHex = await this.cache.getPublicKey();
+      trustedIssuer = await this.cache.getTrustedIssuer();
     } catch (err) {
       if (err instanceof AsKeyMismatchError) {
         void notifyControlPlane("as-key-mismatch");
@@ -2071,22 +2136,22 @@ var MCPGatekeeper = class {
       throw err;
     }
     const resolvedBounds = override?.bounds ?? auth.bounds ?? auth.frame;
-    const resolvedContext = override?.context ?? auth.context;
-    const frame = { ...resolvedBounds, profile: auth.profileId };
+    const resolvedScope = override?.context ?? auth.context;
+    const bounds = { ...resolvedBounds, profile: auth.profileId };
     const request = {
-      frame,
-      attestations: auth.attestations.map((a) => a.blob),
+      bounds,
+      mandates: auth.attestations.map((a) => a.blob),
       execution,
-      context: resolvedContext,
+      scope: resolvedScope,
       // Identifies the grant whose bounds are being checked. hap-core reads it
       // only to scope a cumulative lookup, which no longer happens here (see
       // below); it is kept because it belongs to the request, not to the
-      // dropped check. It cannot go inside `frame`: that is validated against
+      // dropped check. It cannot go inside `bounds`: that is validated against
       // the profile's boundsSchema, which declares no `path` field in any
       // shipped profile, so an extra key there fails with "Unknown field".
       path: auth.path
     };
-    const result = await verify(request, publicKeyHex);
+    const result = await verify(request, { trustedIssuers: [trustedIssuer] });
     return { result, authorization: auth };
   }
 };
@@ -2551,6 +2616,7 @@ var ReportStore = class {
 };
 
 // src/lib/shared-state.ts
+import { PROTOCOL_VERSION } from "@hap/core";
 var SharedState = class {
   spClient;
   cache;
@@ -2567,6 +2633,21 @@ var SharedState = class {
    *  see ticket-verify.ts / commitments.ts. */
   proposalSubmissions;
   gatekeeper;
+  /**
+   * V7 — set by {@link checkAsCompat} (called once at process start, and
+   * again whenever the AS URL this process pairs with changes — which, in
+   * practice, only happens across a restart; see bin/http.ts's
+   * `repairIfAsUrlChanged`). Non-null means the AS this gateway is paired
+   * with does not list {@link PROTOCOL_VERSION} among its
+   * `supportedVersions` — every gated tool call MUST refuse with this
+   * message rather than reach the AS at all (checked in tool-proxy.ts,
+   * before anything else). `null` until the first check completes, which
+   * reads the SAME as "compatible" — fail-closed behaviour starts only
+   * once a check has actually run and failed, not merely "has not run
+   * yet" (the compat endpoint is best-effort: an AS that is briefly
+   * unreachable at boot must not permanently brick the gateway).
+   */
+  asVersionRefusal = null;
   /**
    * @param dataDir Passed to the AttestationCache so it can enforce AS key
    *   pinning (as-pairing.ts), and to the SPClient so it can enforce opt-in
@@ -2586,22 +2667,61 @@ var SharedState = class {
     this.proposalSubmissions = new ProposalSubmissionStore(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache);
   }
+  /**
+   * V7 — call once at startup (and again if the AS URL this process pairs
+   * with changes). Fetches GET /api/as/compat and sets
+   * {@link asVersionRefusal} when the AS does not support this package's
+   * protocol version. A network failure (AS unreachable at boot) does NOT
+   * set a refusal — that is a connectivity problem every gated call
+   * already surfaces on its own merits (SPReceiptError etc.); this check
+   * exists to catch the specific, otherwise-silent-until-first-tool-call
+   * case of a genuinely incompatible AS, not to duplicate "AS is down".
+   */
+  async checkAsCompat() {
+    let compat;
+    try {
+      compat = await this.spClient.getCompat();
+    } catch {
+      return;
+    }
+    const supported = Array.isArray(compat.supportedVersions) ? compat.supportedVersions : [];
+    if (!supported.includes(PROTOCOL_VERSION)) {
+      this.asVersionRefusal = supported.length > 0 ? `This Authority Server supports protocol version(s) [${supported.join(", ")}], not ${PROTOCOL_VERSION}. Update the gateway or the Authority Server so the two agree, then restart. No gated action can run until then.` : `This Authority Server's /api/as/compat does not name a supportedVersions list (it answered ${JSON.stringify(compat.protocolVersion ?? "unknown")}), so it cannot be confirmed to support protocol ${PROTOCOL_VERSION}. Update the gateway or the Authority Server, then restart. No gated action can run until then.`;
+      console.error(`[Suveren MCP] ${this.asVersionRefusal}`);
+    } else {
+      this.asVersionRefusal = null;
+    }
+  }
   /**
    * Archive a signed receipt into the local receipt archive — the subject's
    * own durable copy of the evidence (see receipt-archive.ts).
    *
-   * Best-effort by contract: the AS has already issued the receipt and holds
-   * the authoritative copy, so an archive failure logs loudly but MUST NOT
-   * block the execution it documents.
+   * FAIL-CLOSED (V8, reversed from the original "best-effort" contract):
+   * callers MUST call this BEFORE executing the downstream tool, and MUST
+   * NOT execute it if this throws. The AS's copy of the TICKET is
+   * authoritative, but this archive is the subject's ONLY copy of the
+   * intent/context plaintext the ticket's hashes commit to, and of the
+   * issuer key needed to verify it offline — an execution that ran with no
+   * way to produce that evidence later is worse than one that was refused
+   * up front.
+   *
+   * @throws AsKeyMismatchError when the pinned key is unavailable or
+   *   mismatched (propagated as-is — callers already react to this
+   *   specifically: refuse + lock, not a generic archive failure).
+   * @throws ArchiveWriteError for every other failure to produce a complete,
+   *   verifiable entry (no public key resolved, or the write itself failed).
    */
   async archiveReceipt(receipt, opts) {
+    let asPublicKey;
+    try {
+      asPublicKey = await this.cache.getPublicKey();
+    } catch (err) {
+      if (err instanceof AsKeyMismatchError) throw err;
+      throw new ArchiveWriteError(
+        `Could not resolve the Authority Server's public key to archive this receipt against: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
     try {
-      let asPublicKey;
-      try {
-        asPublicKey = await this.cache.getPublicKey();
-      } catch (err) {
-        if (err instanceof AsKeyMismatchError) throw err;
-      }
       this.receiptArchive.record({
         receipt,
         authorizationId: opts.authorizationId,
@@ -2622,11 +2742,7 @@ var SharedState = class {
         } : void 0
       });
     } catch (err) {
-      if (err instanceof AsKeyMismatchError) throw err;
-      console.error(
-        "[Suveren MCP] Receipt archive write failed (execution proceeds \u2014 AS retains authoritative copy):",
-        err
-      );
+      throw new ArchiveWriteError(`Receipt archive write failed: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
   setGateContent(path, authorizationId, profileId, content, opts) {
@@ -2657,7 +2773,8 @@ var SharedState = class {
         ...auth,
         gateContent: gateEntry?.gateContent ?? null,
         context: auth.context ?? gateEntry?.context,
-        contextHash: auth.contextHash ?? gateEntry?.contextHash
+        contextHash: auth.contextHash ?? gateEntry?.contextHash,
+        needsReapproval: this.cache.needsReapproval(auth.authorizationId)
       };
     }).filter((auth) => auth.gateContent !== null);
   }
@@ -2848,7 +2965,7 @@ function shouldAttachFooter() {
   return true;
 }
 function receiptUrl(receiptId) {
-  return `${AS_BASE}/r/${receiptId}`;
+  return `${AS_BASE}/t/${receiptId}`;
 }
 function verbForProfile(profile) {
   return profile === "publish" ? "Published" : "Sent";
@@ -2938,14 +3055,14 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
     boundContent
   };
 }
-function attachReceiptId(tool, args, receiptId) {
+function attachTicketId(tool, args, ticketId) {
   const schema = tool.inputSchema;
-  if (!schema?.properties || !("receipt_id" in schema.properties)) return args;
-  return { ...args, receipt_id: receiptId };
+  if (!schema?.properties || !("ticket_id" in schema.properties)) return args;
+  return { ...args, ticket_id: ticketId };
 }
 
 // src/lib/ticket-verify.ts
-import { verifyReceiptSignature } from "@hap/core";
+import { verifyTicketSignature } from "@hap/core";
 var TicketBindingMismatchError = class extends Error {
   constructor(message) {
     super(message);
@@ -2955,12 +3072,12 @@ var TicketBindingMismatchError = class extends Error {
 var TICKET_MAX_AGE_SECONDS = 5 * 60;
 var TICKET_MAX_CLOCK_SKEW_SECONDS = 30;
 async function verifyTicket(cache, receipt, expected) {
-  const publicKeyHex = await cache.getPublicKey();
+  const trustedIssuer = await cache.getTrustedIssuer();
   if (typeof receipt.signature !== "string" || !receipt.signature) {
     throw new AsKeyMismatchError("Ticket carries no signature \u2014 refusing to trust it.");
   }
   try {
-    await verifyReceiptSignature(receipt, publicKeyHex);
+    await verifyTicketSignature(receipt, { trustedIssuers: [trustedIssuer] });
   } catch (err) {
     throw new AsKeyMismatchError(
       `Ticket signature does not verify against the pinned Authority Server key \u2014 ${err instanceof Error ? err.message : String(err)}. Refusing to execute.`
@@ -3380,6 +3497,24 @@ function applyMapping(m, value, execution) {
 function profileMatches(profileId, shortName) {
   return profileId === shortName || profileId.includes("/" + shortName + "@") || profileId.endsWith("/" + shortName);
 }
+function wireExecutionContext(profileId, execution) {
+  const profile = getProfile2(profileId);
+  const allowed = /* @__PURE__ */ new Set(["action_type"]);
+  const fields = profile?.boundsSchema?.fields;
+  if (fields) {
+    for (const fieldDef of Object.values(fields)) {
+      const bt = fieldDef.boundType;
+      if (bt && (bt.kind === "per_transaction" || bt.kind === "cumulative_sum") && bt.of) {
+        allowed.add(bt.of);
+      }
+    }
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(execution)) {
+    if (allowed.has(key)) out[key] = value;
+  }
+  return out;
+}
 function countBoundsFor(profileId, actionType) {
   const fields = getProfile2(profileId)?.boundsSchema?.fields;
   if (!fields) return null;
@@ -3471,14 +3606,18 @@ function createGatedToolHandler(tool, integrationManager2, state2) {
 function isStaleMandateRefusal(err) {
   const errors = err.body?.errors;
   const code = errors?.[0]?.code;
-  if (err.statusCode === 403 && (code === "ATTESTATION_REVOKED" || code === "ATTESTATION_EXPIRED")) {
+  if (err.statusCode === 403 && (code === "MANDATE_REVOKED" || code === "MANDATE_EXPIRED")) {
     return true;
   }
-  if (err.statusCode === 404 && code === "ATTESTATION_NOT_FOUND") {
+  if (err.statusCode === 404 && code === "MANDATE_NOT_FOUND") {
     return true;
   }
   return false;
 }
+function isVersionUnsupportedRefusal(err) {
+  const errors = err.body?.errors;
+  return err.statusCode === 409 && errors?.[0]?.code === "VERSION_UNSUPPORTED";
+}
 function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   if (!tool.gating || !tool.gating.profile) {
     return async () => {
@@ -3518,6 +3657,9 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         isError: true
       };
     }
+    if (state2.asVersionRefusal) {
+      return { content: [{ type: "text", text: `Refused: ${state2.asVersionRefusal}` }], isError: true };
+    }
     return inner(args);
   };
   if (category === "disabled") {
@@ -3760,7 +3902,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         isError: true
       };
     }
-    const contextKeys = getProfile2(passers[0].profileId)?.contextSchema?.keyOrder ?? [];
+    const contextKeys = getProfile2(passers[0].profileId)?.scopeSchema?.keyOrder ?? [];
     return attemptWithCandidates(passers);
     async function attemptWithCandidates(candidates) {
       const selection = selectAuthorization(
@@ -3791,6 +3933,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
       if ((auth.deferredCommitmentDomains ?? []).length > 0) {
         try {
           const enrichedArgs = await attachImagePreview(args);
+          const wireExecCtx = wireExecutionContext(auth.profileId, execution);
           const { proposal } = await state2.spClient.submitProposal({
             authorizationId: authzId,
             profileId: auth.profileId,
@@ -3798,13 +3941,13 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             pendingDomains: auth.deferredCommitmentDomains,
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
-            executionContext: { ...execution }
+            executionContext: wireExecCtx
           });
           state2.proposalSubmissions.record({
             proposalId: proposal.id,
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
-            executionContext: { ...execution },
+            executionContext: wireExecCtx,
             authorizationId: authzId,
             profileId: auth.profileId
           });
@@ -3833,6 +3976,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
         const idempotencyKey = randomUUID();
+        const wireExecCtx = wireExecutionContext(auth.profileId, execution);
         const { receipt } = await state2.spClient.postReceipt({
           authorizationId: authzId,
           // Optional cross-check — the AS fails closed on a mismatch.
@@ -3840,7 +3984,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           profileId: auth.profileId,
           action: tool.namespacedName,
           actionType,
-          executionContext: { ...execution },
+          executionContext: wireExecCtx,
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
           idempotencyKey,
           // Privacy: send the hash and how to reproduce it — never the
@@ -3853,7 +3997,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
         await verifyTicket(state2.cache, receipt, {
           action: tool.namespacedName,
-          executionContext: { ...execution },
+          executionContext: wireExecCtx,
           authorizationId: authzId,
           profileId: auth.profileId,
           idempotencyKey,
@@ -3881,6 +4025,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             isError: true
           };
         }
+        if (err instanceof ArchiveWriteError) {
+          return {
+            content: [{ type: "text", text: `Blocked: the ticket could not be archived locally \u2014 ${err.message}. The action was not executed.` }],
+            isError: true
+          };
+        }
         if (err instanceof ContentBindingError) {
           return {
             content: [{
@@ -3890,6 +4040,23 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
             isError: true
           };
         }
+        if (err instanceof SPReceiptError && isVersionUnsupportedRefusal(err)) {
+          state2.cache.markNeedsReapproval(auth.authorizationId);
+          const remaining = candidates.filter((c) => c.authorizationId !== auth.authorizationId);
+          if (remaining.length === 0) {
+            return {
+              content: [{
+                type: "text",
+                text: `Blocked: mandate ${auth.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`
+              }],
+              isError: true
+            };
+          }
+          console.error(
+            `[Suveren MCP] fallback(${tool.namespacedName}): mandate ${auth.authorizationId} needs re-approval (VERSION_UNSUPPORTED) \u2192 retrying with [${remaining.map((c) => c.authorizationId).join(", ")}]`
+          );
+          return attemptWithCandidates(remaining);
+        }
         if (err instanceof SPReceiptError && isStaleMandateRefusal(err)) {
           state2.cache.invalidate(auth.authorizationId);
           const code = err.body?.errors?.[0]?.code ?? "unknown";
@@ -3934,6 +4101,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           const uniqueApprovers = [...new Set(pendingApprovers)];
           try {
             const enrichedArgs = await attachImagePreview(args);
+            const wireExecCtx = wireExecutionContext(auth.profileId, execution);
             const { proposal } = await state2.spClient.submitProposal({
               authorizationId: authzId,
               profileId: auth.profileId,
@@ -3941,14 +4109,14 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               pendingDomains: [],
               tool: tool.namespacedName,
               toolArgs: enrichedArgs,
-              executionContext: { ...execution },
+              executionContext: wireExecCtx,
               pendingApprovers: uniqueApprovers
             });
             state2.proposalSubmissions.record({
               proposalId: proposal.id,
               tool: tool.namespacedName,
               toolArgs: enrichedArgs,
-              executionContext: { ...execution },
+              executionContext: wireExecCtx,
               authorizationId: authzId,
               profileId: auth.profileId
             });
@@ -3979,7 +4147,8 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
           };
         }
         if (err instanceof SPReceiptError && err.statusCode === 403) {
-          if (/revoked/i.test(err.message)) {
+          const errors403 = err.body?.errors;
+          if (errors403?.[0]?.code === "MANDATE_REVOKED") {
             state2.cache.invalidate(auth.authorizationId);
           }
           return {
@@ -4005,7 +4174,7 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
         timestamp: Math.floor(Date.now() / 1e3)
       });
       let outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId, auth.subjects?.[0]) : args;
-      if (receiptId) outgoingArgs = attachReceiptId(tool, outgoingArgs, receiptId);
+      if (receiptId) outgoingArgs = attachTicketId(tool, outgoingArgs, receiptId);
       outgoingArgs = encodeOutgoingArgs(tool, outgoingArgs);
       if (receiptId) {
         const begun = state2.executionJournal.begin({
@@ -4118,6 +4287,12 @@ function buildMandateBrief(opts) {
     "You have bounded authorities granted by human decision owners.",
     "You MUST stay within these bounds \u2014 the Gatekeeper will reject actions that exceed them."
   ];
+  if (opts.asVersionRefusal) {
+    lines.push("");
+    lines.push("=== AUTHORITY SERVER INCOMPATIBLE \u2014 NO GATED ACTION WILL RUN ===");
+    lines.push("");
+    lines.push(opts.asVersionRefusal);
+  }
   const { brief: contextBrief } = getContextForBrief(contextDir);
   if (contextBrief) {
     lines.push("");
@@ -4128,6 +4303,18 @@ function buildMandateBrief(opts) {
   const active = authorizations.filter((a) => a.complete);
   const pending = authorizations.filter((a) => !a.complete);
   const now = Math.floor(Date.now() / 1e3);
+  const needingReapproval = active.filter((a) => a.needsReapproval);
+  if (needingReapproval.length > 0) {
+    lines.push("");
+    lines.push("=== NEEDS RE-APPROVAL ===");
+    lines.push("");
+    for (const auth of needingReapproval) {
+      lines.push(
+        `[${shortProfileName(auth.profileId)}] ${auth.authorizationId}: the Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.`
+      );
+    }
+    lines.push("");
+  }
   if (active.length > 0) {
     lines.push("");
     lines.push("=== ACTIVE AUTHORITIES ===");
@@ -4156,7 +4343,7 @@ function buildMandateBrief(opts) {
     }
   }
   if (pending.length > 0) {
-    lines.push("=== PENDING (awaiting attestations) ===");
+    lines.push("=== PENDING (awaiting mandates) ===");
     lines.push("");
     for (const auth of pending) {
       const missing = auth.requiredDomains.filter((d) => !auth.attestedDomains.includes(d));
@@ -4186,8 +4373,8 @@ function shortProfileName2(profileId) {
   const parts = withoutVersion.split("/");
   return parts[parts.length - 1];
 }
-function buildCapabilityMap(profileId, toolGating, integrationManager2) {
-  if (!integrationManager2 || !toolGating) return "";
+function buildCapabilityMap(profileId, integrationManager2) {
+  if (!integrationManager2) return "";
   const allTools = integrationManager2.getAllTools();
   const shortName = shortProfileName2(profileId);
   const gated = [];
@@ -4200,21 +4387,20 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
     if (!profileMatches(tool.gating.profile, shortName) && tool.gating.profile !== profileId) {
       continue;
     }
-    const overrides = toolGating.overrides ?? {};
-    const override = overrides[tool.originalName];
-    if (override === null) {
+    const gating = tool.gating;
+    if (gating.category === "read") {
       readOnly.push(tool.originalName);
-    } else if (override !== void 0) {
-      const mappingDesc = Object.entries(override.executionMapping ?? {}).map(([arg, mapping]) => {
+    } else if (gating.category === "disabled") {
+      undescribed.push(tool.originalName);
+    } else {
+      const mappingDesc = Object.entries(gating.executionMapping ?? {}).map(([arg, mapping]) => {
         if (typeof mapping === "string") return `${mapping} from ${arg}`;
         if (Array.isArray(mapping)) return `${mapping.map((m) => m.field).join("+")} from ${arg}`;
         if ("divisor" in mapping) return `${mapping.field} from ${arg} (/${mapping.divisor})`;
         return `${mapping.field} from ${arg}`;
       }).join(", ");
-      const actionType = override.staticExecution?.action_type ?? "unknown";
+      const actionType = gating.staticExecution?.action_type ?? "unknown";
       gated.push(`      - ${tool.originalName}: ${actionType}${mappingDesc ? `, ${mappingDesc}` : ""}`);
-    } else {
-      undescribed.push(tool.originalName);
     }
   }
   const lines = [];
@@ -4270,8 +4456,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
         const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
         const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
-        const statusLabel = auth.complete ? "" : " (PENDING)";
+        const statusLabel = !auth.complete ? " (PENDING)" : auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
         output2.push(`[${auth.path}] ${auth.profileId} (${remainingMin} min remaining)${statusLabel}`);
+        if (auth.needsReapproval) {
+          output2.push("  The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+        }
         output2.push("");
         output2.push(`  Bounds: ${boundsDesc}`);
         const reviewDomains = auth.deferredCommitmentDomains ?? [];
@@ -4311,11 +4500,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         if (!auth.complete) {
           const missing = auth.requiredDomains.filter((d) => !auth.attestedDomains.includes(d));
           output2.push("");
-          output2.push(`  Missing attestations: ${missing.join(", ")}`);
+          output2.push(`  Missing mandates: ${missing.join(", ")}`);
         }
         if (profile && integrationManager2) {
           output2.push("");
-          output2.push(buildCapabilityMap(auth.profileId, profile.toolGating, integrationManager2));
+          output2.push(buildCapabilityMap(auth.profileId, integrationManager2));
         }
         output2.push("");
       }
@@ -4334,8 +4523,12 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
       const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
       if (auth.complete) {
-        const lines = [`  [${auth.path}] ${auth.profileId} \u2014 ${remainingMin} min remaining`];
+        const statusLabel = auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
+        const lines = [`  [${auth.path}] ${auth.profileId} \u2014 ${remainingMin} min remaining${statusLabel}`];
         lines.push(`    Bounds: ${boundsDesc}`);
+        if (auth.needsReapproval) {
+          lines.push("    The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+        }
         if ((auth.deferredCommitmentDomains ?? []).length > 0) {
           lines.push("    Mode: review (each action requires your approval)");
         }
@@ -4353,7 +4546,7 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       } else {
         const missing = auth.requiredDomains.filter((d) => !auth.attestedDomains.includes(d));
         pending.push(
-          `  ${auth.path}: ${boundsDesc} \u2014 needs ${missing.join(", ")} attestation, ${remainingMin} min remaining`
+          `  ${auth.path}: ${boundsDesc} \u2014 needs ${missing.join(", ")} mandate, ${remainingMin} min remaining`
         );
       }
     }
@@ -4391,11 +4584,11 @@ function checkPendingHandler(cache) {
         return {
           content: [{
             type: "text",
-            text: `No pending attestations for domain "${domain}".`
+            text: `No pending mandates for domain "${domain}".`
           }]
         };
       }
-      const lines = [`Pending attestations needing your domain (${domain}):`];
+      const lines = [`Pending mandates needing your domain (${domain}):`];
       for (const item of pending) {
         const boundsDesc = Object.entries(item.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
         const attested = item.attested_domains.join(", ");
@@ -4416,7 +4609,7 @@ function checkPendingHandler(cache) {
       return {
         content: [{
           type: "text",
-          text: `Failed to check pending attestations: ${error}`
+          text: `Failed to check pending mandates: ${error}`
         }],
         isError: true
       };
@@ -4590,6 +4783,12 @@ async function executeCommitted(proposal, state2, integrationManager2) {
         isError: true
       };
     }
+    if (err instanceof ArchiveWriteError) {
+      return {
+        text: `Proposal ${proposal.id}: blocked \u2014 the ticket could not be archived locally \u2014 ${err.message}. The action was not executed.`,
+        isError: true
+      };
+    }
     if (err instanceof ContentBindingError2) {
       return {
         text: `Proposal ${proposal.id}: blocked \u2014 the approved content cannot be bound to the receipt. ${err.message}`,
@@ -4603,6 +4802,13 @@ async function executeCommitted(proposal, state2, integrationManager2) {
           text: `Proposal ${proposal.id} has already been executed by another request.`
         };
       }
+      if (err.statusCode === 409 && code === "VERSION_UNSUPPORTED") {
+        state2.cache.markNeedsReapproval(proposal.authorizationId);
+        return {
+          text: `Proposal ${proposal.id}: blocked \u2014 mandate ${proposal.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`,
+          isError: true
+        };
+      }
       return {
         text: `Proposal ${proposal.id}: SP rejected receipt \u2014 ${err.message}`,
         isError: true
@@ -4649,7 +4855,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       if (shouldAttachFooter()) {
         outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId, cachedAuth?.subjects?.[0]);
       }
-      outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId);
+      outgoingArgs = attachTicketId(discovered, outgoingArgs, receiptId);
       outgoingArgs = encodeOutgoingArgs(discovered, outgoingArgs);
     }
     let result;
@@ -4858,7 +5064,8 @@ function createMcpServer(state2, integrationManager2) {
   const instructions = buildMandateBrief({
     authorizations: enriched,
     executionLog: state2.executionLog,
-    integrationManager: integrationManager2
+    integrationManager: integrationManager2,
+    asVersionRefusal: state2.asVersionRefusal
   });
   const server = new McpServer(
     { name: "suveren-gateway", version: "0.1.0" },
@@ -4875,9 +5082,9 @@ function createMcpServer(state2, integrationManager2) {
     listAuthorizationsHandler(state2, integrationManager2)
   );
   server.registerTool(
-    "check-pending-attestations",
+    "check-pending-mandates",
     {
-      description: "Check if any attestations are waiting for your owner's approval.",
+      description: "Check if any mandates are waiting for your owner's approval.",
       inputSchema: {
         domain: z2.string().describe(`The owner's domain (e.g., "compliance")`)
       }
@@ -5014,7 +5221,7 @@ var AgentContactStore = class {
 
 // src/lib/gate-content.ts
 import { computeIntentHash } from "@hap/core";
-import { decodeAttestationBlob as decodeAttestationBlob2 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob2 } from "@hap/core";
 function hashGateContent(text) {
   return computeIntentHash(text);
 }
@@ -5023,7 +5230,7 @@ function verifyGateContentHashes(content, auth) {
   if (auth.attestations.length === 0) {
     return { valid: false, errors: ["No attestations available to verify against"] };
   }
-  const attestation = decodeAttestationBlob2(auth.attestations[0].blob);
+  const attestation = decodeMandateBlob2(auth.attestations[0].blob);
   const expectedHashes = attestation.payload.gate_content_hashes;
   if (!expectedHashes?.intent) {
     return { valid: false, errors: ["Attestation does not contain intent hash"] };
@@ -5125,7 +5332,6 @@ import { existsSync as existsSync15, writeFileSync as writeFileSync12, mkdirSync
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import { getProfile as getProfile5 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
 import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
@@ -5735,7 +5941,7 @@ var IntegrationManager = class {
     await this.connectWithGuard(client, transport, config);
     console.error(`[IntegrationManager] Connected to ${config.id} (${config.command} ${config.args.join(" ")})`);
     const toolsResult = await client.listTools();
-    const profileGating = config.toolGating ?? (config.profile ? getProfile5(config.profile)?.toolGating ?? null : null);
+    const profileGating = config.toolGating ?? null;
     const tools = (toolsResult.tools ?? []).map((tool) => {
       const gating = this.resolveToolGating(config.profile, profileGating, tool.name);
       return {
@@ -6240,11 +6446,11 @@ async function buildTicketDetails(archive, ticketIds) {
 }
 
 // src/lib/report/window.ts
-import { getProfile as getProfile6 } from "@hap/core";
+import { getProfile as getProfile5 } from "@hap/core";
 var REPORT_AGE_FIELD = "read_age_days";
 var REPORTING_PROFILE = "reporting";
 var END_SKEW_SECONDS = 120;
-var OLD_PROFILE_REFUSAL = "this reporting mandate is from an older profile version \u2014 create a new reporting mandate (reporting@0.2).";
+var OLD_PROFILE_REFUSAL = "this reporting mandate is from an older profile version \u2014 create a new reporting mandate.";
 var DAY = 86400;
 function boundsOf(a) {
   return a.bounds ?? a.frame;
@@ -6254,7 +6460,7 @@ function windowLabel(start, days, loadedAt) {
   if (loadedAt !== null && loadedAt === start) return `${since} (when the test data was loaded)`;
   return `${since} (the last ${days} ${days === 1 ? "day" : "days"})`;
 }
-var defaultLookup = (id) => getProfile6(id);
+var defaultLookup = (id) => getProfile5(id);
 function reportingMandateRefusal(m, lookup = defaultLookup) {
   const schema = lookup(m.profileId)?.boundsSchema;
   const field = resolveAgeBoundField(schema, REPORT_AGE_FIELD);
@@ -6737,7 +6943,7 @@ function writeReportTool(deps) {
       type: "object",
       properties: {
         html: { type: "string", description: "The full report HTML \u2014 see the tool description for how to write it." },
-        receipt_id: { type: "string" }
+        ticket_id: { type: "string" }
       },
       required: ["html"]
     },
@@ -6902,7 +7108,7 @@ function guideHeader(systems, inactive = []) {
   return lines.join("\n");
 }
 function scopeFieldsOf(profile) {
-  return profile.scopeSchema ?? profile.contextSchema;
+  return profile.scopeSchema;
 }
 function fieldLine(name, f) {
   const kind = [];
@@ -6950,7 +7156,7 @@ function fillGenerated(body, sections) {
 }
 
 // src/lib/builtins/setup.ts
-import { getProfile as getProfile7 } from "@hap/core";
+import { getProfile as getProfile6 } from "@hap/core";
 var DELEGATION_PROFILE = "delegation";
 var DELEGATION_INTENT_HINT = [
   "Why \u2014 With test data only, I want to find out which routine parts of my work an AI could take over, so people gain time \u2014 before anything touches real systems.",
@@ -7059,7 +7265,7 @@ Read each topic with get_guide(topic) before doing that step.`);
             return { ...builtinText(`Unknown topic "${topic}". Topics: ${guides.map((g) => g.topic).join(", ") || "none installed"}.`), isError: true };
           }
           const body = fillGenerated(guide.body.trim(), {
-            limits: () => limitsSection(systems.map((s) => ({ id: s.id, profile: getProfile7(s.profile) }))),
+            limits: () => limitsSection(systems.map((s) => ({ id: s.id, profile: getProfile6(s.profile) }))),
             package: () => packageSection(
               deps.integrationManager.getAllTools().find((t) => !deps.integrationManager.isBuiltin(t.integrationId) && t.originalName === "load_simulation")
             )
@@ -7076,7 +7282,7 @@ ${body}`);
           type: "object",
           properties: {
             content: { type: "string", description: "The complete new agent brief, in markdown (at most 16 KB)." },
-            receipt_id: {
+            ticket_id: {
               type: "string",
               description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
             }
@@ -7108,7 +7314,7 @@ ${body}`);
             mode: { type: "string", enum: ["review", "automatic"], description: "review = each action needs approval; automatic = within the limits." },
             duration_hours: { type: "number", description: "How long the mandate is valid, in hours. Omit for the profile default." },
             title: { type: "string", description: "A short name for the mandate." },
-            receipt_id: {
+            ticket_id: {
               type: "string",
               description: "Authorization reference for this call, set by the governing gateway \u2014 agents do not set this."
             }
@@ -7161,7 +7367,7 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 }
 
 // bin/http.ts
-import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync13, readFileSync as readFileSync19, unlinkSync as unlinkSync6, writeFileSync as writeFileSync13 } from "fs";
@@ -7298,6 +7504,7 @@ var reportSources = {
   }
   writeMcpPairedAsUrl(dataDir, spUrl);
 })();
+void state.checkAsCompat();
 var spApiKey = process.env.SUVEREN_AS_API_KEY ?? "";
 if (spApiKey) {
   state.spClient.setApiKey(spApiKey);
@@ -7663,7 +7870,10 @@ app.get("/internal/authorizations", internalOnly, (_req, res) => {
     bounds: a.frame,
     context: a.context ?? {},
     intent: a.gateContent?.intent ?? null,
-    deferredCommitmentDomains: a.deferredCommitmentDomains ?? []
+    deferredCommitmentDomains: a.deferredCommitmentDomains ?? [],
+    // Item 9 (re-approval UX) — the AS told us, via a VERSION_UNSUPPORTED
+    // ticket refusal, that this authorization's mandate blob is pre-0.7.
+    needsReapproval: a.needsReapproval ?? false
   }));
   res.json({ authorizations });
 });
@@ -7688,7 +7898,7 @@ app.get("/internal/evidence", internalOnly, (_req, res) => {
     ...a,
     attestations: a.attestations.map((att) => {
       try {
-        return { ...att, decoded: decodeAttestationBlob3(att.blob) };
+        return { ...att, decoded: decodeMandateBlob3(att.blob) };
       } catch {
         return att;
       }
@@ -7855,7 +8065,8 @@ app.get("/internal/brief", internalOnly, (_req, res) => {
     const brief = buildMandateBrief({
       authorizations: enriched,
       executionLog: state.executionLog,
-      integrationManager
+      integrationManager,
+      asVersionRefusal: state.asVersionRefusal
     });
     res.json({ brief });
   } catch (err) {