@suveren/gateway 0.39.0 → 0.41.0

package/dist/mcp-server/http.mjs

@@ -744,12 +744,19 @@ async function postInternal(path, body) {
     clearTimeout(timer);
   }
 }
-async function cpEncryptContent(toolArgs, recipientUserIds) {
-  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds });
+async function cpEncryptContent(toolArgs, recipientUserIds, readers) {
+  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds, ...readers ? { readers } : {} });
   return data;
 }
 async function cpDecryptContent(wire) {
-  const data = await postInternal("/internal/decrypt-content", { ciphertext: wire.ciphertext, keys: wire.keys });
+  const data = await postInternal("/internal/decrypt-content", {
+    ciphertext: wire.ciphertext,
+    // Both names: under a 0.8 mandate `encrypted_keys` is keyed by DID and
+    // `keys` by account id; the control plane finds this user's wrap by either.
+    keys: { ...wire.keys ?? {}, ...wire.encrypted_keys ?? {} },
+    // v0.8 rule 8: the control plane checks the decrypted content against the fingerprint.
+    ...wire.proposalContentHash ? { proposalContentHash: wire.proposalContentHash } : wire.hash ? { hash: wire.hash } : {}
+  });
   return data.plaintext;
 }
 
@@ -983,7 +990,10 @@ var SPClient = class {
     const { proposalContentHash, ...rest } = data;
     const body = JSON.stringify({
       ...rest,
-      ...proposalContentHash ? { proposal_content_hash: proposalContentHash } : {}
+      // v0.8 wire name is `proposalContentHash`; today's AS reads the
+      // Suveren-internal `proposal_content_hash`. Both are sent through the
+      // transition (same value); the AS of Track B reads the normative one.
+      ...proposalContentHash ? { proposal_content_hash: proposalContentHash, proposalContentHash } : {}
     });
     const maxAttempts = data.idempotencyKey || data.proposalId ? this.receiptRetry.maxAttempts : 1;
     let lastError;
@@ -1037,7 +1047,7 @@ var SPClient = class {
    * read it; the caller reports who cannot.
    */
   async submitProposal(data) {
-    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds);
+    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds, data.readers);
     const res = await this.fetch("/api/proposals", {
       method: "POST",
       body: JSON.stringify({
@@ -1046,8 +1056,18 @@ var SPClient = class {
         path: data.path,
         pending_domains: data.pendingDomains,
         tool: data.tool,
+        // v0.8 normative object, beside the Suveren-internal fields today's AS
+        // reads: `content` carries `encrypted_keys`/`readers`/`unreadable` with
+        // the legacy `keys`/`hash`; the fingerprint travels as
+        // `proposalContentHash`; the operation as `action` + `actionType`.
         content,
+        proposalContentHash: content.hash,
+        action: data.tool,
+        ...data.actionType ? { actionType: data.actionType } : {},
+        ...data.mandateId ? { mandateId: data.mandateId } : {},
+        ...data.boundsHash ? { boundsHash: data.boundsHash } : {},
         execution_context: data.executionContext,
+        executionContext: data.executionContext,
         // Phase 6
         ...data.pendingApprovers && data.pendingApprovers.length > 0 ? { pending_approvers: data.pendingApprovers } : {},
         ...data.createdBy ? { created_by: data.createdBy } : {}
@@ -1331,6 +1351,7 @@ var AttestationCache = class {
     }
     let signedCommitmentMode;
     let subjects;
+    let mandateId;
     const firstBlob = result.attestations[0]?.blob;
     if (firstBlob) {
       try {
@@ -1341,6 +1362,39 @@ var AttestationCache = class {
         signedCommitmentMode = void 0;
       }
     }
+    const mandateIds = [];
+    let mandateVersion;
+    const nowSec4 = Math.floor(Date.now() / 1e3);
+    for (const a of result.attestations) {
+      if (!a.blob) continue;
+      try {
+        const id = decodeMandateBlob(a.blob).payload.mandate_id;
+        if (typeof id !== "string") continue;
+        if (!mandateIds.includes(id)) mandateIds.push(id);
+        if (mandateId === void 0 && a.expires_at > nowSec4) {
+          mandateId = id;
+          const v = decodeMandateBlob(a.blob).payload.version;
+          if (typeof v === "string") mandateVersion = v;
+        }
+      } catch {
+      }
+    }
+    mandateId ??= mandateIds[0];
+    let proposalReaders;
+    let latestIssuedAt = -Infinity;
+    for (const a of result.attestations) {
+      if (!a.blob) continue;
+      try {
+        const p = decodeMandateBlob(a.blob).payload;
+        const ownerDid = p.mandate_owners?.[0]?.did;
+        if (typeof p.version !== "string" || typeof ownerDid !== "string") continue;
+        const issuedAt = typeof p.issued_at === "number" ? p.issued_at : 0;
+        if (issuedAt < latestIssuedAt) continue;
+        latestIssuedAt = issuedAt;
+        proposalReaders = { version: p.version, ownerDid, deciders: [...p.above_cap_approvers ?? []] };
+      } catch {
+      }
+    }
     const auth = {
       authorizationId: result.authorization_id,
       boundsHash: result.bounds_hash,
@@ -1362,6 +1416,10 @@ var AttestationCache = class {
       attestedDomains: result.attested_domains ?? [],
       deferredCommitmentDomains: result.deferred_commitment_domains ?? [],
       signedCommitmentMode,
+      mandateId,
+      mandateIds,
+      mandateVersion,
+      proposalReaders,
       subjects,
       complete: result.complete,
       groupId
@@ -2169,17 +2227,69 @@ var ExecutionJournal = class {
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
-    return this.load().entries.find((e) => e.ticketId === ticketId);
+    return this.load().entries.find((e) => e.ticketId === ticketId && ticketId !== "");
+  }
+  /** The row for a request (idempotencyKey / proposalId), whatever its state. */
+  getByRequest(requestKey) {
+    return this.load().entries.find((e) => e.requestKey === requestKey);
+  }
+  /**
+   * v0.8 — record that a ticket is about to be REQUESTED for this request,
+   * before the request leaves the machine (*One execution per ticket*, rule 1).
+   * A lost response then leaves a `requested` row: "the ticket never arrived,
+   * so the action cannot have started" — the one case a replayed ticket may
+   * run (rule 2). Idempotent for the same request key: a retry of the request
+   * itself keeps the one row.
+   */
+  requested(entry) {
+    const file = this.load();
+    if (file.entries.some((e) => e.requestKey === entry.requestKey)) return;
+    file.entries.push({
+      ticketId: "",
+      ...entry,
+      state: "requested",
+      startedAt: nowSec(),
+      pid: process.pid
+    });
+    this.persist(file);
   }
   /**
-   * Record intent to execute under `ticketId`. Refuses if any row for that
-   * ticket already exists, whatever its state — deciding what an existing row
-   * means is the caller's job, and it differs by state (see commitments.ts).
+   * Close a `requested` row whose ticket was never issued (the AS refused).
+   * Nothing ran; the row records that the request was judged and refused.
+   */
+  refusedBeforeTicket(requestKey, outcome, detail) {
+    const file = this.load();
+    const row = file.entries.find((e) => e.requestKey === requestKey && e.state === "requested");
+    if (!row) return;
+    row.state = "failed";
+    row.outcome = outcome;
+    if (detail !== void 0) row.detail = detail.length > DETAIL_CAP ? detail.slice(0, DETAIL_CAP) : detail;
+    row.finishedAt = nowSec();
+    this.persist(file);
+  }
+  /**
+   * Claim the ticket for execution — the atomic move to `intent` ("started")
+   * BEFORE the downstream call (*One execution per ticket*, rule 2). Refuses
+   * if a row for that ticket already exists, whatever its state — deciding
+   * what an existing row means is the caller's job, and it differs by state
+   * (see commitments.ts). With a `requestKey`, a row for the SAME request that
+   * is already `intent`/`done`/`failed` refuses too — a second ticket with a
+   * new id for the same request is not executed again; a `requested` row is
+   * upgraded in place.
    */
   begin(entry) {
     const file = this.load();
-    const existing = file.entries.find((e) => e.ticketId === entry.ticketId);
+    const existing = file.entries.find((e) => e.ticketId === entry.ticketId && e.ticketId !== "");
     if (existing) return { ok: false, existing };
+    if (entry.requestKey) {
+      const sameRequest = file.entries.find((e) => e.requestKey === entry.requestKey);
+      if (sameRequest && sameRequest.state !== "requested") return { ok: false, existing: sameRequest };
+      if (sameRequest) {
+        Object.assign(sameRequest, entry, { state: "intent", startedAt: nowSec(), pid: process.pid });
+        this.persist(file);
+        return { ok: true };
+      }
+    }
     file.entries.push({
       ...entry,
       state: "intent",
@@ -2431,7 +2541,8 @@ var ProposalSubmissionStore = class {
       authorizationId: entry.authorizationId,
       profileId: entry.profileId,
       submittedAt: nowSec3(),
-      ...entry.previewHash ? { previewHash: entry.previewHash } : {}
+      ...entry.previewHash ? { previewHash: entry.previewHash } : {},
+      ...entry.actionType ? { actionType: entry.actionType } : {}
     });
     this.persist(file);
   }
@@ -3230,7 +3341,7 @@ var ReportStore = class {
 };
 
 // src/lib/shared-state.ts
-import { PROTOCOL_VERSION } from "@hap/core";
+import { SUPPORTED_VERSIONS } from "@hap/core";
 var SharedState = class {
   spClient;
   cache;
@@ -3259,7 +3370,7 @@ var SharedState = class {
    * again whenever the AS URL this process pairs with changes — which, in
    * practice, only happens across a restart; see bin/http.ts's
    * `repairIfAsUrlChanged`). Non-null means the AS this gateway is paired
-   * with does not list {@link PROTOCOL_VERSION} among its
+   * with shares no version with SUPPORTED_VERSIONS among its
    * `supportedVersions` — every gated tool call MUST refuse with this
    * message rather than reach the AS at all (checked in tool-proxy.ts,
    * before anything else). `null` until the first check completes, which
@@ -3269,6 +3380,16 @@ var SharedState = class {
    * unreachable at boot must not permanently brick the gateway).
    */
   asVersionRefusal = null;
+  /** v0.8: whether the paired Authority Server lists 0.8 among its supportedVersions —
+   * read once at start-up ({@link checkAsCompat}); false until known. Where the wire
+   * shape differs between a 0.7 and a 0.8 AS (today: nothing), this is the switch. */
+  asSpeaks08 = false;
+  /** v0.8: the paired AS's supportedVersions as read at start-up; null until
+   * known. A mandate whose signed version is not in it can no longer be
+   * exercised (protocol.md → Version negotiation, rule 3: a v0.8 AS issues no
+   * ticket against a v0.7 mandate) and is shown as needing to be signed again
+   * before any call is refused for it. */
+  asSupportedVersions = null;
   /**
    * @param dataDir Passed to the AttestationCache so it can enforce AS key
    *   pinning (as-pairing.ts), and to the SPClient so it can enforce opt-in
@@ -3309,8 +3430,11 @@ var SharedState = class {
       return;
     }
     const supported = Array.isArray(compat.supportedVersions) ? compat.supportedVersions : [];
-    if (!supported.includes(PROTOCOL_VERSION)) {
-      this.asVersionRefusal = supported.length > 0 ? `This Authority Server supports protocol version(s) [${supported.join(", ")}], not ${PROTOCOL_VERSION}. Update the gateway or the Authority Server so the two agree, then restart. No gated action can run until then.` : `This Authority Server's /api/as/compat does not name a supportedVersions list (it answered ${JSON.stringify(compat.protocolVersion ?? "unknown")}), so it cannot be confirmed to support protocol ${PROTOCOL_VERSION}. Update the gateway or the Authority Server, then restart. No gated action can run until then.`;
+    const common = SUPPORTED_VERSIONS.filter((v) => supported.includes(v));
+    this.asSpeaks08 = supported.includes("0.8");
+    this.asSupportedVersions = supported.filter((v) => typeof v === "string");
+    if (common.length === 0) {
+      this.asVersionRefusal = supported.length > 0 ? `This Authority Server supports protocol version(s) [${supported.join(", ")}], none of [${SUPPORTED_VERSIONS.join(", ")}] this gateway speaks. Update the gateway or the Authority Server so the two agree, then restart. No gated action can run until then.` : `This Authority Server's /api/as/compat does not name a supportedVersions list (it answered ${JSON.stringify(compat.protocolVersion ?? "unknown")}), so it cannot be confirmed to support any of protocol [${SUPPORTED_VERSIONS.join(", ")}]. Update the gateway or the Authority Server, then restart. No gated action can run until then.`;
       console.error(`[Suveren MCP] ${this.asVersionRefusal}`);
     } else {
       this.asVersionRefusal = null;
@@ -3400,7 +3524,7 @@ var SharedState = class {
         gateContent: gateEntry?.gateContent ?? null,
         context: auth.context ?? gateEntry?.context,
         contextHash: auth.contextHash ?? gateEntry?.contextHash,
-        needsReapproval: this.cache.needsReapproval(auth.authorizationId)
+        needsReapproval: this.cache.needsReapproval(auth.authorizationId) || this.asSupportedVersions !== null && this.asSupportedVersions.length > 0 && typeof auth.mandateVersion === "string" && !this.asSupportedVersions.includes(auth.mandateVersion)
       };
     }).filter((auth) => auth.gateContent !== null);
   }
@@ -6418,7 +6542,13 @@ function attachTicketId(tool, args, ticketId) {
 }
 
 // src/lib/ticket-verify.ts
-import { verifyTicketSignature } from "@hap/core";
+import {
+  verifyTicketSignature,
+  verifyTicketAgainstRequest,
+  verifyTicketApprovals,
+  decodeMandateBlob as decodeMandateBlob2,
+  HapError
+} from "@hap/core";
 var TicketBindingMismatchError = class extends Error {
   constructor(message) {
     super(message);
@@ -6427,6 +6557,17 @@ var TicketBindingMismatchError = class extends Error {
 };
 var TICKET_MAX_AGE_SECONDS = 5 * 60;
 var TICKET_MAX_CLOCK_SKEW_SECONDS = 30;
+function mandateForTicket(attestations, ticketMandateId) {
+  if (typeof ticketMandateId !== "string") return void 0;
+  for (const a of attestations ?? []) {
+    try {
+      const m = decodeMandateBlob2(a.blob);
+      if (m.payload.mandate_id === ticketMandateId) return m;
+    } catch {
+    }
+  }
+  return void 0;
+}
 async function verifyTicket(cache, receipt, expected) {
   const trustedIssuer = await cache.getTrustedIssuer();
   if (typeof receipt.signature !== "string" || !receipt.signature) {
@@ -6485,20 +6626,70 @@ async function verifyTicket(cache, receipt, expected) {
   if (typeof timestamp !== "number" || !Number.isFinite(timestamp)) {
     throw new TicketBindingMismatchError("Ticket carries no valid timestamp \u2014 refusing to execute.");
   }
-  const nowSec4 = Math.floor(Date.now() / 1e3);
-  const ageSec = nowSec4 - timestamp;
-  if (ageSec > TICKET_MAX_AGE_SECONDS) {
-    throw new TicketBindingMismatchError(
-      `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
-    );
+  if (expected.replay !== true) {
+    const nowSec4 = Math.floor(Date.now() / 1e3);
+    const ageSec = nowSec4 - timestamp;
+    if (ageSec > TICKET_MAX_AGE_SECONDS) {
+      throw new TicketBindingMismatchError(
+        `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
+      );
+    }
+    if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
+      throw new TicketBindingMismatchError(
+        `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+      );
+    }
   }
-  if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
-    throw new TicketBindingMismatchError(
-      `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+  const ticket = receipt;
+  let acceptedMandateId = expected.mandateId;
+  if (expected.mandateIds && expected.mandateIds.length > 0) {
+    if (typeof ticket.mandateId !== "string" || !expected.mandateIds.includes(ticket.mandateId)) {
+      throw new TicketBindingMismatchError(
+        `TICKET_REQUEST_MISMATCH: ticket mandateId ${String(ticket.mandateId)} is not a mandate of this grant \u2014 refusing to execute.`
+      );
+    }
+    acceptedMandateId = ticket.mandateId;
+  }
+  try {
+    verifyTicketAgainstRequest(
+      ticket,
+      {
+        profileId: expected.profileId ?? ticket.profileId,
+        actionType: expected.actionType ?? ticket.actionType,
+        boundsHash: expected.boundsHash ?? ticket.boundsHash,
+        executionContext: expected.executionContext ?? ticket.executionContext ?? {},
+        mandateId: acceptedMandateId,
+        idempotencyKey: expected.idempotencyKey,
+        contentHash: expected.contentHash ?? ticket.contentHash,
+        contentBinding: expected.contentBinding !== void 0 ? expected.contentBinding : ticket.contentBinding,
+        proposalId: expected.proposalId ?? ticket.proposalId,
+        // A v0.7 ticket has no `proposalContentHash` (today's Authority Server
+        // binds the fingerprint on the request only); a v0.8 ticket MUST carry
+        // the one this call sent.
+        proposalContentHash: ticket.version === "0.7" ? ticket.proposalContentHash : expected.proposalContentHash ?? ticket.proposalContentHash
+      },
+      { mandate: expected.mandate, replay: expected.replay === true }
     );
+  } catch (err) {
+    if (err instanceof HapError) {
+      throw new TicketBindingMismatchError(`${err.message} \u2014 refusing to execute.`);
+    }
+    throw err;
+  }
+  if (expected.mandate && (ticket.approvalSignature || (ticket.approvalSignatures?.length ?? 0) > 0)) {
+    try {
+      await verifyTicketApprovals(ticket, expected.mandate);
+    } catch (err) {
+      throw new TicketBindingMismatchError(
+        `${err instanceof Error ? err.message : String(err)} \u2014 the approval does not cover this operation; refusing to execute.`
+      );
+    }
   }
 }
 
+// src/lib/tool-proxy.ts
+import { wireExecutionContext as hapWireExecutionContext, checkExecutionValues, missingSumFields } from "@hap/core";
+
 // src/lib/who-label.ts
 var UNKNOWN_DECIDER = "the person";
 async function resolveWhoLabel(archive, domainKey, userId) {
@@ -6720,21 +6911,8 @@ function profileMatches(profileId, shortName2) {
 }
 function wireExecutionContext(profileId, execution) {
   const profile = getProfile5(profileId);
-  const allowed = /* @__PURE__ */ new Set(["action_type"]);
-  const fields = profile?.boundsSchema?.fields;
-  if (fields) {
-    for (const fieldDef of Object.values(fields)) {
-      const bt = fieldDef.boundType;
-      if (bt && (bt.kind === "per_transaction" || bt.kind === "cumulative_sum") && bt.of) {
-        allowed.add(bt.of);
-      }
-    }
-  }
-  const out = {};
-  for (const [key, value] of Object.entries(execution)) {
-    if (allowed.has(key)) out[key] = value;
-  }
-  return out;
+  if (!profile) return {};
+  return hapWireExecutionContext(execution, profile);
 }
 function countBoundsFor(profileId, actionType) {
   const fields = getProfile5(profileId)?.boundsSchema?.fields;
@@ -6898,7 +7076,7 @@ function isStaleMandateRefusal(err) {
 }
 function isVersionUnsupportedRefusal(err) {
   const errors = err.body?.errors;
-  return err.statusCode === 409 && errors?.[0]?.code === "VERSION_UNSUPPORTED";
+  return errors?.[0]?.code === "VERSION_UNSUPPORTED";
 }
 function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   if (!tool.gating || !tool.gating.profile) {
@@ -7004,7 +7182,8 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
           ageBoundField
         ) : null;
         const isTeam = typeof state2.cache?.isTeamGroup === "function" ? state2.cache.isTeamGroup(matchingAuths[0]?.groupId) : void 0;
-        readMaxAge = isTeam === true && signedAge !== null ? localAge !== null ? Math.min(localAge, signedAge) : signedAge : localAge ?? signedAge;
+        const ceilingMarked = ageBoundField !== null && boundsSchema?.fields?.[ageBoundField]?.enforcedBy === "gatekeeper" && matchingAuths.some((a) => a.mandateVersion === "0.8");
+        readMaxAge = (ceilingMarked || isTeam === true) && signedAge !== null ? localAge !== null ? Math.min(localAge, signedAge) : signedAge : localAge ?? signedAge;
         if (readMaxAge === null) {
           return denyRead(
             state2,
@@ -7209,6 +7388,32 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
       return { content: [{ type: "text", text: noMandateRefusal(tool.namespacedName, mandateLabel) }], isError: true };
     }
     if (matchingAuths.length === 0) return noEligibleMandate(refusals);
+    {
+      const profileDefs = [...new Set(matchingAuths.map((a) => a.profileId))].map((id) => getProfile5(id)).filter((d) => d !== void 0);
+      for (const profileDef of profileDefs) {
+        try {
+          checkExecutionValues(hapWireExecutionContext(execution, profileDef), profileDef);
+        } catch (err) {
+          const detail = err instanceof Error ? err.message : String(err);
+          const field = /executionContext\.([A-Za-z0-9_]+)/.exec(detail)?.[1];
+          const bounds = field ? Object.entries(profileDef.boundsSchema?.fields ?? {}).filter(([, def]) => def.boundType?.of === field).map(([name]) => name) : [];
+          recordBlocked(state2, tool, {
+            kind: "bound",
+            detail,
+            ...field ? { field } : {},
+            who: "gateway",
+            code: "MALFORMED_TICKET_REQUEST"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `Blocked by Gatekeeper: ${field ? `"${field}" is not a number of zero or more` : "a value a bound reads is not a number of zero or more"}${bounds.length > 0 ? ` (read by ${bounds.join(", ")})` : ""} \u2014 ${detail}. Correct the request and try again.`
+            }],
+            isError: true
+          };
+        }
+      }
+    }
     const blockingFails = await failedBlockingChecks(integrationManager2, tool.integrationId, tool.originalName, args);
     if (blockingFails.length > 0) {
       recordBlocked(state2, tool, {
@@ -7366,7 +7571,12 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
             executionContext: wireExecCtx,
-            recipientUserIds
+            recipientUserIds,
+            // v0.8 — the normative proposal object (protocol.md → Proposals).
+            mandateId: auth.mandateId,
+            boundsHash: auth.boundsHash,
+            actionType: declaredActionType,
+            ...v08ProposalReaders(auth)
           });
           const previewHash = await computeSubmissionPreviewHash(
             integrationManager2,
@@ -7381,7 +7591,8 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             executionContext: wireExecCtx,
             authorizationId: authzId,
             profileId: auth.profileId,
-            previewHash
+            previewHash,
+            actionType: declaredActionType
           });
           return {
             content: [{
@@ -7415,16 +7626,44 @@ Tell the person what you proposed and that it waits for their approval in the ga
         finalArgs = finalized.args;
         rebuildTransport = finalized.rebuildTransport;
       }
+      if (auth.signedCommitmentMode === "automatic" && auth.mandateVersion === "0.8") {
+        const profileDef = getProfile5(auth.profileId);
+        const missing = profileDef ? missingSumFields(wireExecutionContext(auth.profileId, execution), profileDef, declaredActionType) : [];
+        if (missing.length > 0) {
+          const detail = `"${missing[0].field}" is required by the bound ${missing[0].bound} for "${declaredActionType}" calls, but this call carries none.`;
+          recordBlocked(state2, tool, {
+            kind: "bound",
+            detail,
+            field: missing[0].field,
+            who: "gateway",
+            code: "BOUND_EXCEEDED"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `Blocked by Gatekeeper: ${detail} Without it the spend cannot be counted against the mandate, so nothing ran.`
+            }],
+            isError: true
+          };
+        }
+      }
       let receiptId;
+      let autoRequestKey;
       try {
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, finalArgs, actionType);
         const idempotencyKey = randomUUID();
         const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-        const { receipt } = await state2.spClient.postReceipt({
+        state2.executionJournal?.requested?.({ requestKey: idempotencyKey, tool: tool.namespacedName, argsHash: hashToolArgs(finalArgs) });
+        autoRequestKey = idempotencyKey;
+        const { receipt, idempotent } = await state2.spClient.postReceipt({
           authorizationId: authzId,
           // Optional cross-check — the AS fails closed on a mismatch.
           boundsHash: auth.boundsHash,
+          // v0.8 — the mandate this call runs under, by its signed id, so a
+          // revoked mandate and its replacement (same bounds_hash) cannot be
+          // confused (Ticket Request Schema, rule 1).
+          mandateId: auth.mandateId,
           profileId: auth.profileId,
           action: tool.namespacedName,
           actionType,
@@ -7444,9 +7683,15 @@ Tell the person what you proposed and that it waits for their approval in the ga
           executionContext: wireExecCtx,
           authorizationId: authzId,
           profileId: auth.profileId,
+          actionType,
+          boundsHash: auth.boundsHash,
+          mandateId: auth.mandateId,
+          mandateIds: auth.mandateIds,
+          mandate: mandateForTicket(auth.attestations, receipt?.mandateId),
           idempotencyKey,
           contentHash: binding?.contentHash,
-          contentBinding: binding?.contentBinding
+          contentBinding: binding?.contentBinding,
+          replay: idempotent
         });
         await state2.archiveReceipt(receipt, {
           authorizationId: authzId,
@@ -7469,6 +7714,10 @@ Tell the person what you proposed and that it waits for their approval in the ga
           sentArgs: finalArgs
         });
       } catch (err) {
+        if (autoRequestKey && !receiptId) {
+          const refusalCode = err instanceof SPReceiptError ? err.body?.errors?.[0]?.code ?? "TICKET_REFUSED" : "REQUEST_FAILED";
+          state2.executionJournal?.refusedBeforeTicket?.(autoRequestKey, "as_refused", refusalCode);
+        }
         if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
           void notifyControlPlane("as-key-mismatch");
           return {
@@ -7499,7 +7748,7 @@ Tell the person what you proposed and that it waits for their approval in the ga
             return {
               content: [{
                 type: "text",
-                text: `Blocked: mandate ${auth.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`
+                text: `Blocked: mandate ${auth.authorizationId} must be signed again \u2014 the Authority Server no longer accepts its protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again; see list-authorizations). ${err.message}`
               }],
               isError: true
             };
@@ -7570,7 +7819,12 @@ Tell the person what you proposed and that it waits for their approval in the ga
               executionContext: wireExecCtx,
               pendingApprovers: uniqueApprovers,
               recipientUserIds,
-              ...ownerId ? { createdBy: ownerId } : {}
+              ...ownerId ? { createdBy: ownerId } : {},
+              // v0.8 — the normative proposal object (protocol.md → Proposals).
+              mandateId: auth.mandateId,
+              boundsHash: auth.boundsHash,
+              actionType: declaredActionType,
+              ...v08ProposalReaders(auth)
             });
             const previewHash = await computeSubmissionPreviewHash(
               integrationManager2,
@@ -7585,7 +7839,8 @@ Tell the person what you proposed and that it waits for their approval in the ga
               executionContext: wireExecCtx,
               authorizationId: authzId,
               profileId: auth.profileId,
-              previewHash
+              previewHash,
+              actionType: declaredActionType
             });
             return {
               content: [{
@@ -7651,6 +7906,7 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + a
       if (receiptId) {
         const begun = state2.executionJournal.begin({
           ticketId: receiptId,
+          requestKey: autoRequestKey,
           tool: tool.namespacedName,
           argsHash: hashToolArgs(finalArgs)
         });
@@ -7692,6 +7948,11 @@ function recordAutomaticOutcome(state2, ticketId, result, thrown) {
     console.error(`[Suveren MCP] Could not record the execution result for ticket ${ticketId}:`, err);
   }
 }
+function v08ProposalReaders(auth) {
+  const r = auth.proposalReaders;
+  if (!r || r.version !== "0.8") return {};
+  return { readers: { ownerDid: r.ownerDid, deciders: r.deciders } };
+}
 function noMandateRefusal(toolName, profile) {
   return `Refused: no mandate covers ${toolName} (${shortProfile(profile)}). Nothing was done. Ask the person to grant a ${shortProfile(profile)} mandate in the gateway, then try again. No ticket was requested.`;
 }
@@ -7799,11 +8060,11 @@ function buildMandateBrief(opts) {
   const needingReapproval = active.filter((a) => a.needsReapproval);
   if (needingReapproval.length > 0) {
     lines.push("");
-    lines.push("=== NEEDS RE-APPROVAL ===");
+    lines.push("=== MUST BE SIGNED AGAIN ===");
     lines.push("");
     for (const auth of needingReapproval) {
       lines.push(
-        `[${shortProfileName(auth.profileId)}] ${auth.authorizationId}: the Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.`
+        `[${shortProfileName(auth.profileId)}] ${auth.authorizationId}: the Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).`
       );
     }
     lines.push("");
@@ -7963,10 +8224,10 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
         const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
         const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
-        const statusLabel = !auth.complete ? " (PENDING)" : auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
+        const statusLabel = !auth.complete ? " (PENDING)" : auth.needsReapproval ? " (MUST BE SIGNED AGAIN)" : "";
         output2.push(`[${auth.path}] ${auth.profileId} (${remainingMin} min remaining)${statusLabel}`);
         if (auth.needsReapproval) {
-          output2.push("  The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+          output2.push("  The Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).");
         }
         output2.push("");
         output2.push(`  Bounds: ${boundsDesc}`);
@@ -8030,11 +8291,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
       const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
       if (auth.complete) {
-        const statusLabel = auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
+        const statusLabel = auth.needsReapproval ? " (MUST BE SIGNED AGAIN)" : "";
         const lines = [`  [${auth.path}] ${auth.profileId} \u2014 ${remainingMin} min remaining${statusLabel}`];
         lines.push(`    Bounds: ${boundsDesc}`);
         if (auth.needsReapproval) {
-          lines.push("    The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+          lines.push("    The Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).");
         }
         if ((auth.deferredCommitmentDomains ?? []).length > 0) {
           lines.push("    Mode: review (each action requires your approval)");
@@ -8268,12 +8529,6 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   const integrationId = proposal.tool.slice(0, sep);
   const toolName = proposal.tool.slice(sep + 2);
   const discovered = integrationManager2.getAllTools().find((t) => t.integrationId === integrationId && t.originalName === toolName);
-  const proposalActionType = typeof proposal.executionContext.action_type === "string" ? proposal.executionContext.action_type : void 0;
-  if (!proposalActionType) {
-    console.error(
-      `[Suveren MCP] Warning: proposal ${proposal.id} has no action_type in executionContext. Bounds check may be skipped. Fix the integration manifest for ${proposal.tool}.`
-    );
-  }
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   const submitted = state2.proposalSubmissions.get(proposal.id);
   if (!submitted) {
@@ -8285,6 +8540,12 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     }
     return { text: buildSkippedProposalNote(proposal.id), skipped: true };
   }
+  const proposalActionType = submitted.actionType ?? (typeof proposal.executionContext.action_type === "string" ? proposal.executionContext.action_type : void 0);
+  if (!proposalActionType) {
+    console.error(
+      `[Suveren MCP] Warning: proposal ${proposal.id} has no action_type. Bounds check may be skipped. Fix the integration manifest for ${proposal.tool}.`
+    );
+  }
   let toolArgs;
   try {
     toolArgs = await resolveProposalToolArgs(proposal);
@@ -8321,18 +8582,29 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       toolArgs,
       proposalActionType
     );
+    state2.executionJournal?.requested?.({
+      requestKey: proposal.id,
+      proposalId: proposal.id,
+      tool: proposal.tool,
+      argsHash: hashToolArgs(toolArgs)
+    });
     const { receipt: r, idempotent } = await state2.spClient.postReceipt({
       authorizationId: proposal.authorizationId,
       // Optional cross-check — the AS fails closed on a mismatch. Parity
       // with the automatic path (tool-proxy.ts).
       boundsHash: cachedAuth?.boundsHash,
+      // v0.8 — the mandate by its signed id (Ticket Request Schema, rule 1).
+      mandateId: cachedAuth?.mandateId,
       profileId: proposal.profileId,
       action: proposal.tool,
       actionType: proposalActionType,
       executionContext: proposal.executionContext,
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
-      toolArgs,
+      // v0.8 (Ticket Request Schema; Proposals, rule 1): the content itself
+      // never travels on the ticket request — only its fingerprint below.
+      // Today's AS matches by `proposal_content_hash` first, so dropping the
+      // readable `toolArgs` it used to receive changes nothing it checks.
       // PE1 — the fingerprint of what THIS gateway resolved (decrypted, or
       // read plain on a legacy row) and is about to execute. The AS compares
       // it against its own stored content_hash and refuses without echoing
@@ -8370,19 +8642,21 @@ async function executeCommitted(proposal, state2, integrationManager2) {
         };
       }
       if (code === "PROPOSAL_REFUSED") {
+        state2.executionJournal?.refusedBeforeTicket?.(proposal.id, "as_refused", `${code}: ${err.message}`);
         return {
           text: `Proposal ${proposal.id}: the Authority Server refused this proposal's ticket earlier \u2014 ${err.message} Nothing ran. Do not retry the same values; ask the person (e.g. for a higher limit).`,
           isError: true
         };
       }
-      if (err.statusCode === 409 && code === "VERSION_UNSUPPORTED") {
+      if (code === "VERSION_UNSUPPORTED") {
         state2.cache.markNeedsReapproval(proposal.authorizationId);
         return {
-          text: `Proposal ${proposal.id}: blocked \u2014 mandate ${proposal.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`,
+          text: `Proposal ${proposal.id}: blocked \u2014 mandate ${proposal.authorizationId} must be signed again \u2014 the Authority Server no longer accepts its protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again; see list-authorizations). ${err.message}`,
           isError: true
         };
       }
       if (proposal.id) {
+        state2.executionJournal?.refusedBeforeTicket?.(proposal.id, "as_refused", `${code ?? "TICKET_REFUSED"}: ${err.message}`);
         const asRefusedTicketId = `as_refused:${proposal.id}`;
         const begun2 = state2.executionJournal.begin({
           ticketId: asRefusedTicketId,
@@ -8412,6 +8686,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   const begun = state2.executionJournal.begin({
     ticketId: receiptId,
+    requestKey: proposal.id,
     proposalId: proposal.id,
     tool: proposal.tool,
     argsHash: hashToolArgs(toolArgs)
@@ -8435,9 +8710,18 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       executionContext: proposal.executionContext,
       authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
+      actionType: proposalActionType,
+      boundsHash: cachedAuth?.boundsHash,
+      mandateId: cachedAuth?.mandateId,
+      mandateIds: cachedAuth?.mandateIds,
+      // v0.8 — lets the ticket's version be checked against its mandate and
+      // the approval signatures be verified under the deciders' own DIDs.
+      mandate: mandateForTicket(cachedAuth?.attestations, receipt.mandateId),
       proposalId: proposal.id,
+      proposalContentHash: computeProposalContentHash(toolArgs),
       contentHash: binding?.contentHash,
-      contentBinding: binding?.contentBinding
+      contentBinding: binding?.contentBinding,
+      replay: replayed
     });
     await state2.archiveReceipt(receipt, {
       authorizationId: proposal.authorizationId,
@@ -8577,7 +8861,7 @@ Result: ${resultText}` };
 }
 function localOutcomeOfExecuted(proposal, state2) {
   const entry = state2.executionJournal?.findByProposal?.(proposal.id);
-  if (!entry) return null;
+  if (!entry || entry.state === "requested") return null;
   const integration = proposal.tool.split("__")[0];
   if (entry.state === "done") {
     const stored = state2.executionResults?.get(proposal.id);
@@ -8808,7 +9092,7 @@ function convert(schema, depth) {
       if (s.properties && typeof s.properties === "object") {
         t = z.object(shapeOf(s, depth + 1)).passthrough();
       } else {
-        t = z.record(z.unknown());
+        t = z.record(z.string(), z.unknown());
       }
       break;
     }
@@ -9010,7 +9294,7 @@ var AgentContactStore = class {
 
 // src/lib/gate-content.ts
 import { computeIntentHash } from "@hap/core";
-import { decodeMandateBlob as decodeMandateBlob2 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 function hashGateContent(text) {
   return computeIntentHash(text);
 }
@@ -9019,7 +9303,7 @@ function verifyGateContentHashes(content, auth) {
   if (auth.attestations.length === 0) {
     return { valid: false, errors: ["No attestations available to verify against"] };
   }
-  const attestation = decodeMandateBlob2(auth.attestations[0].blob);
+  const attestation = decodeMandateBlob3(auth.attestations[0].blob);
   const expectedHashes = attestation.payload.gate_content_hashes;
   if (!expectedHashes?.intent) {
     return { valid: false, errors: ["Attestation does not contain intent hash"] };
@@ -11505,7 +11789,7 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 }
 
 // bin/http.ts
-import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob4 } from "@hap/core";
 
 // src/lib/committed-executor.ts
 import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync22, unlinkSync as unlinkSync8, writeFileSync as writeFileSync16 } from "fs";
@@ -12170,7 +12454,7 @@ app.get("/internal/evidence", internalOnly, (_req, res) => {
     ...a,
     attestations: a.attestations.map((att) => {
       try {
-        return { ...att, decoded: decodeMandateBlob3(att.blob) };
+        return { ...att, decoded: decodeMandateBlob4(att.blob) };
       } catch {
         return att;
       }