@suveren/gateway 0.40.0 → 0.41.1

package/dist/mcp-server/http.mjs

@@ -744,12 +744,19 @@ async function postInternal(path, body) {
     clearTimeout(timer);
   }
 }
-async function cpEncryptContent(toolArgs, recipientUserIds) {
-  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds });
+async function cpEncryptContent(toolArgs, recipientUserIds, readers) {
+  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds, ...readers ? { readers } : {} });
   return data;
 }
 async function cpDecryptContent(wire) {
-  const data = await postInternal("/internal/decrypt-content", { ciphertext: wire.ciphertext, keys: wire.keys });
+  const data = await postInternal("/internal/decrypt-content", {
+    ciphertext: wire.ciphertext,
+    // Both names: under a 0.8 mandate `encrypted_keys` is keyed by DID and
+    // `keys` by account id; the control plane finds this user's wrap by either.
+    keys: { ...wire.keys ?? {}, ...wire.encrypted_keys ?? {} },
+    // v0.8 rule 8: the control plane checks the decrypted content against the fingerprint.
+    ...wire.proposalContentHash ? { proposalContentHash: wire.proposalContentHash } : wire.hash ? { hash: wire.hash } : {}
+  });
   return data.plaintext;
 }
 
@@ -983,7 +990,10 @@ var SPClient = class {
     const { proposalContentHash, ...rest } = data;
     const body = JSON.stringify({
       ...rest,
-      ...proposalContentHash ? { proposal_content_hash: proposalContentHash } : {}
+      // v0.8 wire name is `proposalContentHash`; today's AS reads the
+      // Suveren-internal `proposal_content_hash`. Both are sent through the
+      // transition (same value); the AS of Track B reads the normative one.
+      ...proposalContentHash ? { proposal_content_hash: proposalContentHash, proposalContentHash } : {}
     });
     const maxAttempts = data.idempotencyKey || data.proposalId ? this.receiptRetry.maxAttempts : 1;
     let lastError;
@@ -1037,7 +1047,7 @@ var SPClient = class {
    * read it; the caller reports who cannot.
    */
   async submitProposal(data) {
-    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds);
+    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds, data.readers);
     const res = await this.fetch("/api/proposals", {
       method: "POST",
       body: JSON.stringify({
@@ -1046,8 +1056,18 @@ var SPClient = class {
         path: data.path,
         pending_domains: data.pendingDomains,
         tool: data.tool,
+        // v0.8 normative object, beside the Suveren-internal fields today's AS
+        // reads: `content` carries `encrypted_keys`/`readers`/`unreadable` with
+        // the legacy `keys`/`hash`; the fingerprint travels as
+        // `proposalContentHash`; the operation as `action` + `actionType`.
         content,
+        proposalContentHash: content.hash,
+        action: data.tool,
+        ...data.actionType ? { actionType: data.actionType } : {},
+        ...data.mandateId ? { mandateId: data.mandateId } : {},
+        ...data.boundsHash ? { boundsHash: data.boundsHash } : {},
         execution_context: data.executionContext,
+        executionContext: data.executionContext,
         // Phase 6
         ...data.pendingApprovers && data.pendingApprovers.length > 0 ? { pending_approvers: data.pendingApprovers } : {},
         ...data.createdBy ? { created_by: data.createdBy } : {}
@@ -1331,6 +1351,7 @@ var AttestationCache = class {
     }
     let signedCommitmentMode;
     let subjects;
+    let mandateId;
     const firstBlob = result.attestations[0]?.blob;
     if (firstBlob) {
       try {
@@ -1341,6 +1362,39 @@ var AttestationCache = class {
         signedCommitmentMode = void 0;
       }
     }
+    const mandateIds = [];
+    let mandateVersion;
+    const nowSec4 = Math.floor(Date.now() / 1e3);
+    for (const a of result.attestations) {
+      if (!a.blob) continue;
+      try {
+        const id = decodeMandateBlob(a.blob).payload.mandate_id;
+        if (typeof id !== "string") continue;
+        if (!mandateIds.includes(id)) mandateIds.push(id);
+        if (mandateId === void 0 && a.expires_at > nowSec4) {
+          mandateId = id;
+          const v = decodeMandateBlob(a.blob).payload.version;
+          if (typeof v === "string") mandateVersion = v;
+        }
+      } catch {
+      }
+    }
+    mandateId ??= mandateIds[0];
+    let proposalReaders;
+    let latestIssuedAt = -Infinity;
+    for (const a of result.attestations) {
+      if (!a.blob) continue;
+      try {
+        const p = decodeMandateBlob(a.blob).payload;
+        const ownerDid = p.mandate_owners?.[0]?.did;
+        if (typeof p.version !== "string" || typeof ownerDid !== "string") continue;
+        const issuedAt = typeof p.issued_at === "number" ? p.issued_at : 0;
+        if (issuedAt < latestIssuedAt) continue;
+        latestIssuedAt = issuedAt;
+        proposalReaders = { version: p.version, ownerDid, deciders: [...p.above_cap_approvers ?? []] };
+      } catch {
+      }
+    }
     const auth = {
       authorizationId: result.authorization_id,
       boundsHash: result.bounds_hash,
@@ -1362,6 +1416,10 @@ var AttestationCache = class {
       attestedDomains: result.attested_domains ?? [],
       deferredCommitmentDomains: result.deferred_commitment_domains ?? [],
       signedCommitmentMode,
+      mandateId,
+      mandateIds,
+      mandateVersion,
+      proposalReaders,
       subjects,
       complete: result.complete,
       groupId
@@ -2169,17 +2227,69 @@ var ExecutionJournal = class {
   }
   /** Look a ticket up. Always reads from disk — another process may have written. */
   get(ticketId) {
-    return this.load().entries.find((e) => e.ticketId === ticketId);
+    return this.load().entries.find((e) => e.ticketId === ticketId && ticketId !== "");
+  }
+  /** The row for a request (idempotencyKey / proposalId), whatever its state. */
+  getByRequest(requestKey) {
+    return this.load().entries.find((e) => e.requestKey === requestKey);
+  }
+  /**
+   * v0.8 — record that a ticket is about to be REQUESTED for this request,
+   * before the request leaves the machine (*One execution per ticket*, rule 1).
+   * A lost response then leaves a `requested` row: "the ticket never arrived,
+   * so the action cannot have started" — the one case a replayed ticket may
+   * run (rule 2). Idempotent for the same request key: a retry of the request
+   * itself keeps the one row.
+   */
+  requested(entry) {
+    const file = this.load();
+    if (file.entries.some((e) => e.requestKey === entry.requestKey)) return;
+    file.entries.push({
+      ticketId: "",
+      ...entry,
+      state: "requested",
+      startedAt: nowSec(),
+      pid: process.pid
+    });
+    this.persist(file);
   }
   /**
-   * Record intent to execute under `ticketId`. Refuses if any row for that
-   * ticket already exists, whatever its state — deciding what an existing row
-   * means is the caller's job, and it differs by state (see commitments.ts).
+   * Close a `requested` row whose ticket was never issued (the AS refused).
+   * Nothing ran; the row records that the request was judged and refused.
+   */
+  refusedBeforeTicket(requestKey, outcome, detail) {
+    const file = this.load();
+    const row = file.entries.find((e) => e.requestKey === requestKey && e.state === "requested");
+    if (!row) return;
+    row.state = "failed";
+    row.outcome = outcome;
+    if (detail !== void 0) row.detail = detail.length > DETAIL_CAP ? detail.slice(0, DETAIL_CAP) : detail;
+    row.finishedAt = nowSec();
+    this.persist(file);
+  }
+  /**
+   * Claim the ticket for execution — the atomic move to `intent` ("started")
+   * BEFORE the downstream call (*One execution per ticket*, rule 2). Refuses
+   * if a row for that ticket already exists, whatever its state — deciding
+   * what an existing row means is the caller's job, and it differs by state
+   * (see commitments.ts). With a `requestKey`, a row for the SAME request that
+   * is already `intent`/`done`/`failed` refuses too — a second ticket with a
+   * new id for the same request is not executed again; a `requested` row is
+   * upgraded in place.
    */
   begin(entry) {
     const file = this.load();
-    const existing = file.entries.find((e) => e.ticketId === entry.ticketId);
+    const existing = file.entries.find((e) => e.ticketId === entry.ticketId && e.ticketId !== "");
     if (existing) return { ok: false, existing };
+    if (entry.requestKey) {
+      const sameRequest = file.entries.find((e) => e.requestKey === entry.requestKey);
+      if (sameRequest && sameRequest.state !== "requested") return { ok: false, existing: sameRequest };
+      if (sameRequest) {
+        Object.assign(sameRequest, entry, { state: "intent", startedAt: nowSec(), pid: process.pid });
+        this.persist(file);
+        return { ok: true };
+      }
+    }
     file.entries.push({
       ...entry,
       state: "intent",
@@ -2431,7 +2541,8 @@ var ProposalSubmissionStore = class {
       authorizationId: entry.authorizationId,
       profileId: entry.profileId,
       submittedAt: nowSec3(),
-      ...entry.previewHash ? { previewHash: entry.previewHash } : {}
+      ...entry.previewHash ? { previewHash: entry.previewHash } : {},
+      ...entry.actionType ? { actionType: entry.actionType } : {}
     });
     this.persist(file);
   }
@@ -3230,7 +3341,7 @@ var ReportStore = class {
 };
 
 // src/lib/shared-state.ts
-import { PROTOCOL_VERSION } from "@hap/core";
+import { SUPPORTED_VERSIONS } from "@hap/core";
 var SharedState = class {
   spClient;
   cache;
@@ -3259,7 +3370,7 @@ var SharedState = class {
    * again whenever the AS URL this process pairs with changes — which, in
    * practice, only happens across a restart; see bin/http.ts's
    * `repairIfAsUrlChanged`). Non-null means the AS this gateway is paired
-   * with does not list {@link PROTOCOL_VERSION} among its
+   * with shares no version with SUPPORTED_VERSIONS among its
    * `supportedVersions` — every gated tool call MUST refuse with this
    * message rather than reach the AS at all (checked in tool-proxy.ts,
    * before anything else). `null` until the first check completes, which
@@ -3269,6 +3380,16 @@ var SharedState = class {
    * unreachable at boot must not permanently brick the gateway).
    */
   asVersionRefusal = null;
+  /** v0.8: whether the paired Authority Server lists 0.8 among its supportedVersions —
+   * read once at start-up ({@link checkAsCompat}); false until known. Where the wire
+   * shape differs between a 0.7 and a 0.8 AS (today: nothing), this is the switch. */
+  asSpeaks08 = false;
+  /** v0.8: the paired AS's supportedVersions as read at start-up; null until
+   * known. A mandate whose signed version is not in it can no longer be
+   * exercised (protocol.md → Version negotiation, rule 3: a v0.8 AS issues no
+   * ticket against a v0.7 mandate) and is shown as needing to be signed again
+   * before any call is refused for it. */
+  asSupportedVersions = null;
   /**
    * @param dataDir Passed to the AttestationCache so it can enforce AS key
    *   pinning (as-pairing.ts), and to the SPClient so it can enforce opt-in
@@ -3309,8 +3430,11 @@ var SharedState = class {
       return;
     }
     const supported = Array.isArray(compat.supportedVersions) ? compat.supportedVersions : [];
-    if (!supported.includes(PROTOCOL_VERSION)) {
-      this.asVersionRefusal = supported.length > 0 ? `This Authority Server supports protocol version(s) [${supported.join(", ")}], not ${PROTOCOL_VERSION}. Update the gateway or the Authority Server so the two agree, then restart. No gated action can run until then.` : `This Authority Server's /api/as/compat does not name a supportedVersions list (it answered ${JSON.stringify(compat.protocolVersion ?? "unknown")}), so it cannot be confirmed to support protocol ${PROTOCOL_VERSION}. Update the gateway or the Authority Server, then restart. No gated action can run until then.`;
+    const common = SUPPORTED_VERSIONS.filter((v) => supported.includes(v));
+    this.asSpeaks08 = supported.includes("0.8");
+    this.asSupportedVersions = supported.filter((v) => typeof v === "string");
+    if (common.length === 0) {
+      this.asVersionRefusal = supported.length > 0 ? `This Authority Server supports protocol version(s) [${supported.join(", ")}], none of [${SUPPORTED_VERSIONS.join(", ")}] this gateway speaks. Update the gateway or the Authority Server so the two agree, then restart. No gated action can run until then.` : `This Authority Server's /api/as/compat does not name a supportedVersions list (it answered ${JSON.stringify(compat.protocolVersion ?? "unknown")}), so it cannot be confirmed to support any of protocol [${SUPPORTED_VERSIONS.join(", ")}]. Update the gateway or the Authority Server, then restart. No gated action can run until then.`;
       console.error(`[Suveren MCP] ${this.asVersionRefusal}`);
     } else {
       this.asVersionRefusal = null;
@@ -3400,7 +3524,7 @@ var SharedState = class {
         gateContent: gateEntry?.gateContent ?? null,
         context: auth.context ?? gateEntry?.context,
         contextHash: auth.contextHash ?? gateEntry?.contextHash,
-        needsReapproval: this.cache.needsReapproval(auth.authorizationId)
+        needsReapproval: this.cache.needsReapproval(auth.authorizationId) || this.asSupportedVersions !== null && this.asSupportedVersions.length > 0 && typeof auth.mandateVersion === "string" && !this.asSupportedVersions.includes(auth.mandateVersion)
       };
     }).filter((auth) => auth.gateContent !== null);
   }
@@ -6418,7 +6542,13 @@ function attachTicketId(tool, args, ticketId) {
 }
 
 // src/lib/ticket-verify.ts
-import { verifyTicketSignature } from "@hap/core";
+import {
+  verifyTicketSignature,
+  verifyTicketAgainstRequest,
+  verifyTicketApprovals,
+  decodeMandateBlob as decodeMandateBlob2,
+  HapError
+} from "@hap/core";
 var TicketBindingMismatchError = class extends Error {
   constructor(message) {
     super(message);
@@ -6427,6 +6557,17 @@ var TicketBindingMismatchError = class extends Error {
 };
 var TICKET_MAX_AGE_SECONDS = 5 * 60;
 var TICKET_MAX_CLOCK_SKEW_SECONDS = 30;
+function mandateForTicket(attestations, ticketMandateId) {
+  if (typeof ticketMandateId !== "string") return void 0;
+  for (const a of attestations ?? []) {
+    try {
+      const m = decodeMandateBlob2(a.blob);
+      if (m.payload.mandate_id === ticketMandateId) return m;
+    } catch {
+    }
+  }
+  return void 0;
+}
 async function verifyTicket(cache, receipt, expected) {
   const trustedIssuer = await cache.getTrustedIssuer();
   if (typeof receipt.signature !== "string" || !receipt.signature) {
@@ -6485,20 +6626,70 @@ async function verifyTicket(cache, receipt, expected) {
   if (typeof timestamp !== "number" || !Number.isFinite(timestamp)) {
     throw new TicketBindingMismatchError("Ticket carries no valid timestamp \u2014 refusing to execute.");
   }
-  const nowSec4 = Math.floor(Date.now() / 1e3);
-  const ageSec = nowSec4 - timestamp;
-  if (ageSec > TICKET_MAX_AGE_SECONDS) {
-    throw new TicketBindingMismatchError(
-      `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
-    );
+  if (expected.replay !== true) {
+    const nowSec4 = Math.floor(Date.now() / 1e3);
+    const ageSec = nowSec4 - timestamp;
+    if (ageSec > TICKET_MAX_AGE_SECONDS) {
+      throw new TicketBindingMismatchError(
+        `Ticket is ${ageSec}s old, older than the ${TICKET_MAX_AGE_SECONDS}s freshness window \u2014 refusing to execute.`
+      );
+    }
+    if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
+      throw new TicketBindingMismatchError(
+        `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+      );
+    }
   }
-  if (ageSec < -TICKET_MAX_CLOCK_SKEW_SECONDS) {
-    throw new TicketBindingMismatchError(
-      `Ticket is timestamped ${-ageSec}s in the future, beyond the ${TICKET_MAX_CLOCK_SKEW_SECONDS}s clock-skew tolerance \u2014 refusing to execute.`
+  const ticket = receipt;
+  let acceptedMandateId = expected.mandateId;
+  if (expected.mandateIds && expected.mandateIds.length > 0) {
+    if (typeof ticket.mandateId !== "string" || !expected.mandateIds.includes(ticket.mandateId)) {
+      throw new TicketBindingMismatchError(
+        `TICKET_REQUEST_MISMATCH: ticket mandateId ${String(ticket.mandateId)} is not a mandate of this grant \u2014 refusing to execute.`
+      );
+    }
+    acceptedMandateId = ticket.mandateId;
+  }
+  try {
+    verifyTicketAgainstRequest(
+      ticket,
+      {
+        profileId: expected.profileId ?? ticket.profileId,
+        actionType: expected.actionType ?? ticket.actionType,
+        boundsHash: expected.boundsHash ?? ticket.boundsHash,
+        executionContext: expected.executionContext ?? ticket.executionContext ?? {},
+        mandateId: acceptedMandateId,
+        idempotencyKey: expected.idempotencyKey,
+        contentHash: expected.contentHash ?? ticket.contentHash,
+        contentBinding: expected.contentBinding !== void 0 ? expected.contentBinding : ticket.contentBinding,
+        proposalId: expected.proposalId ?? ticket.proposalId,
+        // A v0.7 ticket has no `proposalContentHash` (today's Authority Server
+        // binds the fingerprint on the request only); a v0.8 ticket MUST carry
+        // the one this call sent.
+        proposalContentHash: ticket.version === "0.7" ? ticket.proposalContentHash : expected.proposalContentHash ?? ticket.proposalContentHash
+      },
+      { mandate: expected.mandate, replay: expected.replay === true }
     );
+  } catch (err) {
+    if (err instanceof HapError) {
+      throw new TicketBindingMismatchError(`${err.message} \u2014 refusing to execute.`);
+    }
+    throw err;
+  }
+  if (expected.mandate && (ticket.approvalSignature || (ticket.approvalSignatures?.length ?? 0) > 0)) {
+    try {
+      await verifyTicketApprovals(ticket, expected.mandate);
+    } catch (err) {
+      throw new TicketBindingMismatchError(
+        `${err instanceof Error ? err.message : String(err)} \u2014 the approval does not cover this operation; refusing to execute.`
+      );
+    }
   }
 }
 
+// src/lib/tool-proxy.ts
+import { wireExecutionContext as hapWireExecutionContext, checkExecutionValues, missingSumFields } from "@hap/core";
+
 // src/lib/who-label.ts
 var UNKNOWN_DECIDER = "the person";
 async function resolveWhoLabel(archive, domainKey, userId) {
@@ -6720,21 +6911,8 @@ function profileMatches(profileId, shortName2) {
 }
 function wireExecutionContext(profileId, execution) {
   const profile = getProfile5(profileId);
-  const allowed = /* @__PURE__ */ new Set(["action_type"]);
-  const fields = profile?.boundsSchema?.fields;
-  if (fields) {
-    for (const fieldDef of Object.values(fields)) {
-      const bt = fieldDef.boundType;
-      if (bt && (bt.kind === "per_transaction" || bt.kind === "cumulative_sum") && bt.of) {
-        allowed.add(bt.of);
-      }
-    }
-  }
-  const out = {};
-  for (const [key, value] of Object.entries(execution)) {
-    if (allowed.has(key)) out[key] = value;
-  }
-  return out;
+  if (!profile) return {};
+  return hapWireExecutionContext(execution, profile);
 }
 function countBoundsFor(profileId, actionType) {
   const fields = getProfile5(profileId)?.boundsSchema?.fields;
@@ -6898,7 +7076,7 @@ function isStaleMandateRefusal(err) {
 }
 function isVersionUnsupportedRefusal(err) {
   const errors = err.body?.errors;
-  return err.statusCode === 409 && errors?.[0]?.code === "VERSION_UNSUPPORTED";
+  return errors?.[0]?.code === "VERSION_UNSUPPORTED";
 }
 function createGatedToolHandlerInner(tool, integrationManager2, state2) {
   if (!tool.gating || !tool.gating.profile) {
@@ -7004,7 +7182,8 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
           ageBoundField
         ) : null;
         const isTeam = typeof state2.cache?.isTeamGroup === "function" ? state2.cache.isTeamGroup(matchingAuths[0]?.groupId) : void 0;
-        readMaxAge = isTeam === true && signedAge !== null ? localAge !== null ? Math.min(localAge, signedAge) : signedAge : localAge ?? signedAge;
+        const ceilingMarked = ageBoundField !== null && boundsSchema?.fields?.[ageBoundField]?.enforcedBy === "gatekeeper" && matchingAuths.some((a) => a.mandateVersion === "0.8");
+        readMaxAge = (ceilingMarked || isTeam === true) && signedAge !== null ? localAge !== null ? Math.min(localAge, signedAge) : signedAge : localAge ?? signedAge;
         if (readMaxAge === null) {
           return denyRead(
             state2,
@@ -7209,6 +7388,32 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
       return { content: [{ type: "text", text: noMandateRefusal(tool.namespacedName, mandateLabel) }], isError: true };
     }
     if (matchingAuths.length === 0) return noEligibleMandate(refusals);
+    {
+      const profileDefs = [...new Set(matchingAuths.map((a) => a.profileId))].map((id) => getProfile5(id)).filter((d) => d !== void 0);
+      for (const profileDef of profileDefs) {
+        try {
+          checkExecutionValues(hapWireExecutionContext(execution, profileDef), profileDef);
+        } catch (err) {
+          const detail = err instanceof Error ? err.message : String(err);
+          const field = /executionContext\.([A-Za-z0-9_]+)/.exec(detail)?.[1];
+          const bounds = field ? Object.entries(profileDef.boundsSchema?.fields ?? {}).filter(([, def]) => def.boundType?.of === field).map(([name]) => name) : [];
+          recordBlocked(state2, tool, {
+            kind: "bound",
+            detail,
+            ...field ? { field } : {},
+            who: "gateway",
+            code: "MALFORMED_TICKET_REQUEST"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `Blocked by Gatekeeper: ${field ? `"${field}" is not a number of zero or more` : "a value a bound reads is not a number of zero or more"}${bounds.length > 0 ? ` (read by ${bounds.join(", ")})` : ""} \u2014 ${detail}. Correct the request and try again.`
+            }],
+            isError: true
+          };
+        }
+      }
+    }
     const blockingFails = await failedBlockingChecks(integrationManager2, tool.integrationId, tool.originalName, args);
     if (blockingFails.length > 0) {
       recordBlocked(state2, tool, {
@@ -7366,7 +7571,12 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
             executionContext: wireExecCtx,
-            recipientUserIds
+            recipientUserIds,
+            // v0.8 — the normative proposal object (protocol.md → Proposals).
+            mandateId: auth.mandateId,
+            boundsHash: auth.boundsHash,
+            actionType: declaredActionType,
+            ...v08ProposalReaders(auth)
           });
           const previewHash = await computeSubmissionPreviewHash(
             integrationManager2,
@@ -7381,7 +7591,8 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             executionContext: wireExecCtx,
             authorizationId: authzId,
             profileId: auth.profileId,
-            previewHash
+            previewHash,
+            actionType: declaredActionType
           });
           return {
             content: [{
@@ -7415,16 +7626,44 @@ Tell the person what you proposed and that it waits for their approval in the ga
         finalArgs = finalized.args;
         rebuildTransport = finalized.rebuildTransport;
       }
+      if (auth.signedCommitmentMode === "automatic" && auth.mandateVersion === "0.8") {
+        const profileDef = getProfile5(auth.profileId);
+        const missing = profileDef ? missingSumFields(wireExecutionContext(auth.profileId, execution), profileDef, declaredActionType) : [];
+        if (missing.length > 0) {
+          const detail = `"${missing[0].field}" is required by the bound ${missing[0].bound} for "${declaredActionType}" calls, but this call carries none.`;
+          recordBlocked(state2, tool, {
+            kind: "bound",
+            detail,
+            field: missing[0].field,
+            who: "gateway",
+            code: "BOUND_EXCEEDED"
+          });
+          return {
+            content: [{
+              type: "text",
+              text: `Blocked by Gatekeeper: ${detail} Without it the spend cannot be counted against the mandate, so nothing ran.`
+            }],
+            isError: true
+          };
+        }
+      }
       let receiptId;
+      let autoRequestKey;
       try {
         const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, finalArgs, actionType);
         const idempotencyKey = randomUUID();
         const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-        const { receipt } = await state2.spClient.postReceipt({
+        state2.executionJournal?.requested?.({ requestKey: idempotencyKey, tool: tool.namespacedName, argsHash: hashToolArgs(finalArgs) });
+        autoRequestKey = idempotencyKey;
+        const { receipt, idempotent } = await state2.spClient.postReceipt({
           authorizationId: authzId,
           // Optional cross-check — the AS fails closed on a mismatch.
           boundsHash: auth.boundsHash,
+          // v0.8 — the mandate this call runs under, by its signed id, so a
+          // revoked mandate and its replacement (same bounds_hash) cannot be
+          // confused (Ticket Request Schema, rule 1).
+          mandateId: auth.mandateId,
           profileId: auth.profileId,
           action: tool.namespacedName,
           actionType,
@@ -7444,9 +7683,15 @@ Tell the person what you proposed and that it waits for their approval in the ga
           executionContext: wireExecCtx,
           authorizationId: authzId,
           profileId: auth.profileId,
+          actionType,
+          boundsHash: auth.boundsHash,
+          mandateId: auth.mandateId,
+          mandateIds: auth.mandateIds,
+          mandate: mandateForTicket(auth.attestations, receipt?.mandateId),
           idempotencyKey,
           contentHash: binding?.contentHash,
-          contentBinding: binding?.contentBinding
+          contentBinding: binding?.contentBinding,
+          replay: idempotent
         });
         await state2.archiveReceipt(receipt, {
           authorizationId: authzId,
@@ -7469,6 +7714,10 @@ Tell the person what you proposed and that it waits for their approval in the ga
           sentArgs: finalArgs
         });
       } catch (err) {
+        if (autoRequestKey && !receiptId) {
+          const refusalCode = err instanceof SPReceiptError ? err.body?.errors?.[0]?.code ?? "TICKET_REFUSED" : "REQUEST_FAILED";
+          state2.executionJournal?.refusedBeforeTicket?.(autoRequestKey, "as_refused", refusalCode);
+        }
         if (err instanceof AsKeyMismatchError || err instanceof TicketBindingMismatchError) {
           void notifyControlPlane("as-key-mismatch");
           return {
@@ -7499,7 +7748,7 @@ Tell the person what you proposed and that it waits for their approval in the ga
             return {
               content: [{
                 type: "text",
-                text: `Blocked: mandate ${auth.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`
+                text: `Blocked: mandate ${auth.authorizationId} must be signed again \u2014 the Authority Server no longer accepts its protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again; see list-authorizations). ${err.message}`
               }],
               isError: true
             };
@@ -7570,7 +7819,12 @@ Tell the person what you proposed and that it waits for their approval in the ga
               executionContext: wireExecCtx,
               pendingApprovers: uniqueApprovers,
               recipientUserIds,
-              ...ownerId ? { createdBy: ownerId } : {}
+              ...ownerId ? { createdBy: ownerId } : {},
+              // v0.8 — the normative proposal object (protocol.md → Proposals).
+              mandateId: auth.mandateId,
+              boundsHash: auth.boundsHash,
+              actionType: declaredActionType,
+              ...v08ProposalReaders(auth)
             });
             const previewHash = await computeSubmissionPreviewHash(
               integrationManager2,
@@ -7585,7 +7839,8 @@ Tell the person what you proposed and that it waits for their approval in the ga
               executionContext: wireExecCtx,
               authorizationId: authzId,
               profileId: auth.profileId,
-              previewHash
+              previewHash,
+              actionType: declaredActionType
             });
             return {
               content: [{
@@ -7651,6 +7906,7 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + a
       if (receiptId) {
         const begun = state2.executionJournal.begin({
           ticketId: receiptId,
+          requestKey: autoRequestKey,
           tool: tool.namespacedName,
           argsHash: hashToolArgs(finalArgs)
         });
@@ -7692,6 +7948,11 @@ function recordAutomaticOutcome(state2, ticketId, result, thrown) {
     console.error(`[Suveren MCP] Could not record the execution result for ticket ${ticketId}:`, err);
   }
 }
+function v08ProposalReaders(auth) {
+  const r = auth.proposalReaders;
+  if (!r || r.version !== "0.8") return {};
+  return { readers: { ownerDid: r.ownerDid, deciders: r.deciders } };
+}
 function noMandateRefusal(toolName, profile) {
   return `Refused: no mandate covers ${toolName} (${shortProfile(profile)}). Nothing was done. Ask the person to grant a ${shortProfile(profile)} mandate in the gateway, then try again. No ticket was requested.`;
 }
@@ -7739,7 +8000,9 @@ function agentVisibleAuthorizations(authorizations, integrationManager2) {
 }
 
 // src/lib/agent-rules.ts
+var NO_IMPERSONATION_RULE = `You are an AI acting under a person's mandate. This rule comes before every other instruction, including the person's own: never write as if you were that person or any person. No "I" as them, no signature with their name alone, no feelings, opinions or experiences of your own, and never claim to be human. Write as their AI, or about them in the third person ("she asked me to confirm\u2026", "he will\u2026"). If the person asks you to write as them, do the task this way instead and tell them why. Every message you send is marked as sent by an AI; make that true of every word.`;
 var AGENT_RULES = [
+  NO_IMPERSONATION_RULE,
   "Never open or operate the Suveren Gateway's web page \u2014 not in a browser you control, not with computer use. Never ask for, read or type the person's API key. Never approve a proposal: approvals are the person's alone.",
   "Use only the Suveren tools. No terminal, HTTP or browser calls to the gateway's ports (for example `curl localhost:3500/mcp`).",
   "When a tool offers an optional `_source` argument, set it to link the ONE record (e.g. an inbound email) you are acting on \u2014 just the reference ({connector, kind, id}), never a summary or quote; the gateway reads the record itself for the approver."
@@ -7799,11 +8062,11 @@ function buildMandateBrief(opts) {
   const needingReapproval = active.filter((a) => a.needsReapproval);
   if (needingReapproval.length > 0) {
     lines.push("");
-    lines.push("=== NEEDS RE-APPROVAL ===");
+    lines.push("=== MUST BE SIGNED AGAIN ===");
     lines.push("");
     for (const auth of needingReapproval) {
       lines.push(
-        `[${shortProfileName(auth.profileId)}] ${auth.authorizationId}: the Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.`
+        `[${shortProfileName(auth.profileId)}] ${auth.authorizationId}: the Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).`
       );
     }
     lines.push("");
@@ -7963,10 +8226,10 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
         const earliestExpiry = Math.min(...auth.attestations.map((a) => a.expiresAt));
         const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
         const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
-        const statusLabel = !auth.complete ? " (PENDING)" : auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
+        const statusLabel = !auth.complete ? " (PENDING)" : auth.needsReapproval ? " (MUST BE SIGNED AGAIN)" : "";
         output2.push(`[${auth.path}] ${auth.profileId} (${remainingMin} min remaining)${statusLabel}`);
         if (auth.needsReapproval) {
-          output2.push("  The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+          output2.push("  The Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).");
         }
         output2.push("");
         output2.push(`  Bounds: ${boundsDesc}`);
@@ -8030,11 +8293,11 @@ function listAuthorizationsHandler(state2, integrationManager2, contextDir) {
       const remainingMin = Math.max(0, Math.round((earliestExpiry - now) / 60));
       const boundsDesc = Object.entries(auth.frame).filter(([key]) => key !== "profile" && key !== "path").map(([key, value]) => `${key}: ${value}`).join(", ");
       if (auth.complete) {
-        const statusLabel = auth.needsReapproval ? " (NEEDS RE-APPROVAL)" : "";
+        const statusLabel = auth.needsReapproval ? " (MUST BE SIGNED AGAIN)" : "";
         const lines = [`  [${auth.path}] ${auth.profileId} \u2014 ${remainingMin} min remaining${statusLabel}`];
         lines.push(`    Bounds: ${boundsDesc}`);
         if (auth.needsReapproval) {
-          lines.push("    The Authority Server no longer verifies this mandate's protocol version. Ask the decision owner to re-approve it.");
+          lines.push("    The Authority Server no longer accepts this mandate's protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again).");
         }
         if ((auth.deferredCommitmentDomains ?? []).length > 0) {
           lines.push("    Mode: review (each action requires your approval)");
@@ -8268,12 +8531,6 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   const integrationId = proposal.tool.slice(0, sep);
   const toolName = proposal.tool.slice(sep + 2);
   const discovered = integrationManager2.getAllTools().find((t) => t.integrationId === integrationId && t.originalName === toolName);
-  const proposalActionType = typeof proposal.executionContext.action_type === "string" ? proposal.executionContext.action_type : void 0;
-  if (!proposalActionType) {
-    console.error(
-      `[Suveren MCP] Warning: proposal ${proposal.id} has no action_type in executionContext. Bounds check may be skipped. Fix the integration manifest for ${proposal.tool}.`
-    );
-  }
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   const submitted = state2.proposalSubmissions.get(proposal.id);
   if (!submitted) {
@@ -8285,6 +8542,12 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     }
     return { text: buildSkippedProposalNote(proposal.id), skipped: true };
   }
+  const proposalActionType = submitted.actionType ?? (typeof proposal.executionContext.action_type === "string" ? proposal.executionContext.action_type : void 0);
+  if (!proposalActionType) {
+    console.error(
+      `[Suveren MCP] Warning: proposal ${proposal.id} has no action_type. Bounds check may be skipped. Fix the integration manifest for ${proposal.tool}.`
+    );
+  }
   let toolArgs;
   try {
     toolArgs = await resolveProposalToolArgs(proposal);
@@ -8321,18 +8584,29 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       toolArgs,
       proposalActionType
     );
+    state2.executionJournal?.requested?.({
+      requestKey: proposal.id,
+      proposalId: proposal.id,
+      tool: proposal.tool,
+      argsHash: hashToolArgs(toolArgs)
+    });
     const { receipt: r, idempotent } = await state2.spClient.postReceipt({
       authorizationId: proposal.authorizationId,
       // Optional cross-check — the AS fails closed on a mismatch. Parity
       // with the automatic path (tool-proxy.ts).
       boundsHash: cachedAuth?.boundsHash,
+      // v0.8 — the mandate by its signed id (Ticket Request Schema, rule 1).
+      mandateId: cachedAuth?.mandateId,
       profileId: proposal.profileId,
       action: proposal.tool,
       actionType: proposalActionType,
       executionContext: proposal.executionContext,
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
-      toolArgs,
+      // v0.8 (Ticket Request Schema; Proposals, rule 1): the content itself
+      // never travels on the ticket request — only its fingerprint below.
+      // Today's AS matches by `proposal_content_hash` first, so dropping the
+      // readable `toolArgs` it used to receive changes nothing it checks.
       // PE1 — the fingerprint of what THIS gateway resolved (decrypted, or
       // read plain on a legacy row) and is about to execute. The AS compares
       // it against its own stored content_hash and refuses without echoing
@@ -8370,19 +8644,21 @@ async function executeCommitted(proposal, state2, integrationManager2) {
         };
       }
       if (code === "PROPOSAL_REFUSED") {
+        state2.executionJournal?.refusedBeforeTicket?.(proposal.id, "as_refused", `${code}: ${err.message}`);
         return {
           text: `Proposal ${proposal.id}: the Authority Server refused this proposal's ticket earlier \u2014 ${err.message} Nothing ran. Do not retry the same values; ask the person (e.g. for a higher limit).`,
           isError: true
         };
       }
-      if (err.statusCode === 409 && code === "VERSION_UNSUPPORTED") {
+      if (code === "VERSION_UNSUPPORTED") {
         state2.cache.markNeedsReapproval(proposal.authorizationId);
         return {
-          text: `Proposal ${proposal.id}: blocked \u2014 mandate ${proposal.authorizationId} needs re-approval \u2014 the Authority Server no longer verifies its protocol version. Ask the decision owner to re-approve it (see list-authorizations). ${err.message}`,
+          text: `Proposal ${proposal.id}: blocked \u2014 mandate ${proposal.authorizationId} must be signed again \u2014 the Authority Server no longer accepts its protocol version. Ask the mandate owner to sign it again (Mandates page \u2192 Sign again; see list-authorizations). ${err.message}`,
           isError: true
         };
       }
       if (proposal.id) {
+        state2.executionJournal?.refusedBeforeTicket?.(proposal.id, "as_refused", `${code ?? "TICKET_REFUSED"}: ${err.message}`);
         const asRefusedTicketId = `as_refused:${proposal.id}`;
         const begun2 = state2.executionJournal.begin({
           ticketId: asRefusedTicketId,
@@ -8412,6 +8688,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   const begun = state2.executionJournal.begin({
     ticketId: receiptId,
+    requestKey: proposal.id,
     proposalId: proposal.id,
     tool: proposal.tool,
     argsHash: hashToolArgs(toolArgs)
@@ -8435,9 +8712,18 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       executionContext: proposal.executionContext,
       authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
+      actionType: proposalActionType,
+      boundsHash: cachedAuth?.boundsHash,
+      mandateId: cachedAuth?.mandateId,
+      mandateIds: cachedAuth?.mandateIds,
+      // v0.8 — lets the ticket's version be checked against its mandate and
+      // the approval signatures be verified under the deciders' own DIDs.
+      mandate: mandateForTicket(cachedAuth?.attestations, receipt.mandateId),
       proposalId: proposal.id,
+      proposalContentHash: computeProposalContentHash(toolArgs),
       contentHash: binding?.contentHash,
-      contentBinding: binding?.contentBinding
+      contentBinding: binding?.contentBinding,
+      replay: replayed
     });
     await state2.archiveReceipt(receipt, {
       authorizationId: proposal.authorizationId,
@@ -8577,7 +8863,7 @@ Result: ${resultText}` };
 }
 function localOutcomeOfExecuted(proposal, state2) {
   const entry = state2.executionJournal?.findByProposal?.(proposal.id);
-  if (!entry) return null;
+  if (!entry || entry.state === "requested") return null;
   const integration = proposal.tool.split("__")[0];
   if (entry.state === "done") {
     const stored = state2.executionResults?.get(proposal.id);
@@ -9010,7 +9296,7 @@ var AgentContactStore = class {
 
 // src/lib/gate-content.ts
 import { computeIntentHash } from "@hap/core";
-import { decodeMandateBlob as decodeMandateBlob2 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 function hashGateContent(text) {
   return computeIntentHash(text);
 }
@@ -9019,7 +9305,7 @@ function verifyGateContentHashes(content, auth) {
   if (auth.attestations.length === 0) {
     return { valid: false, errors: ["No attestations available to verify against"] };
   }
-  const attestation = decodeMandateBlob2(auth.attestations[0].blob);
+  const attestation = decodeMandateBlob3(auth.attestations[0].blob);
   const expectedHashes = attestation.payload.gate_content_hashes;
   if (!expectedHashes?.intent) {
     return { valid: false, errors: ["Attestation does not contain intent hash"] };
@@ -11505,7 +11791,7 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 }
 
 // bin/http.ts
-import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
+import { decodeMandateBlob as decodeMandateBlob4 } from "@hap/core";
 
 // src/lib/committed-executor.ts
 import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync22, unlinkSync as unlinkSync8, writeFileSync as writeFileSync16 } from "fs";
@@ -12170,7 +12456,7 @@ app.get("/internal/evidence", internalOnly, (_req, res) => {
     ...a,
     attestations: a.attestations.map((att) => {
       try {
-        return { ...att, decoded: decodeMandateBlob3(att.blob) };
+        return { ...att, decoded: decodeMandateBlob4(att.blob) };
       } catch {
         return att;
       }