@suveren/gateway 0.7.6 → 0.8.1

package/dist/mcp-server/http.mjs

@@ -33,6 +33,85 @@ async function notifyControlPlane(type) {
   }
 }
 
+// src/lib/client-version.ts
+import { createRequire } from "module";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var UNKNOWN = "unknown";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function detectGatewayVersion() {
+  const override = process.env.SUVEREN_GATEWAY_VERSION;
+  if (override) return override;
+  const start = import.meta.dirname ?? process.cwd();
+  let dir = start;
+  for (let up = 0; up < 6; up++) {
+    const pkg = readJson(join(dir, "package.json"));
+    const name = pkg?.name;
+    const version = pkg?.version;
+    if (typeof version === "string" && (name === "@suveren/gateway" || name === "suveren-gateway")) {
+      return version;
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.env.HAP_BUILD_SHA ?? UNKNOWN;
+}
+function findPackageVersion(entry, wantName) {
+  let dir = join(entry, "..");
+  for (let up = 0; up < 6; up++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      const pkg = readJson(candidate);
+      if (typeof pkg?.version === "string" && (pkg.name === wantName || pkg.name === "@hap/core")) {
+        return pkg.name === wantName ? pkg.version : null;
+      }
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function detectHapCoreVersion() {
+  const CORE = "@humanagencyp/hap-core";
+  let req;
+  try {
+    req = createRequire(import.meta.url);
+  } catch {
+    return UNKNOWN;
+  }
+  try {
+    const v = findPackageVersion(req.resolve(CORE), CORE);
+    if (v) return v;
+  } catch {
+  }
+  try {
+    const wrapperEntry = req.resolve("@hap/core");
+    const v = findPackageVersion(wrapperEntry, CORE);
+    if (v) return v;
+    const wrapperReq = createRequire(wrapperEntry);
+    const v2 = findPackageVersion(wrapperReq.resolve(CORE), CORE);
+    if (v2) return v2;
+  } catch {
+  }
+  return UNKNOWN;
+}
+var GATEWAY_VERSION = detectGatewayVersion();
+var HAP_CORE_VERSION = detectHapCoreVersion();
+function clientVersionHeaders() {
+  return {
+    "x-suveren-gateway-version": GATEWAY_VERSION,
+    "x-hap-core-version": HAP_CORE_VERSION
+  };
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -82,6 +161,11 @@ var SPClient = class {
     const url = `${this.baseUrl}${path}`;
     const headers = {
       "Content-Type": "application/json",
+      // Identify the caller so the AS can answer "what is deployed against
+      // me?" and name a version in an upgrade instruction. Advisory only —
+      // never used for authorization. Sent on every call, not just receipts,
+      // so the picture is not skewed toward one endpoint.
+      ...clientVersionHeaders(),
       ...init?.headers
     };
     if (this.sessionCookie) {
@@ -170,7 +254,10 @@ var SPClient = class {
         const message = first?.message ?? first?.code ?? respBody.error ?? `SP receipt request failed: ${res.status}`;
         throw new SPReceiptError(message, res.status, respBody);
       }
-      return { receipt: respBody.receipt };
+      return {
+        receipt: respBody.receipt,
+        idempotent: respBody.idempotent === true
+      };
     }
     throw lastError ?? new Error("postReceipt: retries exhausted");
   }
@@ -378,11 +465,11 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, unlinkSync } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join2(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
@@ -400,11 +487,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync(this.encryptedFilePath)) {
+    if (existsSync2(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync(this.plaintextFilePath)) {
+      if (existsSync2(this.plaintextFilePath)) {
         try {
           unlinkSync(this.plaintextFilePath);
         } catch {
@@ -455,19 +542,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join(this.baseDir, "gates.json");
+    return join2(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join(this.baseDir, "gates.enc.json");
+    return join2(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync(this.plaintextFilePath)) {
+    if (!existsSync2(this.plaintextFilePath)) {
       mkdirSync(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -476,9 +563,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync(this.encryptedFilePath)) return;
+    if (!existsSync2(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -519,11 +606,11 @@ var GateStore = class {
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -542,11 +629,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync2(this.encryptedFilePath)) {
+    if (existsSync3(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync2(this.plaintextFilePath)) {
+      if (existsSync3(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -641,19 +728,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join2(this.baseDir, "execution-log.json");
+    return join3(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join2(this.baseDir, "execution-log.enc.json");
+    return join3(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync2(this.plaintextFilePath)) {
+    if (!existsSync3(this.plaintextFilePath)) {
       mkdirSync2(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -663,9 +750,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync2(this.encryptedFilePath)) return;
+    if (!existsSync3(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -712,11 +799,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -729,11 +816,11 @@ var DenialLog = class {
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -783,18 +870,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join3(this.baseDir, "denials.json");
+    return join4(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "denials.enc.json");
+    return join4(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
+    if (!existsSync4(this.plaintextFilePath)) {
       mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync3(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -802,9 +889,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync3(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -830,11 +917,11 @@ var DenialLog = class {
 };
 
 // src/lib/receipt-archive.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync4, unlinkSync as unlinkSync4 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
+import { dirname as dirname4, join as join5 } from "path";
 import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
 function stripPreviews(proposal) {
   const args = proposal.toolArgs;
   if (!args || typeof args !== "object") return proposal;
@@ -859,11 +946,11 @@ var ReceiptArchive = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync4(this.encryptedFilePath)) {
+    if (existsSync5(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
       this.persistEncrypted();
-      if (existsSync4(this.plaintextFilePath)) {
+      if (existsSync5(this.plaintextFilePath)) {
         try {
           unlinkSync4(this.plaintextFilePath);
         } catch {
@@ -877,7 +964,7 @@ var ReceiptArchive = class {
    * this state — that would report a hollow success over unreadable evidence.
    */
   isLocked() {
-    return this.vaultKey === null && existsSync4(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync5(this.encryptedFilePath);
   }
   /**
    * Archive a signed receipt (and the grant it was issued under).
@@ -978,19 +1065,19 @@ var ReceiptArchive = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join4(this.baseDir, "receipt-archive.json");
+    return join5(this.baseDir, "receipt-archive.json");
   }
   get encryptedFilePath() {
-    return join4(this.baseDir, "receipt-archive.enc.json");
+    return join5(this.baseDir, "receipt-archive.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync4(this.plaintextFilePath)) {
+    if (!existsSync5(this.plaintextFilePath)) {
       mkdirSync4(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync4(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.data = {
         version: 1,
@@ -1002,16 +1089,16 @@ var ReceiptArchive = class {
       try {
         writeFileSync4(
           `${this.plaintextFilePath}.corrupt-${Date.now()}`,
-          readFileSync4(this.plaintextFilePath)
+          readFileSync5(this.plaintextFilePath)
         );
       } catch {
       }
     }
   }
   loadEncrypted() {
-    if (!existsSync4(this.encryptedFilePath)) return;
+    if (!existsSync5(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync4(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -1025,7 +1112,7 @@ var ReceiptArchive = class {
       try {
         writeFileSync4(
           `${this.encryptedFilePath}.corrupt-${Date.now()}`,
-          readFileSync4(this.encryptedFilePath)
+          readFileSync5(this.encryptedFilePath)
         );
       } catch {
       }
@@ -1052,12 +1139,106 @@ var ReceiptArchive = class {
   }
 };
 
+// src/lib/execution-journal.ts
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6, renameSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname5, join as join6 } from "path";
+import { createHash } from "crypto";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
+var FILE_NAME = "execution-journal.json";
+var MAX_AGE_SECONDS2 = 90 * 24 * 60 * 60;
+function hashToolArgs(args) {
+  return "sha256:" + createHash("sha256").update(stableStringify(args)).digest("hex");
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
+  if (Array.isArray(value)) return "[" + value.map(stableStringify).join(",") + "]";
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+}
+var ExecutionJournal = class {
+  filePath;
+  constructor(filePath) {
+    const baseDir = filePath && filePath.endsWith(".json") ? dirname5(filePath) : filePath ?? DEFAULT_DIR5;
+    this.filePath = join6(baseDir, FILE_NAME);
+  }
+  /** Look a ticket up. Always reads from disk — another process may have written. */
+  get(ticketId) {
+    return this.load().entries.find((e) => e.ticketId === ticketId);
+  }
+  /**
+   * Record intent to execute under `ticketId`. Refuses if any row for that
+   * ticket already exists, whatever its state — deciding what an existing row
+   * means is the caller's job, and it differs by state (see commitments.ts).
+   */
+  begin(entry) {
+    const file = this.load();
+    const existing = file.entries.find((e) => e.ticketId === entry.ticketId);
+    if (existing) return { ok: false, existing };
+    file.entries.push({
+      ...entry,
+      state: "intent",
+      startedAt: nowSec(),
+      pid: process.pid
+    });
+    this.persist(file);
+    return { ok: true };
+  }
+  /** Close an `intent` row. Missing row is a programming error, not a silent no-op. */
+  complete(ticketId, state2) {
+    const file = this.load();
+    const row = file.entries.find((e) => e.ticketId === ticketId);
+    if (!row) throw new Error(`execution journal: no row for ticket ${ticketId} to complete`);
+    row.state = state2;
+    row.finishedAt = nowSec();
+    this.persist(file);
+  }
+  /** All rows, newest last. Diagnostic. */
+  getAll() {
+    return [...this.load().entries];
+  }
+  // ─── Persistence ────────────────────────────────────────────────────────
+  load() {
+    if (!existsSync6(this.filePath)) return { version: 1, entries: [] };
+    try {
+      const parsed = JSON.parse(readFileSync6(this.filePath, "utf8"));
+      if (parsed?.version !== 1 || !Array.isArray(parsed.entries)) {
+        throw new Error("unexpected shape");
+      }
+      return parsed;
+    } catch (err) {
+      throw new Error(
+        `execution journal at ${this.filePath} is unreadable (${err instanceof Error ? err.message : String(err)}); refusing to execute until it is inspected`
+      );
+    }
+  }
+  persist(file) {
+    const cutoff = nowSec() - MAX_AGE_SECONDS2;
+    file.entries = file.entries.filter((e) => e.startedAt >= cutoff);
+    mkdirSync5(dirname5(this.filePath), { recursive: true, mode: 448 });
+    const tmp = this.filePath + ".tmp";
+    writeFileSync5(tmp, JSON.stringify(file, null, 2), { mode: 384 });
+    renameSync(tmp, this.filePath);
+  }
+};
+function nowSec() {
+  return Math.floor(Date.now() / 1e3);
+}
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
-  constructor(cache, executionLog) {
+  /**
+   * No ExecutionLog dependency by construction. The local record is
+   * display-only (protocol.md → "Executor Gating, Context vs Bounds,
+   * Display-Only Logs"), so the Gatekeeper must not be able to read it: with
+   * no log in scope, a local cumulative check cannot be reintroduced by
+   * accident. `SharedState.executionLog` stays — it feeds the UI's consumption
+   * display and nothing else.
+   */
+  constructor(cache) {
     this.cache = cache;
-    this.executionLog = executionLog;
   }
   /**
    * Verify an execution request against a cached authorization.
@@ -1104,16 +1285,15 @@ var MCPGatekeeper = class {
       attestations: auth.attestations.map((a) => a.blob),
       execution,
       context: resolvedContext,
-      // Scopes the local cumulative check to the same (profileId, path) key the
-      // ExecutionLog records under (see tool-proxy's record call). It cannot go
-      // inside `frame`: that is validated against the profile's boundsSchema,
-      // which declares no `path` field in any shipped profile, so an extra key
-      // there fails verification with "Unknown field". Omitting it entirely —
-      // the previous behaviour — made every cumulative lookup return zero, so
-      // the local gate never fired and the AS was doing all the enforcing.
+      // Identifies the grant whose bounds are being checked. hap-core reads it
+      // only to scope a cumulative lookup, which no longer happens here (see
+      // below); it is kept because it belongs to the request, not to the
+      // dropped check. It cannot go inside `frame`: that is validated against
+      // the profile's boundsSchema, which declares no `path` field in any
+      // shipped profile, so an extra key there fails with "Unknown field".
       path: auth.path
     };
-    const result = await verify(request, publicKeyHex, void 0, this.executionLog);
+    const result = await verify(request, publicKeyHex);
     return { result, authorization: auth };
   }
 };
@@ -1126,6 +1306,8 @@ var SharedState = class {
   executionLog;
   denialLog;
   receiptArchive;
+  /** Which tickets this Gatekeeper has executed — the "one execution per ticket" half of exactly-once. */
+  executionJournal;
   gatekeeper;
   constructor(spUrl2, gateStorePath) {
     this.spClient = new SPClient(spUrl2);
@@ -1134,7 +1316,8 @@ var SharedState = class {
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
     this.receiptArchive = new ReceiptArchive(gateStorePath);
-    this.gatekeeper = new MCPGatekeeper(this.cache, this.executionLog);
+    this.executionJournal = new ExecutionJournal(gateStorePath);
+    this.gatekeeper = new MCPGatekeeper(this.cache);
   }
   /**
    * Archive a signed receipt into the local receipt archive — the subject's
@@ -1282,17 +1465,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
-var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
+import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+var DEFAULT_DIR6 = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir) {
-  const dir = dataDir ?? DEFAULT_DIR5;
-  const filePath = join5(dir, "context.md");
-  if (!existsSync5(filePath)) return null;
+  const dir = dataDir ?? DEFAULT_DIR6;
+  const filePath = join7(dir, "context.md");
+  if (!existsSync7(filePath)) return null;
   try {
-    const content = readFileSync5(filePath, "utf-8").trim();
+    const content = readFileSync7(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -1933,10 +2116,11 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
     return inner(args);
   };
   if (category === "disabled") {
+    const reason = tool.gating.disabledReason;
     return async () => ({
       content: [{
         type: "text",
-        text: `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
+        text: reason ? `Tool "${tool.namespacedName}" is refused: ${reason}. A tool that no manifest entry describes cannot be gated \u2014 there is nothing declaring which action type it performs or how its arguments map to the bounds. Add an entry for "${tool.originalName}" under this integration's toolGating.overrides (with "category": "read" for a read-only tool) before it can be used.` : `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
       }],
       isError: true
     });
@@ -2257,7 +2441,12 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           executionContext: { ...execution },
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
           idempotencyKey: randomUUID(),
-          ...binding ?? {}
+          // Privacy: send the hash and how to reproduce it — never the
+          // preimage. `binding` also carries `boundContent`, the plaintext
+          // that was hashed (an email's to/cc/subject/body); it stays on
+          // this machine for the local archive, so it must be picked out
+          // field by field rather than spread.
+          ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
         await state2.archiveReceipt(receipt, {
@@ -2362,6 +2551,30 @@ Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
       let outgoingArgs = shouldAttachFooter() && receiptId ? appendVerificationFooter(tool, args, receiptId, auth.subjects?.[0]) : args;
       if (receiptId) outgoingArgs = attachReceiptId(tool, outgoingArgs, receiptId);
       outgoingArgs = encodeOutgoingArgs(tool, outgoingArgs);
+      if (receiptId) {
+        const begun = state2.executionJournal.begin({
+          ticketId: receiptId,
+          tool: tool.namespacedName,
+          argsHash: hashToolArgs(args)
+        });
+        if (!begun.ok) {
+          return {
+            content: [{
+              type: "text",
+              text: `Blocked: ticket ${receiptId} was already used to execute ${tool.namespacedName} (state: ${begun.existing.state}). Not running it again.`
+            }],
+            isError: true
+          };
+        }
+        try {
+          const result = await integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
+          state2.executionJournal.complete(receiptId, "done");
+          return result;
+        } catch (err) {
+          state2.executionJournal.complete(receiptId, "failed");
+          throw err;
+        }
+      }
       return integrationManager2.callTool(tool.integrationId, tool.originalName, outgoingArgs);
     }
   });
@@ -2407,7 +2620,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   const shortName = shortProfileName2(profileId);
   const gated = [];
   const readOnly = [];
-  const defaultGated = [];
+  const undescribed = [];
   for (const tool of allTools) {
     if (!tool.gating || !tool.gating.profile) {
       continue;
@@ -2429,12 +2642,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
       const actionType = override.staticExecution?.action_type ?? "unknown";
       gated.push(`      - ${tool.originalName}: ${actionType}${mappingDesc ? `, ${mappingDesc}` : ""}`);
     } else {
-      const defaultAction = toolGating.default.staticExecution?.action_type;
-      if (defaultAction === "read" && Object.keys(toolGating.default.executionMapping ?? {}).length === 0) {
-        defaultGated.push(tool.originalName);
-      } else {
-        gated.push(`      - ${tool.originalName}: ${defaultAction ?? "default"} (default gating)`);
-      }
+      undescribed.push(tool.originalName);
     }
   }
   const lines = [];
@@ -2446,10 +2654,12 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   if (readOnly.length > 0) {
     lines.push(`    Read-only (no authorization needed): ${readOnly.join(", ")}`);
   }
-  if (defaultGated.length > 0) {
-    lines.push(`    Default-gated (action_type: ${toolGating.default.staticExecution?.action_type ?? "read"}): ${defaultGated.join(", ")}`);
+  if (undescribed.length > 0) {
+    lines.push(
+      `    Refused (no manifest entry \u2014 do not call): ${undescribed.join(", ")}`
+    );
   }
-  if (gated.length === 0 && readOnly.length === 0 && defaultGated.length === 0) {
+  if (gated.length === 0 && readOnly.length === 0 && undescribed.length === 0) {
     lines.push("    No tools discovered for this profile.");
   }
   return lines.join("\n");
@@ -2693,6 +2903,13 @@ function listIntegrationsHandler(state2, integrationManager2) {
 
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
+var installedExecutor = null;
+function installCommittedExecutor(executor) {
+  installedExecutor = executor;
+}
+function runCommitted(proposal, state2, integrationManager2) {
+  return installedExecutor ? installedExecutor.execute(proposal) : executeCommitted(proposal, state2, integrationManager2);
+}
 async function executeCommitted(proposal, state2, integrationManager2) {
   if (!integrationManager2) {
     return { text: `Proposal ${proposal.id} committed but integration manager unavailable for execution.`, isError: true };
@@ -2712,6 +2929,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   }
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   let receiptId;
+  let replayed = false;
   try {
     const binding = computeContentBinding(
       proposal.profileId,
@@ -2719,7 +2937,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       proposal.toolArgs,
       proposalActionType
     );
-    const { receipt } = await state2.spClient.postReceipt({
+    const { receipt, idempotent } = await state2.spClient.postReceipt({
       authorizationId: proposal.authorizationId,
       // Optional cross-check — the AS fails closed on a mismatch. Parity
       // with the automatic path (tool-proxy.ts).
@@ -2738,9 +2956,13 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       // SPClient therefore treats proposalId as retry-safe on its own; a
       // PROPOSAL_ALREADY_EXECUTED answer is still a definitive rejection
       // (never retried) and means a *different* caller consumed the proposal.
-      ...binding ?? {}
+      // Privacy: hash + how to reproduce it only. `binding.boundContent` is
+      // the plaintext preimage (what the human approved) and never leaves
+      // this machine — see the archive call below.
+      ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+    replayed = idempotent;
     await state2.archiveReceipt(receipt, {
       authorizationId: proposal.authorizationId,
       profileId: proposal.profileId,
@@ -2778,6 +3000,36 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       isError: true
     };
   }
+  if (!receiptId) {
+    return {
+      text: `Proposal ${proposal.id}: the ticket carries no id \u2014 refusing to execute an action that could not be recorded.`,
+      isError: true
+    };
+  }
+  const begun = state2.executionJournal.begin({
+    ticketId: receiptId,
+    proposalId: proposal.id,
+    tool: proposal.tool,
+    argsHash: hashToolArgs(proposal.toolArgs)
+  });
+  if (!begun.ok) {
+    const prior = begun.existing;
+    const when = new Date(prior.startedAt * 1e3).toISOString();
+    if (prior.state === "done") {
+      return {
+        text: `Proposal ${proposal.id} was already executed under ticket ${receiptId} at ${when}. Not running it again.`
+      };
+    }
+    return {
+      text: `Proposal ${proposal.id}: an execution under ticket ${receiptId} started at ${when} (pid ${prior.pid}) and ${prior.state === "failed" ? "reported failure" : "never reported completion"}. Not re-running: the action may already have taken effect. Check the downstream system before deciding.`,
+      isError: true
+    };
+  }
+  if (replayed) {
+    console.error(
+      `[Suveren MCP] Proposal ${proposal.id}: ticket ${receiptId} was replayed by the AS with no local execution record \u2014 executing once (lost-response recovery).`
+    );
+  }
   try {
     let outgoingArgs = proposal.toolArgs;
     if (discovered && receiptId) {
@@ -2787,7 +3039,14 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       outgoingArgs = attachReceiptId(discovered, outgoingArgs, receiptId);
       outgoingArgs = encodeOutgoingArgs(discovered, outgoingArgs);
     }
-    const result = await integrationManager2.callTool(integrationId, toolName, outgoingArgs);
+    let result;
+    try {
+      result = await integrationManager2.callTool(integrationId, toolName, outgoingArgs);
+    } catch (err) {
+      state2.executionJournal.complete(receiptId, "failed");
+      throw err;
+    }
+    state2.executionJournal.complete(receiptId, "done");
     state2.executionLog.record({
       profileId: proposal.profileId,
       path: proposal.path,
@@ -2822,7 +3081,7 @@ function checkPendingCommitmentsHandler(state2, integrationManager2) {
           };
         }
         if (match.status === "committed") {
-          const { text, isError } = await executeCommitted(match, state2, integrationManager2);
+          const { text, isError } = await runCommitted(match, state2, integrationManager2);
           return {
             content: [{ type: "text", text }],
             ...isError ? { isError: true } : {}
@@ -3076,16 +3335,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync5, existsSync as existsSync6 } from "fs";
-import { homedir as homedir6 } from "os";
-import { dirname as dirname5, join as join6 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync8 } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname6, join as join8 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir) {
     const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join6(dir, "integrations.json");
+    this.filePath = join8(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -3116,12 +3375,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync6(this.filePath)) {
-      mkdirSync5(dirname5(this.filePath), { recursive: true });
+    if (!existsSync8(this.filePath)) {
+      mkdirSync6(dirname6(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync6(this.filePath, "utf-8");
+      const raw = readFileSync8(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -3150,33 +3409,39 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync5(dirname5(this.filePath), { recursive: true });
-    writeFileSync5(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync6(dirname6(this.filePath), { recursive: true });
+    writeFileSync6(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir7 } from "os";
-import { join as join7, delimiter } from "path";
-import { existsSync as existsSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join9, delimiter } from "path";
+import { existsSync as existsSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync9, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join7(homedir7(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join7(DEFAULT_DATA_DIR2, "integrations");
-var INTEGRATIONS_BIN = join7(INTEGRATIONS_DIR, "node_modules", ".bin");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join9(homedir8(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join9(DEFAULT_DATA_DIR2, "integrations");
+var installLock = Promise.resolve();
+function withInstallLock(task) {
+  const run = installLock.then(task, task);
+  installLock = run.then(() => void 0, () => void 0);
+  return run;
+}
+var INTEGRATIONS_BIN = join9(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync7(INTEGRATIONS_DIR)) {
-    mkdirSync6(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync9(INTEGRATIONS_DIR)) {
+    mkdirSync7(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join7(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync7(pkgPath)) {
-    writeFileSync6(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join9(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync9(pkgPath)) {
+    writeFileSync7(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -3242,19 +3507,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join7(pkgDir, "package.json");
-    if (!existsSync7(pkgDir) || !existsSync7(pkgJson)) return false;
+    const pkgDir = join9(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join9(pkgDir, "package.json");
+    if (!existsSync9(pkgDir) || !existsSync9(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync7(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync9(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync7(join7(pkgDir, target))) return false;
+        if (!existsSync9(join9(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync7(join7(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync9(join9(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -3268,7 +3533,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync7(join7(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync9(join9(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -3285,8 +3550,15 @@ var IntegrationManager = class {
   async ensureInstalled(npmPackage) {
     ensureIntegrationsDir();
     if (this.isUsableInstall(npmPackage)) return;
-    const pkgDir = join7(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync7(pkgDir)) {
+    return withInstallLock(async () => {
+      if (this.isUsableInstall(npmPackage)) return;
+      await this.installNow(npmPackage);
+    });
+  }
+  /** The actual install. Callers MUST hold the install lock. */
+  async installNow(npmPackage) {
+    const pkgDir = join9(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync9(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3658,8 +3930,9 @@ var IntegrationManager = class {
     }
     return {
       profile: profileId,
-      executionMapping: profileGating.default.executionMapping,
-      staticExecution: profileGating.default.staticExecution
+      executionMapping: {},
+      category: "disabled",
+      disabledReason: "not described in manifest"
     };
   }
   /**
@@ -3701,28 +3974,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
-import { join as join8, resolve } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join10, resolve } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join8(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join8(dir, "index.json");
-  if (!existsSync8(indexPath)) {
+  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join10(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join10(dir, "index.json");
+  if (!existsSync10(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync8(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync10(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join8(dir, relativePath);
+    const profilePath = join10(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync8(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync10(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -3755,30 +4028,30 @@ function warnNoProfiles(reason) {
 }
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
-import { join as join9, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync11, existsSync as existsSync11 } from "fs";
+import { join as join11, resolve as resolve2 } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve2(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join11(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join9(dir, "index.json");
-  if (!existsSync9(indexPath)) {
+  const indexPath = join11(dir, "index.json");
+  if (!existsSync11(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync11(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join9(dir, relativePath);
+    const manifestPath = join11(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync9(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync11(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3797,6 +4070,90 @@ function getAllManifests() {
 
 // bin/http.ts
 import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
+
+// src/lib/committed-executor.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync8, readFileSync as readFileSync12, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join12 } from "path";
+var CommittedExecutor = class {
+  constructor(run) {
+    this.run = run;
+  }
+  inFlight = /* @__PURE__ */ new Map();
+  chain = Promise.resolve();
+  /** Execute `proposal` once, however many callers ask while it is running. */
+  execute(proposal) {
+    const existing = this.inFlight.get(proposal.id);
+    if (existing) return existing;
+    const p = this.chain.then(() => this.run(proposal)).finally(() => this.inFlight.delete(proposal.id));
+    this.chain = p.then(
+      () => void 0,
+      () => void 0
+    );
+    this.inFlight.set(proposal.id, p);
+    return p;
+  }
+  /** Proposal ids currently queued or running. Diagnostic. */
+  get pending() {
+    return [...this.inFlight.keys()];
+  }
+};
+var ExecutorLock = class {
+  path;
+  held = false;
+  constructor(dataDir) {
+    this.path = join12(dataDir, "executor.lock");
+  }
+  /** Try to take the lock. Returns the holder's pid when someone else has it. */
+  acquire() {
+    const current = this.read();
+    if (current && current.pid !== process.pid && isAlive(current.pid)) {
+      return { held: false, holderPid: current.pid };
+    }
+    mkdirSync8(dirname7(this.path), { recursive: true, mode: 448 });
+    const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
+    writeFileSync8(this.path, JSON.stringify(lock), { mode: 384 });
+    this.held = true;
+    return { held: true };
+  }
+  /** True if this process currently holds the lock (re-checks the file). */
+  isHeld() {
+    if (!this.held) return false;
+    const current = this.read();
+    return current?.pid === process.pid;
+  }
+  release() {
+    if (!this.held) return;
+    this.held = false;
+    const current = this.read();
+    if (current?.pid === process.pid) {
+      try {
+        unlinkSync5(this.path);
+      } catch {
+      }
+    }
+  }
+  read() {
+    if (!existsSync12(this.path)) return null;
+    try {
+      const parsed = JSON.parse(readFileSync12(this.path, "utf8"));
+      return typeof parsed?.pid === "number" ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+};
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+
+// bin/http.ts
+import { homedir as homedir9 } from "os";
+import { join as join13 } from "path";
 var spUrl = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
 var state = new SharedState(spUrl);
@@ -4287,12 +4644,31 @@ app.listen(port, "0.0.0.0", () => {
     }
   });
   const PROPOSAL_POLL_INTERVAL = 5e3;
+  const committedExecutor = new CommittedExecutor(
+    (proposal) => executeCommitted(proposal, state, integrationManager)
+  );
+  installCommittedExecutor(committedExecutor);
+  const dataDir = process.env.SUVEREN_DATA_DIR ?? join13(homedir9(), ".suveren");
+  const executorLock = new ExecutorLock(dataDir);
+  const lock = executorLock.acquire();
+  if (!lock.held) {
+    console.error(
+      `[Suveren MCP] Committed-proposal execution is DISABLED in this process: pid ${lock.holderPid} holds ${dataDir}/executor.lock. Approved proposals will run there. Stop that gateway if this one should execute.`
+    );
+  }
+  for (const sig of ["SIGINT", "SIGTERM", "exit"]) {
+    process.once(sig, () => executorLock.release());
+  }
+  let draining = false;
   async function executeCommittedProposals() {
+    if (!executorLock.isHeld()) return;
+    if (draining) return;
+    draining = true;
     try {
       const committed = await state.spClient.getCommittedProposals();
       for (const proposal of committed) {
         try {
-          const { text, isError } = await executeCommitted(proposal, state, integrationManager);
+          const { text, isError } = await committedExecutor.execute(proposal);
           console.error(
             isError ? `[Suveren MCP] Auto-exec proposal ${proposal.id}: ${text}` : `[Suveren MCP] Auto-executed proposal ${proposal.id}: ${proposal.tool}`
           );
@@ -4301,6 +4677,8 @@ app.listen(port, "0.0.0.0", () => {
         }
       }
     } catch {
+    } finally {
+      draining = false;
     }
   }
   setInterval(executeCommittedProposals, PROPOSAL_POLL_INTERVAL);