@verax-ai/proxy 0.3.0 → 0.4.0

package/dist/ledger.js

@@ -13,7 +13,7 @@ import { canonical, decisionRecordHash } from "@cedulon/core";
 import { coseToHex, signCoseSign1 } from "@cedulon/cose";
 import { signEffectExtract, } from "@cedulon/effect-extract";
 import { readJsonlTail, seekOffsetByTimestamp } from "./jsonl-tail.js";
-import { copyRel, decisionIndexCount, DEFAULT_PIECE_MAX_BYTES, DEFAULT_PIECE_MAX_ROWS, indexPath, LEGACY_PIECE_ID, legacyPieceRow, newPieceRow, nextPieceId, pieceOverlaps, readLedgerIndex, readLedgerManifest, writeLedgerManifest, } from "./ledger-manifest.js";
+import { copyRel, decisionIndexCount, DEFAULT_PIECE_MAX_BYTES, DEFAULT_PIECE_MAX_ROWS, indexPath, LEGACY_PIECE_ID, legacyPieceRow, newPieceRow, nextPieceId, pieceOverlaps, readLedgerIndex, readLedgerManifest, requireLedgerPiecePath, writeLedgerManifest, } from "./ledger-manifest.js";
 import { tenantKey } from "./tenant.js";
 import { sha256Canonical } from "./hash.js";
 import { SerialQueue } from "./serial-queue.js";
@@ -63,7 +63,7 @@ export function readLedgerTail(path, visit, chunkBytesOrOpts) {
     return readJsonlTail(path, visit, { open: ledgerFs.open, ...opts });
 }
 async function readPieceWindow(dir, piece, fileRel, toMs, tsOf, visit) {
-    const path = join(dir, fileRel);
+    const path = requireLedgerPiecePath(dir, fileRel);
     const seekTarget = toMs + WINDOW_SLACK_MS;
     if (piece.lastMs !== null && seekTarget < piece.lastMs) {
         const endOffset = await seekOffsetByTimestamp(path, seekTarget, tsOf, { open: ledgerFs.open });
@@ -263,7 +263,7 @@ export class MemoryLedger {
                 effectClass: "duplicate-effect",
                 timestampMs: row.timestampMs,
                 actor: row.actor,
-            }, DEFAULT_WITNESS, resultHash, undefined));
+            }, DEFAULT_WITNESS, resultHash, this.effectSigner));
             throw new Error(`duplicate-effect:${row.ref}`);
         }
         this._effects.push(asStoredEffect(row, witnessClass, resultHash, this.effectSigner));
@@ -380,7 +380,7 @@ export class FileLedger {
     inputsPaths() {
         return {
             active: this.inputsPath,
-            all: this.pieces.map((p) => join(this.dir, p.inputs)),
+            all: this.pieces.map((p) => this.pieceFile(p.inputs)),
         };
     }
     /** After lock handoff a new instance reloads; the lost owner cannot append. */
@@ -456,11 +456,15 @@ export class FileLedger {
     applyActivePaths() {
         const piece = this.pieces.find((p) => p.id === this.activeId) ?? this.pieces[this.pieces.length - 1];
         this.activeId = piece.id;
-        this.decisionsPath = join(this.dir, piece.decisions);
-        this.effectsPath = join(this.dir, piece.effects);
-        this.inputsPath = join(this.dir, piece.inputs);
-        this.copyDecisionsPath = join(this.dir, copyRel(piece.id, "decisions.jsonl"));
-        this.copyEffectsPath = join(this.dir, copyRel(piece.id, "effects.jsonl"));
+        this.decisionsPath = this.pieceFile(piece.decisions);
+        this.effectsPath = this.pieceFile(piece.effects);
+        this.inputsPath = this.pieceFile(piece.inputs);
+        this.copyDecisionsPath = this.pieceFile(copyRel(piece.id, "decisions.jsonl"));
+        this.copyEffectsPath = this.pieceFile(copyRel(piece.id, "effects.jsonl"));
+    }
+    /** Manifest piece path, refused before any filesystem call when it leaves this directory. */
+    pieceFile(rel) {
+        return requireLedgerPiecePath(this.dir, rel);
     }
     activePiece() {
         return this.pieces.find((p) => p.id === this.activeId) ?? this.pieces[this.pieces.length - 1];
@@ -509,10 +513,10 @@ export class FileLedger {
     rebuildIndex(activeDecisions) {
         const lines = [];
         for (const piece of this.pieces) {
-            const path = join(this.dir, piece.decisions);
+            const path = this.pieceFile(piece.decisions);
             const recs = piece.id === this.activeId ? activeDecisions : readJsonlSync(path);
-            const inputLists = inputsByRef(join(this.dir, piece.inputs));
-            const effectSet = primaryEffectRefs(join(this.dir, piece.effects));
+            const inputLists = inputsByRef(this.pieceFile(piece.inputs));
+            const effectSet = primaryEffectRefs(this.pieceFile(piece.effects));
             const seen = new Map();
             for (const rec of recs) {
                 const row = indexRowOf(rec);
@@ -638,10 +642,10 @@ export class FileLedger {
         }
     }
     ensurePieceFiles(piece) {
-        mkdirSync(join(this.dir, dirname(piece.decisions)), { recursive: true, mode: 0o700 });
-        mkdirSync(join(this.dir, dirname(copyRel(piece.id, "decisions.jsonl"))), { recursive: true, mode: 0o700 });
+        mkdirSync(dirname(this.pieceFile(piece.decisions)), { recursive: true, mode: 0o700 });
+        mkdirSync(dirname(this.pieceFile(copyRel(piece.id, "decisions.jsonl"))), { recursive: true, mode: 0o700 });
         for (const rel of [piece.decisions, piece.effects, piece.inputs, copyRel(piece.id, "decisions.jsonl"), copyRel(piece.id, "effects.jsonl")]) {
-            const path = join(this.dir, rel);
+            const path = this.pieceFile(rel);
             if (!existsSync(path))
                 writeFileSync(path, "", { encoding: "utf8", mode: 0o600 });
         }
@@ -704,6 +708,29 @@ export class FileLedger {
     lockStatus() {
         return this.ownsLock() ? "held" : "free";
     }
+    /**
+     * Record the port this process is listening on. Called once the socket is
+     * bound, so the number is the one the kernel gave us. An older lock has no
+     * port; this rewrite keeps the pid, the start time, and the token.
+     */
+    recordListenPort(port) {
+        if (!Number.isInteger(port) || port <= 0 || port >= 65536) {
+            throw new Error("ledger-listen-port");
+        }
+        this.assertOwned();
+        const existing = readLock(this.lockPath);
+        if (!existing || existing.token !== this.token) {
+            this.markLost();
+            throw new Error("ledger-lost-lock");
+        }
+        const body = `${JSON.stringify({
+            pid: existing.pid,
+            startedAt: existing.startedAt,
+            token: this.token,
+            port,
+        })}\n`;
+        writeFileAtomic(this.lockPath, body);
+    }
     markLost() {
         this.lost = true;
     }
@@ -897,7 +924,7 @@ export class FileLedger {
                 effectClass: "duplicate-effect",
                 timestampMs: row.timestampMs,
                 actor: row.actor,
-            }, DEFAULT_WITNESS, resultHash, undefined));
+            }, DEFAULT_WITNESS, resultHash, this.effectSigner));
             await appendDurable(this.effectsPath, dup);
             await this.pulse("effects.jsonl", dup, "effect");
             this.activeEffectN += 1;
@@ -915,14 +942,14 @@ export class FileLedger {
     async decisions() {
         const out = [];
         for (const piece of this.pieces) {
-            out.push(...(await readJsonl(join(this.dir, piece.decisions))));
+            out.push(...(await readJsonl(this.pieceFile(piece.decisions))));
         }
         return out;
     }
     async effects() {
         const out = [];
         for (const piece of this.pieces) {
-            out.push(...(await readJsonl(join(this.dir, piece.effects))));
+            out.push(...(await readJsonl(this.pieceFile(piece.effects))));
         }
         return out;
     }

package/dist/policy.d.ts

@@ -4,6 +4,11 @@ export type PolicySpend = {
     currency: string;
     payees: readonly string[];
     dailyMaxMinor?: number;
+    /**
+     * Minutes added to `createdAtMs` before the UTC day bucket.
+     * 0 is UTC. −720..840 covers the offsets an operator's clock can sit in.
+     */
+    dayOffsetMinutes?: number;
     /** Statement stamps for this payee. Optional; never guessed. */
     descriptors?: readonly string[];
 };
@@ -21,7 +26,7 @@ export type PolicyDocument = {
     default: "deny";
     approvalTtlMs?: number;
     egress?: readonly string[];
-    /** Body-wide: a call with no `_inputs` key is deny inputs-required. */
+    /** Body-wide: a call with no `_inputs` key, or an empty list, is deny inputs-required. */
     requireInputs?: true;
     limits?: {
         ratePerMinute?: number;
@@ -32,6 +37,12 @@ export type PolicyDocument = {
 };
 /** Named per tool. Do not sniff `host` / `url` on arbitrary arguments. */
 export declare const HOST_EXTRACTORS: Record<string, (args: Record<string, unknown>) => string | undefined>;
+/**
+ * One class for the spend gate and the approve prompt: every control (Cc,
+ * C0 and C1), every format character (Cf: bidi, ZWJ/ZWNJ, U+FEFF), and the
+ * line and paragraph separators (Zl, Zp).
+ */
+export declare const TERMINAL_CONTROL_CLASS = "\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}";
 export declare function parsePolicyDocument(json: unknown): PolicyDocument;
 export declare function ruleTextHash(text: string): string;
 export declare function loadPolicy(json: unknown): Policy;

package/dist/policy.js

@@ -1,20 +1,50 @@
 import { parseIJson } from "@cedulon/core";
 import { defaultDiskFreeBytes } from "./disk.js";
 import { sha256Canonical } from "./hash.js";
+/** One DNS label: letters, digits, hyphens; no leading or trailing hyphen. */
+function plainDnsLabel(label) {
+    if (label.length === 0 || label.length > 63)
+        return false;
+    return /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/.test(label);
+}
+/** A hostname and nothing else: no port, path, whitespace, or trailing dot. */
+function plainDnsHost(host) {
+    if (host.length === 0 || host.length > 253)
+        return undefined;
+    const labels = host.split(".");
+    if (labels.length === 0 || labels.some((label) => !plainDnsLabel(label)))
+        return undefined;
+    return host.toLowerCase();
+}
+/**
+ * `to` is one address. More than one `@`, a local part that carries a list
+ * separator or whitespace, or a host that is not a plain DNS name yields no
+ * host, and the egress rule then denies `egress-host-missing`.
+ */
+function hasControl(value) {
+    for (let i = 0; i < value.length; i += 1) {
+        const c = value.charCodeAt(i);
+        if (c < 0x20 || c === 0x7f)
+            return true;
+    }
+    return false;
+}
+function messageSendHost(args) {
+    const to = args.to;
+    if (typeof to !== "string" || to === "")
+        return undefined;
+    const at = to.indexOf("@");
+    if (at <= 0 || at !== to.lastIndexOf("@"))
+        return undefined;
+    const local = to.slice(0, at);
+    const host = to.slice(at + 1);
+    if (local === "" || /[\s,;<>"]/.test(local) || hasControl(local))
+        return undefined;
+    return plainDnsHost(host);
+}
 /** Named per tool. Do not sniff `host` / `url` on arbitrary arguments. */
 export const HOST_EXTRACTORS = {
-    "message.send": (args) => {
-        const to = args.to;
-        if (typeof to !== "string" || to === "")
-            return undefined;
-        const at = to.lastIndexOf("@");
-        if (at < 0)
-            return undefined;
-        const host = to.slice(at + 1).trim().toLowerCase();
-        if (host === "" || host.includes("/") || host.includes(" "))
-            return undefined;
-        return host;
-    },
+    "message.send": messageSendHost,
 };
 const DEFAULT_APPROVAL_TTL_MS = 86_400_000;
 function asRule(raw, index) {
@@ -90,6 +120,15 @@ function asSpend(raw, id) {
         }
         spend.dailyMaxMinor = rec.dailyMaxMinor;
     }
+    if (rec.dayOffsetMinutes !== undefined) {
+        if (typeof rec.dayOffsetMinutes !== "number" ||
+            !Number.isInteger(rec.dayOffsetMinutes) ||
+            rec.dayOffsetMinutes < -720 ||
+            rec.dayOffsetMinutes > 840) {
+            throw new Error(`policy-rule-spend-day-offset:${id}`);
+        }
+        spend.dayOffsetMinutes = rec.dayOffsetMinutes;
+    }
     if (rec.descriptors !== undefined) {
         if (!Array.isArray(rec.descriptors) ||
             rec.descriptors.length === 0 ||
@@ -100,6 +139,13 @@ function asSpend(raw, id) {
     }
     return spend;
 }
+/**
+ * One class for the spend gate and the approve prompt: every control (Cc,
+ * C0 and C1), every format character (Cf: bidi, ZWJ/ZWNJ, U+FEFF), and the
+ * line and paragraph separators (Zl, Zp).
+ */
+export const TERMINAL_CONTROL_CLASS = "\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}";
+const SPEND_CONTROL = new RegExp(`[${TERMINAL_CONTROL_CLASS}]`, "u");
 function spendArgsInvalid(args) {
     const keys = Object.keys(args);
     const allowed = new Set(["amountMinor", "currency", "payee", "reference"]);
@@ -110,9 +156,11 @@ function spendArgsInvalid(args) {
         return true;
     if (typeof args.currency !== "string" || !/^[A-Z]{3}$/.test(args.currency))
         return true;
-    if (typeof args.payee !== "string" || args.payee === "")
+    if (typeof args.payee !== "string" || args.payee === "" || SPEND_CONTROL.test(args.payee))
+        return true;
+    if (typeof args.reference !== "string" || args.reference.length > 140 || SPEND_CONTROL.test(args.reference))
         return true;
-    if (typeof args.reference !== "string" || args.reference.length > 140)
+    if (SPEND_CONTROL.test(args.currency))
         return true;
     return false;
 }
@@ -158,8 +206,24 @@ export function parsePolicyDocument(json) {
         }
         document.requireInputs = true;
     }
+    rejectDuplicateRules(document.rules);
     return document;
 }
+function rejectDuplicateRules(rules) {
+    const seenId = new Set();
+    const toolOwner = new Map();
+    for (const rule of rules) {
+        if (seenId.has(rule.id)) {
+            throw new Error(`duplicate rule id ${rule.id} and ${rule.id}`);
+        }
+        seenId.add(rule.id);
+        const prior = toolOwner.get(rule.tool);
+        if (prior !== undefined) {
+            throw new Error(`duplicate rule for tool ${rule.tool}: ${prior} and ${rule.id}`);
+        }
+        toolOwner.set(rule.tool, rule.id);
+    }
+}
 function asLimits(raw) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
         throw new Error("policy-limits");
@@ -188,8 +252,10 @@ export function loadPolicy(json) {
         ...(document.limits?.ratePerMinute !== undefined ? { ratePerMinute: document.limits.ratePerMinute } : {}),
         ...(document.limits?.dailyMax !== undefined ? { dailyMax: document.limits.dailyMax } : {}),
     };
+    const spendRule = document.rules.find((rule) => rule.tool === "spend");
     return {
         hash,
+        dayOffsetMinutes: spendRule?.spend?.dayOffsetMinutes ?? 0,
         approvalTtlMs: document.approvalTtlMs ?? DEFAULT_APPROVAL_TTL_MS,
         limits,
         ...(document.requireInputs ? { requireInputs: true } : {}),
@@ -201,8 +267,13 @@ export function loadPolicy(json) {
                 ? {
                     id: found.id,
                     text: found.text,
-                    ...(found.spend?.dailyMaxMinor !== undefined
-                        ? { spend: { dailyMaxMinor: found.spend.dailyMaxMinor } }
+                    ...(found.spend
+                        ? {
+                            spend: {
+                                ...(found.spend.dailyMaxMinor !== undefined ? { dailyMaxMinor: found.spend.dailyMaxMinor } : {}),
+                                dayOffsetMinutes: found.spend.dayOffsetMinutes ?? 0,
+                            },
+                        }
                         : {}),
                 }
                 : null;

package/dist/proxy.js

@@ -73,6 +73,16 @@ function threwReplay(ref) {
         isError: true,
     };
 }
+/** The tool returned. The effect row did not. That is not `:threw`. */
+function effectUnrecorded(ref) {
+    return {
+        content: [{ type: "text", text: `effect-unrecorded:${ref}` }],
+        isError: true,
+    };
+}
+function isEffectUnrecorded(result) {
+    return result.content.some((part) => part.text.startsWith("effect-unrecorded:"));
+}
 async function replayAfterEffect(ledger, ref) {
     const primary = (await ledger.effects()).find((e) => e.row.ref === ref && e.row.effectClass !== "duplicate-effect");
     if (primary?.row.effectClass.endsWith(":threw")) {
@@ -137,6 +147,27 @@ function readRef(args) {
         return "invalid";
     return raw;
 }
+/**
+ * The input-validity fold a new decision uses. A cited input that is missing,
+ * mismatched, or outside validFromMs..validUntilMs is a deny for that reason.
+ * An approved retry calls this same function before inner; it does not grow a second copy.
+ */
+function applyInputValidity(inputReason, verdict) {
+    if (inputReason !== null)
+        return { decision: "deny", reasonCode: inputReason };
+    return verdict;
+}
+function inputIdentityHash(rows) {
+    return sha256Canonical(rows.map((row) => {
+        const id = {
+            id: row.id,
+            versionHash: row.versionHash,
+        };
+        if (row.source !== undefined)
+            id.source = row.source;
+        return id;
+    }));
+}
 function toolCallOf(call) {
     const args = { ...call.arguments };
     delete args._inputs;
@@ -152,6 +183,7 @@ export function createProxy(deps) {
         policy: deps.policy,
         approvals,
         now: deps.now,
+        ledger: deps.ledger,
     });
     deps.ledger.effectSigner = deps.effectSigner;
     const ledgerDir = deps.ledger.dir;
@@ -233,7 +265,7 @@ export function createProxy(deps) {
         });
         return denied("spend-reauth-required", ref);
     }
-    async function runInner(call, principal, ref) {
+    async function runInner(call, principal, ref, effectRecorded) {
         const dispatchedName = call.name;
         const dispatchedArgs = deepFreeze(structuredClone(call.arguments));
         const dispatchedHash = sha256Canonical(effectDescriptor(dispatchedName, dispatchedArgs));
@@ -242,17 +274,9 @@ export function createProxy(deps) {
             name: dispatchedName,
             arguments: dispatchedArgs,
         });
+        let result;
         try {
-            const result = await deps.inner(frozenCall, principal, ref);
-            const row = {
-                ref,
-                effectHash: dispatchedHash,
-                effectClass: dispatchedName,
-                timestampMs: deps.now(),
-                actor: principal.brain,
-            };
-            await deps.ledger.appendEffect(row, "self", sha256Canonical(result));
-            return result;
+            result = await deps.inner(frozenCall, principal, ref);
         }
         catch (err) {
             const row = {
@@ -262,9 +286,33 @@ export function createProxy(deps) {
                 timestampMs: deps.now(),
                 actor: principal.brain,
             };
-            await deps.ledger.appendEffect(row, "self", sha256Canonical(thrownPayload(err)));
+            try {
+                await deps.ledger.appendEffect(row, "self", sha256Canonical(thrownPayload(err)));
+                effectRecorded.ok = true;
+            }
+            catch (writeErr) {
+                throw writeErr;
+            }
             throw err;
         }
+        const row = {
+            ref,
+            effectHash: dispatchedHash,
+            effectClass: dispatchedName,
+            timestampMs: deps.now(),
+            actor: principal.brain,
+        };
+        try {
+            await deps.ledger.appendEffect(row, "self", sha256Canonical(result));
+            effectRecorded.ok = true;
+        }
+        catch {
+            // The tool already returned. A failed effect write is not a throw of the
+            // tool, so this does not record `:threw`. The start mark stays (effectRecorded
+            // stays false) and a restart answers outcome-unknown instead of running again.
+            return effectUnrecorded(ref);
+        }
+        return result;
     }
     async function resolveInputs(call, principal, timestampMs) {
         const declared = declaredInputs(call.arguments);
@@ -274,7 +322,8 @@ export function createProxy(deps) {
                 reasonCode: "input-invalid",
             };
         }
-        if (declared === null && deps.policy.requireInputs === true) {
+        if (deps.policy.requireInputs === true &&
+            (declared === null || declared.length === 0)) {
             return {
                 inputs: { principal: principalInputs(principal), inputs: [] },
                 reasonCode: "inputs-required",
@@ -309,22 +358,57 @@ export function createProxy(deps) {
             reasonCode: null,
         };
     }
+    async function boundInputsReason(rows, timestampMs, principal) {
+        for (const item of rows) {
+            if (deps.resolveInput) {
+                const got = await deps.resolveInput(item.id, principal);
+                if (!got ||
+                    got.versionHash !== item.versionHash ||
+                    got.validFromMs > timestampMs ||
+                    got.validUntilMs < timestampMs) {
+                    return "input-invalid";
+                }
+                continue;
+            }
+            if (item.validFromMs > timestampMs || item.validUntilMs < timestampMs)
+                return "input-invalid";
+        }
+        return null;
+    }
+    async function signedRetryDeny(reasonCode, requestHash, inputs, timestampMs, subject, scopedRef) {
+        const denyRef = deps.nonce();
+        await writeRecord({
+            decision: "deny",
+            reasonCode,
+            ref: denyRef,
+            requestHash,
+            inputs: {
+                ...inputs,
+                approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+            },
+            effectHash: null,
+            subject,
+            timestampMs,
+        });
+        return denied(reasonCode, denyRef);
+    }
     function launchInner(dispatchedCall, principal, allowRef, flightKey) {
         // Written before the tool runs, removed after the effect is recorded. A
         // mark that survives the process is what tells a restarted body that this
         // ref was already started (in-flight-log.ts).
         if (stateDir !== null)
             markStarted(stateDir, flightKey, dispatchedCall.name);
-        const work = runInner(dispatchedCall, principal, allowRef);
+        const effectRecorded = { ok: false };
+        const work = runInner(dispatchedCall, principal, allowRef, effectRecorded);
         inFlight.set(flightKey, work);
-        return { kind: "run", work, key: flightKey, replayRef: allowRef };
+        return { kind: "run", work, key: flightKey, replayRef: allowRef, effectRecorded };
     }
     async function retryPolicyDeny(dispatchedCall, principal, requestHash, inputs, timestampMs, subject, scopedRef) {
         let spendCtx;
         if (dispatchedCall.name === "spend") {
             const approvalRows = await approvals.listAll();
             spendCtx = {
-                spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs),
+                spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs, deps.policy.dayOffsetMinutes ?? 0),
             };
         }
         const verdict = deps.policy.evaluate(dispatchedCall, principal, spendCtx);
@@ -362,8 +446,8 @@ export function createProxy(deps) {
                         nonce: deps.nonce,
                         ref: cmd.ref,
                         approverId: cmd.approverId,
-                        // Only `verax approve` queues a command, when the ledger is locked.
-                        via: "cli",
+                        // A command with no `via` is an old queue file; treat it as a script, not a person.
+                        via: cmd.via === "cli" ? "cli" : "cli-script",
                         policyHash: defer.policyHash,
                         approvals,
                         inputsLog,
@@ -405,6 +489,21 @@ export function createProxy(deps) {
             }
             const given = readRef(call.arguments);
             const plan = await admission.enqueue(async () => {
+                // A call that waited here behind another admission reads the halt flag again.
+                if (stateDir && existsSync(join(stateDir, "halted"))) {
+                    const ref = deps.nonce();
+                    await writeRecord({
+                        decision: "deny",
+                        reasonCode: "halted",
+                        ref,
+                        requestHash,
+                        inputs: resolved.inputs,
+                        effectHash: null,
+                        subject: call.name,
+                        timestampMs,
+                    });
+                    return { kind: "done", result: denied("halted", ref) };
+                }
                 if (given === "invalid") {
                     const ref = deps.nonce();
                     await writeRecord({
@@ -473,7 +572,10 @@ export function createProxy(deps) {
                                     return { kind: "done", result: deferred(given) };
                                 }
                                 if (!snap?.allowRef) {
-                                    await approvals.updateStatus(scopedRef, "approved", { allowRef: allow.ref });
+                                    await approvals.updateStatus(scopedRef, "approved", {
+                                        allowRef: allow.ref,
+                                        approvedAtMs: allow.timestampMs,
+                                    });
                                 }
                                 if (await hasPrimaryEffect(deps.ledger, allow.ref)) {
                                     return { kind: "done", result: await replayAfterEffect(deps.ledger, allow.ref) };
@@ -511,6 +613,49 @@ export function createProxy(deps) {
                                     });
                                     return { kind: "done", result: denied("outcome-unknown", unknownRef) };
                                 }
+                                const declared = declaredInputs(call.arguments);
+                                if (declared === "invalid") {
+                                    return {
+                                        kind: "done",
+                                        result: await signedRetryDeny("input-invalid", requestHash, resolved.inputs, timestampMs, call.name, scopedRef),
+                                    };
+                                }
+                                const boundRows = bound?.inputs ?? [];
+                                if (declared !== null && inputIdentityHash(declared) !== inputIdentityHash(boundRows)) {
+                                    return {
+                                        kind: "done",
+                                        result: await signedRetryDeny("inputs-changed", requestHash, resolved.inputs, timestampMs, call.name, scopedRef),
+                                    };
+                                }
+                                const validityReason = await boundInputsReason(boundRows, timestampMs, principal);
+                                const gated = applyInputValidity(validityReason, {
+                                    decision: "allow",
+                                    reasonCode: "approved-by-operator",
+                                });
+                                if (gated.decision !== "allow") {
+                                    return {
+                                        kind: "done",
+                                        result: await signedRetryDeny(gated.reasonCode, requestHash, resolved.inputs, timestampMs, call.name, scopedRef),
+                                    };
+                                }
+                                if (deps.checkTenantMismatch &&
+                                    (await deps.checkTenantMismatch(dispatched, principal))) {
+                                    const denyRef = deps.nonce();
+                                    await writeRecord({
+                                        decision: "deny",
+                                        reasonCode: "tenant-mismatch",
+                                        ref: denyRef,
+                                        requestHash,
+                                        inputs: {
+                                            ...resolved.inputs,
+                                            approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+                                        },
+                                        effectHash: null,
+                                        subject: call.name,
+                                        timestampMs,
+                                    });
+                                    return { kind: "done", result: denied("tenant-mismatch", denyRef) };
+                                }
                                 return launchInner(dispatched, principal, allow.ref, scopedRef);
                             }
                             return { kind: "done", result: deferred(given) };
@@ -556,19 +701,20 @@ export function createProxy(deps) {
                 if (dispatched.name === "spend") {
                     const approvalRows = await approvals.listAll();
                     spendCtx = {
-                        spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs),
+                        spentTodayMinor: (currency) => spentTodayMinorOf(approvalRows, timestampMs, currency, deps.policy.approvalTtlMs, deps.policy.dayOffsetMinutes ?? 0),
                     };
                 }
                 const verdict = deps.policy.evaluate(dispatched, principal, spendCtx);
-                let reasonCode = resolved.reasonCode ?? verdict.reasonCode;
-                let decision = resolved.reasonCode ? "deny" : verdict.decision;
+                const admitted = applyInputValidity(resolved.reasonCode, verdict);
+                let reasonCode = admitted.reasonCode;
+                let decision = admitted.decision;
                 const bound = rateBound(timestampMs, decision === "allow" || decision === "defer");
                 if (bound) {
                     decision = "deny";
                     reasonCode = bound;
                 }
                 if (!bound &&
-                    decision === "allow" &&
+                    (decision === "allow" || decision === "defer") &&
                     deps.checkTenantMismatch &&
                     (await deps.checkTenantMismatch(dispatched, principal))) {
                     decision = "deny";
@@ -626,7 +772,9 @@ export function createProxy(deps) {
                 return plan.result;
             if (plan.kind === "wait") {
                 try {
-                    await plan.work;
+                    const result = await plan.work;
+                    if (isEffectUnrecorded(result))
+                        return result;
                     return allowedReplay(plan.replayRef);
                 }
                 catch {
@@ -640,9 +788,11 @@ export function createProxy(deps) {
             }
             finally {
                 inFlight.delete(plan.key);
-                // runInner has written its effect row by now — on the throw path too,
-                // as `<name>:threw`. The outcome is on the ledger, so the mark goes.
-                if (stateDir !== null)
+                // The mark stays when the effect row did not land: the tool threw and
+                // `:threw` could not be written, or the tool returned and its effect
+                // row could not be written. A retry then answers outcome-unknown
+                // instead of running again. A returned tool is not recorded as `:threw`.
+                if (plan.effectRecorded.ok && stateDir !== null)
                     markEnded(stateDir, plan.key);
             }
         },