immune-brain 4.5.0 → 5.0.0

package/plugins/immune-brain/runtime/kernel/application.ts

@@ -9,6 +9,7 @@ import {
 	type MutationAuthorityRegistry,
 } from "./authority_port";
 import { asTaskDiffSnapshot } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import { canonicalIntentHash, readTaskIntent } from "./intent";
 import {
 	inspectIntentTokenPair,
@@ -51,9 +52,9 @@ export interface ApplyTaskActionInput {
 	/** Paired mutation authority registry that must recognize every supplied capability. */
 	registry: MutationAuthorityRegistry;
 	capability?: MutationAuthorityCapabilityV2;
-	/** Trusted injected diff provider; the action's diff_hash is only an expectation. */
-	diffProvider: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
-	now?: number;
+	/** Trusted injected diff provider; the action's diff_hash is only an expectation.
+	 * Defaults to the shared delivery identity selector when omitted. */
+	diffProvider?: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
 	/**
 	 * Terminal commit mode: record + workspace + active-claim removal + task
 	 * tombstone converge through one recoverable terminal transaction marker
@@ -72,8 +73,8 @@ export interface ApplyTaskActionInput {
 export function applyTaskAction(
 	input: ApplyTaskActionInput,
 ): StoredTaskMutationV3 {
-	const { root, task_id, prior_intent_token, registry, capability, diffProvider, now } =
-		input;
+	const { root, task_id, prior_intent_token, registry, capability } = input;
+	const diffProvider = input.diffProvider ?? taskDeliveryIdentity;
 	return withKernelStoreLock(root, () => {
 		const current = readTaskRecordRaw(root, task_id);
 		if (!current.record)
@@ -192,7 +193,7 @@ export function applyTaskAction(
 		// replay identity, and conflicting reuse, so any throw is a zero-write
 		// failure (including stale record/workspace CAS).
 		const inspectedAudit = expectedAuthority
-			? registry.inspect(capability, expectedAuthority, now)
+			? registry.inspect(capability, expectedAuthority)
 			: null;
 		const authorityRunId = inspectedAudit?.run_id;
 		const mutation = reduceTask(
@@ -237,7 +238,6 @@ export function applyTaskAction(
 			registry.consume(
 				capability as MutationAuthorityCapabilityV2,
 				expectedAuthority,
-				now,
 			);
 		}
 

package/plugins/immune-brain/runtime/kernel/assurance_projection.ts

@@ -2,9 +2,9 @@
 // projection that binds a task's backend claim, TaskRecord v3, workspace,
 // attestations, findings, and completion facts into one closed result.
 //
-// This module is deliberately INTERNAL to the Kernel runtime: it is imported
-// by the Pi extension only through the structural runtime-stub adapter and is
-// never re-exported from ./index.ts. Hosts consume the projection without
+// This module is deliberately INTERNAL to the Kernel runtime: both host
+// adapters import it statically and it is never re-exported from ./index.ts.
+// Hosts consume the projection without
 // reconstructing evidence/approval freshness or authorization readiness.
 //
 // It does not know about Pi session state, pending native Review verdicts,
@@ -13,13 +13,15 @@
 
 import { readBackendClaim, readTaskTombstone } from "./backend_claim";
 import {
-	readTaskRecord,
+	readTaskRecordRaw,
 	readAuditTaskPair,
+	localRunId,
 	readCommittedRecord,
 	readWorkspaceStateRaw,
 	reconcileKernelAuthority,
 } from "./storage";
 import { projectTask, resolveProjectedRisk } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import type { AssuranceObligation, TaskIntentV1, TaskRecord, TaskRecordV3 } from "./types";
 import type { TaskRecordV2 } from "./legacy_task_record";
 
@@ -244,7 +246,9 @@ function projectFromRecord(
 /**
  * One closed read-only projection for a task. The injected diffProvider keeps
  * this module free of git/worktree concerns; hosts supply it from their own
- * task-scope diff implementation.
+ * task-scope diff implementation. When no provider is supplied the shared
+ * delivery identity selector (workspace_scope.taskDeliveryIdentity) computes
+ * it; a supplied provider still overrides it (I5).
  *
  * Error semantics:
  * - no authority facts          -> error null, claim null, empty projection
@@ -257,7 +261,7 @@ function projectFromRecord(
 export async function projectAssurance(
 	root: string,
 	taskId: string,
-	diffProvider: (root: string, record: TaskRecord) => TaskDiffSnapshot,
+	diffProvider: (root: string, record: TaskRecord) => TaskDiffSnapshot = taskDeliveryIdentity,
 ): Promise<AssuranceProjectionResult> {
 	const fail = (
 		error: string,
@@ -303,7 +307,7 @@ export async function projectAssurance(
 		}
 		let read;
 		try {
-			read = await readTaskRecord(root, taskId);
+			read = await readTaskRecordRaw(root, taskId);
 		} catch (error) {
 			if (!terminalOwner || !(error instanceof Error) || !error.message.startsWith("TaskRecord v2")) throw error;
 			return fail(error instanceof Error ? error.message : String(error));
@@ -332,7 +336,10 @@ export async function projectAssurance(
 					},
 				};
 			}
-			const auditPair = await readAuditTaskPair(root, taskId);
+			// Run-aware: with a local run row the store already answered above;
+			// without one (a fresh clone or pre-run-layout evidence) only the
+			// resolved pair may serve, never another run's directory by drift.
+			const auditPair = await readAuditTaskPair(root, taskId, localRunId(root, taskId) ?? undefined);
 			if (!auditPair) return fail(`task ${taskId} has no terminal audit pair`, claim);
 			const workspace = await readWorkspaceStateRaw(root);
 			if (auditPair.record.contract === "assurance_kernel/task_record/v2")

package/plugins/immune-brain/runtime/kernel/authority_port.ts

@@ -62,17 +62,15 @@ export interface MutationAuthorityRegistry {
 	readonly brand: symbol;
 	/** Issue one capability bound to an exact binding. Library primitive; no production caller in P2B2. */
 	issue(binding: CapabilityBindingV2, issuedAt?: string): MutationAuthorityCapabilityV2;
-	/** Inspect without consuming. Fails on missing, expired, mismatched, or reused capability. */
+	/** Inspect without consuming. Fails on missing, mismatched, or reused capability. */
 	inspect(
 		capability: MutationAuthorityCapabilityV2 | undefined,
 		expected: MutationAuthorityInspection,
-		now?: number,
 	): ValidatedAuthorityV2;
 	/** Consume irreversibly. Returns the validated authority. */
 	consume(
 		capability: MutationAuthorityCapabilityV2,
 		expected: MutationAuthorityInspection,
-		now?: number,
 	): ValidatedAuthorityV2;
 	isConsumed(capability: MutationAuthorityCapabilityV2): boolean;
 }
@@ -88,7 +86,7 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 	const inner = createCapabilityRegistry<CapabilityBindingV2, MutationAuthorityInspection, ValidatedAuthorityV2, MutationAuthorityCapabilityV2>(
 		MUTATION_AUTHORITY_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				const missing: string[] = [];
 				if (binding.run_id !== undefined && binding.run_id.length === 0)
 					throw new Error("authority capability run_id must not be empty");
@@ -100,12 +98,8 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 					throw new Error(`authority capability binding is incomplete: ${missing.join(", ")}`);
 				if (binding.findings_digest !== null && !/^sha256:[a-f0-9]{64}$/.test(binding.findings_digest))
 					throw new Error("authority capability findings_digest must be a canonical sha256 hash");
-				if (Number.isNaN(Date.parse(binding.expires_at)) || Date.parse(binding.expires_at) <= Date.parse(issuedAt))
-					throw new Error("authority capability must have a future expiry");
 			},
-			validateAndProject(state, expected, now) {
-				if (Date.parse(state.expires_at) <= now)
-					throw new Error("authority capability has expired");
+			validateAndProject(state, expected) {
 				const actionDigest = digestOfAction(expected.action);
 				if (state.action_digest !== actionDigest)
 					throw new Error("authority capability action digest mismatch");
@@ -141,7 +135,6 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 						actor_id: canonicalActorId(state.actor_id),
 						confirmation_ref: state.confirmation_ref,
 						issued_at: state.issued_at,
-						expires_at: state.expires_at,
 					},
 					action_digest: actionDigest,
 					...(state.run_id !== undefined ? { run_id: state.run_id } : {}),
@@ -162,12 +155,11 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 		inspect(
 			capability: MutationAuthorityCapabilityV2 | undefined,
 			expected: MutationAuthorityInspection,
-			now = Date.now(),
 		): ValidatedAuthorityV2 {
 			if (!capability)
 				throw new Error("privileged action requires an opaque authority capability");
 			try {
-				return inner.inspect(capability, expected, now);
+				return inner.inspect(capability, expected);
 			} catch (err) {
 				if (err instanceof Error && err.message.includes("not recognized by this registry"))
 					throw new Error("privileged action requires an opaque authority capability");
@@ -177,10 +169,9 @@ export function createMutationAuthorityRegistry(): MutationAuthorityRegistry {
 		consume(
 			capability: MutationAuthorityCapabilityV2,
 			expected: MutationAuthorityInspection,
-			now = Date.now(),
 		): ValidatedAuthorityV2 {
 			try {
-				return inner.consume(capability, expected, now);
+				return inner.consume(capability, expected);
 			} catch (err) {
 				if (err instanceof Error && err.message.includes("not recognized by this registry"))
 					throw new Error("privileged action requires an opaque authority capability");

package/plugins/immune-brain/runtime/kernel/batch_authority.ts

@@ -8,6 +8,7 @@
 // plus an advancing HEAD lineage instead.
 
 import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 import { createCapabilityRegistry } from "./capability_registry";
 import { isLiteralUserActor } from "./actor_identity";
 import type { BaseCapabilityBinding, EnrollmentCapabilityBinding } from "./enrollment_authority";
@@ -19,15 +20,6 @@ export const BATCH_AUTHORITY_CAPABILITY_BRAND = Symbol.for(
 
 const GIT_COMMIT_ID = /^[a-f0-9]{40}$/;
 
-/** review-7(3rd rework): typed expiry marker thrown at the Kernel enrollment
- * boundary so the driver can classify a real enrollment-time expiry as an
- * intentional budget stop without free-form message matching. */
-export class BatchAuthorizationExpiryError extends Error {
-	constructor(message: string) {
-		super(message);
-		this.name = "BatchAuthorizationExpiryError";
-	}
-}
 
 export interface BatchPlanChild {
 	task_id: string;
@@ -39,7 +31,6 @@ export interface BatchPlanChild {
 
 export interface BatchBudget {
 	max_children: number;
-	deadline_at: string;
 	qa_failure_limit: number;
 }
 
@@ -63,7 +54,6 @@ export interface ValidatedBatchAuthorization {
 	actor_id: string;
 	confirmation_ref: string;
 	issued_at: string;
-	expires_at: string;
 	nonce: string;
 }
 
@@ -81,7 +71,6 @@ export interface BatchAuthorityRegistry {
 	inspect(
 		capability: object,
 		expected: BatchAuthorizationBinding,
-		now?: number,
 	): ValidatedBatchAuthorization;
 	children(capability: object): BatchPlanChild[];
 	consumedChildren(capability: object): string[];
@@ -91,7 +80,6 @@ export interface BatchAuthorityRegistry {
 		capability: object,
 		expected: BatchAuthorizationBinding,
 		taskId: string,
-		now?: number,
 	): ValidatedBatchAuthorization;
 	/** Undo one slot consumption when the bound write did not commit. */
 	releaseChild(capability: object, taskId: string): void;
@@ -138,7 +126,6 @@ function requireNonEmpty(binding: BatchAuthorizationBinding): void {
 		"base_head",
 		"actor_id",
 		"confirmation_ref",
-		"expires_at",
 		"nonce",
 	] as const) {
 		const value = binding[key];
@@ -149,14 +136,11 @@ function requireNonEmpty(binding: BatchAuthorizationBinding): void {
 		throw new Error(`batch authorization binding is incomplete: ${missing.join(", ")}`);
 }
 
-function validateBudget(budget: BatchBudget, issuedAt: string): void {
+function validateBudget(budget: BatchBudget): void {
 	if (!Number.isInteger(budget.max_children) || budget.max_children <= 0)
 		throw new Error("batch budget max_children must be a positive integer");
 	if (!Number.isInteger(budget.qa_failure_limit) || budget.qa_failure_limit <= 0)
 		throw new Error("batch budget qa_failure_limit must be a positive integer");
-	const deadline = Date.parse(budget.deadline_at);
-	if (Number.isNaN(deadline) || deadline <= Date.parse(issuedAt))
-		throw new Error("batch budget must have a future deadline_at");
 }
 
 function validateChildren(children: BatchPlanChild[], planDigest: string): void {
@@ -210,7 +194,7 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 	>(
 		BATCH_AUTHORITY_CAPABILITY_BRAND,
 		{
-			validateBinding(binding, issuedAt) {
+			validateBinding(binding) {
 				requireNonEmpty(binding);
 				// Both the canonical literal-user spelling and the historical `user`
 				// spelling are read, so a batch authorized before the convergence keeps
@@ -219,29 +203,15 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 					throw new Error("batch authorization requires a literal-user actor_id");
 				if (!GIT_COMMIT_ID.test(binding.base_head))
 					throw new Error("batch authorization base_head must be a committed 40-hex commit id");
-				const expires = Date.parse(binding.expires_at);
-				if (Number.isNaN(expires) || expires <= Date.parse(issuedAt))
-					throw new Error("batch authorization must have a future expiry");
-				validateBudget(binding.budget, issuedAt);
+				validateBudget(binding.budget);
 			},
-			validateAndProject(state, expected, now) {
-				// Fail closed on an unusable clock. `now` reaches here as
-				// Date.parse(...) from callers, and NaN makes every `<=` compare
-				// false, which would silently accept an expired authorization.
-				if (!Number.isFinite(now))
-					throw new Error("batch authorization requires a valid clock");
-				const expires = Date.parse(state.expires_at);
-				if (Number.isNaN(expires) || expires <= now)
-					throw new BatchAuthorizationExpiryError("batch authorization has expired");
-				if (Date.parse(state.budget.deadline_at) <= now)
-					throw new BatchAuthorizationExpiryError("batch authorization deadline has expired");
+			validateAndProject(state, expected) {
 				for (const key of Object.keys(expected) as Array<keyof BatchAuthorizationBinding>) {
 					if (key === "budget") {
 						const a = state.budget ?? ({} as BatchBudget);
 						const b = expected.budget ?? ({} as BatchBudget);
 						if (
 							a.max_children !== b.max_children ||
-							a.deadline_at !== b.deadline_at ||
 							a.qa_failure_limit !== b.qa_failure_limit
 						)
 							throw new Error("batch authorization budget mismatch");
@@ -263,7 +233,6 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 					actor_id: state.actor_id,
 					confirmation_ref: state.confirmation_ref,
 					issued_at: state.issued_at,
-					expires_at: state.expires_at,
 					nonce: state.nonce,
 				};
 			},
@@ -299,9 +268,9 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 			consumed.set(capability, new Set<string>());
 			return capability;
 		},
-		inspect(capability, expected, now = Date.now()) {
+		inspect(capability, expected) {
 			planOf(capability);
-			return inner.inspect(capability, expected, now);
+			return inner.inspect(capability, expected);
 		},
 		children(capability) {
 			return planOf(capability).map((child) => ({ ...child, blocked_by: [...child.blocked_by] }));
@@ -312,8 +281,8 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 		isChildConsumed(capability, taskId) {
 			return slotsOf(capability).has(taskId);
 		},
-		consumeChild(capability, expected, taskId, now = Date.now()) {
-			const validated = this.inspect(capability, expected, now);
+		consumeChild(capability, expected, taskId) {
+			const validated = this.inspect(capability, expected);
 			const plan = planOf(capability);
 			if (!plan.some((child) => child.task_id === taskId))
 				throw new Error(`batch_child_not_in_plan: ${taskId}`);
@@ -331,6 +300,24 @@ export function createBatchAuthorityRegistry(): BatchAuthorityRegistry {
 	};
 }
 
+/**
+ * Before a batch has consumed a slot it has created no commit, so its lineage
+ * can only stand on the confirmed base_head or on a fast-forward of it: the
+ * user's own commit on the batch branch, which the runner adopts. A head that
+ * does not descend from base_head is not a lineage.
+ */
+export function assertBatchLineageOrigin(root: string, baseHead: string, expectedHead: string): void {
+	if (expectedHead === baseHead) return;
+	const descends =
+		spawnSync("git", ["-C", root, "merge-base", "--is-ancestor", baseHead, expectedHead], {
+			stdio: ["ignore", "ignore", "ignore"],
+		}).status === 0;
+	if (!descends)
+		throw new Error(
+			`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${baseHead} or a fast-forward of it, not ${expectedHead}`,
+		);
+}
+
 export interface DeriveChildEnrollmentInput {
 	capability: object;
 	binding: BatchAuthorizationBinding;
@@ -355,7 +342,7 @@ export function deriveChildEnrollment(
 	registry: BatchAuthorityRegistry,
 	input: DeriveChildEnrollmentInput,
 ): DerivedChildEnrollment {
-	const validated = registry.inspect(input.capability, input.binding, Date.parse(input.now));
+	const validated = registry.inspect(input.capability, input.binding);
 	const child = registry
 		.children(input.capability)
 		.find((entry) => entry.task_id === input.task_id);
@@ -385,13 +372,8 @@ export function deriveChildEnrollment(
 	// settled a child there is no commit it could have created, so a
 	// caller-supplied expected_head other than base_head is not a lineage.
 	// Checked last so the intent-divergence reason keeps its precedence.
-	if (
-		registry.consumedChildren(input.capability).length === 0 &&
-		input.expected_head !== validated.base_head
-	)
-		throw new Error(
-			`batch_head_lineage_broken: the first child must enroll on the confirmed base_head ${validated.base_head}, not ${input.expected_head}`,
-		);
+	if (registry.consumedChildren(input.capability).length === 0)
+		assertBatchLineageOrigin(root, validated.base_head, input.expected_head);
 
 	return {
 		child,
@@ -404,7 +386,6 @@ export function deriveChildEnrollment(
 			preparation_digest: preparation.digest,
 			actor_id: validated.actor_id,
 			confirmation_ref: validated.confirmation_ref,
-			expires_at: validated.expires_at,
 			nonce: `${validated.nonce}:${child.task_id}`,
 		},
 	};

package/plugins/immune-brain/runtime/kernel/canary_application.ts

@@ -14,6 +14,7 @@ import {
 } from "./authority_port";
 import { applyTaskAction } from "./application";
 import { asTaskDiffSnapshot } from "./completion";
+import { taskDeliveryIdentity } from "../workspace_scope";
 import { readTaskIntent } from "./intent";
 import {
 	inspectIntentTokenPair,
@@ -67,8 +68,9 @@ export interface CanaryExecuteInput {
 	task_id: string;
 	operation: CanaryOperation;
 	prior_intent_token: TaskIntentIdentityToken;
-	/** Trusted injected diff provider; the application derives the diff identity. */
-	diffProvider: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
+	/** Trusted injected diff provider; the application derives the diff identity.
+	 * Defaults to the shared delivery identity selector when omitted. */
+	diffProvider?: (root: string, record: TaskRecord) => string | { diff_hash: string; changed_paths?: readonly string[] };
 	now?: string;
 }
 
@@ -313,7 +315,7 @@ export function createCanaryApplication(
 				record: current.record,
 			};
 		});
-		const diffHash = asTaskDiffSnapshot(input.diffProvider(input.root, snapshot.record)).diff_hash;
+		const diffHash = asTaskDiffSnapshot((input.diffProvider ?? taskDeliveryIdentity)(input.root, snapshot.record)).diff_hash;
 		if (operation.op === "stop" && !("capability" in operation))
 			throw new KernelInvariantError(["stop requires user authority capability"]);
 		const hasBoundSpec = boundSpecPath(snapshot.intent_snapshot) !== undefined;
@@ -431,7 +433,6 @@ export function createCanaryApplication(
 			registry,
 			capability: capability as never,
 			diffProvider: input.diffProvider,
-			now: Date.parse(now),
 			...(operation.op === "complete" || operation.op === "stop"
 				? { terminal: { terminalized_at: now } }
 				: {}),
@@ -492,7 +493,7 @@ export function createCanaryApplication(
 				intent_revision: current.record.intent_snapshot.revision,
 				intent_content_hash: current.record.intent_ref.content_hash,
 				diff_hash: "sha256:" + "0".repeat(64),
-			}, Date.parse(now));
+			});
 			const nextClaim: BackendClaim = {
 				...claim,
 				lifecycle_status: "draining",

package/plugins/immune-brain/runtime/kernel/canary_eligibility.ts

@@ -23,7 +23,6 @@ export interface CanaryWaiver {
 	reason: string;
 	actor: string;
 	confirmation_ref: string;
-	expires_at: string;
 	nonce: string;
 }
 

package/plugins/immune-brain/runtime/kernel/capability_registry.ts

@@ -4,20 +4,19 @@
 
 export interface CapabilityRegistryHooks<TBinding, TExpected, TValidated> {
 	/** Validate the binding at issue time. Throw on invalid input. */
-	validateBinding(binding: TBinding, issuedAt: string): void;
+	validateBinding(binding: TBinding): void;
 	/** Validate stored state against expected input at inspect time. Return the domain-specific validated result. */
 	validateAndProject(
 		state: TBinding & { issued_at: string },
 		expected: TExpected,
-		now: number,
 	): TValidated;
 }
 
 export interface CapabilityRegistry<TBinding, TExpected, TValidated, TCapability> {
 	readonly brand: symbol;
 	issue(binding: TBinding, issuedAt?: string): TCapability;
-	inspect(capability: TCapability, expected: TExpected, now?: number): TValidated;
-	consume(capability: TCapability, expected: TExpected, now?: number): TValidated;
+	inspect(capability: TCapability, expected: TExpected): TValidated;
+	consume(capability: TCapability, expected: TExpected): TValidated;
 	isConsumed(capability: TCapability): boolean;
 }
 
@@ -53,7 +52,7 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 	return {
 		brand,
 		issue(binding: TBinding, issuedAt = new Date().toISOString()): TCapability {
-			hooks.validateBinding(binding, issuedAt);
+			hooks.validateBinding(binding);
 			const capability = Object.freeze(
 				Object.defineProperties(
 					{},
@@ -66,7 +65,7 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 			states.set(capability as object, { binding: { ...binding }, issued_at: issuedAt, consumed: false });
 			return capability;
 		},
-		inspect(capability: TCapability, expected: TExpected, now = Date.now()): TValidated {
+		inspect(capability: TCapability, expected: TExpected): TValidated {
 			if (!isCapability(capability))
 				throw new Error(`${domainLabel} capability is not recognized by this registry`);
 			const state = stateOf(capability);
@@ -74,11 +73,10 @@ export function createCapabilityRegistry<TBinding, TExpected, TValidated, TCapab
 			return hooks.validateAndProject(
 				{ ...state.binding, issued_at: state.issued_at },
 				expected,
-				now,
 			);
 		},
-		consume(capability: TCapability, expected: TExpected, now = Date.now()): TValidated {
-			const validated = this.inspect(capability, expected, now);
+		consume(capability: TCapability, expected: TExpected): TValidated {
+			const validated = this.inspect(capability, expected);
 			stateOf(capability).consumed = true;
 			return validated;
 		},