otto-intel-mcp 0.1.2 → 0.1.4

package/dist/execution-delegation.js

@@ -31,6 +31,20 @@
  *
  * Nothing here logs the header, the secret, or a credential. Refusals are machine-readable codes; upstream
  * error bodies are never relayed.
+ *
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * 🔴 THE THREAT MODEL THE PER-SWAP CAP GATE (step 5b) ENFORCES (Founder ruling, 2026-09-03, verbatim)
+ * ══════════════════════════════════════════════════════════════════════════════════════════════════
+ * "The per-person delegation cap protects every delegated send that goes through Otto's page
+ * (/app/delegate) and Otto's CLI (otto-execute delegate). A permission a person mints or revokes
+ * directly against Coinbase with their own login, outside Otto's page and CLI, is OUT OF SCOPE: Otto
+ * cannot distinguish it (CDP returns no grant identity, only an expiry) and does not defend against it;
+ * the CDP project-scope $5,000 ceiling remains the hard backstop for every permission. The delegated
+ * agent never holds the person's login."
+ *
+ * Note the direction that holds even out of the model: a grant Otto has no CONFIRMED record for
+ * authorises NOTHING here — it is refused by name, never admitted at the shared ceiling. An
+ * out-of-model actor can therefore shorten what Otto may do for them, never widen it.
  */
 import { createHash, timingSafeEqual } from 'node:crypto';
 import { getAddress } from 'viem';
@@ -38,7 +52,14 @@ import { CDP_CAPABILITIES, CdpDelegatedSigner, DelegatedPlanHaltedError, createC
 import { isAdapterRefusal } from './adapter/refusal.js';
 import { defaultAdapterPolicy, verifySwapEnvelope } from './adapter/verify.js';
 import { DELEGATION_AUTH_HEADER, SUBMIT_UNDER_DELEGATION_INPUT_SCHEMA, } from './execution-delegated-definition.js';
-import { assertWithinModelBFence, MODEL_B_CHAIN_ID, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_NAME_V1, readBackModelBFence, } from './execution-delegation-policy.js';
+import { confirmedDelegationOperationResult } from './execution-delegation-operations-definition.js';
+import { MODEL_B_CAP_RULESET_VERSION } from './execution-delegation-cap-store.js';
+import { assertWithinModelBFence, assertWithinUserPerSwapCap, MODEL_B_CHAIN_ID, MODEL_B_DELEGATION_EXPIRY_MAX_DAYS, MODEL_B_PER_SWAP_CAP_USD, MODEL_B_POLICY_VERSION, assertWithdrawWithinModelBFence, modelBWithdrawToken, MODEL_B_INPUT_TOKENS_V1, readBackModelBFence, } from './execution-delegation-policy.js';
+import { createDelegationCapStore, resolveDelegationCapStorePath, resolveDelegationMintEnabled, } from './execution-delegation-cap-store.js';
+import { createDelegationOperationStore, delegationOperationIdempotencyKey, DelegationOperationJournalNotReadyError, } from './execution-delegation-operation-store.js';
+import { verifyDelegatedStepFinality } from './execution-delegation-finality.js';
+import { createDelegationExitStore, } from './execution-delegation-exit-store.js';
+import { ExecutionWorkerBusyError, openExecutionWorkerGuardStore, unavailableExecutionWorkerGuardStore, } from './execution-worker-guard.js';
 import { EXECUTION_REFUSAL_CODES, ExecutionRefusal, isExecutionRefusal, refuse, } from './execution-errors.js';
 import { artifactCommitmentDigest, canonicalJson, } from './execution-types.js';
 import { DELEGATED_SUBMISSION_GRACE_MS, preparedHere } from './prepared-artifacts.js';
@@ -129,12 +150,13 @@ function isAbsentDelegation(error) {
 export function createDelegationRig(cdp, pub) {
     const rig = createCdpRig({
         pub,
-        submit: async (user, transaction) => {
+        submit: async (user, transaction, idempotencyKey) => {
             const result = await cdp.endUser.sendEvmTransaction({
                 userId: user.userId,
                 address: user.address,
                 transaction,
                 network: 'base',
+                ...(idempotencyKey ? { idempotencyKey } : {}),
             });
             return result.transactionHash;
         },
@@ -285,6 +307,58 @@ function requestFingerprint(input, commitment) {
         .update(canonicalJson({ user_id: input.userId, commitment, prepare_input: prepareInput }))
         .digest('hex');
 }
+function operationBinding(input, fingerprint) {
+    return Object.freeze({
+        artifactId: input.envelope.artifact_id,
+        userId: input.userId,
+        account: getAddress(input.prepareInput.accountProfile.address),
+        chainId: MODEL_B_CHAIN_ID,
+        fingerprint,
+    });
+}
+function operationMatches(operation, binding) {
+    return (operation.artifactId === binding.artifactId &&
+        operation.userId === binding.userId &&
+        operation.account.toLowerCase() === binding.account.toLowerCase() &&
+        operation.chainId === binding.chainId &&
+        operation.fingerprint === binding.fingerprint);
+}
+/** The signer-facing adapter. Its first call commits the exact CDP request before returning the key. */
+function operationJournal(store, binding, nowMs) {
+    return Object.freeze({
+        async prepare(attempt) {
+            const idempotencyKey = delegationOperationIdempotencyKey(binding.artifactId, attempt.index);
+            await store.prepareStep(binding, attempt.index, attempt.kind, {
+                userId: attempt.userId,
+                address: attempt.address,
+                transaction: attempt.transaction,
+                network: attempt.network,
+                idempotencyKey,
+            }, nowMs());
+            return Object.freeze({ idempotencyKey });
+        },
+        notSubmitted: (index, idempotencyKey) => store.markStepNotSubmitted(binding, index, idempotencyKey, nowMs()),
+        submitted: (index, idempotencyKey, transactionHash) => store.markStepSubmitted(binding, index, idempotencyKey, transactionHash, nowMs()),
+        unknown: (index, idempotencyKey) => store.markStepUnknown(binding, index, idempotencyKey, nowMs()),
+        receipt: (index, idempotencyKey, receipt) => store.markStepReceipt(binding, index, idempotencyKey, receipt, nowMs()),
+    });
+}
+function durableReplayOrRefusal(operation, binding) {
+    if (!operationMatches(operation, binding)) {
+        return refuse('DELEGATION_REPLAY_MISMATCH', 'this artifact is durably bound to a different request (user, account or intent); nothing is re-sent');
+    }
+    if (operation.state === 'confirmed') {
+        const confirmed = confirmedDelegationOperationResult(operation);
+        if (!confirmed) {
+            return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the confirmed delegated-operation result could not be read safely; nothing is re-sent');
+        }
+        return Object.freeze({ ...confirmed, replayed: true });
+    }
+    if (operation.state === 'failed') {
+        return refuse('DELEGATED_PLAN_HALTED', 'this artifact previously ended in a known failure; it is not retried — prepare again');
+    }
+    return refuse('DELEGATION_OPERATION_UNRESOLVED', `this artifact has a durable ${operation.state} operation whose final outcome is unresolved; nothing is re-sent`);
+}
 const SUBMISSIONS = new WeakMap();
 function submissionsOf(services, nowMs) {
     let records = SUBMISSIONS.get(services);
@@ -341,31 +415,39 @@ function parseInput(rawInput) {
     }
     return parsed.data;
 }
-function verifiedResult(input, user, verified, sent, fence, expiresAt) {
+function verifiedRecoveryContext(input, user, verified, fence, expiresAt) {
     return Object.freeze({
         status: 'sent',
         user_id: user.userId,
         address: user.address,
         chain_id: MODEL_B_CHAIN_ID,
         artifact_id: verified.artifact.artifact_id,
-        steps: sent.map((step) => Object.freeze({
-            index: step.index,
-            kind: step.kind,
-            to: step.to,
-            transaction_hash: step.transaction_hash,
-            status: step.status,
-            block_number: step.block_number,
-            gas_used: step.gas_used,
-        })),
+        /**
+         * 🔴 TWO NUMBERS, BECAUSE THERE ARE TWO FACTS. `per_swap_cap_usd` is the ENGINE's — the constant
+         * compiled into the one project-scope policy, the same for every delegated user, and the only one
+         * Coinbase enforces. `user_cap_usd` is what THIS person chose when they minted, enforced by this
+         * server alone. Reporting only the second would describe the CDP fence as something it is not;
+         * reporting only the first would hide the number that actually bounded this send.
+         */
         fence: Object.freeze({
             policy_id: fence.id,
-            policy_name: MODEL_B_POLICY_NAME_V1,
+            policy_name: fence.name,
             rules_digest: fence.rulesDigest,
             per_swap_cap_usd: MODEL_B_PER_SWAP_CAP_USD,
+            user_cap_usd: fence.userCapUsd,
         }),
         delegation: Object.freeze({ expires_at: expiresAt }),
         verification: Object.freeze({
-            checks: verified.checks.map((check) => check.id),
+            /**
+             * The verifier's checks, plus the ROUTE the constructor recorded in the envelope (`route_tool:<lifi
+             * tool>` and `route_simulated:<true|false>` assertion ids), so the receipt says which venue executed.
+             * Carried as check strings because the receipt's wire shape is validated `.strict()` by the shipped
+             * dApp until cut #3 — a new field would break the page that is live today.
+             */
+            checks: [
+                ...verified.checks.map((check) => check.id),
+                ...input.envelope.assertions.map((a) => a.id).filter((id) => id.startsWith('route_')),
+            ],
             gross: verified.gross.toString(),
             min_amount_out: verified.minAmountOut.toString(),
             otto_fee_atomic: verified.ottoFee.toString(),
@@ -375,6 +457,52 @@ function verifiedResult(input, user, verified, sent, fence, expiresAt) {
         }),
     });
 }
+function verifiedResult(input, user, verified, sent, fence, expiresAt) {
+    return Object.freeze({
+        ...verifiedRecoveryContext(input, user, verified, fence, expiresAt),
+        steps: sent.map((step) => Object.freeze({
+            index: step.index,
+            kind: step.kind,
+            to: step.to,
+            transaction_hash: step.transaction_hash,
+            status: step.status,
+            block_number: step.block_number,
+            gas_used: step.gas_used,
+        })),
+    });
+}
+/**
+ * A live signer returns after sealed canonical inclusion so the next plan step can safely use the prior
+ * state. Releasing the cross-rail claim is stricter: every one of the three exact requests and receipts
+ * must also sit at or below the canonical finalized head. This bounded immediate read never waits for
+ * Base finality; `otto_delegation_reconcile` performs the same proof later.
+ */
+async function liveDelegatedSuccessIsFinalized(services, binding) {
+    let operation;
+    try {
+        operation = await services.operationStore.readRecoveryArtifact(binding.artifactId);
+    }
+    catch {
+        return false;
+    }
+    if (!operation)
+        return false;
+    if (!operationMatches(operation, binding)) {
+        return refuse('DELEGATION_REPLAY_MISMATCH', 'the durable delegated operation changed before finality could be checked; its claim remains unresolved');
+    }
+    const kinds = ['approve_reset', 'approve', 'call'];
+    if (operation.steps.length !== kinds.length ||
+        operation.steps.some((step, index) => step.index !== index || step.kind !== kinds[index] || step.state !== 'confirmed' ||
+            step.receipt?.status !== 'success' ||
+            step.receipt.transactionHash.toLowerCase() !== step.transactionHash?.toLowerCase()))
+        return false;
+    for (const step of operation.steps) {
+        const finality = await verifyDelegatedStepFinality(services.rig.rig.pub, operation, step);
+        if (finality.outcome !== 'verified')
+            return false;
+    }
+    return true;
+}
 /**
  * Submit a prepared swap under the end user's delegation — the order in the file header is the contract.
  * `caller` is derived from the request headers by the registration layer; it never comes from arguments.
@@ -387,13 +515,12 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
     assertDelegationCaller(services, caller);
     const input = parseInput(rawInput);
     const nowMs = runtime.nowMs();
-    // 1a. Only an artifact THIS process prepared — same id, same whole-envelope commitment — is submittable: the
-    // idempotency record below is process-local, and a process that did not prepare the artifact cannot know
-    // whether another one already sent it (a rolling replacement runs two at once). Refused before any read;
-    // the caller prepares again. The commitment is RECOMPUTED from the presented envelope (the field it
-    // carries is never trusted), so a tampered envelope under a known id is refused here, never replayed.
-    // Checked BEFORE the record on purpose: a prepared-here entry is never evicted and expires exactly when
-    // the record does (same clock value, same window), so a record can never exist without its entry.
+    // 1a. Only an artifact THIS process prepared — same id, same whole-envelope commitment — is submittable.
+    // The durable journal records and exposes outcomes across restart, but it is evidence, not authority for a
+    // replacement worker to adopt an envelope. Refused before any CDP read; the caller uses the authenticated
+    // operation lookup for recovery state and prepares again only when that state is terminal. The commitment
+    // is RECOMPUTED from the presented envelope (the field it carries is never trusted), so a tampered envelope
+    // under a known id is refused here, never replayed.
     const artifactId = input.envelope.artifact_id;
     // The strict schema has validated the shape; the digest is over whatever was presented (a malformed envelope
     // digests to nothing this process recorded and is refused).
@@ -403,6 +530,7 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
     }
     // 1b. Same artifact seen before? Replay its outcome — to the SAME request only; never send twice.
     const fingerprint = requestFingerprint(input, commitment);
+    const binding = operationBinding(input, fingerprint);
     const records = submissionsOf(services, nowMs);
     const seen = records.get(artifactId);
     if (seen) {
@@ -415,6 +543,24 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
             throw seen.state.refusal;
         return refuse('DELEGATION_ARTIFACT_IN_FLIGHT', 'this artifact is being submitted right now; wait for its result');
     }
+    if (!services.operationStore.available) {
+        return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', `the durable delegated-operation journal is unavailable; nothing is submitted (${services.operationStore.unavailableReason ?? 'store unavailable'})`);
+    }
+    let durableSeen;
+    try {
+        durableSeen = await services.operationStore.readArtifact(artifactId);
+    }
+    catch {
+        return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the durable delegated-operation journal could not be read; nothing is submitted');
+    }
+    // Terminal replay needs no process-liveness proof and remains available even if old guard metadata was
+    // retired. An unresolved row must continue to the permanent-guard acquisition below; returning here
+    // would skip the missing/corrupt-guard refusal and could hide a broken recovery boundary.
+    if (durableSeen && (durableSeen.state === 'confirmed' || durableSeen.state === 'failed'))
+        return durableReplayOrRefusal(durableSeen, binding);
+    if (!services.exitStore?.available) {
+        return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the shared mint/delegated/exit claim store is unavailable or internally inconsistent; nothing is submitted');
+    }
     const release = acquireUser(services, input.userId);
     const submission = {
         expiresAtMs: Date.parse(input.envelope.valid_until) + DELEGATED_SUBMISSION_GRACE_MS,
@@ -422,24 +568,39 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
         state: { kind: 'in_flight' },
     };
     records.set(artifactId, submission);
+    let durableStarted = false;
+    let allPlanStepsConfirmed = false;
+    // A live halt's allowance read-back is deliberately not release evidence: it is an unpinned RPC
+    // observation after a merely sealed clear receipt. Even when it reports zero, the clear may still be
+    // above finality or another backend may lag. Every halt therefore keeps the operation and unified
+    // claim until recovery revalidates all known receipts and reads zero at one exact finalized canonical
+    // block. This also keeps the release rule in one place.
+    let retainUnresolvedAfterHalt = false;
+    let durableWorkerGuard;
     try {
         // 2. FENCE before authority.
         const fence = readBackModelBFence(await services.rig.listProjectPolicies());
         if (!fence.present)
             return refuse('DELEGATION_FENCE_ABSENT', `the Model-B project policy is not in force (${fence.reason}): ${fence.detail}`);
-        // 3. GRANT active past the envelope's own expiry; fail-closed once revocation was ever requested here.
-        if (revocationRequested(services.rig.rig, input.userId)) {
-            return refuse('DELEGATION_NOT_ACTIVE', 'revocation was requested for this end user on this server; nothing is submitted for them again');
-        }
+        // 3. GRANT active past the envelope's own expiry; fail-closed once revocation was requested for IT.
         const grant = await services.rig.rig.readDelegation(input.userId);
         if (!grant)
             return refuse('DELEGATION_NOT_ACTIVE', 'no active delegation reads back for this end user');
+        /**
+         * 🔴 PER GRANT, NOT PER USER (gate finding, HIGH — round 3). The marker used to be a sticky set of
+         * user ids, so once revoke was offered in every screen state a Stop press on a screen with no grant
+         * bricked every later permission that person minted. It names the grant now, so a revoke stops
+         * exactly what it was aimed at.
+         */
+        if (revocationRequested(services.rig.rig, input.userId, grant.expiresAt)) {
+            return refuse('DELEGATION_NOT_ACTIVE', 'revocation was requested for this delegation on this server; nothing is submitted under it');
+        }
         const expiresAtMs = Date.parse(grant.expiresAt);
         const validUntilMs = Date.parse(input.envelope.valid_until);
         if (!Number.isFinite(expiresAtMs) ||
             !Number.isFinite(validUntilMs) ||
             expiresAtMs <= validUntilMs) {
-            return refuse('DELEGATION_NOT_ACTIVE', `the delegation expires at ${grant.expiresAt}, not after the envelope's valid_until ${input.envelope.valid_until}; renew the delegation or prepare again`);
+            return refuse('DELEGATION_NOT_ACTIVE', `the delegation expires at ${grant.expiresAt}, not after the envelope's valid_until ${input.envelope.valid_until}; prepare a plan whose validity fits this existing grant if feasible, otherwise delegated execution is unavailable`);
         }
         /**
          * 3b. THE EXPIRY BOUND, ENFORCED WHERE OTTO IS ACTUALLY IN THE PATH.
@@ -466,7 +627,7 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
          */
         const remainingMs = expiresAtMs - nowMs;
         if (remainingMs > DELEGATION_MAX_REMAINING_MS) {
-            return refuse('DELEGATION_EXPIRY_EXCEEDS_BOUND', `the delegation still has ${Math.floor(remainingMs / 86_400_000)} days to run, past the ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}-day maximum; revoke it and mint a new one`);
+            return refuse('DELEGATION_EXPIRY_EXCEEDS_BOUND', `the delegation still has ${Math.floor(remainingMs / 86_400_000)} days to run, past the ${MODEL_B_DELEGATION_EXPIRY_MAX_DAYS}-day maximum; nothing is submitted. Check status and use Stop to revoke this permission if desired`);
         }
         // 4. ACCOUNT: the caller's prepared address must be one of THIS end user's accounts as CDP reports them.
         const record = await services.rig.readEndUser(input.userId);
@@ -500,33 +661,265 @@ export async function submitUnderDelegation(runtime, rawInput, caller, _signal)
                 throw refusal;
             throw error;
         }
-        assertWithinModelBFence(verified, services.fenceBound?.perSwapCapUsd, services.fenceBound?.inputTokens);
-        // 6. SEND.
+        /**
+         * 🔴 v2 — TWO SHAPES THROUGH ONE GATE. A delegated plan spends either an allow-listed INPUT token (a swap,
+         * or a Yield Copilot DEPOSIT, which is a swap into vault shares) — capped in USD by the engine fence and
+         * by the person's own recorded cap — or a registry vault SHARE token (a Yield Copilot WITHDRAW: shares →
+         * USDC, back to the signing account). A withdraw returns the person's own assets to the person and never
+         * increases exposure, so the person's per-swap cap does not apply to it: the cap checks below run with a
+         * gross of ZERO (which still validates the recorded cap's sanity). What bounds a withdraw is the engine's
+         * share cap (`assertWithdrawWithinModelBFence`) and the verifier's receiver pin, and it is admitted ONLY
+         * under fence v2 and ONLY for a permission minted under cap ruleset v2 (the person consented to withdraws).
+         */
+        const inputTokens = services.fenceBound?.inputTokens ?? MODEL_B_INPUT_TOKENS_V1;
+        // A withdraw is recognised by its INPUT being a registry share token; anything else takes the swap path
+        // (and a token outside the allow-list is refused there, by the original message).
+        const isWithdraw = modelBWithdrawToken(verified.token) !== undefined;
+        let capGross;
+        let capToken;
+        if (isWithdraw) {
+            if (fence.version < 2) {
+                return refuse('DELEGATION_OUTSIDE_FENCE', `a delegated vault withdraw needs fence v${MODEL_B_POLICY_VERSION}; the project fence is v${fence.version} — nothing is submitted`);
+            }
+            assertWithdrawWithinModelBFence({
+                token: verified.token,
+                spender: verified.spender,
+                gross: verified.gross,
+                outputToken: verified.outputToken,
+            });
+            capGross = 0n;
+            capToken = MODEL_B_INPUT_TOKENS_V1[0];
+        }
+        else {
+            const bound = assertWithinModelBFence(verified, services.fenceBound?.perSwapCapUsd, inputTokens);
+            capGross = verified.gross;
+            capToken = bound.token;
+        }
+        /**
+         * 5b. THE SEND GATE (Founder word `delegate cap choice`; ROUND 4, built to the codex gate's own
+         * prescription after it NO-GO'd rounds 1–3).
+         *
+         * ══════════════════════════════════════════════════════════════════════════════════════════════
+         * 🔴 WHAT THIS REFUSES, AND WHY IT IS A CONFIRMED RECORD RATHER THAN A ROW
+         * ══════════════════════════════════════════════════════════════════════════════════════════════
+         * Round 3 read a durable row keyed by `(userId, grant.expiresAt)`. The gate's two CRITICALs:
+         *
+         *   "The durable row still authenticates an expiry, not a grant … it does not require a successful
+         *    confirmation, the reservation's mintKey, or an active-grant pointer."
+         *   "Confirmation is not an enforcement gate. Reserve writes the complete enforceable capability;
+         *    confirm writes no state at all."
+         *
+         * So a reservation was a bearer capability: anyone who could ask CDP for a grant at that instant —
+         * the agent CLI, an SDK client, a second tab — inherited the cap without confirming.
+         *
+         * The gate now asks for the CONFIRMED-ACTIVE record and nothing else. A reserved, superseded,
+         * revoked or expired record is not returned by `readActive` at all, so:
+         *
+         *   · a grant minted at a reserved instant WITHOUT confirming is refused `DELEGATION_CAP_UNCONFIRMED`;
+         *   · a grant that is not the one the confirmed record names — an old expiry reused, a permission
+         *     minted elsewhere — is refused `DELEGATION_CAP_MISMATCH`;
+         *   · a record from a NEWER cap ruleset than this worker implements is refused
+         *     `DELEGATION_CAP_RULESET_STALE`, which is what stops a rolling deploy's older binary executing
+         *     a new permission at the shared ceiling.
+         *
+         * None of them fall back to the engine's $5,000: "missing means the ceiling" would turn every one of
+         * these into a silent widening of somebody's permission.
+         *
+         * 🔴 AND IT IS RE-DERIVED FROM CURRENT DURABLE STATE ON EVERY READ, never from a boot-time map, so a
+         * process that missed another's confirmation still sees it — and a store that cannot be read THROWS
+         * rather than answering "nothing is confirmed", because those two have opposite consequences.
+         */
+        const readActiveCap = async () => {
+            if (!services.capStore.available) {
+                return refuse('DELEGATION_CAP_STORE_UNAVAILABLE', `the per-swap cap for this delegation cannot be read, so what the user agreed to is unknown; nothing is submitted (${services.capStore.unavailableReason ?? 'store unavailable'})`);
+            }
+            let active;
+            try {
+                active = await services.capStore.readActive(input.userId, runtime.nowMs());
+            }
+            catch {
+                return refuse('DELEGATION_CAP_STORE_UNAVAILABLE', 'the per-swap cap for this delegation could not be read, so what the user agreed to is unknown; nothing is submitted');
+            }
+            if (!active) {
+                return refuse('DELEGATION_CAP_UNCONFIRMED', 'no confirmed permission stands for this end user on this server, so what they agreed to is unknown; nothing is submitted. Check status and use Stop if a grant remains active');
+            }
+            if (active.requiredVersion > MODEL_B_CAP_RULESET_VERSION) {
+                return refuse('DELEGATION_CAP_RULESET_STALE', `this permission requires cap ruleset v${active.requiredVersion} and this server implements v${MODEL_B_CAP_RULESET_VERSION}; nothing is submitted until the newer build is serving`);
+            }
+            /**
+             * 🔴 THE CONFIRMED RECORD MUST NAME THE GRANT THAT IS ACTUALLY LIVE. Without this the record would
+             * be a standing authorisation for whatever grant the user happens to hold, which is the round-3
+             * defect one layer up.
+             */
+            if (Date.parse(active.expiresAt) !== expiresAtMs) {
+                return refuse('DELEGATION_CAP_MISMATCH', 'the delegation that reads back is not the one this permission was confirmed for; nothing is submitted. Check status and use Stop if you want to revoke the current grant');
+            }
+            return {
+                capUsd: active.perSwapCapUsd,
+                expiresAt: active.expiresAt,
+                requiredVersion: active.requiredVersion,
+            };
+        };
+        const active = await readActiveCap();
+        const userCapUsd = active.capUsd;
+        if (isWithdraw && active.requiredVersion < 2) {
+            return refuse('DELEGATION_WITHDRAW_UNCONSENTED', `this permission was minted under cap ruleset v${active.requiredVersion}, before vault withdraws existed; nothing is submitted. Vault withdrawal is unavailable under this grant; use an independently qualifying user-signed exit or seek support. Stop only revokes future delegated use`);
+        }
+        assertWithinUserPerSwapCap(capGross, userCapUsd, capToken);
+        /**
+         * 🔴 AND IT IS RE-CHECKED BEFORE EVERY STEP, AND AGAIN AFTER THE TRANSACTION IS BUILT.
+         *
+         * The plan is three transactions. `beforeEachStep` re-reads the grant and the confirmed record
+         * between them, which catches a revoke-and-re-mint from another tab. The gate found the remaining
+         * window: "the final asynchronous grant/cap check still happens before transaction construction …
+         * only a synchronous abort check precedes raw submission. A revoke/re-mint to a narrower cap during
+         * transaction building therefore escapes the last authoritative check."
+         *
+         * So the async re-read stores what it saw, and a SYNCHRONOUS assertion over that value runs after
+         * the nonce/fee/gas round trips and immediately before the hand-off. It cannot await — awaiting is
+         * what opened the window — so what it closes is the interval between the last read and the send,
+         * using the freshest value that exists. The irreducible residual is the network round trip itself,
+         * which no vendor CAS is offered to close.
+         */
+        let lastSeenCapUsd = userCapUsd;
+        let lastSeenRequiredVersion = active.requiredVersion;
+        let lastSeenGrantOk = true;
+        /** Re-read the grant and the confirmed record; record what was seen. Used by both hooks below. */
+        const refreshSeen = async () => {
+            const current = await services.rig.rig.readDelegation(input.userId);
+            lastSeenGrantOk = current !== undefined && Date.parse(current.expiresAt) === expiresAtMs;
+            if (!lastSeenGrantOk)
+                return;
+            const seen = await readActiveCap();
+            lastSeenCapUsd = seen.capUsd;
+            lastSeenRequiredVersion = seen.requiredVersion;
+        };
+        /** A withdraw's consent is re-asserted wherever the cap is (codex gate r1: true at all three points). */
+        const assertWithdrawConsent = () => {
+            if (isWithdraw && lastSeenRequiredVersion < 2) {
+                return refuse('DELEGATION_WITHDRAW_UNCONSENTED', 'the confirmed permission changed to one minted before vault withdraws existed; the remaining steps are not submitted');
+            }
+        };
+        /** Between steps: the plan must still be admissible before the next one is even built. */
+        const beforeEachStep = async () => {
+            await refreshSeen();
+            if (!lastSeenGrantOk) {
+                return refuse('DELEGATION_NOT_ACTIVE', 'the delegation changed while the plan was in flight; the remaining steps are not submitted');
+            }
+            assertWithdrawConsent();
+            assertWithinUserPerSwapCap(capGross, lastSeenCapUsd, capToken);
+        };
+        /**
+         * 🔴 AND AGAIN AFTER THE TRANSACTION IS BUILT — the window the gate named. The nonce, fee and gas
+         * round trips take real time, and a revoke or a narrower re-mint landing inside them was invisible
+         * to the check between steps. This one runs after construction; the synchronous assertion below then
+         * acts on what it found, with nothing awaited between it and the hand-off.
+         */
+        const afterBuild = refreshSeen;
+        const beforeSubmit = () => {
+            if (!lastSeenGrantOk) {
+                return refuse('DELEGATION_NOT_ACTIVE', 'the delegation changed while this transaction was being built; it is not submitted');
+            }
+            assertWithdrawConsent();
+            assertWithinUserPerSwapCap(capGross, lastSeenCapUsd, capToken);
+        };
+        // 6. CLAIM DURABLY, THEN SEND. The partial UNIQUE index is the cross-process per-user lock.
+        let begun;
+        try {
+            if (!services.workerGuards?.available)
+                throw new Error('worker guard store unavailable');
+            // Only a genuinely new artifact may create its permanent guard. If a durable row already exists,
+            // missing/corrupt guard metadata is a hard recovery refusal; recreating it could manufacture
+            // ownership while an old worker still holds a deleted or replaced inode.
+            const durableBeforeGuard = await services.operationStore.readArtifact(binding.artifactId);
+            if (durableBeforeGuard &&
+                (durableBeforeGuard.state === 'confirmed' || durableBeforeGuard.state === 'failed'))
+                return durableReplayOrRefusal(durableBeforeGuard, binding);
+            durableWorkerGuard = await services.workerGuards.acquire('delegated', binding.artifactId, durableBeforeGuard === undefined);
+            begun = await services.operationStore.begin(binding, runtime.nowMs());
+        }
+        catch (error) {
+            if (error instanceof ExecutionWorkerBusyError) {
+                return refuse('DELEGATION_ARTIFACT_IN_FLIGHT', 'the durable worker for this artifact is still active; wait for its result');
+            }
+            if (error instanceof DelegationOperationJournalNotReadyError) {
+                return refuse('DELEGATION_OPERATION_JOURNAL_NOT_READY', 'delegated execution is paused until every pre-journal worker has drained and journal coverage is marked ready');
+            }
+            return refuse('DELEGATION_OPERATION_STORE_UNAVAILABLE', 'the delegated operation could not be claimed durably; nothing is submitted');
+        }
+        if (begun.outcome === 'mismatch') {
+            return refuse('DELEGATION_REPLAY_MISMATCH', 'this artifact is durably bound to a different request; nothing is submitted');
+        }
+        if (begun.outcome === 'busy') {
+            return refuse('DELEGATION_OPERATION_UNRESOLVED', `another delegated operation (${begun.record.artifactId}) for this end user is ${begun.record.state}; resolve it before starting a conflicting send`);
+        }
+        if (begun.outcome === 'conflict') {
+            return refuse('DELEGATION_OPERATION_UNRESOLVED', `this end user has an unresolved ${begun.kind} operation (${begun.claimId}); resolve it before starting a delegated send`);
+        }
+        if (begun.outcome === 'existing')
+            return durableReplayOrRefusal(begun.record, binding);
+        durableStarted = true;
+        // Seal every static success field while no request has reached CDP. A replacement process can then
+        // reconstruct the exact three-step result from canonical stored receipts without re-running policy,
+        // quote or verification logic against newer state. A pre-upgrade row has no context and stays open.
+        const recoveryContext = verifiedRecoveryContext(input, user, verified, { id: fence.id, rulesDigest: fence.rulesDigest, userCapUsd, name: fence.name }, grant.expiresAt);
+        await services.operationStore.setRecoveryContext(binding, recoveryContext, runtime.nowMs());
         const signer = new CdpDelegatedSigner(services.rig.rig, user, {
             sealedWait: services.sealedWait,
+            beforeEachStep,
+            afterBuild,
+            beforeSubmit,
+            // The grant this plan is bound to: the revocation marker is per grant, so the signer names one.
+            grantExpiresAt: grant.expiresAt,
+            submissionJournal: operationJournal(services.operationStore, binding, runtime.nowMs),
         });
         let sent;
         try {
             sent = await signer.sendPlan(verified);
+            allPlanStepsConfirmed = true;
         }
         catch (error) {
+            retainUnresolvedAfterHalt = error instanceof DelegatedPlanHaltedError;
             // Something may have reached the chain: this artifact is never retried on this server.
             const refusal = toDelegationRefusal(error) ??
                 new ExecutionRefusal('DELEGATED_PLAN_HALTED', 'delegated plan halted (upstream_failure); the artifact is not retried on this server — prepare again');
             submission.state = { kind: 'halted', refusal };
+            if (!retainUnresolvedAfterHalt) {
+                try {
+                    await services.operationStore.finalizeFailure(binding, refusal.code, runtime.nowMs());
+                }
+                catch {
+                    // A failed finalization leaves the partial-index guard unresolved. Never retry CDP or erase it.
+                }
+            }
             throw refusal;
         }
-        const result = verifiedResult(input, user, verified, sent, fence, grant.expiresAt);
+        if (!(await liveDelegatedSuccessIsFinalized(services, binding))) {
+            return refuse('DELEGATION_OPERATION_UNRESOLVED', 'all three delegated transactions were included, but their exact receipts are still pending Base finality; the operation and unified claim remain open — use Check Base receipts to reconcile it later');
+        }
+        const result = verifiedResult(input, user, verified, sent, { id: fence.id, rulesDigest: fence.rulesDigest, userCapUsd, name: fence.name }, grant.expiresAt);
+        await services.operationStore.finalizeSuccess(binding, result, runtime.nowMs());
         submission.state = { kind: 'sent', result };
         return result;
     }
     catch (error) {
         // A refusal BEFORE any send leaves no trace: the caller may fix the request and resubmit the same artifact.
-        if (submission.state.kind === 'in_flight')
+        if (submission.state.kind === 'in_flight') {
+            if (durableStarted && !allPlanStepsConfirmed && !retainUnresolvedAfterHalt) {
+                const code = isExecutionRefusal(error) ? error.code : 'DELEGATION_UPSTREAM_FAILED';
+                try {
+                    await services.operationStore.finalizeFailure(binding, code, runtime.nowMs());
+                }
+                catch {
+                    // The unresolved row is the safety outcome. Do not mask the original error.
+                }
+            }
             records.delete(artifactId);
+        }
         throw error;
     }
     finally {
+        durableWorkerGuard?.release();
         release();
     }
 }
@@ -574,9 +967,26 @@ export async function openDelegationServicesFromEnv(env) {
     if (chainId !== MODEL_B_CHAIN_ID) {
         throw new Error(`BASE_RPC_URL reports chainId ${chainId}, expected ${MODEL_B_CHAIN_ID} (Base mainnet)`);
     }
+    const operationRoot = resolveDelegationCapStorePath();
     return Object.freeze({
         rig: createDelegationRig(cdp, pub),
+        pub,
         serverSecret: env.serverSecret,
+        // 🔴 An unconfigured store does NOT stop the boot — it opens UNAVAILABLE, and every delegated send
+        // then refuses `DELEGATION_CAP_STORE_UNAVAILABLE` by name. Refusing to boot would also take down the
+        // read-only tools (status, revoke, the public fence promise) and, in particular, the REVOKE that lets
+        // a person withdraw authority — the one control that must never be collateral damage.
+        capStore: await createDelegationCapStore(),
+        operationStore: await createDelegationOperationStore(),
+        exitStore: await createDelegationExitStore(),
+        workerGuards: operationRoot
+            ? await openExecutionWorkerGuardStore(operationRoot)
+            : unavailableExecutionWorkerGuardStore('no durable operation guard directory is configured'),
+        // Default FALSE in code: an operator who never sets the variable gets the paused surface, never an
+        // unfenced first rollout. Read once at boot, so a mid-life environment change needs a redeploy —
+        // which is exactly what the rollout runbook does.
+        mintEnabled: resolveDelegationMintEnabled(),
+        tradeMintEnabled: false,
         ...(env.publicProjectId ? { publicProjectId: env.publicProjectId } : {}),
     });
 }

package/dist/execution-errors.d.ts

@@ -1,4 +1,4 @@
-export declare const EXECUTION_REFUSAL_CODES: readonly ["ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_EXPIRY_EXCEEDS_BOUND", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED"];
+export declare const EXECUTION_REFUSAL_CODES: readonly ["HYPERLIQUID_RETIRED", "ATTRIBUTION_MISSING", "LIFI_FEE_CAP_EXCEEDED", "ACCOUNT_BINDING_MISMATCH", "DIGEST_MISMATCH", "ARTIFACT_INVALID", "STALE_ARTIFACT", "EXECUTION_RATE_LIMITED", "EXECUTION_CONCURRENCY_FULL", "UNSUPPORTED_ACCOUNT_PROFILE", "LIFI_QUOTE_FAILED", "LIFI_QUOTE_INVALID", "UNSUPPORTED_LIFI_ROUTE", "POLYMARKET_METADATA_FAILED", "POLYMARKET_METADATA_INVALID", "UNSUPPORTED_POLYMARKET_MARKET", "POLYMARKET_ORDER_INVALID", "POLYMARKET_BUILDER_FEE_UNRULED", "HYPERLIQUID_META_FAILED", "HYPERLIQUID_META_INVALID", "UNSUPPORTED_HYPERLIQUID_MARKET", "HYPERLIQUID_ORDER_INVALID", "DELEGATION_UNAVAILABLE", "DELEGATION_UNAUTHORIZED", "DELEGATION_INPUT_INVALID", "DELEGATION_BUSY", "DELEGATION_ARTIFACT_IN_FLIGHT", "ARTIFACT_NOT_PREPARED_HERE", "PREPARED_ARTIFACT_CAPACITY", "ARTIFACT_ID_COLLISION", "DELEGATION_REPLAY_MISMATCH", "DELEGATION_FENCE_ABSENT", "DELEGATION_FENCE_FOREIGN", "DELEGATION_FENCE_AMBIGUOUS", "DELEGATION_FENCE_NEWER", "DELEGATION_TOKEN_INVALID", "DELEGATION_REVOKE_NOT_CONFIRMED", "DELEGATION_NOT_ACTIVE", "DELEGATION_EXPIRY_EXCEEDS_BOUND", "DELEGATION_USER_UNKNOWN", "DELEGATION_OUTSIDE_FENCE", "DELEGATION_ABOVE_USER_CAP", "DELEGATION_CAP_UNRECORDED", "DELEGATION_CAP_GRANT_CHANGED", "DELEGATION_CAP_EXPIRY_UNAVAILABLE", "DELEGATION_CAP_UNCONFIRMED", "DELEGATION_CAP_MISMATCH", "DELEGATION_CAP_RULESET_STALE", "DELEGATION_CAP_SUPERSEDED", "DELEGATION_CAP_STORE_UNAVAILABLE", "DELEGATION_OPERATION_STORE_UNAVAILABLE", "DELEGATION_OPERATION_JOURNAL_NOT_READY", "DELEGATION_OPERATION_UNRESOLVED", "DELEGATION_EXIT_UNAVAILABLE", "DELEGATION_EXIT_NOT_FOUND", "DELEGATION_EXIT_MISMATCH", "DELEGATION_EXIT_STALE_OWNER", "DELEGATION_EXIT_GRANT_ACTIVE", "DELEGATION_EXIT_UNRESOLVED", "DELEGATION_MINT_PAUSED", "DELEGATION_CAP_CANCELLED", "DELEGATED_PLAN_REFUSED", "DELEGATED_PLAN_HALTED", "DELEGATION_UPSTREAM_FAILED", "YIELD_MARKET_UNKNOWN", "YIELD_DEPOSIT_UNAVAILABLE", "YIELD_REGISTRY_MISMATCH", "YIELD_PREVIEW_UNAVAILABLE", "YIELD_DEPOSIT_PARITY", "YIELD_WITHDRAW_PARITY", "DELEGATION_WITHDRAW_UNCONSENTED", "EQUITY_UNKNOWN", "EQUITY_REGISTRY_MISMATCH", "EQUITY_ORACLE_UNAVAILABLE", "EQUITY_ORACLE_FROZEN", "STOCK_BUY_PARITY"];
 export type ExecutionRefusalCode = (typeof EXECUTION_REFUSAL_CODES)[number];
 /** A fail-closed, machine-readable refusal. No upstream response bodies or secrets are retained. */
 export declare class ExecutionRefusal extends Error {