sealbridge 0.4.2 → 0.5.0

package/dist/packages/runtime/dist/session.js

@@ -1,4 +1,6 @@
 // SPDX-License-Identifier: Apache-2.0
+import { ApprovalGate } from './policy.js';
+import { assembleDelegation, redelegationTarget, requireOwnerDecision, verifyRecoveredDelegation, verifyDelegationAttachment } from './delegation.js';
 import { IdempotencyStore, runtimeIdempotencyAction, unwrapIdempotency, validateIdempotencyKey } from './idempotency-store.js';
 import { RecipientDeliveryCoordinator } from './delivery-status.js';
 import { setDeliveryStatusReaderFactory } from './delivery-status-router.js';
@@ -9,8 +11,9 @@ import { existsSync, openSync, closeSync, fstatSync, fchmodSync, appendFileSync,
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomUUID } from 'node:crypto';
-import { createContract, createCapability, createSignedAgentCard, createInviteToken, parseAndVerifyInviteToken, isInviteTarget, validateRelayEndpointUrl, signPayload, verifySigned, verifyEnvelope, verifyContract, verifyApproval, validateManifest, validateOutput, verifyCapabilityChain, capabilityIssuerControls, findDiscoveredAgentCard, discoverAgentCards, schemaNarrows, digest, openEnvelope, resolveDid, createRevocationNotice, verifyRevocationNotice, RevocationRegistry, signEnvelope, DEFAULT_CLOCK_SKEW_MS, assertConnectionsOptions, isConnectionEvent, } from '../../core/dist/index.js';
-import { parseJsonl, verifyAudit } from '../../ledger/dist/index.js';
+import { createContract, assertDelegationAttenuation, createDelegationLink, createCapability, createSignedAgentCard, createInviteToken, parseAndVerifyInviteToken, isInviteTarget, validateRelayEndpointUrl, signPayload, verifySigned, verifyEnvelope, verifyContract, verifyApproval, validateManifest, validateOutput, verifyCapabilityChain, capabilityIssuerControls, findDiscoveredAgentCard, discoverAgentCards, schemaNarrows, digest, openEnvelope, resolveDid, createRevocationNotice, verifyRevocationNotice, RevocationRegistry, signEnvelope, DEFAULT_CLOCK_SKEW_MS, assertConnectionsOptions, isConnectionEvent, buildContextGrant, validateContextGrantUse, } from '../../core/dist/index.js';
+import { CONTEXT_GRANT_AUDIT_EVENTS, proposalAuditDigest, verifyContextAcceptanceAudit } from './context-grant-audit.js';
+import { parseJsonl, verifyAudit, createAuditInterruption, JsonlStore } from '../../ledger/dist/index.js';
 import { HttpRelayClient, waitForRelayRetry, relayDiagnostic, relayDeadline, validateRelayAuthRecoveryOptions } from '../../relay/dist/index.js';
 import { InteractiveCliApprovalProvider, ProposalRejectedError, evaluateContractAcceptance, } from './approval-providers.js';
 import { OwnerGateway } from './gateway.js';
@@ -175,6 +178,7 @@ const WORKER_BOUND_EVENTS = new Set([
     'CHECKPOINT',
 ]);
 const REQUESTER_BOUND_EVENTS = new Set([
+    ...CONTEXT_GRANT_AUDIT_EVENTS,
     'ACCEPT',
     'ATTEST',
     'START',
@@ -457,6 +461,8 @@ export class WorkerNode {
         assertConnectionsOptions(options);
         validateRelayAuthRecoveryOptions(options);
         validateSessionTimeouts(options);
+        if (options.auditInterruptionFormat !== undefined && options.auditInterruptionFormat !== 1)
+            throw new Error('UNSUPPORTED_AUDIT_INTERRUPTION_FORMAT');
         this.protocol = new LiveProtocol(options);
         this.intakeStore = options.intakeStore ?? new WorkerTrustStore(options.owner, {
             path: options.identityOptions ? workerIntakePath(options.owner.did, options.identityOptions) : undefined,
@@ -707,6 +713,23 @@ export class WorkerNode {
         return protocolVersion === '0.2.0' && this.connectionStore.connectionState(did) === 'connected' ? 'limited' : 'unknown';
     }
     async notifyOutcome(record, outcome = record.outcome) {
+        if (outcome.result?.state === 'SETTLED') {
+            const entries = outcome.result.bundle.entries;
+            const proposal = entries.find(e => e.body.eventType === 'PROPOSE')?.body.payload;
+            const accepted = entries.find(e => e.body.eventType === 'ACCEPT')?.body.payload;
+            const delivered = entries.find(e => e.body.eventType === 'DELIVER')?.body.payload;
+            const retainedManifest = accepted?.contract?.manifest ??
+                proposal?.proposal?.payload;
+            const grantBearing = record.delegation || (retainedManifest ? !!retainedManifest.contextGrant :
+                !!proposal?.grantDigest);
+            if (grantBearing) {
+                if (!delivered || proposalAuditDigest(proposal) !== record.proposalDigest)
+                    throw new Error('DELEGATION_INVALID');
+                verifyRecoveredDelegation(delivered, proposal, accepted, record.delegation?.parentContract);
+                if (record.delegation && digest(assembleDelegation(record.delegation)) !== digest(delivered.delegation))
+                    throw new Error('DELEGATION_INVALID');
+            }
+        }
         const send = (recovery) => this.relay.send(signEnvelope({ taskId: record.taskId,
             recipientDid: record.requesterDid, seq: 0, eventType: 'ERROR',
             payload: asJson({ code: outcome.code, recovery }),
@@ -736,6 +759,38 @@ export class WorkerNode {
         else
             this.taskJournal.save(record);
     }
+    /** Intent is durable before audit append; retries reuse the entire original signed record. */
+    closeInterruptedAudit(record, reason, expectedEntries, save = record => this.saveTaskCheckpoint(record)) {
+        if (!record.auditPath || !record.auditStage || record.auditStage === 'OUT_OF_SCOPE')
+            return record;
+        const store = new JsonlStore(record.auditPath);
+        const entries = store.read();
+        if (expectedEntries && digest(entries) !== digest(expectedEntries))
+            throw new Error('AUDIT_PREFIX_MISMATCH');
+        const proposal = entries[0]?.body.payload;
+        if (!proposal || digest({ manifest: proposal.proposal.payload, input: proposal.input }) !== record.proposalDigest)
+            throw new Error('AUDIT_PREFIX_MISMATCH');
+        if (!record.auditClosure) {
+            const interruption = createAuditInterruption(entries, this.options.owner, record.auditStage, reason);
+            record = { ...record, auditClosure: { state: 'pending', interruption } };
+        }
+        store.closeInterrupted({ entries, interruption: record.auditClosure.interruption }, () => save(record));
+        const written = { ...record, auditClosure: { ...record.auditClosure, state: 'written' } };
+        save(written);
+        return written;
+    }
+    reportInterruptionFailure(taskId) {
+        // Keep the original task outcome separately; never expose arbitrary I/O exception text.
+        try {
+            this.reportRejection(taskId, new Error('AUDIT_INTERRUPTION_WRITE_FAILED'));
+        }
+        catch {
+            try {
+                this.options.onEvent?.('REJECTED', taskId, { code: 'AUDIT_INTERRUPTION_WRITE_FAILED' });
+            }
+            catch { }
+        }
+    }
     async reconcileTasks() {
         if (this.reconciled || !this.taskJournal)
             return;
@@ -745,7 +800,20 @@ export class WorkerNode {
             this.taskJournal.load();
         for (const saved of [...this.taskJournal.tasks.values()]) {
             let record = saved;
-            const pending = this.intakeStore.pendingTask(record.requesterDid, record.taskId, record.proposalDigest);
+            // Pending intents are retried even if the business outcome was already made terminal.
+            // Old files have no explicit auditStage and are never backfilled, even with opt-in enabled.
+            if (record.auditStage && record.auditStage !== 'OUT_OF_SCOPE' &&
+                !record.outcome?.result && record.auditClosure?.state !== 'written' &&
+                (record.phase !== 'terminal' || record.outcome?.code === 'TASK_INTERRUPTED' || record.auditClosure?.state === 'pending')) {
+                try {
+                    record = this.closeInterruptedAudit(record, 'WORKER_RESTART_OBSERVED');
+                }
+                catch {
+                    record = this.taskJournal.tasks.get(record.taskId) ?? record;
+                    this.reportInterruptionFailure(record.taskId);
+                }
+            }
+            const pending = !record.auditClosure && this.intakeStore.pendingTask(record.requesterDid, record.taskId, record.proposalDigest);
             if (record.phase !== 'terminal') {
                 const result = this.sealedTaskResult(record);
                 // Adapters expose executeTask only. Unknown execution/tool results cannot be retried safely.
@@ -781,14 +849,19 @@ export class WorkerNode {
             if (!verifyAudit(bundle, { taskId: record.taskId, actors: [record.requesterDid, this.options.owner.did] }).valid)
                 return;
             const proposal = bundle.entries.find((entry) => entry.body.eventType === 'PROPOSE')?.body.payload;
-            if (!proposal || digest({ manifest: proposal.proposal.payload, input: proposal.input }) !== record.proposalDigest)
+            if (proposalAuditDigest(proposal) !== record.proposalDigest)
                 return;
             const last = bundle.entries.at(-1)?.body.eventType;
             if (last === 'CANCEL')
                 return { taskId: record.taskId, state: 'CANCELLED', deliverable: null, bundle };
             const delivery = bundle.entries.find((entry) => entry.body.eventType === 'DELIVER')?.body.payload;
-            if (last === 'SETTLED' && delivery)
+            if (last === 'SETTLED' && delivery) {
+                const accepted = bundle.entries.find(entry => entry.body.eventType === 'ACCEPT')?.body.payload;
+                verifyRecoveredDelegation(delivery, proposal, accepted, record.delegation?.parentContract);
+                if (record.delegation && digest(assembleDelegation(record.delegation)) !== digest(delivery.delegation))
+                    return;
                 return { taskId: record.taskId, state: 'SETTLED', deliverable: delivery.artifact.payload.data, bundle };
+            }
         }
         catch { /* An unsealed or partial audit is evidence to preserve, not authorization to rerun. */ }
         return undefined;
@@ -873,8 +946,8 @@ export class WorkerNode {
         return true;
     }
     /** Local signed diagnostics are separate from the bilateral hash-chain ledger. */
-    reportRejection(taskId, error) {
-        const diagnostic = rejectionBody(error);
+    reportRejection(taskId, error, contextGrant = false) {
+        const diagnostic = rejectionBody(error, contextGrant);
         if (this.options.auditPath) {
             const fd = openSync(this.options.auditPath + '.errors.jsonl', constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
             try {
@@ -1003,6 +1076,7 @@ export class WorkerNode {
         let m;
         let auditPath;
         let checkpoint;
+        let auditStage;
         const saveCheckpoint = (patch) => {
             if (!checkpoint || !this.taskJournal)
                 return;
@@ -1013,6 +1087,16 @@ export class WorkerNode {
             saveCheckpoint({ phase: 'terminal', outcome, notificationPending: true });
             this.deliveryService?.store.receipt(first, Date.parse(m.deadline), 'terminal', outcome.code);
         };
+        const setAuditStage = (stage) => {
+            if (this.options.auditInterruptionFormat !== 1 || !auditPath)
+                return;
+            // Format 1 requires a full, PROPOSE-only prefix. Grant audits use compact
+            // proposal evidence and bilateral lifecycle entries, outside that scope.
+            if (m.contextGrant)
+                return;
+            auditStage = stage;
+            saveCheckpoint({ auditStage: stage });
+        };
         const acknowledgeProposal = async (signal) => {
             this.deliveryService?.store.receipt(first, Date.parse(m.deadline), 'processed');
             await acknowledgeRelay(relay, first, signal);
@@ -1032,6 +1116,18 @@ export class WorkerNode {
                 throw new Error('INVALID_PROPOSAL');
             this.assertPeer(first.payload.senderDid);
             validateManifest(manifest);
+            validateContextGrantUse(manifest, data.input, this.protocol.now());
+            if (manifest.contextGrant?.deliveryMode === 'approval_redelegation') {
+                const facility = this.options.redelegation;
+                if (!facility || !this.options.auditPath || !this.taskJournal)
+                    throw new Error('DELEGATION_INVALID');
+                requireOwnerDecision(facility.ownerApprovalProvider);
+                requireOwnerDecision(facility.requester.approvalProvider);
+                if (facility.requester.options.owner.did !== this.options.owner.did)
+                    throw new Error('DELEGATION_INVALID');
+            }
+            if (manifest.contextGrant && this.options.inboxPath)
+                throw new Error('CONTEXT_GRANT_INPUT_RETENTION_CONFLICT');
             m = manifest;
             auditPath = this.options.auditPath
                 ? this.completed++ === 0 && !existsSync(this.options.auditPath)
@@ -1057,14 +1153,14 @@ export class WorkerNode {
             }
         }
         catch (e) {
-            this.reportRejection(first.payload.taskId, e);
+            this.reportRejection(first.payload.taskId, e, !!data?.proposal?.payload?.contextGrant);
             try {
                 await relay.send(signEnvelope({
                     taskId: first.payload.taskId,
                     recipientDid: first.payload.senderDid,
                     seq: 0,
                     eventType: 'ERROR',
-                    payload: asJson(rejectionBody(e)),
+                    payload: asJson(rejectionBody(e, !!data?.proposal?.payload?.contextGrant)),
                 }, this.options.owner, { encrypt: true }));
             }
             catch {
@@ -1078,7 +1174,7 @@ export class WorkerNode {
                 messageId: receiptFileId(first.payload.envelopeId), peerOwnerDid: m.requester.ownerDid,
                 relayUrl: this.options.relayUrl ?? (typeof this.options.relay === 'string' ? this.options.relay : this.agentCard.payload.relayEndpoint),
                 deliveryDeadline: Date.parse(m.deadline),
-            } } : undefined);
+            } } : undefined, m.contextGrant);
         const cancelController = new AbortController();
         wire.earlyCancel = () => cancelController.abort('CANCELLED');
         let heartbeat;
@@ -1094,7 +1190,30 @@ export class WorkerNode {
             }
         };
         let gateway, workspace;
+        let childHostOpen = true;
         let preserveWorkspace = false;
+        let proposalAudited = false;
+        const cleanupWorkspace = async () => {
+            if (!workspace)
+                return;
+            const path = workspace;
+            try {
+                await rm(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+                workspace = undefined;
+            }
+            catch (error) {
+                const code = error?.code ?? 'WORKSPACE_CLEANUP_FAILED';
+                // Reporting residual files must not replace settlement or the execution error.
+                try {
+                    if (this.options.onWorkspaceCleanupError)
+                        void Promise.resolve(this.options.onWorkspaceCleanupError({ taskId: m.taskId, workspaceDir: path, code }))
+                            .catch(() => { });
+                    else
+                        console.warn('Workspace cleanup incomplete (' + code + '): ' + path);
+                }
+                catch { }
+            }
+        };
         let trackedTaskId;
         // Progress metrics are applied synchronously. The tail only serializes wire frames.
         let progressTail = Promise.resolve();
@@ -1135,6 +1254,7 @@ export class WorkerNode {
             if (reason)
                 throw new ProposalRejectedError(reason);
             validateManifest(m);
+            validateContextGrantUse(m, data.input, this.protocol.now());
             if (!validateOutput(m.io.inputSchema, data.input))
                 throw new Error('INVALID_PROPOSAL');
             if (this.options.executionTimeoutMs !== undefined && m.budget.maxWallClockSeconds * 1000 > this.options.executionTimeoutMs)
@@ -1226,21 +1346,31 @@ export class WorkerNode {
             if (!contractProvider || peerTrust === 'limited' && (contractProvider.kind === 'policy' ||
                 contractProvider === this.approvalProvider && contractProvider.kind !== 'human'))
                 throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
+            if (m.contextGrant?.deliveryMode === 'approval_redelegation')
+                requireOwnerDecision(contractProvider);
             await wire.receiveEvent('PROPOSE', first);
+            proposalAudited = true;
+            await wire.contextEvent('CONTEXT_GRANT');
+            await wire.contextEvent('CONTEXT_MODE');
+            setAuditStage('OWNER_APPROVAL');
             const contract = createContract(m, data.proposal, this.options.owner);
+            const openingStarted = m.contextGrant?.deliveryMode === 'approval_redelegation' ? Date.now() : 0;
             const approval = await abortable(contractProvider.approve({
                 taskId: m.taskId,
                 gate: 'contract_acceptance',
                 target: contract.contractDigest,
                 details: {
-                    manifest: m,
-                    input: data.input,
+                    manifest: m.contextGrant?.deliveryMode === 'approval_redelegation' ? structuredClone(m) : m,
+                    input: m.contextGrant?.deliveryMode === 'approval_redelegation' ? structuredClone(data.input) : data.input,
                     capabilities: data.capabilityChains,
                     ...(inspection ? { inspection } : {}),
                     from: first.payload.senderDid,
                 },
                 signal: activeSignal,
             }), activeSignal);
+            if (m.contextGrant?.deliveryMode === 'approval_redelegation')
+                assertFreshDecision(approval, openingStarted);
+            setAuditStage('OUT_OF_SCOPE');
             if (this.trust(m.requester.ownerDid, m.protocolVersion) === 'unknown')
                 throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
             this.assertCapabilitiesActive(data.capabilityChains, capabilityContext);
@@ -1249,8 +1379,11 @@ export class WorkerNode {
                 throw new Error('APPROVAL_CHANNEL_UNAVAILABLE');
             gateway = new OwnerGateway(this.options.owner, contract, policy, this.revocation);
             const accepted = gateway.accept(approval);
+            validateContextGrantUse(m, data.input, this.protocol.now());
+            await wire.contextEvent('CONTEXT_OPENED');
             this.acceptedPeers.set(m.taskId, m.requester.ownerDid);
-            saveCheckpoint({ phase: 'accepted' });
+            saveCheckpoint({ phase: 'accepted', ...(m.contextGrant?.deliveryMode === 'approval_redelegation'
+                    ? { delegation: { parentContract: contract, attempts: [] } } : {}) });
             if (inspection?.inspectionStatus === 'complete')
                 this.deliveryService?.recipientStatus.observe(first.payload.envelopeId, 'opened');
             if (this.options.dailyLimit)
@@ -1287,7 +1420,10 @@ export class WorkerNode {
                     // Synchronous notification failures are also best effort.
                 }
             }
+            validateContextGrantUse(m, data.input, this.protocol.now());
+            setAuditStage('ACCEPT_ACK_WAIT');
             await wire.sendEvent('ACCEPT', { contract, transition: accepted, approval });
+            setAuditStage('OUT_OF_SCOPE');
             this.options.onEvent?.('ACCEPT', m.taskId);
             await wire.sendEvent('START', gateway.transition('START'));
             heartbeat = setTimeout(() => void sendHeartbeat(), this.options.heartbeatIntervalMs ?? 15_000);
@@ -1364,6 +1500,110 @@ export class WorkerNode {
                 void run.catch(() => undefined);
                 return run;
             };
+            const managedChildren = new Set();
+            let childrenClosed = false;
+            const delegationState = m.contextGrant?.deliveryMode === 'approval_redelegation'
+                ? { parentContract: structuredClone(contract), attempts: [] } : undefined;
+            const persistChildren = () => saveCheckpoint({ delegation: structuredClone(delegationState) });
+            const checkParent = () => {
+                executionSignal.throwIfAborted();
+                if (!childHostOpen || gateway.machine.state !== 'IN_PROGRESS' || wire.cancelHandled)
+                    throw new Error('DELEGATION_INVALID');
+                this.assertPeer(m.requester.ownerDid, m.taskId);
+                this.assertCapabilitiesActive(data.capabilityChains, capabilityContext);
+                validateContextGrantUse(m, data.input, this.protocol.now());
+                if (Date.parse(m.deadline) <= this.protocol.now())
+                    throw new Error('DELEGATION_INVALID');
+            };
+            const dispatchChild = async (request) => {
+                if (childrenClosed || !delegationState)
+                    throw new Error('DELEGATION_INVALID');
+                if (!request || Object.keys(request).some(k => !['to', 'relay', 'manifest', 'input', 'auditPath'].includes(k)))
+                    throw new Error('DELEGATION_INVALID');
+                const child = structuredClone(request.manifest), input = structuredClone(request.input);
+                if (Object.hasOwn(child, 'parentTaskId'))
+                    throw new Error('DELEGATION_INVALID');
+                assertDelegationAttenuation(m, child);
+                if (child.requester.ownerDid !== this.options.owner.did || child.taskId === m.taskId ||
+                    [m.requester.ownerDid, this.options.owner.did].includes(child.worker.ownerDid) ||
+                    delegationState.attempts.some(a => a.childTaskId === child.taskId))
+                    throw new Error('DELEGATION_INVALID');
+                checkParent();
+                validateContextGrantUse(child, input, this.protocol.now());
+                const facility = this.options.redelegation;
+                requireOwnerDecision(facility.ownerApprovalProvider);
+                requireOwnerDecision(facility.requester.approvalProvider);
+                if (facility.requester.options.owner.did !== this.options.owner.did)
+                    throw new Error('DELEGATION_INVALID');
+                let attempt;
+                const options = { to: request.to, relay: request.relay, manifest: child, input,
+                    title: child.task.title, description: child.task.description, auditPath: request.auditPath,
+                    signal: executionSignal, capabilityChains: [] };
+                managedChildHooks.set(options, {
+                    prepare: async (manifest, selectedInput, peer) => {
+                        checkParent();
+                        assertDelegationAttenuation(m, manifest);
+                        if (peer !== child.worker.ownerDid || peer === m.requester.ownerDid || peer === this.options.owner.did)
+                            throw new Error('DELEGATION_INVALID');
+                        const values = { childManifestDigest: digest(manifest), childInputDigest: digest(selectedInput), delegateeOwnerDid: peer };
+                        const target = redelegationTarget(contract, values), started = Date.now();
+                        const receipt = await abortable(facility.ownerApprovalProvider.approve({ taskId: m.taskId, gate: 'redelegation',
+                            target: structuredClone(target), details: { parentManifest: structuredClone(m), childManifest: structuredClone(manifest),
+                                input: structuredClone(selectedInput), delegateeOwnerDid: peer, depthRemaining: 0,
+                                disclosure: 'The root owner receives the complete signed parent and child contracts, including declarations and owner DIDs. Confirm this input, angle and task serve the parent purpose.' },
+                            signal: executionSignal, deadline: m.deadline }), executionSignal);
+                        checkParent();
+                        validateContextGrantUse(manifest, selectedInput, this.protocol.now());
+                        assertFreshDecision(receipt, started);
+                        gateway.approvals.require(m.taskId, 'redelegation', target, receipt);
+                        if (delegationState.attempts.some(a => a.childTaskId === child.taskId))
+                            throw new Error('DELEGATION_INVALID');
+                        attempt = { childTaskId: child.taskId, ...values, approval: receipt, status: 'approved' };
+                        delegationState.attempts.push(attempt);
+                        persistChildren();
+                    },
+                    beforeTransmit: (manifest, selectedInput) => {
+                        checkParent();
+                        validateContextGrantUse(manifest, selectedInput, this.protocol.now());
+                        if (!attempt || digest(manifest) !== attempt.childManifestDigest || digest(selectedInput) !== attempt.childInputDigest ||
+                            !verifyApproval(attempt.approval, this.options.owner.did, m.taskId, 'redelegation', redelegationTarget(contract, attempt)))
+                            throw new Error('DELEGATION_APPROVAL_REQUIRED');
+                        attempt.status = 'dispatching';
+                        persistChildren();
+                    },
+                    onAcceptedContract: acceptedChild => {
+                        if (!attempt)
+                            throw new Error('DELEGATION_INVALID');
+                        // Keep uncertainty durable if signing or publication fails after authenticated ACCEPT.
+                        attempt.status = 'unresolved';
+                        persistChildren();
+                        checkParent();
+                        const link = createDelegationLink({ parentContract: contract, childContract: acceptedChild }, this.options.owner);
+                        attempt.proof = { link, childContract: structuredClone(acceptedChild) };
+                        attempt.status = 'accepted';
+                        persistChildren();
+                    },
+                });
+                try {
+                    const result = await facility.requester.delegate(options);
+                    if (!attempt?.proof || result.state !== 'SETTLED')
+                        throw new Error('DELEGATION_INVALID');
+                    attempt.status = 'completed';
+                    persistChildren();
+                    return result;
+                }
+                catch (error) {
+                    if (attempt) {
+                        attempt.status = attempt.proof || attempt.status === 'approved' || error instanceof PeerRejectedError && attempt.status !== 'unresolved'
+                            ? 'failed' : 'unresolved';
+                        persistChildren();
+                    }
+                    throw error;
+                }
+                finally {
+                    managedChildHooks.delete(options);
+                }
+            };
             const context = {
                 taskId: m.taskId,
                 manifest: structuredClone(m),
@@ -1407,7 +1647,7 @@ export class WorkerNode {
                     }
                     if (metricsError) {
                         progressFailure ??= metricsError;
-                        const code = safeError(metricsError);
+                        const code = safeError(metricsError, !!m.contextGrant);
                         return enqueueProgress(async () => {
                             // Wait until any in-flight PROGRESS handshake finishes, then reject the session.
                             wireFailureSent = true;
@@ -1455,10 +1695,22 @@ export class WorkerNode {
                     return result;
                 },
             };
+            if (delegationState)
+                context.redelegate = request => {
+                    const operation = dispatchChild(request);
+                    managedChildren.add(operation);
+                    void operation.finally(() => managedChildren.delete(operation)).catch(() => { });
+                    return operation;
+                };
             this.assertPeer(m.requester.ownerDid, m.taskId);
             this.assertCapabilitiesActive(data.capabilityChains, capabilityContext);
+            validateContextGrantUse(m, data.input, this.protocol.now());
             this.deliveryService?.recipientStatus.handoff(first, m);
             const output = await abortable(this.options.adapter.executeTask(context), executionSignal);
+            childrenClosed = true;
+            if (delegationState)
+                await abortable(Promise.allSettled([...managedChildren]), executionSignal);
+            const delegation = delegationState ? assembleDelegation(delegationState) : undefined;
             if (!this.options.inboxPath)
                 await acknowledgeProposal(executionSignal);
             // A task may return while a queued progress update is still waiting for its ACK.
@@ -1473,7 +1725,11 @@ export class WorkerNode {
             const delivery = createDelivery(m.taskId, contract.contractDigest, output, gateway.quota.receipt(this.options.owner), this.options.owner, {
                 effectiveIsolationLevel,
                 ...(sandboxBoundary ? { sandboxBoundary } : {}),
-            });
+            }, delegation);
+            if (m.contextGrant && workspace) {
+                await cleanupWorkspace();
+                await wire.contextEvent('CONTEXT_DELETION_ATTEMPTED');
+            }
             const transition = gateway.transition('DELIVER');
             saveCheckpoint({ phase: 'delivered' });
             await wire.sendEvent('DELIVER', { ...delivery, transition });
@@ -1493,6 +1749,7 @@ export class WorkerNode {
             return { taskId: m.taskId, state: 'SETTLED', deliverable: output, bundle };
         }
         catch (e) {
+            childHostOpen = false;
             if (checkpoint?.outcome?.result) {
                 // The bilateral checkpoint is already durable even if its final relay send failed.
                 await this.notifyOutcome(checkpoint).then(() => saveCheckpoint({ notificationPending: false })).catch(() => { });
@@ -1516,23 +1773,47 @@ export class WorkerNode {
                     return { taskId: m.taskId, state: 'CANCELLED', deliverable: null, bundle };
                 }
                 catch (inner) {
-                    await wire.rawSend('ERROR', { code: safeError(inner) }).catch(() => { });
+                    await wire.rawSend('ERROR', { code: safeError(inner, !!m.contextGrant) }).catch(() => { });
                     throw inner;
                 }
             }
             await progressTail;
             preserveWorkspace = activeSignal.aborted || idleSignal.aborted;
+            const timeoutReason = activeSignal.reason instanceof Error ? activeSignal.reason.message : activeSignal.reason;
+            const interruptionReason = idleSignal.aborted ? 'WORKER_STOPPED' :
+                activeSignal.aborted && ['TASK_TIMEOUT', 'PEER_WAIT_TIMEOUT'].includes(String(timeoutReason)) ? 'SESSION_TIMEOUT' : undefined;
+            if (interruptionReason && auditStage && auditStage !== 'OUT_OF_SCOPE' && auditPath) {
+                const entries = await wire.quiesceAudit();
+                try {
+                    // No journal is available only to embedders without persisted task checkpoints.
+                    const record = checkpoint ?? { version: 1, taskId: m.taskId, requesterDid: m.requester.ownerDid,
+                        envelopeId: first.payload.envelopeId, proposalDigest: digest({ manifest: m, input: data.input }),
+                        phase: 'received', auditPath, auditStage, invocations: [] };
+                    this.closeInterruptedAudit(record, interruptionReason, entries, saved => {
+                        checkpoint = saved;
+                        this.saveTaskCheckpoint(saved);
+                    });
+                }
+                catch {
+                    this.reportInterruptionFailure(m.taskId);
+                }
+                saveOutcome({ code: 'TASK_INTERRUPTED' });
+            }
+            else if (auditStage && !preserveWorkspace)
+                setAuditStage('OUT_OF_SCOPE');
             if (idleSignal.aborted)
                 throw e;
-            const diagnostic = preserveWorkspace ? { code: 'TASK_INTERRUPTED' } : rejectionBody(progressFailure ?? e);
+            const diagnostic = preserveWorkspace ? { code: 'TASK_INTERRUPTED' } : rejectionBody(progressFailure ?? e, !!m.contextGrant);
             saveOutcome(diagnostic);
             this.deliveryService?.recipientStatus.end(first.payload.envelopeId);
             const refused = this.heldReview.list().find(r => r.taskId === m.taskId);
             if (refused && diagnostic.code !== 'PENDING_OWNER_APPROVAL' && !preserveWorkspace)
                 this.heldReview.discard(refused.id);
-            this.reportRejection(m.taskId, progressFailure ?? e);
+            this.reportRejection(m.taskId, progressFailure ?? e, !!m.contextGrant);
             if (!wireFailureSent) {
                 wireFailureSent = true;
+                if (proposalAudited && !preserveWorkspace && diagnostic.code !== 'PENDING_OWNER_APPROVAL')
+                    await wire.contextEvent('CONTEXT_DISCARDED').catch(() => { });
                 await wire.rawSend('ERROR', diagnostic)
                     .then(async () => {
                     saveCheckpoint({ notificationPending: false });
@@ -1548,6 +1829,7 @@ export class WorkerNode {
             throw e;
         }
         finally {
+            childHostOpen = false;
             this.deliveryService?.recipientStatus.end(first.payload.envelopeId);
             heartbeatStopped = true;
             clearTimeout(heartbeat);
@@ -1562,23 +1844,8 @@ export class WorkerNode {
             gateway?.close();
             if (idleSignal.aborted && checkpoint?.phase !== 'terminal')
                 preserveWorkspace = true;
-            if (workspace && !preserveWorkspace) {
-                try {
-                    await rm(workspace, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
-                }
-                catch (error) {
-                    const code = error?.code ?? 'WORKSPACE_CLEANUP_FAILED';
-                    // Reporting residual files must not replace settlement or the execution error.
-                    try {
-                        if (this.options.onWorkspaceCleanupError)
-                            void Promise.resolve(this.options.onWorkspaceCleanupError({ taskId: m.taskId, workspaceDir: workspace, code }))
-                                .catch(() => { });
-                        else
-                            console.warn('Workspace cleanup incomplete (' + code + '): ' + workspace);
-                    }
-                    catch { }
-                }
-            }
+            if (workspace && !preserveWorkspace)
+                await cleanupWorkspace();
         }
     }
     /**
@@ -1920,24 +2187,26 @@ class PendingTaskError extends Error {
 function diagnosticError(code, field, expected, actual, hint) {
     return new DiagnosticError(code, { field, expected: digest(expected), actual: digest(actual), hint });
 }
-function rejectionBody(error) {
+function rejectionBody(error, contextGrant = false) {
     if (error instanceof PendingTaskError)
         return { code: 'PENDING_OWNER_APPROVAL', reason: error.reason };
     if (error instanceof DiagnosticError)
-        return { code: safeError(error), detail: error.detail };
+        return { code: safeError(error, contextGrant), detail: error.detail };
     if (error instanceof ProposalRejectedError)
         return { code: error.code, reason: error.reason };
-    if (safeError(error) === 'PENDING_OWNER_APPROVAL')
+    if (safeError(error, contextGrant) === 'PENDING_OWNER_APPROVAL')
         return { code: 'PENDING_OWNER_APPROVAL', reason: PENDING_MESSAGE };
-    return { code: safeError(error) };
+    return { code: safeError(error, contextGrant) };
 }
-function safeError(e) {
+function safeError(e, contextGrant = false) {
     const s = String(e);
     const exact = e instanceof Error ? e.message.split(':')[0] : '';
     if (['OUTBOX_STORE_INVALID', 'OUTBOX_STORE_BUSY', 'OUTBOX_STORE_UNWRITABLE', 'OUTBOX_FULL',
-        'OUTBOX_DEADLINE_EXPIRED', 'DELIVERY_RECORD_CONFLICT'].includes(exact))
+        'OUTBOX_DEADLINE_EXPIRED', 'DELIVERY_RECORD_CONFLICT', 'AUDIT_INTERRUPTION_WRITE_FAILED'].includes(exact))
         return exact;
-    if (/^(PROTOCOL_|CONNECTION_|INVALID_CONNECTION_|QUARANTINE_|INSPECTION_|ACCESS_MODE_REMOVED|INVITE_REFERENCE_UNAVAILABLE)/.test(exact))
+    if (contextGrant && ['DELEGATION_PROOF_REQUIRED', 'DELEGATION_INVALID', 'DELEGATION_APPROVAL_REQUIRED'].includes(exact))
+        return exact;
+    if (/^(CONTEXT_GRANT_|PROTOCOL_|CONNECTION_|INVALID_CONNECTION_|QUARANTINE_|INSPECTION_|ACCESS_MODE_REMOVED|INVITE_REFERENCE_UNAVAILABLE)/.test(exact))
         return exact;
     for (const code of ['PENDING_OWNER_APPROVAL', 'PEER_NOT_ALLOWED', 'REQUEST_DENIED', 'INTAKE_QUEUE_FULL', 'INTAKE_RATE_LIMITED', 'INTAKE_STORE_INVALID', 'INTAKE_STORE_BUSY', 'INTAKE_STORE_UNWRITABLE', 'APPROVAL_CHANNEL_UNAVAILABLE', 'CONTACT_REVOKED', 'CONTACT_NOT_ALLOWED', 'INCOMPATIBLE_TIMEOUTS', 'CLAIM_LOST', 'DAILY_LIMIT_REACHED', 'DAILY_TASK_REPLAY', 'DAILY_LIMIT_CLOCK_ROLLBACK', 'DAILY_LIMIT_BUSY', 'DAILY_LIMIT_INVALID', 'UNENCRYPTED_ENVELOPE_REJECTED', 'INVITE_REQUIRED', 'INVITE_EXPIRED', 'INVITE_WORKER_MISMATCH', 'TASK_SCOPE_REJECTED'])
         if (s === 'Error: ' + code || s.startsWith('Error: ' + code + ':'))
@@ -1974,6 +2243,14 @@ function freezeApprovalAction(value) {
     }
     return value;
 }
+// Module-private hooks cannot be supplied by task output or arbitrary delegate options.
+const managedChildHooks = new WeakMap();
+function assertFreshDecision(receipt, started) {
+    const approved = Date.parse(receipt?.payload?.approvedAt), signed = Date.parse(receipt?.signature?.signedAt);
+    if (!Number.isFinite(approved) || !Number.isFinite(signed) || approved < started || signed < started ||
+        approved > Date.now() || signed > Date.now())
+        throw new Error('DELEGATION_APPROVAL_REQUIRED');
+}
 /** Completion failure preserves local verification without claiming a sealed checkpoint. */
 export class IncompleteSettlementError extends Error {
     incompleteReceipt;
@@ -2031,6 +2308,7 @@ export async function deliverRevocation(options) {
 }
 export class RequesterClient {
     options;
+    contextApprovals;
     idempotency;
     keyedStore() {
         return this.idempotency ??= new IdempotencyStore(this.options.owner, {
@@ -2040,7 +2318,7 @@ export class RequesterClient {
     keyedAction(options) {
         const allowed = ['idempotencyKey', 'idempotencyOperation', 'idempotencyChildIndex', 'workerRef', 'pendingId', 'pendingRelayUrl',
             'renegotiateProtocol', 'beforePropose', 'beforeTransmit', 'to', 'discover', 'relay', 'title', 'description', 'input',
-            'outputSchema', 'budget', 'manifest', 'auditPath', 'signal', 'capabilities', 'capabilityChains', 'minimumIsolationLevel',
+            'outputSchema', 'contextGrant', 'budget', 'manifest', 'auditPath', 'signal', 'capabilities', 'capabilityChains', 'minimumIsolationLevel',
             'onProgress', 'workers', 'mode', 'quorumSize', 'completionTimeoutMs', 'timeoutMs', 'executionTimeoutMs', 'taskTimeoutMs',
             'waitTimeoutMs', 'connectTimeoutMs', 'transportIdleTimeoutMs', 'heartbeatIntervalMs'];
         if (Object.keys(options).some(k => !allowed.includes(k)))
@@ -2073,6 +2351,7 @@ export class RequesterClient {
         validateSessionTimeouts(options);
         this.approvalProvider =
             options.approvalProvider ?? new InteractiveCliApprovalProvider(options.owner);
+        this.contextApprovals = new ApprovalGate(options.owner.did, policy);
         this.deliveryService = options.deliveryService;
         if (this.deliveryService && this.deliveryService.owner.did !== options.owner.did)
             throw deliveryError('OUTBOX_STORE_INVALID');
@@ -2128,24 +2407,40 @@ export class RequesterClient {
         });
     }
     async delegate(options, hooks) {
+        const managedChild = managedChildHooks.get(options);
         if (options.idempotencyKey !== undefined && !options.idempotencyOperation) {
             validateIdempotencyKey(options.idempotencyKey);
             options = { ...options, input: structuredClone(options.input),
                 outputSchema: options.outputSchema && structuredClone(options.outputSchema),
+                contextGrant: options.contextGrant && structuredClone(options.contextGrant),
                 budget: options.budget && structuredClone(options.budget),
                 capabilities: options.capabilities && structuredClone(options.capabilities) };
             options = { ...options, manifest: options.manifest && structuredClone(options.manifest),
                 discover: options.discover && structuredClone(options.discover),
                 capabilityChains: options.capabilityChains && structuredClone(options.capabilityChains) };
             const action = this.keyedAction(options);
-            return unwrapIdempotency(await this.keyedStore().run('acp_delegate_task', options.idempotencyKey, action, async (operation) => ({ isError: false, value: await this.delegate({ ...options,
+            const result = unwrapIdempotency(await this.keyedStore().run('acp_delegate_task', options.idempotencyKey, action, async (operation) => ({ isError: false, value: await this.delegate({ ...options,
                     idempotencyKey: undefined, idempotencyOperation: operation }, hooks) })));
+            if ((options.manifest ? options.manifest.contextGrant : options.contextGrant)?.deliveryMode === 'approval_redelegation' &&
+                result.state === 'SETTLED') {
+                const proposed = result.bundle.entries.find(e => e.body.eventType === 'PROPOSE')?.body.payload;
+                const accepted = result.bundle.entries.find(e => e.body.eventType === 'ACCEPT')?.body.payload;
+                const delivered = result.bundle.entries.find(e => e.body.eventType === 'DELIVER')?.body.payload;
+                if (!delivered || !verifyAudit(result.bundle).valid)
+                    throw new Error('DELEGATION_INVALID');
+                verifyRecoveredDelegation(delivered, proposed, accepted);
+                if (options.manifest && delivered.delegation && digest(delivered.delegation.parentContract.manifest) !== digest(options.manifest))
+                    throw new Error('DELEGATION_INVALID');
+            }
+            return result;
         }
         assertConnectionsOptions(this.options);
         // Retain the reviewed values even if the caller changes its objects while awaiting consent.
-        if (options.beforePropose)
+        if (options.beforePropose || managedChild ||
+            (options.manifest ? options.manifest.contextGrant : options.contextGrant)?.deliveryMode === 'approval_redelegation')
             options = { ...options,
                 input: structuredClone(options.input), manifest: options.manifest && structuredClone(options.manifest),
+                contextGrant: options.contextGrant && structuredClone(options.contextGrant),
                 budget: options.budget && structuredClone(options.budget),
                 outputSchema: options.outputSchema && structuredClone(options.outputSchema),
                 capabilities: options.capabilities && structuredClone(options.capabilities),
@@ -2217,6 +2512,7 @@ export class RequesterClient {
             options.budget.maxWallClockSeconds * 1000 > timeoutOptions.executionTimeoutMs)
             throw new Error('INCOMPATIBLE_TIMEOUTS: requested budget exceeds executionTimeoutMs');
         validateManifest(manifest);
+        validateContextGrantUse(manifest, options.input, (this.options.now ?? Date.now)());
         if (manifest.requester.ownerDid !== owner.did ||
             manifest.worker?.ownerDid !== peer ||
             Date.parse(manifest.deadline) <= Date.now())
@@ -2247,6 +2543,24 @@ export class RequesterClient {
         if (operation)
             await operation.prepare({ childIndex, manifest, input: options.input, relayUrl: stableRelayUrl ?? approvalRelay,
                 peerOwnerDid: peer, peerAgentDid: manifest.worker.agentDid, approvalTargetDigest });
+        const approvalMode = manifest.contextGrant?.deliveryMode === 'approval_redelegation';
+        const proposalTarget = () => ({ type: 'ContextGrantProposal', manifestDigest: digest(manifest),
+            inputDigest: digest(options.input), workerOwnerDid: peer });
+        let contextProposalApproval;
+        if (approvalMode) {
+            requireOwnerDecision(this.approvalProvider);
+            const target = proposalTarget(), started = Date.now();
+            const approvalSignal = AbortSignal.any([
+                AbortSignal.timeout(Math.max(1, Math.min(Date.parse(manifest.deadline) - Date.now(), timeoutOptions.waitTimeoutMs ?? timeoutOptions.taskTimeoutMs ?? timeoutOptions.timeoutMs ?? 600000))),
+                ...(options.signal ? [options.signal] : []),
+            ]);
+            contextProposalApproval = await abortable(this.approvalProvider.approve({ taskId: manifest.taskId, gate: 'contract_acceptance',
+                target: structuredClone(target), details: { manifest: structuredClone(manifest), input: structuredClone(options.input) },
+                signal: approvalSignal, deadline: manifest.deadline }), approvalSignal);
+            assertFreshDecision(contextProposalApproval, started);
+            this.contextApprovals.require(manifest.taskId, 'contract_acceptance', target, contextProposalApproval);
+            validateContextGrantUse(manifest, options.input, (this.options.now ?? Date.now)());
+        }
         if (options.beforePropose) {
             const approvalSignal = AbortSignal.any([
                 AbortSignal.timeout(Math.max(0, Date.parse(manifest.deadline) - Date.now())),
@@ -2278,6 +2592,8 @@ export class RequesterClient {
             await operation.authorize(childIndex, {
                 targetDigest: approvalTargetDigest, approvedAt: (this.options.now ?? Date.now)(), policy: 'configured-auto',
             });
+        if (managedChild)
+            await managedChild.prepare(manifest, options.input, peer);
         await operation?.sending();
         const wireDelivery = this.deliveryService && stableRelayUrl ? {
             service: this.deliveryService, context: { messageId: '00000000-0000-4000-8000-000000000000',
@@ -2294,7 +2610,7 @@ export class RequesterClient {
         const mailbox = inbox.attach(manifest.taskId);
         const timeouts = new SessionTimeouts(timeoutOptions, manifest.deadline, bridge.signal);
         const signal = timeouts.signal;
-        const wire = new SessionWire(mailboxRelay(relay, mailbox), owner, peer, manifest.taskId, [owner.did, peer], signal, auditPath, this.options.allowUnencryptedEnvelopes === true, false, wireDelivery);
+        const wire = new SessionWire(mailboxRelay(relay, mailbox), owner, peer, manifest.taskId, [owner.did, peer], signal, auditPath, this.options.allowUnencryptedEnvelopes === true, false, wireDelivery, manifest.contextGrant);
         if (onProgress) {
             wire.onProgress = async (progress, envelope) => {
                 await onProgress(progress, {
@@ -2391,6 +2707,17 @@ export class RequesterClient {
             // Recheck the live phase immediately before transmission; owner review may cross a boundary.
             this.protocol.outbound(invite?.agentCard ?? card, manifest.protocolVersion, peer, manifest.worker.agentDid);
             options.beforeTransmit?.();
+            validateContextGrantUse(manifest, options.input, (this.options.now ?? Date.now)());
+            if (approvalMode && !verifyApproval(contextProposalApproval, owner.did, manifest.taskId, 'contract_acceptance', proposalTarget()))
+                throw new Error('DELEGATION_APPROVAL_REQUIRED');
+            if (approvalMode || managedChild) {
+                options.signal?.throwIfAborted();
+                if (Date.parse(manifest.deadline) <= Date.now())
+                    throw new Error('DELEGATION_INVALID');
+                if (invite)
+                    parseAndVerifyInviteToken(options.to, Date.now(), { allowPrivateRelay: this.options.allowPrivateRelay });
+            }
+            managedChild?.beforeTransmit(manifest, options.input);
             await wire.sendEvent('PROPOSE', {
                 proposal: signPayload(manifest, owner),
                 input: options.input,
@@ -2404,6 +2731,8 @@ export class RequesterClient {
                 digest(accept.contract.manifest) !== digest(manifest) ||
                 !verifyApproval(accept.approval, peer, manifest.taskId, 'contract_acceptance', accept.contract.contractDigest))
                 throw new Error('INVALID_ACCEPTANCE');
+            validateContextGrantUse(manifest, options.input, (this.options.now ?? Date.now)());
+            managedChild?.onAcceptedContract(accept.contract);
             gateway = new OwnerGateway(owner, accept.contract, policy);
             gateway.machine.apply(accept.transition);
             gateway.machine.apply((await wire.receiveEvent('START')).payload.payload);
@@ -2416,15 +2745,32 @@ export class RequesterClient {
             timeouts.wait();
             gateway.machine.apply(data.transition);
             hooks?.onDelivered?.();
-            const approval = () => this.approvalProvider.approve({
-                taskId: manifest.taskId,
-                gate: 'final_verification',
-                target: data,
-                details: { manifest, deliverableDigest: data.artifact.payload.digest },
-                deadline: manifest.deadline,
-                signal,
-            });
-            const { result, verification, settlement } = await abortable(gateway.verifyAndSettle(wire.sealed(envelope), this.options.verificationEngine ?? new VerificationEngine(), approval, { allowUnencryptedEnvelopes: this.options.allowUnencryptedEnvelopes === true, onVerifiedDelivery: () => {
+            const approval = () => {
+                if (approvalMode || managedChild)
+                    requireOwnerDecision(this.approvalProvider);
+                const lineage = approvalMode ? verifyDelegationAttachment(data.delegation, accept.contract) : undefined;
+                const started = approvalMode || managedChild ? Date.now() : 0;
+                const pendingApproval = this.approvalProvider.approve({
+                    taskId: manifest.taskId,
+                    gate: 'final_verification',
+                    target: data,
+                    details: { manifest, deliverableDigest: data.artifact.payload.digest,
+                        ...(approvalMode ? { delegateeOwnerDids: lineage.delegateeOwnerDids,
+                            delegationDigests: data.delegation.children.map(p => ({ linkDigest: digest(p.link),
+                                contractDigest: p.childContract.contractDigest, grantDigest: digest(p.childContract.manifest.contextGrant) })) } : {}) },
+                    deadline: manifest.deadline,
+                    signal,
+                });
+                if (!approvalMode && !managedChild)
+                    return pendingApproval;
+                return pendingApproval.then(receipt => {
+                    assertFreshDecision(receipt, started);
+                    if (Date.parse(manifest.deadline) <= Date.now())
+                        throw new Error('DELEGATION_INVALID');
+                    return receipt;
+                });
+            };
+            const { result, verification, settlement } = await abortable(gateway.verifyAndSettle(wire.sealed(envelope), this.options.verificationEngine ?? new VerificationEngine(), approval, { ...(approvalMode ? { ownerDecision: this.approvalProvider.ownerDecision } : {}), allowUnencryptedEnvelopes: this.options.allowUnencryptedEnvelopes === true, onVerifiedDelivery: () => {
                     if (!wireDelivery)
                         return;
                     wireDelivery.service.markPeerObserved(wireDelivery.context.messageId, { status: 'replied', envelopeId: wireDelivery.context.messageId,
@@ -2490,8 +2836,9 @@ export class RequesterClient {
                             ?.body.payload;
                         if (cached.taskId !== manifest.taskId || !['SETTLED', 'CANCELLED'].includes(cached.state) ||
                             !verifyAudit(cached.bundle, { taskId: manifest.taskId, actors: [owner.did, peer] }).valid ||
-                            !proposed || digest({ manifest: proposed.proposal.payload, input: proposed.input }) !== e.recovery.proposalDigest ||
-                            !accepted || !verifyContract(accepted.contract) || digest(accepted.contract.manifest) !== digest(manifest) ||
+                            proposalAuditDigest(proposed) !== e.recovery.proposalDigest ||
+                            !(manifest.contextGrant ? verifyContextAcceptanceAudit(accepted, manifest) :
+                                accepted && verifyContract(accepted.contract) && digest(accepted.contract.manifest) === digest(manifest)) ||
                             (cached.state === 'CANCELLED' && (e.code !== 'TASK_CANCELLED' || cached.deliverable !== null ||
                                 cached.bundle.entries.at(-1)?.body.eventType !== 'CANCEL')) ||
                             (cached.state === 'SETTLED' && (!delivered ||
@@ -2499,8 +2846,14 @@ export class RequesterClient {
                                 digest(delivered.artifact.payload.data) !== digest(cached.deliverable) ||
                                 cached.bundle.entries.at(-1)?.body.eventType !== 'SETTLED')))
                             throw new Error('INVALID_RECOVERY_OUTCOME');
-                        if (cached.state === 'SETTLED')
+                        if (cached.state === 'SETTLED') {
+                            if (manifest.contextGrant) {
+                                verifyRecoveredDelegation(delivered, proposed, accepted);
+                                if (delivered?.delegation && digest(delivered.delegation.parentContract.manifest) !== digest(manifest))
+                                    throw new Error('INVALID_RECOVERY_OUTCOME');
+                            }
                             hooks?.onDelivered?.();
+                        }
                         return cached;
                     }
                 }
@@ -2519,11 +2872,11 @@ export class RequesterClient {
                     catch (inner) {
                         if (inner instanceof Error && inner.message === 'CANCELLED')
                             throw inner;
-                        await wire.rawSend('ERROR', { code: safeError(inner) }).catch(() => { });
+                        await wire.rawSend('ERROR', { code: safeError(inner, !!manifest.contextGrant) }).catch(() => { });
                         throw inner;
                     }
                 }
-                await wire.rawSend('ERROR', { code: safeError(e) }).catch(() => { });
+                await wire.rawSend('ERROR', { code: safeError(e, !!manifest.contextGrant) }).catch(() => { });
                 throw e;
             }
             catch (error) {
@@ -2549,6 +2902,7 @@ export class RequesterClient {
             validateIdempotencyKey(options.idempotencyKey);
             options = { ...options, input: structuredClone(options.input),
                 outputSchema: options.outputSchema && structuredClone(options.outputSchema),
+                contextGrant: options.contextGrant && structuredClone(options.contextGrant),
                 budget: options.budget && structuredClone(options.budget),
                 capabilities: options.capabilities && structuredClone(options.capabilities) };
             options = { ...options, workers: structuredClone(options.workers) };
@@ -2617,6 +2971,7 @@ export class RequesterClient {
                     description: options.description,
                     input: options.input,
                     outputSchema: options.outputSchema,
+                    contextGrant: options.contextGrant,
                     executionTimeoutMs: options.executionTimeoutMs,
                     timeoutMs: options.timeoutMs,
                     taskTimeoutMs: options.taskTimeoutMs,
@@ -2769,7 +3124,8 @@ function verifiedWorkerDid(bundle, expectedDid) {
     const accept = bundle.entries.find((entry) => entry.body.eventType === 'ACCEPT');
     const payload = accept?.body.payload;
     const worker = payload && typeof payload === 'object' && !Array.isArray(payload)
-        ? payload.contract?.manifest?.worker
+        ? payload.contract?.manifest?.worker ??
+            payload.worker
         : undefined;
     const actors = bundle.checkpoint.actor.payload.actors;
     if (!worker ||
@@ -2821,7 +3177,7 @@ async function canonicalizeDiscoveredWorkers(targets, options) {
 export function buildTaskManifest(options) {
     const now = (options.now ?? Date.now)();
     const createdAt = new Date(now).toISOString(), deadline = new Date(now + (options.taskTimeoutMs ?? 600000)).toISOString();
-    return {
+    const manifest = {
         protocolVersion: options.protocolVersion ?? '0.2.0',
         taskId: 'task_' + randomUUID().replaceAll('-', ''),
         createdAt,
@@ -2861,5 +3217,14 @@ export function buildTaskManifest(options) {
         },
         hitlPolicy: { requiredGates: ['GATE_CONTRACT_ACCEPT', 'GATE_DELIVERY_ACCEPT'] },
     };
+    if (options.contextGrant) {
+        manifest.contextGrant = buildContextGrant(options.contextGrant, createdAt);
+        if (manifest.contextGrant.deliveryMode === 'approval_redelegation') {
+            manifest.permissions.maxDelegationDepth = 1;
+            manifest.hitlPolicy.requiredGates.push('GATE_SUB_DELEGATION');
+        }
+        validateManifest(manifest);
+    }
+    return manifest;
 }
 //# sourceMappingURL=session.js.map