sealbridge 0.4.2 → 0.5.0

package/dist/spec/examples/sample-audit-evidence.json

@@ -0,0 +1,138 @@
+{
+  "entries": [
+    {
+      "body": {
+        "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+        "seq": 0,
+        "prevEntryHash": null,
+        "actorDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "receiverDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+        "eventType": "PROPOSE",
+        "payload": {
+          "proposal": {
+            "payload": {
+              "protocolVersion": "0.2.0",
+              "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+              "createdAt": "2026-11-05T00:00:00.000Z",
+              "deadline": "2026-11-05T00:10:00.000Z",
+              "requester": {
+                "ownerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+                "agentDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk"
+              },
+              "worker": {
+                "ownerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+                "agentDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+              },
+              "task": {
+                "title": "Sample interruption",
+                "description": "Worker-only observation of a PROPOSE prefix",
+                "acceptanceCriteria": [
+                  {
+                    "id": "ac_schema",
+                    "description": "Output satisfies the agreed JSON schema",
+                    "required": true
+                  }
+                ]
+              },
+              "io": {
+                "inputSchema": {},
+                "outputSchema": {}
+              },
+              "verification": {
+                "mode": "hybrid",
+                "requireUsageReceipt": true,
+                "requireExecutionAttestation": true,
+                "maxRetries": 0
+              },
+              "budget": {
+                "costBearer": "worker_byok",
+                "maxInputTokens": 50000,
+                "maxOutputTokens": 10000,
+                "maxToolInvocations": 10,
+                "maxWallClockSeconds": 60,
+                "onOverrun": "hard_stop"
+              },
+              "permissions": {
+                "maxDelegationDepth": 0,
+                "grantedCapabilities": []
+              },
+              "sandboxPolicy": {
+                "isolationLevel": "subprocess_restricted",
+                "networkAccess": "none",
+                "filesystemScope": "ephemeral_workspace_only"
+              },
+              "hitlPolicy": {
+                "requiredGates": [
+                  "GATE_CONTRACT_ACCEPT",
+                  "GATE_DELIVERY_ACCEPT"
+                ]
+              }
+            },
+            "signature": {
+              "signerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+              "canonicalization": "RFC8785-JCS",
+              "payloadDigest": "sha256:abf8b10ee34ed8774fe4b4f9634fd2a46f02b9c574204f4d93f7fd496b7d5595",
+              "signedAt": "2026-11-05T00:00:00.000Z",
+              "signature": "ed25519:Bnu3IQj4_w9_Tr-x72xh_CcylwfKDl2CYsuQKCworMebRxVqFFFyGAGTlDk3m9kSyQk4Cc0cfo934Tm8fbYBCA"
+            }
+          },
+          "input": {},
+          "capabilityChains": []
+        }
+      },
+      "entryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "actorSignature": {
+        "signerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "canonicalization": "RFC8785-JCS",
+        "payloadDigest": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "signedAt": "2026-11-05T12:08:18.830Z",
+        "signature": "ed25519:gcjAXj9pEsUQXQ4nixpSDqaFFjf1De2ayIt6XTIuSwVTrFMPmofMRZYbRbWcF4gMiz9_wqVVzArIjOmQ6JEYCw"
+      },
+      "counterSignature": {
+        "payload": {
+          "type": "AckReceipt",
+          "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+          "entryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+          "actorDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+          "receiverDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+        },
+        "signature": {
+          "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+          "canonicalization": "RFC8785-JCS",
+          "payloadDigest": "sha256:5981ecd15643250116b0655697bea324505e496b428797d6447f3314b014f166",
+          "signedAt": "2026-11-05T12:08:18.831Z",
+          "signature": "ed25519:XqX00TUcPJOkZjzFcyFHx7_hCCWgL5gZ5AglBkO1yfIjTNlWHu5U_a45H-tR1wx72RQVd4ShZT5ZVVLW7w53BA"
+        }
+      }
+    }
+  ],
+  "interruption": {
+    "payload": {
+      "type": "AuditInterruption",
+      "formatVersion": 1,
+      "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+      "actors": [
+        "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+      ],
+      "seq": 1,
+      "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "acknowledgedPrefix": {
+        "count": 1,
+        "lastSeq": 0,
+        "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+      },
+      "phase": "OWNER_APPROVAL",
+      "reason": "SESSION_TIMEOUT",
+      "observedAt": "2026-11-05T00:01:00.000Z"
+    },
+    "signature": {
+      "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+      "canonicalization": "RFC8785-JCS",
+      "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+      "signedAt": "2026-11-05T00:01:00.000Z",
+      "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+    }
+  }
+}

package/dist/spec/examples/sample-audit-file-record.json

@@ -0,0 +1,31 @@
+{
+  "interruption": {
+    "payload": {
+      "type": "AuditInterruption",
+      "formatVersion": 1,
+      "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+      "actors": [
+        "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+      ],
+      "seq": 1,
+      "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "acknowledgedPrefix": {
+        "count": 1,
+        "lastSeq": 0,
+        "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+      },
+      "phase": "OWNER_APPROVAL",
+      "reason": "SESSION_TIMEOUT",
+      "observedAt": "2026-11-05T00:01:00.000Z"
+    },
+    "signature": {
+      "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+      "canonicalization": "RFC8785-JCS",
+      "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+      "signedAt": "2026-11-05T00:01:00.000Z",
+      "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+    }
+  }
+}

package/dist/spec/examples/sample-audit-interruption.json

@@ -0,0 +1,29 @@
+{
+  "payload": {
+    "type": "AuditInterruption",
+    "formatVersion": 1,
+    "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+    "actors": [
+      "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+      "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+    ],
+    "seq": 1,
+    "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+    "acknowledgedPrefix": {
+      "count": 1,
+      "lastSeq": 0,
+      "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+    },
+    "phase": "OWNER_APPROVAL",
+    "reason": "SESSION_TIMEOUT",
+    "observedAt": "2026-11-05T00:01:00.000Z"
+  },
+  "signature": {
+    "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+    "canonicalization": "RFC8785-JCS",
+    "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+    "signedAt": "2026-11-05T00:01:00.000Z",
+    "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+  }
+}

package/dist/spec/task-manifest.0.2.0.schema.json

@@ -20,6 +20,7 @@
     "hitlPolicy"
   ],
   "properties": {
+    "contextGrant": { "$ref": "https://acp-spec.local/schemas/v0.2/context-grant.schema.json" },
     "protocolVersion": {
       "type": "string",
       "const": "0.2.0",
@@ -418,5 +419,90 @@
         }
       }
     }
-  }
+  },
+  "allOf": [
+    {
+      "if": {
+        "required": ["contextGrant"],
+        "properties": {
+          "contextGrant": {
+            "properties": {
+              "deliveryMode": { "enum": ["view_only", "hand_over"] }
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "permissions": {
+            "properties": {
+              "maxDelegationDepth": {
+                "const": 0
+              }
+            }
+          }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "contextGrant": {
+                  "properties": {
+                    "deliveryMode": {
+                      "const": "view_only"
+                    }
+                  }
+                }
+              }
+            },
+            "then": {
+              "properties": {
+                "sandboxPolicy": {
+                  "properties": {
+                    "filesystemScope": {
+                      "const": "ephemeral_workspace_only"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "contextGrant"
+        ],
+        "properties": {
+          "contextGrant": {
+            "properties": {
+              "deliveryMode": {
+                "const": "approval_redelegation"
+              }
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "permissions": {
+            "properties": {
+              "maxDelegationDepth": {
+                "const": 1
+              }
+            }
+          },
+          "sandboxPolicy": {
+            "properties": {
+              "filesystemScope": {
+                "const": "ephemeral_workspace_only"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
 }

package/docs/context-grants.md

@@ -0,0 +1,221 @@
+# Context grants (CP1 and CP5a)
+
+`TaskManifest.contextGrant` is an optional 0.2.0 contract property for a
+sender's selected context. Existing manifests without it remain valid in both
+supported versions. No protocol version, peer floor, or release clock changes.
+A peer with the older closed 0.2.0 schema will reject this optional extension;
+use it only with CP1-capable peers. There is no automatic downgrade that strips
+the grant.
+
+| Delivery mode | Delegation depth | Retention declaration | Input retention |
+| --- | --- | --- | --- |
+| `view_only` (builder default) | 0 | `ephemeral_view` | false |
+| `hand_over` | 0 | `keep_deliverable` | false |
+| `approval_redelegation` (explicit opt-in) | 1 | either; default `ephemeral_view` | false |
+
+`hand_over` permits keeping the agreed, accepted deliverable. It does not permit
+keeping the input selection. CP5a enables `approval_redelegation` only with the
+owner decision and host prerequisites described below. Desktop controls are outside this slice.
+
+## Build and validate
+
+```ts
+import { buildTaskManifest, validateManifest, validateContextGrantUse } from 'sealbridge/sdk';
+
+const manifest = buildTaskManifest({
+  ownerDid, workerDid, title: 'Production feasibility',
+  description: 'Review selected dimensions and material.',
+  contextGrant: {
+    selectors: ['$.items[*]'],
+    fieldsAllowed: ['dimensions', 'material'],
+    fieldsDenied: ['customerName'],
+    angle: 'Report feasibility and missing dimensions.',
+    // Optional: deliveryMode: 'hand_over'
+  },
+});
+validateManifest(manifest);
+validateContextGrantUse(manifest, selectedInput);
+```
+
+The opt-in builder defaults to `view_only`, 24 hours from manifest `createdAt`,
+64 KiB, the mode's retention declaration, and `inputRetentionAllowed: false`.
+It does not change default manifests. `RequesterClient.delegate` also accepts
+these builder options as `contextGrant`; a supplied `manifest` is authoritative.
+
+Selectors are non-empty opaque strings describing the sender's selection.
+CP1 does not define a selector language, fetch source data, or filter input.
+The sender must construct the selection before submitting it. Allowed and denied
+field identifiers are compared literally; any identical identifier in both lists
+is refused. Empty selectors, blank angles, unknown grant properties (including a
+second `maxDelegationDepth`), and mismatched depth, retention or filesystem scope
+are refused. `view_only` requires the existing
+`filesystemScope: ephemeral_workspace_only` declaration. The builder uses that
+scope for both modes. CP1 refuses `inputRetentionAllowed: true` in either mode.
+A worker configured with the persistent plaintext `inboxPath` refuses grants.
+
+The schema caps `maxBytes` at 65,536. Live use checks the UTF-8 byte length of the
+entire JSON-serialized inline input, including JSON syntax, against that limit.
+This is an input limit, not a promise that envelope overhead fits every relay's
+configured admission cap. CP1 does not add attachment transfer or source access.
+`expiresAt` must be after manifest `createdAt` and at most seven days after it.
+Live proposal, acceptance and execution handoff additionally reject expired
+grants, including expiry during owner review. Historical contract verification
+checks the declared interval without consulting the current clock. Expiry does
+not extend the task deadline or prove deletion. Existing execution timeouts still
+control a running adapter.
+
+`outputSchema` in a grant is an optional declaration. CP1 does not add angle or
+grant-output verification; existing `io.outputSchema` behavior continues.
+
+## Audit lifecycle
+
+Context events are `CONTEXT_GRANT`, `CONTEXT_MODE`, `CONTEXT_OPENED`,
+`CONTEXT_DISCARDED`, and `CONTEXT_DELETION_ATTEMPTED`. Each payload contains only
+`{ grantDigest, deliveryMode }`, with the digest computed over the exact grant
+using the existing canonical JSON digest. Extra lifecycle payload fields are
+rejected by the audit-entry schema.
+
+The worker records grant and mode after proposal admission, opened after contract
+approval, and discarded on a subsequent terminal failure where its audit channel
+is still available. Pending intake is not recorded as discarded. On normal
+execution completion it attempts the existing temporary workspace cleanup before
+delivery and records deletion attempted before the bilateral checkpoint. The
+event describes an attempt, including cleanup failures; the existing cleanup
+error callback still reports residual files. Existing cancellation and failure
+cleanup paths remain; they do not claim a deletion event after a sealed or
+unavailable audit channel. Pre-admission refusals have no new bilateral entries.
+
+For grant-bearing sessions, proposal audit payloads contain proposal/manifest
+and frame digests plus the grant digest and mode, rather than the manifest and
+input. Acceptance audit payloads contain digests, worker identity, and the
+worker's signed acceptance proof, rather than the full contract. The encrypted
+wire frames still carry the complete signed contract. Replay/recovery verifies
+the compact evidence against the supplied manifest. Sessions without a grant
+keep their existing audit payloads. Depth-zero delivery and progress evidence retain their
+existing shapes and may contain application data; CP1 is not a general content
+scrubber for adapter output.
+
+AuditInterruption local format 1 remains limited to one acknowledged PROPOSE
+containing the full signed manifest. Compact grant proposals and their lifecycle
+entries are outside that scope, including when `auditInterruptionFormat: 1` is
+enabled on the worker. Grant sessions keep their existing lifecycle and recovery
+behavior; sessions without grants retain format-1 interruption closure. The
+interruption verifier's manifest and prefix checks are unchanged.
+
+Embedders can use `appendContextGrantAuditEvent(append, eventType, grant)` from
+`sealbridge/sdk` for an actual local lifecycle action. The append port owns
+signing, countersigning and persistence; for example, it can call an existing
+`BilateralLedger.append`. The helper never appends a grant body. Do not report
+opened or deletion attempted unless the corresponding action occurred.
+
+The filesystem and retention fields are contract declarations. A temporary
+workspace cleanup attempt does not prove erasure of copies, provider records,
+held input, owner-managed files, or application logs. CP1 adds neither a deletion
+proof nor a deliverable storage UI.
+
+Schemas: [ContextGrant](../spec/context-grant.schema.json),
+[audit payload](../spec/context-grant-audit-payload.schema.json),
+[manifest 0.2.0](../spec/task-manifest.0.2.0.schema.json).
+Examples: [view only](../spec/examples/context-pooling/view_only/sample-task-manifest.0.2.0.json),
+[hand over](../spec/examples/context-pooling/hand_over/sample-task-manifest.0.2.0.json).
+
+
+## CP5a: one approved child edge
+
+For A → B → C, A explicitly selects `approval_redelegation` on A → B at depth 1.
+The builder adds the existing `GATE_SUB_DELEGATION`. B can dispatch separate
+B → C tasks with strictly narrower `view_only` grants at depth 0. Only one
+edge is supported; siblings are independent one-edge chains.
+
+The root requires protocol 0.2.0, `ephemeral_workspace_only`, and absent/false
+input retention. Both root retention declarations remain available. No required
+manifest field or protocol version changes. Use this mode only with a known
+CP5a worker: version 0.2.0 alone does not advertise support. C receives an ordinary
+CP1 task; its host handles inspection and owner opening.
+
+### Host configuration and owner decisions
+
+```ts
+import { WorkerNode, RequesterClient } from 'sealbridge/sdk';
+
+const childRequester = new RequesterClient({
+  owner: bOwner, relay, approvalProvider: bOwnerDecisionProvider,
+});
+const worker = new WorkerNode({
+  owner: bOwner, relay, adapter, auditPath,
+  approvalProvider: bOwnerDecisionProvider,
+  redelegation: { requester: childRequester, ownerApprovalProvider: bOwnerDecisionProvider },
+});
+// Inside an admitted root adapter:
+const partial = await context.redelegate!({
+  to: cInvitation, manifest: fullyBuiltChildManifest, input: alreadySelectedJson,
+});
+```
+
+The worker needs `auditPath` for its durable journal and a requester using B's
+same owner identity. Configure ordinary connection and inspection policy
+separately. The child method exists only during an admitted approval-mode root.
+`ChildDelegationRequest` accepts `to`, optional `relay`, complete `manifest`,
+selected JSON `input`, and optional `auditPath`. Resolve saved references before
+calling. Capability chains, automatic approval/retry flags and supplied proofs
+are not accepted. The helper adds no root identifiers or parent input to C's
+frames; owner-supplied child content can still disclose them.
+
+A approves the exact root manifest/input/worker target before send. B separately
+opens the root, approves each child manifest/input/owner target, and reviews its
+result. A reviews the final root delivery. These live boundaries require a
+provider declaring `ownerDecision: true` and fresh target-bound owner receipts.
+Interactive CLI and MCP form providers declare it; webhooks declare it in
+owner-decision response mode. Policy providers cannot operate this mode. The
+marker is a host assertion, not independent evidence of a physical human action.
+
+### Link checks and delivery
+
+`createDelegationLink` signs after authenticated child acceptance and copies the
+actual child limits. `verifyDelegationChain` checks signed contracts, task IDs,
+owner continuity, digests, timestamps and remaining depth without consulting
+today's clock. `assertDelegationAttenuation` compares declarations literally:
+child selectors must be a nonempty subset, parent allowed fields cannot widen,
+denied fields persist, and selectors or allowed fields must strictly narrow.
+Reducing only bytes, budget or depth is insufficient. Parent grant `outputSchema`
+is preserved. Numeric budgets, deadline, expiry and bytes cannot increase;
+other budget fields, sandbox policy and verification policy must be equal.
+Child capabilities are empty. These are per-task ceilings; sibling budgets are
+not added together. The checks do not establish semantic provenance, interpret
+selectors, verify an angle, prove erasure or establish child-output acceptance.
+
+The host persists approved attempts before dispatch and accepted proofs before
+parent delivery, retaining proofs even when later child execution fails. It
+waits for managed children and attaches every issued proof; unresolved attempts,
+duplicate IDs, invalid proofs and empty attachments prevent delivery. Restart
+uses existing terminal recovery and does not replay child sends. An otherwise
+valid subset cannot reveal an out-of-band sibling to A.
+
+`Delivery.delegation` contains `{ parentContract, children }`, with each child
+`{ link, childContract }`. The optional attachment is required for depth-one
+contracts carrying a ContextGrant. Contracts without a ContextGrant keep their
+origin/main delivery, verification, recovery and retained-result behavior at
+all existing depths, including depth one without proof. CP1 depth-zero grants
+keep their ordinary path; attaching CP5a evidence to them is refused. There is
+no signed empty-child alternative: B cancels/rejects if it cannot produce a
+linked child; A may explicitly submit a fresh depth-zero task.
+
+Full signed parent and child contracts disclose selectors, angles, task text,
+limits and owner DIDs to A. B reviews that disclosure before dispatch. Proof and
+new journal fields add no raw input or child artifact body. Existing application
+records and relay byte limits still apply; proofs are never stripped to fit.
+
+`verifyDelegationAttachment(attachment, trustedContract)` checks every sibling
+against the exact root. Live verification runs before output checks, callbacks
+and owner review, adding `delegation_chain` only for the grant-bearing depth-one
+path. Direct live verification also requires `ownerDecision: true`. Final review
+includes verified child owner DIDs and proof digests. Recovery binds the embedded
+root to retained proposal/acceptance evidence; historical expiry is not a new
+refusal. Existing hashes and checkpoints retain the delivery attachment, and
+version-1 task journals retain optional child-attempt state. `verifyAudit`
+continues to check ledger hashes/signatures only.
+
+Diagnostics are `DELEGATION_PROOF_REQUIRED`, `DELEGATION_INVALID`, and
+`DELEGATION_APPROVAL_REQUIRED`. Schemas: [link](../spec/delegation-link.schema.json)
+and [attachment](../spec/delegation-attachment.schema.json). See the
+[complete attachment example](../spec/examples/context-pooling/approval_redelegation/sample-delegation-attachment.json).

package/docs/sdk.ja.md

@@ -136,3 +136,7 @@ JSON の metadata・イベントを受け取ります。`now`・`transportFactor
 無指定時の policy-auto の既定値は変わりません。送信前の承認と最終検収は別です。
 接続の審査には別の `connectionReview` を使います。[MCP の説明](../README.ja.md)も
 参照してください。
+
+## 監査の中断証拠
+
+`parseJsonl` / `verifyAudit` は双方署名の形式専用を維持します。`parseAuditJsonl` / `verifyAuditEvidence` は `AuditEvidence`（`AuditBundle | InterruptedAuditBundle`）を扱い、ワーカー単独の形式 1 の終端は、外部ピンが一致しても `UNILATERALLY_CLOSED`・`valid:false` です。`createAuditInterruption`・対応ストア・関連公開型も `sealbridge/sdk` から利用できます。[保存形式・ピン・永続化・依頼者との照合規則（英語）](audit-interruption.md)を参照してください。

package/docs/sdk.md

@@ -143,3 +143,7 @@ existing CLI lifecycle. For host-owned streams, construct `AcpMcpServer`, call
 inject an `approvalProvider`; the unflagged policy-auto default is unchanged.
 Approval before sending and final verification remain separate. Connection review
 is a separate `connectionReview` option. See [MCP integration](../README.md#mcp-live-progress-revocation-and-quorum).
+
+## Audit evidence
+
+`parseJsonl` / `verifyAudit` retain their bilateral-only contracts. Use `parseAuditJsonl` / `verifyAuditEvidence` for the `AuditEvidence` union (`AuditBundle | InterruptedAuditBundle`). Worker-only format-1 terminals return `UNILATERALLY_CLOSED` with `valid:false`, even with matching external pins; ordinary result APIs still require bilateral bundles. `createAuditInterruption`, the interruption-aware stores, and public evidence types are exported from `sealbridge/sdk`. See [storage, pins, durability, and requester comparison rules](audit-interruption.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealbridge",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "private": false,
   "type": "module",
   "license": "Apache-2.0",
@@ -65,7 +65,8 @@
     "README.md",
     "README.ja.md",
     "docs/sdk.md",
-    "docs/sdk.ja.md"
+    "docs/sdk.ja.md",
+    "docs/context-grants.md"
   ],
   "publishConfig": {
     "access": "public"