sealbridge 0.4.2 → 0.6.0

package/dist/spec/examples/sample-audit-evidence.json

@@ -0,0 +1,138 @@
+{
+  "entries": [
+    {
+      "body": {
+        "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+        "seq": 0,
+        "prevEntryHash": null,
+        "actorDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "receiverDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+        "eventType": "PROPOSE",
+        "payload": {
+          "proposal": {
+            "payload": {
+              "protocolVersion": "0.2.0",
+              "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+              "createdAt": "2026-11-05T00:00:00.000Z",
+              "deadline": "2026-11-05T00:10:00.000Z",
+              "requester": {
+                "ownerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+                "agentDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk"
+              },
+              "worker": {
+                "ownerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+                "agentDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+              },
+              "task": {
+                "title": "Sample interruption",
+                "description": "Worker-only observation of a PROPOSE prefix",
+                "acceptanceCriteria": [
+                  {
+                    "id": "ac_schema",
+                    "description": "Output satisfies the agreed JSON schema",
+                    "required": true
+                  }
+                ]
+              },
+              "io": {
+                "inputSchema": {},
+                "outputSchema": {}
+              },
+              "verification": {
+                "mode": "hybrid",
+                "requireUsageReceipt": true,
+                "requireExecutionAttestation": true,
+                "maxRetries": 0
+              },
+              "budget": {
+                "costBearer": "worker_byok",
+                "maxInputTokens": 50000,
+                "maxOutputTokens": 10000,
+                "maxToolInvocations": 10,
+                "maxWallClockSeconds": 60,
+                "onOverrun": "hard_stop"
+              },
+              "permissions": {
+                "maxDelegationDepth": 0,
+                "grantedCapabilities": []
+              },
+              "sandboxPolicy": {
+                "isolationLevel": "subprocess_restricted",
+                "networkAccess": "none",
+                "filesystemScope": "ephemeral_workspace_only"
+              },
+              "hitlPolicy": {
+                "requiredGates": [
+                  "GATE_CONTRACT_ACCEPT",
+                  "GATE_DELIVERY_ACCEPT"
+                ]
+              }
+            },
+            "signature": {
+              "signerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+              "canonicalization": "RFC8785-JCS",
+              "payloadDigest": "sha256:abf8b10ee34ed8774fe4b4f9634fd2a46f02b9c574204f4d93f7fd496b7d5595",
+              "signedAt": "2026-11-05T00:00:00.000Z",
+              "signature": "ed25519:Bnu3IQj4_w9_Tr-x72xh_CcylwfKDl2CYsuQKCworMebRxVqFFFyGAGTlDk3m9kSyQk4Cc0cfo934Tm8fbYBCA"
+            }
+          },
+          "input": {},
+          "capabilityChains": []
+        }
+      },
+      "entryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "actorSignature": {
+        "signerDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "canonicalization": "RFC8785-JCS",
+        "payloadDigest": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "signedAt": "2026-11-05T12:08:18.830Z",
+        "signature": "ed25519:gcjAXj9pEsUQXQ4nixpSDqaFFjf1De2ayIt6XTIuSwVTrFMPmofMRZYbRbWcF4gMiz9_wqVVzArIjOmQ6JEYCw"
+      },
+      "counterSignature": {
+        "payload": {
+          "type": "AckReceipt",
+          "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+          "entryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+          "actorDid": "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+          "receiverDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+        },
+        "signature": {
+          "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+          "canonicalization": "RFC8785-JCS",
+          "payloadDigest": "sha256:5981ecd15643250116b0655697bea324505e496b428797d6447f3314b014f166",
+          "signedAt": "2026-11-05T12:08:18.831Z",
+          "signature": "ed25519:XqX00TUcPJOkZjzFcyFHx7_hCCWgL5gZ5AglBkO1yfIjTNlWHu5U_a45H-tR1wx72RQVd4ShZT5ZVVLW7w53BA"
+        }
+      }
+    }
+  ],
+  "interruption": {
+    "payload": {
+      "type": "AuditInterruption",
+      "formatVersion": 1,
+      "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+      "actors": [
+        "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+      ],
+      "seq": 1,
+      "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "acknowledgedPrefix": {
+        "count": 1,
+        "lastSeq": 0,
+        "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+      },
+      "phase": "OWNER_APPROVAL",
+      "reason": "SESSION_TIMEOUT",
+      "observedAt": "2026-11-05T00:01:00.000Z"
+    },
+    "signature": {
+      "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+      "canonicalization": "RFC8785-JCS",
+      "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+      "signedAt": "2026-11-05T00:01:00.000Z",
+      "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+    }
+  }
+}

package/dist/spec/examples/sample-audit-file-record.json

@@ -0,0 +1,31 @@
+{
+  "interruption": {
+    "payload": {
+      "type": "AuditInterruption",
+      "formatVersion": 1,
+      "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+      "actors": [
+        "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+        "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+      ],
+      "seq": 1,
+      "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "acknowledgedPrefix": {
+        "count": 1,
+        "lastSeq": 0,
+        "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+        "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+      },
+      "phase": "OWNER_APPROVAL",
+      "reason": "SESSION_TIMEOUT",
+      "observedAt": "2026-11-05T00:01:00.000Z"
+    },
+    "signature": {
+      "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+      "canonicalization": "RFC8785-JCS",
+      "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+      "signedAt": "2026-11-05T00:01:00.000Z",
+      "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+    }
+  }
+}

package/dist/spec/examples/sample-audit-interruption.json

@@ -0,0 +1,29 @@
+{
+  "payload": {
+    "type": "AuditInterruption",
+    "formatVersion": 1,
+    "taskId": "task_58ba4c65aebe441ca9d2b3f253fea677",
+    "actors": [
+      "did:key:z6Mkj6gKgj855yaUZd1FS1CcBv7C5VWSv9eJmmLfuxt3Ppqk",
+      "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD"
+    ],
+    "seq": 1,
+    "prevEntryHash": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+    "acknowledgedPrefix": {
+      "count": 1,
+      "lastSeq": 0,
+      "head": "sha256:533936cbbede60ba3617394ed7b99babd3a56109cc5139db011ba56b780f0e51",
+      "entriesDigest": "sha256:4fb32f5f4591aba0759f49b85d839277f17ba15261446c40aa92bc54f9c34602"
+    },
+    "phase": "OWNER_APPROVAL",
+    "reason": "SESSION_TIMEOUT",
+    "observedAt": "2026-11-05T00:01:00.000Z"
+  },
+  "signature": {
+    "signerDid": "did:key:z6Mkvo3zuWyhTjVCMZMTVERfBUvyQM372AnuN1XvHVE61CfD",
+    "canonicalization": "RFC8785-JCS",
+    "payloadDigest": "sha256:9b3e500d642b0731f02ac523f976f6854e623a7c1cfcd5396f2bbb21f0167b06",
+    "signedAt": "2026-11-05T00:01:00.000Z",
+    "signature": "ed25519:vn43o4hIZCRT5R_8xjCeT-MLibvv9kLVrgzmj-LIa9N019cCWBGL6tkVEJGGXFMVBthvrPB4tgR9Qq0iOpdGDg"
+  }
+}

package/dist/spec/task-manifest.0.2.0.schema.json

@@ -20,6 +20,7 @@
     "hitlPolicy"
   ],
   "properties": {
+    "contextGrant": { "$ref": "https://acp-spec.local/schemas/v0.2/context-grant.schema.json" },
     "protocolVersion": {
       "type": "string",
       "const": "0.2.0",
@@ -418,5 +419,90 @@
         }
       }
     }
-  }
+  },
+  "allOf": [
+    {
+      "if": {
+        "required": ["contextGrant"],
+        "properties": {
+          "contextGrant": {
+            "properties": {
+              "deliveryMode": { "enum": ["view_only", "hand_over"] }
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "permissions": {
+            "properties": {
+              "maxDelegationDepth": {
+                "const": 0
+              }
+            }
+          }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": {
+                "contextGrant": {
+                  "properties": {
+                    "deliveryMode": {
+                      "const": "view_only"
+                    }
+                  }
+                }
+              }
+            },
+            "then": {
+              "properties": {
+                "sandboxPolicy": {
+                  "properties": {
+                    "filesystemScope": {
+                      "const": "ephemeral_workspace_only"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        ]
+      }
+    },
+    {
+      "if": {
+        "required": [
+          "contextGrant"
+        ],
+        "properties": {
+          "contextGrant": {
+            "properties": {
+              "deliveryMode": {
+                "const": "approval_redelegation"
+              }
+            }
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "permissions": {
+            "properties": {
+              "maxDelegationDepth": {
+                "const": 1
+              }
+            }
+          },
+          "sandboxPolicy": {
+            "properties": {
+              "filesystemScope": {
+                "const": "ephemeral_workspace_only"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
 }

package/docs/context-grants.md

@@ -0,0 +1,221 @@
+# Context grants (CP1 and CP5a)
+
+`TaskManifest.contextGrant` is an optional 0.2.0 contract property for a
+sender's selected context. Existing manifests without it remain valid in both
+supported versions. No protocol version, peer floor, or release clock changes.
+A peer with the older closed 0.2.0 schema will reject this optional extension;
+use it only with CP1-capable peers. There is no automatic downgrade that strips
+the grant.
+
+| Delivery mode | Delegation depth | Retention declaration | Input retention |
+| --- | --- | --- | --- |
+| `view_only` (builder default) | 0 | `ephemeral_view` | false |
+| `hand_over` | 0 | `keep_deliverable` | false |
+| `approval_redelegation` (explicit opt-in) | 1 | either; default `ephemeral_view` | false |
+
+`hand_over` permits keeping the agreed, accepted deliverable. It does not permit
+keeping the input selection. CP5a enables `approval_redelegation` only with the
+owner decision and host prerequisites described below. Desktop controls are outside this slice.
+
+## Build and validate
+
+```ts
+import { buildTaskManifest, validateManifest, validateContextGrantUse } from 'sealbridge/sdk';
+
+const manifest = buildTaskManifest({
+  ownerDid, workerDid, title: 'Production feasibility',
+  description: 'Review selected dimensions and material.',
+  contextGrant: {
+    selectors: ['$.items[*]'],
+    fieldsAllowed: ['dimensions', 'material'],
+    fieldsDenied: ['customerName'],
+    angle: 'Report feasibility and missing dimensions.',
+    // Optional: deliveryMode: 'hand_over'
+  },
+});
+validateManifest(manifest);
+validateContextGrantUse(manifest, selectedInput);
+```
+
+The opt-in builder defaults to `view_only`, 24 hours from manifest `createdAt`,
+64 KiB, the mode's retention declaration, and `inputRetentionAllowed: false`.
+It does not change default manifests. `RequesterClient.delegate` also accepts
+these builder options as `contextGrant`; a supplied `manifest` is authoritative.
+
+Selectors are non-empty opaque strings describing the sender's selection.
+CP1 does not define a selector language, fetch source data, or filter input.
+The sender must construct the selection before submitting it. Allowed and denied
+field identifiers are compared literally; any identical identifier in both lists
+is refused. Empty selectors, blank angles, unknown grant properties (including a
+second `maxDelegationDepth`), and mismatched depth, retention or filesystem scope
+are refused. `view_only` requires the existing
+`filesystemScope: ephemeral_workspace_only` declaration. The builder uses that
+scope for both modes. CP1 refuses `inputRetentionAllowed: true` in either mode.
+A worker configured with the persistent plaintext `inboxPath` refuses grants.
+
+The schema caps `maxBytes` at 65,536. Live use checks the UTF-8 byte length of the
+entire JSON-serialized inline input, including JSON syntax, against that limit.
+This is an input limit, not a promise that envelope overhead fits every relay's
+configured admission cap. CP1 does not add attachment transfer or source access.
+`expiresAt` must be after manifest `createdAt` and at most seven days after it.
+Live proposal, acceptance and execution handoff additionally reject expired
+grants, including expiry during owner review. Historical contract verification
+checks the declared interval without consulting the current clock. Expiry does
+not extend the task deadline or prove deletion. Existing execution timeouts still
+control a running adapter.
+
+`outputSchema` in a grant is an optional declaration. CP1 does not add angle or
+grant-output verification; existing `io.outputSchema` behavior continues.
+
+## Audit lifecycle
+
+Context events are `CONTEXT_GRANT`, `CONTEXT_MODE`, `CONTEXT_OPENED`,
+`CONTEXT_DISCARDED`, and `CONTEXT_DELETION_ATTEMPTED`. Each payload contains only
+`{ grantDigest, deliveryMode }`, with the digest computed over the exact grant
+using the existing canonical JSON digest. Extra lifecycle payload fields are
+rejected by the audit-entry schema.
+
+The worker records grant and mode after proposal admission, opened after contract
+approval, and discarded on a subsequent terminal failure where its audit channel
+is still available. Pending intake is not recorded as discarded. On normal
+execution completion it attempts the existing temporary workspace cleanup before
+delivery and records deletion attempted before the bilateral checkpoint. The
+event describes an attempt, including cleanup failures; the existing cleanup
+error callback still reports residual files. Existing cancellation and failure
+cleanup paths remain; they do not claim a deletion event after a sealed or
+unavailable audit channel. Pre-admission refusals have no new bilateral entries.
+
+For grant-bearing sessions, proposal audit payloads contain proposal/manifest
+and frame digests plus the grant digest and mode, rather than the manifest and
+input. Acceptance audit payloads contain digests, worker identity, and the
+worker's signed acceptance proof, rather than the full contract. The encrypted
+wire frames still carry the complete signed contract. Replay/recovery verifies
+the compact evidence against the supplied manifest. Sessions without a grant
+keep their existing audit payloads. Depth-zero delivery and progress evidence retain their
+existing shapes and may contain application data; CP1 is not a general content
+scrubber for adapter output.
+
+AuditInterruption local format 1 remains limited to one acknowledged PROPOSE
+containing the full signed manifest. Compact grant proposals and their lifecycle
+entries are outside that scope, including when `auditInterruptionFormat: 1` is
+enabled on the worker. Grant sessions keep their existing lifecycle and recovery
+behavior; sessions without grants retain format-1 interruption closure. The
+interruption verifier's manifest and prefix checks are unchanged.
+
+Embedders can use `appendContextGrantAuditEvent(append, eventType, grant)` from
+`sealbridge/sdk` for an actual local lifecycle action. The append port owns
+signing, countersigning and persistence; for example, it can call an existing
+`BilateralLedger.append`. The helper never appends a grant body. Do not report
+opened or deletion attempted unless the corresponding action occurred.
+
+The filesystem and retention fields are contract declarations. A temporary
+workspace cleanup attempt does not prove erasure of copies, provider records,
+held input, owner-managed files, or application logs. CP1 adds neither a deletion
+proof nor a deliverable storage UI.
+
+Schemas: [ContextGrant](../spec/context-grant.schema.json),
+[audit payload](../spec/context-grant-audit-payload.schema.json),
+[manifest 0.2.0](../spec/task-manifest.0.2.0.schema.json).
+Examples: [view only](../spec/examples/context-pooling/view_only/sample-task-manifest.0.2.0.json),
+[hand over](../spec/examples/context-pooling/hand_over/sample-task-manifest.0.2.0.json).
+
+
+## CP5a: one approved child edge
+
+For A → B → C, A explicitly selects `approval_redelegation` on A → B at depth 1.
+The builder adds the existing `GATE_SUB_DELEGATION`. B can dispatch separate
+B → C tasks with strictly narrower `view_only` grants at depth 0. Only one
+edge is supported; siblings are independent one-edge chains.
+
+The root requires protocol 0.2.0, `ephemeral_workspace_only`, and absent/false
+input retention. Both root retention declarations remain available. No required
+manifest field or protocol version changes. Use this mode only with a known
+CP5a worker: version 0.2.0 alone does not advertise support. C receives an ordinary
+CP1 task; its host handles inspection and owner opening.
+
+### Host configuration and owner decisions
+
+```ts
+import { WorkerNode, RequesterClient } from 'sealbridge/sdk';
+
+const childRequester = new RequesterClient({
+  owner: bOwner, relay, approvalProvider: bOwnerDecisionProvider,
+});
+const worker = new WorkerNode({
+  owner: bOwner, relay, adapter, auditPath,
+  approvalProvider: bOwnerDecisionProvider,
+  redelegation: { requester: childRequester, ownerApprovalProvider: bOwnerDecisionProvider },
+});
+// Inside an admitted root adapter:
+const partial = await context.redelegate!({
+  to: cInvitation, manifest: fullyBuiltChildManifest, input: alreadySelectedJson,
+});
+```
+
+The worker needs `auditPath` for its durable journal and a requester using B's
+same owner identity. Configure ordinary connection and inspection policy
+separately. The child method exists only during an admitted approval-mode root.
+`ChildDelegationRequest` accepts `to`, optional `relay`, complete `manifest`,
+selected JSON `input`, and optional `auditPath`. Resolve saved references before
+calling. Capability chains, automatic approval/retry flags and supplied proofs
+are not accepted. The helper adds no root identifiers or parent input to C's
+frames; owner-supplied child content can still disclose them.
+
+A approves the exact root manifest/input/worker target before send. B separately
+opens the root, approves each child manifest/input/owner target, and reviews its
+result. A reviews the final root delivery. These live boundaries require a
+provider declaring `ownerDecision: true` and fresh target-bound owner receipts.
+Interactive CLI and MCP form providers declare it; webhooks declare it in
+owner-decision response mode. Policy providers cannot operate this mode. The
+marker is a host assertion, not independent evidence of a physical human action.
+
+### Link checks and delivery
+
+`createDelegationLink` signs after authenticated child acceptance and copies the
+actual child limits. `verifyDelegationChain` checks signed contracts, task IDs,
+owner continuity, digests, timestamps and remaining depth without consulting
+today's clock. `assertDelegationAttenuation` compares declarations literally:
+child selectors must be a nonempty subset, parent allowed fields cannot widen,
+denied fields persist, and selectors or allowed fields must strictly narrow.
+Reducing only bytes, budget or depth is insufficient. Parent grant `outputSchema`
+is preserved. Numeric budgets, deadline, expiry and bytes cannot increase;
+other budget fields, sandbox policy and verification policy must be equal.
+Child capabilities are empty. These are per-task ceilings; sibling budgets are
+not added together. The checks do not establish semantic provenance, interpret
+selectors, verify an angle, prove erasure or establish child-output acceptance.
+
+The host persists approved attempts before dispatch and accepted proofs before
+parent delivery, retaining proofs even when later child execution fails. It
+waits for managed children and attaches every issued proof; unresolved attempts,
+duplicate IDs, invalid proofs and empty attachments prevent delivery. Restart
+uses existing terminal recovery and does not replay child sends. An otherwise
+valid subset cannot reveal an out-of-band sibling to A.
+
+`Delivery.delegation` contains `{ parentContract, children }`, with each child
+`{ link, childContract }`. The optional attachment is required for depth-one
+contracts carrying a ContextGrant. Contracts without a ContextGrant keep their
+origin/main delivery, verification, recovery and retained-result behavior at
+all existing depths, including depth one without proof. CP1 depth-zero grants
+keep their ordinary path; attaching CP5a evidence to them is refused. There is
+no signed empty-child alternative: B cancels/rejects if it cannot produce a
+linked child; A may explicitly submit a fresh depth-zero task.
+
+Full signed parent and child contracts disclose selectors, angles, task text,
+limits and owner DIDs to A. B reviews that disclosure before dispatch. Proof and
+new journal fields add no raw input or child artifact body. Existing application
+records and relay byte limits still apply; proofs are never stripped to fit.
+
+`verifyDelegationAttachment(attachment, trustedContract)` checks every sibling
+against the exact root. Live verification runs before output checks, callbacks
+and owner review, adding `delegation_chain` only for the grant-bearing depth-one
+path. Direct live verification also requires `ownerDecision: true`. Final review
+includes verified child owner DIDs and proof digests. Recovery binds the embedded
+root to retained proposal/acceptance evidence; historical expiry is not a new
+refusal. Existing hashes and checkpoints retain the delivery attachment, and
+version-1 task journals retain optional child-attempt state. `verifyAudit`
+continues to check ledger hashes/signatures only.
+
+Diagnostics are `DELEGATION_PROOF_REQUIRED`, `DELEGATION_INVALID`, and
+`DELEGATION_APPROVAL_REQUIRED`. Schemas: [link](../spec/delegation-link.schema.json)
+and [attachment](../spec/delegation-attachment.schema.json). See the
+[complete attachment example](../spec/examples/context-pooling/approval_redelegation/sample-delegation-attachment.json).

package/docs/sdk.ja.md

@@ -36,10 +36,12 @@ import だけでは、鍵の作成・招待の読み取り・待受開始・rela
 | 接続の metadata | `WorkerTrustStore`（`listConnections` を含む）, `workerIntakePath` |
 | 接続交換 | `ConnectionService`, `ConnectionRouter`, `StoredConnectionExchange`, `syncConnections` |
 | 所有者の確認コマンド | `connectionsCommand`, `connectionHumanReview` |
-| 保留の審査 | `ConnectionAdmissionReview`, `HeldRequestReview`, `unavailableHeldContentReviewProvider` |
+| 保留の審査 | `ConnectionAdmissionReview`, `HeldRequestReview`, `unavailableHeldContentReviewProvider`, `createRuleBasedContentReviewProvider` |
+| 検証済みタスク内容 | `taskContent` |
 | 検索・招待 | `createSignedAgentCard`, `verifySignedAgentCard`, `createInviteToken`, `inviteTokenFromUri`, `isInviteTarget`, `parseAndVerifyInviteToken`, `discoverAgentCards`, `findDiscoveredAgentCard` |
 | 鍵の生成 | `generateKeyPair` |
 | MCP のホスト | `AcpMcpServer`, `mcpServerCommand`, `parseMcpServerArgs`, `mcpServerOptionsFromArgs` |
+| 内容のルール検査 | `inspectRuleContent`, `CONTENT_INSPECTION_RULES`, `CONTENT_INSPECTION_RULESET_VERSION`, `CONTENT_INSPECTION_RULESET_DIGEST`, `CONTENT_INSPECTION_LIMITS` |
 
 名前付きの型 exports:
 
@@ -57,7 +59,7 @@ import だけでは、鍵の作成・招待の読み取り・待受開始・rela
   `ConnectionRouterOptions`, `ConnectedEvent`, `ConnectionsCommandOptions`。
 - 審査: `HeldRequestReviewOptions`, `HeldContentReviewProvider`,
   `HeldInspectionContext`, `InspectionCompletion`, `ConnectionAdmissionReviewOptions`,
-  `InboundConnectionSummary`。
+  `InboundConnectionSummary`, `HeldTaskContent`。
 - MCP: `AcpMcpServerOptions`, `ApprovalProvider`, `ParsedMcpServerArgs`。
 - core・転送: `KeyPair`, `Json`, `Signed`, `SignedEnvelope`, `Invite`,
   `AgentSkill`, `DiscoveryAgentCard`, `CreateAgentCardOptions`, `SignedAgentCard`,
@@ -126,6 +128,31 @@ JSON の metadata・イベントを受け取ります。`now`・`transportFactor
 任意の `peerDisplayName` を含み、表示名は情報として扱います。組み込み検査の対象は接続情報だけです。
 [受信接続の審査](connections/admission.ja.md#受信接続の審査)を参照してください。
 
+## 保留タスク内容の検証と取り出し
+
+`taskContent(envelope, owner, contentDigest, envelopeDigest?)` は
+`HeldTaskContent` として `{manifest, input, capabilityChains}` だけを返します。
+能力の既定値は `[]` です。復号前に封筒の署名と宛先を検証し、暗号化と自身の `input`
+欄を必須とします。manifest と提案の署名、PROPOSE・連番0・タスク・依頼者・
+ワーカー所有者・内容ダイジェストの対応も検証します。保留レコードの `envelopeDigest`
+を渡すと封筒全体との一致も検証します。招待・接続・転送用の欄は返しません。
+既存 CLI の内部パスからの import を含め、3引数の呼び出しも維持します。
+
+結果は機微な平文をメモリ内に含みます。ログや永続保存に入れず、文字列データとして
+表示してください。所有者向けに表示する呼び出し側は、`HeldRequestReview` による
+検査完了（所有者・内容・封筒に結び付いた受領書を含む）を別途必須にしてください。
+取り出し自体は検査状態を確認せず、開封・接続同意・実行を承認しません。
+検査 provider は検査中にこの関数を使えます。能力チェーンの権限・信頼・現在の grant や
+依頼期限の有効性は検証しません。期限を過ぎた終端タスクも内容を検証でき、
+ライブ受付は従来の別の検証を維持します。構造と署名などの検証であり、
+内容に対するヒューリスティックな検出・評価は行いません。
+
+検証失敗は `INVALID_PROPOSAL`、暗号化入力の失敗は従来の
+`UNENCRYPTED_ENVELOPE_REJECTED` または `ENVELOPE_DECRYPTION_FAILED` です。
+スキーマやネイティブパーサーの詳細は返しません。検査受領書の作成・ファイル書き込み・
+通信は行わず、プロトコル・スキーマ・必須欄・保存形式は変更しません。
+[保留内容の審査](connections/held-content.ja.md)を参照してください。
+
 ## MCP のライフサイクル
 
 専用の stdio MCP プロセスでは `mcpServerCommand(args, identityOptions)` が既存 CLI
@@ -136,3 +163,82 @@ JSON の metadata・イベントを受け取ります。`now`・`transportFactor
 無指定時の policy-auto の既定値は変わりません。送信前の承認と最終検収は別です。
 接続の審査には別の `connectionReview` を使います。[MCP の説明](../README.ja.md)も
 参照してください。
+
+## 監査の中断証拠
+
+`parseJsonl` / `verifyAudit` は双方署名の形式専用を維持します。`parseAuditJsonl` / `verifyAuditEvidence` は `AuditEvidence`（`AuditBundle | InterruptedAuditBundle`）を扱い、ワーカー単独の形式 1 の終端は、外部ピンが一致しても `UNILATERALLY_CLOSED`・`valid:false` です。`createAuditInterruption`・対応ストア・関連公開型も `sealbridge/sdk` から利用できます。[保存形式・ピン・永続化・依頼者との照合規則（英語）](audit-interruption.md)を参照してください。
+
+## 明示的に選ぶオフラインの内容検査
+
+`inspectRuleContent({manifest,input,capabilityChains?}, limits?, signal?)` は
+core のメモリ上の検査器です。公開する型は `RuleInspectionInput`、
+`RuleInspectionOptions`、`RuleInspectionRule`、`RuleInspectionKind`、
+`RuleInspectionFinding`、`RuleInspectionDiagnosticCode`、`RuleInspectionReport`、
+`RuleBasedContentReviewOptions` です。ルールと走査は core、子プロセス管理は runtime
+が担当します。edge の入口は変えません。
+
+保留中のタスクには、プロバイダを明示的に渡します。
+
+```ts
+import { HeldRequestReview, WorkerNode, createRuleBasedContentReviewProvider } from 'sealbridge/sdk';
+
+const inspectionTimeoutMs = 5000;
+const heldReview = new HeldRequestReview(owner, {
+  ...identityOptions,
+  inspectionTimeoutMs,
+  provider: createRuleBasedContentReviewProvider({
+    timeoutMs: inspectionTimeoutMs,
+    onReport(recordId, report) {
+      // 所有者向けの資料として、メモリ上で文字どおり表示する。
+      renderInspection(recordId, report);
+    },
+  }),
+});
+const worker = new WorkerNode({ ...workerOptions, owner, heldReview });
+```
+
+`owner`・`identityOptions`・`workerOptions`・`renderInspection` は組み込み側が用意します。
+プロバイダの制限時間は review 以下にします。両方の既定は5秒、指定範囲は1〜45,000 ms
+です。中止、どちらかの時間切れ、失敗で子を終了します。コールバックの例外・拒否・中断・
+時間超過でも完了になりません。コールバックへ渡すレポートは複製なので、変更しても受領の
+内容は変わりません。これはホストの処理であり、任意のコードを隔離する口ではありません。
+
+外側の封筒署名、暗号化された宛先、署名付き proposal、manifest、タスク・送信者・
+ワーカーと保留ダイジェストの一致を確認してから、manifest・input・capabilities だけを
+固定のビルド済み検査器へ IPC で渡します。所有者の鍵と通信用の資格情報は渡しません。
+環境変数は許可リストから作り、結果は64 KiBまでとし、中止・時間切れ・失敗で子を終了します。
+平文ファイルやログを書かず、ネットワーク要求・DNS照会・実行・アーカイブの展開をしません。
+カーネルのネットワーク隔離ではなく、固定の信頼したコードです。外部プラグイン、ダウンロード
+したルール、呼び出し側の正規表現・ソースコードは受け付けません。
+
+変更不可の記述子・検出器の版・既定の上限から `CONTENT_INSPECTION_RULESET_DIGEST` を
+作ります。既定は直列化した内容256 KiB、深さ32、ノードとキー合計100,000、文字列ごと
+UTF-8で64 KiB、所見100件、base64復号合計64 KiBです。`limits` では下げることだけができます。
+作業量・出力の上限超過は `error` とし、切り詰めて成功にはしません。manifest の全欄・
+input・capabilities・文字列のキーを JSON Pointer 順で検査します。位置は元の文字列の
+UTF-16単位です。パスは `~0`・`~1` でエスケープし、機微な内容の可能性があるキーは
+`[redacted]` に置き換えます。所見の説明と診断は固定コードで、証拠の抜粋やURLの値は
+含めません。通常のキーは位置に含まれるため、レポートも確認用の資料として扱います。
+
+見えない文字・制御文字、英語と日本語の指示表現、URLの形、秘密を求める語と動詞の
+組み合わせ、資格情報の典型的な形、コードの目印、長いbase64を検出します。復号は上限を
+設けて1回だけ行い、実行形式・アーカイブの先頭バイトなら `block` にします。検出は
+ヒューリスティックです。通常の引用文にも反応し、未対応の表現は通ることがあります。
+資格情報をオンラインで確認しません。`pass` はこのルールで所見が出なかったことを示します。
+`pass`・`warn`・`block` の完了はいずれも既存受領の `complete` になり、`block` は
+所有者への最も強い注意です。実行許可や開封にはならず、その会期の人間による契約承認は
+引き続き必要です。失敗は途中の所見より優先し `error` になり、検査完了前の表示を許可しません。
+
+`contentDigest` は `digest({manifest,input})` です。capabilities と実効上限はレポートと
+正確な封筒を通じて結び付けます。core 単体で上限内の JSON 複製を作る前に失敗した場合は、
+不完全な値として `digest(null)` を返します。エラーレポートを内容の検証に使わないでください。
+runtime は認証できた保留のダイジェストにエラーレポートを結び付けます。既存受領の
+`reportDigest` は `{recordId,ownerDid,kind,contentDigest,envelopeDigest,report}` の
+ハッシュです。保存するのはこのダイジェストだけで、レポート全体は `onReport` のメモリ内に
+とどめます。既存受領に所見はなく、`HeldRequestReview.inspect` はキャッシュ済み完了を返す
+場合があります。再起動後にレポートが必要なら、保存済み封筒と対応する inspection context
+でプロバイダを明示的に再実行します。受領から所見なしと推定せず、ディスクにレポートの
+キャッシュを作らないでください。
+
+task 以外は `unavailable` です。既定の検査、CLI の表示、trusted の受付、MCP、自動承認の
+動作は変わりません。protocol・schema・manifest 必須欄・通信形式・保存形式を変えません。