Content Binding & TOCTOU

// packages/shared/src/domain/execution-authorization.ts (abridged: submittedBy and
// grantedCapability left out, see Execution Authorization)
export interface ExecutionAuthorizationPayload {
  readonly version: 1;
  readonly authorizationId: string;
  readonly nonce: string;
  readonly decisionId: string;
  readonly businessTransactionId: string;
  readonly policyName: string;
  readonly policyVersion: string;
  readonly authorizedAt: string;
  readonly expiresAt: string;

  /**
   * Canonical content hash of the ExecutableContent (businessTransactionId,
   * action, target, parameters) approved for execution. Computed identically
   * by the signing side and the verifying side via the same
   * ExecutableContentHasher, so a receiving gateway can recompute this hash
   * from the exact content it is about to forward and reject any mismatch.
   */
  readonly businessTransactionHash: string;

  /** Same idea, for the exact policy content the decision rested on. The gateway rejects an authorization that lacks it. */
  readonly policyContentHash?: string;

  /** Optional. Same idea, for the runtime signals the decision was evaluated against. */
  readonly signalsHash?: string;
}

// packages/execution-gateway/src/ExecutionGateway.ts
if (passed) {
  const actualHash = await this.contentHasher.hash(executableContent);
  const expectedHash = request.authorization.payload.businessTransactionHash;

  businessTransactionHashMatches = actualHash === expectedHash;

  if (!businessTransactionHashMatches) {
    hashMismatch = { expected: expectedHash, actual: actualHash };
  }
}

version → signature → expiry → TTL policy → businessTransactionHash recompute-and-compare
    → policyStillCurrent recompute-and-compare (required, fails closed)
  → policyGovernanceVerified approval record check (required, fails closed)
  → signalsStillCurrent recompute-and-verify (when wired)
  → nonce

// packages/execution-gateway/src/ExecutionGateway.ts
if (currentSignalsHash !== signalsHash) {
  signalsStillCurrent = false;
  signalsHashMismatch = { expected: signalsHash, actual: currentSignalsHash };
} else {
  const violations = await this.signalStateVerifier.findViolations(
    {
      action: executableContent.action,
      businessTransactionId: executableContent.businessTransactionId,
      intentParameters: executableContent.parameters,
      intentTarget: executableContent.target,
      stage: "release",
      ...(verifiedPolicy !== undefined ? { policy: verifiedPolicy } : {}),
    },
    request.signals as PolicySignals,
  );

  signalsStillCurrent = violations.length === 0;
}

// examples/tutorials/36-parameter-tampering/run.ts
const originalHash = context.authorization.payload.businessTransactionHash;
const tampered = {
  ...content,
  parameters: { ...content.parameters, paymentAmount: 500000 },
};
const tamperedHash = await hasher.hash(tampered);
// originalHash !== tamperedHash