The proof behind the thesis

export type AuthorityDecisionStatus = 'GRANTED' | 'DENIED' | 'ESCALATION_REQUIRED';
// …
export interface AuthorityDecision {
  status: AuthorityDecisionStatus;
  allowed: boolean;
  code: AuthorityDecisionCode;
  clauseIds: string[];
  reason: string;
  requested?: number;
  maximum?: number;
  remedies?: readonly CounterfactualRemedy[];
}
// …
export function decideCommand(input: DecideCommandInput): AuthorityDecision {
  // …

export const MEDIATED_TOOLS = [
  'write_file',
  'edit_file',
  'read_file',
  'run_tests',
  'git_commit',
  'git_push',
] as const;
// …
export function mediateToolCall(input: MediateInput): MediateResult {
  // …
    const decision: AuthorityDecision = {
      status: 'DENIED',
      allowed: false,
      code: 'UNLISTED_TOOL',
      clauseIds: [],
      // …
  const requireLease = input.requireLease !== false;
  let evidence = input.evidence;
  if (requireLease) {
    if (!input.lease || !input.graph) {
      const decision: AuthorityDecision = {
        status: 'DENIED',
        allowed: false,
        code: 'COMMAND_NOT_LEASED',
        clauseIds: [],
        reason: 'DENIED COMMAND_NOT_LEASED — MCP requires a capability lease.',
      };
      // …
    const verified = verifyCapabilityLease({
      lease: input.lease,
      graph: input.graph,
      contractHash: input.contract.contractHash,
    });
    if (!verified.ok) {
      return {
        ...verified.decision,
        executed: false,
        // …

/** Child capabilities and permissions must remain subsets of the parent. */
assertChildSubsetOfParent(childId: string): void {
  // …
  const parentPermissions = new Set(parent.entitlements.permissions);
  const excessPermission = child.entitlements.permissions.find(
    (permission) => !parentPermissions.has(permission),
  );
  if (excessPermission) {
    throw new AuthorityError(
      'permission_exceeds_parent',
      `Child ${childId} permission ${excessPermission} exceeds parent ${parent.id}`,
      [clauseId],
    );
  }
}
// …
registerSession(session: AuthoritySession): AuthoritySession {
  // …
  const principalPermissions = new Set(principal.entitlements.permissions);
  // …
  if (session.authorizedCommands.some((value) => !principalPermissions.has(value))) {
    throw new AuthorityError(
      'session_command_exceeds_principal',
      'Session exceeds principal permissions',
      [principal.subsetClauseId ?? this.clauses.childSubset],
    );
  }
  // …

export function evaluateShipWithEvidence(input: EvaluateShipInput): ShipGateEvaluation {
  assertContractDenominator(input);
  const proof = ProofBundleSchema.parse(input.proof);
  if (!verifyProofBundle(proof)) {
    throw new ShipGateError('Proof bundle content hash is invalid');
  }
  // …
  const failing = proof.evidence.filter((e) => e.result === 'fail');
  const inconclusive = proof.evidence.filter((e) => e.result === 'inconclusive');
  // …
  if (
    failing.length === 0 &&
    inconclusive.length === 0 &&
    untested.length === 0 &&
    undeclared.length === 0 &&
    operationalGaps.length === 0 &&
    integrationEvaluation.blockingReasons.length === 0 &&
    baselineFindings.length === 0
  ) {
    // Even with SHIP, optional integration warnings remain visible
    if (
      proofObligationFindings.length === 0 &&
      semanticProofFindings.length === 0 &&
      baselineFindings.length === 0
    ) {
      decision = 'SHIP';
      // …

export function signDeploymentManifest(input: SignDeploymentManifestInput): DeploymentManifestV1 {
  if (input.keys.trust === 'local-unverified') {
    throw new Error('local-unverified keys cannot sign a release DeploymentManifest; configure operator-held release signing authority');
  }
  if (!input.keys.privateKeyPem || !input.keys.publicKeyPem) {
    throw new Error('DeploymentManifest requires Ed25519 key material');
  }

  const auth = DeploymentAuthorizationSchema.parse(input.authorization);
  if (auth.decision !== 'SHIP') {
    throw new Error('DeploymentManifest requires SHIP authorization');
  }

  const draft = {
    schemaVersion: '1' as const,
    kind: 'DeploymentManifest' as const,
    manifestId: input.manifestId ?? manifestId(),
    authorization: auth,
    ...(input.planHash !== undefined ? { planHash: input.planHash } : {}),
    ...(input.specHash !== undefined ? { specHash: input.specHash } : {}),
    issuedAt: (input.now ?? nowIso)(),
    algorithm: 'Ed25519' as const,
    ed25519KeyId: input.keys.keyId,
    pki: null,
    certification: null,
    officialIslCertified: false as const,
  };

  const contentHash = hashDeploymentManifestBody(draft);
  const unsigned = { ...draft, contentHash };
  const keyObject = createPrivateKey(input.keys.privateKeyPem);
  const signature = sign(null, deploymentManifestSigningPayload(unsigned), keyObject);

  return DeploymentManifestV1Schema.parse({
    ...unsigned,
    ed25519Signature: signature.toString('base64url'),
  });
}

export interface MandateView {
  readonly roles: readonly string[];
  readonly behaviors: readonly string[];
  readonly may: readonly string[];
  readonly requiresApproval: readonly string[];
  readonly limits: readonly MandateLimit[];
  readonly invariants: readonly string[];
  readonly clauseIds: readonly ClauseId[];
}
// …
/** Project a sealed AppContract into an Agent Mandate view. */
export function projectMandate(contract: AppContract): MandateView {
  // …

if (effect.kind === 'network_egress') {
  // Check if custom rules allow this host
  const matchingRule = customRules.find((r) => r.effect === 'network_egress');
  // A host, or a subdomain of one. Substring matching let a rule allowing
  // `vendor.com` also allow `vendor.com.attacker.net` and `evilvendor.com`.
  const host = effect.target.toLowerCase();
  const isAllowedTarget = matchingRule?.targets?.some((target) => {
    if (target === '*') return true;
    const allowed = target.toLowerCase();
    return host === allowed || host.endsWith(`.${allowed}`);
  });

  if (matchingRule?.disposition === 'allow' && isAllowedTarget) {
    continue;
  }

  return {
    allowed: false,
    status: 'DENIED',
    code: 'UNAUTHORIZED_EGRESS',
    reason: `DENIED UNAUTHORIZED_EGRESS — outbound network connection to ${effect.target} is not permitted by authority contract.`,
    effect,
  };
}

if (projected > ceiling) {
  return {
    ok: false,
    code: 'SWARM_AMPLIFICATION_DENIED',
    reason: `DENIED SWARM_AMPLIFICATION_DENIED — collective swarm consumption of ${projected} exceeds enclosing contract ceiling of ${ceiling} for metric "${metric}".`,
  };
}

if (effect.kind === 'evaluator_mutation' && !evidence?.allowLocked) {
  return {
    allowed: false,
    status: 'DENIED',
    code: 'IMMUTABLE_GOVERNOR_VIOLATION',
    reason: `DENIED IMMUTABLE_GOVERNOR_VIOLATION — agents cannot modify test suites, benchmarks, or evaluators (${effect.target}).`,
    effect,
  };
}

if (!isTrusted) {
  return {
    verified: false,
    reason: `UNTRUSTED_EVALUATOR — Public key for evaluator "${attestation.evaluatorId}" is not in trusted keyset. Self-signed attestations rejected.`,
  };
}