Skip to content
Press / to search

API Contracts

Canonical ContextOS contracts for invokeAgent, tool envelopes, DecisionRecord, replay, and RunContext propagation.

Implementation GuideLast reviewed: Edit on GitHub
At a glance

ContextOS standardizes portable execution boundaries through a canonical contract. The published schemas are the normative serialization surface, while the TypeScript compiler is a deterministic conformance reference—not a production runtime.

Published validation artifacts:

ContractSchema
RunContext/schemas/run-context.v1.schema.json
invokeAgent/schemas/invoke-agent.v1.schema.json
CompiledContext/schemas/compiled-context.v1.schema.json
ToolEnvelope/schemas/tool-envelope.v1.schema.json
DecisionRecord/schemas/decision-record.v1.schema.json
ReplayPacket/schemas/replay-packet.v1.schema.json
AgentDelegationEnvelope/schemas/agent-delegation.v1.schema.json
Additive execution profiles/schemas/execution-contract.v1.schema.json

Profile-aware execution

The separate Execution Contract preserves these base envelopes and attaches exact profile/control/release selection to the authenticated run, trace and tenant. Trusted admission derives actual enabled features, pins the immutable registry and release, and binds attachments in a protected store. Matching identifier strings in untrusted JSON do not authenticate that association.

Control Profiles expand mandatory and conditional requirements as a union; no optional listing can demote them. negotiateExecutionContract proves compatibility against declared support only. Dispatch additionally needs current verified authority/revocation, policy, any exact stored approval, independent constraints, an active execution boundary, permitted actual data flow and reserved budget. The attachment entry-point index covers the full authority, boundary, durable, budget and evidence types without adding required fields to old envelopes.

The compiler throws sanitized ContextCompileError with code: "policy_eval_error" on an applicable predicate exception and produces no successful CompiledContext. False predicates retain their declared behavior. Normalized business priority/equal-priority deny and independent guardrails are defined separately from the compiler’s cumulative prohibition filter. Governance explains both paths. Pure reference validators consume normalized trusted observations; they do not authenticate a broker, execute a sandbox or atomically persist state.

Canonical execution contract

invokeAgent(request_envelope, run_context)
  → resolve pack refs, tenant, identity, intent, safety mode
  → compile(packs, request, run_context) → CompiledContext
  → bind DecisionSpec
  → route model judgment through AI Gateway / LLM Router
  → loop {
       planner(CompiledContext)         → Plan
       critic.verify(Plan)              → ok | replan | reject | escalate
       executor(Plan, ToolGateway)      → step_results + evidence_refs
       critic.score(step_results)       → accept | retry | replan | escalate
       consolidate(effects, evidence)   → memory_proposals
     }
  → emit DecisionRecord(evidence_refs, approvals, controls_active, trace_id, replay?)
  → emit replay packet and scorecard

Run Context

The Run Context is the state container carried through every layer and every contract. Every envelope below carries it (or a reference to it).

{
  "run_id": "run_a1b2c3d4e5f60718",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "session_id": "sess_42f1",
  "tenant_id": "tenant_acme_prod",
  "user": {
    "user_id": "usr_771",
    "delegation": {
      "auth_type": "oauth2",
      "scopes": ["orders.read", "payments.refund"],
      "subject": "u:user:771",
      "token_ref": "tok_user_7a"
    }
  },
  "agent": {
    "agent_id": "agt_support",
    "agent_urn": "agent:contextos/support-refund@1.2.0",
    "workload_identity": "spiffe://contextos/agents/support",
    "role": "support_ops",
    "token_ref": "tok_agent_92",
    "lifecycle": "active",
    "principal_chain": [
      { "kind": "user", "id": "usr_771", "tenant_id": "tenant_acme_prod" },
      { "kind": "agent", "id": "agent:contextos/support-refund@1.2.0", "tenant_id": "tenant_acme_prod" }
    ],
    "identity_claim": {
      "version": "ctxid/1",
      "iss": "https://identity.contextos.example",
      "sub": "agent:contextos/support-refund@1.2.0",
      "run_id": "run_a1b2c3d4e5f60718",
      "tenant_id": "tenant_acme_prod",
      "principal_chain": [
        { "kind": "user", "id": "usr_771", "tenant_id": "tenant_acme_prod" },
        { "kind": "agent", "id": "agent:contextos/support-refund@1.2.0", "tenant_id": "tenant_acme_prod" }
      ],
      "scopes": ["tools:read", "tools:write", "a2a:send"],
      "nbf": "2026-09-03T08:00:00Z",
      "exp": "2026-09-03T08:05:00Z",
      "kid": "kid_ctxos_support_2026_05",
      "claim_hash": "sha256:..."
    }
  },
  "intent": "support.refund",
  "locale": "en-IN",
  "safety_mode": "delegated",
  "run_budget": {
    "total_tokens": 12000,
    "bucket_tokens": { "policy": 1800, "tool": 1500, "evidence": 3500, "memory": 1500, "business": 1500, "session": 2200 },
    "max_tool_calls": 8,
    "max_replan_attempts": 2,
    "wall_clock_ms": 30000,
    "max_cost_cents": 25.0,
    "tokens_used": 0,
    "tool_calls_used": 0,
    "latency_ms_used": 0,
    "cost_cents_used": 0
  },
  "metadata": {}
}

Try it: live envelope builder

Toggle the mode and safety_mode below to see the invokeAgent envelope rebuild live, alongside the runtime implications.

Runtime implications
  • Streaming. Bidirectional event stream; tool calls progress live to the client.
  • Delegated identity. An implementing gateway must validate current owned authority and every ancestor, then broker scoped credentials outside model context. The delegated v1 mode is a compatibility label, not a grant.

Base envelope builder only. ExecutionContractEnvelope is attached separately; no tool runs or authority checks occur here.

invokeAgent envelope
{
  "request_id": "req_9f3a12",
  "session_id": "sess_42f1",
  "tenant_id": "tenant_acme_prod",
  "user": {
    "user_id": "usr_771",
    "delegation": {
      "auth_type": "oauth2",
      "scopes": [
        "orders.read",
        "payments.refund"
      ],
      "subject": "u:user:771"
    }
  },
  "agent": {
    "agent_id": "agt_support",
    "workload_identity": "spiffe://contextos/agents/support"
  },
  "context_pack_refs": [
    "ctxpack.support@5.2.0"
  ],
  "input": {
    "intent": "support.refund",
    "message": "Refund order ord_881 for INR 4200",
    "channel": "app_chat",
    "locale": "en-IN",
    "context": {
      "refund_amount": 4200,
      "identity_verified": true
    }
  },
  "mode": "stream",
  "runtime": {
    "plan_timeout_ms": 15000,
    "max_tool_calls": 8,
    "max_cost_cents": 25
  },
  "trace": {
    "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
    "span_id": "00f067aa0ba902b7",
    "trace_flags": "01"
  }
}

invokeAgent envelope

The single entry point for the runtime.

{
  "request_id": "req_9f3a12",
  "session_id": "sess_42f1",
  "tenant_id": "tenant_acme_prod",
  "user": {
    "user_id": "usr_771",
    "delegation": { "auth_type": "oauth2", "scopes": ["orders.read", "payments.refund"], "subject": "u:user:771" }
  },
  "agent": {
    "agent_id": "agt_support",
    "agent_urn": "agent:contextos/support-refund@1.2.0",
    "workload_identity": "spiffe://contextos/agents/support",
    "role": "support_ops"
  },
  "context_pack_refs": [
    "ctxpack.support@5.2.0",
    "decision-catalog.support@2.1.0"
  ],
  "input": {
    "intent": "support.refund",
    "message": "Refund order ord_881",
    "channel": "app_chat",
    "locale": "en-IN"
  },
  "mode": "stream",
  "runtime": {
    "plan_timeout_ms": 15000,
    "max_session_duration_ms": 14400000,
    "max_tool_calls": 8,
    "max_payload_bytes": 1048576,
    "max_cost_cents": 25.0
  },
  "attachments": [
    { "artifact_id": "art_invoice_881", "media_type": "application/pdf", "sha256": "2f9cc0...", "uri": "s3://tenant-acme-prod/invoices/881.pdf" }
  ],
  "trace": {
    "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
    "span_id": "00f067aa0ba902b7",
    "trace_flags": "01"
  }
}

Field reference

FieldRequiredDescription
request_idyesglobally unique request identifier
session_idoptionalper-session execution scope; absent → ephemeral run
tenant_idyestenant boundary for policy, data, and tool auth
user.delegationconditionalRequired when native ActionRisk.authority is user_delegated or policy requires on-behalf-of authority; the v1 mode alone is not the full decision.
agent.agent_urnoptionalVersioned agent subject: agent:contextos/<slug>@<version>.
agent.workload_identityyesSPIFFE-style URI for the executing workload
agent.identity_claimoptional profileShort-lived run or hop claim. A signing/attestation profile can require sig; audit should expose claim_hash, not raw secrets.
context_pack_refs[]yes (≥1)pinned pack versions; the runtime refuses unpinned refs
input.intentyescanonical intent in the Intent-Task Catalog
modeyesstream / batch / long_running
runtime.*yesbudget hints; the runtime materializes these into the RunContext.run_budget
traceyesW3C Trace Context — propagated through every span

RunContext.safety_mode and the three v1 tool-envelope approval fields remain required compatibility ceilings. Native policy evaluates the independent ActionRisk dimensions carried by adapter declarations and, when available, tool calls.

Execution modes

  • stream — bidirectional event stream for interactive planning/tool steps.
  • batch — single response envelope for non-interactive jobs.
  • long_running — durable session with progress events and heartbeat TTL for hour-scale workflows.

Timeout and long-running guidance

  • Planner timeout: 5–30 s by task class.
  • Tool step timeout: adapter-specific (2–120 s typical).
  • Long-running session timeout: up to hours with heartbeat renewal.
  • Hard-stop behavior: stop new dispatch, fence ownership and retain a checkpoint/failure observation where storage permits. Preserve unknown in-flight effects and route to the declared escalation/reconciliation owner; a crash cannot guarantee that a final checkpoint was persisted.

RunExecutionState uses the exact lifecycle in Orchestration. Approval wait/expiry, run deadline and effect outcome are separate facts. validateResume checks pinned artifacts against current owned store state, revalidates authority/approval/boundary/external preconditions/budget and requires explicit policy migration when interpretation changes. A historical snapshot cannot reset later used/reserved capacity or grant a stale executor ownership.

Payload limits and attachments

  • Keep envelope metadata small and stable.
  • Pass large payloads as attachments[] references (artifact_id, signed URL, checksum, media type).
  • The Tool Gateway enforces tenant-scoped attachment access at the boundary.
  • Attachment hashes are recorded in the evidence_manifest and the trace.

AgentDelegationEnvelope

Agent-to-agent delegation creates a derived child run under narrower authority. It is not a free-form orchestration message. The parent reserves the child’s budget and binds the scope ceiling before the child starts; deployments that require cryptographic delegation also sign that binding.

{
  "envelope_version": "contextos.agent_delegation.v1",
  "delegation_id": "dlg_refund_research_01",
  "parent_run_id": "run_a1b2c3d4e5f60718",
  "child_run_id": "run_child_01",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "tenant_id": "tenant_acme_prod",
  "issuer": "agent:contextos/support@1.2.0",
  "subject": "agent:contextos/order_research@1.0.0",
  "principal_chain": [
    { "kind": "user", "id": "usr_771", "tenant_id": "tenant_acme_prod" },
    { "kind": "agent", "id": "agt_support", "tenant_id": "tenant_acme_prod" },
    { "kind": "agent", "id": "agt_order_research", "tenant_id": "tenant_acme_prod" }
  ],
  "scope": {
    "allowed_intents": ["orders.verify_refund_evidence"],
    "allowed_capabilities": ["adp_orders.lookup"],
    "data_classification_ceiling": "CONFIDENTIAL",
    "output_schema_ref": "schema://orders/refund-evidence.v1"
  },
  "sub_budget": {
    "total_tokens": 4000,
    "bucket_tokens": { "evidence": 2000 },
    "max_tool_calls": 2,
    "max_replan_attempts": 1,
    "wall_clock_ms": 10000,
    "max_cost_cents": 3,
    "tokens_used": 0,
    "tool_calls_used": 0,
    "latency_ms_used": 0,
    "cost_cents_used": 0
  },
  "effect_policy": "read_only",
  "issued_at": "2026-07-11T08:00:00Z",
  "expires_at": "2026-07-11T08:05:00Z",
  "parent_claim_hash": "sha256:parent_claim_01"
}

Conforming enforcement rejects a delegation if its capability set, classification ceiling, expiry, or sub-budget exceeds the parent. Write-capable child effects use isolate_until_accepted; a read_only child cannot commit effects into the parent’s lineage.

Published schema: agent-delegation.v1.schema.json.

Delegation context evidence

AgentDelegationEnvelope remains the authority contract. Its effect_policy retains only read_only and isolate_until_accepted. Context initialization is recorded in a separate, locally versioned trace attachment naming the selection policy, parent checkpoint, artifact revisions, and admitted evidence. Implementations must not add fork to the effect-policy enum or treat inherited history as a credential.

The envelope serializes intended delegation; it does not prove its issuer, current ancestor authority or actual enforcement. Profile-aware AuthorityValidationInput binds authenticated principals and verified run links to finite grants, checking every ancestor’s scope, expiry and current revocation. Personal standing mandates bind an authenticated owner and trigger context. Child budgets reserve from the parent before execution; a child cannot create a fresh spending pool. These checks are additional to the legacy serialized shape.

The same narrowing checks apply to workers and reviewers. For an independent-review claim, retain what the reviewer could see and whether it received the author’s interpretation before producing its initial findings. Evidence references remain subject to tenant, classification, retention, and redaction controls.

ToolCallEnvelope

Produced by the Executor for each plan step that calls an adapter; brokered by the Tool Gateway.

{
  "envelope_version": "contextos.tool_call.v1",
  "tool_call_id": "tool_118",
  "run_id": "run_a1b2c3d4e5f60718",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "session_id": "sess_42f1",
  "capability_id": "adp_payments.issue_refund",
  "args": {
    "order_id": "ord_881",
    "amount_inr": 4200,
    "currency": "INR",
    "idempotency_key": "ik_2x9k4j7m1q8w0p3z"
  },
  "principal_chain": [
    { "kind": "user", "id": "usr_771", "tenant_id": "tenant_acme_prod" },
    { "kind": "agent", "id": "agent:contextos/support-refund@1.2.0", "tenant_id": "tenant_acme_prod" }
  ],
  "approval_mode_requested": "destructive",
  "approval_mode_effective": "destructive",
  "approval_mode_highest": "destructive",
  "action_risk_requested": {
    "effect": "external_state",
    "authority": "user_delegated",
    "reversibility": "compensatable",
    "interaction": "api",
    "data_scope": "CONFIDENTIAL",
    "decision_ttl_seconds": 300
  },
  "action_risk_effective": {
    "effect": "external_state",
    "authority": "human_approved",
    "reversibility": "compensatable",
    "interaction": "api",
    "data_scope": "CONFIDENTIAL",
    "decision_ttl_seconds": 300
  },
  "policy_decision_id": "pol_9901",
  "evidence_refs": [
    "kg:order:ord_881#snapshot_kg_2026_05_03_T0930",
    "policy:POLICY_RETURNS_V4#R_HIGH_VALUE_REQUIRES_APPROVAL"
  ],
  "idempotency_key": "ik_2x9k4j7m1q8w0p3z",
  "auth_ref": "claim_hash:sha256:...",
  "metadata": {
    "arg_schema_ref": "schema://adp_payments.issue_refund.v3",
    "requires_approval_gate": "GATE_FINANCE_APPROVAL",
    "protocol": "openapi",
    "version": "2026-04-15"
  }
}

ToolResultEnvelope

Produced by the Tool Gateway after the adapter returns.

{
  "envelope_version": "contextos.tool_result.v1",
  "tool_call_id": "tool_118",
  "run_id": "run_a1b2c3d4e5f60718",
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
  "session_id": "sess_42f1",
  "capability_id": "adp_payments.issue_refund",
  "status": "completed",
  "output": {
    "transaction_id": "txn_q9...",
    "refund_amount_inr": 4200,
    "currency": "INR",
    "supplier_rules_ref": "rules:payments:refund:v12"
  },
  "error": null,
  "artifacts": [],
  "citations": [
    { "evidence_ref": "tool:adp_payments.issue_refund:tool_118" }
  ],
  "mutations": ["refund:txn_q9"],
  "risk_tags": ["destructive"],
  "policy_decision_id": "pol_9901",
  "latency_ms": 612,
  "metadata": {
    "approver": "user_finance_lead_77",
    "approval_evidence_snapshot_hash": "sha256:b2a1...",
    "tool_transcript_id": "tool_tx_118",
    "redaction_applied": false,
    "retries": 0,
    "cost_cents": 0.31
  }
}

ToolResultEnvelope statuses

StatusMeaning
okread-only or synchronous operation returned without side effects
completedgoverned operation finished and any declared side effects are represented in mutations[]
pausedapproval, external dependency, or long-running continuation is pending
blockedpolicy or consent blocked execution before the adapter ran
rejectedgateway rejected malformed, unauthorized, or unsurfaced capability use
failedadapter, transport, or runtime execution failed
errornormalized error result where the caller may inspect error and metadata

Effect evidence and resumption

Tool-result status describes the reported invocation outcome; it is not a distributed transaction guarantee. failed or error may follow a committed external effect whose response was lost. paused may represent pending reconciliation. Emit completed only when the declared postcondition is established and known effects are represented; do not convert an unknown outcome into success or invent an unknown v1 status.

Use existing error, metadata, citations, and mutations surfaces, plus evidence referenced by the DecisionRecord, to retain minimized normalized-request evidence, logical operation reference, provider receipt or lookup, attempted recovery, and unresolved questions. The additive OperationLedger/EffectObservation attachments define the standard profile-aware recovery shape; application-specific metadata remains explicitly versioned. Record only observed mutations; an empty mutation list after a timeout is not proof of no mutation.

Effect outcomes are not_dispatched, confirmed, not_applied, partial and unknown, independently of the unchanged v1 result status. A provider-idempotent retry requires exact key/payload scope, retention and current verified provider guarantees; manual/query/no-retry strategies preserve uncertainty instead of fabricating deduplication. Late observations may settle an effect fact without granting executor ownership or releasing budget. Compensation is a separately authorized operation preserving the original history.

A conforming recovery implementation must demonstrate these cases against its actual adapter contract:

CaseRequired behavior and retained evidence
Timeout before dispatchEstablish that dispatch did not occur before classifying the effect as absent
Provider commit followed by response lossReconcile the original logical operation; no blind duplicate write
Duplicate request deliveryReuse the operation identity; reject incompatible request reuse; apply declared deduplication semantics
Provider deduplication window expiresDo not assume the old key remains protective; reconcile or escalate
Approval or credential revoked during pauseDeny new protected access or effects until current authority permits them
Cancellation races with an external writeReport cancellation separately from the observed or unresolved effect
Session recovered but postcondition unavailablePreserve unresolved evidence; no accepted business outcome

These are implementation acceptance obligations, not claims that the reference compiler implements a session store, provider reconciliation, or a payment runtime. See adapter retry obligations.

DecisionRecord

The typed outcome the runtime returns after the canonical loop completes.

For the full conceptual contract, lifecycle, validation rules, replay model, and storage requirements, see Decision Record.

{
  "record_id": "dr_2026_05_04_a17",
  "decision_key": "support.refund.execute",
  "decision_version": "1.0.0",
  "timestamp": "2026-05-04T09:31:42Z",
  "status": "DECIDED",
  "actor": { "type": "AGENT", "id": "agt_support" },
  "intent_ref": "support.refund",
  "subject_ids": ["customer:cus_77", "order:ord_881"],
  "inputs_refs": { "request": "req_9f3a12", "session": "sess_42f1" },
  "outputs": {
    "refund_amount_inr": 4200,
    "currency": "INR",
    "transaction_id": "txn_q9..."
  },
  "evidence_refs": [
    "kg:order:ord_881#snapshot_kg_2026_05_03_T0930",
    "tool:adp_orders.lookup:tc_117",
    "tool:adp_policy.eval:tc_119",
    "tool:adp_payments.issue_refund:tc_121"
  ],
  "policy_decisions": [
    { "policy_decision_id": "pol_9900", "rule_ids": ["R_REFUND_REQUIRES_IDV"] },
    { "policy_decision_id": "pol_9901", "rule_ids": ["R_HIGH_VALUE_REQUIRES_APPROVAL"] }
  ],
  "approvals": [
    {
      "gate_id": "GATE_FINANCE_APPROVAL",
      "approver": "user_finance_lead_77",
      "approval_mode_effective": "destructive",
      "evidence_snapshot_hash": "sha256:b2a1...",
      "decided_at": "2026-05-04T09:31:30Z"
    }
  ],
  "controls_active": {
    "must_refuse": [],
    "must_escalate": [],
    "approval_gates_active": ["GATE_FINANCE_APPROVAL"],
    "redaction_rules_active": [],
    "context_admission": {
      "data_only_block_ids": ["ev_0", "ev_1", "mem_0", "session"],
      "untrusted_block_ids": [],
      "privileged_sink_policy": "verified_or_user_intent"
    },
    "evidence_gates": [
      {
        "decision_key": "support.refund.execute",
        "required": ["order_lookup", "policy.eval", "identity_verified"],
        "satisfied": ["order_lookup", "policy.eval", "identity_verified"],
        "unresolved": [],
        "rejected_evidence": [],
        "conflicts": [],
        "sufficiency": "sufficient",
        "commit_allowed": true
      }
    ]
  },
  "confidence": 0.95,
  "rationale": { "strategy": "policy_match_with_evidence", "alternatives_considered": [] },
  "budget_usage": { "tokens": 4720, "tool_calls": 4, "cost_usd_cents": 0.91, "wall_clock_ms": 1840 },
  "lineage": { "pack_version": "ctxpack.support@5.2.0", "snapshot_version": "kg_2026_05_03_T0930" },
  "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736"
}

DecisionRecord status values

DECIDED, DEFERRED, REJECTED, ESCALATED, IN_FLIGHT, CLOSED.

controls_active records the decision’s control context; it is not an attestation that a sandbox, broker or store actually enforced a profile. Preserve correlated ConformanceReport evidence for that implementation/workflow/release/environment separately. Existing fractional-cent budget fields keep their meaning; new aggregate accounting uses an explicitly declared currency and integer quantum, with exact conversion or visible rejection rather than rounding. See Conformance.

Trace context propagation

W3C Trace Context propagates traceparent and tracestate across the planes. Optional W3C Baggage is separate, with explicitly approved minimized metadata and destination-specific forwarding rules. A trace identifier grants no authority. The following is an illustrative internal telemetry projection, not another runtime envelope; its tenant/session/pack identifiers are eligible only where reader, recipient and retention policy permits them:

{
  "trace_context": {
    "traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-b9c7c989f97918e1-01",
    "tracestate": "tenant=tenant_acme_prod,ctxpack=ctxpack.support@5.2.0",
    "baggage": "session_id=sess_42f1,decision_id=support.refund.execute,run_id=run_a1b2c3d4e5f60718"
  }
}

Context Pack reference

The pack is loaded by reference. A context_pack_refs[] entry is pack_id@semver, and the runtime refuses unpinned refs.

{ "context_pack_refs": ["ctxpack.support@5.2.0"] }

See Context Pack for the full schema.

Compiled output

This is an abridged explanatory projection, with repeated provenance and complete ledger hashes elided. Use the Context Pack’s tested compiler projection and published schema for actual validation. The surfaced manifest and evidence sufficiency flags are compiler outputs; dispatch authorization still checks the current runtime conditions above.

{
  "compiled_prompt": { "system": "...", "developer": "...", "task": "...", "context_blocks": [] },
  "manifests": {
    "policy_manifest": [{ "bundle_id": "POLICY_RETURNS_V4", "rule_ids": ["R_REFUND_REQUIRES_IDV"] }],
    "tool_manifest":   [{
      "adapter_id": "adp_payments",
      "capabilities": ["issue_refund"],
      "capability_metadata": {
        "issue_refund": {
          "kind": "write",
          "risk_level": "write_irreversible",
          "approval_mode": "destructive",
          "source": "adapter_registry"
        }
      }
    }],
    "evidence_manifest": [{ "evidence_ref": "kg:order:ord_881#snapshot_kg_2026_05_03_T0930" }]
  },
  "runtime_controls": {
    "must_refuse": [],
    "must_escalate": [],
    "approval_gates_active": ["GATE_FINANCE_APPROVAL"],
    "redaction_rules_active": [],
    "context_admission": {
      "data_only_block_ids": ["ev_0", "ev_1", "mem_0", "session"],
      "untrusted_block_ids": [],
      "privileged_sink_policy": "verified_or_user_intent"
    },
    "evidence_gates": [
      {
        "decision_key": "support.refund.execute",
        "required": ["order_lookup", "policy.eval", "identity_verified"],
        "satisfied": ["order_lookup", "policy.eval", "identity_verified"],
        "unresolved": [],
        "rejected_evidence": [],
        "conflicts": [],
        "sufficiency": "sufficient",
        "commit_allowed": true
      }
    ]
  },
  "budget_report": {
    "tokens_allocated": { "policy": 1800, "tool": 1500, "evidence": 3500, "memory": 1500, "business": 1500, "session": 2200 },
    "tokens_used_at_compile": 4720,
    "tokens_used_by_bucket": { "policy": 940, "tool": 220, "evidence": 2100, "memory": 460, "business": 510, "session": 490 },
    "bucket_truncations": { "evidence": true },
    "dropped_block_ids": { "evidence": ["ev_low_priority_7"] },
    "omissions": [
      {
        "block_id": "ev_low_priority_7",
        "bucket": "evidence",
        "reason": "budget_exceeded",
        "estimated_tokens": 510,
        "priority": 20,
        "source_refs": ["kg:order:ord_991#snapshot_kg_2026_05_03_T0930"]
      }
    ],
    "warnings": ["evidence bucket exceeded budget; dropped 1 low-priority block"]
  },
  "context_ledger": {
    "pack_ref": "ctxpack.support@5.2.0",
    "request_id": "req_9f3a12",
    "policy_bundles": ["POLICY_RETURNS_V4"],
    "tools": ["adp_payments.issue_refund"],
    "evidence_refs": ["kg:order:ord_881#snapshot_kg_2026_05_03_T0930"],
    "memory_refs": [],
    "dropped_block_ids": ["ev_low_priority_7"],
    "omissions": [
      {
        "block_id": "ev_low_priority_7",
        "bucket": "evidence",
        "reason": "budget_exceeded",
        "estimated_tokens": 510,
        "priority": 20,
        "source_refs": ["kg:order:ord_991#snapshot_kg_2026_05_03_T0930"]
      }
    ],
    "budget": { "tokens_used_at_compile": 4720, "truncated_buckets": ["evidence"] },
    "compiled_context_hash": "sha256:9f0b..."
  }
}

The budget_report and context_ledger fields are part of the audit surface. They make replay and operator debugging local: a budget issue names the dropped blocks, and a tool-surfacing question carries capability risk metadata in the manifest itself.

Decision output (snippet)

The Decision Spec the runtime resolves to live alongside the catalog:

{
  "decision_id": "support.refund.execute",
  "outcome": "approved",
  "evidence_refs": ["kg:order:ord_881#snapshot_kg_2026_05_03_T0930", "policy:POLICY_RETURNS_V4#R_HIGH_VALUE_REQUIRES_APPROVAL"]
}