# Vendor-Neutral Consequence Adapter Contract v0.1

## Purpose

The adapter is the mandatory boundary between a proposed command and a
partner-owned sandbox consequence. It must not trust an upstream `ALLOW`
boolean or an agent's statement that approval occurred.

## Required Inputs

The adapter receives:

```text
authority artifact
exact command object
declared receiver audience
policy version
evidence commitments
request identity
```

The authority artifact must bind at least:

```text
issuer
audience
command commitment
asset identity
task or mission scope
policy version
evidence hashes
issued time
expiry
one-shot nonce
```

## Required Operations

The adapter must:

1. validate the authority artifact's structure and signature;
2. reject the wrong audience, policy, asset, task, or evidence revision;
3. independently canonicalize and hash the submitted command;
4. compare the command commitment in constant time where applicable;
5. reject expired or not-yet-valid authority;
6. consume the nonce atomically before applying the bounded command;
7. reject replay after process restart;
8. apply no command when state persistence or verification is unavailable;
9. emit a receiver receipt separately from an application receipt;
10. obtain an observed-effect receipt from an independent observation source.

## Receipt Chain

Statuses must remain distinct:

```text
AUTHORITY_ACCEPTED
COMMAND_ACCEPTED_BY_RECEIVER
COMMAND_APPLIED_TO_SANDBOX
EXPECTED_EFFECT_OBSERVED
```

Absence of a later status must never be converted into implied success.

Every receipt must contain:

```text
request_id
adapter_id
authority_artifact_hash
command_commitment
status
reason_codes
policy_version
monotonic_observation_time
physical_action_authorized: false
```

## Required Rejections

The adapter must fail closed on:

- invalid signature or structure;
- command commitment mismatch;
- wrong receiver audience;
- identity or scope mismatch;
- stale policy or evidence;
- expired authority;
- consumed nonce;
- unavailable durable state;
- unavailable sandbox;
- ambiguous application response.

## Prohibited Behavior

The adapter must not:

- repair or reinterpret a mismatched command;
- request broader authority automatically;
- substitute a different asset, task, destination, or policy;
- report application as observed consequence;
- expose production credentials to the proposing agent;
- issue physical authority from a pilot receipt;
- call an external LLM to make an enforcement decision.

## Portability

The contract is transport-neutral. ROS 2, HTTP, message queues, and vendor SDKs
may carry the request, but transport access alone does not satisfy authority.