Module runtime 

Runtime mandate enforcement.

This module provides runtime authorization and consumption of mandates for tool calls. It ensures atomic single-use enforcement, nonce replay prevention, and idempotent consumption.

Architecture (SPEC-Mandate-v1.0.3 §7)

┌─────────────────────────────────────────────────────────────────┐
│                        MCP Proxy                                │
│  ┌──────────────┐    ┌──────────────┐    ┌──────────────────┐  │
│  │ Policy Check │───▶│ Authorizer   │───▶│ Forward to Tool  │  │
│  └──────────────┘    └──────┬───────┘    └────────┬─────────┘  │
│                             │                      │            │
│                     ┌───────▼───────┐      ┌──────▼──────┐     │
│                     │ MandateStore  │      │ Tool Server │     │
│                     │   (SQLite)    │      └─────────────┘     │
│                     └───────────────┘                          │
└─────────────────────────────────────────────────────────────────┘

Structs

Authorizer

Runtime authorizer.

AuthzConfig

Authorization configuration.

AuthzReceipt

Authorization receipt returned after successful consumption.

ConsumeParams

Parameters for consume_mandate.

MandateData

Mandate data for authorization (extracted from signed mandate).

MandateMetadata

Mandate metadata for upsert.

MandateStore

SQLite-backed mandate store.

ToolCallData

Tool call data for authorization.

Enums

AuthorizeError

Combined authorization error.

AuthzError

Authorization errors.

MandateKind

Mandate kind.

OperationClass

Operation class for tool classification.

PolicyError

Policy-level authorization errors (before DB).

Constants

DEFAULT_CLOCK_SKEW_SECONDS

Default clock skew tolerance in seconds.

MANDATE_SCHEMA

DDL for mandate runtime enforcement tables.

Functions

compute_use_id

Compute deterministic use_id per SPEC-Mandate-v1.0.4 §7.4.