Module execution_nonce 

Execution nonces prevent TOCTOU races between capability evaluation and tool-server dispatch.

An ExecutionNonce is a short-lived, single-use token that the kernel attaches to every Verdict::Allow response. Tool servers MUST present the nonce before executing; the kernel rejects stale (>nonce_ttl_secs, default 30s) or replayed nonces. This closes the time-of-check / time-of-use window between evaluate() and tool-server execution that DPoP alone cannot close.

Design

• The nonce body is an opaque nonce_id plus a NonceBinding that binds the nonce to the exact (subject, capability, server, tool, request_id, parameter_hash) tuple. Substituting a nonce between unrelated tool calls therefore fails the binding check.
• The kernel signs the full body (nonce id + binding + expires_at) with its receipt-signing key, so downstream tool servers can cryptographically verify authenticity without a round trip.
• Replay is prevented by an ExecutionNonceStore: the first reserve(nonce_id) returns true and consumes the nonce; any subsequent reservation returns false and the verify path rejects.

Backward compatibility

The whole feature is opt-in by installing an ExecutionNonceConfig. With no config installed, no nonce is minted and non-nonce callers keep working. With a config installed and require_nonce == false, allow responses carry nonces and dispatch verifies any nonce that is presented, but callers that omit the nonce remain backward-compatible. New strict deployments flip require_nonce to make every execution-bound dispatch present a fresh nonce.

Structs

ExecutionNonce

Signable body of a kernel-issued execution nonce.

ExecutionNonceConfig

Configuration for execution nonce issuance and verification.

InMemoryExecutionNonceStore

In-memory LRU-backed execution nonce store.

NonceBinding

Fields that bind an execution nonce to one tool invocation.

SignedExecutionNonce

Kernel-signed execution nonce carried across agent/kernel transports.

Enums

ExecutionNonceError

All the reasons an execution nonce can fail verification.

Constants

DEFAULT_EXECUTION_NONCE_STORE_CAPACITY

Default capacity for the in-memory replay-prevention LRU cache.

DEFAULT_EXECUTION_NONCE_TTL_SECS

Default TTL for a freshly minted execution nonce.

EXECUTION_NONCE_SCHEMA

Schema identifier for Chio execution nonces.

Traits

ExecutionNonceStore

Persistence boundary for replay-prevention of execution nonces.

Functions

consume_execution_nonce

is_supported_execution_nonce_schema

mint_execution_nonce

Mint a fresh signed execution nonce.

mint_execution_nonce_with_reservation

verify_execution_nonce

Verify a signed execution nonce against the expected binding.

verify_execution_nonce_without_consume