Bound task execution by absolute call and credential deadlines

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

docs/task-execution-native-fixture.md

@@ -205,3 +205,56 @@ changes during its single read. A valid older prepared capsule still cannot
 prove a task token absent when durable journal state/calls reached issuance:
 that remains unknown cleanup debt. Authentication alone is not anti-rollback.
 No business or consume admission is restored and no production scope is granted.
+
+
+## Absolute budgets, effective credential expiry and exact source bytes
+
+This source successor tightens the disposable native owner adapter; it does not
+establish actual v2 whole-stack ALLOW/native acceptance. The retained-registry
+Approval correspondence failure is preserved in the coordinator artifact. The
+new real provider fixture is retained separately as unfinished follow-up, while
+the existing ec215-based fixture evidence remains its original scoped proof.
+
+Every native business/grant method now runs inside the earlier wall/monotonic
+operation deadline minus the five-second reserve. After exact owner token lookup,
+the adapter requires aware expire_time and retains the earlier actual expiry and
+conservative mint-start + declared TTL bound, in wall and monotonic coordinates.
+Every subsequent business call uses the minimum of global and credential bounds.
+The descriptor and signed global deadline are never extended or rewritten.
+Missing/expired credential evidence refuses issuance acceptance. Cleanup continues
+under its original separate obligation after either business bound expires.
+
+The fixture owner main-thread execution profile uses absolute SIGALRM budgets,
+not socket inactivity timeouts alone. Each native transport and cleanup native
+call has a two-second execution deadline, including intent/source checking and
+send/header/body/close work. Larger compiler reconstruction remains within the
+earlier operation/credential window. A 50ms alarm backstop keeps blocked teardown
+interruptible after timeout; it cannot authorize another business effect. Nested
+timers retain the shorter outer deadline rather than refreshing it. Unsupported
+threads, invalid budgets and conflicting ambient timers refuse. This fixed Unix
+fixture profile does not select a production process supervisor or provide a
+shared arbitrary-thread execution service. Native rollout still needs exact owner
+runtime/admission, trusted clock and independent recovery/custody enforcement.
+
+The actual v2 package/version selects additional mediator checks over the exact
+independently installed descriptor source_bundle before authorization and each
+freshness gate, including pre-native grant entry. It reads bounded regular,
+files without group/world write, non-indirect paths, compares exact source hashes and stat stability,
+and applies an absolute read budget. The existing compiler's own pin set does not
+implicitly authenticate other source_bundle roles; these explicit checks fill
+that gap. No requester-selected path, approval flag or source boolean can enable
+this path. Legacy synthetic fixture proof remains separately scoped and is not
+used to satisfy v2 acceptance.
+
+Native policy/grant absence now requires exact empty-errors404 and policy HCL
+comparison admits only the already reviewed single optional terminal LF, reusing
+frozen recovery R2 helpers. Native response JSON rejects duplicate/nonfinite data.
+
+The independent slice tests cover actual header/body drips, stalled close after
+timeout, slow compiler and shorter actual credential expiry before any HTTP
+effect, nested/conflicting/foreign-thread budgets, private source hash drift,
+unsafe modes/indirection/FIFO/oversize refusal, and bounded cleanup after expiry.
+Actual native fixed grant/metadata/readback/cleanup remains a separate positive
+compatibility check. There is no successful actual normalized provider-chain
+claim in this slice; source-managed pre-approval normalization and immediate CAS
+precision must pass the follow-up full-stack proof first.