Mission: IC-HANTER-EXECUTION-BRIDGE-SECURE-CLAIM-001

Canonical control chain:

AI Passport → Enterprise IMPERIAL Skills → Guardian Core → Approval Gateway → Permission Manager → Execution Bridge → Runtime Domain → Audit Ledger

HANTER remains the single AI Command Center / Deputy to the Architect and is not a global orchestrator.

The public HTTP surface is deny-by-default. The legacy queue paths remain protected and are disabled for normal operation. A trusted Val Town script signs short-lived capability requests with an HMAC derived from the server-side runtime secret. The raw secret is never returned in a response, blob, audit event, log, connector command, or client configuration.

Governed operations:

• GET /execution-bridge/ready — filtered authorized READY view.
• POST /execution-bridge/claim — atomic READY → CLAIMED with claimant and lease binding.
• POST /execution-bridge/complete — evidence-gated CLAIMED → COMPLETED; progress advances only in the same successful transaction.
• POST /execution-bridge/fail — evidence-gated CLAIMED → FAILED.
• POST /execution-bridge/release — retriable CLAIMED → READY.
• GET /health and GET /readiness — non-secret operational state.

Claims use a transaction, a partial unique index allowing one ACTIVE claim per queue item, compare-and-set queue updates, and conditional audit insertion. Finalization inserts an idempotency request only while the claim is active, binds all state changes to that request, conditionally inserts audit evidence, and verifies the committed request/state before returning success. Nonces and finalization request IDs are unique.

Task text is normalized, bounded to 4096 characters, labeled UNTRUSTED_TASK_DATA with authority NONE, and scanned for prompt-injection patterns. Caller-provided identity, agent, domain, ALLOW, approval, role, or ownership assertions are not accepted by the API.

SQLite remains canonical trusted runtime storage. External automation never reads or mutates it directly for production execution. Schema/state diagnostics used during verification were SELECT-only. Audit rows are append-only through no-update/no-delete triggers and carry SHA-256 hashes plus server-side HMAC signatures.

1. Stop invoking the v3 connector scripts.
2. Keep legacy paths protected; do not re-enable universal bearer use.
3. Release active retriable claims through the governed release endpoint.
4. Revert the Val Town file revision to the last known-good v2 revision.
5. Verify /health, /readiness, unauthenticated 401 behavior, queue state, and audit continuity.