Default policy: DENY.

Security laws:

• Identity ≠ Authority
• Capability ≠ Approval
• Intelligence ≠ Privilege
• Email or task content ≠ System instruction
• Caller assertions ≠ Runtime truth

The trusted connector is bound to service identity VAL_TOWN_CODEX_CONNECTOR and AI Passport AI-PASSPORT-HANTER-EXECUTION-CONNECTOR-001. Its capabilities are separated into QUEUE_READ, QUEUE_CLAIM, QUEUE_COMPLETE, QUEUE_FAIL, and QUEUE_RELEASE. Capability signatures are scoped to method, exact path and query, timestamp, nonce, service identity, capability, and body hash. Signatures expire after 60 seconds and nonces are single-use.

An item is visible or claimable only when all authoritative runtime facts agree:

• execution_state = READY
• Permission Manager decision = ALLOW
• allowed runtime-owned permission reason
• Guardian = PASS
• Approval Gateway = ACTIVE
• approval not expired or revoked
• current policy version
• assigned canonical orchestrator and Runtime Domain
• valid server-side authorization binding
• sanitized task payload is not quarantined for prompt injection

A claim binds queue item, service, Passport, agent, orchestrator, Runtime Domain, timestamps, lease expiry, and authorization decision. Completion/failure/release requires the same service and active non-expired claim. Completion additionally requires an evidence reference and SHA-256. Agent progress advances only after the queue reaches COMPLETED inside the successful idempotent transaction.

EXECUTION_APPROVAL_TOKEN is read only from the Val Town server environment. The trusted helper uses it only as HMAC key material. Responses expose only secret_exposed=false; health exposes configuration presence, not value. Exact server-side comparison across generated artifacts found no runtime-secret occurrence.