Authoritative Spend

What a receipt must prove

Before this contract, agents using the chio-api-protect sidecar direct tool-call route) routed around the kernel's atomic spend pipeline and emitted an advisory receipt that admitted, in its own metadata, that it was not authorization. A TrustLevel::Mediated value is a stamp written at persistence time, not proof that budget was held and guards ran.

ADR-0016 retires the advisory receipt and makes the enforcement contract normative: “authoritative” requires all four checks over a kernel signature. A receipt must pass every check below. The kernel rejects it as non-authoritative if any check fails.

The four checks

Four facts must co-occur on one receipt. They are not independent signals to be weighed; the receipt is authoritative if and only if all four hold at once.

1. A mediated Allow decision. The call went through the kernel: mediated_decision present, prevent enforcement, observation_outcome absent, trust_level equal to Mediated, and the decision was Allow.
2. A budget hold that moved. A reconciled BudgetAuthorityReceiptRef whose exposure actually moved against the agent's cost-bearing capability. The hold has already reduced the available budget.
3. A kernel-signed execution nonce. A chio.execution_nonce.v1 signed by the kernel and bound to the exact capability_id, tool_server, tool_name, and parameter_hash of this call.
4. The receipt records that nonce. The receipt carries the same nonce_id, so the hold and the nonce are cross-bound. The shared identifier links the budget change to the call.

Two conditions complete the check. The signature must verify under an admitted kernel key, and any missing or invalid element returns false. That is the fail-closed rule in full: there is no authoritative-by-default, and no advisory shortcut.

Gate Diagram

The Predicate

Whether a receipt represents authoritative, real-money spend is a machine-checkable predicate, not a convention. is_authoritative_spend_receipt and the mediated_spend evidence (schema chio.mediated_spend.v1) evaluate the receipt directly. The function returns a bool and is fail-closed by construction:

// A receipt is an authoritative spend receipt iff EVERY clause below holds.
// Fail-closed: any missing or invalid element returns false. A
// TrustLevel::Mediated stamp, on its own, does not qualify.
pub fn is_authoritative_spend_receipt(receipt: &Receipt) -> bool {
    //  (a) mediated Allow       mediated_decision present, `prevent` enforcement,
    //                           observation_outcome absent, trust_level == Mediated,
    //                           decision == Allow
    //  (b) budget hold moved    a reconciled BudgetAuthorityReceiptRef whose
    //                           exposure moved against the cost-bearing capability
    //  (c) nonce bound to call  a kernel-signed chio.execution_nonce.v1 bound to
    //                           this capability_id / tool_server / tool_name / parameter_hash
    //  (d) receipt records nonce  the receipt carries that nonce_id (hold <-> nonce)
    //  (e) admitted kernel key  the signature verifies under an admitted kernel key
    //
    //  (a) && (b) && (c) && (d) && (e)   // else false
}

Because the predicate lives in chio_core_types, every consumer checks the same shape: the settlement receipt gate, the comptroller surface-report projection, and the reconciliation ledger all agree on what “authoritative” means. The receipt also carries a BudgetGuaranteeLevel recording how strong the underlying hold really was, covered next.

The Execution Nonce

Clause (c) is checkable because the kernel signs a single-use nonce that pins one call. chio.execution_nonce.v1 is a signed body plus an Ed25519 signature:

{
  "schema": "chio.execution_nonce.v1",
  "nonce_id": "en_9c3f2a18b4e1...",
  "issued_at": 1735000000,
  "expires_at": 1735000060,
  "bound_to": {
    "subject_id": "did:chio:9b4f...",
    "request_id": "req_7f21...",
    "capability_id": "cap_soc2_review",
    "tool_server": "ts-search-prod",
    "tool_name": "soc2-review",
    "parameter_hash": "b1946ac92492d2347c6235b4d2611184..."
  },
  "signature": "ed25519:3f9a...c012"
}

The bound_to block is the whole point: the nonce is worthless unless it names the exact capability_id, tool_server, tool_name, and parameter_hash that ran. A missing or empty request_id is rejected fail-closed, so a nonce cannot be issued for an unidentified call. The receipt records the matching nonce_id (clause d), which is what cross-binds the hold to the nonce: the same event, signed once by the kernel.

BudgetGuaranteeLevel: Declared, and It Has to Be True

A hold moving against a capability is necessary but not sufficient to describe how strong that hold is. BudgetGuaranteeLevel is the taxonomy a budget store declares for the guarantee it actually provides. Four variants:

The taxonomy is normative and must be truthful: a store never claims a level above its real backing. The retired advisory receipt was effectively advisory_posthoc presenting itself as authorization; making the level explicit on the receipt is what turns that mismatch into a machine-visible fact.

Authorize the Worst Case, Then Reconcile

The hold in clause (b) follows one lifecycle: authorize the worst case up front, then reconcile down to what actually happened. The authoritative number is the authorize-then-reconcile pair, not either endpoint on its own.

1. Authorize. The kernel holds the worst case: quote.quoted_cost when a quote is present, otherwise max_cost_per_invocation.
2. Execute. The governed call runs under the kernel-signed nonce.
3. Reconcile. The hold reconciles down to the realized cost_charged, releasing the unused reservation back to the capability budget.
4. Reverse. A deny or abort reverses the hold entirely, so a call that never executed leaves no residual charge.

This supersedes the “monotonic, no-refund” text of ADR-0006: the code already refunds via the reverse-and-reconcile path, and the contract now says so. Advisory-only consumption of a spend receipt is a machine-visible conformance failure, enforced by the golden conformance gate in the chio-conformance crate.

Two linkage slots are reserved so downstream records can cite the exact nonce and hold once a v2 schema revision lands. The comptroller surface-report contract chio.comptroller.surface-report.v1 and the settlement receipt both carry execution_nonce_ref and hold_ref, populated as Option::None until then so no governance-gated schema bump is forced early.

See Also

• Reconciliation & Watchdog for the ledger view of this contract: the exposure ledger, the quoted/observed/charged cost layers, and how reconciled receipts feed billing.
• Budgets & Metering for the authorize/capture/release/reconcile lifecycle against a capability budget, which this contract makes checkable.
• Receipts for the receipt as a governance record: what it carries and why every governed call emits one.
• Predeclared Settlement for how settlement terms are fixed before the call, upstream of the hold.
• The Wall Stops Money for why the pre-action gate, not the receipt, is what actually stops a spend.