From 3a43ca5d49ca778dc4de8e85d05a6caf7b44c426 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:39 -0700
Subject: [PATCH 01/15] Add one-use grant path:
 pilots/action-boundary/boundary.mjs

---
 pilots/action-boundary/boundary.mjs | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/pilots/action-boundary/boundary.mjs b/pilots/action-boundary/boundary.mjs
index 7dc48945..91bdd92f 100644
--- a/pilots/action-boundary/boundary.mjs
+++ b/pilots/action-boundary/boundary.mjs
@@ -51,9 +51,9 @@ export function planAction(proposal, policy) {
   }
 }
 
-// requestApproval and executeTool must be supplied by the trusted host. A model
-// must never supply either callback or the policy. No approval callback => deny.
-export async function dispatchAction(proposal, { policy, requestApproval, executeTool } = {}) {
+// All callbacks and policy must be supplied by the trusted host. A model must
+// never supply them. consumeApproval is an optional atomic, one-use host claim.
+export async function dispatchAction(proposal, { policy, requestApproval, consumeApproval, executeTool } = {}) {
   const plan = planAction(proposal, policy);
   const receipt = (status, reason) => ({ protocol: "aml-action-dispatch/1",
     proposal_sha256: plan.proposal_sha256, policy_decision: plan.decision,
@@ -61,9 +61,9 @@ export async function dispatchAction(proposal, { policy, requestApproval, execut
   if (plan.decision === "deny") return { receipt: receipt("blocked", plan.reason) };
   if (typeof executeTool !== "function") return { receipt: receipt("blocked", "missing_host_dispatch") };
   const frozen = snapshot(proposal);
+  let approval;
   if (plan.decision === "requires_approval") {
     if (typeof requestApproval !== "function") return { receipt: receipt("blocked", "approval_unavailable") };
-    let approval;
     try { approval = await requestApproval({ proposal: JSON.parse(frozen.bytes), proposal_sha256: frozen.digest }); }
     catch { return { receipt: receipt("blocked", "approval_error") }; }
     if (approval?.approved !== true || approval?.proposal_sha256 !== frozen.digest) {
@@ -76,6 +76,23 @@ export async function dispatchAction(proposal, { policy, requestApproval, execut
   if (rechecked.decision !== plan.decision || rechecked.proposal_sha256 !== frozen.digest) {
     return { receipt: receipt("blocked", "policy_changed") };
   }
+  if (plan.decision === "requires_approval" && consumeApproval !== undefined) {
+    if (typeof consumeApproval !== "function") return { receipt: receipt("blocked", "invalid_host_consumer") };
+    let consumed;
+    try {
+      consumed = await consumeApproval({ approval, proposal: JSON.parse(frozen.bytes),
+        proposal_sha256: frozen.digest });
+    } catch {
+      return { receipt: receipt("blocked", "approval_consume_error") };
+    }
+    if (consumed !== true) return { receipt: receipt("blocked", "approval_reused_or_expired") };
+    // An asynchronous host store can outlive the policy snapshot above. A
+    // consumed grant stays spent if the host revokes the rule in the meantime.
+    const finalPlan = planAction(frozen.value, policy);
+    if (finalPlan.decision !== plan.decision || finalPlan.proposal_sha256 !== frozen.digest) {
+      return { receipt: receipt("blocked", "policy_changed") };
+    }
+  }
   try {
     const result = await executeTool(JSON.parse(frozen.bytes));
     return { receipt: receipt("dispatched", "host_dispatch_returned"), result };
@@ -85,3 +102,4 @@ export async function dispatchAction(proposal, { policy, requestApproval, execut
     return { receipt: receipt("unknown", "host_dispatch_error") };
   }
 }
+

From 51184cec8eece94069698339074a95fa4a7f56c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:40 -0700
Subject: [PATCH 02/15] Add one-use grant path:
 pilots/action-boundary/guarded-tool.mjs

---
 pilots/action-boundary/guarded-tool.mjs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pilots/action-boundary/guarded-tool.mjs b/pilots/action-boundary/guarded-tool.mjs
index f6195dd2..5cd30811 100644
--- a/pilots/action-boundary/guarded-tool.mjs
+++ b/pilots/action-boundary/guarded-tool.mjs
@@ -4,13 +4,14 @@
 import { planAction, dispatchAction } from "./boundary.mjs";
 
 export function createGuardedToolExecute({
-  tool, effect, purpose, resourceFor, policy, requestApproval, execute
+  tool, effect, purpose, resourceFor, policy, requestApproval, consumeApproval, execute
 } = {}) {
   if (typeof tool !== "string" || !tool.trim() ||
       typeof effect !== "string" || !effect.trim() ||
       typeof purpose !== "string" || !purpose.trim() ||
       typeof resourceFor !== "function" || typeof execute !== "function" ||
       (requestApproval !== undefined && typeof requestApproval !== "function") ||
+      (consumeApproval !== undefined && typeof consumeApproval !== "function") ||
       !policy || typeof policy !== "object") {
     throw new TypeError("A host-owned tool, effect, purpose, resourceFor, policy, and execute are required");
   }
@@ -28,6 +29,7 @@ export function createGuardedToolExecute({
     const outcome = await dispatchAction(proposal, {
       policy,
       requestApproval: requestApproval && (input => requestApproval(input, context)),
+      consumeApproval: consumeApproval && (input => consumeApproval(input, context)),
       executeTool: frozen => execute(frozen.arguments, context, frozen)
     });
     return {

From d6c41bcdc58a57bf4df23ca9db7554efa76f8bc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:41 -0700
Subject: [PATCH 03/15] Add one-use grant path: docs/action-lab-core.js

---
 docs/action-lab-core.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/docs/action-lab-core.js b/docs/action-lab-core.js
index 81ab7a5a..6d447210 100644
--- a/docs/action-lab-core.js
+++ b/docs/action-lab-core.js
@@ -54,11 +54,14 @@ export async function planPreview(proposal, policy, subtle) {
   }
 }
 
-export function rehearse(plan, approvedDigest, uncertain = false) {
+export function rehearse(plan, approvedDigest, uncertain = false, grantConsumed = false) {
   if (plan.decision === "deny") return { outcome: "blocked", reason: plan.reason };
   if (plan.decision === "requires_approval" && approvedDigest !== plan.proposal_sha256) {
     return { outcome: "blocked", reason: "approval_missing_or_mismatched" };
   }
+  if (plan.decision === "requires_approval" && grantConsumed) {
+    return { outcome: "blocked", reason: "approval_reused_or_expired" };
+  }
   return uncertain ? { outcome: "unknown", reason: "simulated_dispatch_exception" } :
     { outcome: "would_dispatch", reason: "simulation_only" };
 }

From 69cca1b5425543a1a77830038b3cef40f6dfbd71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:43 -0700
Subject: [PATCH 04/15] Add one-use grant path: docs/action-lab-story.js

---
 docs/action-lab-story.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/action-lab-story.js b/docs/action-lab-story.js
index 70cdcc66..d88fb9e1 100644
--- a/docs/action-lab-story.js
+++ b/docs/action-lab-story.js
@@ -1,6 +1,6 @@
 // Presentation mapping for the local Action Boundary Lab. It uses the plan
 // and rehearsal result; it does not make a second policy or dispatch decision.
-export function actionPathStory(proposal, plan, approvedDigest, outcome) {
+export function actionPathStory(proposal, plan, approvedDigest, outcome, grantConsumed = false) {
   const digest = plan?.proposal_sha256;
   const match = Boolean(digest && approvedDigest && digest === approvedDigest);
   const stale = Boolean(approvedDigest && !match);
@@ -17,6 +17,8 @@ export function actionPathStory(proposal, plan, approvedDigest, outcome) {
       { value: "DENY", detail: `Host rule: ${readable(plan?.reason)}`, tone: "blocked" };
   const approvalCard = stale ?
     { value: "STALE", detail: "Prior simulated digest no longer matches", tone: "blocked" } :
+    match && grantConsumed ?
+      { value: "SPENT", detail: "The one-use grant was already claimed", tone: "blocked" } :
     match ?
       { value: "DIGEST MATCH", detail: `Simulated approval · ${digest.slice(0, 12)}…`, tone: "allowed" } :
       plan?.decision === "allow" ?

From 4eef4ff259fa8aef7e0ba82d681825c9ac3534e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:44 -0700
Subject: [PATCH 05/15] Add one-use grant path: docs/action-lab.js

---
 docs/action-lab.js | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/docs/action-lab.js b/docs/action-lab.js
index 9b579472..6e6c6c20 100644
--- a/docs/action-lab.js
+++ b/docs/action-lab.js
@@ -16,12 +16,15 @@ const cases = {
   read: { tool: "fetch_record", effect: "read", resource: "record:42",
     purpose: "Inspect record", arguments: { id: 42 } },
   timeout: { tool: "send_message", effect: "send", resource: "team@example.test",
+    purpose: "Send a status update", arguments: { subject: "Update", body: "The build passed." } },
+  replay: { tool: "send_message", effect: "send", resource: "team@example.test",
     purpose: "Send a status update", arguments: { subject: "Update", body: "The build passed." } }
 };
 const $ = id => document.getElementById(id);
 const form = $("proposal");
 let scenario = "send";
 let approvedDigest = null;
+let grantConsumed = false;
 let outcome = null;
 let latest = null;
 let generation = 0;
@@ -59,12 +62,14 @@ async function render() {
     "Reason: " + plan.reason.replaceAll("_", " ");
   $("digest").textContent = plan.proposal_sha256 || "No valid proposal digest";
   $("approve").disabled = plan.decision !== "requires_approval";
-  $("approval").textContent = approved ? "Simulated approval matches this exact digest." :
+  $("approval").textContent = approved && grantConsumed ?
+    "Simulated one-use grant spent. Re-approve to try again." :
+    approved ? "Simulated approval matches this exact digest." :
     approvedDigest ? "Previous simulated approval is stale for this proposal." :
       "No simulated approval recorded.";
   $("outcome").textContent = outcome ? outcome.outcome.toUpperCase().replaceAll("_", " ") : "NOT ATTEMPTED";
   $("outcome").className = "badge " + (outcome?.outcome || "");
-  const story = actionPathStory(proposal, plan, approvedDigest, outcome);
+  const story = actionPathStory(proposal, plan, approvedDigest, outcome, grantConsumed);
   for (const key of ["proposal", "policy", "approval", "receipt"]) {
     const card = $("path-" + key);
     card.dataset.tone = story[key].tone;
@@ -73,6 +78,7 @@ async function render() {
   }
   const report = { protocol: "aml-action-lab-report/1", provenance: "project-authored browser simulation",
     proposal: proposal || null, plan, simulated_approval_matches: approved,
+    simulated_one_use_grant_spent: scenario === "replay" ? grantConsumed : null,
     simulation: outcome, canonical_proposal_json: plan.canonical_json,
     limits: "No live tool, authenticated approver, external delivery, or execution proof." };
   $("report").textContent = JSON.stringify(report, null, 2);
@@ -81,6 +87,7 @@ async function render() {
 function selectCase(name) {
   scenario = name;
   approvedDigest = null;
+  grantConsumed = false;
   outcome = null;
   const selected = cases[name];
   for (const key of ["tool", "effect", "resource", "purpose"]) input(key).value = selected[key];
@@ -100,13 +107,17 @@ $("approve").addEventListener("click", async () => {
   await render();
   if (latest.plan.decision === "requires_approval") {
     approvedDigest = latest.plan.proposal_sha256;
+    grantConsumed = false;
     outcome = null;
     await render();
   }
 });
 $("dispatch").addEventListener("click", async () => {
   await render();
-  outcome = rehearse(latest.plan, approvedDigest, scenario === "timeout");
+  const oneUse = scenario === "replay";
+  const wasConsumed = oneUse && grantConsumed;
+  outcome = rehearse(latest.plan, approvedDigest, scenario === "timeout", wasConsumed);
+  if (oneUse && !wasConsumed && outcome.outcome === "would_dispatch") grantConsumed = true;
   await render();
 });
 $("copy").addEventListener("click", async () => {

From 5eda3d08a9b1882acc9091c1e3534145efba471a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:45 -0700
Subject: [PATCH 06/15] Add one-use grant path: docs/action-lab.html

---
 docs/action-lab.html | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/docs/action-lab.html b/docs/action-lab.html
index 207a3793..980b90c0 100644
--- a/docs/action-lab.html
+++ b/docs/action-lab.html
@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <meta name="theme-color" content="#080c17">
-  <meta name="description" content="Rehearse an AI agent tool call against an exact host policy. Change one argument, inspect its digest, and see a simulated approval become stale.">
+  <meta name="description" content="Rehearse an AI agent tool call against an exact host policy. Change an argument, inspect its digest, and test a simulated one-use grant against replay.">
   <title>Action Boundary Lab · ĀML™</title>
   <style>
     :root{color-scheme:dark;--bg:#080c17;--panel:#111b2d;--line:#304058;--ink:#f4f7ff;--muted:#b7c5d8;--cyan:#78e8f5;--gold:#f5d27a;--red:#ffa0ac;--green:#9af4bb}
@@ -26,7 +26,7 @@
     <header>
       <div class="eyebrow">PROPOSE · POLICY · APPROVAL · RECEIPT</div>
       <h1>What exactly did the <span>agent ask to do?</span></h1>
-      <p class="lede">Edit a proposed tool call. ĀML's reference contract hashes its exact meaning and asks a host-owned policy for an exact match. Change the destination or body after simulated approval to see why the approval no longer matches.</p>
+      <p class="lede">Edit a proposed tool call. ĀML's reference contract hashes its exact meaning and asks a host-owned policy for an exact match. Try <strong>Replay one-use grant</strong>: approve once, rehearse dispatch twice, and watch the second attempt block.</p>
       <p class="notice"><strong>Browser rehearsal only.</strong> No tool runs, no message is sent, and the button does not obtain a person's consent. The visible policy is a fixed local fixture.</p>
     </header>
     <div id="presets" class="presets" role="group" aria-label="Choose a scenario">
@@ -34,6 +34,7 @@ <h1>What exactly did the <span>agent ask to do?</span></h1>
       <button type="button" data-case="changed" aria-pressed="false">02 · Different destination</button>
       <button type="button" data-case="read" aria-pressed="false">03 · Allowed read</button>
       <button type="button" data-case="timeout" aria-pressed="false">04 · Uncertain result</button>
+      <button type="button" data-case="replay" aria-pressed="false">05 · Replay one-use grant</button>
     </div>
     <section class="path-visual" aria-label="Live action decision path">
       <div class="path-heading"><strong>THE ACTION PATH</strong><span>Changes with the local scenario and your edits</span></div>
@@ -74,7 +75,7 @@ <h2 id="result-title">02 / Inspect the boundary</h2>
     </main>
     <div class="steps" aria-label="What this proves">
       <div class="step"><b>01 · Exact match</b><p>An undeclared destination or effect is denied by the local fixture.</p></div>
-      <div class="step"><b>02 · Approval binding</b><p>The simulated approval stores one proposal digest. Editing arguments invalidates that match.</p></div>
+      <div class="step"><b>02 · Approval binding and replay</b><p>Editing arguments invalidates the digest. In the replay scenario, a spent local grant blocks the second attempt.</p></div>
       <div class="step"><b>03 · Honest outcome</b><p>A simulated callback error is unknown. It cannot prove an external action happened or did not happen.</p></div>
     </div>
     <footer class="foot">Project-authored reference experiment · <a href="https://github.com/aruintelligence/aml-core/blob/main/pilots/action-boundary/README.md">Read the contract and claim limits</a> · <a href="https://github.com/aruintelligence/aml-core/blob/main/docs/AGENT_TOOL_QUICKSTART.md">Wrap one agent tool</a> · <a href="https://github.com/aruintelligence/aml-core/blob/main/publications/ACTION_BOUNDARY_CHALLENGE.md">Run the outside implementation challenge</a> · <a href="https://github.com/aruintelligence/aml-core/issues/88">Independent verification call</a><br>Local browser inputs are not uploaded by this lab. SHA-256 is a change detector, not proof of trusted identity, policy authority, human approval, or delivery. ĀML™ · ĀRU Intelligence Inc.™</footer>

From d199e626f1fd8d843e76341b0b90143a9a1037ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:46 -0700
Subject: [PATCH 07/15] Add one-use grant path: test/action-lab.test.js

---
 test/action-lab.test.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/test/action-lab.test.js b/test/action-lab.test.js
index e546fb3f..1b35ef0e 100644
--- a/test/action-lab.test.js
+++ b/test/action-lab.test.js
@@ -32,6 +32,16 @@ test("changing an approved proposal invalidates the simulated approval", async (
     original.proposal_sha256).outcome, "blocked");
 });
 
+test("the one-use browser rehearsal blocks a second attempt on the same grant", async () => {
+  const plan = await planPreview(vectors.cases[0].proposal, vectors.policy, webcrypto.subtle);
+  assert.deepEqual(rehearse(plan, plan.proposal_sha256, false, true),
+    { outcome: "blocked", reason: "approval_reused_or_expired" });
+  const spent = actionPathStory(vectors.cases[0].proposal, plan, plan.proposal_sha256,
+    rehearse(plan, plan.proposal_sha256, false, true), true);
+  assert.equal(spent.approval.value, "SPENT");
+  assert.equal(spent.receipt.value, "BLOCKED");
+});
+
 test("malformed and ambiguous host policies deny in the browser mirror", async () => {
   const proposal = vectors.cases[0].proposal;
   const ambiguous = { ...vectors.policy, rules: [...vectors.policy.rules, vectors.policy.rules[0]] };
@@ -77,6 +87,6 @@ test("the public page exposes its limitations and uses only local browser inputs
   assert.match(html, /id="path-receipt-value"/);
   assert.match(html, /green simulated path is not tool execution/);
   assert.match(ui, /planPreview\(proposal, policy, crypto\.subtle\)/);
-  assert.match(ui, /actionPathStory\(proposal, plan, approvedDigest, outcome\)/);
+  assert.match(ui, /actionPathStory\(proposal, plan, approvedDigest, outcome, grantConsumed\)/);
   assert.doesNotMatch(ui, /\bfetch\(|XMLHttpRequest|sendBeacon/);
 });

From 74ef6b166a76936ac08709661b220da019694793 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:47 -0700
Subject: [PATCH 08/15] Add one-use grant path:
 pilots/action-boundary/README.md

---
 pilots/action-boundary/README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pilots/action-boundary/README.md b/pilots/action-boundary/README.md
index 115753fa..b3b3112f 100644
--- a/pilots/action-boundary/README.md
+++ b/pilots/action-boundary/README.md
@@ -8,6 +8,8 @@ Agents can propose a tool call; the host must decide whether to dispatch it. Thi
 
 [**Wrap a function tool in your host**](../../docs/AGENT_TOOL_QUICKSTART.md) with `createGuardedToolExecute`, then run `node pilots/action-boundary/guarded-tool-demo.mjs` to see a simulated dispatch and a blocked destination change. The wrapper imports this project's reference boundary and is not an independent implementation.
 
+[**Try a one-use grant replay**](https://aruintelligence.github.io/aml-core/action-lab.html?scenario=replay) or run `node pilots/action-boundary/one-shot-grant-demo.mjs`. The fixture issues one process-local grant for a digest. The first guarded call invokes the simulated callback; a second call with that same grant returns `approval_reused_or_expired` without invoking it again. This is a project-authored demonstration, not authenticated human approval or a durable distributed replay defense.
+
 ```bash
 node pilots/action-boundary/demo.mjs
 node pilots/action-boundary/boundary.test.mjs
@@ -34,7 +36,9 @@ The published [`vectors.json`](vectors.json) contains six exact proposal digests
 
 The separate policy has protocol `aml-action-policy/1` and exact rules with `tool`, `effect`, `resource`, and `requires_approval`. Unknown, malformed, and ambiguous policies deny. No wildcards or URL-prefix rules are supported. Supported effect labels are `read`, `write`, `send`, `pay`, and `delete`; they are declarations, not automatic classifications. The host must map the real tool and resource correctly. The host approval callback must return `{ approved: true, proposal_sha256 }` for the frozen proposal; an untrusted string with that shape is not proof of a person's consent.
 
-The dispatch receipt records `blocked`, `dispatched`, or `unknown`. `dispatched` means the host callback returned; it does not prove delivery or completion. A callback error is `unknown` because a side effect might already have occurred; the boundary never retries it. SHA-256 detects changes in this proposal's canonical JSON, but does not authenticate the policy, approver, tool implementation, or external result. A production host needs authentication, durable audit storage, replay controls, approval expiry, idempotency, and tool-specific authorization. This pilot does not replace those controls or the existing ĀML UI governance stack.
+The dispatch receipt records `blocked`, `dispatched`, or `unknown`. `dispatched` means the host callback returned; it does not prove delivery or completion. A callback error is `unknown` because a side effect might already have occurred; the boundary never retries it. SHA-256 detects changes in this proposal's canonical JSON, but does not authenticate the policy, approver, tool implementation, or external result.
+
+An optional host-owned `consumeApproval` callback can atomically claim a grant after the digest matches and policy is rechecked, before the tool callback. It must return exactly `true` for a successful claim. A `false` result blocks with `approval_reused_or_expired`; a claim error blocks with `approval_consume_error`. Policy is checked again after an asynchronous claim. `createLocalOneShotGrants()` illustrates the contract in one Node process with expiry and a synchronous Map deletion. Production use needs a durable atomic store shared across workers, authenticated approval issuance, bounded expiry, audit storage, idempotency, and tool-specific authorization. The opt-in store does not protect unwrapped tools or other processes. This pilot does not replace those controls or the existing ĀML UI governance stack.
 
 ## Why this wedge
 

From 6f88571416c68b8841cc011560df8feca74997f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:48 -0700
Subject: [PATCH 09/15] Add one-use grant path: docs/AGENT_TOOL_QUICKSTART.md

---
 docs/AGENT_TOOL_QUICKSTART.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/docs/AGENT_TOOL_QUICKSTART.md b/docs/AGENT_TOOL_QUICKSTART.md
index aebe1faa..e5c1579d 100644
--- a/docs/AGENT_TOOL_QUICKSTART.md
+++ b/docs/AGENT_TOOL_QUICKSTART.md
@@ -45,6 +45,32 @@ const execute = createGuardedToolExecute({
 
 `requestApproval` must return `{ approved: true, proposal_sha256 }` for the exact frozen proposal, or refuse. The callback may be omitted for a policy rule that allows an action without approval. If an approval-required rule has no callback, dispatch blocks. The adapter passes the framework's second `execute` argument as `context` to the host callbacks, and calls the tool with the frozen canonical arguments. A host mapping error throws before any tool invocation.
 
+## Rehearse a one-use grant
+
+Run `node pilots/action-boundary/one-shot-grant-demo.mjs` or open the [replay scenario](https://aruintelligence.github.io/aml-core/action-lab.html?scenario=replay). The first invocation uses a local grant; the second attempt with the same grant blocks before the callback. The example sends no message and authenticates no person.
+
+To opt in for a host function tool, keep the grant store and approval issuer **inside the host**:
+
+```js
+import { createLocalOneShotGrants } from "./pilots/action-boundary/one-shot-grants.mjs";
+
+const grants = createLocalOneShotGrants(); // One Node process, demonstration only.
+const guarded = createGuardedToolExecute({
+  tool: "send_message", effect: "send", purpose: "Send a team update",
+  resourceFor: args => args.to, policy,
+  requestApproval: async (input, context) => {
+    if (!await hostAuthenticateAndApprove(input.proposal, input.proposal_sha256, context)) {
+      return { approved: false };
+    }
+    return grants.issue(input.proposal_sha256); // New ID, short expiry.
+  },
+  consumeApproval: grants.consume,
+  execute: async (args, context) => sendThroughMyService(args.to, args.body, context)
+});
+```
+
+`hostAuthenticateAndApprove` and `sendThroughMyService` are host functions you must implement; the browser and CLI examples only simulate their outcome. The `consumeApproval` hook runs after the proposal digest and rule match, before the callback. It must make an atomic one-use claim bound to the digest and return `true` only once. A false claim blocks with `approval_reused_or_expired`; an error blocks with `approval_consume_error`. A policy change during an asynchronous claim still blocks. The local Map store does not survive restarts or coordinate multiple workers. Use a durable atomic store and your own authenticated approval, time policy, audit, and idempotency controls in a real deployment. An uncertain callback result still consumes the grant and must not be retried automatically.
+
 For the [OpenAI Agents SDK JavaScript function-tool API](https://openai.github.io/openai-agents-js/guides/tools/), install `@openai/agents` and `zod` in your agent app, then attach the `execute` function above:
 
 ```js

From 0b128bf1d355de3c558cda693116fffb8ee39a6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:50 -0700
Subject: [PATCH 10/15] Add one-use grant path: README.md

---
 README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 390fbe02..45d005a5 100644
--- a/README.md
+++ b/README.md
@@ -24,12 +24,14 @@
 
 **Explore the interface:** [Live lab](https://aruintelligence.github.io/aml-core/) · [View Meaning™ inspector](https://aruintelligence.github.io/aml-core/view-meaning.html) · [API contract](protocol/aml-http.openapi.yaml)
 
-**Explore the next boundary:** [Try the Action Boundary Lab](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1) — change an agent's intended tool call and see an exact policy decision, digest, stale simulated approval, and uncertain outcome. [Explore the visual 13-case challenge](https://aruintelligence.github.io/aml-core/action-challenge.html), [read its adapter contract](publications/ACTION_BOUNDARY_CHALLENGE.md), or [read the pilot](pilots/action-boundary/README.md) and its [six published vectors](pilots/action-boundary/vectors.json). The browser rehearsal and repository self-test are project-authored, with no live tool access.
+**Explore the next boundary:** [Try the Action Boundary Lab](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1) — change an agent's intended tool call and see an exact policy decision, digest, stale simulated approval, and uncertain outcome. [Try a one-use grant replay](https://aruintelligence.github.io/aml-core/action-lab.html?scenario=replay): a second attempt with the same local grant blocks before a callback. [Explore the visual 13-case challenge](https://aruintelligence.github.io/aml-core/action-challenge.html), [read its adapter contract](publications/ACTION_BOUNDARY_CHALLENGE.md), or [read the pilot](pilots/action-boundary/README.md) and its [six published vectors](pilots/action-boundary/vectors.json). The browser rehearsal and repository self-test are project-authored, with no live tool access.
 
 [![Illustrated local action boundary: an agent proposes sending to an outside destination; the host policy blocks the call before dispatch.](docs/action-boundary-story.svg)](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1)
 
 **Wire one agent tool:** [Follow the function-tool quickstart](docs/AGENT_TOOL_QUICKSTART.md) to wrap a host-owned callback with exact policy matching, approval binding, and a dispatch receipt. Its runnable local demo simulates execution; the host must supply real authorization and tool mapping.
 
+[![One local approval grant permits one simulated callback. Reusing it blocks before a second callback.](docs/one-shot-approval.svg)](https://aruintelligence.github.io/aml-core/action-lab.html?scenario=replay)
+
 ## Prove the core claim in 60 seconds
 
 Open this exact state: [**attention 5 / restoration 1 → SUPPRESS**](https://aruintelligence.github.io/aml-core/proof.html?attention=5&restoration=1&lang=en).

From d9a7297ba06ac37b3eedb73f67e11ec868c2f8b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:51 -0700
Subject: [PATCH 11/15] Add one-use grant path: BREAKTHROUGHS.md

---
 BREAKTHROUGHS.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/BREAKTHROUGHS.md b/BREAKTHROUGHS.md
index 9f271a15..4b3b5900 100644
--- a/BREAKTHROUGHS.md
+++ b/BREAKTHROUGHS.md
@@ -163,6 +163,12 @@ This separates long-lived root trust from short-lived operational signing author
 
 It does not establish legal identity, employment, organizational approval, regulatory authority, certification, independent validation, or official ĀRU authorization. Those remain separate external claims.
 
+## 18. A host-owned approval can be claimed once before an agent tool runs
+
+The proposed-action pilot has an optional `consumeApproval` callback. After exact digest approval and policy recheck, a host can atomically claim a short-lived grant before invoking the tool. A reused or expired grant blocks, and a policy revocation during an asynchronous claim is checked again before dispatch.
+
+Run `node pilots/action-boundary/one-shot-grant-demo.mjs`: the first call invokes one simulated callback; a second call reusing the same grant is blocked with no additional callback. The [visual replay lab](https://aruintelligence.github.io/aml-core/action-lab.html?scenario=replay) shows the same project-authored scenario. The local store works in one Node process only; it is not a durable cross-worker replay defense, authenticated human approval, proof of delivery, or independent validation.
+
 ## The frontier
 
 The next technical frontiers are:

From 66548c99853eb6249163aafb6e842834897517b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:55 -0700
Subject: [PATCH 12/15] Add one-use grant artifact:
 pilots/action-boundary/one-shot-grants.mjs

---
 pilots/action-boundary/one-shot-grants.mjs | 37 ++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 pilots/action-boundary/one-shot-grants.mjs

diff --git a/pilots/action-boundary/one-shot-grants.mjs b/pilots/action-boundary/one-shot-grants.mjs
new file mode 100644
index 00000000..5e543599
--- /dev/null
+++ b/pilots/action-boundary/one-shot-grants.mjs
@@ -0,0 +1,37 @@
+// Process-local illustration of a host-owned approval store. A production host
+// needs a durable atomic claim shared by all workers and its own identity checks.
+import { randomUUID } from "node:crypto";
+
+const DIGEST = /^[a-f0-9]{64}$/;
+
+export function createLocalOneShotGrants({ now = () => Date.now() } = {}) {
+  if (typeof now !== "function") throw new TypeError("Invalid host clock");
+  const grants = new Map();
+
+  function issue(proposal_sha256, { ttlMs = 60_000 } = {}) {
+    if (typeof proposal_sha256 !== "string" || !DIGEST.test(proposal_sha256) ||
+        !Number.isSafeInteger(ttlMs) || ttlMs <= 0 || ttlMs > 300_000) {
+      throw new TypeError("A valid digest and a positive TTL of at most five minutes are required");
+    }
+    const issuedAt = now();
+    const approval_id = randomUUID();
+    if (!Number.isSafeInteger(issuedAt) || !Number.isSafeInteger(issuedAt + ttlMs) ||
+        grants.has(approval_id)) throw new Error("Invalid host clock or duplicate grant ID");
+    grants.set(approval_id, { proposal_sha256, expiresAt: issuedAt + ttlMs });
+    return { approved: true, proposal_sha256, approval_id };
+  }
+
+  function consume({ approval, proposal_sha256 } = {}) {
+    if (!approval || typeof approval.approval_id !== "string") return false;
+    const grant = grants.get(approval.approval_id);
+    if (!grant) return false;
+    if (now() >= grant.expiresAt) { grants.delete(approval.approval_id); return false; }
+    if (grant.proposal_sha256 !== proposal_sha256 || approval.proposal_sha256 !== proposal_sha256) return false;
+    // This is a synchronous claim in one Node process. No await occurs between
+    // checking the grant and removing it, so concurrent calls cannot both pass.
+    grants.delete(approval.approval_id);
+    return true;
+  }
+
+  return { issue, consume };
+}

From 4d8c9eaeaa89113e4b900c4a3238221d60a1214b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:57 -0700
Subject: [PATCH 13/15] Add one-use grant artifact:
 pilots/action-boundary/one-shot-grant-demo.mjs

---
 .../action-boundary/one-shot-grant-demo.mjs   | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 pilots/action-boundary/one-shot-grant-demo.mjs

diff --git a/pilots/action-boundary/one-shot-grant-demo.mjs b/pilots/action-boundary/one-shot-grant-demo.mjs
new file mode 100644
index 00000000..2fa781e7
--- /dev/null
+++ b/pilots/action-boundary/one-shot-grant-demo.mjs
@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+// A local fixture: the callback records a count; no message is sent.
+import { planAction } from "./boundary.mjs";
+import { createGuardedToolExecute } from "./guarded-tool.mjs";
+import { createLocalOneShotGrants } from "./one-shot-grants.mjs";
+
+const args = { to: "team@example.test", body: "Build passed." };
+const policy = { protocol: "aml-action-policy/1", rules: [
+  { tool: "send_message", effect: "send", resource: args.to, requires_approval: true }
+] };
+const proposal = { protocol: "aml-proposed-action/1", tool: "send_message", effect: "send",
+  resource: args.to, purpose: "Send a status update", arguments: args };
+const store = createLocalOneShotGrants();
+// A real host must authenticate the approver before calling issue(). This
+// fixture deliberately creates a grant without a human, solely for replay.
+const grant = store.issue(planAction(proposal, policy).proposal_sha256);
+let toolCallbacks = 0;
+const guarded = createGuardedToolExecute({ tool: proposal.tool, effect: proposal.effect,
+  purpose: proposal.purpose, resourceFor: input => input.to, policy,
+  requestApproval: async () => grant, consumeApproval: store.consume,
+  execute: async () => { toolCallbacks++; return { simulated: true }; } });
+
+const first = await guarded(args);
+const replay = await guarded(args);
+console.log(JSON.stringify({ first: first.receipt, replay: replay.receipt,
+  tool_callbacks: toolCallbacks, limits: "Process-local fixture; no message or human approval." }, null, 2));

From cd0cc862bd8937b52330ffd0a377cff0535d04da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:58 -0700
Subject: [PATCH 14/15] Add one-use grant artifact:
 test/action-boundary-one-shot.test.js

---
 test/action-boundary-one-shot.test.js | 76 +++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100644 test/action-boundary-one-shot.test.js

diff --git a/test/action-boundary-one-shot.test.js b/test/action-boundary-one-shot.test.js
new file mode 100644
index 00000000..a4abbe2b
--- /dev/null
+++ b/test/action-boundary-one-shot.test.js
@@ -0,0 +1,76 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createGuardedToolExecute } from "../pilots/action-boundary/guarded-tool.mjs";
+import { createLocalOneShotGrants } from "../pilots/action-boundary/one-shot-grants.mjs";
+import { dispatchAction, planAction } from "../pilots/action-boundary/boundary.mjs";
+
+const proposal = { protocol: "aml-proposed-action/1", tool: "send_message", effect: "send",
+  resource: "team@example.test", purpose: "Send a status update",
+  arguments: { to: "team@example.test", body: "Build passed." } };
+const policy = () => ({ protocol: "aml-action-policy/1", rules: [
+  { tool: "send_message", effect: "send", resource: "team@example.test", requires_approval: true }
+] });
+
+test("a reused one-use grant cannot dispatch twice, including concurrent requests", async () => {
+  const store = createLocalOneShotGrants();
+  const grant = store.issue(planAction(proposal, policy()).proposal_sha256);
+  let calls = 0;
+  const guarded = createGuardedToolExecute({ tool: "send_message", effect: "send",
+    purpose: "Send a status update", resourceFor: args => args.to, policy: policy(),
+    requestApproval: async () => grant, consumeApproval: store.consume,
+    execute: async () => { calls++; return "fixture only"; } });
+  const outcomes = await Promise.all([guarded(proposal.arguments), guarded(proposal.arguments)]);
+  assert.deepEqual(outcomes.map(x => x.receipt.execution_status).sort(), ["blocked", "dispatched"]);
+  assert.equal(outcomes.find(x => x.receipt.execution_status === "blocked").receipt.reason,
+    "approval_reused_or_expired");
+  assert.equal(calls, 1);
+  assert.equal((await guarded(proposal.arguments)).receipt.reason, "approval_reused_or_expired");
+  assert.equal(calls, 1);
+});
+
+test("an expired, changed, or unknown grant is blocked before the callback", async () => {
+  let clock = 1000;
+  const store = createLocalOneShotGrants({ now: () => clock });
+  const digest = planAction(proposal, policy()).proposal_sha256;
+  const grant = store.issue(digest, { ttlMs: 100 });
+  let calls = 0;
+  const options = { policy: policy(), requestApproval: async () => grant,
+    consumeApproval: store.consume, executeTool: async () => { calls++; } };
+  clock = 1100;
+  assert.equal((await dispatchAction(proposal, options)).receipt.reason, "approval_reused_or_expired");
+  assert.equal(calls, 0);
+
+  const fresh = store.issue(digest);
+  const changed = { ...proposal, arguments: { ...proposal.arguments, body: "Changed" } };
+  assert.equal((await dispatchAction(changed, { ...options, requestApproval: async () => fresh })).receipt.reason,
+    "approval_missing_or_mismatched");
+  assert.equal((await dispatchAction(proposal, { ...options,
+    requestApproval: async () => ({ ...fresh, approval_id: "unknown" }) })).receipt.reason,
+    "approval_reused_or_expired");
+  assert.equal(calls, 0);
+});
+
+test("a grant stays spent after an uncertain tool result", async () => {
+  const store = createLocalOneShotGrants();
+  const grant = store.issue(planAction(proposal, policy()).proposal_sha256);
+  let calls = 0;
+  const options = { policy: policy(), requestApproval: async () => grant,
+    consumeApproval: store.consume, executeTool: async () => { calls++; throw Error("unknown result"); } };
+  assert.equal((await dispatchAction(proposal, options)).receipt.execution_status, "unknown");
+  assert.equal((await dispatchAction(proposal, options)).receipt.reason, "approval_reused_or_expired");
+  assert.equal(calls, 1);
+});
+
+test("revocation while an asynchronous claim runs still blocks dispatch", async () => {
+  const mutable = policy();
+  const store = createLocalOneShotGrants();
+  const grant = store.issue(planAction(proposal, mutable).proposal_sha256);
+  let calls = 0;
+  const result = await dispatchAction(proposal, { policy: mutable,
+    requestApproval: async () => grant,
+    consumeApproval: async input => { const claimed = store.consume(input); mutable.rules.length = 0; return claimed; },
+    executeTool: async () => { calls++; } });
+  assert.equal(result.receipt.reason, "policy_changed");
+  assert.equal(calls, 0);
+  assert.equal(store.consume({ approval: grant, proposal_sha256: grant.proposal_sha256 }), false);
+});

From 64af07bf1764cf97842ab8625d9661e4d06dd000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Jacob=20Read=20IV=20=E2=80=94=20Creator=20of=20?=
 =?UTF-8?q?=C4=80ML=E2=84=A2?= <aruintelligence@gmail.com>
Date: Sat, 10 Oct 2026 22:14:59 -0700
Subject: [PATCH 15/15] Add one-use grant artifact: docs/one-shot-approval.svg

---
 docs/one-shot-approval.svg | 41 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 docs/one-shot-approval.svg

diff --git a/docs/one-shot-approval.svg b/docs/one-shot-approval.svg
new file mode 100644
index 00000000..07f74627
--- /dev/null
+++ b/docs/one-shot-approval.svg
@@ -0,0 +1,41 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 430" role="img" aria-labelledby="title desc">
+  <title id="title">ĀML one-use approval: first call allowed, replay blocked</title>
+  <desc id="desc">A project-authored local fixture issues one short-lived grant for an exact proposed-action digest. The first guarded call claims it and invokes one simulated callback. A second call reusing the same grant is blocked with zero additional callbacks.</desc>
+  <defs>
+    <linearGradient id="background" x2="1" y2="1"><stop stop-color="#102a3a"/><stop offset=".55" stop-color="#0b1425"/><stop offset="1" stop-color="#211b2d"/></linearGradient>
+    <linearGradient id="accent" x2="1"><stop stop-color="#78e8f5"/><stop offset="1" stop-color="#f5d27a"/></linearGradient>
+  </defs>
+  <rect width="1200" height="430" rx="25" fill="url(#background)"/>
+  <rect x="1" y="1" width="1198" height="428" rx="24" fill="none" stroke="#466776"/>
+  <g font-family="Arial, Helvetica, sans-serif">
+    <text x="50" y="53" fill="#78e8f5" font-size="15" font-weight="700" letter-spacing="3">ĀML™ / ACTION BOUNDARY</text>
+    <text x="49" y="109" fill="#f4f7ff" font-size="44" font-weight="700">One approval.</text>
+    <text x="49" y="157" fill="url(#accent)" font-size="44" font-weight="700">One callback.</text>
+    <text x="51" y="205" fill="#cad8e5" font-size="18">Exact proposal digest + short-lived grant ID.</text>
+    <text x="51" y="233" fill="#cad8e5" font-size="18">The host claims it before dispatch.</text>
+    <rect x="49" y="267" width="318" height="50" rx="13" fill="#102f3a" stroke="#458994"/>
+    <text x="67" y="299" fill="#b6eef1" font-size="17" font-weight="700">TRY THE REPLAY LAB  ↗</text>
+    <text x="50" y="409" fill="#9db2c2" font-size="13" letter-spacing=".5">PROJECT-AUTHORED LOCAL FIXTURE · NO HUMAN APPROVAL OR MESSAGE</text>
+  </g>
+  <g font-family="Arial, Helvetica, sans-serif">
+    <rect x="423" y="66" width="345" height="272" rx="20" fill="#102535" stroke="#54aa91" stroke-width="2"/>
+    <rect x="441" y="84" width="309" height="5" rx="2" fill="#9af4bb"/>
+    <text x="448" y="130" fill="#a4e6cb" font-size="15" font-weight="700" letter-spacing="2">01 / FIRST CLAIM</text>
+    <text x="448" y="185" fill="#9af4bb" font-size="36" font-weight="700">DISPATCHED</text>
+    <text x="448" y="224" fill="#d2e9df" font-size="18">Grant claimed once.</text>
+    <text x="448" y="254" fill="#d2e9df" font-size="18">Simulated callback: 1</text>
+    <rect x="448" y="283" width="158" height="35" rx="17" fill="#204c3b"/>
+    <text x="463" y="307" fill="#d3ffe2" font-size="15" font-weight="700">GRANT SPENT</text>
+    <path d="M776 202h22" stroke="#78e8f5" stroke-width="3"/>
+    <path d="m790 194 9 8-9 8" fill="none" stroke="#78e8f5" stroke-width="3"/>
+    <rect x="806" y="66" width="345" height="272" rx="20" fill="#291b2b" stroke="#a45669" stroke-width="2"/>
+    <rect x="824" y="84" width="309" height="5" rx="2" fill="#ffa0ac"/>
+    <text x="831" y="130" fill="#f1b1bc" font-size="15" font-weight="700" letter-spacing="2">02 / SAME GRANT AGAIN</text>
+    <text x="831" y="185" fill="#ffa0ac" font-size="36" font-weight="700">BLOCKED</text>
+    <text x="831" y="224" fill="#f0d7dc" font-size="18">Replay rejected before tool.</text>
+    <text x="831" y="254" fill="#f0d7dc" font-size="18">Additional callbacks: 0</text>
+    <rect x="831" y="283" width="276" height="35" rx="17" fill="#56323d"/>
+    <text x="845" y="307" fill="#ffe2e7" font-size="14" font-weight="700">REUSED OR EXPIRED</text>
+  </g>
+  <text x="424" y="374" fill="#a6b9c7" font-size="14" font-family="Arial, Helvetica, sans-serif">Process-local proof · distributed hosts need a durable atomic claim.</text>
+</svg>