Retain typed proof materials and trusted context for TypeScript authorization

[bordumb]

Finding

The TypeScript Full Workflow contract currently cannot assemble a verifiable proof from its retained state:

• TrustedAuthority.verifierConfiguration carries only the 32-byte engine commitment, not the immutable verifier-context template containing trust anchors, accepted registries, status snapshots, assurance policy, and limits.
• SignedGrantProvider returns only a signed grant, so root control evidence is discarded at attachment.
• delegation signing returns public evidence through SigningResponse, but the attached child retains only the signed grant and statement.
• SigningResponse.evidence is an array of opaque bytes with no evidence type or media type, although the Rust model requires both to construct an addressed EvidenceObject.

Consequently, AttachedAgent.authorize(...) cannot honestly satisfy AP27-PR6 without either using private fixtures, inventing protocol CBOR in JavaScript, or silently assuming verification facts that were never supplied.

Required correction

AP27-PR6 should make a clean pre-release contract correction:

1. represent public control evidence as structured { evidenceType, mediaType, bytes } values;
2. retain evidence beside every attached/delegated signed grant;
3. load an explicit immutable trusted-context template through a sealed/provider-backed source on TrustedAuthority;
4. bind the request audience, challenge, evaluation time, and exact authorization plan natively;
5. assemble addressed evidence, control bindings, the signed action, grant chain, proof bundle, and request context in Rust/WASM;
6. keep raw CBOR out of normal application options and preserve authorized/denied/indeterminate as distinct results.

Security boundary

The context provider supplies trusted facts; it does not decide the verdict. The packaged verifier must check its configuration commitment and evaluate the assembled proof locally. Profile canonicalization remains owned by auths-profile-mcp, and this correction must not add a global operation-tag action/executor or mint the PR7 effect-capable command.

Follow-up evidence

• authorized, denied, and indeterminate cross-language fixtures;
• mutation of one canonical action byte denies authorization;
• missing/malformed evidence remains a value-level protocol result where applicable;
• provider failures remain typed workflow errors;
• defensive-copy and hard-limit tests.