feat: harden authz layer with cycle detection, SRL, and issuance bounds

Security hardening based on deep review of the capability-token design
space:

- chain: reject duplicate warrant ids in a delegation chain (cycle
  detection); distinct-id re-entry (A->B->A) remains allowed.
- warrant: enforce unknown-extension-key rejection on decode (was dead
  code); add 128-bit UUIDv7 warrant-id generation with full entropy.
- pop: bind tool-call arguments into the PoP tuple (tool_args_digest) for
  confused-deputy defense; order-independent canonical digest.
- constraint: add validate_attenuation (decidable subset check) and
  issuance-time static attenuation in DelegatedWarrantBuilder via
  with_merchant/with_resource/with_payment/with_tool narrowers.
- issue_bounds: control-plane defense-in-depth constraining what a holder
  may delegate (merchant/asset/rail/scheme/payee/cap ceilings), carried in
  the reserved ledgerflow.issue_bounds extension.
- srl: add Signed Revocation List (versioned, anti-rollback, additive) in
  core, and SrlSync bridging it onto the persistent FileRevocationStore for
  multi-node SaaS revocation propagation.
- Add security_hardening (19 tests) and srl_sync_behaviors (3 tests); all
  new code paths covered by mutation testing (0 surviving mutants).

Author: Akagi201

bin/ledgerflow-cli/src/main.rs

@@ -90,6 +90,7 @@ fn render_sample_payment_fixture() -> Result<String> {
             created_at_ms: 2_000,
             nonce: "nonce-1".to_string(),
             payment_identifier: Some("payment-1".to_string()),
+            tool_args: std::collections::BTreeMap::new(),
             approvals: Vec::new(),
         },
     )?;

crates/ledgerflow-core/src/approval.rs

@@ -452,6 +452,7 @@ mod tests {
             request_hash: request_hash.to_string(),
             accepted_hash: "accepted-hash".to_string(),
             payment_payload_digest: "payment-digest".to_string(),
+            tool_args_digest: None,
             approvals_digest: Some(PopTuple::approvals_digest(approvals)),
             nonce: "nonce-1".to_string(),
             created_at_ms: 10_000,

crates/ledgerflow-core/src/chain.rs

@@ -9,6 +9,12 @@
 //! Capability attenuation is enforced with **runtime conjunction** (I4): a
 //! request must satisfy the constraints of *every* node in the chain. This
 //! avoids undecidable static subset checking of URL patterns.
+//!
+//! A presented chain must not contain the same warrant id twice: duplicate
+//! ids would allow re-arranging nodes (or a same-node-cycle) to confuse the
+//! chain's depth accounting. This is checked before any linkage work.
+
+use std::collections::HashSet;
 
 use crate::{
     constraint::{AuthorizationContext, Verify},
@@ -105,6 +111,18 @@ pub fn verify_chain(
     // Trust anchor: the root issuer must be trusted.
     trusted.verify_root(root)?;
 
+    // Cycle detection: the same warrant id must not appear twice. Duplicate
+    // ids would permit re-ordering nodes (or a self-referencing cycle) that
+    // bypasses the depth accounting below.
+    let mut seen = HashSet::with_capacity(chain.len());
+    for node in &chain.warrants {
+        if !seen.insert(node.id.as_slice()) {
+            return Err(AuthorizationError::DuplicateWarrantInChain {
+                warrant_id: node.id_hex(),
+            });
+        }
+    }
+
     // Per-node checks: envelope signature, time bounds, runtime-conjunction
     // constraints, and delegation capability on non-leaf nodes.
     for (index, node) in chain.warrants.iter().enumerate() {

crates/ledgerflow-core/src/constraint.rs

@@ -234,6 +234,151 @@ impl PaymentConstraint {
     }
 }
 
+/// Validates that `child` is a valid static attenuation of `parent`.
+///
+/// This performs a **conservative, decidable** subset check: every value that
+/// `parent` allows must also be allowed by `child`. It is used at issuance
+/// time (in [`crate::typestate::DelegatedWarrantBuilder`]) to reject a child
+/// that would expand capabilities *before* the warrant is signed.
+///
+/// The check is conservative in two ways:
+///
+/// - Empty allowlists mean "any", so a child that adds restrictions to a
+///   parent with an empty list is valid (narrowing), but a child that empties
+///   a parent's non-empty list is rejected (widening).
+/// - Unknown/unbounded dimensions (e.g. arbitrary host names under a suffix)
+///   are judged by the same allow-list semantics, never by pattern-language
+///   containment (which can be undecidable).
+pub fn validate_attenuation(parent: &Constraint, child: &Constraint) -> Result<()> {
+    match (parent, child) {
+        (Constraint::Merchant(p), Constraint::Merchant(c)) => {
+            // Child's allowed merchant ids must be a subset of parent's
+            // (when the parent restricts them).
+            if !p.merchant_ids.is_empty() {
+                for id in &c.merchant_ids {
+                    if !p.merchant_ids.contains(id) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "merchant_ids".to_string(),
+                            detail: format!("merchant `{id}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            // Child's host suffixes must be a subset of parent's.
+            if !p.host_suffixes.is_empty() {
+                for suffix in &c.host_suffixes {
+                    if !p.host_suffixes.contains(suffix) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "host_suffixes".to_string(),
+                            detail: format!("host suffix `{suffix}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            Ok(())
+        }
+        (Constraint::Resource(p), Constraint::Resource(c)) => {
+            if !p.http_methods.is_empty() {
+                for method in &c.http_methods {
+                    if !p.http_methods.iter().any(|m| m.eq_ignore_ascii_case(method)) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "http_methods".to_string(),
+                            detail: format!("method `{method}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            if !p.path_prefixes.is_empty() {
+                for prefix in &c.path_prefixes {
+                    if !p.path_prefixes.iter().any(|pp| prefix.starts_with(pp)) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "path_prefixes".to_string(),
+                            detail: format!("path prefix `{prefix}` not under a parent prefix"),
+                        });
+                    }
+                }
+            }
+            Ok(())
+        }
+        (Constraint::Tool(p), Constraint::Tool(c)) => {
+            for (dimension, parent_list, child_list) in [
+                ("tool_names", &p.tool_names, &c.tool_names),
+                ("model_providers", &p.model_providers, &c.model_providers),
+                ("action_labels", &p.action_labels, &c.action_labels),
+            ] {
+                if parent_list.is_empty() {
+                    continue;
+                }
+                for value in child_list {
+                    if !parent_list.contains(value) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: dimension.to_string(),
+                            detail: format!("`{value}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            Ok(())
+        }
+        (Constraint::Payment(p), Constraint::Payment(c)) => {
+            // Amount cap can only shrink.
+            if c.max_per_charge > p.max_per_charge {
+                return Err(AuthorizationError::AttenuationViolation {
+                    dimension: "max_per_charge".to_string(),
+                    detail: format!(
+                        "child cap {} exceeds parent cap {}",
+                        c.max_per_charge, p.max_per_charge
+                    ),
+                });
+            }
+            // Child assets must be a subset of parent assets.
+            if !p.allowed_assets.is_empty() {
+                for asset in &c.allowed_assets {
+                    if !p.allowed_assets.iter().any(|pa| pa == asset) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "allowed_assets".to_string(),
+                            detail: format!("asset `{}` not allowed by parent", asset.asset),
+                        });
+                    }
+                }
+            }
+            // Rails are a distinct enum type; check them separately.
+            if !p.allowed_rails.is_empty() {
+                for rail in &c.allowed_rails {
+                    if !p.allowed_rails.contains(rail) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: "allowed_rails".to_string(),
+                            detail: format!("rail `{rail:?}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            for (dimension, parent_list, child_list) in [
+                ("allowed_schemes", &p.allowed_schemes, &c.allowed_schemes),
+                ("payee_ids", &p.payee_ids, &c.payee_ids),
+            ] {
+                if parent_list.is_empty() {
+                    continue;
+                }
+                for value in child_list {
+                    if !parent_list.contains(value) {
+                        return Err(AuthorizationError::AttenuationViolation {
+                            dimension: dimension.to_string(),
+                            detail: format!("`{value}` not allowed by parent"),
+                        });
+                    }
+                }
+            }
+            Ok(())
+        }
+        // Different constraint kinds are never comparable; treat as invalid.
+        _ => Err(AuthorizationError::AttenuationViolation {
+            dimension: "constraint_kind".to_string(),
+            detail: "parent and child constraint kinds differ".to_string(),
+        }),
+    }
+}
+
 /// Unified `Verify` trait for constraint evaluation.
 pub trait Verify {
     /// Checks this constraint against the given context.

crates/ledgerflow-core/src/error.rs

@@ -52,6 +52,8 @@ pub enum AuthorizationError {
     DelegationDepthExceeded { presented: u8, allowed: u8 },
     #[error("the warrant chain is empty")]
     EmptyChain,
+    #[error("warrant `{warrant_id}` appears more than once in the chain (cycle detected)")]
+    DuplicateWarrantInChain { warrant_id: String },
     #[error("child issuer does not match parent holder (I1)")]
     DelegationAuthorityMismatch,
     #[error("child depth {actual} does not equal parent depth + 1 (expected {expected}) (I2)")]
@@ -66,6 +68,8 @@ pub enum AuthorizationError {
     ParentHashMismatch,
     #[error("the root issuer is not trusted")]
     UntrustedIssuer { key_id: String },
+    #[error("child constraint violates monotonic attenuation on `{dimension}`: {detail}")]
+    AttenuationViolation { dimension: String, detail: String },
     #[error("the warrant has been revoked")]
     WarrantRevoked,
     #[error("the holder key has been revoked")]
@@ -86,6 +90,10 @@ pub enum AuthorizationError {
     ApprovalsDigestMismatch,
     #[error("unknown warrant extension key `{key}` (extensions are frozen in v1)")]
     UnknownExtension { key: String },
+    #[error("SRL version {presented} does not advance the applied version {applied} (anti-rollback)")]
+    SrlVersionRegression { presented: u64, applied: u64 },
+    #[error("the SRL signature is invalid")]
+    InvalidSrlSignature,
 }
 
 /// Errors returned while encoding or decoding LedgerFlow wire payloads.
@@ -97,4 +105,6 @@ pub enum WireError {
     Serialization(String),
     #[error("failed to decode the payload from CBOR: {0}")]
     Deserialization(String),
+    #[error("unknown warrant extension key `{key}` (extensions are frozen in v1)")]
+    UnknownExtension { key: String },
 }

crates/ledgerflow-core/src/issue_bounds.rs

@@ -0,0 +1,93 @@
+//! Issuance bounds: what a warrant's holder may delegate to descendants.
+//!
+//! A root warrant can carry an optional `IssueBounds` that constrains the
+//! warrants its holder is allowed to issue (delegate). This provides
+//! defense-in-depth for the control plane: even if a root signing key is
+//! compromised, the attacker can only delegate within the bounds, never
+//! arbitrarily.
+//!
+//! Bounds are carried in the warrant's `extensions` map under the reserved
+//! key [`ISSUE_BOUNDS_EXTENSION`], encoded as CBOR (see [`IssueBounds`]).
+//! Unknown extension keys are rejected by the decoder, so the reserved key is
+//! the only way to express bounds on the wire.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    error::WireResult,
+    warrant::{AssetRef, PaymentRail, CborCodec, Warrant},
+};
+
+/// Reserved extension key carrying the issuance bounds.
+pub const ISSUE_BOUNDS_EXTENSION: &str = "ledgerflow.issue_bounds";
+
+/// Limits on the warrants this warrant's holder may issue (delegate).
+///
+/// Every dimension is a *ceiling*: a delegated warrant's corresponding
+/// constraint must be no wider than the bound. Empty lists mean "no
+/// restriction" (any value allowed), mirroring the warrant constraint
+/// semantics.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+pub struct IssueBounds {
+    /// Merchant ids the issuer may delegate to (empty = any).
+    pub merchant_ids: Vec<String>,
+    /// Host suffixes the issuer may delegate to (empty = any).
+    pub host_suffixes: Vec<String>,
+    /// HTTP methods the issuer may delegate (empty = any).
+    pub http_methods: Vec<String>,
+    /// Path prefixes the issuer may delegate (empty = any).
+    pub path_prefixes: Vec<String>,
+    /// Assets the issuer may delegate (empty = any).
+    pub assets: Vec<AssetRef>,
+    /// Rails the issuer may delegate (empty = any).
+    pub rails: Vec<PaymentRail>,
+    /// Schemes the issuer may delegate (empty = any).
+    pub schemes: Vec<String>,
+    /// Payees the issuer may delegate to (empty = any).
+    pub payee_ids: Vec<String>,
+    /// Maximum per-charge amount the issuer may delegate (`None` = inherit
+    /// the parent's cap, which is already monotonic).
+    pub max_per_charge: Option<u128>,
+    /// Maximum delegation depth for issued warrants.
+    pub max_issue_depth: Option<u8>,
+}
+
+impl IssueBounds {
+    /// Creates unrestricted bounds (no limits beyond what the parent itself
+    /// already constrains).
+    #[must_use]
+    pub const fn unrestricted() -> Self {
+        Self {
+            merchant_ids: Vec::new(),
+            host_suffixes: Vec::new(),
+            http_methods: Vec::new(),
+            path_prefixes: Vec::new(),
+            assets: Vec::new(),
+            rails: Vec::new(),
+            schemes: Vec::new(),
+            payee_ids: Vec::new(),
+            max_per_charge: None,
+            max_issue_depth: None,
+        }
+    }
+
+    /// Encodes the bounds as CBOR bytes (for embedding in `extensions`).
+    pub fn encode_cbor(&self) -> WireResult<Vec<u8>> {
+        <Self as CborCodec>::encode_cbor(self)
+    }
+
+    /// Decodes bounds from CBOR bytes.
+    pub fn decode_cbor(bytes: &[u8]) -> WireResult<Self> {
+        <Self as CborCodec>::decode_cbor(bytes)
+    }
+}
+
+impl CborCodec for IssueBounds {}
+
+impl Warrant {
+    /// Returns the issuance bounds carried by this warrant, if any.
+    pub fn issue_bounds(&self) -> Option<IssueBounds> {
+        let bytes = self.extensions.get(ISSUE_BOUNDS_EXTENSION)?;
+        IssueBounds::decode_cbor(bytes).ok()
+    }
+}

crates/ledgerflow-core/src/lib.rs

@@ -23,9 +23,11 @@ pub mod approval;
 pub mod chain;
 pub mod constraint;
 pub mod error;
+pub mod issue_bounds;
 pub mod pop;
 pub mod proof_builder;
 pub mod revocation;
+pub mod srl;
 pub mod trust;
 pub mod typestate;
 pub mod verification;
@@ -38,25 +40,28 @@ pub use crate::{
     },
     chain::{VerifiedChainAuthorization, WarrantChain, verify_chain, verify_link},
     constraint::{
-        AuthorizationContext, Constraint, MerchantConstraint, PaymentConstraint,
-        ResourceConstraint, ToolConstraint, Verify, verify_all as verify_all_constraints,
+        validate_attenuation, AuthorizationContext, Constraint, MerchantConstraint,
+        PaymentConstraint, ResourceConstraint, ToolConstraint, Verify,
+        verify_all as verify_all_constraints,
     },
+    issue_bounds::{ISSUE_BOUNDS_EXTENSION, IssueBounds},
     error::{AuthorizationError, Result, WireError, WireResult},
     pop::{POP_SIGN_DOMAIN, PopProof, PopTuple, verify_freshness},
     proof_builder::ProofBuilder,
     revocation::{InMemoryRevocationCheck, RevocationCheck, RevocationDecision},
+    srl::{SRL_SIGN_DOMAIN, SignedRevocationList, SrlEntry, SrlState},
     trust::{TrustedIssuer, TrustedIssuers},
     typestate::{DelegatedWarrantBuilder, WarrantBuilder},
     verification::{
         AuthorizationInput, ToolArguments, VerifiedAuthorization, WarrantExt, verify_authorization,
     },
     warrant::{
         AssetRef, CborCodec, DEFAULT_CHALLENGE_TTL_MS, DEFAULT_CLOCK_SKEW_MS, DEFAULT_MAX_DEPTH,
-        DEFAULT_PROOF_FRESHNESS_MS, DEFAULT_WARRANT_TTL_SECS, MAX_DELEGATION_DEPTH,
-        MAX_WARRANT_CBOR_BYTES, MAX_WARRANT_TTL_SECS, PaymentRail, PaymentSubjectKind,
-        PaymentSubjectRef, SignatureEnvelope, SignerRef, SigningAlgorithm, SigningKeyPair,
-        WARRANT_SIGN_DOMAIN, WARRANT_VERSION_V1, Warrant, WarrantMetadata, generate_warrant_id,
-        sha256_prefixed,
+        DEFAULT_PROOF_FRESHNESS_MS, DEFAULT_WARRANT_TTL_SECS, KNOWN_EXTENSION_KEYS,
+        MAX_DELEGATION_DEPTH, MAX_WARRANT_CBOR_BYTES, MAX_WARRANT_TTL_SECS, PaymentRail,
+        PaymentSubjectKind, PaymentSubjectRef, SignatureEnvelope, SignerRef, SigningAlgorithm,
+        SigningKeyPair,         WARRANT_SIGN_DOMAIN, WARRANT_VERSION_V1, Warrant, WarrantMetadata,
+        generate_warrant_id, generate_warrant_id_128, hex_encode_bytes, sha256_prefixed,
     },
 };