[MichaelWave369]

Summary

P0-u makes one normative P0 governance boundary executable:

ACCEPT_OUTCOME != EXECUTE_EXTERNAL_EFFECT

An accepted artifact still cannot trigger even the harmless proof effect unless the caller presents an exact active EXECUTE_EXTERNAL_EFFECT grant.

P0 issues no such grant by default.

Safe proof adapter

The only effect surface is:

demo-marker -> local-proof-sink

It performs no network request, payment, messaging, deployment, filesystem write, or device control. It records only an in-memory proof marker when authorized.

Authorization chain

A request must bind:

• current room version
• accepted artifact id
• exact execution grant id
• effect request id
• fixed proof kind + target

The executor runs only if the supplied grant:

• belongs to the actor
• is EXECUTE_EXTERNAL_EFFECT
• is active
• is not revoked
• is not expired

Acceptance authority cannot substitute.

Negative control

The browser governance test performs:

1. bounded work
2. explicit artifact acceptance
3. external-effect probe
4. expected blocked / NOT_AUTHORIZED

The production executor remains uninvoked.

Unit tests also fabricate one execution grant in-memory to prove the harmless local sink runs only under the exact authority check.

CI

Adds:

npm run test:p0-governance

and a dedicated p0-governance-probes job.

Schema

Wire advances to p0-u.1.

The physical SQLite layout remains p0-q.1; existing P0-q databases receive an in-place wire-metadata migration.

Deliberately absent

P0-u does not add a product path for issuing execution grants and does not add any real effectful adapter.