Contract interface

API reference

PolicyFuse v1 exposes seven state-changing methods and eight views. The contract has no payable method, token transfer, escrow, arbitrary downstream write, or hidden execution surface.

Write methods

WRITEcreate_policy(...)

Creates an immutable policy version. Requires bounded fields, unique rule ids, strictly increasing version within an owner/slug lineage, sorted unique action types, and bounded lifetimes. Returns the deterministic policy id.

WRITEsupersede_policy(policy_id, replacement_policy_id)

Owner-only explicit lifecycle transition from ACTIVE to SUPERSEDED. Replacement must share owner + slug, be ACTIVE, and have a greater version.

WRITErevoke_policy(policy_id)

Owner-only terminal revocation. Existing historical authorizations become non-current immediately.

WRITEcreate_intent(policy_id, consumer, action_type, action_core, clarification, deadline)

Creates one immutable OPEN intent with exact requester, policy fingerprint, consumer, action type, canonical action data, clarification digest, deadline, and requester-local counter bindings.

WRITEevaluate_intent(intent_id)

Runs the leader/validator semantic path, requires complete exact rule coverage and substantive validator agreement, then deterministically derives ALLOW, DENY, or REPAIR_REQUIRED.

WRITErepair_intent(intent_id, clarification, deadline)

Requester-only. Creates a new immutable revision after REPAIR_REQUIRED while preserving the exact consequence-bearing action core and consumer bindings.

WRITEexpire_intent(intent_id)

Materializes EXPIRED for OPEN or REPAIR_REQUIRED after the immutable deadline. Expiry never manufactures semantic DENY.

View methods

VIEWget_policy(policy_id)

Returns the stored immutable policy record and current lifecycle state.

VIEWget_intent(intent_id)

Returns the stored intent record.

VIEWget_decision(intent_id)

Returns the completed semantic decision record. Missing decisions are errors.

VIEWget_authorization(authorization_id)

Returns an ALLOW authorization. Non-ALLOW intents have no authorization.

VIEWget_verdict(intent_id)

Compact application-facing tuple: intent status, decision, failure/repair code, authorization id, and validity bound.

VIEWis_authorization_current(authorization_id)

Recomputes whether a historical authorization remains usable under policy lifecycle, identity, lineage, and time guards.

VIEWis_authorization_current_for(authorization_id, expected_consumer, expected_action_core_digest)

Preferred downstream integration read. Returns true only when general currentness passes and both exact consequence bindings match.

VIEWget_latest_policy(owner, slug)

Returns the latest-created policy id for a lineage. Latest-created does not imply ACTIVE.

Key hard bounds

Rule surface

1–12 rules · rule id ≤32 ASCII identifier chars · each rule text ≤1024 UTF-8 bytes · aggregate rule text ≤8192 bytes.

Action surface

1–12 allowed action types · action type ≤64 chars · action core ≤4096 UTF-8 bytes · clarification ≤4096 bytes.

Lifetimes

Intent and authorization lifetime configuration: 60 to 604,800 seconds, with policy-selected bounds allowed to be smaller.

Canonicalization

Stable ordered rule ids, sorted unique action types, canonical JSON, domain-separated hashing, and explicit sequence binding.