Class ExecutionToken

src/orgkernel/schemas/execution_token.py:94–242

Scoped, time-bounded permission token for a specific Mission execution. Issued at Mission APPROVED state. Enforced at the Tool Gateway — out-of-scope calls are blocked before reaching any external system.

class ExecutionToken(BaseModel):
    """
    Scoped, time-bounded permission token for a specific Mission execution.
    Issued at Mission APPROVED state.
    Enforced at the Tool Gateway — out-of-scope calls are blocked
    before reaching any external system.
    """
    model_config = {"frozen": True}

    token_id: str = Field(default_factory=_new_token_id)
    agent_id: str
    mission_id: str
    execution_scope: list[str] = Field(
        min_length=1,
        description="Whitelist of permitted tool call identifiers.",
    )
    immutable_params: dict = Field(
        default_factory=dict,
        description="Tool call params that must match exactly.",
    )
    bounded_params: list[BoundedParam] = Field(
        default_factory=list,
        description="Params with numeric bounds.",
    )
    issued_at: datetime = Field(default_factory=_now_utc)
    expires_at: datetime
    boundary_snapshot_id: str | None = None
    token_signature: str | None = Field(
        default=None,
        description="Ed25519 signature by Org CA over canonical token payload. Prevents token tampering and Token Grafting.",
    )
    used: bool = False
    invalidated_at: datetime | None = None
    invalidation_reason: str | None = None

    @field_validator("token_id")
    @classmethod
    def _validate_token_id(cls, v: str) -> str:
        if not _TOKEN_ID_RE.match(v):
            raise ValueError(f"token_id '{v}' must match ^tok_[a-z0-9]+$")
        return v

    @field_validator("agent_id")
    @classmethod
    def _validate_agent_id(cls, v: str) -> str:
        if not _AGENT_ID_RE.match(v):
            raise ValueError(f"agent_id '{v}' must match ^aid_[a-z0-9]+$")
        return v

    @field_validator("mission_id")
    @classmethod
    def _validate_mission_id(cls, v: str) -> str:
        if not _MISSION_ID_RE.match(v):
            raise ValueError(f"mission_id '{v}' must match ^msn_[a-z0-9]+$")
        return v

    @field_validator("execution_scope")
    @classmethod