# Guard Cloud Review Contract

Generated from `contracts/guard-cloud-review/v2/contract.json`; do not edit this file by hand.

This contract defines the active protocol 2 review boundary and its Local Guard runtime behavior.

## Glossary

- **localRequest:** The exact pending request persisted by Local Guard before the harness pauses.
- **reviewRequest:** The Cloud canonical aggregate bound to one local request and machine installation.
- **decision:** An immutable reviewer outcome recorded by Cloud for one review request.
- **deliveryCommand:** The exact signed command that transports one recorded decision to its target Local Guard.
- **localApplication:** The Local Guard result after it verifies and resolves the exact pending local request.
- **agentContinuation:** The harness-reported result after Local Guard applies a decision; it is independent of application.

## Invariants

- `decision-not-application`: A recorded Cloud decision is not evidence of local application.
- `application-not-continuation`: A successful local application is not evidence that the agent continued.
- `allow-once-exact-request`: allow_once resolves only one pending local request and cannot create reusable policy or decision memory.
- `immutable-block-not-remotely-approvable`: An immutable policy block is not a reviewable request and cannot be approved remotely.
- `policy-memory-separate-operation`: Persistent memory and policy changes require guard.review.syncPolicyMemory and separate authorization.

## Operations

- `guard.review.resolveExact`: outcomes `allow_once`, `block`.
- `guard.review.syncPolicyMemory`: outcomes none.

## Portable Semantic Rules

- `rfc3339-date-times`: `rfc3339_date_time`.
- `correlation-equality`: `all_equal`.
- `exact-result-reviewable-pause`: `equals`.
- `allow-once-request-status`: `if_all_equals_then_in`.
- `block-request-status`: `if_all_equals_then_in`.
- `resolved-allow-requires-recorded-decision`: `if_equals_then_equals`.
- `resolved-allow-requires-allow-once-outcome`: `if_equals_then_equals`.
- `resolved-block-requires-recorded-decision`: `if_equals_then_equals`.
- `resolved-block-requires-block-outcome`: `if_equals_then_equals`.
- `resolved-block-requires-blocked-continuation`: `if_equals_then_equals`.
- `resolved-request-requires-applied-application`: `if_in_then_equals`.
- `recorded-block-requires-blocked-continuation`: `if_all_equals_then_in`.
- `applied-block-requires-blocked-continuation`: `if_all_equals_then_in`.
- `resumed-continuation-requires-recorded-decision`: `if_in_then_equals`.
- `resumed-continuation-requires-allow-once-decision`: `if_in_then_equals`.
- `recorded-decision-has-delivery`: `if_equals_then_in`.
- `delivery-requires-recorded-decision`: `if_in_then_equals`.
- `completed-application-requires-applied-delivery`: `if_in_then_equals`.
- `not-applicable-application-requires-not-applicable-delivery`: `if_equals_then_equals`.
- `not-applicable-delivery-requires-not-applicable-application`: `if_equals_then_equals`.
- `applied-continuation-requires-applied-application`: `if_in_then_equals`.
- `not-applicable-continuation-requires-not-applicable-application`: `if_equals_then_equals`.
- `failed-continuation-requires-compatible-application`: `if_equals_then_in`.
- `blocked-continuation-requires-block-decision`: `if_equals_then_equals`.

## Correlation

`correlationId` format: `^gcr_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`.
It must be attached to `localRequest`, `reviewRequest`, `decisionReceipt`, `deliveryCommand`, `localApplication`, `continuationResult`.

## Canonical Status Values

### requestStatus

`pending`, `resolved_allow`, `resolved_block`, `expired`, `cancelled`, `superseded`

### visibilityStatus

`local_only`, `syncing`, `visible`, `quarantined`, `stale`

### decisionStatus

`none`, `submitting`, `recorded`, `rejected`, `failed`, `cancelled`

### deliveryStatus

`none`, `queued`, `queued_offline`, `leased`, `applying`, `applied`, `rejected`, `failed`, `cancelled`, `not_applicable`

### applicationStatus

`waiting`, `applied`, `rejected_stale`, `rejected_binding`, `failed_retryable`, `failed_terminal`, `not_applicable`

### continuationStatus

`waiting`, `resumed`, `already_resumed`, `manual_retry_required`, `blocked_not_resumed`, `unsupported`, `failed`, `not_applicable`

### continuationCapability

`suspended-response`, `session-resume`, `retry-only`, `unsupported`

## Result Shape

Every exact remote-review result includes `request`, `decision`, `delivery`, `application`, and `continuation` records. A recorded decision is not local application, and applied locally is not agent continuation.
