Regenerate against ctrlrun main: v0.10 items 1 to 5

docs.mdx

@@ -219,8 +219,8 @@ the framework's own interrupt, and a framework with no such primitive does not n
 
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,975 tests**, every version specified before it was written and every requirement mutation-tested.
-- **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested.
+- **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).
 - **Each receipt carries the hash of the one before it**, so an alteration is detected and named.

docs/production/index.mdx

@@ -28,8 +28,8 @@ need. `test_the_first_line_of_the_section_says_which_store_and_why` asserts the
 
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,975 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
-- **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).
 - **Each receipt carries the hash of the one before it**, so an alteration is detected and named. [Read more](/docs/production/receipt-integrity).

docs/reference/api/Authority.mdx

@@ -5,7 +5,7 @@ description: "The `authority:` section, loaded and evaluable (SPEC-v0.3 §4)."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Authority` — class, defined at `src/ctrlrun/authority.py:1134`
+`ctrlrun.Authority` — class, defined at `src/ctrlrun/authority.py:1229`
 
 ```python
 from ctrlrun import Authority

docs/reference/api/AuthorityResult.mdx

@@ -5,7 +5,7 @@ description: "What the authority axis decided, and which grant it decided on (§
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.AuthorityResult` — class, defined at `src/ctrlrun/authority.py:619`
+`ctrlrun.AuthorityResult` — class, defined at `src/ctrlrun/authority.py:621`
 
 ```python
 from ctrlrun import AuthorityResult
@@ -14,7 +14,7 @@ from ctrlrun import AuthorityResult
 
 ```python
 class AuthorityResult
-    def __init__(passed: bool, reason: str, grant_id: str | None = None, delegation_id: str | None = None, depth: int = 0, dimension: str | None = None, missing_parent_id: str | None = None, expired_parent_id: str | None = None, depth_exceeded: int | None = None, cycle_at: str | None = None)
+    def __init__(passed: bool, reason: str, grant_id: str | None = None, delegation_id: str | None = None, depth: int = 0, hop: str | None = None, dimension: str | None = None, missing_parent_id: str | None = None, expired_parent_id: str | None = None, depth_exceeded: int | None = None, cycle_at: str | None = None)
 ```
 
 What the authority axis decided, and which grant it decided on (§4.8).

docs/reference/api/Condition.mdx

@@ -5,7 +5,7 @@ description: "One `<argument>_<op>: operand` test against an action's arguments
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Condition` — class, defined at `src/ctrlrun/policy.py:371`
+`ctrlrun.Condition` — class, defined at `src/ctrlrun/policy.py:398`
 
 ```python
 from ctrlrun import Condition

docs/reference/api/Control.mdx

@@ -5,7 +5,7 @@ description: "Policy, state and evidence composed around a single action (SPEC-v
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:677`
+`ctrlrun.Control` — class, defined at `src/ctrlrun/control.py:825`
 
 ```python
 from ctrlrun import Control
@@ -14,7 +14,7 @@ from ctrlrun import Control
 
 ```python
 class Control
-    def __init__(policy: Policy, store: StateStore, approvals: ApprovalProvider | None = None, *, clock: Callable[[], datetime] = _utc_now, approval_ttl: timedelta = DEFAULT_APPROVAL_TTL, lease: timedelta = DEFAULT_LEASE, sinks: Sequence[EventSink] = (), suspend_timeout: timedelta = DEFAULT_SUSPEND_TIMEOUT, identity: IdentityProvider | None = None, authority: Authority | None = None, environment: str | None = None, approver_identity: ApproverIdentity | None = None, require_approved_policy: bool = False)
+    def __init__(policy: Policy, store: StateStore, approvals: ApprovalProvider | None = None, *, clock: Callable[[], datetime] = _utc_now, approval_ttl: timedelta = DEFAULT_APPROVAL_TTL, lease: timedelta = DEFAULT_LEASE, sinks: Sequence[EventSink] = (), suspend_timeout: timedelta = DEFAULT_SUSPEND_TIMEOUT, identity: IdentityProvider | None = None, authority: Authority | None = None, environment: str | None = None, approver_identity: ApproverIdentity | None = None, require_approved_policy: bool = False, upstream: str | None = None)
 ```
 
 Policy, state and evidence composed around a single action (SPEC-v0.1 §8).

docs/reference/api/Decision.mdx

@@ -5,7 +5,7 @@ description: "What may happen to an action: exactly three outcomes in v0.1 (SPEC
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Decision` — class, defined at `src/ctrlrun/policy.py:308`
+`ctrlrun.Decision` — class, defined at `src/ctrlrun/policy.py:335`
 
 ```python
 from ctrlrun import Decision

docs/reference/api/Delegation.mdx

@@ -5,7 +5,7 @@ description: "A grant created at runtime by a principal who already holds one (S
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Delegation` — class, defined at `src/ctrlrun/authority.py:579`
+`ctrlrun.Delegation` — class, defined at `src/ctrlrun/authority.py:581`
 
 ```python
 from ctrlrun import Delegation

docs/reference/api/Event.mdx

@@ -5,7 +5,7 @@ description: "One ordered step in the life of an action (SPEC-v0.1 §6.2)."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Event` — class, defined at `src/ctrlrun/receipt.py:297`
+`ctrlrun.Event` — class, defined at `src/ctrlrun/receipt.py:305`
 
 ```python
 from ctrlrun import Event

docs/reference/api/EventSink.mdx

@@ -5,7 +5,7 @@ description: "Somewhere a copy of every `Event` and `Receipt` goes (SPEC-v0.2 §
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.EventSink` — class, defined at `src/ctrlrun/receipt.py:773`
+`ctrlrun.EventSink` — class, defined at `src/ctrlrun/receipt.py:798`
 
 ```python
 from ctrlrun import EventSink

docs/reference/api/Grant.mdx

@@ -5,7 +5,7 @@ description: "One permission: this subject may propose these actions, under thes
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Grant` — class, defined at `src/ctrlrun/authority.py:416`
+`ctrlrun.Grant` — class, defined at `src/ctrlrun/authority.py:431`
 
 ```python
 from ctrlrun import Grant

docs/reference/api/JSONLEventSink.mdx

@@ -5,7 +5,7 @@ description: "The JSONL half of the evidence: two append-only files in one direc
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.JSONLEventSink` — class, defined at `src/ctrlrun/receipt.py:792`
+`ctrlrun.JSONLEventSink` — class, defined at `src/ctrlrun/receipt.py:817`
 
 ```python
 from ctrlrun import JSONLEventSink

docs/reference/api/Policy.mdx

@@ -5,7 +5,7 @@ description: "Action-level autonomy policy: which actions may run, and under whi
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Policy` — class, defined at `src/ctrlrun/policy.py:700`
+`ctrlrun.Policy` — class, defined at `src/ctrlrun/policy.py:759`
 
 ```python
 from ctrlrun import Policy

docs/reference/api/Receipt.mdx

@@ -5,7 +5,7 @@ description: "Portable evidence of one action that reached a terminal state (SPE
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Receipt` — class, defined at `src/ctrlrun/receipt.py:389`
+`ctrlrun.Receipt` — class, defined at `src/ctrlrun/receipt.py:397`
 
 ```python
 from ctrlrun import Receipt
@@ -14,7 +14,7 @@ from ctrlrun import Receipt
 
 ```python
 class Receipt
-    def __init__(receipt_id: str, action_id: str, action: str, action_hash: str, principal: Principal, resource: str | None, arguments: Mapping[str, Any], environment: str, decision: Decision, decision_reason: str, result: ReceiptResult, started_at: datetime, finished_at: datetime, approval_id: str | None = None, approver: str | None = None, effect_key: str | None = None, attempt: int = 1, error: str | None = None, execution: ReceiptResult | None = None, would_have: _WouldHave | None = None, seq: int | None = None, prev_hash: str | None = None, policy_hash: str | None = None, policy_version: str | None = None, controls: tuple[str, ...] = (), hash: str | None = None, precondition_at_request: str | None = None, precondition_at_recheck: str | None = None, approvers: tuple[VerifiedApprover, ...] = (), authority_grant_id: str | None = None, task: str | None = None, scope_hash: str | None = None, budget_charges: tuple[Mapping[str, Any], ...] = (), schema: str = RECEIPT_SCHEMA)
+    def __init__(receipt_id: str, action_id: str, action: str, action_hash: str, principal: Principal, resource: str | None, arguments: Mapping[str, Any], environment: str, decision: Decision, decision_reason: str, result: ReceiptResult, started_at: datetime, finished_at: datetime, approval_id: str | None = None, approver: str | None = None, effect_key: str | None = None, attempt: int = 1, error: str | None = None, execution: ReceiptResult | None = None, would_have: _WouldHave | None = None, seq: int | None = None, prev_hash: str | None = None, policy_hash: str | None = None, policy_version: str | None = None, controls: tuple[str, ...] = (), hash: str | None = None, precondition_at_request: str | None = None, precondition_at_recheck: str | None = None, approvers: tuple[VerifiedApprover, ...] = (), authority_grant_id: str | None = None, task: str | None = None, scope_hash: str | None = None, hop: str | None = None, budget_charges: tuple[Mapping[str, Any], ...] = (), schema: str = RECEIPT_SCHEMA)
 ```
 
 Portable evidence of one action that reached a terminal state (SPEC-v0.1 §6.1).

docs/reference/api/Subject.mdx

@@ -5,7 +5,7 @@ description: "Who a grant is addressed to: an agent pattern, a user pattern, or
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.Subject` — class, defined at `src/ctrlrun/authority.py:320`
+`ctrlrun.Subject` — class, defined at `src/ctrlrun/authority.py:335`
 
 ```python
 from ctrlrun import Subject

docs/reference/api/authority-Budget.mdx

@@ -5,7 +5,7 @@ description: "How much, over what, in how long (SPEC-v0.9 §2.2)."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.authority.Budget` — class, defined at `src/ctrlrun/authority.py:366`
+`ctrlrun.authority.Budget` — class, defined at `src/ctrlrun/authority.py:381`
 
 ```python
 from ctrlrun.authority import Budget

docs/reference/api/context.mdx

@@ -5,7 +5,7 @@ description: "Bind the principal for calls made inside the block."
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:322`
+`ctrlrun.context` — function, defined at `src/ctrlrun/control.py:368`
 
 ```python
 from ctrlrun import context

docs/reference/api/idempotency_token.mdx

@@ -5,7 +5,7 @@ description: "The provider idempotency token for the attempt this executor is ru
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:290`
+`ctrlrun.idempotency_token` — function, defined at `src/ctrlrun/control.py:336`
 
 ```python
 from ctrlrun import idempotency_token

docs/reference/api/parse_conditions.mdx

@@ -5,7 +5,7 @@ description: "Parse a `when:`-shaped mapping into conditions, keyed by the raw c
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.parse_conditions` — function, defined at `src/ctrlrun/policy.py:1248`
+`ctrlrun.parse_conditions` — function, defined at `src/ctrlrun/policy.py:1326`
 
 ```python
 from ctrlrun import parse_conditions

docs/reference/api/protect.mdx

@@ -5,15 +5,15 @@ description: "Bind a function to an action name: every call becomes a decided, r
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4576`
+`ctrlrun.protect` — function, defined at `src/ctrlrun/control.py:4902`
 
 ```python
 from ctrlrun import protect
 ```
 
 
 ```python
-def protect(name: str, *, effect: str | None = None, resource: str | None = None, wait: bool = False, lease: timedelta | None = None, reconcile: Callable[[str], ReconcileOutcome] | None = None, reconcile_eagerly: bool = False, control: Control | None = None, preconditions: Callable[[Action], Mapping[str, Any]] | None = None, task: str | None = None, scope: Callable[[Action], Mapping[str, Any]] | None = None) -> Callable[[Callable[P, R]], Callable[P, R]]
+def protect(name: str, *, effect: str | None = None, resource: str | None = None, wait: bool = False, lease: timedelta | None = None, reconcile: Callable[[str], ReconcileOutcome] | None = None, reconcile_eagerly: bool = False, control: Control | None = None, preconditions: Callable[[Action], Mapping[str, Any]] | None = None, task: str | None = None, hop: str | None = None, scope: Callable[[Action], Mapping[str, Any]] | None = None) -> Callable[[Callable[P, R]], Callable[P, R]]
 ```
 
 Bind a function to an action name: every call becomes a decided, recorded Action.

docs/reference/api/with_approval.mdx

@@ -5,7 +5,7 @@ description: "Present a granted approval to the calls made inside the block (SPE
 
 {/* generated by tools/docs_audit/render_api.py from the docstrings — edit the docstring, never this page */}
 
-`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:345`
+`ctrlrun.with_approval` — function, defined at `src/ctrlrun/control.py:391`
 
 ```python
 from ctrlrun import with_approval

docs/reference/cli.mdx

@@ -166,6 +166,8 @@ Usage: ctrlrun inspect [OPTIONS] [ACTION_ID]
 Options:
   --grant TEXT      Show this grant's budgets instead: consumed, held, and what
                     holds it.
+  --hop TEXT        Show this hop or delegation instead: who issued it, and what
+                    each link narrowed.
   --json            Emit one JSON object instead.
   --store-url TEXT  The store to open. Default: $CTRLRUN_STORE_URL, else the
                     SQLite database beside the policy (.ctrlrun/state.db, or

docs/reference/receipt-and-event-schemas.mdx

@@ -57,8 +57,9 @@ it. A reader checking a chain compares those two.
 | `authority_grant_id` | `str | None` | `None` |
 | `task` | `str | None` | `None` |
 | `scope_hash` | `str | None` | `None` |
+| `hop` | `str | None` | `None` |
 | `budget_charges` | `tuple` | `()` |
-| `schema` | `str` | `'ctrlrun.receipt/v6'` |
+| `schema` | `str` | `'ctrlrun.receipt/v7'` |
 | `_stored_document` | `collections.abc.Mapping[str, Any] | None` | `None` |
 
 ### Result

generated/readiness.full.mdx

@@ -1,7 +1,7 @@
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,975 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
-- **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).
 - **Each receipt carries the hash of the one before it**, so an alteration is detected and named. [Read more](/docs/production/receipt-integrity).

generated/readiness.json

@@ -1,5 +1,5 @@
 {
-  "guarantees": 24,
+  "guarantees": 27,
   "released": "0.9.0",
   "soak": {
     "actions": 889735,
@@ -9,6 +9,6 @@
     "positive_control": true,
     "unexplained": 0
   },
-  "tests": 5975,
+  "tests": 6033,
   "version": "0.9.0"
 }

generated/readiness.mdx

@@ -1,7 +1,7 @@
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,975 tests**, every version specified before it was written and every requirement mutation-tested.
-- **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
+- **6,033 tests**, every version specified before it was written and every requirement mutation-tested.
+- **27 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).
 - **Each receipt carries the hash of the one before it**, so an alteration is detected and named.