Provenance binding

// In workflow code (render time):
const approval = ctx.prove("review", { nodeId: "lane:review" });
// → ProofBinding { table: "review", nodeId: "lane:review",
//                  iteration: 3, digest: "sha256:…" } | undefined

type ProofBinding = {
  table: string;
  nodeId: string;
  iteration: number;
  digest: string; // content hash of the bound output row
};

<Task id="lane:push" bind={approval} agent={luna} output={outputs.push}>
  Push the approved commit. …
</Task>

​

Semantics

• ctx.prove(table, { nodeId, iteration? }) reads the latest (or the named-iteration) output row of that node and returns a ProofBinding carrying a content digest of the row. It returns undefined while the row does not exist - like ctx.outputMaybe, it never throws at render time.
• bind on <Task> (a single binding or an array) is checked by the engine at schedule time, not render time: the digest of the bound row’s current value is recomputed and compared. On mismatch the task parks as BOUND_STALE instead of executing.
• A bind of undefined blocks scheduling the same way an unmet dependency does - a task cannot run on authority that was never produced.

​

Staleness is a signal, not an error

const pushStale = ctx.boundStale("lane:push");
const authorityIsCurrent = gate?.approved === true && !pushStale;

<Loop id="lane:correct" until={authorityIsCurrent} maxIterations={5}>
  …
</Loop>

​

Notes

• Bindings hash content, not iteration counters, so they survive resume, retry, replay, and time travel: a restored run re-verifies against whatever the rows say now.
• ctx.boundStale(nodeId) reports only the current task iteration. A newly rendered iteration starts false even when an older iteration parked stale.
• Bind the decision row (the review verdict, the gate result), not raw agent text; digesting is deterministic over the typed output row.
• This complements, not replaces, human approval: <Approval> answers “may this happen at all”; a proof binding answers “is the thing that was approved still the thing about to happen”.
• <GitHubLanding> and <IsolatedGate> are the canonical producers and consumers: gate result rows and review verdicts get bound into the landing step, so nothing stale can reach a push.