### 5.2 Protocol layer — `delegus-base-v3` (v0.3-rc1)

Reproducible by anyone given: Grant, Proof, Action, RP DID, a clock, the issuer's DID document snapshot, the status-list credential snapshot, (for budgeted Capabilities) the consumption snapshot and (for dependencies) the disclosure package; D5 and D7's standing and key-state parts are Delegus's attestation. D2–D7 are reproducible by a party entitled to the dependency disclosure package (§R.5); D5 is Delegus's attestation. Each check yields `true | false | "skipped"`.

`delegus-base-v3` extends `delegus-base-v2`: every check P1–P21 is as in `delegus-base-v2`, and v3 adds the dependency checks D1–D7 after P21. The receipt is `delegus-receipt-v2`: it pins the authority, the declared dependencies and the relying party's requirements by hash (`authority_commitment`, `relies_on_hash`, `requires_hash`). An Action without `relies_on`, checked for a relying party that states no `requires`, has D1–D7 vacuously true.

| # | Check | DENY reason |
|---|---|---|
| P1 | Grant parses and conforms to §3 (incl. `parentGrant` absent; `budget` well-typed) | `GRANT_MALFORMED` / `UNSUPPORTED_FEATURE` |
| P2 | `kid` names a verification method present in the DID document snapshot | `ISSUER_KEY_NOT_FOUND` |
| P3 | Grant signature verifies | `GRANT_SIGNATURE_INVALID` |
| P4 | `now ≥ validFrom` | `GRANT_NOT_YET_VALID` |
| P5 | `now < validUntil` | `GRANT_EXPIRED` |
| P6 | Status credential signed by Delegus; bit at `statusListIndex` is 0 | `AUTHORITY_REVOKED` |
| P7 | `audience`, if present, contains RP | `AUDIENCE_MISMATCH` |
| P8 | Proof parses and conforms to §4 (incl. `jti` format) | `PROOF_MALFORMED` |
| P9 | Proof signature verifies against Agent key | `PROOF_SIGNATURE_INVALID` |
| P10 | Proof `iss` == Grant `sub` | `PROOF_AGENT_MISMATCH` |
| P11 | Proof `grant` == Grant `id` | `PROOF_GRANT_MISMATCH` |
| P12 | Proof `aud` == RP DID | `PROOF_AUDIENCE_MISMATCH` |
| P13 | `iat` within window | `PROOF_EXPIRED` |
| P14 | `action_hash` == hash of submitted Action | `PROOF_ACTION_MISMATCH` |
| P15 | Action valid for its `type`, including `relies_on` (1–8 entries, each exactly `fingerprint` and `mode`, no repeats); no unknown member | `ACTION_MALFORMED` |
| P16 | Some Capability matches `action.type` | `ACTION_NOT_AUTHORIZED` |
| P17 | All constraint keys known | `UNKNOWN_CONSTRAINT` |
| P18 | Currency authorized | `CURRENCY_NOT_AUTHORIZED` |
| P19 | `amount ≤ maxAmount` | `AMOUNT_EXCEEDS_AUTHORITY` |
| P20 | `resource` matches a pattern | `RESOURCE_NOT_AUTHORIZED` |
| P21 | Some P20 survivor has budget headroom for the action (or declares no `budget`); period from `validFrom` in UTC, counts from the snapshot | `AUTHORITY_EXHAUSTED` |
| D1 | Every `requires` entry appears in `action.relies_on` with the same fingerprint and the same mode | `DEPENDENCY_NOT_DECLARED` |
| D2 | The fingerprint resolves, inside Delegus, to a receipt Delegus issued (recomputed from that receipt's bytes and its stored opening) | `DEPENDENCY_COMMITMENT_MISMATCH` |
| D3 | That receipt's signature verifies against a Delegus receipt key and its body equals its payload | `DEPENDENCY_RECEIPT_INVALID` |
| D4 | Its `decision` is ALLOW | `DEPENDENCY_NOT_ALLOW` |
| D5 | Every declared dependency belongs to one internal transaction | `DEPENDENCY_TRANSACTION_MISMATCH` |
| D6 | `CURRENT_AUTHORITY` only: `now <` the dependency receipt's `expires_at` | `DEPENDENCY_AUTHORITY_EXPIRED` |
| D7 | `CURRENT_AUTHORITY` only: the dependency Grant's Principal is in good standing, the key that signed that Grant is not marked `compromised`, and the Grant's bit is 0 in its Principal's status-list credential; all read before P6, checked in that order; any unavailable → `SERVICE_UNAVAILABLE` | `DEPENDENCY_ISSUER_NOT_TRUSTED` / `DEPENDENCY_ISSUER_KEY_COMPROMISED` / `DEPENDENCY_AUTHORITY_REVOKED` |

Order: P1 … P20 → P21 → D1 … D7 → `[consume]` → T7. The first P21 survivor in Grant order is the authority. `[consume]` is the last step: it runs only when every other check in the order is true, and its answer is the trust check T7 (`delegus-trust-v3`, which also puts the Principal's standing in T1): `consumed` → true, `exhausted` → `AUTHORITY_EXHAUSTED`, `unavailable` → `SERVICE_UNAVAILABLE`. Otherwise T7 is `"skipped"` and nothing is consumed. Each Dn is false if any entry fails it (the first such entry's reason); for `PRIOR_DECISION`, D6 and D7 are `"skipped"`. Declared fingerprints are resolved, and for `CURRENT_AUTHORITY` the dependency Principal's standing, the dependency Grant's key state and its status credential read, in the bracketed step before P6.

The normative text of this table, published at a stable URL, is the **profile document**; its SHA-256 is `protocol.profile_hash` in every v3 receipt. `delegus-base-v1` remains published and frozen; `delegus-base-v2` is superseded by v3 and is not published.