# What the runtime checks

Follow a call from transport context to handler execution, then understand the limits of each guard.

Source context: Source-guided
Source: https://github.com/lssm-tech/contractspec/blob/d58fa5b7de53a947811e5cc68346be028ce18528/packages/foundation/contracts-runtime-kernel/src/operations/prepare.ts

## Follow the execution boundary

A registered call resolves an operation and its bound handler, prepares the input and execution context, invokes the handler, and validates the returned value. The exact checks depend on the contract and the ports supplied by the host.

At the inspected snapshot, preparation parses input first. Policy decisions run when ctx.decide is provided. Explicit approval and ceremony requirements are checked before control reaches the handler.

| Boundary | What is checked | Dependency |
| --- | --- | --- |
| Adapter authentication | A non-anonymous operation has an authenticated subject | Trusted host context |
| Input validation | The request matches the declared schema | Operation input model |
| Policy decision | The configured decision allows the operation | Host decision port |
| Scoped approval | Required evidence and approval runtime are present and authorize the request | Declared approval plus host verifier |
| Output validation | The returned value matches the declared output | Handler result and output model |

## Supply trusted context

Do not construct trusted identity from an arbitrary role, tenant or user field in the request body. The host should resolve the caller using its own authentication mechanism and then provide the corresponding context.

The runtime's conditional policy hook is significant: writing requirements in a contract does not install a policy engine into the host. Test your actual context factory and decision port, not only the declaration.

## Know where protection stops

The runtime can prevent a handler from starting when an applicable precondition fails. Once a handler starts, its database calls and provider effects still need application-level transaction and retry behavior.

Output validation happens after the handler returns. Rejecting an invalid result does not automatically undo a database change or external request the handler already made. For consequential effects, design persistence and recovery explicitly.

## Distinguish execution from evidence

The invocation path provides a guarded event publisher for declared events and validates emitted payloads. The host still supplies the publisher. A direct network call made elsewhere is not made safe merely by declaring an event.

Likewise, operational telemetry is useful evidence about execution, but it is not a substitute for an authorization decision or a durable audit record. Keep those responsibilities visible in the architecture and in tests.

## Related examples

- [Stop a write before it runs](https://lssm.co/examples/required-approval/): Trace a REST request through an approval gate and inspect the zero-handler-call denial assertion.