What the runtime checks
Follow a call from transport context to handler execution, then understand the limits of each guard.
Source and verification context ⌄
Source-guided
Inspect the source ↗Repository links may require access. Source inspection is separate from a clean public-package installation.
Get the shape of this guide.
Move through the ideas, inspect their relationships, or make a focused reading path. The complete guide stays below.
Follow the execution boundary
A registered call resolves an operation and its bound handler, prepares the input and execution context, invokes the handler, and validates the returned value. The exact checks depend on the contract and the ports supplied by the host.
Read the supporting context
At the inspected snapshot, preparation parses input first. Policy decisions run when ctx.decide is provided. Explicit approval and ceremony requirements are checked before control reaches the handler.
Explore a section, then continue with the complete article below.
Follow the execution boundary
A registered call resolves an operation and its bound handler, prepares the input and execution context, invokes the handler, and validates the returned value. The exact checks depend on the contract and the ports supplied by the host.
At the inspected snapshot, preparation parses input first. Policy decisions run when ctx.decide is provided. Explicit approval and ceremony requirements are checked before control reaches the handler.
| Boundary | What is checked | DEPENDENCY |
|---|---|---|
| Adapter authentication | A non-anonymous operation has an authenticated subject | Trusted host context |
| Input validation | The request matches the declared schema | Operation input model |
| Policy decision | The configured decision allows the operation | Host decision port |
| Scoped approval | Required evidence and approval runtime are present and authorize the request | Declared approval plus host verifier |
| Output validation | The returned value matches the declared output | Handler result and output model |
Supply trusted context
Do not construct trusted identity from an arbitrary role, tenant or user field in the request body. The host should resolve the caller using its own authentication mechanism and then provide the corresponding context.
The runtime's conditional policy hook is significant: writing requirements in a contract does not install a policy engine into the host. Test your actual context factory and decision port, not only the declaration.
Know where protection stops
The runtime can prevent a handler from starting when an applicable precondition fails. Once a handler starts, its database calls and provider effects still need application-level transaction and retry behavior.
Output validation happens after the handler returns. Rejecting an invalid result does not automatically undo a database change or external request the handler already made. For consequential effects, design persistence and recovery explicitly.
Find the point where the handler can begin.Trace the mechanism · 3 ways to look closer＋
Take an operation that explicitly requires approval. Change one condition and inspect the expected path from the captured runtime guide.
Input preparation stops the path early.
The request omits an input required by the operation schema.
Parse and validate the request against the declared schema.
The request cannot become a valid prepared input.
No visible button or descriptive tag makes the missing value valid.
A denial test for approval should use otherwise valid input, so it actually reaches the approval boundary.
Where this explanation comes from
An authored situation, grounded in the linked source guides. Choosing a case explores its expected responsibilities; it does not execute an operation.
Distinguish execution from evidence
The invocation path provides a guarded event publisher for declared events and validates emitted payloads. The host still supplies the publisher. A direct network call made elsewhere is not made safe merely by declaring an event.
Likewise, operational telemetry is useful evidence about execution, but it is not a substitute for an authorization decision or a durable audit record. Keep those responsibilities visible in the architecture and in tests.