Bridge API

All local and remote tool execution MUST pass through the Bridge Interface.

Common Request Envelope (Replay-Resistant)

Requests SHOULD include:

• session_id

• tool_call_id

• idempotency_key

• domain

• capability

• policy_hash

• timestamp

• nonce

• origin marker

• signature (REQUIRED for remote boundary)

Remote Boundary Requirements

Remote calls MUST:

• Use canonical JSON payloads

• Include nonce and timestamp

• Include idempotency_key

• Include domain signature

Replay resistance:

• Timestamp MUST be within configured window

• Nonce MUST be unique per session

• Reused nonce MUST be rejected