Broker Runtime
Phase IV · V3 — Given an authorized ApprovalToken and a binding Policy allow, how is execution brokered and handed off to the Provider Execution runtime (V4) without executing anything? The Broker is the last gate before any provider acts, the first runtime whose decisions are BINDING. Fail-closed; single-use token consumption; executes nothing. Read-only.
The Universal Broker Runtime is the execution gate: it consumes an authorized ApprovalToken (V2), re-verifies the CapabilityPlan (V1.5), requires a BINDING Policy allow (M41 — this is where Policy becomes binding), re-verifies required Vault secret references (V1 — releasing nothing), re-derives and matches the token scope hash, and single-use-consumes the token. Everything defaults to DENY: an unauthorized approval, an expired or already-consumed token, a non-binding or mismatched policy, a revoked vault reference, or scope drift fails closed. On success it issues a single-use, binding, unexecuted BrokerGrant carrying a ProviderExecutionHandoff to the future Provider Execution runtime (V4) — which requires the grant before any provider executes. The Broker chooses no providers, releases no secrets, dispatches nothing, and executes nothing.