VENDOR EXECUTION-CONTROL CONTRACT · V1

One emergency stop for MandateShield-mediated execution.

The Global Execution Interlock is an authenticated account control that blocks new MandateShield-mediated payment authority while preserving the evidence paths needed to resolve work already in flight.

NORMATIVE SCOPE

PAUSE governs execution, not analysis or evidence

A committed PAUSE prevents three new operations for the complete MandateShield account: strict execution-authority reservation, PROCESSOR CONSUME, and online execution-permit redemption. The predicate is account-scoped, so no agent identity, API key, protocol label, provider profile or provider account inside that MandateShield account can override it.

Receipt verification, terminal outcome reporting, provider evidence ingestion, reconciliation, COMMIT, RELEASE and due expiry remain available. These operations do not grant a new provider submission; they let an already-started attempt converge on a truthful final state.

ATOMIC RACE RULE

The pause and a new execution step cannot both win afterward

Every gated execution mutation and every interlock transition checks and changes durable account state in one serialized database transaction. If PAUSE commits first, a competing reservation, CONSUME or redemption must fail and roll back. If the execution mutation commits first, that operation won before the pause and the later pause cannot recall it.

An execution response recovered with the same idempotency key does not create a second mutation. While paused, a prior strict reservation is returned as archival-only, a prior CONSUME replay cannot grant a fresh direct-submission permission, and an already claimed permit can return only its same-claim recovery result.

FAIL-CLOSED INTEGRITY

Missing or malformed control state never means RUNNING

Migration creates an explicit RUNNING row for every existing account, and a database trigger creates the same row for each future account. Execution boundaries require that exact row and its append-only transition evidence. Missing, contradictory or corrupt state is treated as PAUSED with integrity status FAIL_CLOSED.

Each real transition increments a monotonic generation and appends an account-owner session event. A stale dashboard generation cannot resume over a newer pause. PAUSE remains available even when legal acceptance is stale; RESUME requires a verified current acceptance.

CONTROL API

Session-authenticated, same-origin and compare-and-set

  • GET /api/account/execution-interlock returns current state, generation, integrity and the exact coverage boundary.
  • POST /api/account/execution-interlock accepts only {"action":"PAUSE", "expected_generation":3} or the corresponding RESUME.
  • Mutations require the authenticated account-owner session and a trusted same-origin request. API keys and agents cannot call this control plane.
  • A generation mismatch returns a conflict rather than applying a stale transition.

The same control is visible at the top of the authenticated MandateShield dashboard.

ASSURANCE BOUNDARY

This is a MandateShield enforcement point, not remote recall

The interlock governs execution that passes through the documented MandateShield reservation, consumption and redemption path. It cannot stop customer code that bypasses MandateShield, revoke a request already accepted by a payment provider, or prove that a customer deployed every integration without an alternate path. Customers must keep provider credentials behind the documented Gate boundary if they want MandateShield to be the required path.

This vendor-authored specification is not an independent audit, certification, provider guarantee or claim that MandateShield can control third-party infrastructure.