Put governance in the path.

import hashlib
import secrets
from pathlib import Path
from tempfile import TemporaryDirectory

from hummbl_governance import DelegationTokenManager, ReceiptEngine

secret = secrets.token_bytes(32)  # Load a stable key in production.
contract = {"id": "summary-v1", "operations": ["summarize"]}
task_id = "task-42"

# AUTHORIZE — issue and validate scoped delegated authority.
tokens = DelegationTokenManager(secret)
dct = tokens.issue(
    issuer="orchestrator",
    subject="summarizer-agent",
    operations=contract["operations"],
    resources=["docs/report.md"],
    task_id=task_id,
    contract_id=contract["id"],
)
allowed, reason = tokens.validate_token(
    dct,
    expected_task_id=task_id,
    expected_contract_id=contract["id"],
    expected_subject="summarizer-agent",
)
if not allowed:
    raise PermissionError(f"Delegated authority denied: {reason}")

# EXECUTE — your runtime performs the authorized action.
source = "Bounded authority makes agent actions reviewable."
result = " ".join(source.split()[:5])

# RECORD + BIND + VERIFY — authenticate the tuple and verify its chain.
with TemporaryDirectory() as state:
    receipts = ReceiptEngine(Path(state), signing_secret=secret)
    receipt = receipts.create_and_store(
        agent_id=dct.subject,
        action_type="summarize",
        payload={
            "contract": contract,
            "dct": dct.to_dict() | {"signature": dct.signature},
            "evidence": {
                "outcome": "completed",
                "output_sha256": hashlib.sha256(result.encode()).hexdigest(),
            },
        },
    )
    if not receipts.validate(receipt):
        raise RuntimeError("Receipt authentication failed")
    chain_valid, chain_reason = receipts.verify_chain(dct.subject)
    if not chain_valid:
        raise RuntimeError(f"Receipt chain failed: {chain_reason}")