[arpanghoshal]

The ACS half of item 8. This amends SPEC-v0.2 §9, which said "no code, no adapter, no claim" — flagged up front because it also narrows a line in the do-not-build list.

Why the amendment

§9's ruling rested on ACS having no stable interface to build against. Reading the v0.1.0 schemas settled that differently: the envelope, the hook payloads and the five decisions are specified precisely enough to write against, and steps/toolCallResult gives a post-execution checkpoint the earlier draft assumed did not exist.

The no-claim rule is untouched, and it is why the adapter is safe to ship. At the commit read there is no ACS reference implementation and no conformance suite, so there is nothing to be conformant with. "ACS-compatible" appears nowhere in the README, docstrings or CLI output. The do-not-build line narrows from "an ACS adapter or any ACS claim" to "any ACS compliance claim"; ROADMAP's v0.3 standards line records that the adapter landed early.

What was read

GenAI-Security-Project/agent-control-standard at commit c7ad162f69386daac94b89073e3b751e8cdf28b2 (2026-08-11), release v0.1.1, spec version v0.1.0 (decoupled at 1af1f92, same day). Apache-2.0 code, CC BY-SA 4.0 docs.

specification/ACS/acs_schema.json · v0.1.0/request-envelope.json · response-envelope.json · hooks/tool-call-request.json · hooks/tool-call-result.json · ask-details.json · CONTRIBUTING.md. All recorded file-by-file in docs/ACS.md.

Two absences shaped the work: no reference implementation (the README puts a Guardian sample and FastMCP instrumentation at v1), and no examples/ directory, so there is no house format for a community example — examples/acs/ follows CTRLRun's own convention and says so.

The design

ACS is advisory and CTRLRun is executing: a Guardian returns a decision and the platform runs the tool, the opposite way round from @protect. So one action splits across two hooks with the reservation held between them — exactly the shape Suspended and Control.resume were built for in §6.9.

steps/toolCallRequest  → Control.execute(…, executor=raise Suspended(request_id))
                         decided, reserved, held; no outcome, no receipt
                       → allow | deny | ask
steps/toolCallResult   → Control.resume(request_id_ref, executor=report(exit_status))
                       → allow

Control stays the only module that composes the others, and there is still one implementation of v0.1 §5.5's asymmetry.

exit_status is success | failure | timeout | blocked, and ACS says nothing about what any of them means for a side effect. The fail-closed reading is §6.8's: success committed, blocked failed (a control refused before dispatch), failure and timeout unknown — because a tool that failed after acting and one that failed before send the same string.

Of ACS's 22 hooks the adapter answers two and declines twenty. The rest are checkpoints about what the model is thinking, remembering or composed of; the product rule is that CTRLRun decides actions that affect the real world, so an unanswered method returns a JSON-RPC error in ACS's reserved range rather than an opinion.

ask_details.intent_extension is not used: it grants capabilities for a session, which is an authority model CTRLRun does not have until v0.3, and a grant it cannot represent is one it must not claim to honour.

Where ACS is silent

docs/ACS.md sets this out at length; the short version is five gaps — no effect identity, exit_status describing the call rather than the effect, no binding of an approval to a canonical action, no terminal unknown state, and a Guardian that cannot make reserve-and-execute atomic because it does not execute.

Mutation table — 30 mutations, all red

#	Group	Result
M1–M6	the exit_status mapping, incl. the inversion, and not_executed_on_error	red
M7–M9	results with no ref, no match; the request hook suspends rather than completing	red
M10–M17	the decision mapping, ask_details, approval re-presentation, mutation refusal	red
M18–M25	argument unwrapping, principal, action naming, resource template	red
M26–M30	envelope validation, reserved error range, echoed ids, the result hook's allow	red

Seven started green, five of them genuinely untested paths — the most useful being that not_executed_on_error reached across to timeout. That flag is an operator's assertion about errors; a timeout is not an error the tool reported, it is the absence of any report, and no per-tool claim can speak for it. Nothing tested that boundary.

The other two are the familiar subsumed-guard shape and stay for their messages: a missing agent_id would be refused by Principal too, but this refusal names the ACS field a producer has to fix.

Not in this PR

The OTel sink (T29) and T30's named test — item 8's other half. docs/ACS.md explains why the OTel attribute alignment is deliberately not written: it would be a compliance claim with nothing behind it, and receipts already written carry the current names.

Drafted, not posted

Three documents in internal/owasp/ (git-excluded, as internal/ always is):

• acs-issue.md — the execution-outcome gap in ACS's own terms, with the concrete duplicate-refund trace and a proposed extension shape (optional effect_id, a three-state effect_outcome, an action_digest on ask_details). CTRLRun is named once as one reference implementation alongside Stripe/Adyen idempotency keys and Temporal. CONTRIBUTING.md says schema changes open a Discussion first, not an issue, so it is written to be pasted there.
• slack-intro.md — four sentences.
• top10-contribution.md — mitigation paragraphs for ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse and ASI09 Human-Agent Trust Exploitation, in the Top 10's register, each with a reference scenario from the demos. It flags that section numbers and file paths must be checked against the live document before filing, and that ASI08 is a plausible fourth home that would weaken both if duplicated.

Nothing has been posted anywhere.

Verification

1241 tests pass (1207 → 1241), mypy --strict src/, ruff check and ruff format --check clean. import ctrlrun imports neither ctrlrun.acs, httpx, ssl nor ctrlrun.gateway. examples/acs/main.py runs with no network.