SOURCE RECOVERY for the SAME immutable R3 candidate. Your attachment view truncated code; this message provides literal code directly. There are 9 fragments. Do not audit until the final fragment; reply only ACK 1/9 if the entire fragment is visible. No tools.
BEGIN action_bundle.py fragment 1/9
# Generated by build_bundle.py. Edit source modules, regenerate, then test.

# SOURCE: action.py
"""Enterprise Action Requests 0.1.0 candidate: a bounded synthetic local adapter.

Host administration, authenticated actor IDs, time, policy verification and file
access are TRUSTED fixture inputs, not production authentication. No network,
shell, financial, personnel or other real-world effect is supported.
"""
from contextlib import contextmanager
from pathlib import Path
import hashlib
import json
import re
import sqlite3
import uuid
from jsonschema import Draft202012Validator

MAX_BYTES=131072
MAX_ROWS=10000
SCHEMA=json.loads(Path(__file__).with_name('action.schema.json').read_text(encoding='utf-8'))
WITHHELD={'status':'withheld'}
STATES={'pending','committed','cancelled','expired','rejected-precondition'}

class Refused(ValueError): pass
class ResponseLost(RuntimeError): pass

def require(condition, code):
    if not condition: raise Refused(code)

def _bounded(value, depth=0):
    require(depth<=24,'wire-depth')
    if value is None or type(value) is bool: return
    if type(value) is int:
        require(abs(value)<=9007199254740991,'wire-integer'); return
    if type(value) is str:
        require(len(value)<=4096 and not any(0xD800<=ord(c)<=0xDFFF for c in value),'wire-string'); return
    if type(value) is list:
        require(len(value)<=256,'wire-array')
        for item in value: _bounded(item,depth+1)
        return
    if type(value) is dict:
        require(len(value)<=128 and all(type(k) is str for k in value),'wire-object')
        for k,v in value.items(): _bounded(k,depth+1); _bounded(v,depth+1)
        return
    raise Refused('wire-type')

def encoded(value):
    """Python code-point sorted, ordered arrays, UTF-8; explicitly NOT JCS."""
    _bounded(value)
    result=json.dumps(value,ensure_ascii=False,sort_keys=True,separators=(',',':'),allow_nan=False).encode('utf-8')
    require(len(result)<=MAX_BYTES,'wire-bytes')
    return result

def digest(value): return hashlib.sha256(encoded(value)).hexdigest()

def _pairs(items):
    result={}
    for k,v in items:
        require(k not in result,'duplicate-key'); result[k]=v
    return result

def parse(raw):
    require(type(raw) in (str,bytes),'wire-input')
    try:
        if isinstance(raw,bytes): raw=raw.decode('utf-8',errors='strict')
        require(len(raw.encode('utf-8'))<=MAX_BYTES,'wire-bytes')
        def bad(_): raise Refused('wire-number')
        value=json.loads(raw,object_pairs_hook=_pairs,parse_float=bad,parse_constant=bad)
        encoded(value)
        return value
    except (UnicodeError,json.JSONDecodeError,RecursionError): raise Refused('wire-json') from None

def validate(kind, value):
    encoded(value)
    validator=Draft202012Validator({'$ref':'#/$defs/'+kind,'$defs':SCHEMA['$defs']})
    require(not list(validator.iter_errors(value)),'schema-'+kind)
    if kind=='ActionDefinition':
        require(value['validFrom']<value['validUntil'],'definition-window')
        if value['mode']=='synthetic-executable':
            require(value['parameterContract']=='ordered-label-list/1' and value['targetType']=='urn:vercy:synthetic:OrderedLabelResource' and value['adapter']=='local-sqlite-ordered-labels/1' and value['compensation']=='new-request-restores-before-labels-at-exact-after-revision','executable-definition')
            require(value['precondition']=='resource-revision-and-retained-compensation-v1' and value['effectBoundary']=='local-atomic-ordered-label-replacement-v1','executable-boundary')
        else:
            require(type(value['parameterContract']) is dict and value['adapter']=='none' and value['compensation']=='external-unspecified','descriptive-definition')
    if kind=='Policy':
        for rule in value:
            require((rule['actorId']==rule['principalId'])==(rule['mode']=='self'),'representation-mode')
            for name in ('principalScope','delegateScope'):
                require(rule[name]['validFrom']<rule[name]['validUntil'],'scope-window')
    return value

def definition_ref(definition):
    validate('ActionDefinition',definition)
    return {'definitionId':definition['definitionId'],'version':definition['version'],'sha256':digest(definition)}

def matching_rules(policy,intent,action,now):
    matches=[]
    for rule in policy:
        if (rule['actorId'],rule['principalId'])!=(intent['actorId'],intent['principalId']): continue
        def contains(scope):
            return all(scope[k]==intent[k] for k in ('dimensionId','definition','resourceId','purpose','audience')) and action in scope['actions'] and scope['validFrom']<=now<scope['validUntil']
        if contains(rule['principalScope']) and contains(rule['delegateScope']): matches.append(digest(rule))
    return sorted(set(matches))

def _json(value): return encoded(value).decode('utf-8')
def _id(prefix): return prefix+'.'+uuid.uuid4().hex

SQL='''
CREATE TABLE meta (id INTEGER PRIMARY KEY CHECK(id=1), dimension TEXT NOT NULL, issuer TEXT NOT NULL, epoch TEXT NOT NULL, clock INTEGER NOT NULL, policy_revision INTEGER NOT NULL, control_sequence INTEGER NOT NULL);
CREATE TABLE definitions (id TEXT NOT NULL, version TEXT NOT NULL, body TEXT NOT NULL, digest TEXT NOT NULL, available INTEGER NOT NULL, recorded_at INTEGER NOT NULL, control_sequence INTEGER NOT NULL, retired_sequence INTEGER, ordinal INTEGER PRIMARY KEY AUTOINCREMENT, UNIQUE(id,version));
CREATE TABLE policies (revision INTEGER PRIMARY KEY, body TEXT NOT NULL, recorded_at INTEGER NOT NULL, control_sequence INTEGER NOT NULL);
CREATE TABLE resources (id TEXT NOT NULL, revision INTEGER NOT NULL, labels TEXT NOT NULL, recorded_at INTEGER NOT NULL, control_sequence INTEGER NOT NULL, PRIMARY KEY(id,revision));
CREATE TABLE requests (id TEXT PRIMARY KEY, slot TEXT UNIQUE NOT NULL, body TEXT NOT NULL);
CREATE TABLE events (sequence INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT UNIQUE NOT NULL, body TEXT NOT NULL);
'''

class Executor:
    """One database is the autho
END fragment 1/9