Freeze supplier, search-result, policy-evaluation, and near-miss contracts

Outcome

Adapters and agent-facing tools agree on factual inventory, provider completeness, candidate-local policy evidence, asynchronous result semantics, and execution-time authority.

Scope

• Version AirSupplier and LodgingSupplier ports, normalized immutable offers, repricing, state-changing idempotency/lookup, read-only retry observations, and PII execution context.
• Define deterministic finite AirStub and SimHotel inventory independent of mandate values; soft preferences never suppress inventory.
• Reject malformed/unsupported typed requests, including non-USD, before provider effects with stable factual request violations.
• Define complete, no_matching_offers, and temporarily_unavailable as provider-completeness outcomes rather than trip decisions.
• Put exact offer facts, monetary projections, rule results, freshness, and autonomous|approval_required|prohibited policy snapshots on each candidate in neutral mechanical order.
• Make search_trip plan provider work and return a durable operation/search ID; expose eventual facts through get_search_result without rewriting the command receipt.
• Define factual near-miss payloads without Farewright-generated advice or silent relaxation; policy prohibition is not missing inventory.
• Define non-authorizing CandidateSelected evidence and require completed immutable reprice observations plus atomic execution revalidation of exact selection, request, mandate, access, ledger, and remaining selected-plan commitments.
• Define displayed attempt order and symmetric partial-success behavior for independent air and lodging orders; do not promise unsupported voluntary cancellation.

Acceptance

• Unsupported request/non-USD rejects before provider work; provider outage cannot be represented as no inventory or budget failure.
• complete has at least one matching candidate and no provider failure; no_matching_offers has no candidate/provider failure and factual no-match evidence; temporarily_unavailable has no bookable candidate and at least one sanitized provider failure.
• Every candidate carries offer/version/expiry/material facts, projections, named mandate/ledger snapshot, exact rule results, freshness, and one deterministic policy status.
• Candidate status is prohibited on any hard-rule failure, approval_required when no rule fails but at least one action exceeds threshold, and autonomous otherwise.
• Candidate/offer ordering is replay-stable and mechanical, with no score, ranking, recommendation, preferred alternative, or selection from Farewright.
• Each approval requirement states immutable offer/version, action class, gross amount/currency, threshold, and reason without creating approval or authority.
• CandidateSelected records an eligible current exact selection and attempt order but creates no reservation/effect; prohibited/stale snapshots and material reprice changes require a new confirmed selection.
• Booking consumes completed reprice observations and atomically checks the selected plan's remaining gross commitments so one affordable order cannot bypass a known over-cap combination.
• Search-time autonomous evidence cannot override changed offer, request, mandate, access, or ledger state at execution.
• Stub price/inventory rules cannot inspect cap or approval threshold, and soft preferences do not filter candidates.
• Near misses contain observed hard-request facts only and are sufficient for a host agent to form a new proposal.
• State-changing provider effects have idempotency/lookup proof or remain stub-only; read-only retries create a fresh immutable observation and never masquerade as a lost response.
• Supplier execution PII is ephemeral and never enters events, effects, receipts, logs, projections, or MCP responses.
• Either first-order success is retained honestly if the second order fails; retry/stop behavior does not fabricate rollback or cancellation.

Dependencies

• #6 resolved spec inconsistencies.

Review

Mandatory independent contract-gate review, including agent/core boundary, stale-selection, over-cap plan bypass, no-match, outage, and partial-success examples.

The issue names no files, tests, or entry points; start by reading resolved issue #6 and mapping the contract boundaries implied by the Scope. Done requires satisfying the Acceptance checklist and completing the mandatory independent contract-gate review, including the listed edge cases.