LoopGrid Core signs evidence independently of the Pydantic AI runtime. The capability captures native events; the host authenticates identity, evaluates policy, approves actions, and verifies downstream receipts.

Execution boundary. Each consequential action binds to one decision, a versioned host policy, exact tool name/arguments and a bounded invocation count. Native tool execution is refused unless trusted policy and any required host-validated human approval are already recorded. Use Pydantic AI's deferred approval for the UI/agent pause; DeferredToolResults alone does not authenticate reviewer identity.

Authorization store. Default InMemoryAuthorizationStore is process-local. Optional SQLiteAuthorizationStore persists reservations across restarts and atomically coordinates multiple local processes sharing a single local disk. Protect the database and its directory with OS permissions. SQLite on a shared network drive, cross-host coordination, and untrusted storage are not supported. For multi-host production systems, use an application-owned atomic authorization service/ledger instead. The Core event write and store transition are separate operations; an interrupted transition must fail closed and be reconciled rather than guessed.

Tool failure and partial evidence. A tool exception preserves its original type and leaves the reservation spent; it must not generate a tool_executed success claim. When a tool returned but its result could not be committed or the Core post-execution write failed, EvidencePersistenceError explicitly identifies that the action occurred and requires receipt-based reconciliation before any retry. The integration does not currently emit a signed tool_failed event because it cannot assume that event type is accepted by the existing Core. Persist failure/audit details in the host's own secure operations log and verify external receipts before recording outcome_observed.

Instrumentation scope. Only tools executed through this capability are intercepted. Direct host actions, tool-output functions, external/deferred tools, and other agent entry points need host-side instrumentation. Pydantic's own observability and model-level safety remain separate controls.

Data and proofs. Model responses and tool input/output use SHA-256 commitments instead of including raw values in middleware events. The host's initial decision data and outcome may contain values, so apply the application's privacy and retention policies. A signed bundle proves integrity and provenance of captured evidence, not that an event was never omitted or that an unverified host assertion is true. Never use model-generated policy verdicts, review identities, or outcome receipts as proof of authority.