# Complete Effect Mediation — source-only profile

Profile: `bulla.complete-effect-mediation/0.1-experimental`

This profile evaluates one closed receiver-owned lock for one protected
`sandbox.append` state transition. It does not define a generic lock language,
compiler, stable Bulla API, installed capability, or production deployment.

The receiver issues an ActionReceipt with action type `effect.grant.issue`. A
redemption uses `bulla.effect-redemption/0.1-experimental` and carries the exact
grant, mandate and boundary-decision receipts, canonical AuthZEN request and
response objects, exact effect arguments, receiver nonce and recomputed evidence
bundle root. The locked target verifies those records under receiver-pinned
context before it changes state. A signed `PERMIT` is evidence; it is not effect
authority by itself. The authoritative use limit is the receiver's persisted
`UNSPENT` grant state, not portable grant bytes.

The accepted context binds the exact receiver, authorization and boundary role
set, a role-set-derived authority epoch, and the exact declared runtime-graph
root. The receiver also enforces one terminal standing record for the semantic
grant identifier and nonce, independently of an attestation hash.

## Laws evaluated

1. **Complete Effect Mediation:** every path to the protected append in the
   declared fixture graph crosses target verification and grant consumption in
   that order.
2. **Record Recurrence:** every committed append creates an exact signed
   `effect.execute` ActionReceipt binding the grant, redemption, effect,
   receiver, target, accepted context and before/after state roots.

The graph result is about the closed declared route and transition registry. It
does not establish completeness of source code, deployment, platform
administration, credentials, or external effects.
