PFC delegation chain governing MCP connector calls, pre-effect gating, scope containment, mid-run revocation that fails closed, signed Ed25519 receipts. Reference implementation, v0.13.