Permissionless checkpoint — policies, allowlists, intents, activity.
Build calldata, preview selector/dataHash, sign EIP-712, and call executeWithUserSig.