@agenticprimitives/contracts 0.1.0-alpha.2 → 1.0.0-alpha.10

package/src/enforcers/PaymentEnforcer.sol

@@ -0,0 +1,194 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import "../agency/ICaveatEnforcer.sol";
+import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+
+interface IPaymentReceiptRegistry {
+    function record(
+        bytes32 mandateId,
+        address payer,
+        address payee,
+        address asset,
+        uint256 amount,
+        bytes32 resourceHash,
+        bytes32 delegationHash,
+        bytes32 nonce
+    ) external;
+}
+
+/**
+ * @title PaymentEnforcer
+ * @notice x402 pay-per-use caveat enforcer (spec 272, PAY-CON-1). Constrains a redeemed PAYMENT
+ *         delegation to EXACTLY a capped `IERC20.transfer(treasury, amount)`, with a per-delegation
+ *         aggregate spend cap, a windowed frequency cap, and a single-use nonce (on-chain replay
+ *         guard). Fuses smart-agent's AllocationLimit (spend) + RateLimit (window) into one
+ *         `beforeHook` so spend, frequency, and binding are checked ATOMICALLY — a charge that passes
+ *         the rate limit but busts the budget reverts the whole redemption as a unit (spec §2 divergence).
+ *
+ * @dev    terms = abi.encode(
+ *           address treasury, address asset, uint256 maxAmountPerCharge,
+ *           uint256 maxAggregate, uint32 maxRedemptionsPerWindow, uint32 windowSeconds)   // 192 bytes
+ *         args  = abi.encode(bytes32 mandateId, bytes32 nonce, bytes32 resourceHash)
+ *
+ *         State is keyed [delegator][delegationHash] so sibling delegations never cross-interfere
+ *         (a redeemer can't bypass the cap by re-anchoring under a different delegation).
+ *
+ *         Fail-closed (spec §9): wrong/zero asset or treasury, non-`transfer` calldata, wrong
+ *         recipient/amount, ANY cap breach, or a reused nonce reverts and blocks the whole
+ *         `DelegationManager.redeemDelegation`. The state SSTOREs are atomic with the underlying
+ *         transfer — if Phase-2 execution reverts, the budget/nonce writes revert with it.
+ *
+ *         `transfer`-only by construction (spec §163): `target == asset` rejects multicall/router
+ *         targets; the 68-byte length + selector check rejects `transferFrom`/`approve`/extra-arg
+ *         smuggling; `value == 0` rejects ETH; the DelegationManager's single (target,value,data)
+ *         redemption shape rejects batch/delegatecall.
+ */
+contract PaymentEnforcer is ICaveatEnforcer {
+    bytes4 private constant TRANSFER_SELECTOR = IERC20.transfer.selector; // 0xa9059cbb
+
+    struct Budget {
+        uint256 spent; // cumulative against maxAggregate
+        uint64 windowStart; // start of the current frequency window
+        uint32 callsInWindow; // redemptions so far in the current window
+    }
+
+    /// delegator => delegationHash => budget/window state
+    mapping(address => mapping(bytes32 => Budget)) private _budgets;
+    /// delegator => delegationHash => nonce => consumed (on-chain replay guard)
+    mapping(address => mapping(bytes32 => mapping(bytes32 => bool))) private _nonceUsed;
+
+    /// @notice Trustless receipt sink (PAY-CON-4). Immutable; `address(0)` disables registry receipts
+    ///         (the `PaymentCharged` event below is always the primary on-chain receipt).
+    IPaymentReceiptRegistry public immutable receiptRegistry;
+
+    event PaymentCharged(
+        address indexed delegator,
+        bytes32 indexed delegationHash,
+        bytes32 indexed mandateId,
+        address treasury,
+        address asset,
+        uint256 amount,
+        bytes32 nonce,
+        bytes32 resourceHash,
+        uint256 totalSpent,
+        uint32 callsInWindow
+    );
+
+    error InvalidTerms();
+    error ValueNotZero();
+    error AssetMismatch(address expectedAsset, address target);
+    error NotTransferCall();
+    error WrongRecipient(address treasury, address to);
+    error ChargeExceedsMax(uint256 amount, uint256 maxAmountPerCharge);
+    error AggregateExceeded(uint256 spent, uint256 maxAggregate, uint256 amount);
+    error FrequencyExceeded(uint32 callsInWindow, uint32 maxRedemptionsPerWindow);
+    error NonceReused(bytes32 nonce);
+
+    constructor(address receiptRegistry_) {
+        receiptRegistry = IPaymentReceiptRegistry(receiptRegistry_);
+    }
+
+    function beforeHook(
+        bytes calldata terms,
+        bytes calldata args,
+        bytes32 delegationHash,
+        address delegator,
+        address, /*redeemer*/
+        address target,
+        uint256 value,
+        bytes calldata callData
+    ) external override {
+        // ── terms (immutable, set at delegation creation) ──
+        if (terms.length != 192) revert InvalidTerms();
+        (
+            address treasury,
+            address asset,
+            uint256 maxPerCharge,
+            uint256 maxAggregate,
+            uint32 maxPerWindow,
+            uint32 windowSeconds
+        ) = abi.decode(terms, (address, address, uint256, uint256, uint32, uint32));
+        if (
+            treasury == address(0) || asset == address(0) || maxPerCharge == 0 || maxAggregate < maxPerCharge
+                || maxPerWindow == 0 || windowSeconds == 0
+        ) {
+            revert InvalidTerms();
+        }
+
+        // ── calldata MUST be exactly IERC20.transfer(treasury, amount): single call, no ETH ──
+        if (value != 0) revert ValueNotZero();
+        if (target != asset) revert AssetMismatch(asset, target);
+        if (callData.length != 68) revert NotTransferCall(); // 4 + 32 + 32; rejects transferFrom/approve/extra args
+        if (bytes4(callData[0:4]) != TRANSFER_SELECTOR) revert NotTransferCall();
+        (address to, uint256 amount) = abi.decode(callData[4:], (address, uint256));
+        if (to != treasury) revert WrongRecipient(treasury, to);
+        if (amount > maxPerCharge) revert ChargeExceedsMax(amount, maxPerCharge);
+
+        // ── replay: single-use nonce per delegation (on-chain idempotency, PAY-RAIL-4) ──
+        (bytes32 mandateId, bytes32 nonce, bytes32 resourceHash) = abi.decode(args, (bytes32, bytes32, bytes32));
+        if (_nonceUsed[delegator][delegationHash][nonce]) revert NonceReused(nonce);
+        _nonceUsed[delegator][delegationHash][nonce] = true;
+
+        Budget storage b = _budgets[delegator][delegationHash];
+
+        // ── aggregate spend cap (port AllocationLimitEnforcer) ──
+        uint256 nextSpent = b.spent + amount;
+        if (nextSpent > maxAggregate) revert AggregateExceeded(b.spent, maxAggregate, amount);
+
+        // ── windowed frequency cap; roll on expiry (port RateLimitEnforcer) ──
+        uint64 nowTs = uint64(block.timestamp);
+        if (b.windowStart == 0 || nowTs >= b.windowStart + windowSeconds) {
+            b.windowStart = nowTs;
+            b.callsInWindow = 0;
+        }
+        uint32 nextCalls = b.callsInWindow + 1;
+        if (nextCalls > maxPerWindow) revert FrequencyExceeded(b.callsInWindow, maxPerWindow);
+
+        b.spent = nextSpent;
+        b.callsInWindow = nextCalls;
+
+        emit PaymentCharged(
+            delegator, delegationHash, mandateId, treasury, asset, amount, nonce, resourceHash, nextSpent, nextCalls
+        );
+
+        // Trustless settlement receipt (PAY-CON-4). Reverting here reverts the whole redemption, so a
+        // settled charge always has a receipt and an unsettled one never does (atomic).
+        if (address(receiptRegistry) != address(0)) {
+            receiptRegistry.record(mandateId, delegator, treasury, asset, amount, resourceHash, delegationHash, nonce);
+        }
+    }
+
+    function afterHook(bytes calldata, bytes calldata, bytes32, address, address, address, uint256, bytes calldata)
+        external
+        pure
+        override
+    {}
+
+    // ── views (off-chain budget display + idempotency checks) ──
+
+    function getBudget(address delegator, bytes32 delegationHash)
+        external
+        view
+        returns (uint256 spent, uint64 windowStart, uint32 callsInWindow)
+    {
+        Budget storage b = _budgets[delegator][delegationHash];
+        return (b.spent, b.windowStart, b.callsInWindow);
+    }
+
+    function isNonceUsed(address delegator, bytes32 delegationHash, bytes32 nonce) external view returns (bool) {
+        return _nonceUsed[delegator][delegationHash][nonce];
+    }
+
+    /// @notice Encode the immutable caveat terms (mirrors `delegation.buildPaymentMandateCaveats`).
+    function encodeTerms(
+        address treasury,
+        address asset,
+        uint256 maxAmountPerCharge,
+        uint256 maxAggregate,
+        uint32 maxRedemptionsPerWindow,
+        uint32 windowSeconds
+    ) external pure returns (bytes memory) {
+        return abi.encode(treasury, asset, maxAmountPerCharge, maxAggregate, maxRedemptionsPerWindow, windowSeconds);
+    }
+}

package/src/enforcers/QuorumEnforcer.sol

@@ -68,12 +68,23 @@ import "../libraries/SignatureSlotRecovery.sol";
  *      Only the first `threshold` slots are checked. Excess entries
  *      beyond the threshold are ignored — callers SHOULD NOT pad blobs
  *      unnecessarily as calldata cost scales linearly.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.chainid`), `afterHook`
+ *      is `external pure` (empty body); contract has zero storage
+ *      variables. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract QuorumEnforcer is ICaveatEnforcer {
     error InsufficientQuorum(uint256 supplied, uint8 threshold);
     error UnauthorizedSigner(address signer);
     error DuplicateOrUnsortedSigner(address signer);
     error PayloadHashMismatch(bytes32 expected, bytes32 supplied);
+    /// @notice EN-11: a degenerate quorum caveat (threshold 0, or a threshold the
+    ///         signer set can never satisfy) must fail closed, not pass with zero sigs.
+    error InvalidThreshold(uint8 threshold, uint256 signerSetSize);
 
     /// @notice Typehash for the quorum-action binding (contract audit C-4).
     /// @dev Bound to (chainId, enforcer, delegationHash, delegator, redeemer,
@@ -127,6 +138,15 @@ contract QuorumEnforcer is ICaveatEnforcer {
             abi.decode(terms, (address[], uint8, address));
         (bytes32 suppliedPayloadHash, bytes memory signatures) = abi.decode(args, (bytes32, bytes));
 
+        // EN-11: fail closed on a degenerate quorum. threshold == 0 would skip the
+        // verification loop entirely AND make `signatures.length < 0` unreachable, so
+        // the caveat would pass with ZERO signatures. A threshold larger than the
+        // signer set is unsatisfiable; reject it up front rather than running out of
+        // slots mid-loop.
+        if (threshold == 0 || threshold > signerSet.length) {
+            revert InvalidThreshold(threshold, signerSet.length);
+        }
+
         // Contract audit C-4: bind the signed payload to the actual
         // execution context. Previously the redeemer chose payloadHash
         // freely, so a quorum signed off-chain to "approve a transfer

package/src/enforcers/TimestampEnforcer.sol

@@ -8,6 +8,13 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a time window — delegation is only valid between two timestamps.
  * @dev terms = abi.encode(uint256 validAfter, uint256 validUntil)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.timestamp`); contract
+ *      has zero storage. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract TimestampEnforcer is ICaveatEnforcer {
     error TimestampNotYetValid();

package/src/enforcers/ValueEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a maximum ETH value per call.
  * @dev terms = abi.encode(uint256 maxValue)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract ValueEnforcer is ICaveatEnforcer {
     error ValueExceedsLimit();

package/src/geo/GeoFeatureRegistry.sol

@@ -0,0 +1,197 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+/**
+ * @title GeoFeatureRegistry
+ * @notice Versioned PUBLIC geo features — the definition layer of the
+ *         definition-vs-claim model (spec 251). Exact geometry stays OFF chain
+ *         behind `metadataURI`; on chain we anchor a `geometryHash`, coverage +
+ *         source merkle roots, and a COARSE centroid/bbox (UI only).
+ *
+ *   ─── Doctrine ───
+ *
+ * GFR-01 Keyed by Smart Agent ADDRESS (the `stewardAccount`); names are never
+ *        authority (ADR-0010).
+ * GFR-02 Authorization is `msg.sender == stewardAccount` — the steward SA
+ *        publishes through its own `execute()` path. NO `isOwner` staticcall.
+ * GFR-03 Monotonic per-`featureId` versioning; a boundary refresh is a new
+ *        version (claims pin a version, so they don't retroactively re-target).
+ * GFR-04 `featureKind` is a C-box-anchored codelist value (ADR-0009 lockstep).
+ * GFR-05 Geo CLAIMS are NOT on chain — they are verifiable credentials that
+ *        point to a `(featureId, version)` here (spec 251). No GeoClaimRegistry.
+ * GFR-06 NO domain/faith vocabulary (reusable substrate).
+ * GFR-07 NEUTRAL public geography ONLY. A feature is a generic public place
+ *        (planet/region/country/admin area). It is NEVER tagged with — and its
+ *        `metadataURI` NEVER carries — domain or operational data that could
+ *        imply a private presence (e.g. "where a worker operates", access
+ *        sensitivity, ministry context). Sensitivity classification is an
+ *        OFF-chain app/domain policy applied OVER neutral features, never an
+ *        on-chain feature attribute. All metadata MUST be sanitized.
+ * GFR-08 NO on-chain skill↔geo mapping. This registry holds geo features only
+ *        and has ZERO reference to SkillDefinitionRegistry (or any skill id).
+ *        Any "serves skill X in region Y" fact is an off-chain claim/credential.
+ *
+ * Ported from smart-agent `GeoFeatureRegistry`; diverges per spec 251 (AP auth,
+ * C-box-anchored kinds, no name binding in v1).
+ */
+contract GeoFeatureRegistry {
+    // ─── C-box feature-kind codelist (keccak of the cbox URIs) ──────────
+    //   Concept URIs are declared in packages/ontology cbox/geo-vocabulary.ttl
+    //   (scheme apg:geoKind); lockstep-gated against the ontology (ADR-0009).
+    bytes32 public constant KIND_PLANET = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Planet"));
+    bytes32 public constant KIND_REGION = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Region"));
+    bytes32 public constant KIND_COUNTRY = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Country"));
+    bytes32 public constant KIND_ADMIN = keccak256(bytes("https://agenticprimitives.dev/ns/geo#AdminArea"));
+    bytes32 public constant KIND_CUSTOM = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Custom"));
+    int256 public constant COORD_SCALE = 1e7;
+
+    // ─── Errors ─────────────────────────────────────────────────────────
+    error NotSteward();
+    error FeatureNotFound();
+    error EmptyMetadata();
+    error EmptyId();
+
+    // ─── Storage ────────────────────────────────────────────────────────
+    struct FeatureRecord {
+        bytes32 featureId;
+        uint64 version;
+        address stewardAccount;
+        bytes32 featureKind;
+        bytes32 geometryHash; // keccak of canonical GeoJSON (off chain)
+        bytes32 coverageRoot; // merkle root over covering cells (e.g. H3)
+        bytes32 sourceSetRoot; // merkle root over the source dataset
+        string metadataURI;
+        int256 centroidLat; // degrees × 1e7, coarse — UI only
+        int256 centroidLon;
+        int256 bboxMinLat;
+        int256 bboxMinLon;
+        int256 bboxMaxLat;
+        int256 bboxMaxLon;
+        uint64 validAfter;
+        uint64 validUntil;
+        bool active;
+        uint64 registeredAt;
+    }
+
+    mapping(bytes32 => mapping(uint64 => FeatureRecord)) private _records;
+    mapping(bytes32 => uint64) public latestVersion;
+    bytes32[] private _allFeatures;
+
+    // ─── Events ─────────────────────────────────────────────────────────
+    event FeaturePublished(
+        bytes32 indexed featureId,
+        uint64 indexed version,
+        address indexed steward,
+        bytes32 featureKind,
+        bytes32 geometryHash,
+        bytes32 coverageRoot,
+        bytes32 sourceSetRoot,
+        string metadataURI
+    );
+    event FeatureDeactivated(bytes32 indexed featureId, uint64 version);
+    event FeatureValidityChanged(bytes32 indexed featureId, uint64 version, uint64 validAfter, uint64 validUntil);
+
+    // ─── Publish ────────────────────────────────────────────────────────
+    struct PublishInput {
+        bytes32 featureId;
+        bytes32 featureKind;
+        address stewardAccount;
+        bytes32 geometryHash;
+        bytes32 coverageRoot;
+        bytes32 sourceSetRoot;
+        string metadataURI;
+        int256 centroidLat;
+        int256 centroidLon;
+        int256 bboxMinLat;
+        int256 bboxMinLon;
+        int256 bboxMaxLat;
+        int256 bboxMaxLon;
+        uint64 validAfter;
+        uint64 validUntil;
+    }
+
+    function publish(PublishInput calldata p) external returns (uint64 version) {
+        if (p.featureId == bytes32(0)) revert EmptyId();
+        if (bytes(p.metadataURI).length == 0) revert EmptyMetadata();
+        if (msg.sender != p.stewardAccount) revert NotSteward();
+
+        uint64 prevVer = latestVersion[p.featureId];
+        if (prevVer != 0 && _records[p.featureId][prevVer].stewardAccount != p.stewardAccount) {
+            revert NotSteward();
+        }
+
+        version = prevVer + 1;
+        latestVersion[p.featureId] = version;
+        if (prevVer == 0) _allFeatures.push(p.featureId);
+        // The heavy record write + event live in a helper so `publish`'s own stack stays shallow.
+        _storeAndEmit(p, version);
+    }
+
+    /// @dev Writes the record FIELD-BY-FIELD to storage (no in-memory struct literal) and emits.
+    ///      Behaviour is identical to the prior `_records[...] = FeatureRecord({...})` literal; the
+    ///      split exists only to keep `publish` within solc's stack under `forge coverage --ir-minimum`
+    ///      instrumentation (the 18-field memory literal + a dynamic `string` overflowed it by one slot).
+    function _storeAndEmit(PublishInput calldata p, uint64 version) internal {
+        FeatureRecord storage r = _records[p.featureId][version];
+        r.featureId = p.featureId;
+        r.version = version;
+        r.stewardAccount = p.stewardAccount;
+        r.featureKind = p.featureKind;
+        r.geometryHash = p.geometryHash;
+        r.coverageRoot = p.coverageRoot;
+        r.sourceSetRoot = p.sourceSetRoot;
+        r.metadataURI = p.metadataURI;
+        r.centroidLat = p.centroidLat;
+        r.centroidLon = p.centroidLon;
+        r.bboxMinLat = p.bboxMinLat;
+        r.bboxMinLon = p.bboxMinLon;
+        r.bboxMaxLat = p.bboxMaxLat;
+        r.bboxMaxLon = p.bboxMaxLon;
+        r.validAfter = p.validAfter;
+        r.validUntil = p.validUntil;
+        r.active = true;
+        r.registeredAt = uint64(block.timestamp);
+        emit FeaturePublished(p.featureId, version, p.stewardAccount, p.featureKind, p.geometryHash, p.coverageRoot, p.sourceSetRoot, p.metadataURI);
+    }
+
+    function deactivate(bytes32 featureId) external {
+        uint64 v = latestVersion[featureId];
+        if (v == 0) revert FeatureNotFound();
+        FeatureRecord storage r = _records[featureId][v];
+        if (msg.sender != r.stewardAccount) revert NotSteward();
+        r.active = false;
+        emit FeatureDeactivated(featureId, v);
+    }
+
+    function setValidity(bytes32 featureId, uint64 version, uint64 validAfter, uint64 validUntil) external {
+        FeatureRecord storage r = _records[featureId][version];
+        if (r.version == 0) revert FeatureNotFound();
+        if (msg.sender != r.stewardAccount) revert NotSteward();
+        r.validAfter = validAfter;
+        r.validUntil = validUntil;
+        emit FeatureValidityChanged(featureId, version, validAfter, validUntil);
+    }
+
+    // ─── Views ──────────────────────────────────────────────────────────
+    function getFeature(bytes32 featureId, uint64 version) external view returns (FeatureRecord memory) {
+        FeatureRecord memory r = _records[featureId][version];
+        if (r.version == 0) revert FeatureNotFound();
+        return r;
+    }
+
+    function getLatest(bytes32 featureId) external view returns (FeatureRecord memory) {
+        uint64 v = latestVersion[featureId];
+        if (v == 0) revert FeatureNotFound();
+        return _records[featureId][v];
+    }
+
+    /// @notice True if `version` of `featureId` exists (used by off-chain geo claim credentials to
+    ///         confirm the pinned definition version they reference).
+    function exists(bytes32 featureId, uint64 version) external view returns (bool) {
+        return _records[featureId][version].version != 0;
+    }
+
+    function allFeatures() external view returns (bytes32[] memory) {
+        return _allFeatures;
+    }
+}

package/src/governance/AgenticGovernance.sol

@@ -42,15 +42,21 @@ contract AgenticGovernance is IGovernanceView {
     ///         construction; rotate by redeploying.
     address public immutable timelock;
 
-    /// @notice Fast-path emergency-pauser role. Can pause without delay
-    ///         but CANNOT unpause (unpause requires the timelock).
-    address public immutable guardian;
-
     // ─── State ────────────────────────────────────────────────────
 
     bool private _paused;
     mapping(address => bool) private _signers;
 
+    /// @notice Fast-path emergency-pauser role. Can pause without delay but
+    ///         CANNOT unpause (unpause requires the timelock). GOV-1: this is a
+    ///         STORAGE var (not immutable) so the timelock can ROTATE it — a
+    ///         guardian whose key is compromised and grief-pauses the system can
+    ///         be replaced WITHOUT a full governance redeploy, bounding the
+    ///         re-pause DoS to one timelock window instead of "permanent". Set
+    ///         (`setGuardian`) only by the timelock. Declared after the existing
+    ///         storage vars so their slot assignments don't shift.
+    address public guardian;
+
     // ─── Errors ───────────────────────────────────────────────────
 
     error NotTimelock(address caller);
@@ -64,6 +70,8 @@ contract AgenticGovernance is IGovernanceView {
     event Unpaused(address indexed by);
     event SignerSet(address indexed who, bool isSigner);
     event Executed(address indexed target, uint256 value, bytes data);
+    /// @notice GOV-1 — the guardian (fast-pause) role was rotated by the timelock.
+    event GuardianRotated(address indexed oldGuardian, address indexed newGuardian);
 
     // ─── Constructor ──────────────────────────────────────────────
 
@@ -134,6 +142,20 @@ contract AgenticGovernance is IGovernanceView {
         emit SignerSet(who, sig);
     }
 
+    /// @notice GOV-1 — rotate the guardian (fast-pause) role. Timelock-only, so a
+    ///         compromised guardian that is perpetually re-pausing the system can
+    ///         be replaced after one timelock window WITHOUT a governance redeploy.
+    ///         To retire the fast-pause capability entirely, rotate to a burn
+    ///         address. Cannot be the zero address (would make `pause()` an
+    ///         accidental no-op while looking live).
+    function setGuardian(address newGuardian) external {
+        if (msg.sender != timelock) revert NotTimelock(msg.sender);
+        if (newGuardian == address(0)) revert ZeroAddress();
+        address old = guardian;
+        guardian = newGuardian;
+        emit GuardianRotated(old, newGuardian);
+    }
+
     // ─── Receive ETH ──────────────────────────────────────────────
 
     receive() external payable {}

package/src/libraries/SignatureSlotRecovery.sol

@@ -173,9 +173,14 @@ library SignatureSlotRecovery {
                 abi.decode(dyn, (uint256, uint256, bytes32, WebAuthnLib.Assertion));
             address derived = address(uint160(uint256(keccak256(abi.encode(pubX, pubY)))));
             if (derived != signer) revert PasskeyPubKeyMismatch(signer, derived);
-            // requireUv=false at the slot level; account policy can layer UV
-            // requirement via a future policy module.
-            if (!WebAuthnLib.verify(assertion, payloadHash, pubX, pubY, rpIdHash, false)) {
+            // WA-2: require UV at the slot level. This path verifies custody-COUNCIL
+            // passkey signatures (CustodyPolicy quorum: trustees/custodians authorizing
+            // a recovery or admin change) — the highest-assurance signatures in the
+            // system. Consistent with the native ERC-1271 path (AgentAccount, R8.2):
+            // a UP-only assertion is rejected; browser ceremonies for custody signers
+            // MUST use `userVerification: 'required'`. A lower-assurance flow that needs
+            // UP-only must install a separate validator module that relaxes this.
+            if (!WebAuthnLib.verify(assertion, payloadHash, pubX, pubY, rpIdHash, true)) {
                 revert PasskeySigInvalid(signer);
             }
         } else if (v == 27 || v == 28) {

package/src/libraries/WebAuthnLib.sol

@@ -36,6 +36,13 @@ import "./P256Verifier.sol";
  *   PasskeyValidator (for external 1271-style verification).
  */
 library WebAuthnLib {
+    /// @dev secp256r1 (P-256) curve order n ÷ 2 — the low-s malleability bound (WA-1).
+    ///      RIP-7212 accepts BOTH (r, s) and (r, n−s) for the same message, so without
+    ///      this bound a second valid signature always exists. Any path that treats a
+    ///      signature as unique (quorum slot recovery, dedup) would be malleable.
+    uint256 internal constant P256_N_DIV_2 =
+        0x7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8;
+
     /// @notice A WebAuthn-wrapped P-256 signature bundle.
     struct Assertion {
         bytes   authenticatorData;
@@ -74,6 +81,12 @@ library WebAuthnLib {
         if (!_checkClientData(assertion.clientDataJSON, assertion.typeIndex, assertion.challengeIndex, expectedChallengeHash)) {
             return false;
         }
+        // WA-1: enforce low-s. RIP-7212 verifies both (r, s) and (r, n−s); rejecting
+        // the high-s half makes the assertion signature canonical, closing P-256
+        // malleability for every caller (native ERC-1271 + custody-quorum slot recovery).
+        if (assertion.s > P256_N_DIV_2) {
+            return false;
+        }
         bytes32 cdjHash = sha256(bytes(assertion.clientDataJSON));
         bytes32 signingHash = sha256(abi.encodePacked(assertion.authenticatorData, cdjHash));
         return P256Verifier.verify(signingHash, assertion.r, assertion.s, pubX, pubY);