@agenticprimitives/contracts 0.1.0-alpha.3 → 1.0.0-alpha.5

package/src/custody/CustodyPolicy.sol

@@ -4,6 +4,22 @@ pragma solidity ^0.8.28;
 import {IAgentAccount, AgentAccountRecoveryArgs, AgentAccountRecoveryPasskeyAdd} from "../IAgentAccount.sol";
 import {SignatureSlotRecovery} from "../libraries/SignatureSlotRecovery.sol";
 
+/// @dev R6.6 — minimal interface for the `account → factory → governance.isPaused()`
+///      staticcall chain. Mirrors the same patterns introduced by R6.5
+///      in `AgentAccount` (see `IAgentAccountFactoryView` /
+///      `IAgentAccountPauseView` in `AgentAccount.sol`).
+interface IAgentAccountFactoryAccessor {
+    function factory() external view returns (address);
+}
+
+interface ICustodyPolicyFactoryView {
+    function governance() external view returns (address);
+}
+
+interface ICustodyPolicyPauseView {
+    function isPaused() external view returns (bool);
+}
+
 /**
  * @title CustodyPolicy
  * @notice ERC-7579 module that owns the schedule / apply / cancel
@@ -125,6 +141,64 @@ contract CustodyPolicy {
         _CACHED_DOMAIN_SEPARATOR = _buildDomainSeparator();
     }
 
+    // ─── R6.6 / CON-CustodyPolicy-005 — system-pause modifier ──────
+    //
+    //   `whenAccountNotPaused(account)` reverts when
+    //   `AgenticGovernance.isPaused() == true`, where governance is
+    //   resolved per-call via the account's factory:
+    //
+    //       account.factory() → factory.governance() → governance.isPaused()
+    //
+    //   3 staticcalls. Custody schedule/apply are rare; the gas cost
+    //   is acceptable. Non-conforming hops (EOA factory, EOA governance,
+    //   missing fn) treat the system as "not paused" so legacy / test
+    //   deploys keep working — mirrors the R6.5 pattern in AgentAccount
+    //   and `GovernanceManaged._pausedSafe()`.
+    //
+    //   Applied to: `scheduleCustodyChange`, `applyCustodyChange`.
+    //
+    //   Deliberately NOT applied to (recovery primitives that must
+    //   work during an incident):
+    //     - `cancelScheduledChange` — defensive de-escalation
+    //     - `onUninstall`           — removing attack surface
+    //     - `onInstall`              — gated upstream by paused
+    //                                   `installModule` on AgentAccount (R6.5)
+    //                                   and paused `createAgentAccount`
+    //                                   on AgentAccountFactory
+    modifier whenAccountNotPaused(address account) {
+        if (_systemPausedFor(account)) revert SystemPaused();
+        _;
+    }
+
+    /// @notice R6.6 — thrown when a `whenAccountNotPaused`-guarded
+    ///         entrypoint is called while the governance pause flag
+    ///         is set.
+    error SystemPaused();
+
+    function _systemPausedFor(address account) internal view returns (bool) {
+        if (account == address(0) || account.code.length == 0) return false;
+        // Hop 1: account → factory
+        (bool okF, bytes memory dataF) = account.staticcall(
+            abi.encodeWithSelector(IAgentAccountFactoryAccessor.factory.selector)
+        );
+        if (!okF || dataF.length < 32) return false;
+        address fac = abi.decode(dataF, (address));
+        if (fac == address(0) || fac.code.length == 0) return false;
+        // Hop 2: factory → governance
+        (bool okG, bytes memory dataG) = fac.staticcall(
+            abi.encodeWithSelector(ICustodyPolicyFactoryView.governance.selector)
+        );
+        if (!okG || dataG.length < 32) return false;
+        address gov = abi.decode(dataG, (address));
+        if (gov == address(0) || gov.code.length == 0) return false;
+        // Hop 3: governance → isPaused
+        (bool okP, bytes memory dataP) = gov.staticcall(
+            abi.encodeWithSelector(ICustodyPolicyPauseView.isPaused.selector)
+        );
+        if (!okP || dataP.length < 32) return false;
+        return abi.decode(dataP, (bool));
+    }
+
     function _buildDomainSeparator() internal view returns (bytes32) {
         return keccak256(
             abi.encode(
@@ -335,7 +409,7 @@ contract CustodyPolicy {
         CustodyAction action,
         bytes calldata args,
         bytes calldata quorumSigs
-    ) external returns (uint256 changeId) {
+    ) external whenAccountNotPaused(account) returns (uint256 changeId) {
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
 
@@ -394,7 +468,10 @@ contract CustodyPolicy {
         emit CustodyChangeScheduled(account, changeId, action, eta, msg.sender);
     }
 
-    function applyCustodyChange(address account, uint256 changeId, bytes calldata quorumSigs) external {
+    function applyCustodyChange(address account, uint256 changeId, bytes calldata quorumSigs)
+        external
+        whenAccountNotPaused(account)
+    {
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
 

package/src/enforcers/AllowedMethodsEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Restricts delegated calls to specific function selectors.
  * @dev terms = abi.encode(bytes4[] allowedSelectors)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract AllowedMethodsEnforcer is ICaveatEnforcer {
     error MethodNotAllowed();

package/src/enforcers/AllowedTargetsEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Restricts delegated calls to a specific set of target contracts.
  * @dev terms = abi.encode(address[] allowedTargets)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract AllowedTargetsEnforcer is ICaveatEnforcer {
     error TargetNotAllowed();

package/src/enforcers/CallDataHashEnforcer.sol

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import "../agency/ICaveatEnforcer.sol";
+
+/**
+ * @title CallDataHashEnforcer
+ * @notice Pins a delegation to EXACTLY one calldata payload — the exact-call
+ *         binding ADR-0027 / spec 249 (RW1-4b) needs for sensitive ops.
+ * @dev terms = abi.encode(bytes32 expectedHash), where
+ *      `expectedHash == keccak256(callData)` for the single call this
+ *      delegation authorizes. `beforeHook` recomputes `keccak256(callData)`
+ *      and reverts on mismatch.
+ *
+ *      Ported from smart-agent's `CallDataHashEnforcer` (the "P4 — sensitive
+ *      ops require exact-call sub-delegation" doctrine). Combined with
+ *      `AllowedTargetsEnforcer` (target) + a tight `TimestampEnforcer`
+ *      window + `ValueEnforcer`, a consent sub-delegation can pin the precise
+ *      call — not merely its selector — so a registry that checks
+ *      `DelegationManager.verifyAuthorizationForCall(...)` binds consent to the
+ *      exact assertion being stored (RW1-1).
+ *
+ *      R6.7 — Stateless validator: hooks are `pure`, the contract has zero
+ *      storage, so no `whenNotPaused` is needed; the DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch, and the read-only `verifyAuthorizationForCall` evaluates it
+ *      via `staticcall`.
+ */
+contract CallDataHashEnforcer is ICaveatEnforcer {
+    error BadTermsLength();
+    error CallDataMismatch(bytes32 expected, bytes32 actual);
+
+    function beforeHook(
+        bytes calldata terms,
+        bytes calldata,
+        bytes32,
+        address,
+        address,
+        address,
+        uint256,
+        bytes calldata callData
+    ) external pure override {
+        if (terms.length != 32) revert BadTermsLength();
+        bytes32 expected = abi.decode(terms, (bytes32));
+        bytes32 actual = keccak256(callData);
+        if (expected != actual) revert CallDataMismatch(expected, actual);
+    }
+
+    function afterHook(
+        bytes calldata,
+        bytes calldata,
+        bytes32,
+        address,
+        address,
+        address,
+        uint256,
+        bytes calldata
+    ) external pure override {
+        // No post-execution check needed.
+    }
+}

package/src/enforcers/QuorumEnforcer.sol

@@ -68,6 +68,14 @@ import "../libraries/SignatureSlotRecovery.sol";
  *      Only the first `threshold` slots are checked. Excess entries
  *      beyond the threshold are ignored — callers SHOULD NOT pad blobs
  *      unnecessarily as calldata cost scales linearly.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.chainid`), `afterHook`
+ *      is `external pure` (empty body); contract has zero storage
+ *      variables. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract QuorumEnforcer is ICaveatEnforcer {
     error InsufficientQuorum(uint256 supplied, uint8 threshold);

package/src/enforcers/TimestampEnforcer.sol

@@ -8,6 +8,13 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a time window — delegation is only valid between two timestamps.
  * @dev terms = abi.encode(uint256 validAfter, uint256 validUntil)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.timestamp`); contract
+ *      has zero storage. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract TimestampEnforcer is ICaveatEnforcer {
     error TimestampNotYetValid();

package/src/enforcers/ValueEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a maximum ETH value per call.
  * @dev terms = abi.encode(uint256 maxValue)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract ValueEnforcer is ICaveatEnforcer {
     error ValueExceedsLimit();

package/src/geo/GeoFeatureRegistry.sol

@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+/**
+ * @title GeoFeatureRegistry
+ * @notice Versioned PUBLIC geo features — the definition layer of the
+ *         definition-vs-claim model (spec 251). Exact geometry stays OFF chain
+ *         behind `metadataURI`; on chain we anchor a `geometryHash`, coverage +
+ *         source merkle roots, and a COARSE centroid/bbox (UI only).
+ *
+ *   ─── Doctrine ───
+ *
+ * GFR-01 Keyed by Smart Agent ADDRESS (the `stewardAccount`); names are never
+ *        authority (ADR-0010).
+ * GFR-02 Authorization is `msg.sender == stewardAccount` — the steward SA
+ *        publishes through its own `execute()` path. NO `isOwner` staticcall.
+ * GFR-03 Monotonic per-`featureId` versioning; a boundary refresh is a new
+ *        version (claims pin a version, so they don't retroactively re-target).
+ * GFR-04 `featureKind` is a C-box-anchored codelist value (ADR-0009 lockstep).
+ * GFR-05 Geo CLAIMS are NOT on chain — they are verifiable credentials that
+ *        point to a `(featureId, version)` here (spec 251). No GeoClaimRegistry.
+ * GFR-06 NO domain/faith vocabulary (reusable substrate).
+ * GFR-07 NEUTRAL public geography ONLY. A feature is a generic public place
+ *        (planet/region/country/admin area). It is NEVER tagged with — and its
+ *        `metadataURI` NEVER carries — domain or operational data that could
+ *        imply a private presence (e.g. "where a worker operates", access
+ *        sensitivity, ministry context). Sensitivity classification is an
+ *        OFF-chain app/domain policy applied OVER neutral features, never an
+ *        on-chain feature attribute. All metadata MUST be sanitized.
+ * GFR-08 NO on-chain skill↔geo mapping. This registry holds geo features only
+ *        and has ZERO reference to SkillDefinitionRegistry (or any skill id).
+ *        Any "serves skill X in region Y" fact is an off-chain claim/credential.
+ *
+ * Ported from smart-agent `GeoFeatureRegistry`; diverges per spec 251 (AP auth,
+ * C-box-anchored kinds, no name binding in v1).
+ */
+contract GeoFeatureRegistry {
+    // ─── C-box feature-kind codelist (keccak of the cbox URIs) ──────────
+    //   Concept URIs are declared in packages/ontology cbox/geo-vocabulary.ttl
+    //   (scheme apg:geoKind); lockstep-gated against the ontology (ADR-0009).
+    bytes32 public constant KIND_PLANET = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Planet"));
+    bytes32 public constant KIND_REGION = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Region"));
+    bytes32 public constant KIND_COUNTRY = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Country"));
+    bytes32 public constant KIND_ADMIN = keccak256(bytes("https://agenticprimitives.dev/ns/geo#AdminArea"));
+    bytes32 public constant KIND_CUSTOM = keccak256(bytes("https://agenticprimitives.dev/ns/geo#Custom"));
+    int256 public constant COORD_SCALE = 1e7;
+
+    // ─── Errors ─────────────────────────────────────────────────────────
+    error NotSteward();
+    error FeatureNotFound();
+    error EmptyMetadata();
+    error EmptyId();
+
+    // ─── Storage ────────────────────────────────────────────────────────
+    struct FeatureRecord {
+        bytes32 featureId;
+        uint64 version;
+        address stewardAccount;
+        bytes32 featureKind;
+        bytes32 geometryHash; // keccak of canonical GeoJSON (off chain)
+        bytes32 coverageRoot; // merkle root over covering cells (e.g. H3)
+        bytes32 sourceSetRoot; // merkle root over the source dataset
+        string metadataURI;
+        int256 centroidLat; // degrees × 1e7, coarse — UI only
+        int256 centroidLon;
+        int256 bboxMinLat;
+        int256 bboxMinLon;
+        int256 bboxMaxLat;
+        int256 bboxMaxLon;
+        uint64 validAfter;
+        uint64 validUntil;
+        bool active;
+        uint64 registeredAt;
+    }
+
+    mapping(bytes32 => mapping(uint64 => FeatureRecord)) private _records;
+    mapping(bytes32 => uint64) public latestVersion;
+    bytes32[] private _allFeatures;
+
+    // ─── Events ─────────────────────────────────────────────────────────
+    event FeaturePublished(
+        bytes32 indexed featureId,
+        uint64 indexed version,
+        address indexed steward,
+        bytes32 featureKind,
+        bytes32 geometryHash,
+        bytes32 coverageRoot,
+        bytes32 sourceSetRoot,
+        string metadataURI
+    );
+    event FeatureDeactivated(bytes32 indexed featureId, uint64 version);
+    event FeatureValidityChanged(bytes32 indexed featureId, uint64 version, uint64 validAfter, uint64 validUntil);
+
+    // ─── Publish ────────────────────────────────────────────────────────
+    struct PublishInput {
+        bytes32 featureId;
+        bytes32 featureKind;
+        address stewardAccount;
+        bytes32 geometryHash;
+        bytes32 coverageRoot;
+        bytes32 sourceSetRoot;
+        string metadataURI;
+        int256 centroidLat;
+        int256 centroidLon;
+        int256 bboxMinLat;
+        int256 bboxMinLon;
+        int256 bboxMaxLat;
+        int256 bboxMaxLon;
+        uint64 validAfter;
+        uint64 validUntil;
+    }
+
+    function publish(PublishInput calldata p) external returns (uint64 version) {
+        if (p.featureId == bytes32(0)) revert EmptyId();
+        if (bytes(p.metadataURI).length == 0) revert EmptyMetadata();
+        if (msg.sender != p.stewardAccount) revert NotSteward();
+
+        uint64 prevVer = latestVersion[p.featureId];
+        if (prevVer != 0 && _records[p.featureId][prevVer].stewardAccount != p.stewardAccount) {
+            revert NotSteward();
+        }
+
+        version = prevVer + 1;
+        _records[p.featureId][version] = FeatureRecord({
+            featureId: p.featureId,
+            version: version,
+            stewardAccount: p.stewardAccount,
+            featureKind: p.featureKind,
+            geometryHash: p.geometryHash,
+            coverageRoot: p.coverageRoot,
+            sourceSetRoot: p.sourceSetRoot,
+            metadataURI: p.metadataURI,
+            centroidLat: p.centroidLat,
+            centroidLon: p.centroidLon,
+            bboxMinLat: p.bboxMinLat,
+            bboxMinLon: p.bboxMinLon,
+            bboxMaxLat: p.bboxMaxLat,
+            bboxMaxLon: p.bboxMaxLon,
+            validAfter: p.validAfter,
+            validUntil: p.validUntil,
+            active: true,
+            registeredAt: uint64(block.timestamp)
+        });
+        latestVersion[p.featureId] = version;
+        if (prevVer == 0) _allFeatures.push(p.featureId);
+
+        emit FeaturePublished(p.featureId, version, p.stewardAccount, p.featureKind, p.geometryHash, p.coverageRoot, p.sourceSetRoot, p.metadataURI);
+    }
+
+    function deactivate(bytes32 featureId) external {
+        uint64 v = latestVersion[featureId];
+        if (v == 0) revert FeatureNotFound();
+        FeatureRecord storage r = _records[featureId][v];
+        if (msg.sender != r.stewardAccount) revert NotSteward();
+        r.active = false;
+        emit FeatureDeactivated(featureId, v);
+    }
+
+    function setValidity(bytes32 featureId, uint64 version, uint64 validAfter, uint64 validUntil) external {
+        FeatureRecord storage r = _records[featureId][version];
+        if (r.version == 0) revert FeatureNotFound();
+        if (msg.sender != r.stewardAccount) revert NotSteward();
+        r.validAfter = validAfter;
+        r.validUntil = validUntil;
+        emit FeatureValidityChanged(featureId, version, validAfter, validUntil);
+    }
+
+    // ─── Views ──────────────────────────────────────────────────────────
+    function getFeature(bytes32 featureId, uint64 version) external view returns (FeatureRecord memory) {
+        FeatureRecord memory r = _records[featureId][version];
+        if (r.version == 0) revert FeatureNotFound();
+        return r;
+    }
+
+    function getLatest(bytes32 featureId) external view returns (FeatureRecord memory) {
+        uint64 v = latestVersion[featureId];
+        if (v == 0) revert FeatureNotFound();
+        return _records[featureId][v];
+    }
+
+    /// @notice True if `version` of `featureId` exists (used by off-chain geo claim credentials to
+    ///         confirm the pinned definition version they reference).
+    function exists(bytes32 featureId, uint64 version) external view returns (bool) {
+        return _records[featureId][version].version != 0;
+    }
+
+    function allFeatures() external view returns (bytes32[] memory) {
+        return _allFeatures;
+    }
+}

package/src/naming/AgentNameRegistry.sol

@@ -1,11 +1,13 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.28;
 
+import "../governance/GovernanceManaged.sol";
+
 /**
  * @title AgentNameRegistry
  * @notice Hierarchical multi-root name registry for Smart Agents.
  *
- * Names are keyed by `node` (the ENS-style namehash:
+ * Names are keyed by `node` (the recursive namehash:
  * `keccak256(parentNode || labelhash)`). Each node has an owner (a Smart
  * Agent address), a resolver, an optional subregistry delegate that may
  * issue children, a parent pointer, the labelhash, and an optional
@@ -36,7 +38,11 @@ pragma solidity ^0.8.28;
  * discipline (a primary name only counts when the forward record
  * agrees).
  */
-contract AgentNameRegistry {
+/// @dev R6.8 — inherits `GovernanceManaged` to gain the
+///      `whenNotPaused` modifier on its mutating surface. The registry
+///      still owns its own per-node auth (`_requireParentAuth` /
+///      `msg.sender == owner`); governance only owns the pause flag.
+contract AgentNameRegistry is GovernanceManaged {
     // ─── H7-C.4 / CON-NAMING-001 — root-initializer gate ───────────────
     //
     // `initializeRoot` was permissionless: any mempool observer could
@@ -129,10 +135,13 @@ contract AgentNameRegistry {
 
     // ─── Constructor (H7-C.4) ───────────────────────────────────────
 
-    /// @notice Set the immutable root-initializer. The deploy script
-    ///         deploys the registry + calls `initializeRoot` in the same
-    ///         transaction so the TLD can't be frontrun.
-    constructor(address initializer_) {
+    /// @notice Set the immutable root-initializer + governance pointer.
+    ///         The deploy script deploys the registry + calls
+    ///         `initializeRoot` in the same transaction so the TLD
+    ///         can't be frontrun. R6.8 added `governance_` so the
+    ///         registry can read the system pause flag through
+    ///         `GovernanceManaged._pausedSafe()`.
+    constructor(address initializer_, address governance_) GovernanceManaged(governance_) {
         if (initializer_ == address(0)) revert ZeroOwner();
         initializer = initializer_;
     }
@@ -219,7 +228,7 @@ contract AgentNameRegistry {
         address newOwner,
         address resolverContract,
         uint64 expiry
-    ) external returns (bytes32 childNode) {
+    ) external whenNotPaused returns (bytes32 childNode) {
         if (bytes(label).length == 0) revert EmptyLabel();
         if (newOwner == address(0)) revert ZeroOwner();
         _requireParentAuth(parentNode);
@@ -252,7 +261,7 @@ contract AgentNameRegistry {
      *         Authorized to the node's owner ONLY — labels can't be
      *         changed once set, preventing display spoofing.
      */
-    function backfillLabel(bytes32 node, string calldata label_) external {
+    function backfillLabel(bytes32 node, string calldata label_) external whenNotPaused {
         _requireNodeAuth(node);
         if (bytes(label_).length == 0) revert EmptyLabel();
         if (keccak256(bytes(label_)) != _records[node].labelhash) revert NotAuthorized();
@@ -262,26 +271,26 @@ contract AgentNameRegistry {
 
     // ─── Setters ────────────────────────────────────────────────────
 
-    function setOwner(bytes32 node, address newOwner) external {
+    function setOwner(bytes32 node, address newOwner) external whenNotPaused {
         _requireNodeAuth(node);
         if (newOwner == address(0)) revert ZeroOwner();
         _records[node].owner = newOwner;
         emit OwnerChanged(node, newOwner);
     }
 
-    function setResolver(bytes32 node, address resolverContract) external {
+    function setResolver(bytes32 node, address resolverContract) external whenNotPaused {
         _requireNodeAuth(node);
         _records[node].resolver = resolverContract;
         emit ResolverChanged(node, resolverContract);
     }
 
-    function setSubregistry(bytes32 node, address subregistryContract) external {
+    function setSubregistry(bytes32 node, address subregistryContract) external whenNotPaused {
         _requireNodeAuth(node);
         _records[node].subregistry = subregistryContract;
         emit SubregistryChanged(node, subregistryContract);
     }
 
-    function renew(bytes32 node, uint64 newExpiry) external {
+    function renew(bytes32 node, uint64 newExpiry) external whenNotPaused {
         _requireNodeAuth(node);
         _records[node].expiry = newExpiry;
         emit NameRenewed(node, newExpiry);
@@ -293,7 +302,10 @@ contract AgentNameRegistry {
      *         NOT verify the forward record points back here. The
      *         universal resolver enforces the round-trip on reads.
      */
-    function setPrimaryName(bytes32 node) external {
+    function setPrimaryName(bytes32 node) external whenNotPaused {
+        // R6.3: `registeredAt == 0` is a sentinel "record-never-created" check.
+        // Storage default IS exactly 0; not a numeric precision concern.
+        // slither-disable-next-line incorrect-equality
         if (node != bytes32(0) && _records[node].registeredAt == 0) revert NodeNotFound();
         _primaryName[msg.sender] = node;
         if (node == bytes32(0)) emit PrimaryNameCleared(msg.sender);

package/src/naming/AgentNameUniversalResolver.sol

@@ -122,7 +122,7 @@ contract AgentNameUniversalResolver {
     /**
      * @notice Reverse-resolve a Smart Agent address to its primary name
      *         STRING in a single external call. Per spec/222 this is
-     *         the ENS-aligned reverse path — no log walks, no name
+     *         the on-chain reverse path — no log walks, no name
      *         reconstruction in the SDK, no event indexer required.
      *
      *         Walks `parent(node)` up the registry, reading `label(node)`

package/src/naming/PermissionlessSubregistry.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.28;
 
 import "./AgentNameRegistry.sol";
+import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
 
 /**
  * @title PermissionlessSubregistry
@@ -36,7 +37,15 @@ import "./AgentNameRegistry.sol";
  *     through whatever authority `newOwner` represents (EOA wallet,
  *     PSA CustodyPolicy quorum, etc.).
  */
-contract PermissionlessSubregistry {
+/// @dev R6.2 — `ReentrancyGuard` closes the Slither finding
+///      `reentrancy-no-eth` on `register()`: the prior-claim check
+///      (`claimedBy[msg.sender] != 0`) was followed by an external
+///      call to `REGISTRY.register(...)` BEFORE the corresponding
+///      state write. A malicious resolver invoked by the registry
+///      could re-enter `register()` and pass the check a second time.
+///      The guard prevents any nested call into `register()`, closing
+///      the window. Recon doc § 4.1 / `docs/audits/r6-contracts-recon-2026-05-31.md`.
+contract PermissionlessSubregistry is ReentrancyGuard {
     AgentNameRegistry public immutable REGISTRY;
     bytes32 public immutable PARENT_NODE;
     address public immutable DEFAULT_RESOLVER;
@@ -77,12 +86,20 @@ contract PermissionlessSubregistry {
      *         fee — fee gating belongs in a different subregistry
      *         shape if needed.
      */
-    function register(string calldata label, address newOwner) external returns (bytes32 childNode) {
+    function register(string calldata label, address newOwner) external nonReentrant returns (bytes32 childNode) {
         if (bytes(label).length == 0) revert EmptyLabel();
         if (bytes(label).length < MIN_LABEL_LENGTH) revert LabelTooShort();
         if (newOwner == address(0)) revert ZeroNewOwner();
         bytes32 prior = claimedBy[msg.sender];
         if (prior != bytes32(0)) revert AlreadyClaimed(prior);
+        // R9 / docs/audits/r9-static-analysis-triage.md § Slither M-1:
+        // Slither flags this as cross-function reentrancy because state is
+        // written AFTER the external call. The function is `nonReentrant`
+        // (line 89) + REGISTRY is an immutable contract we control
+        // (`AgentNameRegistry`) that does not call back into this contract.
+        // The cross-function reader (`hasClaimed`) is view-only. No invariant
+        // is violated by the pre-write-window. Triaged false positive.
+        // slither-disable-next-line reentrancy-no-eth
         childNode = REGISTRY.register(PARENT_NODE, label, newOwner, DEFAULT_RESOLVER, 0);
         claimedBy[msg.sender] = childNode;
         unchecked {

package/src/relationships/AgentRelationship.sol

@@ -34,6 +34,13 @@ pragma solidity ^0.8.28;
  *     Off-chain JSON published at `metadataURI` MUST hash to
  *     `metadataHash`; consumers reject mismatched fetches.
  */
+// R6.3 — Every `e.createdAt == 0` comparison in this contract is a
+//        sentinel "edge-never-created" check. Storage default IS exactly
+//        0 for unset records, so the equality is semantically a
+//        "does-not-exist" probe — not a numeric-precision concern.
+//        Disabling Slither's `incorrect-equality` at the contract scope
+//        keeps these inline reads idiomatic.
+// slither-disable-start incorrect-equality
 contract AgentRelationship {
     enum EdgeStatus {
         NONE,        // 0 — never set (sentinel)
@@ -287,3 +294,4 @@ contract AgentRelationship {
         }
     }
 }
+// slither-disable-end incorrect-equality