@agenticprimitives/contracts 1.0.0-alpha.12 → 1.0.0-alpha.14

package/dist/abi/CustodyPolicy.json

@@ -778,6 +778,17 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "AdminSelfSignerNotAllowed",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "AdminUnauthorizedSigner",

package/dist/abi/IAgentAccountFactoryView.json

@@ -12,6 +12,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "custodyPolicy",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "governance",

package/dist/abi/IRegistryMembershipPolicy.json

@@ -0,0 +1,70 @@
+[
+  {
+    "type": "function",
+    "name": "canAdminister",
+    "inputs": [
+      {
+        "name": "registryId",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "entryId",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "actor",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "ok",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "canRegister",
+    "inputs": [
+      {
+        "name": "registryId",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "entryId",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "subjectAgent",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "cardHash",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "claimHashes",
+        "type": "bytes32[]",
+        "internalType": "bytes32[]"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "ok",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  }
+]

package/dist/abi/PaymentEnforcer.json

@@ -20,22 +20,22 @@
     "name": "afterHook",
     "inputs": [
       {
-        "name": "",
+        "name": "terms",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "",
+        "name": "args",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "",
+        "name": "delegationHash",
         "type": "bytes32",
         "internalType": "bytes32"
       },
       {
-        "name": "",
+        "name": "delegator",
         "type": "address",
         "internalType": "address"
       },
@@ -55,13 +55,13 @@
         "internalType": "uint256"
       },
       {
-        "name": "",
+        "name": "callData",
         "type": "bytes",
         "internalType": "bytes"
       }
     ],
     "outputs": [],
-    "stateMutability": "view"
+    "stateMutability": "nonpayable"
   },
   {
     "type": "function",
@@ -412,6 +412,11 @@
     "name": "NotTransferCall",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "SettlementNotObserved",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "ValueNotZero",

package/dist/abi/index.d.ts

@@ -10,6 +10,7 @@ export declare const AgentNameRegistry: Abi;
 export declare const AgentNameUniversalResolver: Abi;
 export declare const AgentProfilePredicates: Abi;
 export declare const AgentProfileResolver: Abi;
+export declare const AgentRegistryBase: Abi;
 export declare const AgentRelationship: Abi;
 export declare const AgentRelationshipPredicates: Abi;
 export declare const AgreementRegistry: Abi;
@@ -41,6 +42,7 @@ export declare const IERC7579ModuleLifecycle: Abi;
 export declare const IERC7579ModuleLike: Abi;
 export declare const IGovernanceView: Abi;
 export declare const IPaymentReceiptRegistry: Abi;
+export declare const IRegistryMembershipPolicy: Abi;
 export declare const MockUSDC: Abi;
 export declare const MultiSendCallOnly: Abi;
 export declare const MultiSendCallOnlyHarness: Abi;

package/dist/abi/index.js

@@ -10,6 +10,7 @@ export { default as AgentNameRegistry } from './AgentNameRegistry.json' with { t
 export { default as AgentNameUniversalResolver } from './AgentNameUniversalResolver.json' with { type: 'json' };
 export { default as AgentProfilePredicates } from './AgentProfilePredicates.json' with { type: 'json' };
 export { default as AgentProfileResolver } from './AgentProfileResolver.json' with { type: 'json' };
+export { default as AgentRegistryBase } from './AgentRegistryBase.json' with { type: 'json' };
 export { default as AgentRelationship } from './AgentRelationship.json' with { type: 'json' };
 export { default as AgentRelationshipPredicates } from './AgentRelationshipPredicates.json' with { type: 'json' };
 export { default as AgreementRegistry } from './AgreementRegistry.json' with { type: 'json' };
@@ -41,6 +42,7 @@ export { default as IERC7579ModuleLifecycle } from './IERC7579ModuleLifecycle.js
 export { default as IERC7579ModuleLike } from './IERC7579ModuleLike.json' with { type: 'json' };
 export { default as IGovernanceView } from './IGovernanceView.json' with { type: 'json' };
 export { default as IPaymentReceiptRegistry } from './IPaymentReceiptRegistry.json' with { type: 'json' };
+export { default as IRegistryMembershipPolicy } from './IRegistryMembershipPolicy.json' with { type: 'json' };
 export { default as MockUSDC } from './MockUSDC.json' with { type: 'json' };
 export { default as MultiSendCallOnly } from './MultiSendCallOnly.json' with { type: 'json' };
 export { default as MultiSendCallOnlyHarness } from './MultiSendCallOnlyHarness.json' with { type: 'json' };

package/dist/deployments/base-sepolia.d.ts

@@ -8,6 +8,7 @@ export interface Deployments {
   readonly "agentNameResolver": Address;
   readonly "agentNameUniversalResolver": Address;
   readonly "agentProfileResolver": Address;
+  readonly "agentRegistryBase": Address;
   readonly "agentRelationship": Address;
   readonly "agreementRegistry": Address;
   readonly "allowedMethodsEnforcer": Address;
@@ -20,7 +21,11 @@ export interface Deployments {
   readonly "deployer": Address;
   readonly "entryPoint": Address;
   readonly "geoFeatureRegistry": Address;
+  readonly "mockUsdc": Address;
   readonly "ontologyTermRegistry": Address;
+  readonly "paymentEnforcer": Address;
+  readonly "paymentEscrow": Address;
+  readonly "paymentReceiptRegistry": Address;
   readonly "permissionlessSubregistry": Address;
   readonly "permissionlessSubregistryDemoAgent": Address;
   readonly "quorumEnforcer": Address;
@@ -31,10 +36,6 @@ export interface Deployments {
   readonly "timestampEnforcer": Address;
   readonly "universalSignatureValidator": Address;
   readonly "valueEnforcer": Address;
-  readonly "paymentEnforcer": Address;
-  readonly "paymentReceiptRegistry": Address;
-  readonly "mockUsdc": Address;
-  readonly "paymentEscrow": Address;
   readonly "chainId": number;
 }
 export declare const CONTRACTS: Deployments;

package/dist/deployments/base-sepolia.js

@@ -1,39 +1,40 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 // Source: deployments-base-sepolia.json
 export const CONTRACTS = {
-  "agentAccountFactory": "0x3E68B72B45e7C9d35B210E4Ab06e5Cece85cEbE4",
-  "agentAccountImplementation": "0x338318ABf9C8b28E7e77ed96a91857cCE1Db1328",
-  "agentNameRegistry": "0x15F7ed064A230C011b0244A14fD9653f011d609B",
-  "agentNameResolver": "0xcC9855A23C7a4D4592E68Fe47E195C2f9D832473",
-  "agentNameUniversalResolver": "0x7d777d2d0bbc1806B9Cc779121C27fbaAaFDb60b",
-  "agentProfileResolver": "0xc448EB159B2a35F07f6E1814CC8d125244d7384B",
-  "agentRelationship": "0xE6B8F6C7F1c9857013dA356DF08D0384334A9607",
-  "agreementRegistry": "0x7f4d6A74eda1D6ce251D371566f1c6639F9B0DDa",
-  "allowedMethodsEnforcer": "0xf77cf06aCd8b9e2f3204fe4bE16449B3594c9633",
-  "allowedTargetsEnforcer": "0xe3909FdEfD8b74B7D006E045DCd678e97D469Bfd",
-  "approvedHashRegistry": "0x90735B5281434D1746926E2AA722Cc6DbF3EFEe6",
-  "attestationRegistry": "0xaE3861fd299c74D96F6FCA25f19c7ACf8b9020ed",
-  "callDataHashEnforcer": "0x9F12932F1b85A1F96c1Cb1c5A0645e3F0Ab478Dd",
+  "agentAccountFactory": "0xfCFafCbA6D88351aAAA190a5E971F06CAb40437d",
+  "agentAccountImplementation": "0x28b7d8e4682EF36bE479330Ba6CFE78E9E724Bc4",
+  "agentNameRegistry": "0x419928546Be67ba83C2aEaFCb6AD3364D5659C8D",
+  "agentNameResolver": "0xf96A25DeBF92C514459DC904ec8b79CE52D265A5",
+  "agentNameUniversalResolver": "0x3aC8Cb8Df1A8F9fcA05a37cEC82426b4432A53D3",
+  "agentProfileResolver": "0xb988e75179e11E4d17665d61c6a9Ce0e737A808F",
+  "agentRegistryBase": "0x7fab087fc3d0e1793bdb1d4c5d253635131ee1d1",
+  "agentRelationship": "0xDc409D69aC002B4FC90D4B453cc6B6277B98CB46",
+  "agreementRegistry": "0x882371Dc898f4835335a01558aE5C2B306069FcF",
+  "allowedMethodsEnforcer": "0x1Df87222f53ad26F599C60364F7232a3c0393ad9",
+  "allowedTargetsEnforcer": "0x55A9fD6aF8688EE9c68D15CDAa84d9DBD027B80F",
+  "approvedHashRegistry": "0x878272cc4E0c5bA026CEc29C9722F41fC0515fE5",
+  "attestationRegistry": "0xC695939EA5fB1d7a88BCF536EAC3C13bfcc9E50d",
+  "callDataHashEnforcer": "0x4ab106b80488FE6A920D973cDb96052a933c7450",
   "chainId": 84532,
-  "custodyPolicy": "0xDeD6542A55476745846370562d1c75D15DDf2572",
-  "delegationManager": "0x3a8E2cE74564f699b135db6f266ccDb563979C05",
+  "custodyPolicy": "0xfAFDc79bc03CC7cE27f7AA12A3180E4E4C0BC3F6",
+  "delegationManager": "0x10DB7c0C5887910722354ef37eF874fBD124026C",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x9B33De9d9597de82Eb56b5B26C478Dc0a6955388",
-  "geoFeatureRegistry": "0x78FdCae0aC9B0CD9943996282b8F39D77bec5b1c",
-  "ontologyTermRegistry": "0xf486Ba6e9FD2d687e68a1a7A77D0FA27bb1E66c3",
-  "permissionlessSubregistry": "0x1B8ED8693738e1A9DD653FEE5430d49e00202Bb7",
-  "permissionlessSubregistryDemoAgent": "0xc76b1cdB4340398f59fD9C5d6Cb65fCdC606B33b",
-  "quorumEnforcer": "0x76fb494aE991d1fe1603a91384BA4c1F890442a8",
-  "relationshipTypeRegistry": "0x526fBF5900b18B1D06201493bcE470b416FB71C3",
-  "shapeRegistry": "0x03AbD67A910abB2c5026f1973A05502e0473e316",
-  "skillDefinitionRegistry": "0x5ae94aba46D7daA1Ca9eaE0051043Ad05bcc392B",
-  "smartAgentPaymaster": "0x8eF92B9D62826052D8F7e6dcaB630dC3890bF540",
-  "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
-  "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
-  "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
-  "paymentEnforcer": "0xCB5D2dbfc11e146d568764471516C9DB734D2c60",
-  "paymentReceiptRegistry": "0x391Ed4D7538f80a221F910539005bB00b996Ff9F",
-  "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C",
-  "paymentEscrow": "0xC85EB1831e9180F5e2cA7854f362f6C9a6D727EA"
+  "entryPoint": "0x86Dc419feDD30F58250B314F5947aDd8cf379436",
+  "geoFeatureRegistry": "0x1C3b16aF3C2649f2b1ac78aFD6AB20dA0c379121",
+  "mockUsdc": "0x027de10c034f4055551C32491BCe65711BFE5f69",
+  "ontologyTermRegistry": "0x95C149Be91c925FB348Fa231aD28440FBaD562cF",
+  "paymentEnforcer": "0xB09b95E7BcB5d1b3C934facFBEd5bc474b15897E",
+  "paymentEscrow": "0x053dA1bdD4f0A75b82A75A46F189f137a5267928",
+  "paymentReceiptRegistry": "0x29645211A44714b06B8c4C55c109Ef285699f56c",
+  "permissionlessSubregistry": "0x542915A4118A28f49D40DAE53Ee0dc5721Aa4868",
+  "permissionlessSubregistryDemoAgent": "0x00EB165eA2fd33448bbBd5634a8ba92D616AEc1D",
+  "quorumEnforcer": "0x093ff9790601F712B3730C3cAa34f9353dC93739",
+  "relationshipTypeRegistry": "0x0250274222baBB42d44e72e9992DFEB701399a56",
+  "shapeRegistry": "0x7d0a4e9A981775a3807282bbf3499e77f5E2bA53",
+  "skillDefinitionRegistry": "0x7be2c5615d83Ca95e02b9BDe24879eb220cb1780",
+  "smartAgentPaymaster": "0xe93f4ea2cEA8CFF898948c54D6d6144A8F14ca72",
+  "timestampEnforcer": "0x118A74d6F59ecD9D19BA4b720157a007b6f39894",
+  "universalSignatureValidator": "0x3Bc1Debf2ac2a59548aC5Ad09404A56bA21b5803",
+  "valueEnforcer": "0xB7952Ca4a5E10efD24C03c069a0Ea7e262ebE959"
 };
 export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.12",
+  "version": "1.0.0-alpha.14",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {

package/src/AgentAccount.sol

@@ -28,6 +28,11 @@ interface IAgentAccountFactoryView {
     ///      this address to call `IGovernanceView.isPaused()` from
     ///      `whenNotPaused`-guarded entrypoints.
     function governance() external view returns (address);
+    /// @dev Wave-1/ACCT-C1 — the canonical CustodyPolicy this factory installs
+    ///      as the custody executor for `mode > 0` accounts. AgentAccount reads it
+    ///      to decide whether IT is custody-governed (its CustodyPolicy is installed)
+    ///      vs. merely hosting an unrelated utility executor.
+    function custodyPolicy() external view returns (address);
 }
 
 /// @dev R6.5 — minimal interface for the pause read. Mirrors the same
@@ -158,6 +163,27 @@ contract AgentAccount is
     ///      `_authorizeUpgrade` frame) AND absent from the storage layout.
     bool private transient _upgradeAuthorizedCtx;
 
+    /// @dev Wave-1 / ACCT-C1 (spec 300) — transient "this call stack was entered
+    ///      by the installed CustodyPolicy EXECUTOR via `executeFromModule`"
+    ///      (custody-quorum authorized) flag. Set ONLY inside `executeFromModule`,
+    ///      around the dispatched call, cleared after. Governance mutators require
+    ///      it on a custody-governed account (`mode > 0`, a CustodyPolicy EXECUTOR
+    ///      installed): a 1-of-N UserOp `execute(self, adminSelector)` self-call
+    ///      leaves the flag unset and reverts, so the quorum+timelock can no longer
+    ///      be bypassed by a single compromised key. Person accounts (`mode 0`, no
+    ///      CustodyPolicy) self-govern and are exempt. Transient ⇒ tx-global +
+    ///      absent from the storage layout.
+    bool private transient _custodyGovCtx;
+
+    /// @dev Wave-1 / DM-3 (spec 300) — transient "this execution stack originated
+    ///      from the DelegationManager". Set at the outermost `execute`/`executeBatch`
+    ///      frame whose `msg.sender == _delegationManager`, preserved across the
+    ///      legitimate `DM → execute(self, executeBatch(...))` nest, cleared by the
+    ///      frame that set it. While set, a self-targeted governance selector is
+    ///      rejected — a delegation may never reach account governance (that is the
+    ///      CustodyPolicy's job), regardless of custody mode.
+    bool private transient _delegationExecCtx;
+
     /// @dev Spec 007 Phase A.5 — maximum permitted upgrade timelock to
     ///      protect against an owner accidentally setting an absurdly
     ///      large delay that bricks future migrations.
@@ -223,6 +249,15 @@ contract AgentAccount is
     error LegacyUpgradePathDisabled();
     error ModuleOperationNotAllowed();
 
+    // Wave 1 — account authorization boundary (spec 300 / ACCT-C1 + DM-3).
+    /// @notice A governance mutator was reached on a custody-governed account
+    ///         (`mode > 0`) outside the CustodyPolicy `executeFromModule` path —
+    ///         i.e. a single-signer UserOp `execute(self, adminSelector)` self-call.
+    error AdminRequiresCustodyQuorum();
+    /// @notice A delegation-originated execution stack tried to self-call an
+    ///         account-governance selector. Delegations may never reach governance.
+    error DelegatedGovernanceForbidden();
+
     /// @notice Emitted when `setDelegationManager` rotates the DM via a
     ///         self-call (the only authorized path post-Wave-2A).
     event DelegationManagerRotated(address indexed newDelegationManager);
@@ -441,8 +476,14 @@ contract AgentAccount is
         // matured owner queue — set `_upgradeAuthorizedCtx` and pass through, so the
         // custody path is not double-delayed. A zero timelock keeps the
         // immediate-upgrade default (backward-compatible).
-        if (_upgradeTimelock != 0 && !_upgradeAuthorizedCtx) {
-            revert DirectUpgradeBlocked();
+        // Wave-1/ACCT-C1 + M-4 (spec 300): outside an authorized context, a
+        // custody-governed account (`mode>0`) may upgrade ONLY through the
+        // CustodyPolicy quorum — reject even when the per-account timelock is 0 (M-4
+        // floors it non-zero at the factory, but a quorum-set 0 must not re-open the
+        // direct path). A person account keeps the CA-1 behavior (timelock if set).
+        if (!_upgradeAuthorizedCtx) {
+            if (_hasCustodyGovernance()) revert AdminRequiresCustodyQuorum();
+            if (_upgradeTimelock != 0) revert DirectUpgradeBlocked();
         }
     }
 
@@ -478,6 +519,7 @@ contract AgentAccount is
     ///         meaningful when a timelock is configured — with none set, upgrade
     ///         directly. Overwrites any existing pending upgrade.
     function scheduleUpgrade(address newImplementation) external onlySelf {
+        _requireCustodyGoverned();
         if (newImplementation == address(0)) revert ZeroAddress();
         uint256 tl = _upgradeTimelock;
         if (tl == 0) revert UpgradeTimelockNotSet();
@@ -533,6 +575,7 @@ contract AgentAccount is
     ///         (`onlySelf`). 0 == immediate upgrades (default,
     ///         backward-compat).
     function setUpgradeTimelock(uint256 secs) external onlySelf {
+        _requireCustodyGoverned();
         if (secs > MAX_UPGRADE_TIMELOCK) {
             revert UpgradeTimelockTooLong(secs, MAX_UPGRADE_TIMELOCK);
         }
@@ -576,6 +619,7 @@ contract AgentAccount is
      *         a self-call into this function.
      */
     function setDelegationManager(address dm) external onlySelf {
+        _requireCustodyGoverned();
         if (dm.code.length == 0) revert ValidatorRequired();
         _delegationManager = dm;
         emit DelegationManagerRotated(dm);
@@ -639,6 +683,7 @@ contract AgentAccount is
      *                              delegation the owner has authorized.
      */
     function acceptSessionDelegation(bytes32 sessionDelegationHash) external onlySelf {
+        _requireCustodyGoverned();
         if (_acceptedSessionDelegations[sessionDelegationHash]) {
             revert SessionDelegationAlreadyAccepted(sessionDelegationHash);
         }
@@ -823,6 +868,10 @@ contract AgentAccount is
         address module,
         bytes calldata initData
     ) external onlySelfOrFactoryInit whenNotPaused {
+        // Wave-1/ACCT-C1: on a custody-governed account, module installs must route
+        // through the CustodyPolicy quorum. Exempt by construction at factory-init
+        // (no EXECUTOR installed yet ⇒ `_hasCustodyGovernance()` is false).
+        _requireCustodyGoverned();
         if (module == address(0)) revert ZeroAddress();
         if (!_isSupportedModuleType(moduleTypeId)) revert UnsupportedModuleType(moduleTypeId);
 
@@ -872,6 +921,7 @@ contract AgentAccount is
         // at deploy time, and there's never a legitimate reason for
         // the factory to do that.
         if (msg.sender != address(this)) revert ModuleOperationNotAllowed();
+        _requireCustodyGoverned();
         if (!_isSupportedModuleType(moduleTypeId)) revert UnsupportedModuleType(moduleTypeId);
 
         ModulesStorage storage $ = _modulesStorage();
@@ -978,14 +1028,18 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
-        // CA-1: a module action is a custody-governed context (only an installed
-        // EXECUTOR — the CustodyPolicy — reaches here, gated upstream by its own
-        // T5 quorum + timelock). Authorize any upgrade it dispatches so the custody
-        // path is exempt from the per-account `_upgradeTimelock` (no double delay).
-        // Transient + nonReentrant, cleared after the call.
+        // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action is a custody-governed
+        // context (only an installed EXECUTOR — the CustodyPolicy — reaches here,
+        // gated upstream by its own T5 quorum + timelock). `_custodyGovCtx` authorizes
+        // every governance mutator this call dispatches (the ONLY way past
+        // `_requireCustodyGoverned` on a `mode>0` account); `_upgradeAuthorizedCtx`
+        // additionally exempts a dispatched upgrade from the per-account timelock (no
+        // double delay). Both transient, cleared after the call.
+        _custodyGovCtx = true;
         _upgradeAuthorizedCtx = true;
         (bool ok, bytes memory ret) = target.call{value: value}(data);
         _upgradeAuthorizedCtx = false;
+        _custodyGovCtx = false;
         if (!ok) {
             assembly { revert(add(ret, 32), mload(ret)) }
         }
@@ -1035,6 +1089,13 @@ contract AgentAccount is
     function execute(address target, uint256 value, bytes calldata data) external override nonReentrant whenNotPaused {
         _requireForExecute();
 
+        // DM-3 (spec 300): mark a delegation-originated stack (set once at the
+        // outermost DM frame; preserved across the legitimate DM → execute(self,
+        // executeBatch(...)) nest) and forbid it from self-calling governance.
+        bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
+        if (setDelCtx) _delegationExecCtx = true;
+        _rejectDelegatedGovernance(target, data);
+
         ModulesStorage storage $ = _modulesStorage();
         address[] memory hooks = $.installedList[MODULE_TYPE_HOOK];
         bytes[] memory hookData = new bytes[](hooks.length);
@@ -1062,6 +1123,8 @@ contract AgentAccount is
         for (uint256 i = 0; i < hooks.length; i++) {
             IERC7579HookLike(hooks[i]).postCheck(hookData[i]);
         }
+
+        if (setDelCtx) _delegationExecCtx = false;
     }
 
     /// @notice Atomically execute multiple calls from this account.
@@ -1088,6 +1151,13 @@ contract AgentAccount is
     function executeBatch(Call[] calldata calls) external override whenNotPaused {
         _requireForExecute();
 
+        // DM-3 (spec 300): same delegation-origin marking as `execute`. Preserved
+        // across the DM → execute(self, executeBatch(...)) nest so a governance
+        // self-call in ANY inner call is caught even though this frame's
+        // msg.sender is address(this).
+        bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
+        if (setDelCtx) _delegationExecCtx = true;
+
         ModulesStorage storage $ = _modulesStorage();
         address[] memory hooks = $.installedList[MODULE_TYPE_HOOK];
         bytes[] memory hookData = new bytes[](hooks.length);
@@ -1101,6 +1171,7 @@ contract AgentAccount is
         }
 
         for (uint256 i = 0; i < calls.length; i++) {
+            _rejectDelegatedGovernance(calls[i].target, calls[i].data);
             (bool ok, bytes memory ret) = calls[i].target.call{ value: calls[i].value }(calls[i].data);
             if (!ok) {
                 assembly {
@@ -1113,6 +1184,8 @@ contract AgentAccount is
         for (uint256 i = 0; i < hooks.length; i++) {
             IERC7579HookLike(hooks[i]).postCheck(hookData[i]);
         }
+
+        if (setDelCtx) _delegationExecCtx = false;
     }
 
     // ─── ERC-4337 ───────────────────────────────────────────────────
@@ -1146,6 +1219,68 @@ contract AgentAccount is
         }
     }
 
+    // ─── Wave 1 — account authorization boundary (spec 300) ─────────
+
+    /// @dev True when this account is custody-governed — i.e. the canonical
+    ///      CustodyPolicy the factory installs for `mode > 0` accounts is installed
+    ///      as an EXECUTOR here. Governance mutators then require the
+    ///      `executeFromModule` (quorum+timelock) path. A `mode 0` person account
+    ///      (no CustodyPolicy) self-governs; installing an UNRELATED utility executor
+    ///      does NOT make it custody-governed (we check the specific policy address,
+    ///      not "any executor"). If the factory is unknown (legacy direct deploy),
+    ///      fall back to person semantics.
+    function _hasCustodyGovernance() internal view returns (bool) {
+        address f = _factory;
+        if (f == address(0)) return false;
+        address cp = IAgentAccountFactoryView(f).custodyPolicy();
+        if (cp == address(0)) return false;
+        return _modulesStorage().installed[MODULE_TYPE_EXECUTOR][cp];
+    }
+
+    /// @dev ACCT-C1 gate: on a custody-governed account, a governance mutator is
+    ///      reachable only through `executeFromModule` (which sets `_custodyGovCtx`).
+    ///      A single-signer UserOp `execute(self, adminSelector)` self-call leaves the
+    ///      flag unset and reverts here, so the custody quorum can no longer be bypassed.
+    function _requireCustodyGoverned() internal view {
+        if (_hasCustodyGovernance() && !_custodyGovCtx) revert AdminRequiresCustodyQuorum();
+    }
+
+    /// @dev DM-3 gate: a delegation-originated stack may never self-call an account
+    ///      governance selector. `_delegationExecCtx` is set at the outermost
+    ///      DM-driven `execute`/`executeBatch` and persists across the legitimate
+    ///      `DM → execute(self, executeBatch(...))` nest, so a nested governance
+    ///      self-call is caught regardless of mode.
+    function _rejectDelegatedGovernance(address target, bytes calldata data) internal view {
+        if (
+            _delegationExecCtx &&
+            target == address(this) &&
+            data.length >= 4 &&
+            _isGovernanceSelector(bytes4(data[0:4]))
+        ) {
+            revert DelegatedGovernanceForbidden();
+        }
+    }
+
+    /// @dev The account-governance selector set — mutators that change custody,
+    ///      the DelegationManager, installed modules, or the upgrade path. Kept in
+    ///      sync with the `_requireCustodyGoverned`-gated functions above.
+    function _isGovernanceSelector(bytes4 s) internal pure returns (bool) {
+        return
+            s == this.setDelegationManager.selector ||
+            s == UUPSUpgradeable.upgradeToAndCall.selector ||
+            s == this.setUpgradeTimelock.selector ||
+            s == this.scheduleUpgrade.selector ||
+            s == this.executePendingUpgrade.selector ||
+            s == this.cancelPendingUpgrade.selector ||
+            s == this.installModule.selector ||
+            s == this.uninstallModule.selector ||
+            s == IAgentAccount.addCustodian.selector ||
+            s == IAgentAccount.removeCustodian.selector ||
+            s == this.addPasskey.selector ||
+            s == this.removePasskey.selector ||
+            s == this.acceptSessionDelegation.selector;
+    }
+
     // ─── ERC-1271 ───────────────────────────────────────────────────
 
     /// @dev 32-byte ERC-6492 magic suffix — `0x6492…6492` repeated.
@@ -1359,6 +1494,7 @@ contract AgentAccount is
     ///      the ERC-165 marker. Passkey custodians are not added here;
     ///      use `addPasskey` instead.
     function addCustodian(address owner) external override onlySelf whenNotPaused {
+        _requireCustodyGoverned();
         if (owner == address(0)) revert ZeroAddress();
         if (_externalCustodians[owner]) revert CustodianAlreadyExists(owner);
         if (_isAgenticPrimitivesAgent(owner)) {
@@ -1402,6 +1538,7 @@ contract AgentAccount is
     ///      owner if there are also no registered passkeys. A passkey-only
     ///      account is allowed, but a zero-signer account is not.
     function removeCustodian(address owner) external override onlySelf {
+        _requireCustodyGoverned();
         if (!_externalCustodians[owner]) revert CustodianDoesNotExist(owner);
         if (_externalCustodianCount == 1 && _passkeyStorage().count == 0) revert CannotRemoveLastCustodian();
         _externalCustodians[owner] = false;
@@ -1466,6 +1603,7 @@ contract AgentAccount is
         uint256 y,
         bytes32 rpIdHash
     ) external onlySelf {
+        _requireCustodyGoverned();
         if (x == 0 || y == 0) revert InvalidPasskeyPublicKey();
         // Audit C-6: zero digest poisons piaToCredentialId mapping.
         if (credentialIdDigest == bytes32(0)) revert InvalidCredentialIdDigest();
@@ -1490,6 +1628,7 @@ contract AgentAccount is
     ///         AND passkeys together. Also clears the credential's PIA
     ///         entry so `isCustodian(pia)` flips back to false.
     function removePasskey(bytes32 credentialIdDigest) external onlySelf {
+        _requireCustodyGoverned();
         PasskeyStorage storage $ = _passkeyStorage();
         if (!$.registered[credentialIdDigest]) revert PasskeyNotRegistered(credentialIdDigest);
         if (_externalCustodianCount + $.count == 1) revert CannotRemoveLastSigner();

package/src/AgentAccountFactory.sol

@@ -77,6 +77,9 @@ contract AgentAccountFactory is GovernanceManaged {
     error NoInitialSigner();
     error InsufficientTrusteesForMode(uint8 mode, uint256 actual, uint256 required);
     error TrusteesRequiredForRecoverableMode(uint8 mode);
+    /// @notice ACCT-M1 (spec 300): a mode-3 (org) account needs ≥2 signers so its separation-of-duties
+    ///         (disjoint propose + apply quorums) is satisfiable — a 1-signer org can never split duties.
+    error InfeasibleOrgConfig(uint8 nSigners);
     error ZeroAddress();
     /// @notice R9.6 / ATL-SEC-05 -- thrown when `params.custodians.length`
     ///         exceeds `MAX_INITIAL_CUSTODIANS`. Without this cap,
@@ -308,6 +311,19 @@ contract AgentAccountFactory is GovernanceManaged {
             thresholds[t] = CustodyPolicy(custodyPolicy).defaultApprovals(uint8(nSigners), t);
         }
 
+        // ACCT-M1 (spec 300): mode-3 (org) separation-of-duties requires DISJOINT propose + apply quorums
+        // for the T4/T5 tiers, so a satisfiable config needs 2×threshold DISTINCT signers. The default
+        // matrix sets T4/T5 = N for small N (all custodians), which would demand 2N signers — making every
+        // such change permanently un-executable (the account silently locks). Cap the SoD-constrained
+        // thresholds at floor(N/2) so a disjoint quorum always exists, and require ≥2 signers (a 1-signer
+        // org can't split duties). Modes 0-2 have no SoD, so their thresholds are unchanged.
+        if (params.mode == 3) {
+            if (nSigners < 2) revert InfeasibleOrgConfig(uint8(nSigners));
+            uint8 sodCap = uint8(nSigners / 2); // ≥ 1 since nSigners ≥ 2
+            if (thresholds[4] > sodCap) thresholds[4] = sodCap;
+            if (thresholds[5] > sodCap) thresholds[5] = sodCap;
+        }
+
         uint32[7] memory timelocks;
         timelocks[4] = timelockOverrides[4] == 0 ? uint32(1 hours)  : timelockOverrides[4];
         timelocks[5] = timelockOverrides[5] == 0 ? uint32(24 hours) : timelockOverrides[5];