@agenticprimitives/contracts 1.0.0-alpha.13 → 1.0.0-alpha.15

package/deployments-base-sepolia.json

@@ -1,37 +1,37 @@
 {
-  "agentAccountFactory": "0x3E68B72B45e7C9d35B210E4Ab06e5Cece85cEbE4",
-  "agentAccountImplementation": "0x338318ABf9C8b28E7e77ed96a91857cCE1Db1328",
-  "agentNameRegistry": "0x15F7ed064A230C011b0244A14fD9653f011d609B",
-  "agentNameResolver": "0xcC9855A23C7a4D4592E68Fe47E195C2f9D832473",
-  "agentNameUniversalResolver": "0x7d777d2d0bbc1806B9Cc779121C27fbaAaFDb60b",
-  "agentProfileResolver": "0xc448EB159B2a35F07f6E1814CC8d125244d7384B",
-  "agentRegistryBase": "0xe320947b18D3C71710DCB75D4bf200147ded18Df",
-  "agentRelationship": "0xE6B8F6C7F1c9857013dA356DF08D0384334A9607",
-  "agreementRegistry": "0x7f4d6A74eda1D6ce251D371566f1c6639F9B0DDa",
-  "allowedMethodsEnforcer": "0xf77cf06aCd8b9e2f3204fe4bE16449B3594c9633",
-  "allowedTargetsEnforcer": "0xe3909FdEfD8b74B7D006E045DCd678e97D469Bfd",
-  "approvedHashRegistry": "0x90735B5281434D1746926E2AA722Cc6DbF3EFEe6",
-  "attestationRegistry": "0xaE3861fd299c74D96F6FCA25f19c7ACf8b9020ed",
-  "callDataHashEnforcer": "0x9F12932F1b85A1F96c1Cb1c5A0645e3F0Ab478Dd",
+  "agentAccountFactory": "0x1D3BF769B3991faA7847872cE05FA22beE2f07e5",
+  "agentAccountImplementation": "0xd96eA06208140763256899727B22A1DF7A09387d",
+  "agentNameRegistry": "0x4e5a6369C91B9093ad17bF0eAc8d344F1b41EdE0",
+  "agentNameResolver": "0x776a5bADb7DBE238048542E0c91f7a86933C8986",
+  "agentNameUniversalResolver": "0x8539fad5B148512775cD3712bb55F2fd5f1C85cB",
+  "agentProfileResolver": "0x82dBC51a77A92A51b177FFE97181cD40aa1c24ab",
+  "agentRegistryBase": "0x54f76a5faab995f194cc61c50eb5e272c8d85cf4",
+  "agentRelationship": "0x763c164d8275F76A806721B423aaB5ad6cb4fEA1",
+  "agreementRegistry": "0xaD300f03EdDf8F015D5583feC8D5F2D1BBC6f854",
+  "allowedMethodsEnforcer": "0xa149A31F32789cDBfd5f0eed1CF92E7BCb91b549",
+  "allowedTargetsEnforcer": "0xfb78589C8a9f464BD1e9A340BC809CEe7949b17c",
+  "approvedHashRegistry": "0x7152282bB71692E7f73ff31DdB43f4a50818845b",
+  "attestationRegistry": "0x9f9bCAF7b238b87c6d7897767c473b6f8C55C0a6",
+  "callDataHashEnforcer": "0x0fCE11eC016bd4Bc3a60951FbE4e9Fe7087955b1",
   "chainId": 84532,
-  "custodyPolicy": "0xDeD6542A55476745846370562d1c75D15DDf2572",
-  "delegationManager": "0x3a8E2cE74564f699b135db6f266ccDb563979C05",
+  "custodyPolicy": "0xF408e54dA113Fe6b785615750c6Bab6F9008A9d9",
+  "delegationManager": "0xaCdB7001dB8305c23703f6DB0EfB8B9BC1d75D62",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x9B33De9d9597de82Eb56b5B26C478Dc0a6955388",
-  "geoFeatureRegistry": "0x78FdCae0aC9B0CD9943996282b8F39D77bec5b1c",
-  "ontologyTermRegistry": "0xf486Ba6e9FD2d687e68a1a7A77D0FA27bb1E66c3",
-  "permissionlessSubregistry": "0x1B8ED8693738e1A9DD653FEE5430d49e00202Bb7",
-  "permissionlessSubregistryDemoAgent": "0xc76b1cdB4340398f59fD9C5d6Cb65fCdC606B33b",
-  "quorumEnforcer": "0x76fb494aE991d1fe1603a91384BA4c1F890442a8",
-  "relationshipTypeRegistry": "0x526fBF5900b18B1D06201493bcE470b416FB71C3",
-  "shapeRegistry": "0x03AbD67A910abB2c5026f1973A05502e0473e316",
-  "skillDefinitionRegistry": "0x5ae94aba46D7daA1Ca9eaE0051043Ad05bcc392B",
-  "smartAgentPaymaster": "0x8eF92B9D62826052D8F7e6dcaB630dC3890bF540",
-  "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
-  "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
-  "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
-  "paymentEnforcer": "0xCB5D2dbfc11e146d568764471516C9DB734D2c60",
-  "paymentReceiptRegistry": "0x391Ed4D7538f80a221F910539005bB00b996Ff9F",
-  "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C",
-  "paymentEscrow": "0xC85EB1831e9180F5e2cA7854f362f6C9a6D727EA"
+  "entryPoint": "0x9Eb5F84E8323aACD4AD61b4b980aDB23B15c2903",
+  "geoFeatureRegistry": "0x74AEb56420a8630c611c36b3053780d90191f94d",
+  "mockUsdc": "0x07190E7586a468E808D6bd58dC3CEdEC0b25B8E3",
+  "ontologyTermRegistry": "0x69670d24AcE8C47a294231a1fdC4207642669a25",
+  "paymentEnforcer": "0xF08946A2c4eed77f366AfDc39AE150F2262E5d29",
+  "paymentEscrow": "0x30f0fd53dc1245062962b498be3a7e9641cc7c6c",
+  "paymentReceiptRegistry": "0x36f0cd94A286b011b8C6106E69E14567fb7A498e",
+  "permissionlessSubregistry": "0xE37E1da21Bcce70b515d2f44d84D757c358b96B6",
+  "permissionlessSubregistryDemoAgent": "0xeE2Db355624BdB4a7551604229EbE72683f8fD85",
+  "quorumEnforcer": "0xd030196bD6Ba6a654e6E8f7e3609aAd470122422",
+  "relationshipTypeRegistry": "0x8D5f597f2dE53CC8Ed1a948abF972F8C85301a17",
+  "shapeRegistry": "0x41273A14e77d7dA256c05276B95D8F2054C54930",
+  "skillDefinitionRegistry": "0x9bcd76e8E7e5E57863dca0631F44707974cBa58B",
+  "smartAgentPaymaster": "0xb48Ccecb9118D579204868850f62feb4653c1469",
+  "timestampEnforcer": "0x5ce38463DcE9c910F09a14e6D0650258e72eEcCA",
+  "universalSignatureValidator": "0x4BC3Ea8920c87638e0612007eb9de0d70ee4Ba8f",
+  "valueEnforcer": "0x45170540Ba4d90C7c27103FBF4B136c5EdA545BB"
 }

package/dist/abi/AgentAccount.json

@@ -590,6 +590,25 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "isExternalCustodianOrPasskey",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "isModuleInstalled",
@@ -1267,6 +1286,11 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "AdminRequiresCustodyQuorum",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "AgenticPrimitivesAgentNotAllowedAsCustodian",
@@ -1310,6 +1334,11 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "DelegatedGovernanceForbidden",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "DirectUpgradeBlocked",

package/dist/abi/AgentAccountFactory.json

@@ -390,6 +390,17 @@
     ],
     "anonymous": false
   },
+  {
+    "type": "error",
+    "name": "InfeasibleOrgConfig",
+    "inputs": [
+      {
+        "name": "nSigners",
+        "type": "uint8",
+        "internalType": "uint8"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "InsufficientTrusteesForMode",

package/dist/abi/CustodyPolicy.json

@@ -778,6 +778,17 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "AdminSelfSignerNotAllowed",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "AdminUnauthorizedSigner",
@@ -843,6 +854,17 @@
     "name": "EmptyOwnerSet",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "InfeasibleOrgConfig",
+    "inputs": [
+      {
+        "name": "nSigners",
+        "type": "uint8",
+        "internalType": "uint8"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "InvalidCustodyAction",

package/dist/abi/DelegationManager.json

@@ -622,6 +622,17 @@
     "name": "LegacyRevocationDisabled",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "NoCodeEnforcer",
+    "inputs": [
+      {
+        "name": "enforcer",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "NotDelegatorOrDelegate",

package/dist/abi/IAgentAccountFactoryView.json

@@ -12,6 +12,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "custodyPolicy",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "governance",

package/dist/abi/PaymentEnforcer.json

@@ -20,22 +20,22 @@
     "name": "afterHook",
     "inputs": [
       {
-        "name": "",
+        "name": "terms",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "",
+        "name": "args",
         "type": "bytes",
         "internalType": "bytes"
       },
       {
-        "name": "",
+        "name": "delegationHash",
         "type": "bytes32",
         "internalType": "bytes32"
       },
       {
-        "name": "",
+        "name": "delegator",
         "type": "address",
         "internalType": "address"
       },
@@ -55,13 +55,13 @@
         "internalType": "uint256"
       },
       {
-        "name": "",
+        "name": "callData",
         "type": "bytes",
         "internalType": "bytes"
       }
     ],
     "outputs": [],
-    "stateMutability": "view"
+    "stateMutability": "nonpayable"
   },
   {
     "type": "function",
@@ -412,6 +412,11 @@
     "name": "NotTransferCall",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "SettlementNotObserved",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "ValueNotZero",

package/dist/deployments/base-sepolia.d.ts

@@ -21,7 +21,11 @@ export interface Deployments {
   readonly "deployer": Address;
   readonly "entryPoint": Address;
   readonly "geoFeatureRegistry": Address;
+  readonly "mockUsdc": Address;
   readonly "ontologyTermRegistry": Address;
+  readonly "paymentEnforcer": Address;
+  readonly "paymentEscrow": Address;
+  readonly "paymentReceiptRegistry": Address;
   readonly "permissionlessSubregistry": Address;
   readonly "permissionlessSubregistryDemoAgent": Address;
   readonly "quorumEnforcer": Address;
@@ -32,10 +36,6 @@ export interface Deployments {
   readonly "timestampEnforcer": Address;
   readonly "universalSignatureValidator": Address;
   readonly "valueEnforcer": Address;
-  readonly "paymentEnforcer": Address;
-  readonly "paymentReceiptRegistry": Address;
-  readonly "mockUsdc": Address;
-  readonly "paymentEscrow": Address;
   readonly "chainId": number;
 }
 export declare const CONTRACTS: Deployments;

package/dist/deployments/base-sepolia.js

@@ -1,40 +1,40 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 // Source: deployments-base-sepolia.json
 export const CONTRACTS = {
-  "agentAccountFactory": "0x3E68B72B45e7C9d35B210E4Ab06e5Cece85cEbE4",
-  "agentAccountImplementation": "0x338318ABf9C8b28E7e77ed96a91857cCE1Db1328",
-  "agentNameRegistry": "0x15F7ed064A230C011b0244A14fD9653f011d609B",
-  "agentNameResolver": "0xcC9855A23C7a4D4592E68Fe47E195C2f9D832473",
-  "agentNameUniversalResolver": "0x7d777d2d0bbc1806B9Cc779121C27fbaAaFDb60b",
-  "agentProfileResolver": "0xc448EB159B2a35F07f6E1814CC8d125244d7384B",
-  "agentRegistryBase": "0xe320947b18D3C71710DCB75D4bf200147ded18Df",
-  "agentRelationship": "0xE6B8F6C7F1c9857013dA356DF08D0384334A9607",
-  "agreementRegistry": "0x7f4d6A74eda1D6ce251D371566f1c6639F9B0DDa",
-  "allowedMethodsEnforcer": "0xf77cf06aCd8b9e2f3204fe4bE16449B3594c9633",
-  "allowedTargetsEnforcer": "0xe3909FdEfD8b74B7D006E045DCd678e97D469Bfd",
-  "approvedHashRegistry": "0x90735B5281434D1746926E2AA722Cc6DbF3EFEe6",
-  "attestationRegistry": "0xaE3861fd299c74D96F6FCA25f19c7ACf8b9020ed",
-  "callDataHashEnforcer": "0x9F12932F1b85A1F96c1Cb1c5A0645e3F0Ab478Dd",
+  "agentAccountFactory": "0x1D3BF769B3991faA7847872cE05FA22beE2f07e5",
+  "agentAccountImplementation": "0xd96eA06208140763256899727B22A1DF7A09387d",
+  "agentNameRegistry": "0x4e5a6369C91B9093ad17bF0eAc8d344F1b41EdE0",
+  "agentNameResolver": "0x776a5bADb7DBE238048542E0c91f7a86933C8986",
+  "agentNameUniversalResolver": "0x8539fad5B148512775cD3712bb55F2fd5f1C85cB",
+  "agentProfileResolver": "0x82dBC51a77A92A51b177FFE97181cD40aa1c24ab",
+  "agentRegistryBase": "0x54f76a5faab995f194cc61c50eb5e272c8d85cf4",
+  "agentRelationship": "0x763c164d8275F76A806721B423aaB5ad6cb4fEA1",
+  "agreementRegistry": "0xaD300f03EdDf8F015D5583feC8D5F2D1BBC6f854",
+  "allowedMethodsEnforcer": "0xa149A31F32789cDBfd5f0eed1CF92E7BCb91b549",
+  "allowedTargetsEnforcer": "0xfb78589C8a9f464BD1e9A340BC809CEe7949b17c",
+  "approvedHashRegistry": "0x7152282bB71692E7f73ff31DdB43f4a50818845b",
+  "attestationRegistry": "0x9f9bCAF7b238b87c6d7897767c473b6f8C55C0a6",
+  "callDataHashEnforcer": "0x0fCE11eC016bd4Bc3a60951FbE4e9Fe7087955b1",
   "chainId": 84532,
-  "custodyPolicy": "0xDeD6542A55476745846370562d1c75D15DDf2572",
-  "delegationManager": "0x3a8E2cE74564f699b135db6f266ccDb563979C05",
+  "custodyPolicy": "0xF408e54dA113Fe6b785615750c6Bab6F9008A9d9",
+  "delegationManager": "0xaCdB7001dB8305c23703f6DB0EfB8B9BC1d75D62",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x9B33De9d9597de82Eb56b5B26C478Dc0a6955388",
-  "geoFeatureRegistry": "0x78FdCae0aC9B0CD9943996282b8F39D77bec5b1c",
-  "ontologyTermRegistry": "0xf486Ba6e9FD2d687e68a1a7A77D0FA27bb1E66c3",
-  "permissionlessSubregistry": "0x1B8ED8693738e1A9DD653FEE5430d49e00202Bb7",
-  "permissionlessSubregistryDemoAgent": "0xc76b1cdB4340398f59fD9C5d6Cb65fCdC606B33b",
-  "quorumEnforcer": "0x76fb494aE991d1fe1603a91384BA4c1F890442a8",
-  "relationshipTypeRegistry": "0x526fBF5900b18B1D06201493bcE470b416FB71C3",
-  "shapeRegistry": "0x03AbD67A910abB2c5026f1973A05502e0473e316",
-  "skillDefinitionRegistry": "0x5ae94aba46D7daA1Ca9eaE0051043Ad05bcc392B",
-  "smartAgentPaymaster": "0x8eF92B9D62826052D8F7e6dcaB630dC3890bF540",
-  "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
-  "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
-  "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
-  "paymentEnforcer": "0xCB5D2dbfc11e146d568764471516C9DB734D2c60",
-  "paymentReceiptRegistry": "0x391Ed4D7538f80a221F910539005bB00b996Ff9F",
-  "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C",
-  "paymentEscrow": "0xC85EB1831e9180F5e2cA7854f362f6C9a6D727EA"
+  "entryPoint": "0x9Eb5F84E8323aACD4AD61b4b980aDB23B15c2903",
+  "geoFeatureRegistry": "0x74AEb56420a8630c611c36b3053780d90191f94d",
+  "mockUsdc": "0x07190E7586a468E808D6bd58dC3CEdEC0b25B8E3",
+  "ontologyTermRegistry": "0x69670d24AcE8C47a294231a1fdC4207642669a25",
+  "paymentEnforcer": "0xF08946A2c4eed77f366AfDc39AE150F2262E5d29",
+  "paymentEscrow": "0x30f0fd53dc1245062962b498be3a7e9641cc7c6c",
+  "paymentReceiptRegistry": "0x36f0cd94A286b011b8C6106E69E14567fb7A498e",
+  "permissionlessSubregistry": "0xE37E1da21Bcce70b515d2f44d84D757c358b96B6",
+  "permissionlessSubregistryDemoAgent": "0xeE2Db355624BdB4a7551604229EbE72683f8fD85",
+  "quorumEnforcer": "0xd030196bD6Ba6a654e6E8f7e3609aAd470122422",
+  "relationshipTypeRegistry": "0x8D5f597f2dE53CC8Ed1a948abF972F8C85301a17",
+  "shapeRegistry": "0x41273A14e77d7dA256c05276B95D8F2054C54930",
+  "skillDefinitionRegistry": "0x9bcd76e8E7e5E57863dca0631F44707974cBa58B",
+  "smartAgentPaymaster": "0xb48Ccecb9118D579204868850f62feb4653c1469",
+  "timestampEnforcer": "0x5ce38463DcE9c910F09a14e6D0650258e72eEcCA",
+  "universalSignatureValidator": "0x4BC3Ea8920c87638e0612007eb9de0d70ee4Ba8f",
+  "valueEnforcer": "0x45170540Ba4d90C7c27103FBF4B136c5EdA545BB"
 };
 export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.13",
+  "version": "1.0.0-alpha.15",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {

package/src/AgentAccount.sol

@@ -28,6 +28,11 @@ interface IAgentAccountFactoryView {
     ///      this address to call `IGovernanceView.isPaused()` from
     ///      `whenNotPaused`-guarded entrypoints.
     function governance() external view returns (address);
+    /// @dev Wave-1/ACCT-C1 — the canonical CustodyPolicy this factory installs
+    ///      as the custody executor for `mode > 0` accounts. AgentAccount reads it
+    ///      to decide whether IT is custody-governed (its CustodyPolicy is installed)
+    ///      vs. merely hosting an unrelated utility executor.
+    function custodyPolicy() external view returns (address);
 }
 
 /// @dev R6.5 — minimal interface for the pause read. Mirrors the same
@@ -158,6 +163,27 @@ contract AgentAccount is
     ///      `_authorizeUpgrade` frame) AND absent from the storage layout.
     bool private transient _upgradeAuthorizedCtx;
 
+    /// @dev Wave-1 / ACCT-C1 (spec 300) — transient "this call stack was entered
+    ///      by the installed CustodyPolicy EXECUTOR via `executeFromModule`"
+    ///      (custody-quorum authorized) flag. Set ONLY inside `executeFromModule`,
+    ///      around the dispatched call, cleared after. Governance mutators require
+    ///      it on a custody-governed account (`mode > 0`, a CustodyPolicy EXECUTOR
+    ///      installed): a 1-of-N UserOp `execute(self, adminSelector)` self-call
+    ///      leaves the flag unset and reverts, so the quorum+timelock can no longer
+    ///      be bypassed by a single compromised key. Person accounts (`mode 0`, no
+    ///      CustodyPolicy) self-govern and are exempt. Transient ⇒ tx-global +
+    ///      absent from the storage layout.
+    bool private transient _custodyGovCtx;
+
+    /// @dev Wave-1 / DM-3 (spec 300) — transient "this execution stack originated
+    ///      from the DelegationManager". Set at the outermost `execute`/`executeBatch`
+    ///      frame whose `msg.sender == _delegationManager`, preserved across the
+    ///      legitimate `DM → execute(self, executeBatch(...))` nest, cleared by the
+    ///      frame that set it. While set, a self-targeted governance selector is
+    ///      rejected — a delegation may never reach account governance (that is the
+    ///      CustodyPolicy's job), regardless of custody mode.
+    bool private transient _delegationExecCtx;
+
     /// @dev Spec 007 Phase A.5 — maximum permitted upgrade timelock to
     ///      protect against an owner accidentally setting an absurdly
     ///      large delay that bricks future migrations.
@@ -223,6 +249,15 @@ contract AgentAccount is
     error LegacyUpgradePathDisabled();
     error ModuleOperationNotAllowed();
 
+    // Wave 1 — account authorization boundary (spec 300 / ACCT-C1 + DM-3).
+    /// @notice A governance mutator was reached on a custody-governed account
+    ///         (`mode > 0`) outside the CustodyPolicy `executeFromModule` path —
+    ///         i.e. a single-signer UserOp `execute(self, adminSelector)` self-call.
+    error AdminRequiresCustodyQuorum();
+    /// @notice A delegation-originated execution stack tried to self-call an
+    ///         account-governance selector. Delegations may never reach governance.
+    error DelegatedGovernanceForbidden();
+
     /// @notice Emitted when `setDelegationManager` rotates the DM via a
     ///         self-call (the only authorized path post-Wave-2A).
     event DelegationManagerRotated(address indexed newDelegationManager);
@@ -441,8 +476,14 @@ contract AgentAccount is
         // matured owner queue — set `_upgradeAuthorizedCtx` and pass through, so the
         // custody path is not double-delayed. A zero timelock keeps the
         // immediate-upgrade default (backward-compatible).
-        if (_upgradeTimelock != 0 && !_upgradeAuthorizedCtx) {
-            revert DirectUpgradeBlocked();
+        // Wave-1/ACCT-C1 + M-4 (spec 300): outside an authorized context, a
+        // custody-governed account (`mode>0`) may upgrade ONLY through the
+        // CustodyPolicy quorum — reject even when the per-account timelock is 0 (M-4
+        // floors it non-zero at the factory, but a quorum-set 0 must not re-open the
+        // direct path). A person account keeps the CA-1 behavior (timelock if set).
+        if (!_upgradeAuthorizedCtx) {
+            if (_hasCustodyGovernance()) revert AdminRequiresCustodyQuorum();
+            if (_upgradeTimelock != 0) revert DirectUpgradeBlocked();
         }
     }
 
@@ -478,6 +519,7 @@ contract AgentAccount is
     ///         meaningful when a timelock is configured — with none set, upgrade
     ///         directly. Overwrites any existing pending upgrade.
     function scheduleUpgrade(address newImplementation) external onlySelf {
+        _requireCustodyGoverned();
         if (newImplementation == address(0)) revert ZeroAddress();
         uint256 tl = _upgradeTimelock;
         if (tl == 0) revert UpgradeTimelockNotSet();
@@ -533,6 +575,7 @@ contract AgentAccount is
     ///         (`onlySelf`). 0 == immediate upgrades (default,
     ///         backward-compat).
     function setUpgradeTimelock(uint256 secs) external onlySelf {
+        _requireCustodyGoverned();
         if (secs > MAX_UPGRADE_TIMELOCK) {
             revert UpgradeTimelockTooLong(secs, MAX_UPGRADE_TIMELOCK);
         }
@@ -576,6 +619,7 @@ contract AgentAccount is
      *         a self-call into this function.
      */
     function setDelegationManager(address dm) external onlySelf {
+        _requireCustodyGoverned();
         if (dm.code.length == 0) revert ValidatorRequired();
         _delegationManager = dm;
         emit DelegationManagerRotated(dm);
@@ -639,6 +683,7 @@ contract AgentAccount is
      *                              delegation the owner has authorized.
      */
     function acceptSessionDelegation(bytes32 sessionDelegationHash) external onlySelf {
+        _requireCustodyGoverned();
         if (_acceptedSessionDelegations[sessionDelegationHash]) {
             revert SessionDelegationAlreadyAccepted(sessionDelegationHash);
         }
@@ -823,6 +868,10 @@ contract AgentAccount is
         address module,
         bytes calldata initData
     ) external onlySelfOrFactoryInit whenNotPaused {
+        // Wave-1/ACCT-C1: on a custody-governed account, module installs must route
+        // through the CustodyPolicy quorum. Exempt by construction at factory-init
+        // (no EXECUTOR installed yet ⇒ `_hasCustodyGovernance()` is false).
+        _requireCustodyGoverned();
         if (module == address(0)) revert ZeroAddress();
         if (!_isSupportedModuleType(moduleTypeId)) revert UnsupportedModuleType(moduleTypeId);
 
@@ -872,6 +921,7 @@ contract AgentAccount is
         // at deploy time, and there's never a legitimate reason for
         // the factory to do that.
         if (msg.sender != address(this)) revert ModuleOperationNotAllowed();
+        _requireCustodyGoverned();
         if (!_isSupportedModuleType(moduleTypeId)) revert UnsupportedModuleType(moduleTypeId);
 
         ModulesStorage storage $ = _modulesStorage();
@@ -978,14 +1028,30 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
-        // CA-1: a module action is a custody-governed context (only an installed
-        // EXECUTOR — the CustodyPolicy — reaches here, gated upstream by its own
-        // T5 quorum + timelock). Authorize any upgrade it dispatches so the custody
-        // path is exempt from the per-account `_upgradeTimelock` (no double delay).
-        // Transient + nonReentrant, cleared after the call.
-        _upgradeAuthorizedCtx = true;
+        // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action from the CANONICAL CustodyPolicy is a
+        // custody-governed context (gated upstream by its own T5 quorum + timelock). `_custodyGovCtx`
+        // authorizes every governance mutator this call dispatches (the ONLY way past
+        // `_requireCustodyGoverned` on a `mode>0` account); `_upgradeAuthorizedCtx` additionally exempts a
+        // dispatched upgrade from the per-account timelock (no double delay). Both transient.
+        //
+        // NEW-EXEC-MODULE-1 (2026-07-05 audit, internal + external): grant that context ONLY to the
+        // canonical CustodyPolicy the factory installs — NOT to any installed executor. Otherwise a second
+        // (utility / automation) executor a quorum installs believing it unprivileged would silently inherit
+        // full authority to mutate custody / DM / upgrade / modules, bypassing quorum+timelock. Matching the
+        // specific policy address is the same check `_hasCustodyGovernance` uses. A non-canonical executor
+        // runs WITHOUT the context, so `_requireCustodyGoverned` rejects any governance mutator it dispatches
+        // (defense-in-depth: not reachable at v1 since the factory installs only CustodyPolicy).
+        address f = _factory;
+        bool custodyGoverned = f != address(0) && msg.sender == IAgentAccountFactoryView(f).custodyPolicy();
+        if (custodyGoverned) {
+            _custodyGovCtx = true;
+            _upgradeAuthorizedCtx = true;
+        }
         (bool ok, bytes memory ret) = target.call{value: value}(data);
-        _upgradeAuthorizedCtx = false;
+        if (custodyGoverned) {
+            _upgradeAuthorizedCtx = false;
+            _custodyGovCtx = false;
+        }
         if (!ok) {
             assembly { revert(add(ret, 32), mload(ret)) }
         }
@@ -1035,6 +1101,13 @@ contract AgentAccount is
     function execute(address target, uint256 value, bytes calldata data) external override nonReentrant whenNotPaused {
         _requireForExecute();
 
+        // DM-3 (spec 300): mark a delegation-originated stack (set once at the
+        // outermost DM frame; preserved across the legitimate DM → execute(self,
+        // executeBatch(...)) nest) and forbid it from self-calling governance.
+        bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
+        if (setDelCtx) _delegationExecCtx = true;
+        _rejectDelegatedGovernance(target, data);
+
         ModulesStorage storage $ = _modulesStorage();
         address[] memory hooks = $.installedList[MODULE_TYPE_HOOK];
         bytes[] memory hookData = new bytes[](hooks.length);
@@ -1062,6 +1135,8 @@ contract AgentAccount is
         for (uint256 i = 0; i < hooks.length; i++) {
             IERC7579HookLike(hooks[i]).postCheck(hookData[i]);
         }
+
+        if (setDelCtx) _delegationExecCtx = false;
     }
 
     /// @notice Atomically execute multiple calls from this account.
@@ -1088,6 +1163,13 @@ contract AgentAccount is
     function executeBatch(Call[] calldata calls) external override whenNotPaused {
         _requireForExecute();
 
+        // DM-3 (spec 300): same delegation-origin marking as `execute`. Preserved
+        // across the DM → execute(self, executeBatch(...)) nest so a governance
+        // self-call in ANY inner call is caught even though this frame's
+        // msg.sender is address(this).
+        bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
+        if (setDelCtx) _delegationExecCtx = true;
+
         ModulesStorage storage $ = _modulesStorage();
         address[] memory hooks = $.installedList[MODULE_TYPE_HOOK];
         bytes[] memory hookData = new bytes[](hooks.length);
@@ -1101,6 +1183,7 @@ contract AgentAccount is
         }
 
         for (uint256 i = 0; i < calls.length; i++) {
+            _rejectDelegatedGovernance(calls[i].target, calls[i].data);
             (bool ok, bytes memory ret) = calls[i].target.call{ value: calls[i].value }(calls[i].data);
             if (!ok) {
                 assembly {
@@ -1113,6 +1196,8 @@ contract AgentAccount is
         for (uint256 i = 0; i < hooks.length; i++) {
             IERC7579HookLike(hooks[i]).postCheck(hookData[i]);
         }
+
+        if (setDelCtx) _delegationExecCtx = false;
     }
 
     // ─── ERC-4337 ───────────────────────────────────────────────────
@@ -1146,6 +1231,68 @@ contract AgentAccount is
         }
     }
 
+    // ─── Wave 1 — account authorization boundary (spec 300) ─────────
+
+    /// @dev True when this account is custody-governed — i.e. the canonical
+    ///      CustodyPolicy the factory installs for `mode > 0` accounts is installed
+    ///      as an EXECUTOR here. Governance mutators then require the
+    ///      `executeFromModule` (quorum+timelock) path. A `mode 0` person account
+    ///      (no CustodyPolicy) self-governs; installing an UNRELATED utility executor
+    ///      does NOT make it custody-governed (we check the specific policy address,
+    ///      not "any executor"). If the factory is unknown (legacy direct deploy),
+    ///      fall back to person semantics.
+    function _hasCustodyGovernance() internal view returns (bool) {
+        address f = _factory;
+        if (f == address(0)) return false;
+        address cp = IAgentAccountFactoryView(f).custodyPolicy();
+        if (cp == address(0)) return false;
+        return _modulesStorage().installed[MODULE_TYPE_EXECUTOR][cp];
+    }
+
+    /// @dev ACCT-C1 gate: on a custody-governed account, a governance mutator is
+    ///      reachable only through `executeFromModule` (which sets `_custodyGovCtx`).
+    ///      A single-signer UserOp `execute(self, adminSelector)` self-call leaves the
+    ///      flag unset and reverts here, so the custody quorum can no longer be bypassed.
+    function _requireCustodyGoverned() internal view {
+        if (_hasCustodyGovernance() && !_custodyGovCtx) revert AdminRequiresCustodyQuorum();
+    }
+
+    /// @dev DM-3 gate: a delegation-originated stack may never self-call an account
+    ///      governance selector. `_delegationExecCtx` is set at the outermost
+    ///      DM-driven `execute`/`executeBatch` and persists across the legitimate
+    ///      `DM → execute(self, executeBatch(...))` nest, so a nested governance
+    ///      self-call is caught regardless of mode.
+    function _rejectDelegatedGovernance(address target, bytes calldata data) internal view {
+        if (
+            _delegationExecCtx &&
+            target == address(this) &&
+            data.length >= 4 &&
+            _isGovernanceSelector(bytes4(data[0:4]))
+        ) {
+            revert DelegatedGovernanceForbidden();
+        }
+    }
+
+    /// @dev The account-governance selector set — mutators that change custody,
+    ///      the DelegationManager, installed modules, or the upgrade path. Kept in
+    ///      sync with the `_requireCustodyGoverned`-gated functions above.
+    function _isGovernanceSelector(bytes4 s) internal pure returns (bool) {
+        return
+            s == this.setDelegationManager.selector ||
+            s == UUPSUpgradeable.upgradeToAndCall.selector ||
+            s == this.setUpgradeTimelock.selector ||
+            s == this.scheduleUpgrade.selector ||
+            s == this.executePendingUpgrade.selector ||
+            s == this.cancelPendingUpgrade.selector ||
+            s == this.installModule.selector ||
+            s == this.uninstallModule.selector ||
+            s == IAgentAccount.addCustodian.selector ||
+            s == IAgentAccount.removeCustodian.selector ||
+            s == this.addPasskey.selector ||
+            s == this.removePasskey.selector ||
+            s == this.acceptSessionDelegation.selector;
+    }
+
     // ─── ERC-1271 ───────────────────────────────────────────────────
 
     /// @dev 32-byte ERC-6492 magic suffix — `0x6492…6492` repeated.
@@ -1330,6 +1477,19 @@ contract AgentAccount is
         return _passkeyStorage().piaToCredentialId[account] != bytes32(0);
     }
 
+    /// @notice EXT-ISCUSTODIAN-1 (2026-07-05 audit): like `isCustodian` but EXCLUDES the account itself.
+    /// @dev `isCustodian(address(this)) == true` is deliberate (account-actor compatibility), but that
+    ///      footgun can recreate the ACCT-C2 quorum-collapse class in a FUTURE consumer that reuses
+    ///      `isCustodian` as if it meant "external signer." Any quorum / authority consumer that must count
+    ///      only real external custodians / passkeys (never the account) should use THIS view. ACCT-C2 fixed
+    ///      the current CustodyPolicy quorum at the counting site (reject signer==account); this gives new
+    ///      consumers the safe primitive so the class can't reappear off-path.
+    function isExternalCustodianOrPasskey(address account) external view returns (bool) {
+        if (account == address(this)) return false;
+        if (_externalCustodians[account]) return true;
+        return _passkeyStorage().piaToCredentialId[account] != bytes32(0);
+    }
+
     /// @inheritdoc IAgentAccount
     /// @dev Counts EOA/contract custodians PLUS registered passkeys —
     ///      each passkey contributes one PIA-custodian. Matches the
@@ -1359,6 +1519,7 @@ contract AgentAccount is
     ///      the ERC-165 marker. Passkey custodians are not added here;
     ///      use `addPasskey` instead.
     function addCustodian(address owner) external override onlySelf whenNotPaused {
+        _requireCustodyGoverned();
         if (owner == address(0)) revert ZeroAddress();
         if (_externalCustodians[owner]) revert CustodianAlreadyExists(owner);
         if (_isAgenticPrimitivesAgent(owner)) {
@@ -1402,6 +1563,7 @@ contract AgentAccount is
     ///      owner if there are also no registered passkeys. A passkey-only
     ///      account is allowed, but a zero-signer account is not.
     function removeCustodian(address owner) external override onlySelf {
+        _requireCustodyGoverned();
         if (!_externalCustodians[owner]) revert CustodianDoesNotExist(owner);
         if (_externalCustodianCount == 1 && _passkeyStorage().count == 0) revert CannotRemoveLastCustodian();
         _externalCustodians[owner] = false;
@@ -1466,6 +1628,7 @@ contract AgentAccount is
         uint256 y,
         bytes32 rpIdHash
     ) external onlySelf {
+        _requireCustodyGoverned();
         if (x == 0 || y == 0) revert InvalidPasskeyPublicKey();
         // Audit C-6: zero digest poisons piaToCredentialId mapping.
         if (credentialIdDigest == bytes32(0)) revert InvalidCredentialIdDigest();
@@ -1490,6 +1653,7 @@ contract AgentAccount is
     ///         AND passkeys together. Also clears the credential's PIA
     ///         entry so `isCustodian(pia)` flips back to false.
     function removePasskey(bytes32 credentialIdDigest) external onlySelf {
+        _requireCustodyGoverned();
         PasskeyStorage storage $ = _passkeyStorage();
         if (!$.registered[credentialIdDigest]) revert PasskeyNotRegistered(credentialIdDigest);
         if (_externalCustodianCount + $.count == 1) revert CannotRemoveLastSigner();

package/src/AgentAccountFactory.sol

@@ -77,6 +77,9 @@ contract AgentAccountFactory is GovernanceManaged {
     error NoInitialSigner();
     error InsufficientTrusteesForMode(uint8 mode, uint256 actual, uint256 required);
     error TrusteesRequiredForRecoverableMode(uint8 mode);
+    /// @notice ACCT-M1 (spec 300): a mode-3 (org) account needs ≥2 signers so its separation-of-duties
+    ///         (disjoint propose + apply quorums) is satisfiable — a 1-signer org can never split duties.
+    error InfeasibleOrgConfig(uint8 nSigners);
     error ZeroAddress();
     /// @notice R9.6 / ATL-SEC-05 -- thrown when `params.custodians.length`
     ///         exceeds `MAX_INITIAL_CUSTODIANS`. Without this cap,
@@ -308,6 +311,19 @@ contract AgentAccountFactory is GovernanceManaged {
             thresholds[t] = CustodyPolicy(custodyPolicy).defaultApprovals(uint8(nSigners), t);
         }
 
+        // ACCT-M1 (spec 300): mode-3 (org) separation-of-duties requires DISJOINT propose + apply quorums
+        // for the T4/T5 tiers, so a satisfiable config needs 2×threshold DISTINCT signers. The default
+        // matrix sets T4/T5 = N for small N (all custodians), which would demand 2N signers — making every
+        // such change permanently un-executable (the account silently locks). Cap the SoD-constrained
+        // thresholds at floor(N/2) so a disjoint quorum always exists, and require ≥2 signers (a 1-signer
+        // org can't split duties). Modes 0-2 have no SoD, so their thresholds are unchanged.
+        if (params.mode == 3) {
+            if (nSigners < 2) revert InfeasibleOrgConfig(uint8(nSigners));
+            uint8 sodCap = uint8(nSigners / 2); // ≥ 1 since nSigners ≥ 2
+            if (thresholds[4] > sodCap) thresholds[4] = sodCap;
+            if (thresholds[5] > sodCap) thresholds[5] = sodCap;
+        }
+
         uint32[7] memory timelocks;
         timelocks[4] = timelockOverrides[4] == 0 ? uint32(1 hours)  : timelockOverrides[4];
         timelocks[5] = timelockOverrides[5] == 0 ? uint32(24 hours) : timelockOverrides[5];

package/src/SmartAgentPaymaster.sol

@@ -260,16 +260,21 @@ contract SmartAgentPaymaster is BasePaymaster {
         return _pausedMirror;
     }
 
-    /// @dev Read the canonical governance pause flag. Used ONLY by the
-    ///      out-of-band sync path, never during validation. Mirrors the prior
-    ///      defensive decode: a non-conforming governance (EOA / missing fn)
-    ///      reads as "not paused" so legacy / test deploys keep working.
+    /// @dev Read the canonical governance pause flag. Used ONLY by the out-of-band sync path, never
+    ///      during validation (ERC-7562 scope). L1 (seam audit): distinguish "no governance configured"
+    ///      (legacy / test deploy — not paused, by design) from "governance IS configured but the read
+    ///      faulted / returned malformed data" (a governance outage or non-conforming contract), which now
+    ///      FAILS CLOSED — treat as paused so a sync during a governance fault halts sponsorship rather
+    ///      than fail-open sponsoring. Only a clean, decodable `false` permits sponsorship.
     function _governanceIsPaused() internal view returns (bool) {
-        if (governance.code.length == 0) return false;
+        // Unconfigured governance (unset, or an EOA with no code) → not paused (legacy/test path).
+        if (governance == address(0) || governance.code.length == 0) return false;
         (bool ok, bytes memory data) = governance.staticcall(
             abi.encodeWithSelector(IGovernanceView.isPaused.selector)
         );
-        return ok && data.length >= 32 && abi.decode(data, (bool));
+        // Configured but faulted (call failed or undecodable) → fail closed (paused).
+        if (!ok || data.length < 32) return true;
+        return abi.decode(data, (bool));
     }
 
     // ─── PM-2: governance-timelocked deposit withdrawal ────────────────

package/src/agency/DelegationManager.sol

@@ -109,6 +109,10 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     // Phase A.5 errors.
     error NotDelegatorOrDelegate();
     error HashMismatch();
+    /// @dev EXT-NOCODE-HOOK-1: a caveat enforcer with no code — a call to it would
+    ///      succeed vacuously (fail-OPEN), so the live before/after hook loops reject it,
+    ///      matching the view path (`verifyAuthorizationForCall` → "no-code-enforcer").
+    error NoCodeEnforcer(address enforcer);
     /// @dev Thrown by the deprecated permissionless `revokeDelegation(bytes32)`
     ///      path. Migrate callers to `revokeDelegationByOwner(Delegation)`.
     error LegacyRevocationDisabled();
@@ -454,6 +458,9 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ) internal {
         bytes32 dHash = hashDelegation(d);
         for (uint256 j = 0; j < d.caveats.length; j++) {
+            // EXT-NOCODE-HOOK-1: fail closed on a no-code enforcer (a call would succeed vacuously),
+            // symmetric with the view path's "no-code-enforcer" reject — never rely on call semantics.
+            if (d.caveats[j].enforcer.code.length == 0) revert NoCodeEnforcer(d.caveats[j].enforcer);
             ICaveatEnforcer(d.caveats[j].enforcer).beforeHook(
                 d.caveats[j].terms,
                 d.caveats[j].args,
@@ -475,6 +482,8 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ) internal {
         bytes32 dHash = hashDelegation(d);
         for (uint256 j = 0; j < d.caveats.length; j++) {
+            // EXT-NOCODE-HOOK-1: fail closed on a no-code enforcer, symmetric with the before-hook + view path.
+            if (d.caveats[j].enforcer.code.length == 0) revert NoCodeEnforcer(d.caveats[j].enforcer);
             ICaveatEnforcer(d.caveats[j].enforcer).afterHook(
                 d.caveats[j].terms,
                 d.caveats[j].args,

package/src/custody/CustodyPolicy.sol

@@ -309,10 +309,19 @@ contract CustodyPolicy {
     error AdminInsufficientQuorum(uint256 supplied, uint8 required);
     error AdminDuplicateOrUnsortedSigner(address signer);
     error AdminUnauthorizedSigner(address signer);
+    /// @notice ACCT-C2 (spec 300) — the account itself was presented as a quorum
+    ///         signer (via `isCustodian(address(this))==true` or the `v=0`
+    ///         self-referential ERC-1271 slot). A self-signature must never count
+    ///         toward the quorum, else one custodian forges an extra member.
+    error AdminSelfSignerNotAllowed(address account);
     error TrusteeAlreadyExists(address guardian);
     error TrusteeDoesNotExist(address guardian);
     error InvalidMode(uint8 mode_);
     error InvalidThresholdValue(uint8 thr);
+    /// @dev EXT-CHANGEMODE-1: a runtime ChangeMode into org mode (3) with an infeasible signer
+    ///      count (< 2, so separation-of-duties can't split proposers from appliers). Mirrors the
+    ///      factory's install-time InfeasibleOrgConfig.
+    error InfeasibleOrgConfig(uint8 nSigners);
     /// @dev CP-1: a tier that must be configured (T4/T5 at install, T6 at read)
     ///      was left unset — refuse rather than fall to the 1-of-n read fallback.
     error UnconfiguredTier(uint8 tier);
@@ -748,6 +757,11 @@ contract CustodyPolicy {
             );
             if (signer <= prev) revert AdminDuplicateOrUnsortedSigner(signer);
             prev = signer;
+            // ACCT-C2 (spec 300): the account is never its own quorum signer. Both
+            // exploit shapes — `isCustodian(address(this))==true` and the `v=0`
+            // self-referential ERC-1271 slot that recovers `signer==account` — land
+            // here as `signer == account`, so one guard closes both.
+            if (signer == account) revert AdminSelfSignerNotAllowed(account);
             if (vargs.guardianMode) {
                 if (!c.trustees[signer]) revert UnauthorizedTrustee(signer);
             } else {
@@ -874,6 +888,23 @@ contract CustodyPolicy {
         if (newMode > 3) revert InvalidMode(newMode);
         uint8 oldMode = c.mode;
         if (newMode == 0 && c.trusteeCount > 0) revert CannotDowngradeWithTrustees();
+        // EXT-CHANGEMODE-1 (2026-07-05 audit): a runtime ChangeMode must re-run the factory's install-time
+        // mode-3 feasibility so the account can't enter an un-executable / liveness-hostile org mode.
+        // Org SoD needs ≥2 signers (distinct proposers + appliers) and T4/T5 thresholds within the
+        // floor(N/2) cap (else 2×threshold > N → no disjoint quorum → the tier silently locks). Require the
+        // signer floor; cap the SoD-constrained thresholds (mirrors the factory, avoids a locked mode).
+        if (newMode == 3) {
+            uint256 n = IAgentAccount(account).custodianCount();
+            if (n < 2) revert InfeasibleOrgConfig(uint8(n));
+            uint8 sodCap = uint8(n / 2); // ≥ 1 since n ≥ 2
+            for (uint8 tier = 4; tier <= 5; tier++) {
+                uint8 v = c.approvalsRequiredByTier[tier];
+                if (v > sodCap) {
+                    c.approvalsRequiredByTier[tier] = sodCap;
+                    emit ThresholdChanged(account, tier, v, sodCap);
+                }
+            }
+        }
         c.mode = newMode;
         emit ModeChanged(account, oldMode, newMode);
     }
@@ -958,6 +989,13 @@ contract CustodyPolicy {
         if (newCount == 0) revert InvalidThresholdValue(newCount);
         uint256 n = IAgentAccount(account).custodianCount();
         if (uint256(newCount) > n) revert InvalidThresholdValue(newCount);
+        // acct-mode3-sod-cap-runtime (2026-07-05 audit): the factory caps mode-3 (org) T4/T5 thresholds at
+        // floor(N/2) at install so a DISJOINT propose+apply quorum always exists (2×threshold ≤ N). A later
+        // ChangeApprovalsRequired must not raise them past that cap and silently lock the tier — reject an
+        // explicit over-cap request loud (the org can lower N-constraints or use a lower threshold).
+        if (c.mode == 3 && (tier == 4 || tier == 5) && uint256(newCount) > n / 2) {
+            revert InvalidThresholdValue(newCount);
+        }
         uint8 oldValue = c.approvalsRequiredByTier[tier];
         if (oldValue == 0) oldValue = 1; // mirror _approvalsValue fallback
         c.approvalsRequiredByTier[tier] = newCount;

package/src/enforcers/PaymentEnforcer.sol

@@ -58,6 +58,13 @@ contract PaymentEnforcer is ICaveatEnforcer {
     /// delegator => delegationHash => nonce => consumed (on-chain replay guard)
     mapping(address => mapping(bytes32 => mapping(bytes32 => bool))) private _nonceUsed;
 
+    /// @notice M1 (seam audit): keccak256(delegator, delegationHash, nonce) => (treasury balanceBefore + 1).
+    ///         Snapshotted in `beforeHook`; consumed in `afterHook` to verify the transfer ACTUALLY moved
+    ///         `amount` to the treasury before the settlement receipt is written. `+1` sentinel so a set
+    ///         entry is distinguishable from an unset slot even when the treasury balance is 0. Set and
+    ///         deleted within a single non-reentrant `redeemDelegation`, so it never persists across txs.
+    mapping(bytes32 => uint256) private _settleSnap;
+
     /// @notice The ONLY authorized caller of the hooks (EXT-PMT-1 / C-NEW-1). Unlike the stateless
     ///         enforcers (timestamp/value/targets/methods), this enforcer MUTATES state (budget, nonce)
     ///         and writes a settlement receipt — so it is NOT safe to call externally. A direct caller
@@ -93,6 +100,10 @@ contract PaymentEnforcer is ICaveatEnforcer {
     error FrequencyExceeded(uint32 callsInWindow, uint32 maxRedemptionsPerWindow);
     error NonceReused(bytes32 nonce);
     error NotDelegationManager(address caller);
+    /// @notice M1 (seam audit): the transfer did not move `amount` to the treasury (a token that returns
+    ///         false without reverting, a fee-on-transfer skim, or a missing beforeHook snapshot) — so no
+    ///         settlement receipt is written and the whole redemption reverts.
+    error SettlementNotObserved();
 
     /// @dev The hooks are state-mutating + receipt-emitting, so ONLY the DelegationManager may invoke
     ///      them (EXT-PMT-1). `_runBeforeHooks`/`_runAfterHooks` call the enforcer directly, so during a
@@ -173,19 +184,49 @@ contract PaymentEnforcer is ICaveatEnforcer {
             delegator, delegationHash, mandateId, treasury, asset, amount, nonce, resourceHash, nextSpent, nextCalls
         );
 
-        // Trustless settlement receipt (PAY-CON-4). Reverting here reverts the whole redemption, so a
-        // settled charge always has a receipt and an unsettled one never does (atomic).
+        // M1 (seam audit): snapshot the treasury balance BEFORE the transfer. The trustless settlement
+        // receipt (PAY-CON-4) is written in `afterHook` ONLY once the transfer is observed to have moved
+        // `amount` to the treasury — a token that returns false without reverting (or a fee-on-transfer
+        // skim) then records NO receipt and reverts the whole redemption, so "a settled charge always has
+        // a receipt and an unsettled one never does" holds against the value that ACTUALLY moved.
+        _settleSnap[_settleKey(delegator, delegationHash, nonce)] = IERC20(asset).balanceOf(treasury) + 1;
+    }
+
+    function afterHook(
+        bytes calldata terms,
+        bytes calldata args,
+        bytes32 delegationHash,
+        address delegator,
+        address, /*redeemer*/
+        address, /*target*/
+        uint256, /*value*/
+        bytes calldata callData
+    ) external override onlyDelegationManager {
+        // Only this enforcer's own 192-byte-terms caveat carries a snapshot (beforeHook validated the
+        // shape); ignore anything else defensively so a malformed sibling caveat can't revert settlement.
+        if (terms.length != 192) return;
+        (address treasury, address asset,,,,) = abi.decode(terms, (address, address, uint256, uint256, uint32, uint32));
+        (bytes32 mandateId, bytes32 nonce, bytes32 resourceHash) = abi.decode(args, (bytes32, bytes32, bytes32));
+        (, uint256 amount) = abi.decode(callData[4:], (address, uint256));
+
+        bytes32 key = _settleKey(delegator, delegationHash, nonce);
+        uint256 snap = _settleSnap[key];
+        if (snap == 0) revert SettlementNotObserved(); // no beforeHook snapshot (defensive)
+        delete _settleSnap[key];
+
+        // The treasury must have received AT LEAST `amount` since the snapshot. A silent transfer failure
+        // (balance unchanged) or a fee-on-transfer short-delivery fails this and reverts the redemption.
+        if (IERC20(asset).balanceOf(treasury) < (snap - 1) + amount) revert SettlementNotObserved();
+
         if (address(receiptRegistry) != address(0)) {
             receiptRegistry.record(mandateId, delegator, treasury, asset, amount, resourceHash, delegationHash, nonce);
         }
     }
 
-    function afterHook(bytes calldata, bytes calldata, bytes32, address, address, address, uint256, bytes calldata)
-        external
-        view
-        override
-        onlyDelegationManager
-    {}
+    /// @dev Unique per redemption — the nonce is single-use per [delegator][delegationHash].
+    function _settleKey(address delegator, bytes32 delegationHash, bytes32 nonce) private pure returns (bytes32) {
+        return keccak256(abi.encode(delegator, delegationHash, nonce));
+    }
 
     // ── views (off-chain budget display + idempotency checks) ──
 

package/src/identity/AgentProfilePredicates.sol

@@ -28,6 +28,9 @@ library AgentProfilePredicates {
     // ─── Identity-only ──────────────────────────────────────────────
 
     bytes32 internal constant ATL_DESCRIPTION       = keccak256("atl:description");
+    /// spec 282 — publicly-asserted skill labels (string; the indexer projects to approf:skills, the
+    /// discovery matcher ranks on it). The agent's full private skill claims live in agent-skills VCs.
+    bytes32 internal constant ATL_SKILLS            = keccak256("atl:skills");
     bytes32 internal constant ATL_HOMEPAGE          = keccak256("atl:homepage");
     bytes32 internal constant ATL_AVATAR            = keccak256("atl:avatar");
     bytes32 internal constant ATL_PROFILE_SCHEMA_URI = keccak256("atl:profileSchemaURI");

package/src/naming/AgentNamePredicates.sol

@@ -55,6 +55,17 @@ library AgentNamePredicates {
     /// (per ADR-0008). `string`.
     bytes32 internal constant ATL_NATIVE_ID                  = keccak256("atl:nativeId");
 
+    /// `atl:connectionKind` — connection-bootstrap credential KIND (spec 280).
+    /// Stored as `bytes32` (hashed enum). Bound to CONNECTION_KIND_ENUM. OPT-IN,
+    /// owner-set, PUBLIC. Advertises how a returning person connects by name.
+    bytes32 internal constant ATL_CONNECTION_KIND            = keccak256("atl:connectionKind");
+
+    /// `atl:connectionAddress` — connection-bootstrap credential ADDRESS (spec 280).
+    /// The custodian EOA (wallet) or social KMS C_sub. `address`. OPT-IN, owner-set,
+    /// PUBLIC pre-select hint only (NOT required to connect). Deliberate, documented
+    /// name→credential index (ADR-0040 amendment). Never set automatically.
+    bytes32 internal constant ATL_CONNECTION_ADDRESS         = keccak256("atl:connectionAddress");
+
     // ─── Shape + enum-set ids ───────────────────────────────────────
 
     /// `atl:AgentName` — the class id for ShapeRegistry validation.
@@ -71,4 +82,14 @@ library AgentNamePredicates {
     bytes32 internal constant AGENT_KIND_PERSON              = keccak256("person");
     bytes32 internal constant AGENT_KIND_ORG                 = keccak256("org");
     bytes32 internal constant AGENT_KIND_SERVICE             = keccak256("service");
+
+    /// Enum set bound to `atl:connectionKind` (spec 280). Contains the
+    /// five hashed member ids below.
+    bytes32 internal constant CONNECTION_KIND_ENUM           = keccak256("atl:ConnectionKindEnum");
+
+    bytes32 internal constant CONNECTION_KIND_WALLET         = keccak256("wallet");
+    bytes32 internal constant CONNECTION_KIND_GOOGLE         = keccak256("google");
+    bytes32 internal constant CONNECTION_KIND_YOUVERSION     = keccak256("youversion");
+    bytes32 internal constant CONNECTION_KIND_PASSKEY        = keccak256("passkey");
+    bytes32 internal constant CONNECTION_KIND_MULTI          = keccak256("multi");
 }

package/src/naming/AgentNameRegistry.sol

@@ -261,7 +261,10 @@ contract AgentNameRegistry is GovernanceManaged {
 
         bytes32 lh = keccak256(bytes(label));
         childNode = keccak256(abi.encodePacked(parentNode, lh));
-        if (_records[childNode].registeredAt != 0) revert NodeAlreadyExists();
+        // M2 (seam audit): an EXPIRED name is reclaimable (parent-authorized re-register). Only a LIVE
+        // record blocks re-registration — previously expiry was inert and a name could never be reclaimed.
+        bool reclaiming = _records[childNode].registeredAt != 0;
+        if (reclaiming && !isExpired(childNode)) revert NodeAlreadyExists();
 
         _records[childNode] = NameRecord({
             owner: newOwner,
@@ -274,7 +277,8 @@ contract AgentNameRegistry is GovernanceManaged {
         });
 
         _children[parentNode][lh] = childNode;
-        _childLabels[parentNode].push(lh);
+        // Only index a brand-new child; a reclaim reuses the existing _childLabels entry (no duplicate).
+        if (!reclaiming) _childLabels[parentNode].push(lh);
         _label[childNode] = label;
 
         emit NameRegistered(childNode, parentNode, label, newOwner, resolverContract, expiry);
@@ -352,7 +356,13 @@ contract AgentNameRegistry is GovernanceManaged {
     function parent(bytes32 node) external view returns (bytes32) { return _records[node].parent; }
     function labelhash(bytes32 node) external view returns (bytes32) { return _records[node].labelhash; }
     function expiry(bytes32 node) external view returns (uint64) { return _records[node].expiry; }
-    function recordExists(bytes32 node) external view returns (bool) { return _records[node].registeredAt != 0; }
+    /// @dev M2 (seam audit): an EXPIRED record does NOT exist for read purposes — so the resolver
+    ///      (resolveName/resolveString, which gate on recordExists) and any other reader stop resolving
+    ///      an expired name. Expiry now provides real revocation, not a decorative field. Registry
+    ///      mutators gate on the raw `registeredAt`/`isExpired`, not this, so re-registration is unaffected.
+    function recordExists(bytes32 node) external view returns (bool) {
+        return _records[node].registeredAt != 0 && !isExpired(node);
+    }
     function registeredAt(bytes32 node) external view returns (uint64) { return _records[node].registeredAt; }
 
     function childNode(bytes32 parentNode, bytes32 lh) external view returns (bytes32) {