@agenticprimitives/contracts 1.0.0-alpha.14 → 1.0.0-alpha.16

package/deployments-base-sepolia.json

@@ -1,37 +1,37 @@
 {
-  "agentAccountFactory": "0xfCFafCbA6D88351aAAA190a5E971F06CAb40437d",
-  "agentAccountImplementation": "0x28b7d8e4682EF36bE479330Ba6CFE78E9E724Bc4",
-  "agentNameRegistry": "0x419928546Be67ba83C2aEaFCb6AD3364D5659C8D",
-  "agentNameResolver": "0xf96A25DeBF92C514459DC904ec8b79CE52D265A5",
-  "agentNameUniversalResolver": "0x3aC8Cb8Df1A8F9fcA05a37cEC82426b4432A53D3",
-  "agentProfileResolver": "0xb988e75179e11E4d17665d61c6a9Ce0e737A808F",
-  "agentRegistryBase": "0x7fab087fc3d0e1793bdb1d4c5d253635131ee1d1",
-  "agentRelationship": "0xDc409D69aC002B4FC90D4B453cc6B6277B98CB46",
-  "agreementRegistry": "0x882371Dc898f4835335a01558aE5C2B306069FcF",
-  "allowedMethodsEnforcer": "0x1Df87222f53ad26F599C60364F7232a3c0393ad9",
-  "allowedTargetsEnforcer": "0x55A9fD6aF8688EE9c68D15CDAa84d9DBD027B80F",
-  "approvedHashRegistry": "0x878272cc4E0c5bA026CEc29C9722F41fC0515fE5",
-  "attestationRegistry": "0xC695939EA5fB1d7a88BCF536EAC3C13bfcc9E50d",
-  "callDataHashEnforcer": "0x4ab106b80488FE6A920D973cDb96052a933c7450",
+  "agentAccountFactory": "0xE5d2d68b510cC2325fAB5e278855F10DcF02B80A",
+  "agentAccountImplementation": "0x3C547Ad14CcB3af20b86D671B0B04E61294ad05F",
+  "agentNameRegistry": "0xD9a1eCe15F4265c2f367ccD7Df740baeDc3d0523",
+  "agentNameResolver": "0x6E749688a49C3e32B59A54d374D2C116c4Bcc2ea",
+  "agentNameUniversalResolver": "0xCbb8C3E3a0C87962dC4831152c936Ca2A8B7826b",
+  "agentProfileResolver": "0x821de228dF591089575D9186BF9b5E305f12A221",
+  "agentRelationship": "0x1c6D59DD6fd9C7AF39B5afD06FFE7FC032E3608e",
+  "agreementRegistry": "0x92c4C46619842A8DDC5F59191d5FDb2c0aFc6874",
+  "allowedMethodsEnforcer": "0xb6fa9a218F4d6d3Af3dDaE26E3639a98632d4C09",
+  "allowedTargetsEnforcer": "0xca53c91257f6Fa2d1Bc51411B8da40056c861965",
+  "approvedHashRegistry": "0x97e322FCDc233Ef4f8f81979D6e12bCdEF226eF0",
+  "attestationRegistry": "0x34eF353F7DCdad386b7DD8643248A00bFcE863b8",
+  "callDataHashEnforcer": "0x5d8e57091d716A3623c29Bd6CD07A502484dA845",
   "chainId": 84532,
-  "custodyPolicy": "0xfAFDc79bc03CC7cE27f7AA12A3180E4E4C0BC3F6",
-  "delegationManager": "0x10DB7c0C5887910722354ef37eF874fBD124026C",
+  "custodyPolicy": "0x7d94B5DAc5d66d30e9D2Ed401BbAB237e86804E6",
+  "delegationManager": "0xd494a868B3216A307e9eCAe542D3903e3e364377",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x86Dc419feDD30F58250B314F5947aDd8cf379436",
-  "geoFeatureRegistry": "0x1C3b16aF3C2649f2b1ac78aFD6AB20dA0c379121",
-  "mockUsdc": "0x027de10c034f4055551C32491BCe65711BFE5f69",
-  "ontologyTermRegistry": "0x95C149Be91c925FB348Fa231aD28440FBaD562cF",
-  "paymentEnforcer": "0xB09b95E7BcB5d1b3C934facFBEd5bc474b15897E",
-  "paymentEscrow": "0x053dA1bdD4f0A75b82A75A46F189f137a5267928",
-  "paymentReceiptRegistry": "0x29645211A44714b06B8c4C55c109Ef285699f56c",
-  "permissionlessSubregistry": "0x542915A4118A28f49D40DAE53Ee0dc5721Aa4868",
-  "permissionlessSubregistryDemoAgent": "0x00EB165eA2fd33448bbBd5634a8ba92D616AEc1D",
-  "quorumEnforcer": "0x093ff9790601F712B3730C3cAa34f9353dC93739",
-  "relationshipTypeRegistry": "0x0250274222baBB42d44e72e9992DFEB701399a56",
-  "shapeRegistry": "0x7d0a4e9A981775a3807282bbf3499e77f5E2bA53",
-  "skillDefinitionRegistry": "0x7be2c5615d83Ca95e02b9BDe24879eb220cb1780",
-  "smartAgentPaymaster": "0xe93f4ea2cEA8CFF898948c54D6d6144A8F14ca72",
-  "timestampEnforcer": "0x118A74d6F59ecD9D19BA4b720157a007b6f39894",
-  "universalSignatureValidator": "0x3Bc1Debf2ac2a59548aC5Ad09404A56bA21b5803",
-  "valueEnforcer": "0xB7952Ca4a5E10efD24C03c069a0Ea7e262ebE959"
+  "entryPoint": "0x9B766cc05BD2193B5bE5dE50DB23DdB5F0B79c00",
+  "geoFeatureRegistry": "0x903c289a091CC9200811202De7dF3C22B18325d6",
+  "mockUsdc": "0xac4bf60DC027F71e70e7A821df64549e46d72Ed8",
+  "ontologyTermRegistry": "0x701F8a8521Dfa814d042781C42fA5e88fbf88F86",
+  "paymentEnforcer": "0x4680bcFBB2c2DC40254365300b922659919e3508",
+  "paymentReceiptRegistry": "0x496f9B025BB3FBcE8CDB6375176dd30B2eCE5D73",
+  "permissionlessSubregistry": "0xB4eF2166CEAccF8b2bbeAC9d0e28f991eb012385",
+  "permissionlessSubregistryDemoAgent": "0x857Bec62Dc039A9D06602335d060886206fC0972",
+  "quorumEnforcer": "0x38ffeA6A7c332a841E5fb33ED71B0BBF3387aFE1",
+  "relationshipTypeRegistry": "0x6E6ec3d0fDA798c86D324F2681ad6E16a7435658",
+  "shapeRegistry": "0xe105C57D384a62a3D465Ad6Ca2401B7117bC3415",
+  "skillDefinitionRegistry": "0xA00622b30a1cCe201C27A7a9c9dAAe1349492457",
+  "smartAgentPaymaster": "0xf40792F5b4d56931B9f77b4ae356fA89eA526224",
+  "timestampEnforcer": "0x579e5cDDd94C27688CA5A0DDd2256995e7759280",
+  "universalSignatureValidator": "0x01EC03058e98D0E56509E63b20F8454Fc31681F2",
+  "valueEnforcer": "0x8cC88ac64F3A4C5784E7F8B41cAd8E17Ea05c34B",
+  "agentRegistryBase": "0x1f8609F11fcaf0666534579EABe8B39778DFEdaA",
+  "paymentEscrow": "0xF523F7a30b22F35B2Ee506392cfA16BD8FEEe411"
 }

package/dist/abi/AgentAccount.json

@@ -590,6 +590,25 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "isExternalCustodianOrPasskey",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "isModuleInstalled",

package/dist/abi/AgentAccountFactory.json

@@ -448,6 +448,27 @@
     "name": "SystemPaused",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "TimelockBelowFloor",
+    "inputs": [
+      {
+        "name": "tier",
+        "type": "uint8",
+        "internalType": "uint8"
+      },
+      {
+        "name": "provided",
+        "type": "uint32",
+        "internalType": "uint32"
+      },
+      {
+        "name": "floorSecs",
+        "type": "uint32",
+        "internalType": "uint32"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "TooManyInitialCustodians",

package/dist/abi/CustodyPolicy.json

@@ -854,6 +854,17 @@
     "name": "EmptyOwnerSet",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "InfeasibleOrgConfig",
+    "inputs": [
+      {
+        "name": "nSigners",
+        "type": "uint8",
+        "internalType": "uint8"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "InvalidCustodyAction",

package/dist/abi/DelegationManager.json

@@ -622,6 +622,17 @@
     "name": "LegacyRevocationDisabled",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "NoCodeEnforcer",
+    "inputs": [
+      {
+        "name": "enforcer",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "NotDelegatorOrDelegate",

package/dist/deployments/base-sepolia.d.ts

@@ -8,7 +8,6 @@ export interface Deployments {
   readonly "agentNameResolver": Address;
   readonly "agentNameUniversalResolver": Address;
   readonly "agentProfileResolver": Address;
-  readonly "agentRegistryBase": Address;
   readonly "agentRelationship": Address;
   readonly "agreementRegistry": Address;
   readonly "allowedMethodsEnforcer": Address;
@@ -24,7 +23,6 @@ export interface Deployments {
   readonly "mockUsdc": Address;
   readonly "ontologyTermRegistry": Address;
   readonly "paymentEnforcer": Address;
-  readonly "paymentEscrow": Address;
   readonly "paymentReceiptRegistry": Address;
   readonly "permissionlessSubregistry": Address;
   readonly "permissionlessSubregistryDemoAgent": Address;
@@ -36,6 +34,8 @@ export interface Deployments {
   readonly "timestampEnforcer": Address;
   readonly "universalSignatureValidator": Address;
   readonly "valueEnforcer": Address;
+  readonly "agentRegistryBase": Address;
+  readonly "paymentEscrow": Address;
   readonly "chainId": number;
 }
 export declare const CONTRACTS: Deployments;

package/dist/deployments/base-sepolia.js

@@ -1,40 +1,40 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 // Source: deployments-base-sepolia.json
 export const CONTRACTS = {
-  "agentAccountFactory": "0xfCFafCbA6D88351aAAA190a5E971F06CAb40437d",
-  "agentAccountImplementation": "0x28b7d8e4682EF36bE479330Ba6CFE78E9E724Bc4",
-  "agentNameRegistry": "0x419928546Be67ba83C2aEaFCb6AD3364D5659C8D",
-  "agentNameResolver": "0xf96A25DeBF92C514459DC904ec8b79CE52D265A5",
-  "agentNameUniversalResolver": "0x3aC8Cb8Df1A8F9fcA05a37cEC82426b4432A53D3",
-  "agentProfileResolver": "0xb988e75179e11E4d17665d61c6a9Ce0e737A808F",
-  "agentRegistryBase": "0x7fab087fc3d0e1793bdb1d4c5d253635131ee1d1",
-  "agentRelationship": "0xDc409D69aC002B4FC90D4B453cc6B6277B98CB46",
-  "agreementRegistry": "0x882371Dc898f4835335a01558aE5C2B306069FcF",
-  "allowedMethodsEnforcer": "0x1Df87222f53ad26F599C60364F7232a3c0393ad9",
-  "allowedTargetsEnforcer": "0x55A9fD6aF8688EE9c68D15CDAa84d9DBD027B80F",
-  "approvedHashRegistry": "0x878272cc4E0c5bA026CEc29C9722F41fC0515fE5",
-  "attestationRegistry": "0xC695939EA5fB1d7a88BCF536EAC3C13bfcc9E50d",
-  "callDataHashEnforcer": "0x4ab106b80488FE6A920D973cDb96052a933c7450",
+  "agentAccountFactory": "0xE5d2d68b510cC2325fAB5e278855F10DcF02B80A",
+  "agentAccountImplementation": "0x3C547Ad14CcB3af20b86D671B0B04E61294ad05F",
+  "agentNameRegistry": "0xD9a1eCe15F4265c2f367ccD7Df740baeDc3d0523",
+  "agentNameResolver": "0x6E749688a49C3e32B59A54d374D2C116c4Bcc2ea",
+  "agentNameUniversalResolver": "0xCbb8C3E3a0C87962dC4831152c936Ca2A8B7826b",
+  "agentProfileResolver": "0x821de228dF591089575D9186BF9b5E305f12A221",
+  "agentRelationship": "0x1c6D59DD6fd9C7AF39B5afD06FFE7FC032E3608e",
+  "agreementRegistry": "0x92c4C46619842A8DDC5F59191d5FDb2c0aFc6874",
+  "allowedMethodsEnforcer": "0xb6fa9a218F4d6d3Af3dDaE26E3639a98632d4C09",
+  "allowedTargetsEnforcer": "0xca53c91257f6Fa2d1Bc51411B8da40056c861965",
+  "approvedHashRegistry": "0x97e322FCDc233Ef4f8f81979D6e12bCdEF226eF0",
+  "attestationRegistry": "0x34eF353F7DCdad386b7DD8643248A00bFcE863b8",
+  "callDataHashEnforcer": "0x5d8e57091d716A3623c29Bd6CD07A502484dA845",
   "chainId": 84532,
-  "custodyPolicy": "0xfAFDc79bc03CC7cE27f7AA12A3180E4E4C0BC3F6",
-  "delegationManager": "0x10DB7c0C5887910722354ef37eF874fBD124026C",
+  "custodyPolicy": "0x7d94B5DAc5d66d30e9D2Ed401BbAB237e86804E6",
+  "delegationManager": "0xd494a868B3216A307e9eCAe542D3903e3e364377",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x86Dc419feDD30F58250B314F5947aDd8cf379436",
-  "geoFeatureRegistry": "0x1C3b16aF3C2649f2b1ac78aFD6AB20dA0c379121",
-  "mockUsdc": "0x027de10c034f4055551C32491BCe65711BFE5f69",
-  "ontologyTermRegistry": "0x95C149Be91c925FB348Fa231aD28440FBaD562cF",
-  "paymentEnforcer": "0xB09b95E7BcB5d1b3C934facFBEd5bc474b15897E",
-  "paymentEscrow": "0x053dA1bdD4f0A75b82A75A46F189f137a5267928",
-  "paymentReceiptRegistry": "0x29645211A44714b06B8c4C55c109Ef285699f56c",
-  "permissionlessSubregistry": "0x542915A4118A28f49D40DAE53Ee0dc5721Aa4868",
-  "permissionlessSubregistryDemoAgent": "0x00EB165eA2fd33448bbBd5634a8ba92D616AEc1D",
-  "quorumEnforcer": "0x093ff9790601F712B3730C3cAa34f9353dC93739",
-  "relationshipTypeRegistry": "0x0250274222baBB42d44e72e9992DFEB701399a56",
-  "shapeRegistry": "0x7d0a4e9A981775a3807282bbf3499e77f5E2bA53",
-  "skillDefinitionRegistry": "0x7be2c5615d83Ca95e02b9BDe24879eb220cb1780",
-  "smartAgentPaymaster": "0xe93f4ea2cEA8CFF898948c54D6d6144A8F14ca72",
-  "timestampEnforcer": "0x118A74d6F59ecD9D19BA4b720157a007b6f39894",
-  "universalSignatureValidator": "0x3Bc1Debf2ac2a59548aC5Ad09404A56bA21b5803",
-  "valueEnforcer": "0xB7952Ca4a5E10efD24C03c069a0Ea7e262ebE959"
+  "entryPoint": "0x9B766cc05BD2193B5bE5dE50DB23DdB5F0B79c00",
+  "geoFeatureRegistry": "0x903c289a091CC9200811202De7dF3C22B18325d6",
+  "mockUsdc": "0xac4bf60DC027F71e70e7A821df64549e46d72Ed8",
+  "ontologyTermRegistry": "0x701F8a8521Dfa814d042781C42fA5e88fbf88F86",
+  "paymentEnforcer": "0x4680bcFBB2c2DC40254365300b922659919e3508",
+  "paymentReceiptRegistry": "0x496f9B025BB3FBcE8CDB6375176dd30B2eCE5D73",
+  "permissionlessSubregistry": "0xB4eF2166CEAccF8b2bbeAC9d0e28f991eb012385",
+  "permissionlessSubregistryDemoAgent": "0x857Bec62Dc039A9D06602335d060886206fC0972",
+  "quorumEnforcer": "0x38ffeA6A7c332a841E5fb33ED71B0BBF3387aFE1",
+  "relationshipTypeRegistry": "0x6E6ec3d0fDA798c86D324F2681ad6E16a7435658",
+  "shapeRegistry": "0xe105C57D384a62a3D465Ad6Ca2401B7117bC3415",
+  "skillDefinitionRegistry": "0xA00622b30a1cCe201C27A7a9c9dAAe1349492457",
+  "smartAgentPaymaster": "0xf40792F5b4d56931B9f77b4ae356fA89eA526224",
+  "timestampEnforcer": "0x579e5cDDd94C27688CA5A0DDd2256995e7759280",
+  "universalSignatureValidator": "0x01EC03058e98D0E56509E63b20F8454Fc31681F2",
+  "valueEnforcer": "0x8cC88ac64F3A4C5784E7F8B41cAd8E17Ea05c34B",
+  "agentRegistryBase": "0x1f8609F11fcaf0666534579EABe8B39778DFEdaA",
+  "paymentEscrow": "0xF523F7a30b22F35B2Ee506392cfA16BD8FEEe411"
 };
 export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.14",
+  "version": "1.0.0-alpha.16",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {

package/src/AgentAccount.sol

@@ -547,25 +547,39 @@ contract AgentAccount is
         _upgradeAuthorizedCtx = false;
     }
 
-    /// @notice Cancel a queued upgrade during the timelock window. Owner
-    ///         signs a digest that binds to the pending implementation
-    ///         AND `address(this)` + chain id, preventing cross-account
-    ///         replay of a cancel-grant.
+    /// @notice Cancel a queued upgrade during the timelock window.
+    /// @dev NEW-CANCEL-UPGRADE-1: cancel is a governance op. On a CUSTODY-GOVERNED
+    ///      account (mode>0 / org) it MUST go through the custody quorum — routed via
+    ///      the CustodyPolicy executor (`_custodyGovCtx`), exactly like `scheduleUpgrade`
+    ///      and the other governance mutators — so a single compromised custodian's
+    ///      ECDSA signature cannot perpetually cancel quorum-scheduled upgrades
+    ///      (upgrade-liveness DoS). The lightweight ECDSA cancel-grant fast-path remains
+    ///      ONLY for non-governed (mode-0) accounts, where the sole custodian IS the owner.
     /// @param ownerSig Owner ECDSA signature over `keccak256(abi.encode(
     ///                 "UPGRADE_CANCEL", _pendingUpgrade.newImplementation,
-    ///                 address(this), block.chainid))`.
+    ///                 address(this), block.chainid))`. Ignored on governed accounts
+    ///                 (the quorum context authorizes; no signature is consulted).
     function cancelPendingUpgrade(bytes calldata ownerSig) external {
+        bool governed = _hasCustodyGovernance();
+        // Governed: authorize FIRST (fail-closed before revealing pending state). Only the custody quorum
+        // (executor self-call with the gov context set) may cancel — `_custodyGovCtx` is set solely by
+        // `executeFromModule` when the caller is the CustodyPolicy module, so this reverts
+        // AdminRequiresCustodyQuorum for any single-custodian / external attempt.
+        if (governed) _requireCustodyGoverned();
         PendingUpgrade memory p = _pendingUpgrade;
         if (p.readyAt == 0) revert NoPendingUpgrade();
-        bytes32 digest = keccak256(
-            abi.encode(
-                bytes32("UPGRADE_CANCEL"),
-                p.newImplementation,
-                address(this),
-                block.chainid
-            )
-        );
-        if (!_verifyEcdsa(digest, ownerSig)) revert NotOwnerSig();
+        if (!governed) {
+            // Non-governed (mode-0): the sole custodian's ECDSA cancel-grant authorizes.
+            bytes32 digest = keccak256(
+                abi.encode(
+                    bytes32("UPGRADE_CANCEL"),
+                    p.newImplementation,
+                    address(this),
+                    block.chainid
+                )
+            );
+            if (!_verifyEcdsa(digest, ownerSig)) revert NotOwnerSig();
+        }
         delete _pendingUpgrade;
         emit UpgradeCancelled(p.newImplementation);
     }
@@ -1028,18 +1042,30 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
-        // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action is a custody-governed
-        // context (only an installed EXECUTOR — the CustodyPolicy — reaches here,
-        // gated upstream by its own T5 quorum + timelock). `_custodyGovCtx` authorizes
-        // every governance mutator this call dispatches (the ONLY way past
-        // `_requireCustodyGoverned` on a `mode>0` account); `_upgradeAuthorizedCtx`
-        // additionally exempts a dispatched upgrade from the per-account timelock (no
-        // double delay). Both transient, cleared after the call.
-        _custodyGovCtx = true;
-        _upgradeAuthorizedCtx = true;
+        // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action from the CANONICAL CustodyPolicy is a
+        // custody-governed context (gated upstream by its own T5 quorum + timelock). `_custodyGovCtx`
+        // authorizes every governance mutator this call dispatches (the ONLY way past
+        // `_requireCustodyGoverned` on a `mode>0` account); `_upgradeAuthorizedCtx` additionally exempts a
+        // dispatched upgrade from the per-account timelock (no double delay). Both transient.
+        //
+        // NEW-EXEC-MODULE-1 (2026-07-05 audit, internal + external): grant that context ONLY to the
+        // canonical CustodyPolicy the factory installs — NOT to any installed executor. Otherwise a second
+        // (utility / automation) executor a quorum installs believing it unprivileged would silently inherit
+        // full authority to mutate custody / DM / upgrade / modules, bypassing quorum+timelock. Matching the
+        // specific policy address is the same check `_hasCustodyGovernance` uses. A non-canonical executor
+        // runs WITHOUT the context, so `_requireCustodyGoverned` rejects any governance mutator it dispatches
+        // (defense-in-depth: not reachable at v1 since the factory installs only CustodyPolicy).
+        address f = _factory;
+        bool custodyGoverned = f != address(0) && msg.sender == IAgentAccountFactoryView(f).custodyPolicy();
+        if (custodyGoverned) {
+            _custodyGovCtx = true;
+            _upgradeAuthorizedCtx = true;
+        }
         (bool ok, bytes memory ret) = target.call{value: value}(data);
-        _upgradeAuthorizedCtx = false;
-        _custodyGovCtx = false;
+        if (custodyGoverned) {
+            _upgradeAuthorizedCtx = false;
+            _custodyGovCtx = false;
+        }
         if (!ok) {
             assembly { revert(add(ret, 32), mload(ret)) }
         }
@@ -1465,6 +1491,19 @@ contract AgentAccount is
         return _passkeyStorage().piaToCredentialId[account] != bytes32(0);
     }
 
+    /// @notice EXT-ISCUSTODIAN-1 (2026-07-05 audit): like `isCustodian` but EXCLUDES the account itself.
+    /// @dev `isCustodian(address(this)) == true` is deliberate (account-actor compatibility), but that
+    ///      footgun can recreate the ACCT-C2 quorum-collapse class in a FUTURE consumer that reuses
+    ///      `isCustodian` as if it meant "external signer." Any quorum / authority consumer that must count
+    ///      only real external custodians / passkeys (never the account) should use THIS view. ACCT-C2 fixed
+    ///      the current CustodyPolicy quorum at the counting site (reject signer==account); this gives new
+    ///      consumers the safe primitive so the class can't reappear off-path.
+    function isExternalCustodianOrPasskey(address account) external view returns (bool) {
+        if (account == address(this)) return false;
+        if (_externalCustodians[account]) return true;
+        return _passkeyStorage().piaToCredentialId[account] != bytes32(0);
+    }
+
     /// @inheritdoc IAgentAccount
     /// @dev Counts EOA/contract custodians PLUS registered passkeys —
     ///      each passkey contributes one PIA-custodian. Matches the

package/src/AgentAccountFactory.sol

@@ -80,6 +80,10 @@ contract AgentAccountFactory is GovernanceManaged {
     /// @notice ACCT-M1 (spec 300): a mode-3 (org) account needs ≥2 signers so its separation-of-duties
     ///         (disjoint propose + apply quorums) is satisfiable — a 1-signer org can never split duties.
     error InfeasibleOrgConfig(uint8 nSigners);
+    /// @notice EXT-TL-FLOOR-1 (external audit P1-2): a mode>0 timelock override is below the on-chain product
+    ///         floor. Overrides may RAISE a safety delay but never LOWER it below the marketed minimum
+    ///         (spec 300 — the T5/recovery guarantee is a protocol invariant, not a UI convention).
+    error TimelockBelowFloor(uint8 tier, uint32 provided, uint32 floorSecs);
     error ZeroAddress();
     /// @notice R9.6 / ATL-SEC-05 -- thrown when `params.custodians.length`
     ///         exceeds `MAX_INITIAL_CUSTODIANS`. Without this cap,
@@ -329,6 +333,15 @@ contract AgentAccountFactory is GovernanceManaged {
         timelocks[5] = timelockOverrides[5] == 0 ? uint32(24 hours) : timelockOverrides[5];
         timelocks[6] = timelockOverrides[6] == 0 ? uint32(48 hours) : timelockOverrides[6];
 
+        // EXT-TL-FLOOR-1 (external audit P1-2): a timelock override may RAISE a safety delay but NEVER lower it
+        // below the product floor. A zero override inherits the floor default above; a non-zero override below
+        // the floor reverts, so a mode>0 (custody-governed) account can never deploy with sub-floor T4/T5/T6
+        // (recovery = T6) delays. The "T5=24h / recovery=48h" guarantee becomes a protocol invariant, not a UI
+        // convention (spec 300 — raise-only). Demo/testnet fast-timelock deploys use zero overrides (defaults).
+        if (timelocks[4] < 1 hours)  revert TimelockBelowFloor(4, timelocks[4], uint32(1 hours));
+        if (timelocks[5] < 24 hours) revert TimelockBelowFloor(5, timelocks[5], uint32(24 hours));
+        if (timelocks[6] < 48 hours) revert TimelockBelowFloor(6, timelocks[6], uint32(48 hours));
+
         uint8 recThr = uint8(params.trustees.length / 2 + 1);
 
         return abi.encode(

package/src/agency/DelegationManager.sol

@@ -109,6 +109,10 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     // Phase A.5 errors.
     error NotDelegatorOrDelegate();
     error HashMismatch();
+    /// @dev EXT-NOCODE-HOOK-1: a caveat enforcer with no code — a call to it would
+    ///      succeed vacuously (fail-OPEN), so the live before/after hook loops reject it,
+    ///      matching the view path (`verifyAuthorizationForCall` → "no-code-enforcer").
+    error NoCodeEnforcer(address enforcer);
     /// @dev Thrown by the deprecated permissionless `revokeDelegation(bytes32)`
     ///      path. Migrate callers to `revokeDelegationByOwner(Delegation)`.
     error LegacyRevocationDisabled();
@@ -454,6 +458,9 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ) internal {
         bytes32 dHash = hashDelegation(d);
         for (uint256 j = 0; j < d.caveats.length; j++) {
+            // EXT-NOCODE-HOOK-1: fail closed on a no-code enforcer (a call would succeed vacuously),
+            // symmetric with the view path's "no-code-enforcer" reject — never rely on call semantics.
+            if (d.caveats[j].enforcer.code.length == 0) revert NoCodeEnforcer(d.caveats[j].enforcer);
             ICaveatEnforcer(d.caveats[j].enforcer).beforeHook(
                 d.caveats[j].terms,
                 d.caveats[j].args,
@@ -475,6 +482,8 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ) internal {
         bytes32 dHash = hashDelegation(d);
         for (uint256 j = 0; j < d.caveats.length; j++) {
+            // EXT-NOCODE-HOOK-1: fail closed on a no-code enforcer, symmetric with the before-hook + view path.
+            if (d.caveats[j].enforcer.code.length == 0) revert NoCodeEnforcer(d.caveats[j].enforcer);
             ICaveatEnforcer(d.caveats[j].enforcer).afterHook(
                 d.caveats[j].terms,
                 d.caveats[j].args,

package/src/custody/CustodyPolicy.sol

@@ -318,6 +318,10 @@ contract CustodyPolicy {
     error TrusteeDoesNotExist(address guardian);
     error InvalidMode(uint8 mode_);
     error InvalidThresholdValue(uint8 thr);
+    /// @dev EXT-CHANGEMODE-1: a runtime ChangeMode into org mode (3) with an infeasible signer
+    ///      count (< 2, so separation-of-duties can't split proposers from appliers). Mirrors the
+    ///      factory's install-time InfeasibleOrgConfig.
+    error InfeasibleOrgConfig(uint8 nSigners);
     /// @dev CP-1: a tier that must be configured (T4/T5 at install, T6 at read)
     ///      was left unset — refuse rather than fall to the 1-of-n read fallback.
     error UnconfiguredTier(uint8 tier);
@@ -884,6 +888,23 @@ contract CustodyPolicy {
         if (newMode > 3) revert InvalidMode(newMode);
         uint8 oldMode = c.mode;
         if (newMode == 0 && c.trusteeCount > 0) revert CannotDowngradeWithTrustees();
+        // EXT-CHANGEMODE-1 (2026-07-05 audit): a runtime ChangeMode must re-run the factory's install-time
+        // mode-3 feasibility so the account can't enter an un-executable / liveness-hostile org mode.
+        // Org SoD needs ≥2 signers (distinct proposers + appliers) and T4/T5 thresholds within the
+        // floor(N/2) cap (else 2×threshold > N → no disjoint quorum → the tier silently locks). Require the
+        // signer floor; cap the SoD-constrained thresholds (mirrors the factory, avoids a locked mode).
+        if (newMode == 3) {
+            uint256 n = IAgentAccount(account).custodianCount();
+            if (n < 2) revert InfeasibleOrgConfig(uint8(n));
+            uint8 sodCap = uint8(n / 2); // ≥ 1 since n ≥ 2
+            for (uint8 tier = 4; tier <= 5; tier++) {
+                uint8 v = c.approvalsRequiredByTier[tier];
+                if (v > sodCap) {
+                    c.approvalsRequiredByTier[tier] = sodCap;
+                    emit ThresholdChanged(account, tier, v, sodCap);
+                }
+            }
+        }
         c.mode = newMode;
         emit ModeChanged(account, oldMode, newMode);
     }
@@ -968,6 +989,13 @@ contract CustodyPolicy {
         if (newCount == 0) revert InvalidThresholdValue(newCount);
         uint256 n = IAgentAccount(account).custodianCount();
         if (uint256(newCount) > n) revert InvalidThresholdValue(newCount);
+        // acct-mode3-sod-cap-runtime (2026-07-05 audit): the factory caps mode-3 (org) T4/T5 thresholds at
+        // floor(N/2) at install so a DISJOINT propose+apply quorum always exists (2×threshold ≤ N). A later
+        // ChangeApprovalsRequired must not raise them past that cap and silently lock the tier — reject an
+        // explicit over-cap request loud (the org can lower N-constraints or use a lower threshold).
+        if (c.mode == 3 && (tier == 4 || tier == 5) && uint256(newCount) > n / 2) {
+            revert InvalidThresholdValue(newCount);
+        }
         uint8 oldValue = c.approvalsRequiredByTier[tier];
         if (oldValue == 0) oldValue = 1; // mirror _approvalsValue fallback
         c.approvalsRequiredByTier[tier] = newCount;