@agenticprimitives/contracts 1.0.0-alpha.24 → 1.0.0-alpha.26

package/AUDIT.md

@@ -52,6 +52,11 @@ This package ships the **on-chain enforcement layer** for the agenticprimitives
 | 2.12 | **CustodyPolicy reinstall is permanently forbidden.** | ✅ CLOSED audit C-11 | `CustodyPolicy.sol:onUninstall` + `onInstall` reinstall gate; tested in `CustodyPolicyWave2C.t.sol` |
 | 2.13 | **`SmartAgentPaymaster.getHash` binds `address(entryPoint)` + chainId.** | ✅ CLOSED H7-C.7 / CON-PAYMASTER-004 | `SmartAgentPaymaster.sol:206-222`; tested in `SmartAgentPaymasterValidateR610.t.sol` |
 | 2.14 | **`SmartAgentPaymaster` constructor takes EXPLICIT `devMode` (no implicit fail-open).** | ✅ CLOSED R5.7 / PKG-PAYMASTER-002 / external audit P0-2 | `SmartAgentPaymaster.sol:126-141`; tested in `SmartAgentPaymaster.t.sol::test_R5_7_*` |
+| 2.15 | **The account's `execute` never reaches its own custody-tier contracts from below the custody tier.** `CustodyPolicy.onUninstall` reverts `StillInstalledOn` unless `uninstallModule` already dropped the module; a delegation stack (`_delegationExecCtx`) may not target `custodyPolicy` or `approvedHashRegistry` at all. | ✅ CLOSED R917-C-1 (spec 408 §1.1) | `CustodyPolicy.sol:onUninstall`, `AgentAccount.sol:_isAccountTrustedTarget`; `test/HardeningR917.t.sol` |
+| 2.16 | **An approved hash dies with the custody set that approved it.** The `0x03` sentinel consults `isApproved(this, keccak256(hash ‖ custodyEpoch))`; `custodyEpoch` bumps on every credential retirement (`removeCustodian` / `removePasskey`); `ApprovedHashRegistry.revokeAll()` voids per signer. | ✅ CLOSED R917-C-2 (spec 408 §1.2) | `AgentAccount.sol:approvedHashKey`, `ApprovedHashRegistry.sol`; `test/HardeningR917.t.sol`, `test/ApprovedHashIsValidSignature.t.sol` |
+| 2.17 | **A digest-bound redemption is single-use per step.** `DigestBindingEnforcer` is stateful + DM-only: `(delegator, delegationHash, kind, stepNonce)` consumed in `beforeHook`. | ✅ CLOSED R917-C-4 (spec 408 §1.4) | `enforcers/DigestBindingEnforcer.sol`; `test/DigestBindingEnforcer.t.sol` |
+| 2.18 | **Network posture is a constructor fact, never a chain-id list.** `AgentAccountFactory.relaxedT4Floor` (immutable) is the only way to lift the 1 h T4 floor; recorded in the deployments JSON; refused by `check:production-deploy` off anvil. | ✅ CLOSED R917-C-5 (spec 408 §1.3) | `AgentAccountFactory.sol:_custodyInitData`; `test/AgentAccountFactoryMode.t.sol` |
+| 2.19 | **Receipt anchors are keyed by who anchored.** `(anchoredBy, receiptDigest)` — no squat on a public mempool. | ✅ CLOSED R917-C-3 (spec 408 §1.5) | `provenance/ReceiptAnchorRegistry.sol`; `test/provenance/ReceiptAnchorRegistry.t.sol` |
 
 ## 3. Per-contract notes for the external review
 

package/README.md

@@ -1,5 +1,7 @@
 # @agenticprimitives/contracts
 
+> Part of **[Agentic Primitives](https://agenticprimitives.dev)** — the open-source trust substrate for agentic applications: identity that can sign, authority checked at act time, evidence the owner carries. [Developer kit](https://github.com/agentictrustlabs/agentic-primitives) · [All packages](https://agenticprimitives.dev/developers)
+
 **Contracts and SDK are one artifact.**
 
 This is the on-chain enforcement layer of the agenticprimitives substrate — 42 Solidity sources, all present and audited under `src/`, none of them stubs. ERC-4337 v0.7 Smart Agent core, ERC-7710-style delegation manager with caveat enforcers, an ERC-7579 modular CustodyPolicy, a three-mode paymaster, `.agent` TLD naming with hierarchical subregistries, ontology and profile resolvers, identity facets, and an ERC-6492-aware UniversalSignatureValidator. The package publishes ABI subpaths, per-network deployment JSON, flattened sources, and the Solidity itself — so a TypeScript consumer pulls addresses and ABIs from the same artifact the auditors read.

package/deployments-faithchain.json

@@ -45,5 +45,6 @@
     "household": "0x9c3373E8F28739Df3aA478C18209fD7eeD769F5b"
   },
   "agentRegistryBase": "0x0Be172F1b5cfD1d084CEc2cF2Af0A0cE9023Deb1",
-  "digestBindingEnforcer": "0xA3bb9BCC9b2F6F2419E1aBe5ED6Fd5399b9E68e1"
+  "digestBindingEnforcer": "0xA3bb9BCC9b2F6F2419E1aBe5ED6Fd5399b9E68e1",
+  "receiptAnchorRegistry": "0x0e339334B4438F7546FD53837FDC8943cB3Cf54C"
 }

package/dist/abi/AgentAccount.json

@@ -99,6 +99,25 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "approvedHashKey",
+    "inputs": [
+      {
+        "name": "hash",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "bundlerSigner",
@@ -138,6 +157,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "custodyEpoch",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint64",
+        "internalType": "uint64"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "decodeWebAuthnAssertion",
@@ -1071,6 +1103,19 @@
     ],
     "anonymous": false
   },
+  {
+    "type": "event",
+    "name": "CustodyEpochBumped",
+    "inputs": [
+      {
+        "name": "epoch",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "DelegationManagerRotated",

package/dist/abi/AgentAccountFactory.json

@@ -36,6 +36,11 @@
         "name": "approvedHashRegistry_",
         "type": "address",
         "internalType": "address"
+      },
+      {
+        "name": "relaxedT4Floor_",
+        "type": "bool",
+        "internalType": "bool"
       }
     ],
     "stateMutability": "nonpayable"
@@ -289,6 +294,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "relaxedT4Floor",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "sessionIssuer",

package/dist/abi/ApprovedHashRegistry.json

@@ -17,12 +17,12 @@
     "name": "approved",
     "inputs": [
       {
-        "name": "",
+        "name": "signer",
         "type": "address",
         "internalType": "address"
       },
       {
-        "name": "",
+        "name": "hash",
         "type": "bytes32",
         "internalType": "bytes32"
       }
@@ -36,6 +36,25 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "epochOf",
+    "inputs": [
+      {
+        "name": "signer",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint64",
+        "internalType": "uint64"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "isApproved",
@@ -60,6 +79,13 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "revokeAll",
+    "inputs": [],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "revokeHash",
@@ -73,6 +99,25 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "event",
+    "name": "AllHashesRevoked",
+    "inputs": [
+      {
+        "name": "signer",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "epoch",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "HashApproved",

package/dist/abi/CustodyPolicy.json

@@ -1076,6 +1076,17 @@
       }
     ]
   },
+  {
+    "type": "error",
+    "name": "StillInstalledOn",
+    "inputs": [
+      {
+        "name": "account",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
   {
     "type": "error",
     "name": "SystemPaused",

package/dist/abi/DigestBindingEnforcer.json

@@ -1,4 +1,15 @@
 [
+  {
+    "type": "constructor",
+    "inputs": [
+      {
+        "name": "delegationManager_",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "afterHook",
@@ -62,12 +73,12 @@
         "internalType": "bytes"
       },
       {
-        "name": "",
+        "name": "delegationHash",
         "type": "bytes32",
         "internalType": "bytes32"
       },
       {
-        "name": "",
+        "name": "delegator",
         "type": "address",
         "internalType": "address"
       },
@@ -93,7 +104,91 @@
       }
     ],
     "outputs": [],
-    "stateMutability": "pure"
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "delegationManager",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "address",
+        "internalType": "address"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "isUsed",
+    "inputs": [
+      {
+        "name": "delegator",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "delegationHash",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "kind",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "stepNonce",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "event",
+    "name": "DigestBindingRedeemed",
+    "inputs": [
+      {
+        "name": "delegator",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "delegationHash",
+        "type": "bytes32",
+        "indexed": true,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "kind",
+        "type": "bytes32",
+        "indexed": true,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "presented",
+        "type": "bytes32",
+        "indexed": false,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "stepNonce",
+        "type": "bytes32",
+        "indexed": false,
+        "internalType": "bytes32"
+      }
+    ],
+    "anonymous": false
   },
   {
     "type": "error",
@@ -125,5 +220,32 @@
         "internalType": "bytes32"
       }
     ]
+  },
+  {
+    "type": "error",
+    "name": "NotDelegationManager",
+    "inputs": [
+      {
+        "name": "caller",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "StepNonceReused",
+    "inputs": [
+      {
+        "name": "kind",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "stepNonce",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ]
   }
 ]

package/dist/abi/ICustodyPolicyAccountModuleView.json

@@ -0,0 +1,31 @@
+[
+  {
+    "type": "function",
+    "name": "isModuleInstalled",
+    "inputs": [
+      {
+        "name": "moduleTypeId",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "module",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "additionalContext",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  }
+]

package/dist/abi/ReceiptAnchorRegistry.json

@@ -0,0 +1,153 @@
+[
+  {
+    "type": "function",
+    "name": "anchor",
+    "inputs": [
+      {
+        "name": "receiptDigest",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "intentDigest",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "mandateRef",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "anchorOf",
+    "inputs": [
+      {
+        "name": "anchoredBy",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "receiptDigest",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "tuple",
+        "internalType": "struct ReceiptAnchorRegistry.Anchor",
+        "components": [
+          {
+            "name": "anchoredBy",
+            "type": "address",
+            "internalType": "address"
+          },
+          {
+            "name": "at",
+            "type": "uint64",
+            "internalType": "uint64"
+          },
+          {
+            "name": "intentDigest",
+            "type": "bytes32",
+            "internalType": "bytes32"
+          },
+          {
+            "name": "mandateRef",
+            "type": "bytes32",
+            "internalType": "bytes32"
+          }
+        ]
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "function",
+    "name": "isAnchored",
+    "inputs": [
+      {
+        "name": "anchoredBy",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "receiptDigest",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "event",
+    "name": "ReceiptAnchored",
+    "inputs": [
+      {
+        "name": "receiptDigest",
+        "type": "bytes32",
+        "indexed": true,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "anchoredBy",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "intentDigest",
+        "type": "bytes32",
+        "indexed": true,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "mandateRef",
+        "type": "bytes32",
+        "indexed": false,
+        "internalType": "bytes32"
+      },
+      {
+        "name": "at",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "error",
+    "name": "AlreadyAnchored",
+    "inputs": [
+      {
+        "name": "receiptDigest",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "by",
+        "type": "address",
+        "internalType": "address"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "ZeroDigest",
+    "inputs": []
+  }
+]

package/dist/abi/index.d.ts

@@ -34,6 +34,7 @@ export declare const IAgenticPrimitivesAgentAccount: Abi;
 export declare const IApprovedHashRegistryView: Abi;
 export declare const IAttributeReader: Abi;
 export declare const ICaveatEnforcer: Abi;
+export declare const ICustodyPolicyAccountModuleView: Abi;
 export declare const ICustodyPolicyFactoryView: Abi;
 export declare const ICustodyPolicyPauseView: Abi;
 export declare const IDelegationManager: Abi;
@@ -54,6 +55,7 @@ export declare const PaymentEscrow: Abi;
 export declare const PaymentReceiptRegistry: Abi;
 export declare const PermissionlessSubregistry: Abi;
 export declare const QuorumEnforcer: Abi;
+export declare const ReceiptAnchorRegistry: Abi;
 export declare const RelationshipTypeRegistry: Abi;
 export declare const ShapeRegistry: Abi;
 export declare const SignatureSlotRecovery: Abi;

package/dist/abi/index.js

@@ -34,6 +34,7 @@ export { default as IAgenticPrimitivesAgentAccount } from './IAgenticPrimitivesA
 export { default as IApprovedHashRegistryView } from './IApprovedHashRegistryView.json' with { type: 'json' };
 export { default as IAttributeReader } from './IAttributeReader.json' with { type: 'json' };
 export { default as ICaveatEnforcer } from './ICaveatEnforcer.json' with { type: 'json' };
+export { default as ICustodyPolicyAccountModuleView } from './ICustodyPolicyAccountModuleView.json' with { type: 'json' };
 export { default as ICustodyPolicyFactoryView } from './ICustodyPolicyFactoryView.json' with { type: 'json' };
 export { default as ICustodyPolicyPauseView } from './ICustodyPolicyPauseView.json' with { type: 'json' };
 export { default as IDelegationManager } from './IDelegationManager.json' with { type: 'json' };
@@ -54,6 +55,7 @@ export { default as PaymentEscrow } from './PaymentEscrow.json' with { type: 'js
 export { default as PaymentReceiptRegistry } from './PaymentReceiptRegistry.json' with { type: 'json' };
 export { default as PermissionlessSubregistry } from './PermissionlessSubregistry.json' with { type: 'json' };
 export { default as QuorumEnforcer } from './QuorumEnforcer.json' with { type: 'json' };
+export { default as ReceiptAnchorRegistry } from './ReceiptAnchorRegistry.json' with { type: 'json' };
 export { default as RelationshipTypeRegistry } from './RelationshipTypeRegistry.json' with { type: 'json' };
 export { default as ShapeRegistry } from './ShapeRegistry.json' with { type: 'json' };
 export { default as SignatureSlotRecovery } from './SignatureSlotRecovery.json' with { type: 'json' };

package/dist/deployments/faithchain.d.ts

@@ -36,6 +36,7 @@ export interface Deployments {
   readonly "valueEnforcer": Address;
   readonly "agentRegistryBase": Address;
   readonly "digestBindingEnforcer": Address;
+  readonly "receiptAnchorRegistry": Address;
   readonly "chainId": number;
   readonly "permissionlessSubregistries": string;
   readonly "deploymentEpoch": string;

package/dist/deployments/faithchain.js

@@ -48,6 +48,7 @@ export const CONTRACTS = {
   },
   "agentRegistryBase": "0x0Be172F1b5cfD1d084CEc2cF2Af0A0cE9023Deb1",
   "digestBindingEnforcer": "0xA3bb9BCC9b2F6F2419E1aBe5ED6Fd5399b9E68e1",
+  "receiptAnchorRegistry": "0x0e339334B4438F7546FD53837FDC8943cB3Cf54C",
   "deploymentEpoch": "ep_80afd31afaeacbf9"
 };
 export default CONTRACTS;

package/package.json

@@ -1,18 +1,22 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.24",
+  "version": "1.0.0-alpha.26",
   "type": "module",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
+  "homepage": "https://agenticprimitives.dev",
+  "bugs": {
+    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
+  },
+  "author": {
+    "name": "Agentic Trust Labs",
+    "url": "https://agenticprimitives.dev"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/agentictrustlabs/agenticprimitives.git",
     "directory": "packages/contracts"
   },
-  "homepage": "https://github.com/agentictrustlabs/agenticprimitives/tree/master/packages/contracts",
-  "bugs": {
-    "url": "https://github.com/agentictrustlabs/agenticprimitives/issues"
-  },
   "exports": {
     "./abi": "./dist/abi/index.js",
     "./abi/*": "./dist/abi/*.json",
@@ -48,6 +52,13 @@
   "peerDependencies": {
     "viem": "^2.52.2"
   },
+  "keywords": [
+    "agentic-primitives",
+    "agenticprimitives",
+    "ai-agents",
+    "agent-authority",
+    "agentic-trust"
+  ],
   "scripts": {
     "setup": "bash setup.sh",
     "build": "forge build && pnpm run build:abi && pnpm run build:deployments",

package/src/AgentAccount.sol

@@ -189,12 +189,23 @@ contract AgentAccount is
     ///      large delay that bricks future migrations.
     uint256 internal constant MAX_UPGRADE_TIMELOCK = 30 days;
 
+    /// @dev R917-C-2 (spec 408 §1.2) — THE CUSTODY EPOCH. Incremented by every path that RETIRES a
+    ///      credential (`removeCustodian`, `removePasskey` — T6 recovery and a full rotation remove through
+    ///      these). The `0x03` approved-hash sentinel keys every approval to the epoch it was made under
+    ///      (`approvedHashKey`), so an approval planted by a custodian who is later removed is void the
+    ///      moment the custody set no longer contains that custodian — an ECDSA signature dies with its key,
+    ///      and an approved hash now dies with its custody set. Adding a credential does not bump it: an
+    ///      added key cannot launder an approval a still-present key planted, and voiding a person's
+    ///      standing wires every time she enrols a device would be the wrong invariant. Takes one slot
+    ///      from the gap (49 remain).
+    uint64 private _custodyEpoch;
+
     /// @dev Spec 007 Phase A.5 (SC7 § 3.1) — storage gap reserves 50
     ///      slots after the last linear-layout state variable. Future
     ///      additive upgrades shrink the gap by however many slots they
     ///      add. ERC-7201 namespaced state (passkeys, modules) lives at
     ///      keccak-computed slots and is NOT in this linear layout.
-    uint256[50] private __gap;
+    uint256[49] private __gap;
 
     // ─── Errors ─────────────────────────────────────────────────────
 
@@ -943,6 +954,13 @@ contract AgentAccount is
             revert ModuleNotInstalled(moduleTypeId, module);
         }
 
+        // R917-C-1: effects BEFORE the interaction. The module's `onUninstall` may verify that this account
+        // no longer lists it (CustodyPolicy does — that is how it tells `uninstallModule` apart from a
+        // custodian's `execute(custodyPolicy, onUninstall)`), so the flag is cleared first. A revert below
+        // still rolls the whole call back.
+        $.installed[moduleTypeId][module] = false;
+        _removeFromList($.installedList[moduleTypeId], module);
+
         // Loud uninstall — if the module reverts in onUninstall, we revert
         // too so the caller sees the failure. (Owner can force-uninstall
         // by passing deInitData the module can handle, or by re-deploying
@@ -953,9 +971,6 @@ contract AgentAccount is
             revert ModuleOnUninstallFailed(reason);
         }
 
-        $.installed[moduleTypeId][module] = false;
-        _removeFromList($.installedList[moduleTypeId], module);
-
         emit ModuleUninstalled(moduleTypeId, module);
     }
 
@@ -1297,14 +1312,32 @@ contract AgentAccount is
     ///      `DM → execute(self, executeBatch(...))` nest, so a nested governance
     ///      self-call is caught regardless of mode.
     function _rejectDelegatedGovernance(address target, bytes calldata data) internal view {
+        if (!_delegationExecCtx) return;
         if (
-            _delegationExecCtx &&
             target == address(this) &&
             data.length >= 4 &&
             _isGovernanceSelector(bytes4(data[0:4]))
         ) {
             revert DelegatedGovernanceForbidden();
         }
+        // R917-C-1/C-2 (spec 408 §1.1): a delegation stack may not speak AS THE ACCOUNT to the account's own
+        // custody-tier contracts. `CustodyPolicy` and `ApprovedHashRegistry` treat `msg.sender == account` as
+        // the principal — a delegate reaching them through `execute` would uninstall the custody policy
+        // (bricking the account) or plant approved-hash root delegations that outlive the delegate's own
+        // caveats. Any selector: there is no legitimate delegated call to either.
+        if (_isAccountTrustedTarget(target)) revert DelegatedGovernanceForbidden();
+    }
+
+    /// @dev The contracts that take THIS ACCOUNT as principal when it is `msg.sender` — reachable only from
+    ///      the account's own governance paths (`uninstallModule`, a custodian-signed userOp), never from a
+    ///      delegation. The custody policy is read from the factory (the canonical one; a legacy direct
+    ///      deploy with no factory has none); the registry is the immutable this account was built with.
+    function _isAccountTrustedTarget(address target) internal view returns (bool) {
+        if (target == _approvedHashRegistry && target != address(0)) return true;
+        address f = _factory;
+        if (f == address(0)) return false;
+        address cp = IAgentAccountFactoryView(f).custodyPolicy();
+        return cp != address(0) && target == cp;
     }
 
     /// @dev The account-governance selector set — mutators that change custody,
@@ -1349,9 +1382,11 @@ contract AgentAccount is
         // branch is unreachable from `_validateSignature`/`_validateSig`
         // (the userOp-auth path), where 0x03 is an unknown type → false.
         // Fails CLOSED if the registry is unset/not-a-contract (ADR-0013).
+        // R917-C-2: the registry is consulted for the EPOCH-BOUND key, never the raw hash — an approval
+        // made under a custody set that has since retired a credential is not this account's approval.
         if (signature.length == 1 && uint8(signature[0]) == SIG_TYPE_APPROVED_HASH) {
             if (_approvedHashRegistry.code.length == 0) return bytes4(0xffffffff);
-            return IApprovedHashRegistryView(_approvedHashRegistry).isApproved(address(this), hash)
+            return IApprovedHashRegistryView(_approvedHashRegistry).isApproved(address(this), approvedHashKey(hash))
                 ? ERC1271_MAGIC_VALUE
                 : bytes4(0xffffffff);
         }
@@ -1611,6 +1646,7 @@ contract AgentAccount is
         _externalCustodians[owner] = false;
         _externalCustodianCount--;
         emit CustodianRemoved(owner);
+        _bumpCustodyEpoch();
     }
 
     // ─── Passkey (WebAuthn P-256) management ──────────────────────
@@ -1659,6 +1695,8 @@ contract AgentAccount is
     ///      (ADR-0012/0013; INV-302-3).
     event PasskeyAdded(bytes32 indexed credentialIdDigest);
     event PasskeyRemoved(bytes32 indexed credentialIdDigest);
+    /// @dev R917-C-2 — a credential was retired; every approved hash keyed to the previous epoch is void.
+    event CustodyEpochBumped(uint64 epoch);
 
     /// @notice Register a new WebAuthn credential bound to a specific RP.
     ///         `onlySelf` — callable via a UserOp signed by any existing signer
@@ -1715,6 +1753,7 @@ contract AgentAccount is
         $.count -= 1;
         emit PasskeyRemoved(credentialIdDigest);
         emit CustodianRemoved(pia);
+        _bumpCustodyEpoch();
     }
 
     /// @notice Whether a passkey is registered on this account.
@@ -1741,6 +1780,28 @@ contract AgentAccount is
         return _passkeyStorage().count;
     }
 
+    // ─── Custody epoch (R917-C-2, spec 408 §1.2) ─────────────────────
+
+    /// @notice The current custody epoch — bumped whenever a credential is retired.
+    function custodyEpoch() external view returns (uint64) {
+        return _custodyEpoch;
+    }
+
+    /// @notice THE KEY an SDK approves in the `ApprovedHashRegistry` for `hash` to validate through this
+    ///         account's `0x03` sentinel NOW: `keccak256(abi.encode(hash, custodyEpoch))`. A counterfactual
+    ///         account (not yet deployed) is at epoch 0, so its key is computable before deploy — which is
+    ///         what spec 253's batched deploy-and-approve relies on.
+    function approvedHashKey(bytes32 hash) public view returns (bytes32) {
+        return keccak256(abi.encode(hash, _custodyEpoch));
+    }
+
+    /// @dev Retire-a-credential paths call this; see `_custodyEpoch`.
+    function _bumpCustodyEpoch() internal {
+        uint64 next = _custodyEpoch + 1;
+        _custodyEpoch = next;
+        emit CustodyEpochBumped(next);
+    }
+
     // ─── Custody policy + scheduled changes ───────────────────────────
     //
     // The schedule / apply / cancel custody-change surface, CustodyAction

package/src/AgentAccountFactory.sol

@@ -55,6 +55,14 @@ contract AgentAccountFactory is GovernanceManaged {
     ///      sentinel consults it; it is NOT a mutable factory-view.
     address public immutable approvedHashRegistry;
 
+    /// @notice R917-C-5 (spec 408 §1.3) — whether the T4 (admin) safety-delay floor is LIFTED to zero for
+    ///         accounts this factory deploys. A DEPLOYMENT decision, stated by the deployer in the
+    ///         constructor and recorded in the deployments JSON, never a `block.chainid` list in bytecode:
+    ///         the previous carve-out named the estate's own chain (34348) and silently switched the
+    ///         EXT-TL-FLOOR-1 invariant off where it mattered. `check:production-deploy` refuses a
+    ///         production/testnet record with this `true`. T5 (24 h) / T6 (48 h) are never relaxed.
+    bool public immutable relaxedT4Floor;
+
     address public bundlerSigner;
     address public sessionIssuer;
 
@@ -127,11 +135,13 @@ contract AgentAccountFactory is GovernanceManaged {
         address bundlerSigner_,
         address sessionIssuer_,
         address governance_,
-        address approvedHashRegistry_
+        address approvedHashRegistry_,
+        bool relaxedT4Floor_
     ) GovernanceManaged(governance_) {
         if (custodyPolicy_ == address(0)) revert ZeroAddress();
         accountImplementation = new AgentAccount(entryPoint_, approvedHashRegistry_);
         approvedHashRegistry = approvedHashRegistry_;
+        relaxedT4Floor = relaxedT4Floor_;
         delegationManager = delegationManager_;
         custodyPolicy = custodyPolicy_;
         bundlerSigner = bundlerSigner_;
@@ -357,15 +367,12 @@ contract AgentAccountFactory is GovernanceManaged {
             if (thresholds[5] > sodCap) thresholds[5] = sodCap;
         }
 
-        // DEV/TEST-CHAIN CARVE-OUT (local demo only): on a local development chain the T4 floor is lifted
-        // so a demo can drive an admin custody action's schedule→apply back-to-back without a real-time
-        // wait, and a zero override yields a ZERO T4 safety delay instead of the 1-hour production default.
-        // Gated strictly by `block.chainid` — anvil (31337/1337) and the local faithchain (34348). Every
-        // PRODUCTION and public TESTNET chain id (Base Sepolia 84532, mainnet, …) keeps the audited
-        // EXT-TL-FLOOR-1 invariant. T5 (24h) and T6 (recovery, 48h) are NOT relaxed even on dev — the
-        // CustodyPolicy requires a non-zero timelock for those tiers, and the demo only exercises T4.
-        bool devChain = block.chainid == 31337 || block.chainid == 1337 || block.chainid == 34348;
-        uint32 floor4 = devChain ? 0 : uint32(1 hours);
+        // R917-C-5 (spec 408 §1.3): the T4 floor is lifted ONLY when the deployer said so in the constructor
+        // (`relaxedT4Floor`) — a local development posture so a demo can drive an admin custody action's
+        // schedule→apply back-to-back. It is not inferred from `block.chainid`: the estate's own chain was
+        // once on that list, and the audited EXT-TL-FLOOR-1 invariant was off where it mattered. T5 (24h)
+        // and T6 (recovery, 48h) are NOT relaxed under any posture.
+        uint32 floor4 = relaxedT4Floor ? 0 : uint32(1 hours);
 
         uint32[7] memory timelocks;
         timelocks[4] = timelockOverrides[4] == 0 ? floor4 : timelockOverrides[4];

package/src/ApprovedHashRegistry.sol

@@ -26,13 +26,26 @@ pragma solidity ^0.8.28;
  *      Pairs with `MultiSendCallOnly` (atomic batch) so a passkey
  *      smart account can `approveHash` + perform the delegated action
  *      in one userOp.
+ *
+ *      R917-C-2 (spec 408 §1.2): an `AgentAccount`'s `0x03` sentinel does NOT approve the raw hash —
+ *      it approves `AgentAccount.approvedHashKey(hash)` = `keccak256(abi.encode(hash, custodyEpoch))`,
+ *      so an approval planted by a custodian who is later removed is void once the account's custody
+ *      epoch moves. This registry is agnostic to that: it stores whatever 32 bytes the signer approves.
  */
 contract ApprovedHashRegistry {
-    /// signer => hash => approved
-    mapping(address => mapping(bytes32 => bool)) public approved;
+    /// @dev R917-C-2 (spec 408 §1.2): an approval is recorded with the signer's epoch at the time
+    ///      (`epoch + 1`, so a set slot is never zero); `revokeAll()` bumps the epoch and voids every
+    ///      approval the signer ever made in one call. `isApproved` is the ONE read: the `0x03` sentinel
+    ///      and `QuorumEnforcer`'s `v == 1` slot both consult it.
+    /// signer => hash => (epoch at approval + 1), 0 = never approved
+    mapping(address => mapping(bytes32 => uint64)) private _approvedAt;
+    /// signer => current epoch
+    mapping(address => uint64) private _epoch;
 
     event HashApproved(address indexed signer, bytes32 indexed hash);
     event HashRevoked(address indexed signer, bytes32 indexed hash);
+    /// @dev R917-C-2 — every approval `signer` made before this event is void.
+    event AllHashesRevoked(address indexed signer, uint64 epoch);
 
     /**
      * @notice Pre-approve a hash. `msg.sender` is the signer; only
@@ -40,18 +53,40 @@ contract ApprovedHashRegistry {
      *         for this hash.
      */
     function approveHash(bytes32 hash) external {
-        approved[msg.sender][hash] = true;
+        _approvedAt[msg.sender][hash] = _epoch[msg.sender] + 1;
         emit HashApproved(msg.sender, hash);
     }
 
     /// @notice Revoke a previously-approved hash before redemption.
     function revokeHash(bytes32 hash) external {
-        approved[msg.sender][hash] = false;
+        _approvedAt[msg.sender][hash] = 0;
         emit HashRevoked(msg.sender, hash);
     }
 
-    /// @notice External view used by `QuorumEnforcer`'s `v == 1` path.
+    /// @notice R917-C-2 — revoke EVERY hash `msg.sender` ever approved, in one call. The per-hash
+    ///         approvals are unenumerable on chain; this is how a signer that suspects a planted approval
+    ///         voids all of them without knowing which.
+    function revokeAll() external {
+        uint64 next = _epoch[msg.sender] + 1;
+        _epoch[msg.sender] = next;
+        emit AllHashesRevoked(msg.sender, next);
+    }
+
+    /// @notice The signer's current epoch (informational; `isApproved` already accounts for it).
+    function epochOf(address signer) external view returns (uint64) {
+        return _epoch[signer];
+    }
+
+    /// @notice Whether `signer` approved `hash` under its CURRENT epoch. External view used by the
+    ///         `0x03` sentinel and by `QuorumEnforcer`'s `v == 1` path.
     function isApproved(address signer, bytes32 hash) external view returns (bool) {
-        return approved[signer][hash];
+        uint64 at = _approvedAt[signer][hash];
+        return at != 0 && at == _epoch[signer] + 1;
+    }
+
+    /// @notice Back-compat read shape of the former public mapping: true iff currently approved.
+    function approved(address signer, bytes32 hash) external view returns (bool) {
+        uint64 at = _approvedAt[signer][hash];
+        return at != 0 && at == _epoch[signer] + 1;
     }
 }

package/src/custody/CustodyPolicy.sol

@@ -20,6 +20,13 @@ interface ICustodyPolicyPauseView {
     function isPaused() external view returns (bool);
 }
 
+/// @dev R917-C-1 — the account's ERC-7579 module view. `onUninstall` refuses while the account still lists
+///      this module as installed, so the only path to it is `AgentAccount.uninstallModule` (onlySelf +
+///      custody-quorum), which clears the flag BEFORE calling out.
+interface ICustodyPolicyAccountModuleView {
+    function isModuleInstalled(uint256 moduleTypeId, address module, bytes calldata additionalContext) external view returns (bool);
+}
+
 /**
  * @title CustodyPolicy
  * @notice ERC-7579 module that owns the schedule / apply / cancel
@@ -346,6 +353,11 @@ contract CustodyPolicy {
     /// @dev Audit C-11: reinstall over a previously-uninstalled config
     ///      is forbidden — stale mappings would compose unpredictably.
     error ReinstallForbidden(address account);
+    /// @dev R917-C-1: `onUninstall` was called while the account still has this module installed — i.e. by
+    ///      `execute(custodyPolicy, onUninstall)` under a single custodian or a delegation, not by
+    ///      `uninstallModule`. Accepting it would leave the account governed by a policy that refuses every
+    ///      change (installed on the account, uninstalled here, reinstall forbidden) — bricked forever.
+    error StillInstalledOn(address account);
 
     // ─── ERC-7579 lifecycle ───────────────────────────────────────────
 
@@ -452,6 +464,14 @@ contract CustodyPolicy {
         address account = msg.sender;
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
+        // R917-C-1: the account must have ALREADY dropped this module. `AgentAccount.uninstallModule` (onlySelf
+        // + `_requireCustodyGoverned`) clears its installed flag before this call; any other caller that is the
+        // account — a 1-of-N custodian userOp `execute(custodyPolicy, onUninstall)`, a delegation redeemed
+        // through the DM — still lists the module and is refused here. Fail closed on the read as well: a
+        // caller that cannot answer the view is not an account that uninstalled us.
+        if (ICustodyPolicyAccountModuleView(account).isModuleInstalled(MODULE_TYPE_EXECUTOR, address(this), "")) {
+            revert StillInstalledOn(account);
+        }
         c.installed = false;
         // Audit C-11: lock against ever re-installing on this account.
         // The mapping state (trustees, thresholds, proposals) is left

package/src/enforcers/DigestBindingEnforcer.sol

@@ -10,14 +10,15 @@ import "../agency/ICaveatEnforcer.sol";
  *         §2): authority *for a reason*, not authority for any purpose until revoked.
  *
  * @dev terms = abi.encode(bytes32 kind, bytes32 digest)
- *      args  = abi.encode(bytes32 presented)          — supplied by the redeemer at redemption
+ *      args  = abi.encode(bytes32 presented, bytes32 stepNonce)   — supplied by the redeemer at redemption
  *
  *      `kind` names WHICH artifact the digest is of, so an off-chain reader can tell an intent binding
  *      from a projection binding without guessing:
  *          keccak256("ap:intent")      — the canonical intent (RFC 8785 JCS bytes)
  *          keccak256("ap:projection")  — what was disclosed to the grantee (spec 336 §4)
  *          keccak256("ap:offer")       — the accepted offer (spec 336 §5)
- *      One enforcer serves all three: the mechanics are identical and the kind belongs in the terms,
+ *          keccak256("ap:plan")        — the admitted plan (spec 408 §2.3)
+ *      One enforcer serves all four: the mechanics are identical and the kind belongs in the terms,
  *      where it is signed, rather than in which contract address was chosen.
  *
  *      WHAT THIS ENFORCES, HONESTLY. The chain cannot know what an intent *means*; it can only hold
@@ -30,33 +31,67 @@ import "../agency/ICaveatEnforcer.sol";
  *        2. the presented digest lands in the transaction, so the receipt's `intentDigest` and the
  *           chain's record of what the redeemer claimed to be doing are the same bytes — evidence a
  *           third party can check without trusting either side.
- *      A redeemer that copies `terms` into `args` satisfies the check; that is the point — it has
+ *      A redeemer that copies `terms` into `args` satisfies the digest check; that is the point — it has
  *      now committed, on chain, to that intent, and a step whose real intent differs is caught by the
  *      verifier that computed the digest from the step rather than from the caveat.
  *
- *      R6.7 — Stateless validator: hooks are `pure`, zero storage; the DM-side pause check gates all
- *      reachable enforcer dispatch.
+ *      R917-C-4 (spec 408 §1.4) — SINGLE-USE PER STEP. A digest-bound redemption is consumed under
+ *      `(delegator, delegationHash, kind, stepNonce)`: the harness derives `stepNonce` from the intent
+ *      digest and the step's reference (the same derivation as `PaymentEnforcer`'s nonce), so ONE step
+ *      redeems once and a replay of it reverts `StepNonceReused`. Which steps exist is bound off chain by
+ *      the plan digest the mandate carries; the chain holds each of them to one redemption. The hooks
+ *      therefore mutate state and are `onlyDelegationManager` (EXT-PMT-1's rule for stateful enforcers):
+ *      a stranger cannot burn a step's nonce ahead of the legitimate redemption.
  */
 contract DigestBindingEnforcer is ICaveatEnforcer {
     error BadTermsLength();
     error BadArgsLength();
     error DigestMismatch(bytes32 kind, bytes32 bound, bytes32 presented);
+    error StepNonceReused(bytes32 kind, bytes32 stepNonce);
+    error NotDelegationManager(address caller);
+
+    /// @notice The ONLY authorized caller of `beforeHook` — it consumes a nonce (R917-C-4).
+    address public immutable delegationManager;
+
+    /// delegator => delegationHash => keccak256(kind, stepNonce) => consumed
+    mapping(address => mapping(bytes32 => mapping(bytes32 => bool))) private _used;
+
+    event DigestBindingRedeemed(address indexed delegator, bytes32 indexed delegationHash, bytes32 indexed kind, bytes32 presented, bytes32 stepNonce);
+
+    constructor(address delegationManager_) {
+        require(delegationManager_ != address(0), "DigestBindingEnforcer: zero DelegationManager");
+        delegationManager = delegationManager_;
+    }
+
+    modifier onlyDelegationManager() {
+        if (msg.sender != delegationManager) revert NotDelegationManager(msg.sender);
+        _;
+    }
+
+    /// @notice Whether `stepNonce` was already consumed for this binding (a reader's replay check).
+    function isUsed(address delegator, bytes32 delegationHash, bytes32 kind, bytes32 stepNonce) external view returns (bool) {
+        return _used[delegator][delegationHash][keccak256(abi.encode(kind, stepNonce))];
+    }
 
     function beforeHook(
         bytes calldata terms,
         bytes calldata args,
-        bytes32,
-        address,
+        bytes32 delegationHash,
+        address delegator,
         address,
         address,
         uint256,
         bytes calldata
-    ) external pure override {
+    ) external override onlyDelegationManager {
         if (terms.length != 64) revert BadTermsLength();
-        if (args.length != 32) revert BadArgsLength();
+        if (args.length != 64) revert BadArgsLength();
         (bytes32 kind, bytes32 bound) = abi.decode(terms, (bytes32, bytes32));
-        bytes32 presented = abi.decode(args, (bytes32));
+        (bytes32 presented, bytes32 stepNonce) = abi.decode(args, (bytes32, bytes32));
         if (presented != bound) revert DigestMismatch(kind, bound, presented);
+        bytes32 slot = keccak256(abi.encode(kind, stepNonce));
+        if (_used[delegator][delegationHash][slot]) revert StepNonceReused(kind, stepNonce);
+        _used[delegator][delegationHash][slot] = true;
+        emit DigestBindingRedeemed(delegator, delegationHash, kind, presented, stepNonce);
     }
 
     function afterHook(

package/src/provenance/ReceiptAnchorRegistry.sol

@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+/**
+ * @title ReceiptAnchorRegistry
+ * @notice The on-chain ANCHOR for a harness receipt (spec 351 P0.6, spec 406 W2): a run's record digest, bound
+ *         to the intent digest the mandate was over and the mandate's reference, anchored once by the acting
+ *         runtime's agent. A counterparty who holds the record recomputes its digest and reads the anchor here —
+ *         no trust in the runtime's logs, no vendor, no vault: the chain says a runtime with THIS agent's key
+ *         committed to THESE bytes at THIS block, and the intent digest says which ask it was under.
+ *
+ * @dev    DIGESTS AND ADDRESSES ONLY — nothing of what the run was about reaches the chain (the S1 firewall of
+ *         spec 395 holds by construction). Per-row storage, so a reader uses `readContract` (ADR-0012: no log
+ *         walks in product paths); the event is for indexers. Anchoring is permissionless: WHO anchored is the
+ *         evidence (`anchoredBy`), never a gate — a stranger anchoring random digests proves nothing about a
+ *         run whose receipt names a different agent. A digest anchors ONCE PER ANCHORER (R917-C-3, spec 408
+ *         §1.5): rows are keyed by `(anchoredBy, receiptDigest)`, so a front-runner on a public mempool cannot
+ *         squat the digest ahead of the agent, and an anchor cannot be re-attributed after the fact.
+ */
+contract ReceiptAnchorRegistry {
+    struct Anchor {
+        address anchoredBy;
+        uint64 at;
+        bytes32 intentDigest;
+        bytes32 mandateRef;
+    }
+
+    /// anchoredBy => receiptDigest => anchor (R917-C-3: keyed by WHO anchored, so a stranger's anchor of
+    /// the same digest is a different row — it can neither pre-empt the agent's nor be mistaken for it).
+    mapping(address => mapping(bytes32 => Anchor)) private _anchors;
+
+    event ReceiptAnchored(bytes32 indexed receiptDigest, address indexed anchoredBy, bytes32 indexed intentDigest, bytes32 mandateRef, uint64 at);
+
+    error ZeroDigest();
+    error AlreadyAnchored(bytes32 receiptDigest, address by);
+
+    /// @notice Anchor a receipt digest, once per anchorer. `intentDigest` and `mandateRef` may be zero for a run under no mandate (a read).
+    function anchor(bytes32 receiptDigest, bytes32 intentDigest, bytes32 mandateRef) external {
+        if (receiptDigest == bytes32(0)) revert ZeroDigest();
+        Anchor storage a = _anchors[msg.sender][receiptDigest];
+        if (a.anchoredBy != address(0)) revert AlreadyAnchored(receiptDigest, a.anchoredBy);
+        _anchors[msg.sender][receiptDigest] = Anchor({ anchoredBy: msg.sender, at: uint64(block.timestamp), intentDigest: intentDigest, mandateRef: mandateRef });
+        emit ReceiptAnchored(receiptDigest, msg.sender, intentDigest, mandateRef, uint64(block.timestamp));
+    }
+
+    /// @notice The anchor `anchoredBy` made of a digest, or a zero struct when none — the reader names the
+    ///         agent from the receipt it holds, and decides what absence means.
+    function anchorOf(address anchoredBy, bytes32 receiptDigest) external view returns (Anchor memory) {
+        return _anchors[anchoredBy][receiptDigest];
+    }
+
+    function isAnchored(address anchoredBy, bytes32 receiptDigest) external view returns (bool) {
+        return _anchors[anchoredBy][receiptDigest].anchoredBy != address(0);
+    }
+}