@agenticprimitives/contracts 1.0.0-alpha.25 → 1.0.0-alpha.27

package/src/AgentAccount.sol

@@ -56,6 +56,16 @@ interface IApprovedHashRegistryView {
     function isApproved(address signer, bytes32 hash) external view returns (bool);
 }
 
+/// @dev Spec 410 §1 (THESIS-1a) — the ONLY write path from this account to its registry. The account
+///      computes the epoch-bound key itself (`approveDigest`); `execute` / `executeBatch` /
+///      `executeFromModule` refuse the registry as a target unconditionally, so no caller — custodian,
+///      module or delegate — can approve a key under an epoch the account is not in.
+interface IApprovedHashRegistryWrite {
+    function approveHash(bytes32 hash) external;
+    function revokeHash(bytes32 hash) external;
+    function revokeAll() external;
+}
+
 /**
  * @title AgentAccount
  * @notice ERC-4337 + UUPS-upgradeable smart account — agent identity anchor.
@@ -189,12 +199,23 @@ contract AgentAccount is
     ///      large delay that bricks future migrations.
     uint256 internal constant MAX_UPGRADE_TIMELOCK = 30 days;
 
+    /// @dev R917-C-2 (spec 408 §1.2) — THE CUSTODY EPOCH. Incremented by every path that RETIRES a
+    ///      credential (`removeCustodian`, `removePasskey` — T6 recovery and a full rotation remove through
+    ///      these). The `0x03` approved-hash sentinel keys every approval to the epoch it was made under
+    ///      (`approvedHashKey`), so an approval planted by a custodian who is later removed is void the
+    ///      moment the custody set no longer contains that custodian — an ECDSA signature dies with its key,
+    ///      and an approved hash now dies with its custody set. Adding a credential does not bump it: an
+    ///      added key cannot launder an approval a still-present key planted, and voiding a person's
+    ///      standing wires every time she enrols a device would be the wrong invariant. Takes one slot
+    ///      from the gap (49 remain).
+    uint64 private _custodyEpoch;
+
     /// @dev Spec 007 Phase A.5 (SC7 § 3.1) — storage gap reserves 50
     ///      slots after the last linear-layout state variable. Future
     ///      additive upgrades shrink the gap by however many slots they
     ///      add. ERC-7201 namespaced state (passkeys, modules) lives at
     ///      keccak-computed slots and is NOT in this linear layout.
-    uint256[50] private __gap;
+    uint256[49] private __gap;
 
     // ─── Errors ─────────────────────────────────────────────────────
 
@@ -257,6 +278,9 @@ contract AgentAccount is
     /// @notice A delegation-originated execution stack tried to self-call an
     ///         account-governance selector. Delegations may never reach governance.
     error DelegatedGovernanceForbidden();
+    /// @dev Spec 410 §1 (THESIS-1a): the approved-hash registry is reachable only through
+    ///      `approveDigest` / `revokeDigest` / `revokeAllApprovedDigests`, never as an execute target.
+    error ApprovedHashRegistryOnlyViaAccount();
 
     /// @notice Emitted when `setDelegationManager` rotates the DM via a
     ///         self-call (the only authorized path post-Wave-2A).
@@ -943,6 +967,13 @@ contract AgentAccount is
             revert ModuleNotInstalled(moduleTypeId, module);
         }
 
+        // R917-C-1: effects BEFORE the interaction. The module's `onUninstall` may verify that this account
+        // no longer lists it (CustodyPolicy does — that is how it tells `uninstallModule` apart from a
+        // custodian's `execute(custodyPolicy, onUninstall)`), so the flag is cleared first. A revert below
+        // still rolls the whole call back.
+        $.installed[moduleTypeId][module] = false;
+        _removeFromList($.installedList[moduleTypeId], module);
+
         // Loud uninstall — if the module reverts in onUninstall, we revert
         // too so the caller sees the failure. (Owner can force-uninstall
         // by passing deInitData the module can handle, or by re-deploying
@@ -953,9 +984,6 @@ contract AgentAccount is
             revert ModuleOnUninstallFailed(reason);
         }
 
-        $.installed[moduleTypeId][module] = false;
-        _removeFromList($.installedList[moduleTypeId], module);
-
         emit ModuleUninstalled(moduleTypeId, module);
     }
 
@@ -1042,6 +1070,7 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
+        _rejectDirectRegistryCall(target);
         // CA-1 + Wave-1/ACCT-C1 (spec 300): a module action from the CANONICAL CustodyPolicy is a
         // custody-governed context (gated upstream by its own T5 quorum + timelock). `_custodyGovCtx`
         // authorizes every governance mutator this call dispatches (the ONLY way past
@@ -1131,6 +1160,7 @@ contract AgentAccount is
         // executeBatch(...)) nest) and forbid it from self-calling governance.
         bool setDelCtx = (msg.sender == _delegationManager && !_delegationExecCtx);
         if (setDelCtx) _delegationExecCtx = true;
+        _rejectDirectRegistryCall(target);
         _rejectDelegatedGovernance(target, data);
 
         ModulesStorage storage $ = _modulesStorage();
@@ -1217,6 +1247,7 @@ contract AgentAccount is
         }
 
         for (uint256 i = 0; i < calls.length; i++) {
+            _rejectDirectRegistryCall(calls[i].target);
             _rejectDelegatedGovernance(calls[i].target, calls[i].data);
             (bool ok, bytes memory ret) = calls[i].target.call{ value: calls[i].value }(calls[i].data);
             if (!ok) {
@@ -1297,14 +1328,42 @@ contract AgentAccount is
     ///      `DM → execute(self, executeBatch(...))` nest, so a nested governance
     ///      self-call is caught regardless of mode.
     function _rejectDelegatedGovernance(address target, bytes calldata data) internal view {
+        if (!_delegationExecCtx) return;
         if (
-            _delegationExecCtx &&
             target == address(this) &&
             data.length >= 4 &&
             _isGovernanceSelector(bytes4(data[0:4]))
         ) {
             revert DelegatedGovernanceForbidden();
         }
+        // R917-C-1/C-2 (spec 408 §1.1): a delegation stack may not speak AS THE ACCOUNT to the account's own
+        // custody-tier contracts. `CustodyPolicy` and `ApprovedHashRegistry` treat `msg.sender == account` as
+        // the principal — a delegate reaching them through `execute` would uninstall the custody policy
+        // (bricking the account) or plant approved-hash root delegations that outlive the delegate's own
+        // caveats. Any selector: there is no legitimate delegated call to either.
+        if (_isAccountTrustedTarget(target)) revert DelegatedGovernanceForbidden();
+    }
+
+    /// @dev Spec 410 §1 (THESIS-1a). `ApprovedHashRegistry.approveHash` stores whatever 32 bytes the account
+    ///      sends, and the custody epoch is public — so a custodian who could reach the registry through
+    ///      `execute` could approve `keccak256(abi.encode(h, epoch + 1))`: inert now, live the moment a
+    ///      recovery bumps the epoch to expel that very custodian. Closing it: the registry is never an
+    ///      execute target; the account derives the key on chain in `approveDigest`, under the epoch it is
+    ///      in, and nowhere else. Unconditional — not only under the delegation context (R917-C-1/C-2).
+    function _rejectDirectRegistryCall(address target) internal view {
+        if (target == _approvedHashRegistry && target != address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+    }
+
+    /// @dev The contracts that take THIS ACCOUNT as principal when it is `msg.sender` — reachable only from
+    ///      the account's own governance paths (`uninstallModule`, a custodian-signed userOp), never from a
+    ///      delegation. The custody policy is read from the factory (the canonical one; a legacy direct
+    ///      deploy with no factory has none); the registry is the immutable this account was built with.
+    function _isAccountTrustedTarget(address target) internal view returns (bool) {
+        if (target == _approvedHashRegistry && target != address(0)) return true;
+        address f = _factory;
+        if (f == address(0)) return false;
+        address cp = IAgentAccountFactoryView(f).custodyPolicy();
+        return cp != address(0) && target == cp;
     }
 
     /// @dev The account-governance selector set — mutators that change custody,
@@ -1324,7 +1383,10 @@ contract AgentAccount is
             s == IAgentAccount.removeCustodian.selector ||
             s == this.addPasskey.selector ||
             s == this.removePasskey.selector ||
-            s == this.acceptSessionDelegation.selector;
+            s == this.acceptSessionDelegation.selector ||
+            s == this.approveDigest.selector ||
+            s == this.revokeDigest.selector ||
+            s == this.revokeAllApprovedDigests.selector;
     }
 
     // ─── ERC-1271 ───────────────────────────────────────────────────
@@ -1349,9 +1411,11 @@ contract AgentAccount is
         // branch is unreachable from `_validateSignature`/`_validateSig`
         // (the userOp-auth path), where 0x03 is an unknown type → false.
         // Fails CLOSED if the registry is unset/not-a-contract (ADR-0013).
+        // R917-C-2: the registry is consulted for the EPOCH-BOUND key, never the raw hash — an approval
+        // made under a custody set that has since retired a credential is not this account's approval.
         if (signature.length == 1 && uint8(signature[0]) == SIG_TYPE_APPROVED_HASH) {
             if (_approvedHashRegistry.code.length == 0) return bytes4(0xffffffff);
-            return IApprovedHashRegistryView(_approvedHashRegistry).isApproved(address(this), hash)
+            return IApprovedHashRegistryView(_approvedHashRegistry).isApproved(address(this), approvedHashKey(hash))
                 ? ERC1271_MAGIC_VALUE
                 : bytes4(0xffffffff);
         }
@@ -1611,6 +1675,7 @@ contract AgentAccount is
         _externalCustodians[owner] = false;
         _externalCustodianCount--;
         emit CustodianRemoved(owner);
+        _bumpCustodyEpoch();
     }
 
     // ─── Passkey (WebAuthn P-256) management ──────────────────────
@@ -1659,6 +1724,13 @@ contract AgentAccount is
     ///      (ADR-0012/0013; INV-302-3).
     event PasskeyAdded(bytes32 indexed credentialIdDigest);
     event PasskeyRemoved(bytes32 indexed credentialIdDigest);
+    /// @dev R917-C-2 — a credential was retired; every approved hash keyed to the previous epoch is void.
+    event CustodyEpochBumped(uint64 epoch);
+    /// @dev Spec 410 §1 — `digest` approved under `epoch` through the account's own key derivation.
+    event DigestApproved(bytes32 indexed digest, uint64 epoch);
+    event DigestRevoked(bytes32 indexed digest, uint64 epoch);
+    /// @dev Spec 410 §1 — every approval this account ever made is void (registry-side epoch bump).
+    event AllDigestsRevoked();
 
     /// @notice Register a new WebAuthn credential bound to a specific RP.
     ///         `onlySelf` — callable via a UserOp signed by any existing signer
@@ -1715,6 +1787,7 @@ contract AgentAccount is
         $.count -= 1;
         emit PasskeyRemoved(credentialIdDigest);
         emit CustodianRemoved(pia);
+        _bumpCustodyEpoch();
     }
 
     /// @notice Whether a passkey is registered on this account.
@@ -1741,6 +1814,63 @@ contract AgentAccount is
         return _passkeyStorage().count;
     }
 
+    // ─── Custody epoch (R917-C-2, spec 408 §1.2) ─────────────────────
+
+    /// @notice The current custody epoch — bumped whenever a credential is retired.
+    function custodyEpoch() external view returns (uint64) {
+        return _custodyEpoch;
+    }
+
+    /// @notice THE KEY an SDK approves in the `ApprovedHashRegistry` for `hash` to validate through this
+    ///         account's `0x03` sentinel NOW: `keccak256(abi.encode(hash, custodyEpoch))`. A counterfactual
+    ///         account (not yet deployed) is at epoch 0, so its key is computable before deploy — which is
+    ///         what spec 253's batched deploy-and-approve relies on.
+    function approvedHashKey(bytes32 hash) public view returns (bytes32) {
+        return keccak256(abi.encode(hash, _custodyEpoch));
+    }
+
+    /// @dev Retire-a-credential paths call this; see `_custodyEpoch`.
+    function _bumpCustodyEpoch() internal {
+        uint64 next = _custodyEpoch + 1;
+        _custodyEpoch = next;
+        emit CustodyEpochBumped(next);
+    }
+
+    // ─── Approved digests (spec 410 §1, THESIS-1a) ───────────────────
+
+    /// @notice Approve `digest` for this account's `0x03` sentinel under the epoch the account is IN. The
+    ///         only path to the registry (`execute` refuses it as a target), so the key is never computed
+    ///         by a caller and never for an epoch other than the current one. `onlySelf`, not
+    ///         custody-gated: spec 253's one-prompt org-create batches it into the deploy userOp under the
+    ///         creating custodian, and the epoch (R917-C-2) plus `revokeAllApprovedDigests` on every
+    ///         recovery path (spec 410 §1.2) close the persistence risk instead. A delegation stack cannot
+    ///         reach it (`_isGovernanceSelector`).
+    function approveDigest(bytes32 digest) external onlySelf {
+        if (_approvedHashRegistry == address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+        IApprovedHashRegistryWrite(_approvedHashRegistry).approveHash(approvedHashKey(digest));
+        emit DigestApproved(digest, _custodyEpoch);
+    }
+
+    /// @notice Revoke one approval made under the current epoch.
+    function revokeDigest(bytes32 digest) external onlySelf {
+        if (_approvedHashRegistry == address(0)) revert ApprovedHashRegistryOnlyViaAccount();
+        IApprovedHashRegistryWrite(_approvedHashRegistry).revokeHash(approvedHashKey(digest));
+        emit DigestRevoked(digest, _custodyEpoch);
+    }
+
+    /// @notice Void EVERY approval this account ever made, under any epoch — including one planted for a
+    ///         future epoch before this contract generation refused direct registry calls. `CustodyPolicy`
+    ///         calls it as the last step of every recovery path; a custody-governed account reaches it
+    ///         only through the module (`_requireCustodyGoverned`), a mode-0 person through her own userOp.
+    ///         Recovery re-approves nothing: the person re-issues from a reviewed list (spec 410 §1.2).
+    function revokeAllApprovedDigests() external onlySelf {
+        _requireCustodyGoverned();
+        // No registry wired: nothing was ever approvable (the sentinel fails closed, l. ~1388), so there is
+        // nothing to void — a no-op, never a revert, so a recovery on such an account still completes.
+        if (_approvedHashRegistry != address(0)) IApprovedHashRegistryWrite(_approvedHashRegistry).revokeAll();
+        emit AllDigestsRevoked();
+    }
+
     // ─── Custody policy + scheduled changes ───────────────────────────
     //
     // The schedule / apply / cancel custody-change surface, CustodyAction

package/src/AgentAccountFactory.sol

@@ -55,6 +55,14 @@ contract AgentAccountFactory is GovernanceManaged {
     ///      sentinel consults it; it is NOT a mutable factory-view.
     address public immutable approvedHashRegistry;
 
+    /// @notice R917-C-5 (spec 408 §1.3) — whether the T4 (admin) safety-delay floor is LIFTED to zero for
+    ///         accounts this factory deploys. A DEPLOYMENT decision, stated by the deployer in the
+    ///         constructor and recorded in the deployments JSON, never a `block.chainid` list in bytecode:
+    ///         the previous carve-out named the estate's own chain (34348) and silently switched the
+    ///         EXT-TL-FLOOR-1 invariant off where it mattered. `check:production-deploy` refuses a
+    ///         production/testnet record with this `true`. T5 (24 h) / T6 (48 h) are never relaxed.
+    bool public immutable relaxedT4Floor;
+
     address public bundlerSigner;
     address public sessionIssuer;
 
@@ -127,11 +135,13 @@ contract AgentAccountFactory is GovernanceManaged {
         address bundlerSigner_,
         address sessionIssuer_,
         address governance_,
-        address approvedHashRegistry_
+        address approvedHashRegistry_,
+        bool relaxedT4Floor_
     ) GovernanceManaged(governance_) {
         if (custodyPolicy_ == address(0)) revert ZeroAddress();
         accountImplementation = new AgentAccount(entryPoint_, approvedHashRegistry_);
         approvedHashRegistry = approvedHashRegistry_;
+        relaxedT4Floor = relaxedT4Floor_;
         delegationManager = delegationManager_;
         custodyPolicy = custodyPolicy_;
         bundlerSigner = bundlerSigner_;
@@ -357,15 +367,12 @@ contract AgentAccountFactory is GovernanceManaged {
             if (thresholds[5] > sodCap) thresholds[5] = sodCap;
         }
 
-        // DEV/TEST-CHAIN CARVE-OUT (local demo only): on a local development chain the T4 floor is lifted
-        // so a demo can drive an admin custody action's schedule→apply back-to-back without a real-time
-        // wait, and a zero override yields a ZERO T4 safety delay instead of the 1-hour production default.
-        // Gated strictly by `block.chainid` — anvil (31337/1337) and the local faithchain (34348). Every
-        // PRODUCTION and public TESTNET chain id (Base Sepolia 84532, mainnet, …) keeps the audited
-        // EXT-TL-FLOOR-1 invariant. T5 (24h) and T6 (recovery, 48h) are NOT relaxed even on dev — the
-        // CustodyPolicy requires a non-zero timelock for those tiers, and the demo only exercises T4.
-        bool devChain = block.chainid == 31337 || block.chainid == 1337 || block.chainid == 34348;
-        uint32 floor4 = devChain ? 0 : uint32(1 hours);
+        // R917-C-5 (spec 408 §1.3): the T4 floor is lifted ONLY when the deployer said so in the constructor
+        // (`relaxedT4Floor`) — a local development posture so a demo can drive an admin custody action's
+        // schedule→apply back-to-back. It is not inferred from `block.chainid`: the estate's own chain was
+        // once on that list, and the audited EXT-TL-FLOOR-1 invariant was off where it mattered. T5 (24h)
+        // and T6 (recovery, 48h) are NOT relaxed under any posture.
+        uint32 floor4 = relaxedT4Floor ? 0 : uint32(1 hours);
 
         uint32[7] memory timelocks;
         timelocks[4] = timelockOverrides[4] == 0 ? floor4 : timelockOverrides[4];

package/src/ApprovedHashRegistry.sol

@@ -26,13 +26,26 @@ pragma solidity ^0.8.28;
  *      Pairs with `MultiSendCallOnly` (atomic batch) so a passkey
  *      smart account can `approveHash` + perform the delegated action
  *      in one userOp.
+ *
+ *      R917-C-2 (spec 408 §1.2): an `AgentAccount`'s `0x03` sentinel does NOT approve the raw hash —
+ *      it approves `AgentAccount.approvedHashKey(hash)` = `keccak256(abi.encode(hash, custodyEpoch))`,
+ *      so an approval planted by a custodian who is later removed is void once the account's custody
+ *      epoch moves. This registry is agnostic to that: it stores whatever 32 bytes the signer approves.
  */
 contract ApprovedHashRegistry {
-    /// signer => hash => approved
-    mapping(address => mapping(bytes32 => bool)) public approved;
+    /// @dev R917-C-2 (spec 408 §1.2): an approval is recorded with the signer's epoch at the time
+    ///      (`epoch + 1`, so a set slot is never zero); `revokeAll()` bumps the epoch and voids every
+    ///      approval the signer ever made in one call. `isApproved` is the ONE read: the `0x03` sentinel
+    ///      and `QuorumEnforcer`'s `v == 1` slot both consult it.
+    /// signer => hash => (epoch at approval + 1), 0 = never approved
+    mapping(address => mapping(bytes32 => uint64)) private _approvedAt;
+    /// signer => current epoch
+    mapping(address => uint64) private _epoch;
 
     event HashApproved(address indexed signer, bytes32 indexed hash);
     event HashRevoked(address indexed signer, bytes32 indexed hash);
+    /// @dev R917-C-2 — every approval `signer` made before this event is void.
+    event AllHashesRevoked(address indexed signer, uint64 epoch);
 
     /**
      * @notice Pre-approve a hash. `msg.sender` is the signer; only
@@ -40,18 +53,40 @@ contract ApprovedHashRegistry {
      *         for this hash.
      */
     function approveHash(bytes32 hash) external {
-        approved[msg.sender][hash] = true;
+        _approvedAt[msg.sender][hash] = _epoch[msg.sender] + 1;
         emit HashApproved(msg.sender, hash);
     }
 
     /// @notice Revoke a previously-approved hash before redemption.
     function revokeHash(bytes32 hash) external {
-        approved[msg.sender][hash] = false;
+        _approvedAt[msg.sender][hash] = 0;
         emit HashRevoked(msg.sender, hash);
     }
 
-    /// @notice External view used by `QuorumEnforcer`'s `v == 1` path.
+    /// @notice R917-C-2 — revoke EVERY hash `msg.sender` ever approved, in one call. The per-hash
+    ///         approvals are unenumerable on chain; this is how a signer that suspects a planted approval
+    ///         voids all of them without knowing which.
+    function revokeAll() external {
+        uint64 next = _epoch[msg.sender] + 1;
+        _epoch[msg.sender] = next;
+        emit AllHashesRevoked(msg.sender, next);
+    }
+
+    /// @notice The signer's current epoch (informational; `isApproved` already accounts for it).
+    function epochOf(address signer) external view returns (uint64) {
+        return _epoch[signer];
+    }
+
+    /// @notice Whether `signer` approved `hash` under its CURRENT epoch. External view used by the
+    ///         `0x03` sentinel and by `QuorumEnforcer`'s `v == 1` path.
     function isApproved(address signer, bytes32 hash) external view returns (bool) {
-        return approved[signer][hash];
+        uint64 at = _approvedAt[signer][hash];
+        return at != 0 && at == _epoch[signer] + 1;
+    }
+
+    /// @notice Back-compat read shape of the former public mapping: true iff currently approved.
+    function approved(address signer, bytes32 hash) external view returns (bool) {
+        uint64 at = _approvedAt[signer][hash];
+        return at != 0 && at == _epoch[signer] + 1;
     }
 }

package/src/IAgentAccount.sol

@@ -90,6 +90,29 @@ struct AgentAccountRecoveryArgs {
     bytes32[] removePasskeyCredentialIdDigests;
 }
 
+/**
+ * @notice Payload for `CustodyAction.RotateCredential` (T4) — spec 410 §1.2. A PLANNED rotation: the
+ *         old credential is still controlled, the person (or an org's quorum) registers the new one,
+ *         retires the old one, and re-approves every standing approved-digest wire under the new epoch
+ *         — in ONE applied change, so no wire is dead between the retirement and the re-approval.
+ *
+ *         Exactly one credential is added (`addOwner` XOR `addPasskey.x != 0`) and exactly one retired
+ *         (`removeOwner` XOR `removePasskeyCredentialIdDigest != 0`). `reapprove` lists the delegation
+ *         digests to approve after the retirement; the module calls `AgentAccount.approveDigest` for
+ *         each, so the key is derived on chain under the post-rotation epoch.
+ *
+ *         This is the ONLY custody action that carries a re-approval list. `AgentAccountRecoveryArgs`
+ *         has no such field by construction: a recovery is the moment a planted grant would otherwise
+ *         ride through, so recovery re-approves nothing and ends with `revokeAllApprovedDigests`.
+ */
+struct AgentAccountRotateCredentialArgs {
+    address addOwner;
+    AgentAccountRecoveryPasskeyAdd addPasskey;
+    address removeOwner;
+    bytes32 removePasskeyCredentialIdDigest;
+    bytes32[] reapprove;
+}
+
 /**
  * @title IAgentAccount
  * @notice Interface for an agent-native ERC-4337 smart account.

package/src/custody/CustodyPolicy.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.28;
 
-import {IAgentAccount, AgentAccountRecoveryArgs, AgentAccountRecoveryPasskeyAdd} from "../IAgentAccount.sol";
+import {IAgentAccount, AgentAccountRecoveryArgs, AgentAccountRecoveryPasskeyAdd, AgentAccountRotateCredentialArgs} from "../IAgentAccount.sol";
 import {SignatureSlotRecovery} from "../libraries/SignatureSlotRecovery.sol";
 
 /// @dev R6.6 — minimal interface for the `account → factory → governance.isPaused()`
@@ -20,6 +20,13 @@ interface ICustodyPolicyPauseView {
     function isPaused() external view returns (bool);
 }
 
+/// @dev R917-C-1 — the account's ERC-7579 module view. `onUninstall` refuses while the account still lists
+///      this module as installed, so the only path to it is `AgentAccount.uninstallModule` (onlySelf +
+///      custody-quorum), which clears the flag BEFORE calling out.
+interface ICustodyPolicyAccountModuleView {
+    function isModuleInstalled(uint256 moduleTypeId, address module, bytes calldata additionalContext) external view returns (bool);
+}
+
 /**
  * @title CustodyPolicy
  * @notice ERC-7579 module that owns the schedule / apply / cancel
@@ -73,7 +80,8 @@ contract CustodyPolicy {
         ChangeValueCeiling,           // 12 — T4
         SetRecoveryApprovals,      // 13 — T4
         RecoverAccount,            // 14 — T6
-        ChangeApprovalsRequired    // 15 — T4 (per-tier custody quorum threshold)
+        ChangeApprovalsRequired,   // 15 — T4 (per-tier custody quorum threshold)
+        RotateCredential           // 16 — T4 (spec 410 §1.2: add + retire + re-approve standing wires, atomically)
     }
 
     struct ScheduledChange {
@@ -289,6 +297,9 @@ contract CustodyPolicy {
     event T3CeilingChanged(address indexed account, uint256 oldCeiling, uint256 newCeiling);
     event RecoveryThresholdChanged(address indexed account, uint8 oldValue, uint8 newValue);
     event OwnersRotated(address indexed account, uint256 newOwnerCount);
+    /// @dev Spec 410 §1.2 — a planned rotation applied: one credential in, one out, `reapproved` wires
+    ///      re-approved under the new custody epoch in the same transaction.
+    event CredentialRotated(address indexed account, uint256 reapproved);
     /// @notice Audit C-10: per-rotation count of custodians removed.
     event CustodiansRemovedDuringRotation(address indexed account, uint256 removedCount);
     /// @notice Audit C-11: CustodyPolicy was uninstalled; the account
@@ -336,6 +347,8 @@ contract CustodyPolicy {
     error UnconfiguredTier(uint8 tier);
     error RecoveryRequiresGuardians();
     error EmptyOwnerSet();
+    /// @dev Spec 410 §1.2 — `RotateCredential` needs exactly one credential added and exactly one retired.
+    error RotationNeedsOneAddAndOneRemove();
     error CustodyActionNotYetImplemented(uint8 action);
     error CannotDowngradeWithTrustees();
     error TimelockRequiredForTier(uint8 tier);
@@ -346,6 +359,11 @@ contract CustodyPolicy {
     /// @dev Audit C-11: reinstall over a previously-uninstalled config
     ///      is forbidden — stale mappings would compose unpredictably.
     error ReinstallForbidden(address account);
+    /// @dev R917-C-1: `onUninstall` was called while the account still has this module installed — i.e. by
+    ///      `execute(custodyPolicy, onUninstall)` under a single custodian or a delegation, not by
+    ///      `uninstallModule`. Accepting it would leave the account governed by a policy that refuses every
+    ///      change (installed on the account, uninstalled here, reinstall forbidden) — bricked forever.
+    error StillInstalledOn(address account);
 
     // ─── ERC-7579 lifecycle ───────────────────────────────────────────
 
@@ -452,6 +470,14 @@ contract CustodyPolicy {
         address account = msg.sender;
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
+        // R917-C-1: the account must have ALREADY dropped this module. `AgentAccount.uninstallModule` (onlySelf
+        // + `_requireCustodyGoverned`) clears its installed flag before this call; any other caller that is the
+        // account — a 1-of-N custodian userOp `execute(custodyPolicy, onUninstall)`, a delegation redeemed
+        // through the DM — still lists the module and is refused here. Fail closed on the read as well: a
+        // caller that cannot answer the view is not an account that uninstalled us.
+        if (ICustodyPolicyAccountModuleView(account).isModuleInstalled(MODULE_TYPE_EXECUTOR, address(this), "")) {
+            revert StillInstalledOn(account);
+        }
         c.installed = false;
         // Audit C-11: lock against ever re-installing on this account.
         // The mapping state (trustees, thresholds, proposals) is left
@@ -838,6 +864,9 @@ contract CustodyPolicy {
         } else if (action == CustodyAction.RecoverAccount) {
             AgentAccountRecoveryArgs memory r = abi.decode(args, (AgentAccountRecoveryArgs));
             _applyRecoverAccount(account, r);
+        } else if (action == CustodyAction.RotateCredential) {
+            AgentAccountRotateCredentialArgs memory r = abi.decode(args, (AgentAccountRotateCredentialArgs));
+            _applyRotateCredential(account, r);
         } else if (action == CustodyAction.ApplySystemUpdate) {
             (address newImpl) = abi.decode(args, (address));
             _execute(account, abi.encodeWithSignature("upgradeToAndCall(address,bytes)", newImpl, ""));
@@ -957,6 +986,9 @@ contract CustodyPolicy {
                 removed++;
             }
         }
+        // Spec 410 §1.2: a bulk custodian rotation carries no re-approval list; like recovery it voids every
+        // approval so nothing planted for a future epoch survives it. Re-approve through `RotateCredential`.
+        _revokeAllApprovedDigests(account);
         emit OwnersRotated(account, added);
         // Note: OwnersRotated only carries `added` for ABI compat. A
         // future revision should add a `removed` field; that's a
@@ -1050,9 +1082,47 @@ contract CustodyPolicy {
             removedPasskeys++;
         }
 
+        // Spec 410 §1.2 (THESIS-1a): recovery re-approves nothing and voids every approval the account
+        // ever made — including one planted for a future epoch. The person re-issues from a reviewed list.
+        _revokeAllApprovedDigests(account);
         emit AccountRecovered(account, addedOwners, removedOwners, addedPasskeys, removedPasskeys);
     }
 
+    /// @dev Spec 410 §1.2 — the planned rotation: add → retire → re-approve, one transaction. The account
+    ///      derives each key under the post-retirement epoch (`approveDigest`); this module never computes
+    ///      a key. Exactly one credential in and one out, so the account is never credential-less and the
+    ///      action cannot be bent into a bulk custody change at the rotation tier.
+    function _applyRotateCredential(address account, AgentAccountRotateCredentialArgs memory r) internal {
+        bool addsOwner = r.addOwner != address(0);
+        bool addsPasskey = r.addPasskey.x != 0 || r.addPasskey.y != 0 || r.addPasskey.credentialIdDigest != bytes32(0);
+        bool removesOwner = r.removeOwner != address(0);
+        bool removesPasskey = r.removePasskeyCredentialIdDigest != bytes32(0);
+        if (addsOwner == addsPasskey || removesOwner == removesPasskey) revert RotationNeedsOneAddAndOneRemove();
+
+        if (addsOwner) {
+            _execute(account, abi.encodeCall(IAgentAccount.addCustodian, (r.addOwner)));
+        } else {
+            _execute(account, abi.encodeWithSignature(
+                "addPasskey(bytes32,uint256,uint256,bytes32)",
+                r.addPasskey.credentialIdDigest, r.addPasskey.x, r.addPasskey.y, r.addPasskey.rpIdHash
+            ));
+        }
+        if (removesOwner) {
+            _execute(account, abi.encodeCall(IAgentAccount.removeCustodian, (r.removeOwner)));
+        } else {
+            _execute(account, abi.encodeWithSignature("removePasskey(bytes32)", r.removePasskeyCredentialIdDigest));
+        }
+        for (uint256 i; i < r.reapprove.length; i++) {
+            _execute(account, abi.encodeWithSignature("approveDigest(bytes32)", r.reapprove[i]));
+        }
+        emit CredentialRotated(account, r.reapprove.length);
+    }
+
+    /// @dev Spec 410 §1.2 — `AgentAccount.revokeAllApprovedDigests()` as the account (module context).
+    function _revokeAllApprovedDigests(address account) internal {
+        _execute(account, abi.encodeWithSignature("revokeAllApprovedDigests()"));
+    }
+
     /// @dev Spec § 5.1 default-threshold matrix.
     function _defaultApprovals(uint8 nCustodians, uint8 tier) internal pure returns (uint8) {
         if (nCustodians == 0) return 0;