@agenticprimitives/contracts 1.0.0-alpha.4 → 1.0.0-alpha.5

package/dist/abi/UniversalSignatureValidator.json

@@ -0,0 +1,65 @@
+[
+  {
+    "type": "function",
+    "name": "isValidSig",
+    "inputs": [
+      {
+        "name": "signer",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "hash",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "sig",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "nonpayable"
+  },
+  {
+    "type": "function",
+    "name": "isValidSigView",
+    "inputs": [
+      {
+        "name": "signer",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "hash",
+        "type": "bytes32",
+        "internalType": "bytes32"
+      },
+      {
+        "name": "sig",
+        "type": "bytes",
+        "internalType": "bytes"
+      }
+    ],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
+  {
+    "type": "error",
+    "name": "DeployFailed",
+    "inputs": []
+  }
+]

package/dist/abi/index.d.ts

@@ -1,6 +1,8 @@
 // Generated by scripts/build-abi.mjs — do not edit by hand.
 import type { Abi } from 'viem';
 
+export declare const AgentAccount: Abi;
+export declare const AgentAccountFactory: Abi;
 export declare const AgenticGovernance: Abi;
 export declare const AgentNameAttributeResolver: Abi;
 export declare const AgentNamePredicates: Abi;
@@ -10,26 +12,47 @@ export declare const AgentProfilePredicates: Abi;
 export declare const AgentProfileResolver: Abi;
 export declare const AgentRelationship: Abi;
 export declare const AgentRelationshipPredicates: Abi;
+export declare const AgreementRegistry: Abi;
 export declare const AllowedMethodsEnforcer: Abi;
 export declare const AllowedTargetsEnforcer: Abi;
 export declare const ApprovedHashRegistry: Abi;
+export declare const AttestationRegistry: Abi;
 export declare const AttributeStorage: Abi;
+export declare const CallDataHashEnforcer: Abi;
 export declare const CaveatEnforcerBase: Abi;
+export declare const CustodyPolicy: Abi;
+export declare const DelegationManager: Abi;
+export declare const GeoFeatureRegistry: Abi;
 export declare const GovernanceManaged: Abi;
+export declare const IAgentAccount: Abi;
+export declare const IAgentAccountFactoryAccessor: Abi;
+export declare const IAgentAccountFactoryView: Abi;
+export declare const IAgentAccountPauseView: Abi;
+export declare const IAgenticPrimitivesAgentAccount: Abi;
+export declare const IApprovedHashRegistryView: Abi;
 export declare const IAttributeReader: Abi;
 export declare const ICaveatEnforcer: Abi;
+export declare const ICustodyPolicyFactoryView: Abi;
+export declare const ICustodyPolicyPauseView: Abi;
 export declare const IDelegationManager: Abi;
+export declare const IERC7579HookLike: Abi;
 export declare const IERC7579Module: Abi;
 export declare const IERC7579ModuleLifecycle: Abi;
+export declare const IERC7579ModuleLike: Abi;
 export declare const IGovernanceView: Abi;
 export declare const MultiSendCallOnly: Abi;
 export declare const MultiSendCallOnlyHarness: Abi;
 export declare const OntologyTermRegistry: Abi;
 export declare const P256Verifier: Abi;
 export declare const PermissionlessSubregistry: Abi;
+export declare const QuorumEnforcer: Abi;
 export declare const RelationshipTypeRegistry: Abi;
 export declare const ShapeRegistry: Abi;
+export declare const SignatureSlotRecovery: Abi;
+export declare const SkillDefinitionRegistry: Abi;
 export declare const SmartAgentModuleTypes: Abi;
+export declare const SmartAgentPaymaster: Abi;
 export declare const TimestampEnforcer: Abi;
+export declare const UniversalSignatureValidator: Abi;
 export declare const ValueEnforcer: Abi;
 export declare const WebAuthnLib: Abi;

package/dist/abi/index.js

@@ -1,6 +1,8 @@
 // Generated by scripts/build-abi.mjs — do not edit by hand.
 // Each export is a viem-compatible ABI array.
 
+export { default as AgentAccount } from './AgentAccount.json' with { type: 'json' };
+export { default as AgentAccountFactory } from './AgentAccountFactory.json' with { type: 'json' };
 export { default as AgenticGovernance } from './AgenticGovernance.json' with { type: 'json' };
 export { default as AgentNameAttributeResolver } from './AgentNameAttributeResolver.json' with { type: 'json' };
 export { default as AgentNamePredicates } from './AgentNamePredicates.json' with { type: 'json' };
@@ -10,26 +12,47 @@ export { default as AgentProfilePredicates } from './AgentProfilePredicates.json
 export { default as AgentProfileResolver } from './AgentProfileResolver.json' with { type: 'json' };
 export { default as AgentRelationship } from './AgentRelationship.json' with { type: 'json' };
 export { default as AgentRelationshipPredicates } from './AgentRelationshipPredicates.json' with { type: 'json' };
+export { default as AgreementRegistry } from './AgreementRegistry.json' with { type: 'json' };
 export { default as AllowedMethodsEnforcer } from './AllowedMethodsEnforcer.json' with { type: 'json' };
 export { default as AllowedTargetsEnforcer } from './AllowedTargetsEnforcer.json' with { type: 'json' };
 export { default as ApprovedHashRegistry } from './ApprovedHashRegistry.json' with { type: 'json' };
+export { default as AttestationRegistry } from './AttestationRegistry.json' with { type: 'json' };
 export { default as AttributeStorage } from './AttributeStorage.json' with { type: 'json' };
+export { default as CallDataHashEnforcer } from './CallDataHashEnforcer.json' with { type: 'json' };
 export { default as CaveatEnforcerBase } from './CaveatEnforcerBase.json' with { type: 'json' };
+export { default as CustodyPolicy } from './CustodyPolicy.json' with { type: 'json' };
+export { default as DelegationManager } from './DelegationManager.json' with { type: 'json' };
+export { default as GeoFeatureRegistry } from './GeoFeatureRegistry.json' with { type: 'json' };
 export { default as GovernanceManaged } from './GovernanceManaged.json' with { type: 'json' };
+export { default as IAgentAccount } from './IAgentAccount.json' with { type: 'json' };
+export { default as IAgentAccountFactoryAccessor } from './IAgentAccountFactoryAccessor.json' with { type: 'json' };
+export { default as IAgentAccountFactoryView } from './IAgentAccountFactoryView.json' with { type: 'json' };
+export { default as IAgentAccountPauseView } from './IAgentAccountPauseView.json' with { type: 'json' };
+export { default as IAgenticPrimitivesAgentAccount } from './IAgenticPrimitivesAgentAccount.json' with { type: 'json' };
+export { default as IApprovedHashRegistryView } from './IApprovedHashRegistryView.json' with { type: 'json' };
 export { default as IAttributeReader } from './IAttributeReader.json' with { type: 'json' };
 export { default as ICaveatEnforcer } from './ICaveatEnforcer.json' with { type: 'json' };
+export { default as ICustodyPolicyFactoryView } from './ICustodyPolicyFactoryView.json' with { type: 'json' };
+export { default as ICustodyPolicyPauseView } from './ICustodyPolicyPauseView.json' with { type: 'json' };
 export { default as IDelegationManager } from './IDelegationManager.json' with { type: 'json' };
+export { default as IERC7579HookLike } from './IERC7579HookLike.json' with { type: 'json' };
 export { default as IERC7579Module } from './IERC7579Module.json' with { type: 'json' };
 export { default as IERC7579ModuleLifecycle } from './IERC7579ModuleLifecycle.json' with { type: 'json' };
+export { default as IERC7579ModuleLike } from './IERC7579ModuleLike.json' with { type: 'json' };
 export { default as IGovernanceView } from './IGovernanceView.json' with { type: 'json' };
 export { default as MultiSendCallOnly } from './MultiSendCallOnly.json' with { type: 'json' };
 export { default as MultiSendCallOnlyHarness } from './MultiSendCallOnlyHarness.json' with { type: 'json' };
 export { default as OntologyTermRegistry } from './OntologyTermRegistry.json' with { type: 'json' };
 export { default as P256Verifier } from './P256Verifier.json' with { type: 'json' };
 export { default as PermissionlessSubregistry } from './PermissionlessSubregistry.json' with { type: 'json' };
+export { default as QuorumEnforcer } from './QuorumEnforcer.json' with { type: 'json' };
 export { default as RelationshipTypeRegistry } from './RelationshipTypeRegistry.json' with { type: 'json' };
 export { default as ShapeRegistry } from './ShapeRegistry.json' with { type: 'json' };
+export { default as SignatureSlotRecovery } from './SignatureSlotRecovery.json' with { type: 'json' };
+export { default as SkillDefinitionRegistry } from './SkillDefinitionRegistry.json' with { type: 'json' };
 export { default as SmartAgentModuleTypes } from './SmartAgentModuleTypes.json' with { type: 'json' };
+export { default as SmartAgentPaymaster } from './SmartAgentPaymaster.json' with { type: 'json' };
 export { default as TimestampEnforcer } from './TimestampEnforcer.json' with { type: 'json' };
+export { default as UniversalSignatureValidator } from './UniversalSignatureValidator.json' with { type: 'json' };
 export { default as ValueEnforcer } from './ValueEnforcer.json' with { type: 'json' };
 export { default as WebAuthnLib } from './WebAuthnLib.json' with { type: 'json' };

package/dist/deployments/base-sepolia.d.ts

@@ -0,0 +1,37 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-base-sepolia.json
+import type { Address } from 'viem';
+export interface Deployments {
+  readonly "agentAccountFactory": Address;
+  readonly "agentAccountImplementation": Address;
+  readonly "agentNameRegistry": Address;
+  readonly "agentNameResolver": Address;
+  readonly "agentNameUniversalResolver": Address;
+  readonly "agentProfileResolver": Address;
+  readonly "agentRelationship": Address;
+  readonly "agreementRegistry": Address;
+  readonly "allowedMethodsEnforcer": Address;
+  readonly "allowedTargetsEnforcer": Address;
+  readonly "approvedHashRegistry": Address;
+  readonly "attestationRegistry": Address;
+  readonly "callDataHashEnforcer": Address;
+  readonly "custodyPolicy": Address;
+  readonly "delegationManager": Address;
+  readonly "deployer": Address;
+  readonly "entryPoint": Address;
+  readonly "geoFeatureRegistry": Address;
+  readonly "ontologyTermRegistry": Address;
+  readonly "permissionlessSubregistry": Address;
+  readonly "permissionlessSubregistryDemoAgent": Address;
+  readonly "quorumEnforcer": Address;
+  readonly "relationshipTypeRegistry": Address;
+  readonly "shapeRegistry": Address;
+  readonly "skillDefinitionRegistry": Address;
+  readonly "smartAgentPaymaster": Address;
+  readonly "timestampEnforcer": Address;
+  readonly "universalSignatureValidator": Address;
+  readonly "valueEnforcer": Address;
+  readonly "chainId": number;
+}
+export declare const CONTRACTS: Deployments;
+export default CONTRACTS;

package/dist/deployments/base-sepolia.js

@@ -0,0 +1,35 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-base-sepolia.json
+export const CONTRACTS = {
+  "agentAccountFactory": "0x6f7Fc9B36977F55666548e0a73D9063F0D88A760",
+  "agentAccountImplementation": "0x11f1523D9883BdF382993d70C601D307ED0F1f13",
+  "agentNameRegistry": "0x6e660e41CFd0B410827fb96D21c26600AF6abF2f",
+  "agentNameResolver": "0x324F5A60c5DE45244c70a43cA3A6B1462d80fF5f",
+  "agentNameUniversalResolver": "0x40587e3591F7051ba7534177aB1F0B366034040e",
+  "agentProfileResolver": "0x748D005E8B3b366132F209F066821B2713A6e19e",
+  "agentRelationship": "0x5c3bf13822a37c84Dc617C920dB61a8217f6311d",
+  "agreementRegistry": "0x3B1DB6AC972b649E9E0960F0816F4D1EC3264c22",
+  "allowedMethodsEnforcer": "0x1500601201aA339249e2B78c42952Cf26CD12Ea7",
+  "allowedTargetsEnforcer": "0xfA1c40F9dC4ACC4d339D2eDE0003872154292CEa",
+  "approvedHashRegistry": "0xE01c1356F4B10FEfa8Ab210020B802cf3e900759",
+  "attestationRegistry": "0x16EB207C65A63E3ae256F49a4B11e785fE001139",
+  "callDataHashEnforcer": "0x7267eF129fCf341717D7f3469DDf7A0135d00b61",
+  "chainId": 84532,
+  "custodyPolicy": "0x5e3e3Bda33c799f2403a30aE35bf81deff236283",
+  "delegationManager": "0xBC5AE6213E91E076232a6c8e3942746f06A50154",
+  "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
+  "entryPoint": "0x7707C2b483CcADc3E72C2d39d216aC1C337FCd9d",
+  "geoFeatureRegistry": "0x0A9f10cb72D6Fb5C89Aa5865f397957729cF71F0",
+  "ontologyTermRegistry": "0xa9635EbfDb993395df6CD03b0DEE21E5b2A66Ec1",
+  "permissionlessSubregistry": "0xF38fdcd8eC83360C2F73CEEa52ae419D37aCaB5F",
+  "permissionlessSubregistryDemoAgent": "0x1c698cBFE2733301614a245a505E20eB5597a972",
+  "quorumEnforcer": "0xeB88df4492FB8Eb254f6017eD0463d42CF6FC8e7",
+  "relationshipTypeRegistry": "0x7c5FfD0aB55C52f6aa00c04D2a30457579A3083B",
+  "shapeRegistry": "0xAe431c6F000235d30ae28f507493215815eF88E2",
+  "skillDefinitionRegistry": "0xc0A26f8bac0482E0F8e3a61762F5862Bc21a2D11",
+  "smartAgentPaymaster": "0x0e54A8Cc986C86530f0593817E8CafE01FC52983",
+  "timestampEnforcer": "0xf9AeF60b8cb4939bF5B1AF48E777dad99Ef1084f",
+  "universalSignatureValidator": "0x7A282fFf06E6DC73613A31F55345535e24CB6832",
+  "valueEnforcer": "0x4be1B537b9583E69D9baBf8af1dc5371A4a750C5"
+};
+export default CONTRACTS;

package/dist/deployments/index.d.ts

@@ -0,0 +1,8 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+import type { Address } from 'viem';
+import type { Deployments } from './base-sepolia';
+export type { Deployments };
+export declare const BASE_SEPOLIA: Deployments;
+
+export type Network = 'base-sepolia';
+export declare function getDeployments(network: Network): Deployments;

package/dist/deployments/index.js

@@ -0,0 +1,13 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+import { CONTRACTS as BASE_SEPOLIA } from './base-sepolia.js';
+export { BASE_SEPOLIA };
+
+const TABLE = {
+  "base-sepolia": BASE_SEPOLIA,
+};
+
+export function getDeployments(network) {
+  const c = TABLE[network];
+  if (!c) throw new Error('[@agenticprimitives/contracts] no deployments for network ' + network);
+  return c;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.5",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {
@@ -15,7 +15,15 @@
   "exports": {
     "./abi": "./dist/abi/index.js",
     "./abi/*": "./dist/abi/*.json",
-    "./deployments/*": "./deployments-*.json"
+    "./deployments": {
+      "types": "./dist/deployments/index.d.ts",
+      "default": "./dist/deployments/index.js"
+    },
+    "./deployments/*": {
+      "types": "./dist/deployments/*.d.ts",
+      "default": "./dist/deployments/*.js"
+    },
+    "./deployments-json/*": "./deployments-*.json"
   },
   "files": [
     "LICENSE",
@@ -25,18 +33,27 @@
     "spec.md",
     "src",
     "dist/abi",
+    "dist/deployments",
     "dist/flat",
     "deployments-*.json"
   ],
+  "devDependencies": {
+    "solhint": "^5.0.5"
+  },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
     "setup": "bash setup.sh",
-    "build": "forge build && pnpm run build:abi",
+    "build": "forge build && pnpm run build:abi && pnpm run build:deployments",
     "build:abi": "node scripts/build-abi.mjs",
+    "build:deployments": "node scripts/build-deployments.mjs",
     "build:flat": "node scripts/build-flat.mjs",
     "test": "forge test",
+    "halmos": "halmos",
+    "echidna": "echidna test/echidna/CustodyPolicyEchidna.t.sol --contract CustodyPolicyEchidna --config echidna.yaml",
+    "medusa": "medusa fuzz --config medusa.json",
+    "lint": "solhint 'src/**/*.sol'",
     "typecheck": "echo 'no TS in this package; ABIs are JSON' && exit 0",
     "deploy:anvil": "forge script script/Deploy.s.sol --rpc-url http://127.0.0.1:8545 --broadcast --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80",
     "deploy:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/Deploy.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY",

package/src/AgentAccount.sol

@@ -22,6 +22,33 @@ import "./libraries/WebAuthnLib.sol";
 interface IAgentAccountFactoryView {
     function bundlerSigner() external view returns (address);
     function sessionIssuer() external view returns (address);
+    /// @dev R6.5 — the factory inherits `GovernanceManaged`; its
+    ///      `governance()` getter returns the AgenticGovernance pointer
+    ///      shared across every account it creates. AgentAccount reads
+    ///      this address to call `IGovernanceView.isPaused()` from
+    ///      `whenNotPaused`-guarded entrypoints.
+    function governance() external view returns (address);
+}
+
+/// @dev R6.5 — minimal interface for the pause read. Mirrors the same
+///      selector `GovernanceManaged._pausedSafe()` uses so an EOA or
+///      non-conforming governance contract is treated as "not paused"
+///      (legacy / test deploys still work). Production deploys ALWAYS
+///      use `AgenticGovernance` which implements this interface.
+interface IAgentAccountPauseView {
+    function isPaused() external view returns (bool);
+}
+
+/// @dev Spec 253 — minimal read surface of `ApprovedHashRegistry`. The
+///      account consults it ONLY from `isValidSignature` (the ERC-1271
+///      entrypoint), under the `0x03` sentinel, so a hash the account
+///      itself pre-approved (inside its own custody-gated execute/batch)
+///      validates as an ERC-1271 signature. Address is bound IMMUTABLE in
+///      the impl (see constructor) — never an owner-mutable view — so a
+///      factory/governance key compromise cannot re-point it at an
+///      attacker registry to forge signatures.
+interface IApprovedHashRegistryView {
+    function isApproved(address signer, bytes32 hash) external view returns (bool);
 }
 
 /**
@@ -60,6 +87,14 @@ contract AgentAccount is
     /// @dev The ERC-4337 EntryPoint contract
     IEntryPoint private immutable _entryPoint;
 
+    /// @dev Spec 253 — the `ApprovedHashRegistry` consulted by the `0x03`
+    ///      sentinel branch of `isValidSignature`. IMMUTABLE (baked into
+    ///      impl bytecode, shared by every proxy, changeable only via a
+    ///      custody-gated UUPS upgrade). May be `address(0)` on legacy/test
+    ///      deploys that don't use the sentinel — in which case the
+    ///      sentinel fails CLOSED (see `isValidSignature`).
+    address private immutable _approvedHashRegistry;
+
     /// @dev Authorized DelegationManager (ERC-7710 executor)
     address private _delegationManager;
 
@@ -127,6 +162,9 @@ contract AgentAccount is
 
     error NotFromSelf();
     error NotCustodianOrSelf();
+    /// @notice R6.5 — thrown when a `whenNotPaused`-guarded entrypoint
+    ///         is called while `AgenticGovernance.isPaused() == true`.
+    error SystemPaused();
     error CustodianAlreadyExists(address owner);
     error CustodianDoesNotExist(address owner);
     error CannotRemoveLastCustodian();
@@ -200,10 +238,53 @@ contract AgentAccount is
         _;
     }
 
+    // ─── R6.5 / CON-AgentAccount-005 — system-wide pause modifier ──
+    //
+    //   When `AgenticGovernance.isPaused() == true`, every mutating
+    //   external entrypoint guarded by this modifier reverts with
+    //   `SystemPaused`. Recovery-shaped entrypoints
+    //   (`uninstallModule`, `cancelPendingUpgrade`, `removeCustodian`,
+    //   the three `onlySelf` ceremonies) are deliberately NOT guarded
+    //   — an operator must always be able to remove attack surface
+    //   even during an incident.
+    //
+    //   Reads `governance()` through the factory at each check so a
+    //   factory-level governance rotation propagates to every account
+    //   without per-account migration. Legacy / direct-deploy accounts
+    //   (no factory) and EOA-governance / non-conforming-governance
+    //   deploys are treated as "not paused" so existing test fixtures
+    //   keep working — mirrors `GovernanceManaged._pausedSafe()`.
+    modifier whenNotPaused() {
+        if (_systemPaused()) revert SystemPaused();
+        _;
+    }
+
+    /// @dev R6.5 — `staticcall` chain: factory → governance.isPaused().
+    ///      Returns `false` on any non-conforming hop (legacy
+    ///      compatibility). Production deploys MUST pass a real
+    ///      `AgenticGovernance` to the factory; the production-deploy
+    ///      preflight enforces that invariant.
+    function _systemPaused() internal view returns (bool) {
+        address f = _factory;
+        if (f == address(0)) return false;
+        (bool okF, bytes memory dataF) = f.staticcall(
+            abi.encodeWithSelector(IAgentAccountFactoryView.governance.selector)
+        );
+        if (!okF || dataF.length < 32) return false;
+        address g = abi.decode(dataF, (address));
+        if (g == address(0) || g.code.length == 0) return false;
+        (bool okG, bytes memory dataG) = g.staticcall(
+            abi.encodeWithSelector(IAgentAccountPauseView.isPaused.selector)
+        );
+        if (!okG || dataG.length < 32) return false;
+        return abi.decode(dataG, (bool));
+    }
+
     // ─── Constructor / Initializer ──────────────────────────────────
 
-    constructor(IEntryPoint entryPoint_) {
+    constructor(IEntryPoint entryPoint_, address approvedHashRegistry_) {
         _entryPoint = entryPoint_;
+        _approvedHashRegistry = approvedHashRegistry_;
         _disableInitializers();
     }
 
@@ -361,7 +442,7 @@ contract AgentAccount is
     /// @notice Execute a previously-queued upgrade. Permissionless once
     ///         the timelock has expired — anyone can pay the gas, but
     ///         the implementation address was bound at queue time.
-    function executePendingUpgrade() external {
+    function executePendingUpgrade() external whenNotPaused {
         PendingUpgrade memory p = _pendingUpgrade;
         if (p.readyAt == 0) revert NoPendingUpgrade();
         if (block.timestamp < p.readyAt) revert UpgradeNotReady(p.readyAt, block.timestamp);
@@ -689,7 +770,7 @@ contract AgentAccount is
         uint256 moduleTypeId,
         address module,
         bytes calldata initData
-    ) external onlySelfOrFactoryInit {
+    ) external onlySelfOrFactoryInit whenNotPaused {
         if (module == address(0)) revert ZeroAddress();
         if (!_isSupportedModuleType(moduleTypeId)) revert UnsupportedModuleType(moduleTypeId);
 
@@ -837,6 +918,7 @@ contract AgentAccount is
     function executeFromModule(address target, uint256 value, bytes calldata data)
         external
         nonReentrant
+        whenNotPaused
         returns (bytes memory)
     {
         ModulesStorage storage $ = _modulesStorage();
@@ -891,7 +973,7 @@ contract AgentAccount is
     ///      EntryPoint / self / DelegationManager; the guard hardens
     ///      against a malicious target re-entering through one of those
     ///      callers.
-    function execute(address target, uint256 value, bytes calldata data) external override nonReentrant {
+    function execute(address target, uint256 value, bytes calldata data) external override nonReentrant whenNotPaused {
         _requireForExecute();
 
         ModulesStorage storage $ = _modulesStorage();
@@ -944,7 +1026,7 @@ contract AgentAccount is
     ///      OUTER `execute` already holds the guard, so external re-entry
     ///      is blocked; `_requireForExecute` restricts entry to
     ///      EntryPoint / self / DM (DM has its own `nonReentrant`).
-    function executeBatch(Call[] calldata calls) external override {
+    function executeBatch(Call[] calldata calls) external override whenNotPaused {
         _requireForExecute();
 
         ModulesStorage storage $ = _modulesStorage();
@@ -1018,6 +1100,21 @@ contract AgentAccount is
         bytes32 hash,
         bytes calldata signature
     ) external view override(IAgentAccount, IERC1271) returns (bytes4) {
+        // Spec 253 — approved-hash sentinel (ERC-1271 ONLY). A bare 1-byte
+        // 0x03 validates iff THIS account pre-approved `hash` in the
+        // (immutable) ApprovedHashRegistry — letting an org batch its
+        // outbound-delegation approvals into one deploy userOp. Checked on
+        // the RAW signature before the ERC-6492 unwrap: a 1-byte sig can't
+        // carry a 32-byte 6492 suffix, so there's no smuggling path. This
+        // branch is unreachable from `_validateSignature`/`_validateSig`
+        // (the userOp-auth path), where 0x03 is an unknown type → false.
+        // Fails CLOSED if the registry is unset/not-a-contract (ADR-0013).
+        if (signature.length == 1 && uint8(signature[0]) == SIG_TYPE_APPROVED_HASH) {
+            if (_approvedHashRegistry.code.length == 0) return bytes4(0xffffffff);
+            return IApprovedHashRegistryView(_approvedHashRegistry).isApproved(address(this), hash)
+                ? ERC1271_MAGIC_VALUE
+                : bytes4(0xffffffff);
+        }
         bytes memory inner = signature;
         if (signature.length >= 32 && bytes32(signature[signature.length - 32:]) == ERC6492_MAGIC) {
             (, , bytes memory unwrapped) = abi.decode(
@@ -1033,6 +1130,12 @@ contract AgentAccount is
 
     uint8 internal constant SIG_TYPE_ECDSA    = 0x00;
     uint8 internal constant SIG_TYPE_WEBAUTHN = 0x01;
+    /// @dev Spec 253 — approved-hash sentinel. Honored ONLY by
+    ///      `isValidSignature` (ERC-1271), NEVER by `_validateSig` /
+    ///      `_validateSignature` (the userOp-auth path) — there `0x03` is an
+    ///      unknown type and returns false. A bare 1-byte `0x03` means
+    ///      "this hash is pre-approved in the ApprovedHashRegistry".
+    uint8 internal constant SIG_TYPE_APPROVED_HASH = 0x03;
 
     /// @dev Internal dispatcher. Accepts plain 65-byte ECDSA sigs as legacy
     ///      form AND type-prefixed sigs (first byte = SIG_TYPE_*).
@@ -1061,11 +1164,14 @@ contract AgentAccount is
 
     function _verifyEcdsa(bytes32 hash, bytes memory sig) internal view returns (bool) {
         // Try raw hash first — matches EntryPoint v0.8 (EIP-712 userOpHash signed directly).
+        // R6.3: third return (sigVersion) intentionally discarded; we rely on `err` + custodian-set membership.
+        // slither-disable-next-line unused-return
         (address recovered, ECDSA.RecoverError err,) = ECDSA.tryRecover(hash, sig);
         if (err == ECDSA.RecoverError.NoError && _externalCustodians[recovered]) return true;
         // Fall back to eth-signed-message wrap — matches v0.7 and legacy ERC-1271
         // callers that pre-prefix the digest.
         bytes32 ethSigned = hash.toEthSignedMessageHash();
+        // slither-disable-next-line unused-return
         (recovered, err,) = ECDSA.tryRecover(ethSigned, sig);
         return err == ECDSA.RecoverError.NoError && _externalCustodians[recovered];
     }
@@ -1079,9 +1185,12 @@ contract AgentAccount is
         bytes memory sig,
         address expected
     ) internal pure returns (bool) {
+        // R6.3: third return (sigVersion) intentionally discarded; the `err` discriminant + `recovered == expected` is the auth.
+        // slither-disable-next-line unused-return
         (address recovered, ECDSA.RecoverError err,) = ECDSA.tryRecover(hash, sig);
         if (err == ECDSA.RecoverError.NoError && recovered == expected) return true;
         bytes32 ethSigned = MessageHashUtils.toEthSignedMessageHash(hash);
+        // slither-disable-next-line unused-return
         (recovered, err,) = ECDSA.tryRecover(ethSigned, sig);
         return err == ECDSA.RecoverError.NoError && recovered == expected;
     }
@@ -1105,11 +1214,23 @@ contract AgentAccount is
             PasskeyEntry storage key = $.keys[a.credentialIdDigest];
             if (key.x == 0 && key.y == 0) return false;
             // H7-C.1 / CON-WEBAUTHN-001: pin per-credential rpIdHash + require UP.
-            // UV is not required at the library layer; account policy can layer
-            // UV requirement in via a future policy module if needed.
+            // R8.2 / ATL-SEC-03: require UV (User Verification) at the library
+            // layer. Wave H1 made the JS-side ceremony pass
+            // `userVerification: 'required'` for custody-grade flows
+            // (demo-sso, demo-sso-next, demo-org, demo-web-recovery); the
+            // third-party audit (2026-05-31) correctly observed that the
+            // contract still passed `requireUv: false` here. That meant a
+            // permissive authenticator could produce a UP-only assertion
+            // and we'd accept it. R8.2 makes UV strictly required on every
+            // ERC-1271 verify. Browser ceremonies that pass
+            // `userVerification: 'preferred'` will be REJECTED at the
+            // signature step — those apps (demo-web, demo-web-pro) MUST
+            // upgrade to `'required'` for production deployments. Tests
+            // exercising lower-assurance flows can install a separate
+            // passkey-validator module that relaxes this check.
             bytes32 rpIdHash = $.rpIdHashOf[a.credentialIdDigest];
             if (rpIdHash == bytes32(0)) return false;
-            return WebAuthnLib.verify(a, hash, key.x, key.y, rpIdHash, false);
+            return WebAuthnLib.verify(a, hash, key.x, key.y, rpIdHash, /*requireUv*/ true);
         } catch {
             return false;
         }
@@ -1178,7 +1299,7 @@ contract AgentAccount is
     ///      agenticprimitives AgentAccount is forbidden — enforced via
     ///      the ERC-165 marker. Passkey custodians are not added here;
     ///      use `addPasskey` instead.
-    function addCustodian(address owner) external override onlySelf {
+    function addCustodian(address owner) external override onlySelf whenNotPaused {
         if (owner == address(0)) revert ZeroAddress();
         if (_externalCustodians[owner]) revert CustodianAlreadyExists(owner);
         if (_isAgenticPrimitivesAgent(owner)) {