@agenticprimitives/contracts 1.0.0-alpha.4 → 1.0.0-alpha.6

package/src/attestation/AttestationRegistry.sol

@@ -0,0 +1,320 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import "@openzeppelin/contracts/interfaces/IERC1271.sol";
+
+/**
+ * @title AttestationRegistry
+ * @notice EAS-aligned, bilateral-consent attestation registry per ADR-0023.
+ *
+ *   ─── Substrate role ───
+ *
+ * Layers 12-15 of the coordination spine (Evidence / Outcome / Validation /
+ * TrustUpdate) plus the substrate's Association + JointAgreement attestations
+ * all share THIS one contract. Per ADR-0024 Decision 2 — the architectural
+ * inverse of the smart-contract-per-credential anti-pattern.
+ *
+ *   ─── Key invariants (AR-*) ───
+ *
+ * AR-01 deterministic UID = keccak256(subject, issuer, credentialType, credentialHash, refUID, salt)
+ * AR-02 issuer signature verified via ERC-1271 against the named issuer SA
+ * AR-03 schemaId MUST point to a registered ShapeRegistry shape (governance-gated)
+ * AR-04 bilateral-consent verified via DelegationManager.verifyAuthorization
+ * AR-05 holder-only revocation for unilateral; either-party for joint
+ * AR-06 NO issuerRevoke(...) entrypoint — by static analysis
+ * AR-07 epoch-bucket timestamps; raw block.timestamp never stored
+ * AR-08 four indexed event topics (EAS-like)
+ * AR-09 immutable + non-upgradeable; no admin
+ *
+ * Spec 242 §9 + ADR-0023.
+ */
+contract AttestationRegistry {
+    // ─── Constants ──────────────────────────────────────────────────────
+
+    uint64 public constant EPOCH_SECONDS = 3600;
+
+    // ─── Errors ─────────────────────────────────────────────────────────
+
+    error InvalidIssuerSignature();
+    error AttestationAlreadyExists();
+    error AttestationNotFound();
+    error NotSubject();
+    error NotParty();
+    error AlreadyRevoked();
+    error InvalidParties();
+    error InvalidPartyConsent();
+    error EmptyCredentialHash();
+
+    /// @dev RW1-1 (ADR-0027) — the canonical consent payload each party signs to consent to a
+    ///      joint agreement. The contract RECOMPUTES this digest from calldata; a stored/supplied
+    ///      reference is not consent. Binds the consent to the exact parties + agreement + credential.
+    bytes32 internal constant JOINT_CONSENT_TYPEHASH = keccak256(
+        "JointAgreementConsent(address party1,address party2,bytes32 agreementCommitment,bytes32 credentialHash)"
+    );
+
+    // ─── Storage ────────────────────────────────────────────────────────
+
+    /// @notice The canonical attestation row. EAS-aligned shape.
+    struct Attestation {
+        bytes32 uid;
+        bytes32 schemaId; // → ShapeRegistry row
+        bytes32 credentialType; // VC type class
+        bytes32 credentialHash; // RFC 8785 JCS hash of off-chain VC body
+        bytes32 refUID; // EAS-style back-pointer (e.g. AgreementCommitment for JointAgreement)
+        bytes32 bilateralConsentRef; // 0 for unilateral; hash for joint
+        bytes32 offchainCredentialStatusList; // W3C VC StatusList2021 pointer
+        uint64 epochBucket; // attest time / EPOCH_SECONDS
+        uint64 revocationEpochBucket; // 0 if not revoked
+        address subject; // holder (unilateral) or party[0] (joint)
+        address party2; // address(0) for unilateral; party[1] for joint
+        address issuer; // off-chain VC signer SA
+    }
+
+    mapping(bytes32 => Attestation) private _attestations;
+
+    // ─── Requests ───────────────────────────────────────────────────────
+
+    struct AssociationAttestationRequest {
+        bytes32 schemaId;
+        bytes32 credentialType;
+        bytes32 credentialHash;
+        bytes32 offchainCredentialStatusList;
+        address subject;
+        address issuer;
+        /// @dev EIP-712 signature by `issuer` SA over the credentialHash;
+        ///      verified via ERC-1271.
+        bytes issuerSignature;
+        uint256 salt;
+    }
+
+    struct JointAgreementAttestationRequest {
+        bytes32 schemaId;
+        bytes32 credentialType;
+        bytes32 credentialHash;
+        bytes32 refUID; // AgreementCommitment hash (spec 241)
+        bytes32 bilateralConsentRef; // DEPRECATED / IGNORED (RW1-1, ADR-0027): consent is now
+            // VERIFIED on-chain from party1Signature + party2Signature over the RECOMPUTED
+            // consent digest; the stored `bilateralConsentRef` is that recomputed digest, not this.
+        bytes32 offchainCredentialStatusList;
+        address party1;
+        address party2;
+        address issuer;
+        bytes issuerSignature;
+        bytes party1Signature; // RW1-1: party1's consent over JOINT_CONSENT_TYPEHASH digest
+        bytes party2Signature; // RW1-1: party2's consent over JOINT_CONSENT_TYPEHASH digest
+        uint256 salt;
+    }
+
+    // ─── Events (EAS-like; 4 indexed topics each) ───────────────────────
+
+    /// @dev Solidity caps indexed-args at 3 per non-anonymous event (EVM
+    ///      topic0 = event signature). Matches EAS event shape:
+    ///      `uid` is non-indexed payload; subject + issuer + credentialType
+    ///      are indexed for filtering.
+    event Attested(
+        address indexed subject,
+        address indexed issuer,
+        bytes32 indexed credentialType,
+        bytes32 uid
+    );
+
+    event JointAttested(
+        address indexed party1,
+        address indexed party2,
+        bytes32 indexed credentialType,
+        bytes32 uid
+    );
+
+    event Revoked(
+        address indexed subjectOrParty,
+        bytes32 indexed credentialType,
+        bytes32 uid,
+        bytes32 reasonHash
+    );
+
+    // ─── Public surface ─────────────────────────────────────────────────
+
+    /// @notice Unilateral attestation by a holder against an issued credential.
+    function assertAssociation(AssociationAttestationRequest calldata req) external returns (bytes32) {
+        if (req.credentialHash == bytes32(0)) revert EmptyCredentialHash();
+
+        // AR-02: verify issuer signature over credentialHash
+        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+            revert InvalidIssuerSignature();
+        }
+
+        bytes32 uid = _computeUid(
+            req.subject,
+            address(0),
+            req.issuer,
+            req.credentialType,
+            req.credentialHash,
+            bytes32(0),
+            req.salt
+        );
+
+        if (_attestations[uid].uid != bytes32(0)) revert AttestationAlreadyExists();
+
+        uint64 bucket = uint64(block.timestamp) / EPOCH_SECONDS;
+
+        _attestations[uid] = Attestation({
+            uid: uid,
+            schemaId: req.schemaId,
+            credentialType: req.credentialType,
+            credentialHash: req.credentialHash,
+            refUID: bytes32(0),
+            bilateralConsentRef: bytes32(0),
+            offchainCredentialStatusList: req.offchainCredentialStatusList,
+            epochBucket: bucket,
+            revocationEpochBucket: 0,
+            subject: req.subject,
+            party2: address(0),
+            issuer: req.issuer
+        });
+
+        emit Attested(req.subject, req.issuer, req.credentialType, uid);
+        return uid;
+    }
+
+    /// @notice Joint attestation by two parties against an agreement.
+    /// @dev RW1-1 (ADR-0027) — bilateral consent is VERIFIED on-chain, not trusted. The contract
+    ///      recomputes the canonical consent digest (`JOINT_CONSENT_TYPEHASH` over party1, party2,
+    ///      the agreement commitment, and the credential hash) and requires BOTH parties' signatures
+    ///      over it (ERC-1271 for smart accounts, ECDSA for EOAs). A nonzero `bilateralConsentRef` is
+    ///      NOT consent (the prior "caller's responsibility" model, AR-04). The recomputed digest is
+    ///      what gets stored. Alternative consent proof via `DelegationManager.verifyAuthorizationForCall`
+    ///      (an exact-call sub-delegation per party) is spec 249's option (b); this entrypoint takes
+    ///      the direct two-party-signature form.
+    function assertJointAgreement(
+        JointAgreementAttestationRequest calldata req
+    ) external returns (bytes32) {
+        if (req.credentialHash == bytes32(0)) revert EmptyCredentialHash();
+        if (req.party1 == address(0) || req.party2 == address(0)) revert InvalidParties();
+        if (req.party1 == req.party2) revert InvalidParties();
+
+        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+            revert InvalidIssuerSignature();
+        }
+
+        // VERIFY bilateral consent: recompute the digest, require both parties' signatures over it.
+        bytes32 consentDigest = keccak256(
+            abi.encode(JOINT_CONSENT_TYPEHASH, req.party1, req.party2, req.refUID, req.credentialHash)
+        );
+        if (!_isValidSignatureBool(req.party1, consentDigest, req.party1Signature)) revert InvalidPartyConsent();
+        if (!_isValidSignatureBool(req.party2, consentDigest, req.party2Signature)) revert InvalidPartyConsent();
+
+        bytes32 uid = _computeUid(
+            req.party1,
+            req.party2,
+            req.issuer,
+            req.credentialType,
+            req.credentialHash,
+            req.refUID,
+            req.salt
+        );
+        if (_attestations[uid].uid != bytes32(0)) revert AttestationAlreadyExists();
+
+        uint64 bucket = uint64(block.timestamp) / EPOCH_SECONDS;
+
+        _attestations[uid] = Attestation({
+            uid: uid,
+            schemaId: req.schemaId,
+            credentialType: req.credentialType,
+            credentialHash: req.credentialHash,
+            refUID: req.refUID,
+            bilateralConsentRef: consentDigest, // the VERIFIED, recomputed consent digest (RW1-1)
+            offchainCredentialStatusList: req.offchainCredentialStatusList,
+            epochBucket: bucket,
+            revocationEpochBucket: 0,
+            subject: req.party1,
+            party2: req.party2,
+            issuer: req.issuer
+        });
+
+        emit JointAttested(req.party1, req.party2, req.credentialType, uid);
+        return uid;
+    }
+
+    /// @notice Holder-only revocation for unilateral attestations (AR-05).
+    function revokeOwnAssociation(bytes32 uid, bytes32 reasonHash) external {
+        Attestation storage a = _attestations[uid];
+        if (a.uid == bytes32(0)) revert AttestationNotFound();
+        if (a.party2 != address(0)) revert NotSubject(); // joint — wrong entrypoint
+        if (msg.sender != a.subject) revert NotSubject();
+        if (a.revocationEpochBucket != 0) revert AlreadyRevoked();
+
+        a.revocationEpochBucket = uint64(block.timestamp) / EPOCH_SECONDS;
+        emit Revoked(msg.sender, a.credentialType, uid, reasonHash);
+    }
+
+    /// @notice Either-party revocation for joint attestations (D-26 + AR-05).
+    function revokeOwnJointAgreement(bytes32 uid, bytes32 reasonHash) external {
+        Attestation storage a = _attestations[uid];
+        if (a.uid == bytes32(0)) revert AttestationNotFound();
+        if (a.party2 == address(0)) revert NotParty(); // unilateral — wrong entrypoint
+        if (msg.sender != a.subject && msg.sender != a.party2) revert NotParty();
+        if (a.revocationEpochBucket != 0) revert AlreadyRevoked();
+
+        a.revocationEpochBucket = uint64(block.timestamp) / EPOCH_SECONDS;
+        emit Revoked(msg.sender, a.credentialType, uid, reasonHash);
+    }
+
+    /// @notice Get the full attestation row.
+    function getAttestation(bytes32 uid) external view returns (Attestation memory) {
+        Attestation memory a = _attestations[uid];
+        if (a.uid == bytes32(0)) revert AttestationNotFound();
+        return a;
+    }
+
+    /// @notice Convenience — `!revoked` view.
+    function isValid(bytes32 uid) external view returns (bool) {
+        return _attestations[uid].uid != bytes32(0) && _attestations[uid].revocationEpochBucket == 0;
+    }
+
+    // ─── Internal ───────────────────────────────────────────────────────
+
+    function _computeUid(
+        address subject,
+        address party2,
+        address issuer,
+        bytes32 credentialType,
+        bytes32 credentialHash,
+        bytes32 refUID,
+        uint256 salt
+    ) internal pure returns (bytes32) {
+        return
+            keccak256(
+                abi.encode(subject, party2, issuer, credentialType, credentialHash, refUID, salt)
+            );
+    }
+
+    /// @dev ERC-1271-first signature verification (smart accounts), with EOA fallback.
+    function _isValidSignatureBool(
+        address signer,
+        bytes32 digest,
+        bytes memory signature
+    ) internal view returns (bool) {
+        if (signer.code.length > 0) {
+            try IERC1271(signer).isValidSignature(digest, signature) returns (bytes4 result) {
+                return result == IERC1271.isValidSignature.selector;
+            } catch {
+                return false;
+            }
+        }
+        // EOA fallback via eth-signed message hash + ecrecover
+        bytes32 ethHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", digest));
+        if (signature.length != 65) return false;
+        bytes32 r;
+        bytes32 s;
+        uint8 v;
+        // solhint-disable-next-line no-inline-assembly
+        assembly {
+            r := mload(add(signature, 0x20))
+            s := mload(add(signature, 0x40))
+            v := byte(0, mload(add(signature, 0x60)))
+        }
+        if (v < 27) v += 27;
+        address recovered = ecrecover(ethHash, v, r, s);
+        return recovered != address(0) && recovered == signer;
+    }
+}

package/src/custody/CustodyPolicy.sol

@@ -4,6 +4,22 @@ pragma solidity ^0.8.28;
 import {IAgentAccount, AgentAccountRecoveryArgs, AgentAccountRecoveryPasskeyAdd} from "../IAgentAccount.sol";
 import {SignatureSlotRecovery} from "../libraries/SignatureSlotRecovery.sol";
 
+/// @dev R6.6 — minimal interface for the `account → factory → governance.isPaused()`
+///      staticcall chain. Mirrors the same patterns introduced by R6.5
+///      in `AgentAccount` (see `IAgentAccountFactoryView` /
+///      `IAgentAccountPauseView` in `AgentAccount.sol`).
+interface IAgentAccountFactoryAccessor {
+    function factory() external view returns (address);
+}
+
+interface ICustodyPolicyFactoryView {
+    function governance() external view returns (address);
+}
+
+interface ICustodyPolicyPauseView {
+    function isPaused() external view returns (bool);
+}
+
 /**
  * @title CustodyPolicy
  * @notice ERC-7579 module that owns the schedule / apply / cancel
@@ -125,6 +141,64 @@ contract CustodyPolicy {
         _CACHED_DOMAIN_SEPARATOR = _buildDomainSeparator();
     }
 
+    // ─── R6.6 / CON-CustodyPolicy-005 — system-pause modifier ──────
+    //
+    //   `whenAccountNotPaused(account)` reverts when
+    //   `AgenticGovernance.isPaused() == true`, where governance is
+    //   resolved per-call via the account's factory:
+    //
+    //       account.factory() → factory.governance() → governance.isPaused()
+    //
+    //   3 staticcalls. Custody schedule/apply are rare; the gas cost
+    //   is acceptable. Non-conforming hops (EOA factory, EOA governance,
+    //   missing fn) treat the system as "not paused" so legacy / test
+    //   deploys keep working — mirrors the R6.5 pattern in AgentAccount
+    //   and `GovernanceManaged._pausedSafe()`.
+    //
+    //   Applied to: `scheduleCustodyChange`, `applyCustodyChange`.
+    //
+    //   Deliberately NOT applied to (recovery primitives that must
+    //   work during an incident):
+    //     - `cancelScheduledChange` — defensive de-escalation
+    //     - `onUninstall`           — removing attack surface
+    //     - `onInstall`              — gated upstream by paused
+    //                                   `installModule` on AgentAccount (R6.5)
+    //                                   and paused `createAgentAccount`
+    //                                   on AgentAccountFactory
+    modifier whenAccountNotPaused(address account) {
+        if (_systemPausedFor(account)) revert SystemPaused();
+        _;
+    }
+
+    /// @notice R6.6 — thrown when a `whenAccountNotPaused`-guarded
+    ///         entrypoint is called while the governance pause flag
+    ///         is set.
+    error SystemPaused();
+
+    function _systemPausedFor(address account) internal view returns (bool) {
+        if (account == address(0) || account.code.length == 0) return false;
+        // Hop 1: account → factory
+        (bool okF, bytes memory dataF) = account.staticcall(
+            abi.encodeWithSelector(IAgentAccountFactoryAccessor.factory.selector)
+        );
+        if (!okF || dataF.length < 32) return false;
+        address fac = abi.decode(dataF, (address));
+        if (fac == address(0) || fac.code.length == 0) return false;
+        // Hop 2: factory → governance
+        (bool okG, bytes memory dataG) = fac.staticcall(
+            abi.encodeWithSelector(ICustodyPolicyFactoryView.governance.selector)
+        );
+        if (!okG || dataG.length < 32) return false;
+        address gov = abi.decode(dataG, (address));
+        if (gov == address(0) || gov.code.length == 0) return false;
+        // Hop 3: governance → isPaused
+        (bool okP, bytes memory dataP) = gov.staticcall(
+            abi.encodeWithSelector(ICustodyPolicyPauseView.isPaused.selector)
+        );
+        if (!okP || dataP.length < 32) return false;
+        return abi.decode(dataP, (bool));
+    }
+
     function _buildDomainSeparator() internal view returns (bytes32) {
         return keccak256(
             abi.encode(
@@ -335,7 +409,7 @@ contract CustodyPolicy {
         CustodyAction action,
         bytes calldata args,
         bytes calldata quorumSigs
-    ) external returns (uint256 changeId) {
+    ) external whenAccountNotPaused(account) returns (uint256 changeId) {
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
 
@@ -394,7 +468,10 @@ contract CustodyPolicy {
         emit CustodyChangeScheduled(account, changeId, action, eta, msg.sender);
     }
 
-    function applyCustodyChange(address account, uint256 changeId, bytes calldata quorumSigs) external {
+    function applyCustodyChange(address account, uint256 changeId, bytes calldata quorumSigs)
+        external
+        whenAccountNotPaused(account)
+    {
         Config storage c = _configs[account];
         if (!c.installed) revert NotInstalledOn(account);
 

package/src/enforcers/AllowedMethodsEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Restricts delegated calls to specific function selectors.
  * @dev terms = abi.encode(bytes4[] allowedSelectors)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract AllowedMethodsEnforcer is ICaveatEnforcer {
     error MethodNotAllowed();

package/src/enforcers/AllowedTargetsEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Restricts delegated calls to a specific set of target contracts.
  * @dev terms = abi.encode(address[] allowedTargets)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract AllowedTargetsEnforcer is ICaveatEnforcer {
     error TargetNotAllowed();

package/src/enforcers/CallDataHashEnforcer.sol

@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.28;
+
+import "../agency/ICaveatEnforcer.sol";
+
+/**
+ * @title CallDataHashEnforcer
+ * @notice Pins a delegation to EXACTLY one calldata payload — the exact-call
+ *         binding ADR-0027 / spec 249 (RW1-4b) needs for sensitive ops.
+ * @dev terms = abi.encode(bytes32 expectedHash), where
+ *      `expectedHash == keccak256(callData)` for the single call this
+ *      delegation authorizes. `beforeHook` recomputes `keccak256(callData)`
+ *      and reverts on mismatch.
+ *
+ *      Ported from smart-agent's `CallDataHashEnforcer` (the "P4 — sensitive
+ *      ops require exact-call sub-delegation" doctrine). Combined with
+ *      `AllowedTargetsEnforcer` (target) + a tight `TimestampEnforcer`
+ *      window + `ValueEnforcer`, a consent sub-delegation can pin the precise
+ *      call — not merely its selector — so a registry that checks
+ *      `DelegationManager.verifyAuthorizationForCall(...)` binds consent to the
+ *      exact assertion being stored (RW1-1).
+ *
+ *      R6.7 — Stateless validator: hooks are `pure`, the contract has zero
+ *      storage, so no `whenNotPaused` is needed; the DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch, and the read-only `verifyAuthorizationForCall` evaluates it
+ *      via `staticcall`.
+ */
+contract CallDataHashEnforcer is ICaveatEnforcer {
+    error BadTermsLength();
+    error CallDataMismatch(bytes32 expected, bytes32 actual);
+
+    function beforeHook(
+        bytes calldata terms,
+        bytes calldata,
+        bytes32,
+        address,
+        address,
+        address,
+        uint256,
+        bytes calldata callData
+    ) external pure override {
+        if (terms.length != 32) revert BadTermsLength();
+        bytes32 expected = abi.decode(terms, (bytes32));
+        bytes32 actual = keccak256(callData);
+        if (expected != actual) revert CallDataMismatch(expected, actual);
+    }
+
+    function afterHook(
+        bytes calldata,
+        bytes calldata,
+        bytes32,
+        address,
+        address,
+        address,
+        uint256,
+        bytes calldata
+    ) external pure override {
+        // No post-execution check needed.
+    }
+}

package/src/enforcers/QuorumEnforcer.sol

@@ -68,6 +68,14 @@ import "../libraries/SignatureSlotRecovery.sol";
  *      Only the first `threshold` slots are checked. Excess entries
  *      beyond the threshold are ignored — callers SHOULD NOT pad blobs
  *      unnecessarily as calldata cost scales linearly.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.chainid`), `afterHook`
+ *      is `external pure` (empty body); contract has zero storage
+ *      variables. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract QuorumEnforcer is ICaveatEnforcer {
     error InsufficientQuorum(uint256 supplied, uint8 threshold);

package/src/enforcers/TimestampEnforcer.sol

@@ -8,6 +8,13 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a time window — delegation is only valid between two timestamps.
  * @dev terms = abi.encode(uint256 validAfter, uint256 validUntil)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed.
+ *      `beforeHook` is `external view` (reads `block.timestamp`); contract
+ *      has zero storage. The DM-side pause check in
+ *      `DelegationManager.redeemDelegation` gates all reachable enforcer
+ *      dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract TimestampEnforcer is ICaveatEnforcer {
     error TimestampNotYetValid();

package/src/enforcers/ValueEnforcer.sol

@@ -8,6 +8,12 @@ import "../agency/ICaveatEnforcer.sol";
  * @notice Enforces a maximum ETH value per call.
  * @dev terms = abi.encode(uint256 maxValue)
  *      Follows ERC-7710 / MetaMask DeleGator beforeHook/afterHook pattern.
+ *
+ *      R6.7 — Stateless validator; no `whenNotPaused` modifier needed
+ *      (hooks are `pure`, contract has zero storage). The DM-side pause
+ *      check in `DelegationManager.redeemDelegation` gates all
+ *      reachable enforcer dispatch. See `docs/audits/r6-contracts-recon-2026-05-31.md`
+ *      § 4.4 + `test/EnforcerPauseInvariantR67.t.sol`.
  */
 contract ValueEnforcer is ICaveatEnforcer {
     error ValueExceedsLimit();