@agenticprimitives/contracts 1.0.0-alpha.5 → 1.0.0-alpha.7

package/src/agreement/AgreementRegistry.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.28;
 
 import "@openzeppelin/contracts/interfaces/IERC1271.sol";
+import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 
 /**
  * @title AgreementRegistry
@@ -46,8 +47,20 @@ contract AgreementRegistry {
     ///      digest model; the TS side derives the same constant (cross-stack
     ///      typehash-equality gate). Plain struct hash (no domain separator),
     ///      matching the attestation registry's JOINT_CONSENT_TYPEHASH.
-    bytes32 internal constant TRANSITION_TYPEHASH =
-        keccak256("AgreementTransition(bytes32 agreementCommitment,uint8 toStatus,bytes32 nullifier)");
+    ///      AGR-1 (audit 2026-06-10): also bind chainId + this contract so a transition signature
+    ///      cannot be replayed on another chain or a redeployed registry.
+    bytes32 internal constant TRANSITION_TYPEHASH = keccak256(
+        "AgreementTransition(bytes32 agreementCommitment,uint8 toStatus,bytes32 nullifier,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev SC-1 (audit 2026-06-09): the issuer attestation digest is RECOMPUTED on-chain from the
+    ///      agreement's contents + chain + this contract — it is NOT a caller-supplied free-form hash.
+    ///      Binds (agreementCommitment, schemaHash, issuer, chainId, verifyingContract) so a signature
+    ///      lifted from any other context cannot back an attacker-chosen commitment. The TS side derives
+    ///      the same constant (cross-stack typehash-equality gate).
+    bytes32 internal constant AGREEMENT_ISSUER_TYPEHASH = keccak256(
+        "AgreementIssuerAttestation(bytes32 agreementCommitment,bytes32 schemaHash,address issuer,uint256 chainId,address verifyingContract)"
+    );
 
     // ─── Errors ─────────────────────────────────────────────────────────
 
@@ -85,9 +98,8 @@ contract AgreementRegistry {
     struct AgreementIssuancePayload {
         bytes32 schemaHash;
         address issuer;
-        /// @dev EIP-712 attestation hash by the issuer (over agreementCommitment + schemaHash).
-        bytes32 attestationStructHash;
-        /// @dev issuer's signature over `attestationStructHash`.
+        /// @dev issuer's signature over the RECOMPUTED issuer-attestation digest (SC-1). The contract
+        ///      derives the digest from the payload contents — no caller-supplied attestation hash.
         bytes issuerSignature;
         /// @dev The asserted canonical commitment hash; we verify recomputation.
         bytes32 agreementCommitment;
@@ -153,8 +165,20 @@ contract AgreementRegistry {
             revert AlreadyRegistered();
         }
 
-        // AR-02 — verify issuer signature over the attestation hash
-        if (!_isValidSignatureBool(p.issuer, p.attestationStructHash, p.issuerSignature)) {
+        // AR-02 / SC-1 — RECOMPUTE the issuer-attestation digest from the agreement contents (+ chain +
+        // this contract) and verify the issuer signed THAT. A signature over an arbitrary digest from
+        // any other context can no longer back an attacker-chosen commitment.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                AGREEMENT_ISSUER_TYPEHASH,
+                p.agreementCommitment,
+                p.schemaHash,
+                p.issuer,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(p.issuer, issuerDigest, p.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
@@ -222,7 +246,7 @@ contract AgreementRegistry {
         // caller-supplied hash. The signed payload is canonically bound to (commitment, toStatus,
         // nullifier) here, on chain.
         bytes32 transitionDigest = keccak256(
-            abi.encode(TRANSITION_TYPEHASH, p.agreementCommitment, p.toStatus, p.nullifier)
+            abi.encode(TRANSITION_TYPEHASH, p.agreementCommitment, p.toStatus, p.nullifier, block.chainid, address(this))
         );
 
         bool bilateralRequired = (p.toStatus != STATUS_DISPUTED);
@@ -253,6 +277,15 @@ contract AgreementRegistry {
     ///         that permits public joint assertion (currently any non-NONE
     ///         status; revoked agreements can still be jointly disclosed as
     ///         historical record).
+    ///
+    /// @dev    NOT a consent or validity oracle (audit 2026-06-10). A `true`
+    ///         result means only that `agreementCommitment` is REGISTERED — it is
+    ///         an opaque back-reference, NOT proof that any particular party
+    ///         consented, that the agreement is currently valid, or that a given
+    ///         credential is bound to it. Bilateral consent for a joint assertion
+    ///         is established separately by `AttestationRegistry.assertJointAgreement`,
+    ///         which recomputes both parties' consent signatures. Consumers MUST
+    ///         NOT treat the boolean here as authorization.
     function isAssertableCommitment(
         bytes32 agreementCommitment,
         address /* actor */
@@ -288,19 +321,11 @@ contract AgreementRegistry {
                 return false;
             }
         }
+        // P2-2 (audit 2026-06-10): route EOA recovery through OpenZeppelin ECDSA.tryRecover instead of
+        // raw ecrecover — it rejects high-s (malleable) signatures and malformed lengths, matching the
+        // DelegationManager idiom so every signature-verifying contract shares one low-s-safe path.
         bytes32 ethHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", digest));
-        if (signature.length != 65) return false;
-        bytes32 r;
-        bytes32 s;
-        uint8 v;
-        // solhint-disable-next-line no-inline-assembly
-        assembly {
-            r := mload(add(signature, 0x20))
-            s := mload(add(signature, 0x40))
-            v := byte(0, mload(add(signature, 0x60)))
-        }
-        if (v < 27) v += 27;
-        address recovered = ecrecover(ethHash, v, r, s);
-        return recovered != address(0) && recovered == signer;
+        (address recovered, ECDSA.RecoverError err, ) = ECDSA.tryRecover(ethHash, signature);
+        return err == ECDSA.RecoverError.NoError && recovered == signer;
     }
 }

package/src/attestation/AttestationRegistry.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.28;
 
 import "@openzeppelin/contracts/interfaces/IERC1271.sol";
+import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 
 /**
  * @title AttestationRegistry
@@ -17,9 +18,19 @@ import "@openzeppelin/contracts/interfaces/IERC1271.sol";
  *   ─── Key invariants (AR-*) ───
  *
  * AR-01 deterministic UID = keccak256(subject, issuer, credentialType, credentialHash, refUID, salt)
- * AR-02 issuer signature verified via ERC-1271 against the named issuer SA
- * AR-03 schemaId MUST point to a registered ShapeRegistry shape (governance-gated)
- * AR-04 bilateral-consent verified via DelegationManager.verifyAuthorization
+ * AR-02 issuer signature verified (ERC-1271 for SAs, low-s ECDSA for EOAs) over a CANONICAL TYPED
+ *       digest recomputed on-chain — ASSOCIATION_ATTESTATION_TYPEHASH (unilateral) /
+ *       JOINT_ISSUER_TYPEHASH (joint), each binding the parties/subject + schema + credentialType +
+ *       credentialHash + chainId + this contract (SC-2 / ATT-1). A bare credentialHash is never trusted.
+ * AR-03 schemaId is an OPAQUE tag stored on the attestation. This registry does NOT dereference
+ *       ShapeRegistry on-chain; shape/governance validation of schemaId is an off-chain/consumer
+ *       concern. (Earlier drafts claimed on-chain ShapeRegistry enforcement — that is not implemented
+ *       here and consumers MUST NOT assume it.)
+ * AR-04 bilateral consent is VERIFIED on-chain by recomputing JOINT_CONSENT_TYPEHASH (party1, party2,
+ *       agreementCommitment, credentialHash, chainId, this contract) and requiring BOTH parties'
+ *       signatures over it (ERC-1271 / low-s ECDSA). This entrypoint uses the direct two-party-signature
+ *       form; the DelegationManager.verifyAuthorization predicate path is spec 249's alternative (b),
+ *       NOT this contract's direct joint path.
  * AR-05 holder-only revocation for unilateral; either-party for joint
  * AR-06 NO issuerRevoke(...) entrypoint — by static analysis
  * AR-07 epoch-bucket timestamps; raw block.timestamp never stored
@@ -48,8 +59,28 @@ contract AttestationRegistry {
     /// @dev RW1-1 (ADR-0027) — the canonical consent payload each party signs to consent to a
     ///      joint agreement. The contract RECOMPUTES this digest from calldata; a stored/supplied
     ///      reference is not consent. Binds the consent to the exact parties + agreement + credential.
+    ///      ATT-3 (audit 2026-06-10): also binds chainId + this registry, mirroring the issuer side
+    ///      (ATT-1) and the association path (SC-2). Without it a party's consent signature could be
+    ///      replayed on another chain or a redeployed registry (the attestation map is per-instance
+    ///      storage, so a cross-instance replay anchors a fresh spoofed attestation).
     bytes32 internal constant JOINT_CONSENT_TYPEHASH = keccak256(
-        "JointAgreementConsent(address party1,address party2,bytes32 agreementCommitment,bytes32 credentialHash)"
+        "JointAgreementConsent(address party1,address party2,bytes32 agreementCommitment,bytes32 credentialHash,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev ATT-1 (audit 2026-06-10): the SC-2 bug class lived on in the JOINT issuer signature — it was
+    ///      verified over a bare `credentialHash`, so a known issuer signature could be reused to anchor a
+    ///      spoofed issuer-backed joint attestation with different parties/schema. The issuer now signs a
+    ///      digest binding parties + schema + credential type + commitment + chain + this contract.
+    bytes32 internal constant JOINT_ISSUER_TYPEHASH = keccak256(
+        "JointAgreementIssuerAttestation(address party1,address party2,address issuer,bytes32 schemaId,bytes32 credentialType,bytes32 credentialHash,bytes32 agreementCommitment,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev SC-2 (audit 2026-06-09): the issuer attestation digest binds the SUBJECT (and schema /
+    ///      credential type / chain / this contract) — not just `credentialHash`. Previously the issuer
+    ///      signed only the credentialHash, so anyone who learned that public hash could anchor it on
+    ///      chain against a DIFFERENT subject. Recomputed on-chain; the TS side derives the same constant.
+    bytes32 internal constant ASSOCIATION_ATTESTATION_TYPEHASH = keccak256(
+        "AssociationAttestation(address subject,address issuer,bytes32 schemaId,bytes32 credentialType,bytes32 credentialHash,uint256 chainId,address verifyingContract)"
     );
 
     // ─── Storage ────────────────────────────────────────────────────────
@@ -138,8 +169,22 @@ contract AttestationRegistry {
     function assertAssociation(AssociationAttestationRequest calldata req) external returns (bytes32) {
         if (req.credentialHash == bytes32(0)) revert EmptyCredentialHash();
 
-        // AR-02: verify issuer signature over credentialHash
-        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+        // SC-2: RECOMPUTE the issuer-attestation digest binding the SUBJECT (+ schema / type / chain /
+        // this contract) and verify the issuer signed THAT. A known credentialHash can no longer be
+        // anchored against an attacker-chosen subject.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                ASSOCIATION_ATTESTATION_TYPEHASH,
+                req.subject,
+                req.issuer,
+                req.schemaId,
+                req.credentialType,
+                req.credentialHash,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(req.issuer, issuerDigest, req.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
@@ -192,13 +237,40 @@ contract AttestationRegistry {
         if (req.party1 == address(0) || req.party2 == address(0)) revert InvalidParties();
         if (req.party1 == req.party2) revert InvalidParties();
 
-        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+        // ATT-1 (audit 2026-06-10): the issuer signs a FULL typed digest binding the parties, schema,
+        // credential type/hash, the agreement commitment (refUID), chain, and this registry — not a bare
+        // `credentialHash`. A leaked/observed issuer signature can no longer be replayed to anchor an
+        // issuer-backed joint attestation for different parties/schema/chain.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                JOINT_ISSUER_TYPEHASH,
+                req.party1,
+                req.party2,
+                req.issuer,
+                req.schemaId,
+                req.credentialType,
+                req.credentialHash,
+                req.refUID,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(req.issuer, issuerDigest, req.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
         // VERIFY bilateral consent: recompute the digest, require both parties' signatures over it.
+        // ATT-3: chainId + address(this) bound (anti cross-chain / redeployed-registry replay).
         bytes32 consentDigest = keccak256(
-            abi.encode(JOINT_CONSENT_TYPEHASH, req.party1, req.party2, req.refUID, req.credentialHash)
+            abi.encode(
+                JOINT_CONSENT_TYPEHASH,
+                req.party1,
+                req.party2,
+                req.refUID,
+                req.credentialHash,
+                block.chainid,
+                address(this)
+            )
         );
         if (!_isValidSignatureBool(req.party1, consentDigest, req.party1Signature)) revert InvalidPartyConsent();
         if (!_isValidSignatureBool(req.party2, consentDigest, req.party2Signature)) revert InvalidPartyConsent();
@@ -301,20 +373,12 @@ contract AttestationRegistry {
                 return false;
             }
         }
-        // EOA fallback via eth-signed message hash + ecrecover
+        // EOA fallback via eth-signed message hash + malleability-safe ECDSA.
+        // P2-2 (audit 2026-06-10): route EOA recovery through OpenZeppelin ECDSA.tryRecover instead of
+        // raw ecrecover — it rejects high-s (malleable) signatures and malformed lengths, matching the
+        // DelegationManager idiom so every signature-verifying contract shares one low-s-safe path.
         bytes32 ethHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", digest));
-        if (signature.length != 65) return false;
-        bytes32 r;
-        bytes32 s;
-        uint8 v;
-        // solhint-disable-next-line no-inline-assembly
-        assembly {
-            r := mload(add(signature, 0x20))
-            s := mload(add(signature, 0x40))
-            v := byte(0, mload(add(signature, 0x60)))
-        }
-        if (v < 27) v += 27;
-        address recovered = ecrecover(ethHash, v, r, s);
-        return recovered != address(0) && recovered == signer;
+        (address recovered, ECDSA.RecoverError err, ) = ECDSA.tryRecover(ethHash, signature);
+        return err == ECDSA.RecoverError.NoError && recovered == signer;
     }
 }

package/src/custody/CustodyPolicy.sol

@@ -313,6 +313,9 @@ contract CustodyPolicy {
     error TrusteeDoesNotExist(address guardian);
     error InvalidMode(uint8 mode_);
     error InvalidThresholdValue(uint8 thr);
+    /// @dev CP-1: a tier that must be configured (T4/T5 at install, T6 at read)
+    ///      was left unset — refuse rather than fall to the 1-of-n read fallback.
+    error UnconfiguredTier(uint8 tier);
     error RecoveryRequiresGuardians();
     error EmptyOwnerSet();
     error CustodyActionNotYetImplemented(uint8 action);
@@ -370,11 +373,7 @@ contract CustodyPolicy {
         c.t3HighValueCeiling = t3Ceiling;
         c.approvedHashRegistry = approvedHashReg;
 
-        for (uint8 t = 1; t <= 6; t++) {
-            if (thresholds[t] > 0) c.approvalsRequiredByTier[t] = thresholds[t];
-            if (timelocks[t] > 0) c.safetyDelayByTier[t] = timelocks[t];
-        }
-
+        // Trustees first so `trusteeCount` is known for the CP-2 recovery check.
         for (uint256 i; i < trustees.length; i++) {
             address g = trustees[i];
             if (g == address(0)) revert ZeroAddress();
@@ -383,6 +382,51 @@ contract CustodyPolicy {
             c.trusteeCount += 1;
         }
 
+        // CP-2: a recovery threshold the trustee set can NEVER satisfy bricks the
+        // T6 recovery lifeline from birth. Validate at install exactly as
+        // `_applySetRecoveryThreshold` does at runtime. `recoveryApprovals == 0`
+        // is a legitimate state (trustee recovery simply disabled); a positive
+        // threshold MUST be reachable by the configured trustees.
+        if (recThr > c.trusteeCount) revert RecoveryRequiresGuardians();
+
+        // CP-1: floor each unset tier to the spec default-approvals matrix so a
+        // direct onInstall that bypasses the factory with a zeroed/partial
+        // threshold array can't collapse the admin/critical tiers to the 1-of-n
+        // read fallback in `_approvalsValue`. T1–T3 legitimately stay at the
+        // 1-of-n floor (read/write/value are single-signer tiers by design);
+        // T4/T5 get the council default. T6 (recovery) lives in
+        // `recoveryApprovals`, not this map.
+        //
+        // The custodian count is read best-effort from the installing account
+        // (the ERC-7579 flow guarantees `msg.sender` is the deployed account).
+        // If it can't be determined (the account isn't yet/at all an
+        // `IAgentAccount`), `nCustodians` stays 0 so no flooring happens — and
+        // the hard-revert below then REQUIRES the installer to have passed
+        // explicit T4/T5 thresholds. Either way the admin/critical tiers can
+        // never silently resolve to 1-of-n; the floor is a convenience, the
+        // hard-revert is the security invariant.
+        uint8 nCustodians;
+        if (account.code.length > 0) {
+            try IAgentAccount(account).custodianCount() returns (uint256 cnt) {
+                nCustodians = cnt > 255 ? 255 : uint8(cnt);
+            } catch {}
+        }
+        for (uint8 t = 1; t <= 6; t++) {
+            uint8 thr = thresholds[t];
+            if (thr == 0) thr = _defaultApprovals(nCustodians, t);
+            if (thr > 0) c.approvalsRequiredByTier[t] = thr;
+            if (timelocks[t] > 0) c.safetyDelayByTier[t] = timelocks[t];
+        }
+
+        // CP-1 hard-revert: a non-single account MUST have the admin (T4) +
+        // critical (T5) custody quorum configured (explicitly or via the floor
+        // above) — never the 1-of-n read fallback. Mode 0 (single signer) has no
+        // custody council, so thresholds are moot and this is skipped.
+        if (modeVal >= 1) {
+            if (c.approvalsRequiredByTier[4] == 0) revert UnconfiguredTier(4);
+            if (c.approvalsRequiredByTier[5] == 0) revert UnconfiguredTier(5);
+        }
+
         emit CustodyPolicyInstalled(account, modeVal, recThr);
     }
 
@@ -633,7 +677,16 @@ contract CustodyPolicy {
     function _approvalsValue(Config storage c, uint8 tier) internal view returns (uint8) {
         if (tier == 0 || tier > 6) revert InvalidTier(tier);
         uint8 v = c.approvalsRequiredByTier[tier];
-        return v == 0 ? 1 : v;
+        if (v == 0) {
+            // CP-1 defense-in-depth: the T6 (recovery) quorum lives in
+            // `recoveryApprovals`, never in this map — a T6 read here is a
+            // mis-wire, so fail closed instead of returning the 1-of-n fallback.
+            // T1–T5 keep the 1-of-n floor (T4/T5 are install-floored, so the
+            // fallback only ever applies to the low single-signer tiers).
+            if (tier == 6) revert UnconfiguredTier(6);
+            return 1;
+        }
+        return v;
     }
 
     function _safetyDelayValue(Config storage c, uint8 tier) internal view returns (uint32) {

package/src/enforcers/QuorumEnforcer.sol

@@ -82,6 +82,9 @@ contract QuorumEnforcer is ICaveatEnforcer {
     error UnauthorizedSigner(address signer);
     error DuplicateOrUnsortedSigner(address signer);
     error PayloadHashMismatch(bytes32 expected, bytes32 supplied);
+    /// @notice EN-11: a degenerate quorum caveat (threshold 0, or a threshold the
+    ///         signer set can never satisfy) must fail closed, not pass with zero sigs.
+    error InvalidThreshold(uint8 threshold, uint256 signerSetSize);
 
     /// @notice Typehash for the quorum-action binding (contract audit C-4).
     /// @dev Bound to (chainId, enforcer, delegationHash, delegator, redeemer,
@@ -135,6 +138,15 @@ contract QuorumEnforcer is ICaveatEnforcer {
             abi.decode(terms, (address[], uint8, address));
         (bytes32 suppliedPayloadHash, bytes memory signatures) = abi.decode(args, (bytes32, bytes));
 
+        // EN-11: fail closed on a degenerate quorum. threshold == 0 would skip the
+        // verification loop entirely AND make `signatures.length < 0` unreachable, so
+        // the caveat would pass with ZERO signatures. A threshold larger than the
+        // signer set is unsatisfiable; reject it up front rather than running out of
+        // slots mid-loop.
+        if (threshold == 0 || threshold > signerSet.length) {
+            revert InvalidThreshold(threshold, signerSet.length);
+        }
+
         // Contract audit C-4: bind the signed payload to the actual
         // execution context. Previously the redeemer chose payloadHash
         // freely, so a quorum signed off-chain to "approve a transfer

package/src/geo/GeoFeatureRegistry.sol

@@ -121,29 +121,36 @@ contract GeoFeatureRegistry {
         }
 
         version = prevVer + 1;
-        _records[p.featureId][version] = FeatureRecord({
-            featureId: p.featureId,
-            version: version,
-            stewardAccount: p.stewardAccount,
-            featureKind: p.featureKind,
-            geometryHash: p.geometryHash,
-            coverageRoot: p.coverageRoot,
-            sourceSetRoot: p.sourceSetRoot,
-            metadataURI: p.metadataURI,
-            centroidLat: p.centroidLat,
-            centroidLon: p.centroidLon,
-            bboxMinLat: p.bboxMinLat,
-            bboxMinLon: p.bboxMinLon,
-            bboxMaxLat: p.bboxMaxLat,
-            bboxMaxLon: p.bboxMaxLon,
-            validAfter: p.validAfter,
-            validUntil: p.validUntil,
-            active: true,
-            registeredAt: uint64(block.timestamp)
-        });
         latestVersion[p.featureId] = version;
         if (prevVer == 0) _allFeatures.push(p.featureId);
+        // The heavy record write + event live in a helper so `publish`'s own stack stays shallow.
+        _storeAndEmit(p, version);
+    }
 
+    /// @dev Writes the record FIELD-BY-FIELD to storage (no in-memory struct literal) and emits.
+    ///      Behaviour is identical to the prior `_records[...] = FeatureRecord({...})` literal; the
+    ///      split exists only to keep `publish` within solc's stack under `forge coverage --ir-minimum`
+    ///      instrumentation (the 18-field memory literal + a dynamic `string` overflowed it by one slot).
+    function _storeAndEmit(PublishInput calldata p, uint64 version) internal {
+        FeatureRecord storage r = _records[p.featureId][version];
+        r.featureId = p.featureId;
+        r.version = version;
+        r.stewardAccount = p.stewardAccount;
+        r.featureKind = p.featureKind;
+        r.geometryHash = p.geometryHash;
+        r.coverageRoot = p.coverageRoot;
+        r.sourceSetRoot = p.sourceSetRoot;
+        r.metadataURI = p.metadataURI;
+        r.centroidLat = p.centroidLat;
+        r.centroidLon = p.centroidLon;
+        r.bboxMinLat = p.bboxMinLat;
+        r.bboxMinLon = p.bboxMinLon;
+        r.bboxMaxLat = p.bboxMaxLat;
+        r.bboxMaxLon = p.bboxMaxLon;
+        r.validAfter = p.validAfter;
+        r.validUntil = p.validUntil;
+        r.active = true;
+        r.registeredAt = uint64(block.timestamp);
         emit FeaturePublished(p.featureId, version, p.stewardAccount, p.featureKind, p.geometryHash, p.coverageRoot, p.sourceSetRoot, p.metadataURI);
     }
 

package/src/governance/AgenticGovernance.sol

@@ -42,15 +42,21 @@ contract AgenticGovernance is IGovernanceView {
     ///         construction; rotate by redeploying.
     address public immutable timelock;
 
-    /// @notice Fast-path emergency-pauser role. Can pause without delay
-    ///         but CANNOT unpause (unpause requires the timelock).
-    address public immutable guardian;
-
     // ─── State ────────────────────────────────────────────────────
 
     bool private _paused;
     mapping(address => bool) private _signers;
 
+    /// @notice Fast-path emergency-pauser role. Can pause without delay but
+    ///         CANNOT unpause (unpause requires the timelock). GOV-1: this is a
+    ///         STORAGE var (not immutable) so the timelock can ROTATE it — a
+    ///         guardian whose key is compromised and grief-pauses the system can
+    ///         be replaced WITHOUT a full governance redeploy, bounding the
+    ///         re-pause DoS to one timelock window instead of "permanent". Set
+    ///         (`setGuardian`) only by the timelock. Declared after the existing
+    ///         storage vars so their slot assignments don't shift.
+    address public guardian;
+
     // ─── Errors ───────────────────────────────────────────────────
 
     error NotTimelock(address caller);
@@ -64,6 +70,8 @@ contract AgenticGovernance is IGovernanceView {
     event Unpaused(address indexed by);
     event SignerSet(address indexed who, bool isSigner);
     event Executed(address indexed target, uint256 value, bytes data);
+    /// @notice GOV-1 — the guardian (fast-pause) role was rotated by the timelock.
+    event GuardianRotated(address indexed oldGuardian, address indexed newGuardian);
 
     // ─── Constructor ──────────────────────────────────────────────
 
@@ -134,6 +142,20 @@ contract AgenticGovernance is IGovernanceView {
         emit SignerSet(who, sig);
     }
 
+    /// @notice GOV-1 — rotate the guardian (fast-pause) role. Timelock-only, so a
+    ///         compromised guardian that is perpetually re-pausing the system can
+    ///         be replaced after one timelock window WITHOUT a governance redeploy.
+    ///         To retire the fast-pause capability entirely, rotate to a burn
+    ///         address. Cannot be the zero address (would make `pause()` an
+    ///         accidental no-op while looking live).
+    function setGuardian(address newGuardian) external {
+        if (msg.sender != timelock) revert NotTimelock(msg.sender);
+        if (newGuardian == address(0)) revert ZeroAddress();
+        address old = guardian;
+        guardian = newGuardian;
+        emit GuardianRotated(old, newGuardian);
+    }
+
     // ─── Receive ETH ──────────────────────────────────────────────
 
     receive() external payable {}

package/src/libraries/SignatureSlotRecovery.sol

@@ -173,9 +173,14 @@ library SignatureSlotRecovery {
                 abi.decode(dyn, (uint256, uint256, bytes32, WebAuthnLib.Assertion));
             address derived = address(uint160(uint256(keccak256(abi.encode(pubX, pubY)))));
             if (derived != signer) revert PasskeyPubKeyMismatch(signer, derived);
-            // requireUv=false at the slot level; account policy can layer UV
-            // requirement via a future policy module.
-            if (!WebAuthnLib.verify(assertion, payloadHash, pubX, pubY, rpIdHash, false)) {
+            // WA-2: require UV at the slot level. This path verifies custody-COUNCIL
+            // passkey signatures (CustodyPolicy quorum: trustees/custodians authorizing
+            // a recovery or admin change) — the highest-assurance signatures in the
+            // system. Consistent with the native ERC-1271 path (AgentAccount, R8.2):
+            // a UP-only assertion is rejected; browser ceremonies for custody signers
+            // MUST use `userVerification: 'required'`. A lower-assurance flow that needs
+            // UP-only must install a separate validator module that relaxes this.
+            if (!WebAuthnLib.verify(assertion, payloadHash, pubX, pubY, rpIdHash, true)) {
                 revert PasskeySigInvalid(signer);
             }
         } else if (v == 27 || v == 28) {

package/src/libraries/WebAuthnLib.sol

@@ -36,6 +36,13 @@ import "./P256Verifier.sol";
  *   PasskeyValidator (for external 1271-style verification).
  */
 library WebAuthnLib {
+    /// @dev secp256r1 (P-256) curve order n ÷ 2 — the low-s malleability bound (WA-1).
+    ///      RIP-7212 accepts BOTH (r, s) and (r, n−s) for the same message, so without
+    ///      this bound a second valid signature always exists. Any path that treats a
+    ///      signature as unique (quorum slot recovery, dedup) would be malleable.
+    uint256 internal constant P256_N_DIV_2 =
+        0x7fffffff800000007fffffffffffffffde737d56d38bcf4279dce5617e3192a8;
+
     /// @notice A WebAuthn-wrapped P-256 signature bundle.
     struct Assertion {
         bytes   authenticatorData;
@@ -74,6 +81,12 @@ library WebAuthnLib {
         if (!_checkClientData(assertion.clientDataJSON, assertion.typeIndex, assertion.challengeIndex, expectedChallengeHash)) {
             return false;
         }
+        // WA-1: enforce low-s. RIP-7212 verifies both (r, s) and (r, n−s); rejecting
+        // the high-s half makes the assertion signature canonical, closing P-256
+        // malleability for every caller (native ERC-1271 + custody-quorum slot recovery).
+        if (assertion.s > P256_N_DIV_2) {
+            return false;
+        }
         bytes32 cdjHash = sha256(bytes(assertion.clientDataJSON));
         bytes32 signingHash = sha256(abi.encodePacked(assertion.authenticatorData, cdjHash));
         return P256Verifier.verify(signingHash, assertion.r, assertion.s, pubX, pubY);

package/src/naming/AgentNameRegistry.sol

@@ -77,6 +77,12 @@ contract AgentNameRegistry is GovernanceManaged {
     error NameExpired();
     error RootAlreadyInitialized();
     error EmptyLabel();
+    /// @notice AN-1-ONCHAIN (audit 2026-06-10) — the label is not in canonical form. The off-chain
+    ///         SDK `normalizeLabel` (NFC + lowercase + `[a-z0-9-]`, 1..63, no leading/trailing `-`) was
+    ///         bypassable by any DIRECT contract caller, allowing homoglyph / mixed-case / zero-width /
+    ///         embedded-dot squatting of names. The charset is now enforced ON CHAIN; because a valid
+    ///         label is already lowercase ASCII, raw-byte hashing equals hashing the normalized label.
+    error InvalidLabel();
     error ZeroOwner();
     /// @notice H7-C.4 / CON-NAMING-001 — `initializeRoot` may only be called
     ///         by the immutable `initializer` set at construction. Closes the
@@ -160,6 +166,25 @@ contract AgentNameRegistry is GovernanceManaged {
         return keccak256(abi.encodePacked(bytes32(0), keccak256(bytes("agent"))));
     }
 
+    /// @notice AN-1-ONCHAIN — enforce the canonical single-label charset on chain. Mirrors the SDK
+    ///         `normalizeLabel`: a single label of 1..63 bytes drawn from `[a-z0-9-]`, with no leading
+    ///         or trailing `-`. Reverts `EmptyLabel` / `InvalidLabel`. Reusable from `register` +
+    ///         `initializeRoot` so NO write path can anchor a non-canonical (squattable) label.
+    function _validateLabel(bytes memory b) internal pure {
+        uint256 len = b.length;
+        if (len == 0) revert EmptyLabel();
+        if (len > 63) revert InvalidLabel();
+        // no leading / trailing hyphen (0x2d)
+        if (b[0] == 0x2d || b[len - 1] == 0x2d) revert InvalidLabel();
+        for (uint256 i = 0; i < len; i++) {
+            uint8 c = uint8(b[i]);
+            bool ok = (c >= 0x61 && c <= 0x7a) // a-z
+                || (c >= 0x30 && c <= 0x39) // 0-9
+                || c == 0x2d; // -
+            if (!ok) revert InvalidLabel();
+        }
+    }
+
     // ─── Root Initialization (multi-root) ───────────────────────────
 
     /**
@@ -179,7 +204,7 @@ contract AgentNameRegistry is GovernanceManaged {
         // TLD. The deploy script bundles deploy+init in one transaction so no
         // frontrun window exists.
         if (msg.sender != initializer) revert NotInitializer(msg.sender, initializer);
-        if (bytes(label).length == 0) revert EmptyLabel();
+        _validateLabel(bytes(label)); // AN-1-ONCHAIN: canonical charset on chain
         if (rootOwner == address(0)) revert ZeroOwner();
         rootNode = namehashRoot(label);
         if (_records[rootNode].registeredAt != 0) revert RootAlreadyInitialized();
@@ -229,7 +254,7 @@ contract AgentNameRegistry is GovernanceManaged {
         address resolverContract,
         uint64 expiry
     ) external whenNotPaused returns (bytes32 childNode) {
-        if (bytes(label).length == 0) revert EmptyLabel();
+        _validateLabel(bytes(label)); // AN-1-ONCHAIN: canonical charset on chain
         if (newOwner == address(0)) revert ZeroOwner();
         _requireParentAuth(parentNode);
         _requireNotExpired(parentNode);