@agenticprimitives/contracts 1.0.0-alpha.6 → 1.0.0-alpha.7

package/dist/deployments/base-sepolia.js

@@ -1,35 +1,35 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 // Source: deployments-base-sepolia.json
 export const CONTRACTS = {
-  "agentAccountFactory": "0x6f7Fc9B36977F55666548e0a73D9063F0D88A760",
-  "agentAccountImplementation": "0x11f1523D9883BdF382993d70C601D307ED0F1f13",
-  "agentNameRegistry": "0x6e660e41CFd0B410827fb96D21c26600AF6abF2f",
-  "agentNameResolver": "0x324F5A60c5DE45244c70a43cA3A6B1462d80fF5f",
-  "agentNameUniversalResolver": "0x40587e3591F7051ba7534177aB1F0B366034040e",
-  "agentProfileResolver": "0x748D005E8B3b366132F209F066821B2713A6e19e",
-  "agentRelationship": "0x5c3bf13822a37c84Dc617C920dB61a8217f6311d",
-  "agreementRegistry": "0x3B1DB6AC972b649E9E0960F0816F4D1EC3264c22",
-  "allowedMethodsEnforcer": "0x1500601201aA339249e2B78c42952Cf26CD12Ea7",
-  "allowedTargetsEnforcer": "0xfA1c40F9dC4ACC4d339D2eDE0003872154292CEa",
-  "approvedHashRegistry": "0xE01c1356F4B10FEfa8Ab210020B802cf3e900759",
-  "attestationRegistry": "0x16EB207C65A63E3ae256F49a4B11e785fE001139",
-  "callDataHashEnforcer": "0x7267eF129fCf341717D7f3469DDf7A0135d00b61",
+  "agentAccountFactory": "0x3E68B72B45e7C9d35B210E4Ab06e5Cece85cEbE4",
+  "agentAccountImplementation": "0x338318ABf9C8b28E7e77ed96a91857cCE1Db1328",
+  "agentNameRegistry": "0x15F7ed064A230C011b0244A14fD9653f011d609B",
+  "agentNameResolver": "0xcC9855A23C7a4D4592E68Fe47E195C2f9D832473",
+  "agentNameUniversalResolver": "0x7d777d2d0bbc1806B9Cc779121C27fbaAaFDb60b",
+  "agentProfileResolver": "0xc448EB159B2a35F07f6E1814CC8d125244d7384B",
+  "agentRelationship": "0xE6B8F6C7F1c9857013dA356DF08D0384334A9607",
+  "agreementRegistry": "0x7f4d6A74eda1D6ce251D371566f1c6639F9B0DDa",
+  "allowedMethodsEnforcer": "0xf77cf06aCd8b9e2f3204fe4bE16449B3594c9633",
+  "allowedTargetsEnforcer": "0xe3909FdEfD8b74B7D006E045DCd678e97D469Bfd",
+  "approvedHashRegistry": "0x90735B5281434D1746926E2AA722Cc6DbF3EFEe6",
+  "attestationRegistry": "0xaE3861fd299c74D96F6FCA25f19c7ACf8b9020ed",
+  "callDataHashEnforcer": "0x9F12932F1b85A1F96c1Cb1c5A0645e3F0Ab478Dd",
   "chainId": 84532,
-  "custodyPolicy": "0x5e3e3Bda33c799f2403a30aE35bf81deff236283",
-  "delegationManager": "0xBC5AE6213E91E076232a6c8e3942746f06A50154",
+  "custodyPolicy": "0xDeD6542A55476745846370562d1c75D15DDf2572",
+  "delegationManager": "0x3a8E2cE74564f699b135db6f266ccDb563979C05",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x7707C2b483CcADc3E72C2d39d216aC1C337FCd9d",
-  "geoFeatureRegistry": "0x0A9f10cb72D6Fb5C89Aa5865f397957729cF71F0",
-  "ontologyTermRegistry": "0xa9635EbfDb993395df6CD03b0DEE21E5b2A66Ec1",
-  "permissionlessSubregistry": "0xF38fdcd8eC83360C2F73CEEa52ae419D37aCaB5F",
-  "permissionlessSubregistryDemoAgent": "0x1c698cBFE2733301614a245a505E20eB5597a972",
-  "quorumEnforcer": "0xeB88df4492FB8Eb254f6017eD0463d42CF6FC8e7",
-  "relationshipTypeRegistry": "0x7c5FfD0aB55C52f6aa00c04D2a30457579A3083B",
-  "shapeRegistry": "0xAe431c6F000235d30ae28f507493215815eF88E2",
-  "skillDefinitionRegistry": "0xc0A26f8bac0482E0F8e3a61762F5862Bc21a2D11",
-  "smartAgentPaymaster": "0x0e54A8Cc986C86530f0593817E8CafE01FC52983",
-  "timestampEnforcer": "0xf9AeF60b8cb4939bF5B1AF48E777dad99Ef1084f",
-  "universalSignatureValidator": "0x7A282fFf06E6DC73613A31F55345535e24CB6832",
-  "valueEnforcer": "0x4be1B537b9583E69D9baBf8af1dc5371A4a750C5"
+  "entryPoint": "0x9B33De9d9597de82Eb56b5B26C478Dc0a6955388",
+  "geoFeatureRegistry": "0x78FdCae0aC9B0CD9943996282b8F39D77bec5b1c",
+  "ontologyTermRegistry": "0xf486Ba6e9FD2d687e68a1a7A77D0FA27bb1E66c3",
+  "permissionlessSubregistry": "0x1B8ED8693738e1A9DD653FEE5430d49e00202Bb7",
+  "permissionlessSubregistryDemoAgent": "0xc76b1cdB4340398f59fD9C5d6Cb65fCdC606B33b",
+  "quorumEnforcer": "0x76fb494aE991d1fe1603a91384BA4c1F890442a8",
+  "relationshipTypeRegistry": "0x526fBF5900b18B1D06201493bcE470b416FB71C3",
+  "shapeRegistry": "0x03AbD67A910abB2c5026f1973A05502e0473e316",
+  "skillDefinitionRegistry": "0x5ae94aba46D7daA1Ca9eaE0051043Ad05bcc392B",
+  "smartAgentPaymaster": "0x8eF92B9D62826052D8F7e6dcaB630dC3890bF540",
+  "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
+  "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
+  "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db"
 };
 export default CONTRACTS;

package/dist/deployments/index.d.ts

@@ -3,6 +3,7 @@ import type { Address } from 'viem';
 import type { Deployments } from './base-sepolia';
 export type { Deployments };
 export declare const BASE_SEPOLIA: Deployments;
+export declare const REGISTRIES_BASE_SEPOLIA: Deployments;
 
-export type Network = 'base-sepolia';
+export type Network = 'base-sepolia' | 'registries-base-sepolia';
 export declare function getDeployments(network: Network): Deployments;

package/dist/deployments/index.js

@@ -1,9 +1,12 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 import { CONTRACTS as BASE_SEPOLIA } from './base-sepolia.js';
 export { BASE_SEPOLIA };
+import { CONTRACTS as REGISTRIES_BASE_SEPOLIA } from './registries-base-sepolia.js';
+export { REGISTRIES_BASE_SEPOLIA };
 
 const TABLE = {
   "base-sepolia": BASE_SEPOLIA,
+  "registries-base-sepolia": REGISTRIES_BASE_SEPOLIA,
 };
 
 export function getDeployments(network) {

package/dist/deployments/registries-base-sepolia.d.ts

@@ -0,0 +1,9 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-registries-base-sepolia.json
+import type { Address } from 'viem';
+export interface Deployments {
+  readonly "agreementRegistry": Address;
+  readonly "attestationRegistry": Address;
+}
+export declare const CONTRACTS: Deployments;
+export default CONTRACTS;

package/dist/deployments/registries-base-sepolia.js

@@ -0,0 +1,7 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-registries-base-sepolia.json
+export const CONTRACTS = {
+  "agreementRegistry": "0x9f2A085f0bd2d8Afb69490C0C98D88592093906A",
+  "attestationRegistry": "0x4a156CAaE69E894E3C5e6F3064fE028F138b6847"
+};
+export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.7",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {
@@ -59,6 +59,8 @@
     "deploy:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/Deploy.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY",
     "deploy:paymaster:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/DeployPaymaster.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY --sig 'run()'",
     "deploy:paymaster:anvil": "DEPLOY_NETWORK=anvil forge script script/DeployPaymaster.s.sol --rpc-url http://127.0.0.1:8545 --broadcast --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 --sig 'run()'",
+    "deploy:registries:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/DeployRegistries.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY --sig 'run()'",
+    "deploy:registries:merge": "node scripts/merge-registry-deploy.mjs",
     "verify:base-sepolia": "bash scripts/verify-base-sepolia.sh",
     "clean": "rm -rf out cache broadcast dist"
   }

package/src/AgentAccount.sol

@@ -143,9 +143,21 @@ contract AgentAccount is
     }
 
     /// @dev Spec 007 Phase A.5 — current pending upgrade (set by
-    ///      `upgradeToWithAuthorization` when `_upgradeTimelock > 0`).
+    ///      `scheduleUpgrade` when `_upgradeTimelock > 0`).
     PendingUpgrade private _pendingUpgrade;
 
+    /// @dev CA-1 — transient "the current call stack is an authorized upgrade
+    ///      context" flag. Set while (a) a module action executes
+    ///      (custody-governed, e.g. `CustodyPolicy.ApplySystemUpdate`, which
+    ///      carries its own T5 quorum + timelock) or (b) a matured owner-queued
+    ///      upgrade fires (`executePendingUpgrade`). `_authorizeUpgrade` reads it
+    ///      so that, once an account configures `_upgradeTimelock`, a DIRECT owner
+    ///      `upgradeToAndCall` is refused (must `scheduleUpgrade` then
+    ///      `executePendingUpgrade`), while the custody path keeps working with no
+    ///      double delay. Transient ⇒ tx-global (visible in the nested
+    ///      `_authorizeUpgrade` frame) AND absent from the storage layout.
+    bool private transient _upgradeAuthorizedCtx;
+
     /// @dev Spec 007 Phase A.5 — maximum permitted upgrade timelock to
     ///      protect against an owner accidentally setting an absurdly
     ///      large delay that bricks future migrations.
@@ -198,6 +210,13 @@ contract AgentAccount is
     error UpgradeNotReady(uint64 readyAt, uint256 nowTs);
     error PendingUpgradeMismatch(address pending, address attempted);
     error UpgradePending();
+    /// @notice CA-1 — a direct `upgradeToAndCall` was attempted while a per-account
+    ///         upgrade timelock is set; route through `scheduleUpgrade` +
+    ///         `executePendingUpgrade` (or the custody module path) instead.
+    error DirectUpgradeBlocked();
+    /// @notice CA-1 — `scheduleUpgrade` called with no upgrade timelock configured
+    ///         (nothing to queue against — upgrade directly).
+    error UpgradeTimelockNotSet();
 
     // Wave 2A — on-chain authority closure (contract audit C-1..C-3).
     error ValidatorRequired();
@@ -412,7 +431,20 @@ contract AgentAccount is
      *      will revert here. Master / bundler / session-issuer
      *      therefore cannot upgrade even by submitting the tx.
      */
-    function _authorizeUpgrade(address) internal view override onlySelf {}
+    function _authorizeUpgrade(address) internal view override onlySelf {
+        // CA-1: the per-account upgrade timelock is now ENFORCED here (it was
+        // previously dead code — set via `setUpgradeTimelock` but never consulted,
+        // so a direct `upgradeToAndCall` fired immediately). When a timelock is
+        // configured, a direct owner upgrade is refused; the owner must
+        // `scheduleUpgrade` then `executePendingUpgrade` after the delay. Authorized
+        // contexts — a custody-module action (its own T5 quorum + timelock) or the
+        // matured owner queue — set `_upgradeAuthorizedCtx` and pass through, so the
+        // custody path is not double-delayed. A zero timelock keeps the
+        // immediate-upgrade default (backward-compatible).
+        if (_upgradeTimelock != 0 && !_upgradeAuthorizedCtx) {
+            revert DirectUpgradeBlocked();
+        }
+    }
 
     /**
      * @notice DEPRECATED — single-signature upgrade path (contract audit C-3).
@@ -439,6 +471,21 @@ contract AgentAccount is
         revert LegacyUpgradePathDisabled();
     }
 
+    /// @notice CA-1 — queue an implementation upgrade subject to the per-account
+    ///         upgrade timelock. The owner signs a userOp that calls this
+    ///         (`onlySelf`); the bound implementation can then be applied via
+    ///         `executePendingUpgrade` once `_upgradeTimelock` has elapsed. Only
+    ///         meaningful when a timelock is configured — with none set, upgrade
+    ///         directly. Overwrites any existing pending upgrade.
+    function scheduleUpgrade(address newImplementation) external onlySelf {
+        if (newImplementation == address(0)) revert ZeroAddress();
+        uint256 tl = _upgradeTimelock;
+        if (tl == 0) revert UpgradeTimelockNotSet();
+        uint64 readyAt = uint64(block.timestamp + tl);
+        _pendingUpgrade = PendingUpgrade({newImplementation: newImplementation, readyAt: readyAt});
+        emit UpgradeProposed(newImplementation, readyAt);
+    }
+
     /// @notice Execute a previously-queued upgrade. Permissionless once
     ///         the timelock has expired — anyone can pay the gas, but
     ///         the implementation address was bound at queue time.
@@ -450,7 +497,12 @@ contract AgentAccount is
         // impl can't replay this state.
         delete _pendingUpgrade;
         emit UpgradeAuthorized(p.newImplementation);
+        // CA-1: authorize the nested `_authorizeUpgrade` for this matured queue
+        // (transient, tx-global). Cleared after so a later same-tx direct upgrade
+        // isn't inadvertently authorized.
+        _upgradeAuthorizedCtx = true;
         this.upgradeToAndCall(p.newImplementation, "");
+        _upgradeAuthorizedCtx = false;
     }
 
     /// @notice Cancel a queued upgrade during the timelock window. Owner
@@ -926,7 +978,14 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
+        // CA-1: a module action is a custody-governed context (only an installed
+        // EXECUTOR — the CustodyPolicy — reaches here, gated upstream by its own
+        // T5 quorum + timelock). Authorize any upgrade it dispatches so the custody
+        // path is exempt from the per-account `_upgradeTimelock` (no double delay).
+        // Transient + nonReentrant, cleared after the call.
+        _upgradeAuthorizedCtx = true;
         (bool ok, bytes memory ret) = target.call{value: value}(data);
+        _upgradeAuthorizedCtx = false;
         if (!ok) {
             assembly { revert(add(ret, 32), mload(ret)) }
         }

package/src/AgentAccountFactory.sol

@@ -156,10 +156,13 @@ contract AgentAccountFactory is GovernanceManaged {
         // timelock (see AgenticGovernance).
         _validateInitParams(params);
 
-        address addr = _getAddressForAgentAccount(params, salt);
+        // CA-F1 (audit 2026-06-10): derive the deploy salt from the FULL custody config so the
+        // counterfactual address commits to mode/trustees/timelocks too — not just custodians/passkey.
+        bytes32 deploySalt = _effectiveSalt(params, timelockOverrides, salt);
+        address addr = _getAddressFromSalt(params, deploySalt);
         if (addr.code.length > 0) return AgentAccount(payable(addr));
 
-        ERC1967Proxy proxy = new ERC1967Proxy{salt: bytes32(salt)}(
+        ERC1967Proxy proxy = new ERC1967Proxy{salt: deploySalt}(
             address(accountImplementation),
             _initData(params)
         );
@@ -181,12 +184,16 @@ contract AgentAccountFactory is GovernanceManaged {
     }
 
     /// @notice Counterfactual address for `createAgentAccount`.
+    /// @dev CA-F1: takes `timelockOverrides` because the address now commits to it. Callers MUST
+    ///      predict with the SAME (params, timelockOverrides, salt) they will deploy with, else the
+    ///      predicted address won't match the deployed one.
     function getAddressForAgentAccount(
         AgentAccountInitParams calldata params,
+        uint32[7] calldata timelockOverrides,
         uint256 salt
     ) external view returns (address) {
         _validateInitParams(params);
-        return _getAddressForAgentAccount(params, salt);
+        return _getAddressFromSalt(params, _effectiveSalt(params, timelockOverrides, salt));
     }
 
     // ─── Internals ──────────────────────────────────────────────────────
@@ -209,22 +216,40 @@ contract AgentAccountFactory is GovernanceManaged {
         );
     }
 
-    function _getAddressForAgentAccount(
+    /// @dev CA-F1 (audit 2026-06-10) — the deploy salt commits to the FULL custody configuration:
+    ///      mode, trustees, and per-tier timelock overrides. `_initData` already folds custodians +
+    ///      the initial passkey into the proxy bytecode hash (and thus the address); those, plus the
+    ///      mode/trustees/timelocks bound here, mean the canonical address IS its complete custody
+    ///      config. Two `createAgentAccount` calls that differ in ANY of these resolve to DIFFERENT
+    ///      addresses, so an attacker can no longer front-run a victim's counterfactual address with a
+    ///      weaker mode, attacker-controlled recovery trustees, or shortened timelocks. The
+    ///      occupied-address branch is consequently reachable only by an identical-config request —
+    ///      which also closes CA-F2 (silent adoption of a mismatched pre-existing account) by
+    ///      construction, with no separate config-equality assertion needed.
+    function _effectiveSalt(
         AgentAccountInitParams calldata params,
+        uint32[7] calldata timelockOverrides,
         uint256 salt
+    ) internal pure returns (bytes32) {
+        return keccak256(abi.encode(salt, params.mode, params.trustees, timelockOverrides));
+    }
+
+    function _getAddressFromSalt(
+        AgentAccountInitParams calldata params,
+        bytes32 deploySalt
     ) internal view returns (address) {
         bytes memory initData = _initData(params);
-        return _create2Address(initData, salt);
+        return _create2Address(initData, deploySalt);
     }
 
-    function _create2Address(bytes memory initData, uint256 salt) internal view returns (address) {
+    function _create2Address(bytes memory initData, bytes32 salt) internal view returns (address) {
         bytes memory proxyBytecode = abi.encodePacked(
             type(ERC1967Proxy).creationCode,
             abi.encode(address(accountImplementation), initData)
         );
         bytes32 bytecodeHash = keccak256(proxyBytecode);
         return address(uint160(uint256(keccak256(
-            abi.encodePacked(bytes1(0xff), address(this), bytes32(salt), bytecodeHash)
+            abi.encodePacked(bytes1(0xff), address(this), salt, bytecodeHash)
         ))));
     }
 

package/src/SmartAgentPaymaster.sol

@@ -71,6 +71,20 @@ import "./governance/IGovernance.sol";
  *          `SenderNotAccepted` until governance explicitly opts a sender
  *          in. That is the documented safe state.
  *   2. Monitor `getDeposit()` and alert below a runway threshold.
+ *   3. PM-2 — hand the Ownable owner to the governance TimelockController via
+ *      `Ownable2Step` (`transferOwnership(governance)` then a timelocked
+ *      `acceptOwnership`) once deploy-time staking/funding is done. The owner
+ *      controls the INHERITED instant `withdrawTo`/stake drains; in production
+ *      it MUST be the timelock, not the bootstrap deployer EOA. The
+ *      governance-native, TIMELOCKED `scheduleDepositWithdrawal` /
+ *      `executeDepositWithdrawal` path below is the sanctioned drain that stays
+ *      coupled to governance + delayed regardless of the owner handoff state.
+ *      The deployer-owned window is bootstrap-only (tracked under the
+ *      governance-key custody item).
+ *   4. PM-1 — after governance pauses, call `syncPauseFromGovernance()` (or
+ *      `setPauseMirror(true)` from governance) so the validation-time mirror
+ *      halts sponsorship. Validation never reads governance storage directly
+ *      (ERC-7562), so the mirror must be pushed/synced.
  *
  * @dev Inherits `addStake`, `unlockStake`, `withdrawStake`, `deposit`,
  *      and `withdrawTo` from `BasePaymaster`. Ownable owner is set in
@@ -95,19 +109,62 @@ contract SmartAgentPaymaster is BasePaymaster {
     ///         validation. Stored immutable.
     address public immutable governance;
 
+    /// @notice PM-1 — local mirror of the governance pause flag. This is the
+    ///         ONLY pause signal read during ERC-4337 validation. Reading the
+    ///         external governance contract's storage inside
+    ///         `_validatePaymasterUserOp` violates the ERC-7562 validation-scope
+    ///         rules (a paymaster may touch only its own / associated storage),
+    ///         so reputable bundlers (Pimlico/Stackup/Alchemy) drop the sponsored
+    ///         op during simulation. We read this own-storage mirror instead;
+    ///         `syncPauseFromGovernance()` — a normal call OUTSIDE validation —
+    ///         refreshes it from the canonical governance flag. The mirror is a
+    ///         validation-time cache of governance's pause bit, never a second
+    ///         independent source (ADR-0013: cache-of-canonical, no fallback).
+    bool private _pausedMirror;
+
+    /// @notice PM-2 — a scheduled, governance-authorized EntryPoint-deposit
+    ///         withdrawal. The inherited owner `withdrawTo` is an INSTANT drain
+    ///         gated only by the Ownable owner; this path couples a withdrawal to
+    ///         governance (`onlyGovernance`) AND a fixed timelock, so the
+    ///         sponsorship treasury cannot be emptied in a single transaction.
+    struct PendingWithdrawal {
+        address payable to;
+        uint64 eta;
+        uint256 amount;
+    }
+    PendingWithdrawal private _pendingWithdrawal;
+
+    /// @notice PM-2 — delay between scheduling and executing a governance
+    ///         deposit withdrawal. Gives the guardian a window to pause if a
+    ///         withdrawal is unexpected (incident response).
+    uint64 public constant DEPOSIT_WITHDRAWAL_TIMELOCK = 48 hours;
+
     error SenderNotAccepted(address sender);
     error SystemPaused();
     error ZeroGovernance();
     error NotGovernance();
     error PaymasterDataMalformed();
     error PaymasterSignatureInvalid();
+    /// @dev PM-2 withdrawal-lifecycle errors.
+    error NoPendingWithdrawal();
+    error WithdrawalNotReady(uint64 eta);
+    error WithdrawalAmountZero();
+    error WithdrawalToZero();
 
     event DevModeSet(bool dev);
     event SenderAcceptedSet(address indexed sender, bool accepted);
     event VerifyingSignerSet(address indexed oldSigner, address indexed newSigner);
+    /// @notice PM-1 — emitted whenever the local pause mirror is updated.
+    event PauseMirrorSynced(bool paused, address indexed by);
+    /// @notice PM-2 — deposit-withdrawal lifecycle.
+    event DepositWithdrawalScheduled(address indexed to, uint256 amount, uint64 eta);
+    event DepositWithdrawalExecuted(address indexed to, uint256 amount);
+    event DepositWithdrawalCancelled(address indexed to, uint256 amount);
 
     /// @dev Storage gap reserves slots for future state. Phase A.5 §3.1.
-    uint256[49] private __gap;
+    ///      PM-1/PM-2 consumed 3 slots (`_pausedMirror` packs into 1;
+    ///      `PendingWithdrawal` is 2) — gap reduced 49 → 46 to preserve layout.
+    uint256[46] private __gap;
 
     /// @dev Length of the paymaster-data tail when in verifying mode:
     ///      6 (validUntil) + 6 (validAfter) + 65 (sig) = 77 bytes.
@@ -173,6 +230,90 @@ contract SmartAgentPaymaster is BasePaymaster {
         emit VerifyingSignerSet(old, newSigner);
     }
 
+    // ─── PM-1: pause mirror (own-storage, ERC-7562-compliant) ──────────
+
+    /// @notice PM-1 — refresh the local pause mirror from the canonical
+    ///         governance flag. Permissionless ON PURPOSE: validation may not
+    ///         read governance storage, so the mirror must be refreshable by
+    ///         anyone (a keeper, a bundler, the guardian's incident response)
+    ///         the moment governance pauses. This call is a NORMAL transaction
+    ///         (not paymaster validation), so the ERC-7562 scope rules don't
+    ///         apply to its cross-contract read. The mirror only ever holds the
+    ///         canonical governance value — no independent pause source.
+    function syncPauseFromGovernance() external {
+        bool p = _governanceIsPaused();
+        _pausedMirror = p;
+        emit PauseMirrorSynced(p, msg.sender);
+    }
+
+    /// @notice PM-1 — direct governance push of the pause mirror, for when
+    ///         governance wants to halt sponsorship without depending on a
+    ///         third party to sync. `onlyGovernance` ⇒ inherits the 24h
+    ///         timelock (or guardian-driven governance flow).
+    function setPauseMirror(bool paused_) external onlyGovernance {
+        _pausedMirror = paused_;
+        emit PauseMirrorSynced(paused_, msg.sender);
+    }
+
+    /// @notice The pause bit read during validation (the local mirror).
+    function paused() external view returns (bool) {
+        return _pausedMirror;
+    }
+
+    /// @dev Read the canonical governance pause flag. Used ONLY by the
+    ///      out-of-band sync path, never during validation. Mirrors the prior
+    ///      defensive decode: a non-conforming governance (EOA / missing fn)
+    ///      reads as "not paused" so legacy / test deploys keep working.
+    function _governanceIsPaused() internal view returns (bool) {
+        if (governance.code.length == 0) return false;
+        (bool ok, bytes memory data) = governance.staticcall(
+            abi.encodeWithSelector(IGovernanceView.isPaused.selector)
+        );
+        return ok && data.length >= 32 && abi.decode(data, (bool));
+    }
+
+    // ─── PM-2: governance-timelocked deposit withdrawal ────────────────
+
+    /// @notice PM-2 — schedule a governance-authorized withdrawal of the
+    ///         EntryPoint deposit. Coupled to governance AND delayed by
+    ///         `DEPOSIT_WITHDRAWAL_TIMELOCK`, unlike the inherited owner
+    ///         `withdrawTo` (instant, owner-only). Overwrites any prior pending
+    ///         withdrawal (governance is the single scheduler).
+    function scheduleDepositWithdrawal(address payable to, uint256 amount) external onlyGovernance {
+        if (to == address(0)) revert WithdrawalToZero();
+        if (amount == 0) revert WithdrawalAmountZero();
+        uint64 eta = uint64(block.timestamp) + DEPOSIT_WITHDRAWAL_TIMELOCK;
+        _pendingWithdrawal = PendingWithdrawal({to: to, eta: eta, amount: amount});
+        emit DepositWithdrawalScheduled(to, amount, eta);
+    }
+
+    /// @notice PM-2 — execute a previously-scheduled withdrawal once its
+    ///         timelock has elapsed. `onlyGovernance` so the same authority
+    ///         that scheduled it confirms; the delay gives the guardian time to
+    ///         pause if the withdrawal is unexpected.
+    function executeDepositWithdrawal() external onlyGovernance {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        if (w.eta == 0) revert NoPendingWithdrawal();
+        if (block.timestamp < w.eta) revert WithdrawalNotReady(w.eta);
+        delete _pendingWithdrawal;
+        entryPoint().withdrawTo(w.to, w.amount);
+        emit DepositWithdrawalExecuted(w.to, w.amount);
+    }
+
+    /// @notice PM-2 — cancel a pending withdrawal (governance de-escalation).
+    function cancelDepositWithdrawal() external onlyGovernance {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        if (w.eta == 0) revert NoPendingWithdrawal();
+        delete _pendingWithdrawal;
+        emit DepositWithdrawalCancelled(w.to, w.amount);
+    }
+
+    /// @notice PM-2 — view the pending withdrawal (zero `eta` ⇒ none).
+    function pendingWithdrawal() external view returns (address to, uint256 amount, uint64 eta) {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        return (w.to, w.amount, w.eta);
+    }
+
     // ─── Views ──────────────────────────────────────────────────────────
 
     function devMode() external view returns (bool) {
@@ -229,17 +370,13 @@ contract SmartAgentPaymaster is BasePaymaster {
         bytes32 /*userOpHash*/,
         uint256 /*maxCost*/
     ) internal view override returns (bytes memory context, uint256 validationData) {
-        // H7-C.10 / EXT3-010: gated behind system-wide governance pause.
-        // Skipped when `governance` is an EOA or non-conforming contract
-        // (legacy / test deploys); production deploys MUST pass an
-        // AgenticGovernance address, which the production-deploy preflight
-        // (`check:production-deploy`) enforces.
-        if (governance.code.length > 0) {
-            (bool ok, bytes memory data) = governance.staticcall(
-                abi.encodeWithSelector(IGovernanceView.isPaused.selector)
-            );
-            if (ok && data.length >= 32 && abi.decode(data, (bool))) revert SystemPaused();
-        }
+        // PM-1 / H7-C.10 / EXT3-010: gated behind the system-wide governance
+        // pause — but read from the LOCAL mirror (`_pausedMirror`), never the
+        // external governance contract's storage. A cross-contract staticcall
+        // here violates the ERC-7562 validation-scope rules and gets the op
+        // dropped by bundlers. The mirror is refreshed out-of-band via
+        // `syncPauseFromGovernance()` (a normal call) or `setPauseMirror()`.
+        if (_pausedMirror) revert SystemPaused();
 
         if (_dev) {
             // Dev mode: accept all. validationData = 0 → "valid sig,

package/src/agency/DelegationManager.sol

@@ -251,6 +251,13 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ///         the chain is well-formed (signatures, authority chain, not
     ///         revoked) WITHOUT executing it.
     ///
+    /// @dev ⚠️ DANGER — CHAIN-ONLY, NOT A CALL AUTHORIZATION (audit 2026-06-10). This validates ONLY
+    ///      the chain (signatures / authority / revocation). It does NOT evaluate caveats, so a `true`
+    ///      result is NOT permission to perform any specific (target, value, calldata). Anything
+    ///      authorizing a concrete action MUST use {verifyAuthorizationForCall} (evaluates every caveat,
+    ///      fail-closed) or live {redeemDelegation}. Treating this boolean as call authorization
+    ///      re-opens the exact over-trust the caveats exist to prevent.
+    ///
     /// Spec 242 §6 (PD-9): the `attestations` package uses this to verify
     /// bilateral-consent delegations as signed authorization predicates,
     /// rather than redeeming them as cross-account execution. Returning
@@ -288,8 +295,12 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ///         stateful enforcer attempting a write under staticcall) yields `false` — so `true`
     ///         is a genuine authorization guarantee for this exact call, and `false` means "use
     ///         live redemption" (which evaluates stateful caveats properly). The caveat
-    ///         evaluation mirrors `_runBeforeHooks` exactly (same args, same `sender`-as-redeemer),
-    ///         so an unknown/no-code enforcer is a no-op here just as it is in redemption. Pure
+    ///         evaluation mirrors `_runBeforeHooks` exactly (same args, same `sender`-as-redeemer).
+    ///         SC-3 (audit 2026-06-09): a no-code enforcer is rejected here with `false`. A raw
+    ///         `staticcall` to an empty address SUCCEEDS, which would otherwise make a delegation
+    ///         whose caveat enforcer is a typo / undeployed pass as "constraint-checked" — fail-OPEN.
+    ///         Live redemption fails CLOSED on the same case (solc's extcodesize check on the
+    ///         high-level void-returning hook call reverts), so this restores symmetry. Pure
     ///         addition — `redeemDelegation` is untouched.
     /// @param delegations Chain (leaf first; root authority last)
     /// @param sender The address that would be the redeemer
@@ -312,6 +323,10 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
             Delegation calldata d = delegations[i];
             bytes32 dHash = hashDelegation(d);
             for (uint256 j = 0; j < d.caveats.length; j++) {
+                // SC-3: a no-code enforcer constrains NOTHING — a raw staticcall to an empty address
+                // returns success, which would fail-open. Reject explicitly so `true` is a genuine
+                // guarantee (live redemption fails closed here too via extcodesize on the high-level call).
+                if (d.caveats[j].enforcer.code.length == 0) return (false, "no-code-enforcer");
                 // staticcall the same hook redemption would call; success == satisfied read-only.
                 // Gas-bounded: a stateful enforcer (which would revert on its SSTORE under
                 // staticcall) is capped so an on-chain caller (e.g. RW1-1) sees a cheap, predictable

package/src/agency/IDelegationManager.sol

@@ -72,6 +72,9 @@ interface IDelegationManager {
     ///         Used by trust-substrate contracts (e.g. AttestationRegistry's
     ///         bilateral-consent path per spec 242 PD-9) to validate a packed
     ///         delegation as a signed authorization predicate.
+    /// @dev    ⚠️ DANGER — chain-only; does NOT evaluate caveats. `true` is NOT permission for any
+    ///         specific call. Use {verifyAuthorizationForCall} (fail-closed, evaluates caveats) or live
+    ///         redemption to authorize a concrete (target, value, calldata).
     /// @param delegations Delegation chain, leaf first
     /// @param sender The address that would be the redeemer
     /// @return ok True if the chain verifies