@agenticprimitives/contracts 1.0.0-alpha.6 → 1.0.0-alpha.8

package/dist/abi/SmartAgentPaymaster.json

@@ -30,6 +30,19 @@
     ],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "DEPOSIT_WITHDRAWAL_TIMELOCK",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "uint64",
+        "internalType": "uint64"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "acceptOwnership",
@@ -50,6 +63,13 @@
     "outputs": [],
     "stateMutability": "payable"
   },
+  {
+    "type": "function",
+    "name": "cancelDepositWithdrawal",
+    "inputs": [],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "deposit",
@@ -83,6 +103,13 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "executeDepositWithdrawal",
+    "inputs": [],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "getDeposit",
@@ -217,6 +244,19 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "paused",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "pendingOwner",
@@ -230,6 +270,29 @@
     ],
     "stateMutability": "view"
   },
+  {
+    "type": "function",
+    "name": "pendingWithdrawal",
+    "inputs": [],
+    "outputs": [
+      {
+        "name": "to",
+        "type": "address",
+        "internalType": "address"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "internalType": "uint256"
+      },
+      {
+        "name": "eta",
+        "type": "uint64",
+        "internalType": "uint64"
+      }
+    ],
+    "stateMutability": "view"
+  },
   {
     "type": "function",
     "name": "postOp",
@@ -265,6 +328,24 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "scheduleDepositWithdrawal",
+    "inputs": [
+      {
+        "name": "to",
+        "type": "address",
+        "internalType": "address payable"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "internalType": "uint256"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "setAccepted",
@@ -314,6 +395,19 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "setPauseMirror",
+    "inputs": [
+      {
+        "name": "paused_",
+        "type": "bool",
+        "internalType": "bool"
+      }
+    ],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "setVerifyingSigner",
@@ -327,6 +421,13 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "function",
+    "name": "syncPauseFromGovernance",
+    "inputs": [],
+    "outputs": [],
+    "stateMutability": "nonpayable"
+  },
   {
     "type": "function",
     "name": "transferOwnership",
@@ -472,6 +573,69 @@
     "outputs": [],
     "stateMutability": "nonpayable"
   },
+  {
+    "type": "event",
+    "name": "DepositWithdrawalCancelled",
+    "inputs": [
+      {
+        "name": "to",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "event",
+    "name": "DepositWithdrawalExecuted",
+    "inputs": [
+      {
+        "name": "to",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      }
+    ],
+    "anonymous": false
+  },
+  {
+    "type": "event",
+    "name": "DepositWithdrawalScheduled",
+    "inputs": [
+      {
+        "name": "to",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      },
+      {
+        "name": "amount",
+        "type": "uint256",
+        "indexed": false,
+        "internalType": "uint256"
+      },
+      {
+        "name": "eta",
+        "type": "uint64",
+        "indexed": false,
+        "internalType": "uint64"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "DevModeSet",
@@ -523,6 +687,25 @@
     ],
     "anonymous": false
   },
+  {
+    "type": "event",
+    "name": "PauseMirrorSynced",
+    "inputs": [
+      {
+        "name": "paused",
+        "type": "bool",
+        "indexed": false,
+        "internalType": "bool"
+      },
+      {
+        "name": "by",
+        "type": "address",
+        "indexed": true,
+        "internalType": "address"
+      }
+    ],
+    "anonymous": false
+  },
   {
     "type": "event",
     "name": "SenderAcceptedSet",
@@ -582,6 +765,11 @@
     "name": "MustOverride",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "NoPendingWithdrawal",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "NotFromEntryPoint",
@@ -656,6 +844,27 @@
     "name": "SystemPaused",
     "inputs": []
   },
+  {
+    "type": "error",
+    "name": "WithdrawalAmountZero",
+    "inputs": []
+  },
+  {
+    "type": "error",
+    "name": "WithdrawalNotReady",
+    "inputs": [
+      {
+        "name": "eta",
+        "type": "uint64",
+        "internalType": "uint64"
+      }
+    ]
+  },
+  {
+    "type": "error",
+    "name": "WithdrawalToZero",
+    "inputs": []
+  },
   {
     "type": "error",
     "name": "ZeroGovernance",

package/dist/abi/index.d.ts

@@ -40,10 +40,14 @@ export declare const IERC7579Module: Abi;
 export declare const IERC7579ModuleLifecycle: Abi;
 export declare const IERC7579ModuleLike: Abi;
 export declare const IGovernanceView: Abi;
+export declare const IPaymentReceiptRegistry: Abi;
+export declare const MockUSDC: Abi;
 export declare const MultiSendCallOnly: Abi;
 export declare const MultiSendCallOnlyHarness: Abi;
 export declare const OntologyTermRegistry: Abi;
 export declare const P256Verifier: Abi;
+export declare const PaymentEnforcer: Abi;
+export declare const PaymentReceiptRegistry: Abi;
 export declare const PermissionlessSubregistry: Abi;
 export declare const QuorumEnforcer: Abi;
 export declare const RelationshipTypeRegistry: Abi;

package/dist/abi/index.js

@@ -40,10 +40,14 @@ export { default as IERC7579Module } from './IERC7579Module.json' with { type: '
 export { default as IERC7579ModuleLifecycle } from './IERC7579ModuleLifecycle.json' with { type: 'json' };
 export { default as IERC7579ModuleLike } from './IERC7579ModuleLike.json' with { type: 'json' };
 export { default as IGovernanceView } from './IGovernanceView.json' with { type: 'json' };
+export { default as IPaymentReceiptRegistry } from './IPaymentReceiptRegistry.json' with { type: 'json' };
+export { default as MockUSDC } from './MockUSDC.json' with { type: 'json' };
 export { default as MultiSendCallOnly } from './MultiSendCallOnly.json' with { type: 'json' };
 export { default as MultiSendCallOnlyHarness } from './MultiSendCallOnlyHarness.json' with { type: 'json' };
 export { default as OntologyTermRegistry } from './OntologyTermRegistry.json' with { type: 'json' };
 export { default as P256Verifier } from './P256Verifier.json' with { type: 'json' };
+export { default as PaymentEnforcer } from './PaymentEnforcer.json' with { type: 'json' };
+export { default as PaymentReceiptRegistry } from './PaymentReceiptRegistry.json' with { type: 'json' };
 export { default as PermissionlessSubregistry } from './PermissionlessSubregistry.json' with { type: 'json' };
 export { default as QuorumEnforcer } from './QuorumEnforcer.json' with { type: 'json' };
 export { default as RelationshipTypeRegistry } from './RelationshipTypeRegistry.json' with { type: 'json' };

package/dist/deployments/base-sepolia.d.ts

@@ -31,6 +31,9 @@ export interface Deployments {
   readonly "timestampEnforcer": Address;
   readonly "universalSignatureValidator": Address;
   readonly "valueEnforcer": Address;
+  readonly "paymentEnforcer": Address;
+  readonly "paymentReceiptRegistry": Address;
+  readonly "mockUsdc": Address;
   readonly "chainId": number;
 }
 export declare const CONTRACTS: Deployments;

package/dist/deployments/base-sepolia.js

@@ -1,35 +1,38 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 // Source: deployments-base-sepolia.json
 export const CONTRACTS = {
-  "agentAccountFactory": "0x6f7Fc9B36977F55666548e0a73D9063F0D88A760",
-  "agentAccountImplementation": "0x11f1523D9883BdF382993d70C601D307ED0F1f13",
-  "agentNameRegistry": "0x6e660e41CFd0B410827fb96D21c26600AF6abF2f",
-  "agentNameResolver": "0x324F5A60c5DE45244c70a43cA3A6B1462d80fF5f",
-  "agentNameUniversalResolver": "0x40587e3591F7051ba7534177aB1F0B366034040e",
-  "agentProfileResolver": "0x748D005E8B3b366132F209F066821B2713A6e19e",
-  "agentRelationship": "0x5c3bf13822a37c84Dc617C920dB61a8217f6311d",
-  "agreementRegistry": "0x3B1DB6AC972b649E9E0960F0816F4D1EC3264c22",
-  "allowedMethodsEnforcer": "0x1500601201aA339249e2B78c42952Cf26CD12Ea7",
-  "allowedTargetsEnforcer": "0xfA1c40F9dC4ACC4d339D2eDE0003872154292CEa",
-  "approvedHashRegistry": "0xE01c1356F4B10FEfa8Ab210020B802cf3e900759",
-  "attestationRegistry": "0x16EB207C65A63E3ae256F49a4B11e785fE001139",
-  "callDataHashEnforcer": "0x7267eF129fCf341717D7f3469DDf7A0135d00b61",
+  "agentAccountFactory": "0x3E68B72B45e7C9d35B210E4Ab06e5Cece85cEbE4",
+  "agentAccountImplementation": "0x338318ABf9C8b28E7e77ed96a91857cCE1Db1328",
+  "agentNameRegistry": "0x15F7ed064A230C011b0244A14fD9653f011d609B",
+  "agentNameResolver": "0xcC9855A23C7a4D4592E68Fe47E195C2f9D832473",
+  "agentNameUniversalResolver": "0x7d777d2d0bbc1806B9Cc779121C27fbaAaFDb60b",
+  "agentProfileResolver": "0xc448EB159B2a35F07f6E1814CC8d125244d7384B",
+  "agentRelationship": "0xE6B8F6C7F1c9857013dA356DF08D0384334A9607",
+  "agreementRegistry": "0x7f4d6A74eda1D6ce251D371566f1c6639F9B0DDa",
+  "allowedMethodsEnforcer": "0xf77cf06aCd8b9e2f3204fe4bE16449B3594c9633",
+  "allowedTargetsEnforcer": "0xe3909FdEfD8b74B7D006E045DCd678e97D469Bfd",
+  "approvedHashRegistry": "0x90735B5281434D1746926E2AA722Cc6DbF3EFEe6",
+  "attestationRegistry": "0xaE3861fd299c74D96F6FCA25f19c7ACf8b9020ed",
+  "callDataHashEnforcer": "0x9F12932F1b85A1F96c1Cb1c5A0645e3F0Ab478Dd",
   "chainId": 84532,
-  "custodyPolicy": "0x5e3e3Bda33c799f2403a30aE35bf81deff236283",
-  "delegationManager": "0xBC5AE6213E91E076232a6c8e3942746f06A50154",
+  "custodyPolicy": "0xDeD6542A55476745846370562d1c75D15DDf2572",
+  "delegationManager": "0x3a8E2cE74564f699b135db6f266ccDb563979C05",
   "deployer": "0x31ed17fb99e82E02085Ab4B3cbdaB05489098b44",
-  "entryPoint": "0x7707C2b483CcADc3E72C2d39d216aC1C337FCd9d",
-  "geoFeatureRegistry": "0x0A9f10cb72D6Fb5C89Aa5865f397957729cF71F0",
-  "ontologyTermRegistry": "0xa9635EbfDb993395df6CD03b0DEE21E5b2A66Ec1",
-  "permissionlessSubregistry": "0xF38fdcd8eC83360C2F73CEEa52ae419D37aCaB5F",
-  "permissionlessSubregistryDemoAgent": "0x1c698cBFE2733301614a245a505E20eB5597a972",
-  "quorumEnforcer": "0xeB88df4492FB8Eb254f6017eD0463d42CF6FC8e7",
-  "relationshipTypeRegistry": "0x7c5FfD0aB55C52f6aa00c04D2a30457579A3083B",
-  "shapeRegistry": "0xAe431c6F000235d30ae28f507493215815eF88E2",
-  "skillDefinitionRegistry": "0xc0A26f8bac0482E0F8e3a61762F5862Bc21a2D11",
-  "smartAgentPaymaster": "0x0e54A8Cc986C86530f0593817E8CafE01FC52983",
-  "timestampEnforcer": "0xf9AeF60b8cb4939bF5B1AF48E777dad99Ef1084f",
-  "universalSignatureValidator": "0x7A282fFf06E6DC73613A31F55345535e24CB6832",
-  "valueEnforcer": "0x4be1B537b9583E69D9baBf8af1dc5371A4a750C5"
+  "entryPoint": "0x9B33De9d9597de82Eb56b5B26C478Dc0a6955388",
+  "geoFeatureRegistry": "0x78FdCae0aC9B0CD9943996282b8F39D77bec5b1c",
+  "ontologyTermRegistry": "0xf486Ba6e9FD2d687e68a1a7A77D0FA27bb1E66c3",
+  "permissionlessSubregistry": "0x1B8ED8693738e1A9DD653FEE5430d49e00202Bb7",
+  "permissionlessSubregistryDemoAgent": "0xc76b1cdB4340398f59fD9C5d6Cb65fCdC606B33b",
+  "quorumEnforcer": "0x76fb494aE991d1fe1603a91384BA4c1F890442a8",
+  "relationshipTypeRegistry": "0x526fBF5900b18B1D06201493bcE470b416FB71C3",
+  "shapeRegistry": "0x03AbD67A910abB2c5026f1973A05502e0473e316",
+  "skillDefinitionRegistry": "0x5ae94aba46D7daA1Ca9eaE0051043Ad05bcc392B",
+  "smartAgentPaymaster": "0x8eF92B9D62826052D8F7e6dcaB630dC3890bF540",
+  "timestampEnforcer": "0x7c452434314A5bf2048f9263aeCd0cC20Fa07965",
+  "universalSignatureValidator": "0xe8F3e531429F44D77dC3A331C18032bfa1550D84",
+  "valueEnforcer": "0x7c4533e0A9fB0B1cb5aa70327b222a80d72d52db",
+  "paymentEnforcer": "0xAF48273e11435cC2D56f4AFBfD091Abb162458E9",
+  "paymentReceiptRegistry": "0x366616E265cd3cDE0F042A592C17838fe210D1d4",
+  "mockUsdc": "0x8fb56ff3C13347DFC4E1287aE83E88deE5a7211C"
 };
 export default CONTRACTS;

package/dist/deployments/index.d.ts

@@ -3,6 +3,7 @@ import type { Address } from 'viem';
 import type { Deployments } from './base-sepolia';
 export type { Deployments };
 export declare const BASE_SEPOLIA: Deployments;
+export declare const REGISTRIES_BASE_SEPOLIA: Deployments;
 
-export type Network = 'base-sepolia';
+export type Network = 'base-sepolia' | 'registries-base-sepolia';
 export declare function getDeployments(network: Network): Deployments;

package/dist/deployments/index.js

@@ -1,9 +1,12 @@
 // Generated by scripts/build-deployments.mjs — do not edit by hand.
 import { CONTRACTS as BASE_SEPOLIA } from './base-sepolia.js';
 export { BASE_SEPOLIA };
+import { CONTRACTS as REGISTRIES_BASE_SEPOLIA } from './registries-base-sepolia.js';
+export { REGISTRIES_BASE_SEPOLIA };
 
 const TABLE = {
   "base-sepolia": BASE_SEPOLIA,
+  "registries-base-sepolia": REGISTRIES_BASE_SEPOLIA,
 };
 
 export function getDeployments(network) {

package/dist/deployments/registries-base-sepolia.d.ts

@@ -0,0 +1,9 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-registries-base-sepolia.json
+import type { Address } from 'viem';
+export interface Deployments {
+  readonly "agreementRegistry": Address;
+  readonly "attestationRegistry": Address;
+}
+export declare const CONTRACTS: Deployments;
+export default CONTRACTS;

package/dist/deployments/registries-base-sepolia.js

@@ -0,0 +1,7 @@
+// Generated by scripts/build-deployments.mjs — do not edit by hand.
+// Source: deployments-registries-base-sepolia.json
+export const CONTRACTS = {
+  "agreementRegistry": "0x9f2A085f0bd2d8Afb69490C0C98D88592093906A",
+  "attestationRegistry": "0x4a156CAaE69E894E3C5e6F3064fE028F138b6847"
+};
+export default CONTRACTS;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/contracts",
-  "version": "1.0.0-alpha.6",
+  "version": "1.0.0-alpha.8",
   "description": "Solidity contracts + ABIs + flattened sources + per-network deployment addresses for the agenticprimitives stack.",
   "license": "MIT",
   "repository": {
@@ -59,6 +59,9 @@
     "deploy:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/Deploy.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY",
     "deploy:paymaster:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/DeployPaymaster.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY --sig 'run()'",
     "deploy:paymaster:anvil": "DEPLOY_NETWORK=anvil forge script script/DeployPaymaster.s.sol --rpc-url http://127.0.0.1:8545 --broadcast --private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80 --sig 'run()'",
+    "deploy:registries:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/DeployRegistries.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY --sig 'run()'",
+    "deploy:payments:base-sepolia": "DEPLOY_NETWORK=base-sepolia forge script script/DeployPayments.s.sol --rpc-url $BASE_SEPOLIA_RPC --broadcast --private-key $PRIVATE_KEY --sig 'run()'",
+    "deploy:registries:merge": "node scripts/merge-registry-deploy.mjs",
     "verify:base-sepolia": "bash scripts/verify-base-sepolia.sh",
     "clean": "rm -rf out cache broadcast dist"
   }

package/src/AgentAccount.sol

@@ -143,9 +143,21 @@ contract AgentAccount is
     }
 
     /// @dev Spec 007 Phase A.5 — current pending upgrade (set by
-    ///      `upgradeToWithAuthorization` when `_upgradeTimelock > 0`).
+    ///      `scheduleUpgrade` when `_upgradeTimelock > 0`).
     PendingUpgrade private _pendingUpgrade;
 
+    /// @dev CA-1 — transient "the current call stack is an authorized upgrade
+    ///      context" flag. Set while (a) a module action executes
+    ///      (custody-governed, e.g. `CustodyPolicy.ApplySystemUpdate`, which
+    ///      carries its own T5 quorum + timelock) or (b) a matured owner-queued
+    ///      upgrade fires (`executePendingUpgrade`). `_authorizeUpgrade` reads it
+    ///      so that, once an account configures `_upgradeTimelock`, a DIRECT owner
+    ///      `upgradeToAndCall` is refused (must `scheduleUpgrade` then
+    ///      `executePendingUpgrade`), while the custody path keeps working with no
+    ///      double delay. Transient ⇒ tx-global (visible in the nested
+    ///      `_authorizeUpgrade` frame) AND absent from the storage layout.
+    bool private transient _upgradeAuthorizedCtx;
+
     /// @dev Spec 007 Phase A.5 — maximum permitted upgrade timelock to
     ///      protect against an owner accidentally setting an absurdly
     ///      large delay that bricks future migrations.
@@ -198,6 +210,13 @@ contract AgentAccount is
     error UpgradeNotReady(uint64 readyAt, uint256 nowTs);
     error PendingUpgradeMismatch(address pending, address attempted);
     error UpgradePending();
+    /// @notice CA-1 — a direct `upgradeToAndCall` was attempted while a per-account
+    ///         upgrade timelock is set; route through `scheduleUpgrade` +
+    ///         `executePendingUpgrade` (or the custody module path) instead.
+    error DirectUpgradeBlocked();
+    /// @notice CA-1 — `scheduleUpgrade` called with no upgrade timelock configured
+    ///         (nothing to queue against — upgrade directly).
+    error UpgradeTimelockNotSet();
 
     // Wave 2A — on-chain authority closure (contract audit C-1..C-3).
     error ValidatorRequired();
@@ -412,7 +431,20 @@ contract AgentAccount is
      *      will revert here. Master / bundler / session-issuer
      *      therefore cannot upgrade even by submitting the tx.
      */
-    function _authorizeUpgrade(address) internal view override onlySelf {}
+    function _authorizeUpgrade(address) internal view override onlySelf {
+        // CA-1: the per-account upgrade timelock is now ENFORCED here (it was
+        // previously dead code — set via `setUpgradeTimelock` but never consulted,
+        // so a direct `upgradeToAndCall` fired immediately). When a timelock is
+        // configured, a direct owner upgrade is refused; the owner must
+        // `scheduleUpgrade` then `executePendingUpgrade` after the delay. Authorized
+        // contexts — a custody-module action (its own T5 quorum + timelock) or the
+        // matured owner queue — set `_upgradeAuthorizedCtx` and pass through, so the
+        // custody path is not double-delayed. A zero timelock keeps the
+        // immediate-upgrade default (backward-compatible).
+        if (_upgradeTimelock != 0 && !_upgradeAuthorizedCtx) {
+            revert DirectUpgradeBlocked();
+        }
+    }
 
     /**
      * @notice DEPRECATED — single-signature upgrade path (contract audit C-3).
@@ -439,6 +471,21 @@ contract AgentAccount is
         revert LegacyUpgradePathDisabled();
     }
 
+    /// @notice CA-1 — queue an implementation upgrade subject to the per-account
+    ///         upgrade timelock. The owner signs a userOp that calls this
+    ///         (`onlySelf`); the bound implementation can then be applied via
+    ///         `executePendingUpgrade` once `_upgradeTimelock` has elapsed. Only
+    ///         meaningful when a timelock is configured — with none set, upgrade
+    ///         directly. Overwrites any existing pending upgrade.
+    function scheduleUpgrade(address newImplementation) external onlySelf {
+        if (newImplementation == address(0)) revert ZeroAddress();
+        uint256 tl = _upgradeTimelock;
+        if (tl == 0) revert UpgradeTimelockNotSet();
+        uint64 readyAt = uint64(block.timestamp + tl);
+        _pendingUpgrade = PendingUpgrade({newImplementation: newImplementation, readyAt: readyAt});
+        emit UpgradeProposed(newImplementation, readyAt);
+    }
+
     /// @notice Execute a previously-queued upgrade. Permissionless once
     ///         the timelock has expired — anyone can pay the gas, but
     ///         the implementation address was bound at queue time.
@@ -450,7 +497,12 @@ contract AgentAccount is
         // impl can't replay this state.
         delete _pendingUpgrade;
         emit UpgradeAuthorized(p.newImplementation);
+        // CA-1: authorize the nested `_authorizeUpgrade` for this matured queue
+        // (transient, tx-global). Cleared after so a later same-tx direct upgrade
+        // isn't inadvertently authorized.
+        _upgradeAuthorizedCtx = true;
         this.upgradeToAndCall(p.newImplementation, "");
+        _upgradeAuthorizedCtx = false;
     }
 
     /// @notice Cancel a queued upgrade during the timelock window. Owner
@@ -926,7 +978,14 @@ contract AgentAccount is
             revert NotInstalledExecutor(msg.sender);
         }
         emit ModuleExecuted(msg.sender, target, value);
+        // CA-1: a module action is a custody-governed context (only an installed
+        // EXECUTOR — the CustodyPolicy — reaches here, gated upstream by its own
+        // T5 quorum + timelock). Authorize any upgrade it dispatches so the custody
+        // path is exempt from the per-account `_upgradeTimelock` (no double delay).
+        // Transient + nonReentrant, cleared after the call.
+        _upgradeAuthorizedCtx = true;
         (bool ok, bytes memory ret) = target.call{value: value}(data);
+        _upgradeAuthorizedCtx = false;
         if (!ok) {
             assembly { revert(add(ret, 32), mload(ret)) }
         }

package/src/AgentAccountFactory.sol

@@ -156,10 +156,13 @@ contract AgentAccountFactory is GovernanceManaged {
         // timelock (see AgenticGovernance).
         _validateInitParams(params);
 
-        address addr = _getAddressForAgentAccount(params, salt);
+        // CA-F1 (audit 2026-06-10): derive the deploy salt from the FULL custody config so the
+        // counterfactual address commits to mode/trustees/timelocks too — not just custodians/passkey.
+        bytes32 deploySalt = _effectiveSalt(params, timelockOverrides, salt);
+        address addr = _getAddressFromSalt(params, deploySalt);
         if (addr.code.length > 0) return AgentAccount(payable(addr));
 
-        ERC1967Proxy proxy = new ERC1967Proxy{salt: bytes32(salt)}(
+        ERC1967Proxy proxy = new ERC1967Proxy{salt: deploySalt}(
             address(accountImplementation),
             _initData(params)
         );
@@ -181,12 +184,16 @@ contract AgentAccountFactory is GovernanceManaged {
     }
 
     /// @notice Counterfactual address for `createAgentAccount`.
+    /// @dev CA-F1: takes `timelockOverrides` because the address now commits to it. Callers MUST
+    ///      predict with the SAME (params, timelockOverrides, salt) they will deploy with, else the
+    ///      predicted address won't match the deployed one.
     function getAddressForAgentAccount(
         AgentAccountInitParams calldata params,
+        uint32[7] calldata timelockOverrides,
         uint256 salt
     ) external view returns (address) {
         _validateInitParams(params);
-        return _getAddressForAgentAccount(params, salt);
+        return _getAddressFromSalt(params, _effectiveSalt(params, timelockOverrides, salt));
     }
 
     // ─── Internals ──────────────────────────────────────────────────────
@@ -209,22 +216,40 @@ contract AgentAccountFactory is GovernanceManaged {
         );
     }
 
-    function _getAddressForAgentAccount(
+    /// @dev CA-F1 (audit 2026-06-10) — the deploy salt commits to the FULL custody configuration:
+    ///      mode, trustees, and per-tier timelock overrides. `_initData` already folds custodians +
+    ///      the initial passkey into the proxy bytecode hash (and thus the address); those, plus the
+    ///      mode/trustees/timelocks bound here, mean the canonical address IS its complete custody
+    ///      config. Two `createAgentAccount` calls that differ in ANY of these resolve to DIFFERENT
+    ///      addresses, so an attacker can no longer front-run a victim's counterfactual address with a
+    ///      weaker mode, attacker-controlled recovery trustees, or shortened timelocks. The
+    ///      occupied-address branch is consequently reachable only by an identical-config request —
+    ///      which also closes CA-F2 (silent adoption of a mismatched pre-existing account) by
+    ///      construction, with no separate config-equality assertion needed.
+    function _effectiveSalt(
         AgentAccountInitParams calldata params,
+        uint32[7] calldata timelockOverrides,
         uint256 salt
+    ) internal pure returns (bytes32) {
+        return keccak256(abi.encode(salt, params.mode, params.trustees, timelockOverrides));
+    }
+
+    function _getAddressFromSalt(
+        AgentAccountInitParams calldata params,
+        bytes32 deploySalt
     ) internal view returns (address) {
         bytes memory initData = _initData(params);
-        return _create2Address(initData, salt);
+        return _create2Address(initData, deploySalt);
     }
 
-    function _create2Address(bytes memory initData, uint256 salt) internal view returns (address) {
+    function _create2Address(bytes memory initData, bytes32 salt) internal view returns (address) {
         bytes memory proxyBytecode = abi.encodePacked(
             type(ERC1967Proxy).creationCode,
             abi.encode(address(accountImplementation), initData)
         );
         bytes32 bytecodeHash = keccak256(proxyBytecode);
         return address(uint160(uint256(keccak256(
-            abi.encodePacked(bytes1(0xff), address(this), bytes32(salt), bytecodeHash)
+            abi.encodePacked(bytes1(0xff), address(this), salt, bytecodeHash)
         ))));
     }