@agenticprimitives/contracts 1.0.0-alpha.6 → 1.0.0-alpha.8

package/src/SmartAgentPaymaster.sol

@@ -71,6 +71,20 @@ import "./governance/IGovernance.sol";
  *          `SenderNotAccepted` until governance explicitly opts a sender
  *          in. That is the documented safe state.
  *   2. Monitor `getDeposit()` and alert below a runway threshold.
+ *   3. PM-2 — hand the Ownable owner to the governance TimelockController via
+ *      `Ownable2Step` (`transferOwnership(governance)` then a timelocked
+ *      `acceptOwnership`) once deploy-time staking/funding is done. The owner
+ *      controls the INHERITED instant `withdrawTo`/stake drains; in production
+ *      it MUST be the timelock, not the bootstrap deployer EOA. The
+ *      governance-native, TIMELOCKED `scheduleDepositWithdrawal` /
+ *      `executeDepositWithdrawal` path below is the sanctioned drain that stays
+ *      coupled to governance + delayed regardless of the owner handoff state.
+ *      The deployer-owned window is bootstrap-only (tracked under the
+ *      governance-key custody item).
+ *   4. PM-1 — after governance pauses, call `syncPauseFromGovernance()` (or
+ *      `setPauseMirror(true)` from governance) so the validation-time mirror
+ *      halts sponsorship. Validation never reads governance storage directly
+ *      (ERC-7562), so the mirror must be pushed/synced.
  *
  * @dev Inherits `addStake`, `unlockStake`, `withdrawStake`, `deposit`,
  *      and `withdrawTo` from `BasePaymaster`. Ownable owner is set in
@@ -95,19 +109,62 @@ contract SmartAgentPaymaster is BasePaymaster {
     ///         validation. Stored immutable.
     address public immutable governance;
 
+    /// @notice PM-1 — local mirror of the governance pause flag. This is the
+    ///         ONLY pause signal read during ERC-4337 validation. Reading the
+    ///         external governance contract's storage inside
+    ///         `_validatePaymasterUserOp` violates the ERC-7562 validation-scope
+    ///         rules (a paymaster may touch only its own / associated storage),
+    ///         so reputable bundlers (Pimlico/Stackup/Alchemy) drop the sponsored
+    ///         op during simulation. We read this own-storage mirror instead;
+    ///         `syncPauseFromGovernance()` — a normal call OUTSIDE validation —
+    ///         refreshes it from the canonical governance flag. The mirror is a
+    ///         validation-time cache of governance's pause bit, never a second
+    ///         independent source (ADR-0013: cache-of-canonical, no fallback).
+    bool private _pausedMirror;
+
+    /// @notice PM-2 — a scheduled, governance-authorized EntryPoint-deposit
+    ///         withdrawal. The inherited owner `withdrawTo` is an INSTANT drain
+    ///         gated only by the Ownable owner; this path couples a withdrawal to
+    ///         governance (`onlyGovernance`) AND a fixed timelock, so the
+    ///         sponsorship treasury cannot be emptied in a single transaction.
+    struct PendingWithdrawal {
+        address payable to;
+        uint64 eta;
+        uint256 amount;
+    }
+    PendingWithdrawal private _pendingWithdrawal;
+
+    /// @notice PM-2 — delay between scheduling and executing a governance
+    ///         deposit withdrawal. Gives the guardian a window to pause if a
+    ///         withdrawal is unexpected (incident response).
+    uint64 public constant DEPOSIT_WITHDRAWAL_TIMELOCK = 48 hours;
+
     error SenderNotAccepted(address sender);
     error SystemPaused();
     error ZeroGovernance();
     error NotGovernance();
     error PaymasterDataMalformed();
     error PaymasterSignatureInvalid();
+    /// @dev PM-2 withdrawal-lifecycle errors.
+    error NoPendingWithdrawal();
+    error WithdrawalNotReady(uint64 eta);
+    error WithdrawalAmountZero();
+    error WithdrawalToZero();
 
     event DevModeSet(bool dev);
     event SenderAcceptedSet(address indexed sender, bool accepted);
     event VerifyingSignerSet(address indexed oldSigner, address indexed newSigner);
+    /// @notice PM-1 — emitted whenever the local pause mirror is updated.
+    event PauseMirrorSynced(bool paused, address indexed by);
+    /// @notice PM-2 — deposit-withdrawal lifecycle.
+    event DepositWithdrawalScheduled(address indexed to, uint256 amount, uint64 eta);
+    event DepositWithdrawalExecuted(address indexed to, uint256 amount);
+    event DepositWithdrawalCancelled(address indexed to, uint256 amount);
 
     /// @dev Storage gap reserves slots for future state. Phase A.5 §3.1.
-    uint256[49] private __gap;
+    ///      PM-1/PM-2 consumed 3 slots (`_pausedMirror` packs into 1;
+    ///      `PendingWithdrawal` is 2) — gap reduced 49 → 46 to preserve layout.
+    uint256[46] private __gap;
 
     /// @dev Length of the paymaster-data tail when in verifying mode:
     ///      6 (validUntil) + 6 (validAfter) + 65 (sig) = 77 bytes.
@@ -173,6 +230,90 @@ contract SmartAgentPaymaster is BasePaymaster {
         emit VerifyingSignerSet(old, newSigner);
     }
 
+    // ─── PM-1: pause mirror (own-storage, ERC-7562-compliant) ──────────
+
+    /// @notice PM-1 — refresh the local pause mirror from the canonical
+    ///         governance flag. Permissionless ON PURPOSE: validation may not
+    ///         read governance storage, so the mirror must be refreshable by
+    ///         anyone (a keeper, a bundler, the guardian's incident response)
+    ///         the moment governance pauses. This call is a NORMAL transaction
+    ///         (not paymaster validation), so the ERC-7562 scope rules don't
+    ///         apply to its cross-contract read. The mirror only ever holds the
+    ///         canonical governance value — no independent pause source.
+    function syncPauseFromGovernance() external {
+        bool p = _governanceIsPaused();
+        _pausedMirror = p;
+        emit PauseMirrorSynced(p, msg.sender);
+    }
+
+    /// @notice PM-1 — direct governance push of the pause mirror, for when
+    ///         governance wants to halt sponsorship without depending on a
+    ///         third party to sync. `onlyGovernance` ⇒ inherits the 24h
+    ///         timelock (or guardian-driven governance flow).
+    function setPauseMirror(bool paused_) external onlyGovernance {
+        _pausedMirror = paused_;
+        emit PauseMirrorSynced(paused_, msg.sender);
+    }
+
+    /// @notice The pause bit read during validation (the local mirror).
+    function paused() external view returns (bool) {
+        return _pausedMirror;
+    }
+
+    /// @dev Read the canonical governance pause flag. Used ONLY by the
+    ///      out-of-band sync path, never during validation. Mirrors the prior
+    ///      defensive decode: a non-conforming governance (EOA / missing fn)
+    ///      reads as "not paused" so legacy / test deploys keep working.
+    function _governanceIsPaused() internal view returns (bool) {
+        if (governance.code.length == 0) return false;
+        (bool ok, bytes memory data) = governance.staticcall(
+            abi.encodeWithSelector(IGovernanceView.isPaused.selector)
+        );
+        return ok && data.length >= 32 && abi.decode(data, (bool));
+    }
+
+    // ─── PM-2: governance-timelocked deposit withdrawal ────────────────
+
+    /// @notice PM-2 — schedule a governance-authorized withdrawal of the
+    ///         EntryPoint deposit. Coupled to governance AND delayed by
+    ///         `DEPOSIT_WITHDRAWAL_TIMELOCK`, unlike the inherited owner
+    ///         `withdrawTo` (instant, owner-only). Overwrites any prior pending
+    ///         withdrawal (governance is the single scheduler).
+    function scheduleDepositWithdrawal(address payable to, uint256 amount) external onlyGovernance {
+        if (to == address(0)) revert WithdrawalToZero();
+        if (amount == 0) revert WithdrawalAmountZero();
+        uint64 eta = uint64(block.timestamp) + DEPOSIT_WITHDRAWAL_TIMELOCK;
+        _pendingWithdrawal = PendingWithdrawal({to: to, eta: eta, amount: amount});
+        emit DepositWithdrawalScheduled(to, amount, eta);
+    }
+
+    /// @notice PM-2 — execute a previously-scheduled withdrawal once its
+    ///         timelock has elapsed. `onlyGovernance` so the same authority
+    ///         that scheduled it confirms; the delay gives the guardian time to
+    ///         pause if the withdrawal is unexpected.
+    function executeDepositWithdrawal() external onlyGovernance {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        if (w.eta == 0) revert NoPendingWithdrawal();
+        if (block.timestamp < w.eta) revert WithdrawalNotReady(w.eta);
+        delete _pendingWithdrawal;
+        entryPoint().withdrawTo(w.to, w.amount);
+        emit DepositWithdrawalExecuted(w.to, w.amount);
+    }
+
+    /// @notice PM-2 — cancel a pending withdrawal (governance de-escalation).
+    function cancelDepositWithdrawal() external onlyGovernance {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        if (w.eta == 0) revert NoPendingWithdrawal();
+        delete _pendingWithdrawal;
+        emit DepositWithdrawalCancelled(w.to, w.amount);
+    }
+
+    /// @notice PM-2 — view the pending withdrawal (zero `eta` ⇒ none).
+    function pendingWithdrawal() external view returns (address to, uint256 amount, uint64 eta) {
+        PendingWithdrawal memory w = _pendingWithdrawal;
+        return (w.to, w.amount, w.eta);
+    }
+
     // ─── Views ──────────────────────────────────────────────────────────
 
     function devMode() external view returns (bool) {
@@ -229,17 +370,13 @@ contract SmartAgentPaymaster is BasePaymaster {
         bytes32 /*userOpHash*/,
         uint256 /*maxCost*/
     ) internal view override returns (bytes memory context, uint256 validationData) {
-        // H7-C.10 / EXT3-010: gated behind system-wide governance pause.
-        // Skipped when `governance` is an EOA or non-conforming contract
-        // (legacy / test deploys); production deploys MUST pass an
-        // AgenticGovernance address, which the production-deploy preflight
-        // (`check:production-deploy`) enforces.
-        if (governance.code.length > 0) {
-            (bool ok, bytes memory data) = governance.staticcall(
-                abi.encodeWithSelector(IGovernanceView.isPaused.selector)
-            );
-            if (ok && data.length >= 32 && abi.decode(data, (bool))) revert SystemPaused();
-        }
+        // PM-1 / H7-C.10 / EXT3-010: gated behind the system-wide governance
+        // pause — but read from the LOCAL mirror (`_pausedMirror`), never the
+        // external governance contract's storage. A cross-contract staticcall
+        // here violates the ERC-7562 validation-scope rules and gets the op
+        // dropped by bundlers. The mirror is refreshed out-of-band via
+        // `syncPauseFromGovernance()` (a normal call) or `setPauseMirror()`.
+        if (_pausedMirror) revert SystemPaused();
 
         if (_dev) {
             // Dev mode: accept all. validationData = 0 → "valid sig,

package/src/agency/DelegationManager.sol

@@ -251,6 +251,13 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ///         the chain is well-formed (signatures, authority chain, not
     ///         revoked) WITHOUT executing it.
     ///
+    /// @dev ⚠️ DANGER — CHAIN-ONLY, NOT A CALL AUTHORIZATION (audit 2026-06-10). This validates ONLY
+    ///      the chain (signatures / authority / revocation). It does NOT evaluate caveats, so a `true`
+    ///      result is NOT permission to perform any specific (target, value, calldata). Anything
+    ///      authorizing a concrete action MUST use {verifyAuthorizationForCall} (evaluates every caveat,
+    ///      fail-closed) or live {redeemDelegation}. Treating this boolean as call authorization
+    ///      re-opens the exact over-trust the caveats exist to prevent.
+    ///
     /// Spec 242 §6 (PD-9): the `attestations` package uses this to verify
     /// bilateral-consent delegations as signed authorization predicates,
     /// rather than redeeming them as cross-account execution. Returning
@@ -288,8 +295,12 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
     ///         stateful enforcer attempting a write under staticcall) yields `false` — so `true`
     ///         is a genuine authorization guarantee for this exact call, and `false` means "use
     ///         live redemption" (which evaluates stateful caveats properly). The caveat
-    ///         evaluation mirrors `_runBeforeHooks` exactly (same args, same `sender`-as-redeemer),
-    ///         so an unknown/no-code enforcer is a no-op here just as it is in redemption. Pure
+    ///         evaluation mirrors `_runBeforeHooks` exactly (same args, same `sender`-as-redeemer).
+    ///         SC-3 (audit 2026-06-09): a no-code enforcer is rejected here with `false`. A raw
+    ///         `staticcall` to an empty address SUCCEEDS, which would otherwise make a delegation
+    ///         whose caveat enforcer is a typo / undeployed pass as "constraint-checked" — fail-OPEN.
+    ///         Live redemption fails CLOSED on the same case (solc's extcodesize check on the
+    ///         high-level void-returning hook call reverts), so this restores symmetry. Pure
     ///         addition — `redeemDelegation` is untouched.
     /// @param delegations Chain (leaf first; root authority last)
     /// @param sender The address that would be the redeemer
@@ -312,6 +323,10 @@ contract DelegationManager is IDelegationManager, ReentrancyGuard {
             Delegation calldata d = delegations[i];
             bytes32 dHash = hashDelegation(d);
             for (uint256 j = 0; j < d.caveats.length; j++) {
+                // SC-3: a no-code enforcer constrains NOTHING — a raw staticcall to an empty address
+                // returns success, which would fail-open. Reject explicitly so `true` is a genuine
+                // guarantee (live redemption fails closed here too via extcodesize on the high-level call).
+                if (d.caveats[j].enforcer.code.length == 0) return (false, "no-code-enforcer");
                 // staticcall the same hook redemption would call; success == satisfied read-only.
                 // Gas-bounded: a stateful enforcer (which would revert on its SSTORE under
                 // staticcall) is capped so an on-chain caller (e.g. RW1-1) sees a cheap, predictable

package/src/agency/IDelegationManager.sol

@@ -72,6 +72,9 @@ interface IDelegationManager {
     ///         Used by trust-substrate contracts (e.g. AttestationRegistry's
     ///         bilateral-consent path per spec 242 PD-9) to validate a packed
     ///         delegation as a signed authorization predicate.
+    /// @dev    ⚠️ DANGER — chain-only; does NOT evaluate caveats. `true` is NOT permission for any
+    ///         specific call. Use {verifyAuthorizationForCall} (fail-closed, evaluates caveats) or live
+    ///         redemption to authorize a concrete (target, value, calldata).
     /// @param delegations Delegation chain, leaf first
     /// @param sender The address that would be the redeemer
     /// @return ok True if the chain verifies

package/src/agreement/AgreementRegistry.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.28;
 
 import "@openzeppelin/contracts/interfaces/IERC1271.sol";
+import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 
 /**
  * @title AgreementRegistry
@@ -46,8 +47,20 @@ contract AgreementRegistry {
     ///      digest model; the TS side derives the same constant (cross-stack
     ///      typehash-equality gate). Plain struct hash (no domain separator),
     ///      matching the attestation registry's JOINT_CONSENT_TYPEHASH.
-    bytes32 internal constant TRANSITION_TYPEHASH =
-        keccak256("AgreementTransition(bytes32 agreementCommitment,uint8 toStatus,bytes32 nullifier)");
+    ///      AGR-1 (audit 2026-06-10): also bind chainId + this contract so a transition signature
+    ///      cannot be replayed on another chain or a redeployed registry.
+    bytes32 internal constant TRANSITION_TYPEHASH = keccak256(
+        "AgreementTransition(bytes32 agreementCommitment,uint8 toStatus,bytes32 nullifier,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev SC-1 (audit 2026-06-09): the issuer attestation digest is RECOMPUTED on-chain from the
+    ///      agreement's contents + chain + this contract — it is NOT a caller-supplied free-form hash.
+    ///      Binds (agreementCommitment, schemaHash, issuer, chainId, verifyingContract) so a signature
+    ///      lifted from any other context cannot back an attacker-chosen commitment. The TS side derives
+    ///      the same constant (cross-stack typehash-equality gate).
+    bytes32 internal constant AGREEMENT_ISSUER_TYPEHASH = keccak256(
+        "AgreementIssuerAttestation(bytes32 agreementCommitment,bytes32 schemaHash,address issuer,uint256 chainId,address verifyingContract)"
+    );
 
     // ─── Errors ─────────────────────────────────────────────────────────
 
@@ -85,9 +98,8 @@ contract AgreementRegistry {
     struct AgreementIssuancePayload {
         bytes32 schemaHash;
         address issuer;
-        /// @dev EIP-712 attestation hash by the issuer (over agreementCommitment + schemaHash).
-        bytes32 attestationStructHash;
-        /// @dev issuer's signature over `attestationStructHash`.
+        /// @dev issuer's signature over the RECOMPUTED issuer-attestation digest (SC-1). The contract
+        ///      derives the digest from the payload contents — no caller-supplied attestation hash.
         bytes issuerSignature;
         /// @dev The asserted canonical commitment hash; we verify recomputation.
         bytes32 agreementCommitment;
@@ -153,8 +165,20 @@ contract AgreementRegistry {
             revert AlreadyRegistered();
         }
 
-        // AR-02 — verify issuer signature over the attestation hash
-        if (!_isValidSignatureBool(p.issuer, p.attestationStructHash, p.issuerSignature)) {
+        // AR-02 / SC-1 — RECOMPUTE the issuer-attestation digest from the agreement contents (+ chain +
+        // this contract) and verify the issuer signed THAT. A signature over an arbitrary digest from
+        // any other context can no longer back an attacker-chosen commitment.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                AGREEMENT_ISSUER_TYPEHASH,
+                p.agreementCommitment,
+                p.schemaHash,
+                p.issuer,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(p.issuer, issuerDigest, p.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
@@ -222,7 +246,7 @@ contract AgreementRegistry {
         // caller-supplied hash. The signed payload is canonically bound to (commitment, toStatus,
         // nullifier) here, on chain.
         bytes32 transitionDigest = keccak256(
-            abi.encode(TRANSITION_TYPEHASH, p.agreementCommitment, p.toStatus, p.nullifier)
+            abi.encode(TRANSITION_TYPEHASH, p.agreementCommitment, p.toStatus, p.nullifier, block.chainid, address(this))
         );
 
         bool bilateralRequired = (p.toStatus != STATUS_DISPUTED);
@@ -253,6 +277,15 @@ contract AgreementRegistry {
     ///         that permits public joint assertion (currently any non-NONE
     ///         status; revoked agreements can still be jointly disclosed as
     ///         historical record).
+    ///
+    /// @dev    NOT a consent or validity oracle (audit 2026-06-10). A `true`
+    ///         result means only that `agreementCommitment` is REGISTERED — it is
+    ///         an opaque back-reference, NOT proof that any particular party
+    ///         consented, that the agreement is currently valid, or that a given
+    ///         credential is bound to it. Bilateral consent for a joint assertion
+    ///         is established separately by `AttestationRegistry.assertJointAgreement`,
+    ///         which recomputes both parties' consent signatures. Consumers MUST
+    ///         NOT treat the boolean here as authorization.
     function isAssertableCommitment(
         bytes32 agreementCommitment,
         address /* actor */
@@ -288,19 +321,11 @@ contract AgreementRegistry {
                 return false;
             }
         }
+        // P2-2 (audit 2026-06-10): route EOA recovery through OpenZeppelin ECDSA.tryRecover instead of
+        // raw ecrecover — it rejects high-s (malleable) signatures and malformed lengths, matching the
+        // DelegationManager idiom so every signature-verifying contract shares one low-s-safe path.
         bytes32 ethHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", digest));
-        if (signature.length != 65) return false;
-        bytes32 r;
-        bytes32 s;
-        uint8 v;
-        // solhint-disable-next-line no-inline-assembly
-        assembly {
-            r := mload(add(signature, 0x20))
-            s := mload(add(signature, 0x40))
-            v := byte(0, mload(add(signature, 0x60)))
-        }
-        if (v < 27) v += 27;
-        address recovered = ecrecover(ethHash, v, r, s);
-        return recovered != address(0) && recovered == signer;
+        (address recovered, ECDSA.RecoverError err, ) = ECDSA.tryRecover(ethHash, signature);
+        return err == ECDSA.RecoverError.NoError && recovered == signer;
     }
 }

package/src/attestation/AttestationRegistry.sol

@@ -2,6 +2,7 @@
 pragma solidity ^0.8.28;
 
 import "@openzeppelin/contracts/interfaces/IERC1271.sol";
+import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
 
 /**
  * @title AttestationRegistry
@@ -17,9 +18,19 @@ import "@openzeppelin/contracts/interfaces/IERC1271.sol";
  *   ─── Key invariants (AR-*) ───
  *
  * AR-01 deterministic UID = keccak256(subject, issuer, credentialType, credentialHash, refUID, salt)
- * AR-02 issuer signature verified via ERC-1271 against the named issuer SA
- * AR-03 schemaId MUST point to a registered ShapeRegistry shape (governance-gated)
- * AR-04 bilateral-consent verified via DelegationManager.verifyAuthorization
+ * AR-02 issuer signature verified (ERC-1271 for SAs, low-s ECDSA for EOAs) over a CANONICAL TYPED
+ *       digest recomputed on-chain — ASSOCIATION_ATTESTATION_TYPEHASH (unilateral) /
+ *       JOINT_ISSUER_TYPEHASH (joint), each binding the parties/subject + schema + credentialType +
+ *       credentialHash + chainId + this contract (SC-2 / ATT-1). A bare credentialHash is never trusted.
+ * AR-03 schemaId is an OPAQUE tag stored on the attestation. This registry does NOT dereference
+ *       ShapeRegistry on-chain; shape/governance validation of schemaId is an off-chain/consumer
+ *       concern. (Earlier drafts claimed on-chain ShapeRegistry enforcement — that is not implemented
+ *       here and consumers MUST NOT assume it.)
+ * AR-04 bilateral consent is VERIFIED on-chain by recomputing JOINT_CONSENT_TYPEHASH (party1, party2,
+ *       agreementCommitment, credentialHash, chainId, this contract) and requiring BOTH parties'
+ *       signatures over it (ERC-1271 / low-s ECDSA). This entrypoint uses the direct two-party-signature
+ *       form; the DelegationManager.verifyAuthorization predicate path is spec 249's alternative (b),
+ *       NOT this contract's direct joint path.
  * AR-05 holder-only revocation for unilateral; either-party for joint
  * AR-06 NO issuerRevoke(...) entrypoint — by static analysis
  * AR-07 epoch-bucket timestamps; raw block.timestamp never stored
@@ -48,8 +59,28 @@ contract AttestationRegistry {
     /// @dev RW1-1 (ADR-0027) — the canonical consent payload each party signs to consent to a
     ///      joint agreement. The contract RECOMPUTES this digest from calldata; a stored/supplied
     ///      reference is not consent. Binds the consent to the exact parties + agreement + credential.
+    ///      ATT-3 (audit 2026-06-10): also binds chainId + this registry, mirroring the issuer side
+    ///      (ATT-1) and the association path (SC-2). Without it a party's consent signature could be
+    ///      replayed on another chain or a redeployed registry (the attestation map is per-instance
+    ///      storage, so a cross-instance replay anchors a fresh spoofed attestation).
     bytes32 internal constant JOINT_CONSENT_TYPEHASH = keccak256(
-        "JointAgreementConsent(address party1,address party2,bytes32 agreementCommitment,bytes32 credentialHash)"
+        "JointAgreementConsent(address party1,address party2,bytes32 agreementCommitment,bytes32 credentialHash,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev ATT-1 (audit 2026-06-10): the SC-2 bug class lived on in the JOINT issuer signature — it was
+    ///      verified over a bare `credentialHash`, so a known issuer signature could be reused to anchor a
+    ///      spoofed issuer-backed joint attestation with different parties/schema. The issuer now signs a
+    ///      digest binding parties + schema + credential type + commitment + chain + this contract.
+    bytes32 internal constant JOINT_ISSUER_TYPEHASH = keccak256(
+        "JointAgreementIssuerAttestation(address party1,address party2,address issuer,bytes32 schemaId,bytes32 credentialType,bytes32 credentialHash,bytes32 agreementCommitment,uint256 chainId,address verifyingContract)"
+    );
+
+    /// @dev SC-2 (audit 2026-06-09): the issuer attestation digest binds the SUBJECT (and schema /
+    ///      credential type / chain / this contract) — not just `credentialHash`. Previously the issuer
+    ///      signed only the credentialHash, so anyone who learned that public hash could anchor it on
+    ///      chain against a DIFFERENT subject. Recomputed on-chain; the TS side derives the same constant.
+    bytes32 internal constant ASSOCIATION_ATTESTATION_TYPEHASH = keccak256(
+        "AssociationAttestation(address subject,address issuer,bytes32 schemaId,bytes32 credentialType,bytes32 credentialHash,uint256 chainId,address verifyingContract)"
     );
 
     // ─── Storage ────────────────────────────────────────────────────────
@@ -138,8 +169,22 @@ contract AttestationRegistry {
     function assertAssociation(AssociationAttestationRequest calldata req) external returns (bytes32) {
         if (req.credentialHash == bytes32(0)) revert EmptyCredentialHash();
 
-        // AR-02: verify issuer signature over credentialHash
-        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+        // SC-2: RECOMPUTE the issuer-attestation digest binding the SUBJECT (+ schema / type / chain /
+        // this contract) and verify the issuer signed THAT. A known credentialHash can no longer be
+        // anchored against an attacker-chosen subject.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                ASSOCIATION_ATTESTATION_TYPEHASH,
+                req.subject,
+                req.issuer,
+                req.schemaId,
+                req.credentialType,
+                req.credentialHash,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(req.issuer, issuerDigest, req.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
@@ -192,13 +237,40 @@ contract AttestationRegistry {
         if (req.party1 == address(0) || req.party2 == address(0)) revert InvalidParties();
         if (req.party1 == req.party2) revert InvalidParties();
 
-        if (!_isValidSignatureBool(req.issuer, req.credentialHash, req.issuerSignature)) {
+        // ATT-1 (audit 2026-06-10): the issuer signs a FULL typed digest binding the parties, schema,
+        // credential type/hash, the agreement commitment (refUID), chain, and this registry — not a bare
+        // `credentialHash`. A leaked/observed issuer signature can no longer be replayed to anchor an
+        // issuer-backed joint attestation for different parties/schema/chain.
+        bytes32 issuerDigest = keccak256(
+            abi.encode(
+                JOINT_ISSUER_TYPEHASH,
+                req.party1,
+                req.party2,
+                req.issuer,
+                req.schemaId,
+                req.credentialType,
+                req.credentialHash,
+                req.refUID,
+                block.chainid,
+                address(this)
+            )
+        );
+        if (!_isValidSignatureBool(req.issuer, issuerDigest, req.issuerSignature)) {
             revert InvalidIssuerSignature();
         }
 
         // VERIFY bilateral consent: recompute the digest, require both parties' signatures over it.
+        // ATT-3: chainId + address(this) bound (anti cross-chain / redeployed-registry replay).
         bytes32 consentDigest = keccak256(
-            abi.encode(JOINT_CONSENT_TYPEHASH, req.party1, req.party2, req.refUID, req.credentialHash)
+            abi.encode(
+                JOINT_CONSENT_TYPEHASH,
+                req.party1,
+                req.party2,
+                req.refUID,
+                req.credentialHash,
+                block.chainid,
+                address(this)
+            )
         );
         if (!_isValidSignatureBool(req.party1, consentDigest, req.party1Signature)) revert InvalidPartyConsent();
         if (!_isValidSignatureBool(req.party2, consentDigest, req.party2Signature)) revert InvalidPartyConsent();
@@ -301,20 +373,12 @@ contract AttestationRegistry {
                 return false;
             }
         }
-        // EOA fallback via eth-signed message hash + ecrecover
+        // EOA fallback via eth-signed message hash + malleability-safe ECDSA.
+        // P2-2 (audit 2026-06-10): route EOA recovery through OpenZeppelin ECDSA.tryRecover instead of
+        // raw ecrecover — it rejects high-s (malleable) signatures and malformed lengths, matching the
+        // DelegationManager idiom so every signature-verifying contract shares one low-s-safe path.
         bytes32 ethHash = keccak256(abi.encodePacked("\x19Ethereum Signed Message:\n32", digest));
-        if (signature.length != 65) return false;
-        bytes32 r;
-        bytes32 s;
-        uint8 v;
-        // solhint-disable-next-line no-inline-assembly
-        assembly {
-            r := mload(add(signature, 0x20))
-            s := mload(add(signature, 0x40))
-            v := byte(0, mload(add(signature, 0x60)))
-        }
-        if (v < 27) v += 27;
-        address recovered = ecrecover(ethHash, v, r, s);
-        return recovered != address(0) && recovered == signer;
+        (address recovered, ECDSA.RecoverError err, ) = ECDSA.tryRecover(ethHash, signature);
+        return err == ECDSA.RecoverError.NoError && recovered == signer;
     }
 }

package/src/custody/CustodyPolicy.sol

@@ -313,6 +313,9 @@ contract CustodyPolicy {
     error TrusteeDoesNotExist(address guardian);
     error InvalidMode(uint8 mode_);
     error InvalidThresholdValue(uint8 thr);
+    /// @dev CP-1: a tier that must be configured (T4/T5 at install, T6 at read)
+    ///      was left unset — refuse rather than fall to the 1-of-n read fallback.
+    error UnconfiguredTier(uint8 tier);
     error RecoveryRequiresGuardians();
     error EmptyOwnerSet();
     error CustodyActionNotYetImplemented(uint8 action);
@@ -370,11 +373,7 @@ contract CustodyPolicy {
         c.t3HighValueCeiling = t3Ceiling;
         c.approvedHashRegistry = approvedHashReg;
 
-        for (uint8 t = 1; t <= 6; t++) {
-            if (thresholds[t] > 0) c.approvalsRequiredByTier[t] = thresholds[t];
-            if (timelocks[t] > 0) c.safetyDelayByTier[t] = timelocks[t];
-        }
-
+        // Trustees first so `trusteeCount` is known for the CP-2 recovery check.
         for (uint256 i; i < trustees.length; i++) {
             address g = trustees[i];
             if (g == address(0)) revert ZeroAddress();
@@ -383,6 +382,51 @@ contract CustodyPolicy {
             c.trusteeCount += 1;
         }
 
+        // CP-2: a recovery threshold the trustee set can NEVER satisfy bricks the
+        // T6 recovery lifeline from birth. Validate at install exactly as
+        // `_applySetRecoveryThreshold` does at runtime. `recoveryApprovals == 0`
+        // is a legitimate state (trustee recovery simply disabled); a positive
+        // threshold MUST be reachable by the configured trustees.
+        if (recThr > c.trusteeCount) revert RecoveryRequiresGuardians();
+
+        // CP-1: floor each unset tier to the spec default-approvals matrix so a
+        // direct onInstall that bypasses the factory with a zeroed/partial
+        // threshold array can't collapse the admin/critical tiers to the 1-of-n
+        // read fallback in `_approvalsValue`. T1–T3 legitimately stay at the
+        // 1-of-n floor (read/write/value are single-signer tiers by design);
+        // T4/T5 get the council default. T6 (recovery) lives in
+        // `recoveryApprovals`, not this map.
+        //
+        // The custodian count is read best-effort from the installing account
+        // (the ERC-7579 flow guarantees `msg.sender` is the deployed account).
+        // If it can't be determined (the account isn't yet/at all an
+        // `IAgentAccount`), `nCustodians` stays 0 so no flooring happens — and
+        // the hard-revert below then REQUIRES the installer to have passed
+        // explicit T4/T5 thresholds. Either way the admin/critical tiers can
+        // never silently resolve to 1-of-n; the floor is a convenience, the
+        // hard-revert is the security invariant.
+        uint8 nCustodians;
+        if (account.code.length > 0) {
+            try IAgentAccount(account).custodianCount() returns (uint256 cnt) {
+                nCustodians = cnt > 255 ? 255 : uint8(cnt);
+            } catch {}
+        }
+        for (uint8 t = 1; t <= 6; t++) {
+            uint8 thr = thresholds[t];
+            if (thr == 0) thr = _defaultApprovals(nCustodians, t);
+            if (thr > 0) c.approvalsRequiredByTier[t] = thr;
+            if (timelocks[t] > 0) c.safetyDelayByTier[t] = timelocks[t];
+        }
+
+        // CP-1 hard-revert: a non-single account MUST have the admin (T4) +
+        // critical (T5) custody quorum configured (explicitly or via the floor
+        // above) — never the 1-of-n read fallback. Mode 0 (single signer) has no
+        // custody council, so thresholds are moot and this is skipped.
+        if (modeVal >= 1) {
+            if (c.approvalsRequiredByTier[4] == 0) revert UnconfiguredTier(4);
+            if (c.approvalsRequiredByTier[5] == 0) revert UnconfiguredTier(5);
+        }
+
         emit CustodyPolicyInstalled(account, modeVal, recThr);
     }
 
@@ -633,7 +677,16 @@ contract CustodyPolicy {
     function _approvalsValue(Config storage c, uint8 tier) internal view returns (uint8) {
         if (tier == 0 || tier > 6) revert InvalidTier(tier);
         uint8 v = c.approvalsRequiredByTier[tier];
-        return v == 0 ? 1 : v;
+        if (v == 0) {
+            // CP-1 defense-in-depth: the T6 (recovery) quorum lives in
+            // `recoveryApprovals`, never in this map — a T6 read here is a
+            // mis-wire, so fail closed instead of returning the 1-of-n fallback.
+            // T1–T5 keep the 1-of-n floor (T4/T5 are install-floored, so the
+            // fallback only ever applies to the low single-signer tiers).
+            if (tier == 6) revert UnconfiguredTier(6);
+            return 1;
+        }
+        return v;
     }
 
     function _safetyDelayValue(Config storage c, uint8 tier) internal view returns (uint32) {