@atbash/sdk 0.16.4-dev.0 → 0.16.6-dev.0

package/dist/browser.d.mts

@@ -1111,6 +1111,8 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     verifyPubKey?: string;
     /** Org name for chain resolution (public vs org-private chain). */
     orgName?: string;
+    /** Explicit chain target when the host already resolved and verified it. */
+    chainOpts?: ChainOpts;
     /** LLM confidence threshold for yellow escalation. Default 0.6. */
     threshold?: number;
     /** When false, red verdicts log but don't block. Default true. */
@@ -1133,7 +1135,7 @@ interface GuardMemoryWriteResult {
     decision?: GuardMemoryDecision;
     /** Present when handled and scan ran. Absent when scan threw. */
     scanResult?: MemoryScanResult;
-    /** Present when handled. True when a chain-commit was dispatched (fire-and-forget). */
+    /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
 /**
@@ -1143,12 +1145,13 @@ interface GuardMemoryWriteResult {
  *
  * Verdict handling:
  * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with LLM score; decision allows
- * - `green`  → persisted with LLM score; decision allows
+ * - `yellow` → persisted with its LLM score; decision allows once the chain confirms
+ * - `green`  → persisted with its LLM score; decision allows once the chain confirms
+ * - anything else → not persisted; decision blocks (unless `enforce: false`)
  *
- * Chain commit is fire-and-forget: network errors are logged via
- * `logger.warn` but never surfaced to the caller. This mirrors the
- * existing plugin behaviour — chain is for audit/recovery, not gating.
+ * A write is acknowledged only after the chain transaction confirms, for
+ * yellow exactly as for green. An unconfirmed write blocks in enforce mode
+ * and remains unaudited in observe mode.
  */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
@@ -1178,6 +1181,8 @@ interface SyncMemoryOptions {
     /** Skip the TTL gate and force a chain check this call. Default false. */
     force?: boolean;
     chainOpts?: ChainOpts;
+    /** Exact chain slot for the managed file; omission keeps the cross-file API behavior. */
+    filePath?: string;
 }
 /**
  * `drifted: false` — pointer is still valid; caller can keep serving the local copy.
@@ -1226,6 +1231,8 @@ declare function defaultPointerPath(workspaceDir?: string): string;
 interface WrappedLogger {
     info(message: string, meta?: Record<string, unknown>): void;
     warn(message: string, meta?: Record<string, unknown>): void;
+    /** Wait for queued writes and surface any lost log entry. */
+    flush(): Promise<void>;
 }
 interface UpstreamLogger {
     info: (...args: unknown[]) => void;
@@ -1285,10 +1292,10 @@ interface HookDecision {
      * failure, a rolled-back version), and a host must never re-judge its way past
      * one.
      *
-     * Absent or false means the guard reached no decision — it was inside its cache
-     * window, chain was unreachable, the scan never ran, the file it can vouch for
-     * is not the file being read, or it is in observe mode. Those calls are
-     * unaudited: fall through to your own judge exactly as for a `null` return.
+   * Absent or false means the guard reached no decision — for example, the scan
+   * never ran or this manager does not own the requested file. In enforce mode,
+   * failed chain verification of the managed file is a block, never an unaudited
+   * allow. In observe mode unverified calls remain unaudited.
      *
      * So the host rule is:
      *   `if (d.block) deny;  else if (d.audited) allow;  else judge it yourself;`
@@ -1388,9 +1395,9 @@ declare class MemoryGuardManager {
     runBootProbe(): Promise<void>;
     /**
      * Returns a `HookDecision` when the guard reached a decision about this event.
-     * Returns `null` when it did not — either the event isn't memory-related, or it
-     * is but the guard could not check it. In both cases the host falls through to
-     * its own audit.
+     * Returns `null` for non-memory events, other files this manager does not
+     * own, or unverified observe-mode reads. An enforced read of the managed
+     * file blocks when verification cannot complete.
      *
      * A returned decision carries `audited` (see `HookDecision`). Only
      * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -1415,6 +1422,9 @@ declare class MemoryGuardManager {
      */
     private vouchesForTarget;
     private handleMemoryRead;
+    /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+    flushLogs(): Promise<void>;
+    private unverifiedRead;
     private writeMemoryAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;

package/dist/browser.mjs

@@ -44360,6 +44360,13 @@ function buildAllowedJudgeHosts() {
   ]);
 }
 var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -44796,16 +44803,23 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
-    try {
-      setupTelemetry({
-        enabled: true,
-        endpoint: this.endpoint,
-        getAuthHeaders: () => this.authHeaders()
-      });
-    } catch (err) {
-      this.logger.warn?.(
-        "[atbash] telemetry setup failed \u2014 continuing without metrics",
-        { error: String(err) }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
       );
     }
   }
@@ -46124,7 +46138,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   if (withinTtl) {
     return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
     return { drifted: false, checked: true, pointer: nextPointer };

package/dist/index.d.mts

@@ -1111,6 +1111,8 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     verifyPubKey?: string;
     /** Org name for chain resolution (public vs org-private chain). */
     orgName?: string;
+    /** Explicit chain target when the host already resolved and verified it. */
+    chainOpts?: ChainOpts;
     /** LLM confidence threshold for yellow escalation. Default 0.6. */
     threshold?: number;
     /** When false, red verdicts log but don't block. Default true. */
@@ -1133,7 +1135,7 @@ interface GuardMemoryWriteResult {
     decision?: GuardMemoryDecision;
     /** Present when handled and scan ran. Absent when scan threw. */
     scanResult?: MemoryScanResult;
-    /** Present when handled. True when a chain-commit was dispatched (fire-and-forget). */
+    /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
 /**
@@ -1143,12 +1145,13 @@ interface GuardMemoryWriteResult {
  *
  * Verdict handling:
  * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with LLM score; decision allows
- * - `green`  → persisted with LLM score; decision allows
+ * - `yellow` → persisted with its LLM score; decision allows once the chain confirms
+ * - `green`  → persisted with its LLM score; decision allows once the chain confirms
+ * - anything else → not persisted; decision blocks (unless `enforce: false`)
  *
- * Chain commit is fire-and-forget: network errors are logged via
- * `logger.warn` but never surfaced to the caller. This mirrors the
- * existing plugin behaviour — chain is for audit/recovery, not gating.
+ * A write is acknowledged only after the chain transaction confirms, for
+ * yellow exactly as for green. An unconfirmed write blocks in enforce mode
+ * and remains unaudited in observe mode.
  */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
@@ -1178,6 +1181,8 @@ interface SyncMemoryOptions {
     /** Skip the TTL gate and force a chain check this call. Default false. */
     force?: boolean;
     chainOpts?: ChainOpts;
+    /** Exact chain slot for the managed file; omission keeps the cross-file API behavior. */
+    filePath?: string;
 }
 /**
  * `drifted: false` — pointer is still valid; caller can keep serving the local copy.
@@ -1226,6 +1231,8 @@ declare function defaultPointerPath(workspaceDir?: string): string;
 interface WrappedLogger {
     info(message: string, meta?: Record<string, unknown>): void;
     warn(message: string, meta?: Record<string, unknown>): void;
+    /** Wait for queued writes and surface any lost log entry. */
+    flush(): Promise<void>;
 }
 interface UpstreamLogger {
     info: (...args: unknown[]) => void;
@@ -1285,10 +1292,10 @@ interface HookDecision {
      * failure, a rolled-back version), and a host must never re-judge its way past
      * one.
      *
-     * Absent or false means the guard reached no decision — it was inside its cache
-     * window, chain was unreachable, the scan never ran, the file it can vouch for
-     * is not the file being read, or it is in observe mode. Those calls are
-     * unaudited: fall through to your own judge exactly as for a `null` return.
+   * Absent or false means the guard reached no decision — for example, the scan
+   * never ran or this manager does not own the requested file. In enforce mode,
+   * failed chain verification of the managed file is a block, never an unaudited
+   * allow. In observe mode unverified calls remain unaudited.
      *
      * So the host rule is:
      *   `if (d.block) deny;  else if (d.audited) allow;  else judge it yourself;`
@@ -1388,9 +1395,9 @@ declare class MemoryGuardManager {
     runBootProbe(): Promise<void>;
     /**
      * Returns a `HookDecision` when the guard reached a decision about this event.
-     * Returns `null` when it did not — either the event isn't memory-related, or it
-     * is but the guard could not check it. In both cases the host falls through to
-     * its own audit.
+     * Returns `null` for non-memory events, other files this manager does not
+     * own, or unverified observe-mode reads. An enforced read of the managed
+     * file blocks when verification cannot complete.
      *
      * A returned decision carries `audited` (see `HookDecision`). Only
      * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -1415,6 +1422,9 @@ declare class MemoryGuardManager {
      */
     private vouchesForTarget;
     private handleMemoryRead;
+    /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+    flushLogs(): Promise<void>;
+    private unverifiedRead;
     private writeMemoryAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;

package/dist/index.d.ts

@@ -1111,6 +1111,8 @@ interface GuardMemoryWriteInput extends ClassifyMemoryWriteOptions {
     verifyPubKey?: string;
     /** Org name for chain resolution (public vs org-private chain). */
     orgName?: string;
+    /** Explicit chain target when the host already resolved and verified it. */
+    chainOpts?: ChainOpts;
     /** LLM confidence threshold for yellow escalation. Default 0.6. */
     threshold?: number;
     /** When false, red verdicts log but don't block. Default true. */
@@ -1133,7 +1135,7 @@ interface GuardMemoryWriteResult {
     decision?: GuardMemoryDecision;
     /** Present when handled and scan ran. Absent when scan threw. */
     scanResult?: MemoryScanResult;
-    /** Present when handled. True when a chain-commit was dispatched (fire-and-forget). */
+    /** Present when handled. True only after the chain transaction confirms. */
     committed?: boolean;
 }
 /**
@@ -1143,12 +1145,13 @@ interface GuardMemoryWriteResult {
  *
  * Verdict handling:
  * - `red`  → not persisted to chain; decision blocks (unless `enforce: false`)
- * - `yellow` → persisted with LLM score; decision allows
- * - `green`  → persisted with LLM score; decision allows
+ * - `yellow` → persisted with its LLM score; decision allows once the chain confirms
+ * - `green`  → persisted with its LLM score; decision allows once the chain confirms
+ * - anything else → not persisted; decision blocks (unless `enforce: false`)
  *
- * Chain commit is fire-and-forget: network errors are logged via
- * `logger.warn` but never surfaced to the caller. This mirrors the
- * existing plugin behaviour — chain is for audit/recovery, not gating.
+ * A write is acknowledged only after the chain transaction confirms, for
+ * yellow exactly as for green. An unconfirmed write blocks in enforce mode
+ * and remains unaudited in observe mode.
  */
 declare function guardMemoryWrite(input: GuardMemoryWriteInput): Promise<GuardMemoryWriteResult>;
 
@@ -1178,6 +1181,8 @@ interface SyncMemoryOptions {
     /** Skip the TTL gate and force a chain check this call. Default false. */
     force?: boolean;
     chainOpts?: ChainOpts;
+    /** Exact chain slot for the managed file; omission keeps the cross-file API behavior. */
+    filePath?: string;
 }
 /**
  * `drifted: false` — pointer is still valid; caller can keep serving the local copy.
@@ -1226,6 +1231,8 @@ declare function defaultPointerPath(workspaceDir?: string): string;
 interface WrappedLogger {
     info(message: string, meta?: Record<string, unknown>): void;
     warn(message: string, meta?: Record<string, unknown>): void;
+    /** Wait for queued writes and surface any lost log entry. */
+    flush(): Promise<void>;
 }
 interface UpstreamLogger {
     info: (...args: unknown[]) => void;
@@ -1285,10 +1292,10 @@ interface HookDecision {
      * failure, a rolled-back version), and a host must never re-judge its way past
      * one.
      *
-     * Absent or false means the guard reached no decision — it was inside its cache
-     * window, chain was unreachable, the scan never ran, the file it can vouch for
-     * is not the file being read, or it is in observe mode. Those calls are
-     * unaudited: fall through to your own judge exactly as for a `null` return.
+   * Absent or false means the guard reached no decision — for example, the scan
+   * never ran or this manager does not own the requested file. In enforce mode,
+   * failed chain verification of the managed file is a block, never an unaudited
+   * allow. In observe mode unverified calls remain unaudited.
      *
      * So the host rule is:
      *   `if (d.block) deny;  else if (d.audited) allow;  else judge it yourself;`
@@ -1388,9 +1395,9 @@ declare class MemoryGuardManager {
     runBootProbe(): Promise<void>;
     /**
      * Returns a `HookDecision` when the guard reached a decision about this event.
-     * Returns `null` when it did not — either the event isn't memory-related, or it
-     * is but the guard could not check it. In both cases the host falls through to
-     * its own audit.
+     * Returns `null` for non-memory events, other files this manager does not
+     * own, or unverified observe-mode reads. An enforced read of the managed
+     * file blocks when verification cannot complete.
      *
      * A returned decision carries `audited` (see `HookDecision`). Only
      * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -1415,6 +1422,9 @@ declare class MemoryGuardManager {
      */
     private vouchesForTarget;
     private handleMemoryRead;
+    /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+    flushLogs(): Promise<void>;
+    private unverifiedRead;
     private writeMemoryAtomic;
 }
 declare function createMemoryGuardManager(opts: MemoryGuardManagerOptions): MemoryGuardManager;

package/dist/index.js

@@ -3026,6 +3026,13 @@ function buildAllowedJudgeHosts() {
   ]);
 }
 var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -3362,6 +3369,7 @@ var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
 var sourceExplicitlySet = false;
+var requestedExportIntervalMs;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3390,18 +3398,36 @@ function setupTelemetry(config2) {
     defaultSource = config2.source;
     sourceExplicitlySet = true;
   }
+  if (config2.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
+    requestedExportIntervalMs = config2.exportIntervalMs;
+  }
   if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
-  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
+  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(
+    config2.endpoint
+  ))
+    return;
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new import_exporter_metrics_otlp_http.OTLPMetricExporter({
     url: proxyUrl,
-    headers: async () => getAuthHeaders()
+    headers: async () => getAuthHeaders(),
+    // DELTA, not the OTel default of CUMULATIVE.
+    //
+    // A cumulative counter reports a running total, and the backend recovers
+    // the increment by differencing consecutive points of a series. That needs
+    // at least two points. Most Atbash callers are short-lived — a CLI run
+    // exports once and exits — so their series has exactly one point, nothing
+    // to difference against, and the usage board reads them as zero: the calls
+    // arrive, carry the right `source`, and still count for nothing.
+    //
+    // A delta counter reports the increment itself, so a single export is a
+    // whole truthful datapoint and SUM over any window is the real call count.
+    temporalityPreference: import_exporter_metrics_otlp_http.AggregationTemporalityPreference.DELTA
   });
   const reader = new import_sdk_metrics.PeriodicExportingMetricReader({
     exporter,
-    exportIntervalMillis: config2.exportIntervalMs ?? 6e4
+    exportIntervalMillis: requestedExportIntervalMs ?? 6e4
   });
   meterProvider = new import_sdk_metrics.MeterProvider({
     resource: (0, import_resources.resourceFromAttributes)({
@@ -3447,6 +3473,7 @@ async function shutdownTelemetry() {
   durationHistogram = null;
   defaultSource = "sdk";
   sourceExplicitlySet = false;
+  requestedExportIntervalMs = void 0;
 }
 
 // src-ts/userConfig.ts
@@ -3634,16 +3661,23 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
-    try {
-      setupTelemetry({
-        enabled: true,
-        endpoint: this.endpoint,
-        getAuthHeaders: () => this.authHeaders()
-      });
-    } catch (err) {
-      this.logger.warn?.(
-        "[atbash] telemetry setup failed \u2014 continuing without metrics",
-        { error: String(err) }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
       );
     }
   }
@@ -43041,7 +43075,7 @@ async function commitMemoryVersion(plaintext, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ADD_AGENT_MEMORY,
       args: [
@@ -43054,6 +43088,9 @@ async function commitMemoryVersion(plaintext, auth, opts) {
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory transaction was not confirmed (status=${receipt.status})`);
+  }
 }
 async function decryptRow(row, key3) {
   const parsed = native.parseMemoryRow(gtvToFfiSafe(row));
@@ -43163,13 +43200,16 @@ async function rollbackMemory(toId, reason, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ROLLBACK_AGENT_MEMORY,
       args: [toGtxBytes(args.agent_pubkey), args.to_id, args.reason]
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory rollback was not confirmed (status=${receipt.status})`);
+  }
 }
 
 // src-ts/memory/_json_safe.ts
@@ -43308,6 +43348,7 @@ async function guardMemoryWrite(input) {
     endpoint,
     verifyPubKey,
     orgName,
+    chainOpts,
     threshold,
     patterns,
     toolNames,
@@ -43364,23 +43405,41 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
+  if (scanResult.verdict !== "green" && scanResult.verdict !== "yellow") {
+    const reason = "Memory scan returned an unrecognized verdict.";
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason } : { allow: true, reason },
+      scanResult,
+      committed: false
+    };
+  }
   const filePath = import_node_path4.default.basename(memEntry.key);
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    filePath,
-    orgName,
-    endpoint,
-    verifyPubKey
-  }).catch((err) => {
+  try {
+    await commitMemoryVersion(memEntry.value, auth, {
+      score: scanResult.score,
+      filePath,
+      orgName,
+      endpoint,
+      verifyPubKey,
+      chainOpts
+    });
+  } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     logger2?.warn?.("[atbash] memory commit to chain failed", {
       path: memEntry.key,
       filePath,
       reason
     });
-  });
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason: `Memory commit failed: ${reason}` } : { allow: true, reason: `Memory commit failed: ${reason}` },
+      scanResult,
+      committed: false
+    };
+  }
   logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
+    scanResult.verdict === "yellow" ? "[atbash] memory ALLOW (yellow, low score)" : "[atbash] memory ALLOW",
     {
       path: memEntry.key,
       filePath,
@@ -43413,7 +43472,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   if (withinTtl) {
     return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
     return { drifted: false, checked: true, pointer: nextPointer };
@@ -43495,13 +43554,16 @@ function formatMeta(meta) {
 }
 function createFileLogger(filePath, upstream) {
   let queue = Promise.resolve();
+  let writeError;
   async function ensureDir() {
     await import_node_fs5.promises.mkdir(import_node_path6.default.dirname(filePath), { recursive: true });
   }
   function append(level, message, meta) {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}${formatMeta(meta)}
 `;
-    queue = queue.then(ensureDir).then(() => import_node_fs5.promises.appendFile(filePath, line, "utf8")).catch(() => {
+    queue = queue.then(ensureDir).then(() => import_node_fs5.promises.appendFile(filePath, line, "utf8")).catch((error4) => {
+      writeError = error4 instanceof Error ? error4 : new Error(String(error4));
+      upstream?.warn("[atbash] plugin log write failed", { error: writeError.message });
     });
   }
   return {
@@ -43512,6 +43574,10 @@ function createFileLogger(filePath, upstream) {
     warn(message, meta) {
       upstream?.warn(message, meta ?? {});
       append("warn", message, meta);
+    },
+    async flush() {
+      await queue;
+      if (writeError) throw writeError;
     }
   };
 }
@@ -43601,7 +43667,15 @@ var MemoryGuardManager = class {
           orgName: this.opts.orgName
         });
         const resolved = await atbash.resolveChainForOrg(this.opts.orgName);
-        const chainOpts = { ...this.opts.chainOpts, network: resolved.network };
+        if (!await atbash.checkAgentExists(this.agentPubkeyHex, { network: resolved.network })) {
+          throw new Error(`agent is not registered on the resolved ${resolved.network} chain`);
+        }
+        const chainOpts = {
+          ...this.opts.chainOpts,
+          network: resolved.network,
+          blockchainRid: resolved.blockchainRid,
+          nodeUrls: this.opts.chainOpts?.nodeUrls ?? resolved.nodeUrls
+        };
         this._resolvedChainOpts = chainOpts;
         this.logger.info(
           `[atbash] resolved org \u2192 chain \u2014 org=${this.opts.orgName} network=${resolved.network}`
@@ -43610,9 +43684,9 @@ var MemoryGuardManager = class {
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         this.logger.warn(
-          `[atbash] org \u2192 chain resolution failed (falling back to SDK default): ${msg}`
+          `[atbash] org \u2192 chain resolution failed (memory read will be blocked): ${msg}`
         );
-        return this.opts.chainOpts;
+        throw err;
       } finally {
         this._resolveChainInflight = void 0;
       }
@@ -43631,13 +43705,18 @@ var MemoryGuardManager = class {
       const result = await syncLocalMemory(this.opts.auth, seed, {
         ttlMs: 0,
         force: true,
-        chainOpts
+        chainOpts,
+        filePath: import_node_path7.default.basename(this.memoryFilePath)
       });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
           `[atbash] no active memory on chain for agent=${this.agentPubkeyHex.slice(0, 16)}\u2026 org=${this.opts.orgName ?? "(none)"} \u2014 either the agent isn't registered on this chain or hasn't written any memory. Sync will remain a no-op until a write lands.`
         );
       } else if (result.drifted && result.current) {
+        if (result.current.filePath !== import_node_path7.default.basename(this.memoryFilePath) || result.current.isActive !== true || result.current.decryptError) {
+          this.logger.warn("[atbash] boot sync REFUSED mismatched memory version");
+          return;
+        }
         if (result.current.score < this.rollbackMinScore) {
           this.logger.warn(
             `[atbash] boot sync REFUSED refresh \u2014 id=${result.current.id} score=${result.current.score} below threshold ${this.rollbackMinScore}. Leaving MEMORY.md and pointer untouched; next memory read will be blocked.`
@@ -43651,7 +43730,8 @@ var MemoryGuardManager = class {
           await this.writeMemoryAtomic(result.current.content);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] boot sync write failed (serving whatever's on disk)", { error: msg });
+          this.logger.warn("[atbash] boot sync write failed; pointer remains unchanged", { error: msg });
+          return;
         }
       }
       await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
@@ -43665,9 +43745,9 @@ var MemoryGuardManager = class {
   }
   /**
    * Returns a `HookDecision` when the guard reached a decision about this event.
-   * Returns `null` when it did not — either the event isn't memory-related, or it
-   * is but the guard could not check it. In both cases the host falls through to
-   * its own audit.
+   * Returns `null` for non-memory events, other files this manager does not
+   * own, or unverified observe-mode reads. An enforced read of the managed
+   * file blocks when verification cannot complete.
    *
    * A returned decision carries `audited` (see `HookDecision`). Only
    * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -43703,6 +43783,7 @@ var MemoryGuardManager = class {
       endpoint: this.opts.judgeEndpoint,
       verifyPubKey: this.opts.judgeVerifyPubKey,
       orgName: this.opts.orgName,
+      chainOpts: this.opts.chainOpts,
       patterns: this.opts.memoryPathPatterns,
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
@@ -43747,6 +43828,14 @@ var MemoryGuardManager = class {
         reason: `memory scan returned ${sr2.verdict} but this guard is not enforcing it`
       };
     }
+    if (guard.committed !== true) {
+      return {
+        allow: true,
+        audited: false,
+        verdict: sr2.verdict,
+        reason: "memory scan passed but chain commit did not confirm"
+      };
+    }
     return { allow: true, audited: true, verdict: sr2.verdict };
   }
   /**
@@ -43781,62 +43870,73 @@ var MemoryGuardManager = class {
     return found.every((p) => import_node_path7.default.resolve(p) === managed);
   }
   async handleMemoryRead(event, ctx) {
+    if (!this.vouchesForTarget(event, ctx)) return null;
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
+    let chainOpts;
     try {
-      const chainOpts = await this.resolveChainOpts();
+      chainOpts = await this.resolveChainOpts();
       result = await syncLocalMemory(this.opts.auth, pointer, {
         ttlMs: this.ttlMs,
-        chainOpts
+        force: this.enforce,
+        chainOpts,
+        filePath: import_node_path7.default.basename(this.memoryFilePath)
       });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
         const reason = `Memory integrity check failed on id ${err.id} \u2014 read blocked.`;
         this.logger.warn("[atbash] MEMORY INTEGRITY FAILURE", { id: err.id, error: err.message });
-        if (!this.enforce) return null;
-        return { block: true, blockReason: reason, allow: false, reason, audited: true };
+        return this.unverifiedRead(reason);
       }
       const msg = err instanceof Error ? err.message : String(err);
-      this.logger.warn("[atbash] memory sync failed (serving local copy)", { error: msg });
-      return null;
+      this.logger.warn("[atbash] memory sync failed", { error: msg });
+      return this.unverifiedRead(`Memory chain sync failed: ${msg}`);
     }
-    let onDiskIsCurrent = result.checked;
-    if (result.drifted) {
-      const fresh = result.current;
-      if (fresh) {
-        if (fresh.score < this.rollbackMinScore) {
-          const reason = `Rolled-back memory version #${fresh.id} scored ${fresh.score} (below threshold ${this.rollbackMinScore}) \u2014 read blocked.`;
-          this.logger.warn("[atbash] blocking read on low-score rollback", { id: fresh.id, score: fresh.score });
-          if (!this.enforce) return null;
-          return { block: true, blockReason: reason, allow: false, reason, audited: true };
-        }
-        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", {
-          id: fresh.id,
-          score: fresh.score
-        });
-        try {
-          await this.writeMemoryAtomic(fresh.content);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] failed to write refreshed memory (serving old)", { error: msg });
-          onDiskIsCurrent = false;
-        }
-      } else {
-        this.logger.info("[atbash] active memory removed on chain", { pubkey: this.agentPubkeyHex });
-        onDiskIsCurrent = false;
-      }
+    if (!result.checked) return this.unverifiedRead("Memory chain state was not checked.");
+    const activeId = result.pointer.activeId;
+    if (activeId === null) {
+      return this.unverifiedRead("No active chain version exists for the managed memory file.");
     }
-    if (onDiskIsCurrent) {
-      await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
-    } else {
-      this.logger.warn(
-        "[atbash] not advancing memory pointer \u2014 local file is stale or revoked; reads stay unaudited until it is refreshed"
-      );
+    let active;
+    try {
+      active = result.drifted ? result.current : await getMemoryById(activeId, this.opts.auth, chainOpts);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] active memory row could not be verified", { error: msg });
+      return this.unverifiedRead(`Memory version could not be verified: ${msg}`);
     }
-    if (!onDiskIsCurrent) return null;
-    if (!this.vouchesForTarget(event, ctx)) return null;
+    const filePath = import_node_path7.default.basename(this.memoryFilePath);
+    if (!active || active.id !== activeId || active.filePath !== filePath || active.isActive !== true || active.decryptError) {
+      return this.unverifiedRead("Active memory version does not match the managed file.");
+    }
+    if (active.score < this.rollbackMinScore) {
+      return this.unverifiedRead(`Memory version #${active.id} is below the minimum safety score.`);
+    }
+    try {
+      if (result.drifted) {
+        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", { id: active.id });
+        await this.writeMemoryAtomic(active.content);
+      }
+      const onDisk = await import_node_fs6.promises.readFile(this.memoryFilePath, "utf8");
+      if (onDisk !== active.content) {
+        return this.unverifiedRead("Local memory bytes do not match the active chain version.");
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] managed memory file could not be verified", { error: msg });
+      return this.unverifiedRead(`Managed memory file could not be verified: ${msg}`);
+    }
+    await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
     return { allow: true, audited: true };
   }
+  /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+  async flushLogs() {
+    await this.logger.flush();
+  }
+  unverifiedRead(reason) {
+    if (!this.enforce) return null;
+    return { block: true, blockReason: reason, allow: false, reason, audited: true };
+  }
   async writeMemoryAtomic(content) {
     await import_node_fs6.promises.mkdir(import_node_path7.default.dirname(this.memoryFilePath), { recursive: true });
     const tmp = `${this.memoryFilePath}.${process.pid}.tmp`;

package/dist/index.mjs

@@ -2930,6 +2930,13 @@ function buildAllowedJudgeHosts() {
   ]);
 }
 var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -3258,7 +3265,10 @@ function canonicalAllow(data) {
 import { readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
+import {
+  AggregationTemporalityPreference,
+  OTLPMetricExporter
+} from "@opentelemetry/exporter-metrics-otlp-http";
 import { resourceFromAttributes } from "@opentelemetry/resources";
 import {
   MeterProvider,
@@ -3269,6 +3279,7 @@ var callCounter = null;
 var durationHistogram = null;
 var defaultSource = "sdk";
 var sourceExplicitlySet = false;
+var requestedExportIntervalMs;
 function isTelemetryOptedOut() {
   const disabled = process.env.ATBASH_TELEMETRY_DISABLED?.trim().toLowerCase();
   if (disabled && ["1", "true", "yes", "on"].includes(disabled)) {
@@ -3297,18 +3308,36 @@ function setupTelemetry(config2) {
     defaultSource = config2.source;
     sourceExplicitlySet = true;
   }
+  if (config2.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
+    requestedExportIntervalMs = config2.exportIntervalMs;
+  }
   if (meterProvider) return;
   if (!config2.endpoint || !config2.getAuthHeaders) return;
-  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(config2.endpoint)) return;
+  if (/^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(
+    config2.endpoint
+  ))
+    return;
   const proxyUrl = `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`;
   const getAuthHeaders = config2.getAuthHeaders;
   const exporter = new OTLPMetricExporter({
     url: proxyUrl,
-    headers: async () => getAuthHeaders()
+    headers: async () => getAuthHeaders(),
+    // DELTA, not the OTel default of CUMULATIVE.
+    //
+    // A cumulative counter reports a running total, and the backend recovers
+    // the increment by differencing consecutive points of a series. That needs
+    // at least two points. Most Atbash callers are short-lived — a CLI run
+    // exports once and exits — so their series has exactly one point, nothing
+    // to difference against, and the usage board reads them as zero: the calls
+    // arrive, carry the right `source`, and still count for nothing.
+    //
+    // A delta counter reports the increment itself, so a single export is a
+    // whole truthful datapoint and SUM over any window is the real call count.
+    temporalityPreference: AggregationTemporalityPreference.DELTA
   });
   const reader = new PeriodicExportingMetricReader({
     exporter,
-    exportIntervalMillis: config2.exportIntervalMs ?? 6e4
+    exportIntervalMillis: requestedExportIntervalMs ?? 6e4
   });
   meterProvider = new MeterProvider({
     resource: resourceFromAttributes({
@@ -3354,6 +3383,7 @@ async function shutdownTelemetry() {
   durationHistogram = null;
   defaultSource = "sdk";
   sourceExplicitlySet = false;
+  requestedExportIntervalMs = void 0;
 }
 
 // src-ts/userConfig.ts
@@ -3547,16 +3577,23 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
-    try {
-      setupTelemetry({
-        enabled: true,
-        endpoint: this.endpoint,
-        getAuthHeaders: () => this.authHeaders()
-      });
-    } catch (err) {
-      this.logger.warn?.(
-        "[atbash] telemetry setup failed \u2014 continuing without metrics",
-        { error: String(err) }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
       );
     }
   }
@@ -42954,7 +42991,7 @@ async function commitMemoryVersion(plaintext, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ADD_AGENT_MEMORY,
       args: [
@@ -42967,6 +43004,9 @@ async function commitMemoryVersion(plaintext, auth, opts) {
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory transaction was not confirmed (status=${receipt.status})`);
+  }
 }
 async function decryptRow(row, key3) {
   const parsed = native.parseMemoryRow(gtvToFfiSafe(row));
@@ -43076,13 +43116,16 @@ async function rollbackMemory(toId, reason, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ROLLBACK_AGENT_MEMORY,
       args: [toGtxBytes(args.agent_pubkey), args.to_id, args.reason]
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory rollback was not confirmed (status=${receipt.status})`);
+  }
 }
 
 // src-ts/memory/_json_safe.ts
@@ -43221,6 +43264,7 @@ async function guardMemoryWrite(input) {
     endpoint,
     verifyPubKey,
     orgName,
+    chainOpts,
     threshold,
     patterns,
     toolNames,
@@ -43277,23 +43321,41 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
+  if (scanResult.verdict !== "green" && scanResult.verdict !== "yellow") {
+    const reason = "Memory scan returned an unrecognized verdict.";
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason } : { allow: true, reason },
+      scanResult,
+      committed: false
+    };
+  }
   const filePath = path3.basename(memEntry.key);
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    filePath,
-    orgName,
-    endpoint,
-    verifyPubKey
-  }).catch((err) => {
+  try {
+    await commitMemoryVersion(memEntry.value, auth, {
+      score: scanResult.score,
+      filePath,
+      orgName,
+      endpoint,
+      verifyPubKey,
+      chainOpts
+    });
+  } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     logger2?.warn?.("[atbash] memory commit to chain failed", {
       path: memEntry.key,
       filePath,
       reason
     });
-  });
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason: `Memory commit failed: ${reason}` } : { allow: true, reason: `Memory commit failed: ${reason}` },
+      scanResult,
+      committed: false
+    };
+  }
   logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
+    scanResult.verdict === "yellow" ? "[atbash] memory ALLOW (yellow, low score)" : "[atbash] memory ALLOW",
     {
       path: memEntry.key,
       filePath,
@@ -43326,7 +43388,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   if (withinTtl) {
     return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
     return { drifted: false, checked: true, pointer: nextPointer };
@@ -43408,13 +43470,16 @@ function formatMeta(meta) {
 }
 function createFileLogger(filePath, upstream) {
   let queue = Promise.resolve();
+  let writeError;
   async function ensureDir() {
     await fs2.mkdir(path5.dirname(filePath), { recursive: true });
   }
   function append(level, message, meta) {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}${formatMeta(meta)}
 `;
-    queue = queue.then(ensureDir).then(() => fs2.appendFile(filePath, line, "utf8")).catch(() => {
+    queue = queue.then(ensureDir).then(() => fs2.appendFile(filePath, line, "utf8")).catch((error4) => {
+      writeError = error4 instanceof Error ? error4 : new Error(String(error4));
+      upstream?.warn("[atbash] plugin log write failed", { error: writeError.message });
     });
   }
   return {
@@ -43425,6 +43490,10 @@ function createFileLogger(filePath, upstream) {
     warn(message, meta) {
       upstream?.warn(message, meta ?? {});
       append("warn", message, meta);
+    },
+    async flush() {
+      await queue;
+      if (writeError) throw writeError;
     }
   };
 }
@@ -43514,7 +43583,15 @@ var MemoryGuardManager = class {
           orgName: this.opts.orgName
         });
         const resolved = await atbash.resolveChainForOrg(this.opts.orgName);
-        const chainOpts = { ...this.opts.chainOpts, network: resolved.network };
+        if (!await atbash.checkAgentExists(this.agentPubkeyHex, { network: resolved.network })) {
+          throw new Error(`agent is not registered on the resolved ${resolved.network} chain`);
+        }
+        const chainOpts = {
+          ...this.opts.chainOpts,
+          network: resolved.network,
+          blockchainRid: resolved.blockchainRid,
+          nodeUrls: this.opts.chainOpts?.nodeUrls ?? resolved.nodeUrls
+        };
         this._resolvedChainOpts = chainOpts;
         this.logger.info(
           `[atbash] resolved org \u2192 chain \u2014 org=${this.opts.orgName} network=${resolved.network}`
@@ -43523,9 +43600,9 @@ var MemoryGuardManager = class {
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         this.logger.warn(
-          `[atbash] org \u2192 chain resolution failed (falling back to SDK default): ${msg}`
+          `[atbash] org \u2192 chain resolution failed (memory read will be blocked): ${msg}`
         );
-        return this.opts.chainOpts;
+        throw err;
       } finally {
         this._resolveChainInflight = void 0;
       }
@@ -43544,13 +43621,18 @@ var MemoryGuardManager = class {
       const result = await syncLocalMemory(this.opts.auth, seed, {
         ttlMs: 0,
         force: true,
-        chainOpts
+        chainOpts,
+        filePath: path6.basename(this.memoryFilePath)
       });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
           `[atbash] no active memory on chain for agent=${this.agentPubkeyHex.slice(0, 16)}\u2026 org=${this.opts.orgName ?? "(none)"} \u2014 either the agent isn't registered on this chain or hasn't written any memory. Sync will remain a no-op until a write lands.`
         );
       } else if (result.drifted && result.current) {
+        if (result.current.filePath !== path6.basename(this.memoryFilePath) || result.current.isActive !== true || result.current.decryptError) {
+          this.logger.warn("[atbash] boot sync REFUSED mismatched memory version");
+          return;
+        }
         if (result.current.score < this.rollbackMinScore) {
           this.logger.warn(
             `[atbash] boot sync REFUSED refresh \u2014 id=${result.current.id} score=${result.current.score} below threshold ${this.rollbackMinScore}. Leaving MEMORY.md and pointer untouched; next memory read will be blocked.`
@@ -43564,7 +43646,8 @@ var MemoryGuardManager = class {
           await this.writeMemoryAtomic(result.current.content);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] boot sync write failed (serving whatever's on disk)", { error: msg });
+          this.logger.warn("[atbash] boot sync write failed; pointer remains unchanged", { error: msg });
+          return;
         }
       }
       await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
@@ -43578,9 +43661,9 @@ var MemoryGuardManager = class {
   }
   /**
    * Returns a `HookDecision` when the guard reached a decision about this event.
-   * Returns `null` when it did not — either the event isn't memory-related, or it
-   * is but the guard could not check it. In both cases the host falls through to
-   * its own audit.
+   * Returns `null` for non-memory events, other files this manager does not
+   * own, or unverified observe-mode reads. An enforced read of the managed
+   * file blocks when verification cannot complete.
    *
    * A returned decision carries `audited` (see `HookDecision`). Only
    * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -43616,6 +43699,7 @@ var MemoryGuardManager = class {
       endpoint: this.opts.judgeEndpoint,
       verifyPubKey: this.opts.judgeVerifyPubKey,
       orgName: this.opts.orgName,
+      chainOpts: this.opts.chainOpts,
       patterns: this.opts.memoryPathPatterns,
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
@@ -43660,6 +43744,14 @@ var MemoryGuardManager = class {
         reason: `memory scan returned ${sr2.verdict} but this guard is not enforcing it`
       };
     }
+    if (guard.committed !== true) {
+      return {
+        allow: true,
+        audited: false,
+        verdict: sr2.verdict,
+        reason: "memory scan passed but chain commit did not confirm"
+      };
+    }
     return { allow: true, audited: true, verdict: sr2.verdict };
   }
   /**
@@ -43694,62 +43786,73 @@ var MemoryGuardManager = class {
     return found.every((p) => path6.resolve(p) === managed);
   }
   async handleMemoryRead(event, ctx) {
+    if (!this.vouchesForTarget(event, ctx)) return null;
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
+    let chainOpts;
     try {
-      const chainOpts = await this.resolveChainOpts();
+      chainOpts = await this.resolveChainOpts();
       result = await syncLocalMemory(this.opts.auth, pointer, {
         ttlMs: this.ttlMs,
-        chainOpts
+        force: this.enforce,
+        chainOpts,
+        filePath: path6.basename(this.memoryFilePath)
       });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
         const reason = `Memory integrity check failed on id ${err.id} \u2014 read blocked.`;
         this.logger.warn("[atbash] MEMORY INTEGRITY FAILURE", { id: err.id, error: err.message });
-        if (!this.enforce) return null;
-        return { block: true, blockReason: reason, allow: false, reason, audited: true };
+        return this.unverifiedRead(reason);
       }
       const msg = err instanceof Error ? err.message : String(err);
-      this.logger.warn("[atbash] memory sync failed (serving local copy)", { error: msg });
-      return null;
+      this.logger.warn("[atbash] memory sync failed", { error: msg });
+      return this.unverifiedRead(`Memory chain sync failed: ${msg}`);
     }
-    let onDiskIsCurrent = result.checked;
-    if (result.drifted) {
-      const fresh = result.current;
-      if (fresh) {
-        if (fresh.score < this.rollbackMinScore) {
-          const reason = `Rolled-back memory version #${fresh.id} scored ${fresh.score} (below threshold ${this.rollbackMinScore}) \u2014 read blocked.`;
-          this.logger.warn("[atbash] blocking read on low-score rollback", { id: fresh.id, score: fresh.score });
-          if (!this.enforce) return null;
-          return { block: true, blockReason: reason, allow: false, reason, audited: true };
-        }
-        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", {
-          id: fresh.id,
-          score: fresh.score
-        });
-        try {
-          await this.writeMemoryAtomic(fresh.content);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] failed to write refreshed memory (serving old)", { error: msg });
-          onDiskIsCurrent = false;
-        }
-      } else {
-        this.logger.info("[atbash] active memory removed on chain", { pubkey: this.agentPubkeyHex });
-        onDiskIsCurrent = false;
-      }
+    if (!result.checked) return this.unverifiedRead("Memory chain state was not checked.");
+    const activeId = result.pointer.activeId;
+    if (activeId === null) {
+      return this.unverifiedRead("No active chain version exists for the managed memory file.");
     }
-    if (onDiskIsCurrent) {
-      await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
-    } else {
-      this.logger.warn(
-        "[atbash] not advancing memory pointer \u2014 local file is stale or revoked; reads stay unaudited until it is refreshed"
-      );
+    let active;
+    try {
+      active = result.drifted ? result.current : await getMemoryById(activeId, this.opts.auth, chainOpts);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] active memory row could not be verified", { error: msg });
+      return this.unverifiedRead(`Memory version could not be verified: ${msg}`);
     }
-    if (!onDiskIsCurrent) return null;
-    if (!this.vouchesForTarget(event, ctx)) return null;
+    const filePath = path6.basename(this.memoryFilePath);
+    if (!active || active.id !== activeId || active.filePath !== filePath || active.isActive !== true || active.decryptError) {
+      return this.unverifiedRead("Active memory version does not match the managed file.");
+    }
+    if (active.score < this.rollbackMinScore) {
+      return this.unverifiedRead(`Memory version #${active.id} is below the minimum safety score.`);
+    }
+    try {
+      if (result.drifted) {
+        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", { id: active.id });
+        await this.writeMemoryAtomic(active.content);
+      }
+      const onDisk = await fs3.readFile(this.memoryFilePath, "utf8");
+      if (onDisk !== active.content) {
+        return this.unverifiedRead("Local memory bytes do not match the active chain version.");
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] managed memory file could not be verified", { error: msg });
+      return this.unverifiedRead(`Managed memory file could not be verified: ${msg}`);
+    }
+    await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
     return { allow: true, audited: true };
   }
+  /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+  async flushLogs() {
+    await this.logger.flush();
+  }
+  unverifiedRead(reason) {
+    if (!this.enforce) return null;
+    return { block: true, blockReason: reason, allow: false, reason, audited: true };
+  }
   async writeMemoryAtomic(content) {
     await fs3.mkdir(path6.dirname(this.memoryFilePath), { recursive: true });
     const tmp = `${this.memoryFilePath}.${process.pid}.tmp`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/sdk",
-  "version": "0.16.4-dev.0",
+  "version": "0.16.6-dev.0",
   "description": "TypeScript SDK for Atbash — the safety layer that evaluates AI agent actions against operator-defined policies before execution.",
   "keywords": [
     "atbash",
@@ -59,6 +59,7 @@
     "test:native": "node --test __test__/vector_parity.test.mjs",
     "test:sdk": "node --test __test__/*.sdk.test.mjs",
     "test:live": "node --test __test__/live_technical_health.test.mjs",
+    "test:memory:live": "node --test __test__/memory_chain_live.test.mjs",
     "test": "node --test __test__/*.test.mjs",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
@@ -89,10 +90,10 @@
     "typescript-eslint": "^8.62.1"
   },
   "optionalDependencies": {
-    "@atbash/sdk-linux-x64-gnu": "0.16.4-dev.0",
-    "@atbash/sdk-linux-arm64-gnu": "0.16.4-dev.0",
-    "@atbash/sdk-linux-x64-musl": "0.16.4-dev.0",
-    "@atbash/sdk-darwin-arm64": "0.16.4-dev.0",
-    "@atbash/sdk-win32-x64-msvc": "0.16.4-dev.0"
+    "@atbash/sdk-linux-x64-gnu": "0.16.6-dev.0",
+    "@atbash/sdk-linux-arm64-gnu": "0.16.6-dev.0",
+    "@atbash/sdk-linux-x64-musl": "0.16.6-dev.0",
+    "@atbash/sdk-darwin-arm64": "0.16.6-dev.0",
+    "@atbash/sdk-win32-x64-msvc": "0.16.6-dev.0"
   }
 }