@atbash/sdk 0.16.5-dev.0 → 0.17.0-dev.0

package/dist/index.mjs

@@ -2930,6 +2930,13 @@ function buildAllowedJudgeHosts() {
   ]);
 }
 var ALLOWED_JUDGE_HOSTS = buildAllowedJudgeHosts();
+function isAllowlistedJudgeHost(endpoint) {
+  try {
+    return ALLOWED_JUDGE_HOSTS.has(new URL(endpoint).hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -3198,7 +3205,7 @@ function loadAgentFromFile(keyPath) {
 // src-ts/normalize.ts
 function normalizeVerdict(raw2) {
   if (raw2 === null || raw2 === void 0) return "No verdict";
-  const v = String(raw2).toUpperCase();
+  const v = String(raw2).trim().toUpperCase();
   if (v === "ALLOW" || v === "GREEN") return "ALLOW";
   if (v === "HOLD" || v === "YELLOW") return "HOLD";
   if (v === "BLOCK" || v === "RED") return "BLOCK";
@@ -3235,17 +3242,58 @@ function allowSignalsPermit(data) {
   }
   return signals.length === 0 || signals.every((value) => value === true);
 }
+function explicitRefusal(data) {
+  let hold = false;
+  for (const source of decisionSources(data)) {
+    const verdict = verdictOf(source);
+    if (verdict === "BLOCK" || verdict === "RED") return "BLOCK";
+    if (verdict === "HOLD" || verdict === "YELLOW") hold = true;
+    const actionType = actionTypeOf(source);
+    if (actionType === "block") return "BLOCK";
+    if (actionType === "hold_for_user_confirm") hold = true;
+  }
+  if (!allowSignalsPermit(data)) return "BLOCK";
+  return hold ? "HOLD" : "";
+}
+function decisionSources(data) {
+  return [data, isRecord(data.decision) ? data.decision : {}];
+}
+function verdictOf(source) {
+  return typeof source.verdict === "string" ? source.verdict.trim().toUpperCase() : "";
+}
+function actionTypeRank(actionType) {
+  if (actionType === "block") return 4;
+  if (actionType === "hold_for_user_confirm") return 3;
+  if (actionType === "") return 1;
+  if (actionType === "allow") return 0;
+  return 2;
+}
+function actionTypeOf(source) {
+  let winner = "";
+  for (const key3 of ["action_type", "actionType"]) {
+    const raw2 = source[key3];
+    if (raw2 === void 0 || raw2 === null) continue;
+    const actionType = normalizeActionType(raw2);
+    if (actionTypeRank(actionType) > actionTypeRank(winner)) winner = actionType;
+  }
+  return winner;
+}
 function wireActionType(data) {
-  if (data.action_type !== void 0)
-    return normalizeActionType(data.action_type);
-  return normalizeActionType(data.actionType);
+  for (const source of decisionSources(data)) {
+    const actionType = actionTypeOf(source);
+    if (actionType !== "") return actionType;
+  }
+  return "";
 }
 function isAuditTier(data) {
   const absentVerdict = data.verdict === null || data.verdict === void 0;
   return absentVerdict && data.status === "logged";
 }
+function isAuditTierBody(data) {
+  return isAuditTier(data);
+}
 function canonicalAllow(data) {
-  if (!allowSignalsPermit(data)) return false;
+  if (explicitRefusal(data) !== "") return false;
   const actionType = wireActionType(data);
   if (actionType && actionType !== "allow") return false;
   if (isAuditTier(data)) return true;
@@ -3487,6 +3535,10 @@ var Atbash = class _Atbash {
   orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
+  /** When true (default), an unenforced (audit-tier) answer is refused. */
+  requireEnforcement;
+  /** Overall deadline for one auditToolCall decision, in ms. */
+  decisionTimeoutMs;
   /** Org key learned from the last agent-exists check, for this agent only. */
   _orgKeyFromChain = null;
   debug;
@@ -3560,6 +3612,8 @@ var Atbash = class _Atbash {
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
+    this.requireEnforcement = options.requireEnforcement !== false;
+    this.decisionTimeoutMs = options.decisionTimeoutMs ?? DEFAULT_DECISION_TIMEOUT_MS;
     this.debug = options.debug === true;
     this.logger = options.logger ?? {};
     this.http = new HttpClient(this.endpoint, options.timeoutMs ?? 12e4);
@@ -3570,16 +3624,23 @@ var Atbash = class _Atbash {
         verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
-    try {
-      setupTelemetry({
-        enabled: true,
-        endpoint: this.endpoint,
-        getAuthHeaders: () => this.authHeaders()
-      });
-    } catch (err) {
-      this.logger.warn?.(
-        "[atbash] telemetry setup failed \u2014 continuing without metrics",
-        { error: String(err) }
+    if (isAllowlistedJudgeHost(this.endpoint)) {
+      try {
+        setupTelemetry({
+          enabled: true,
+          endpoint: this.endpoint,
+          getAuthHeaders: () => this.authHeaders()
+        });
+      } catch (err) {
+        this.logger.warn?.(
+          "[atbash] telemetry setup failed \u2014 continuing without metrics",
+          { error: String(err) }
+        );
+      }
+    } else {
+      this.logger.info?.(
+        "[atbash] telemetry disabled \u2014 the agent bearer is only sent to hosts that already receive it, and this judge endpoint is not one",
+        { endpoint: this.endpoint }
       );
     }
   }
@@ -3643,6 +3704,8 @@ var Atbash = class _Atbash {
       orgName: options.orgName,
       verifyPubKey: validated.verifyPubKey ?? void 0,
       failClosed: options.failClosed,
+      requireEnforcement: options.requireEnforcement,
+      decisionTimeoutMs: options.decisionTimeoutMs,
       // ATBASH_DEBUG lets an operator turn diagnostics on without editing a
       // host's plugin config, which is usually the harder half.
       debug: options.debug ?? /^(1|true|yes)$/i.test(resolve("debug")),
@@ -3841,34 +3904,16 @@ var Atbash = class _Atbash {
     }
     if (!resp.ok) throw await this.httpError(resp);
     const bodyBytes = Buffer.from(await resp.arrayBuffer());
-    const verifyPubKey = options.verifyPubKey ?? this.verifyPubKey;
+    const verifyPubKey = this.effectiveVerifyKey(options.verifyPubKey);
     if (verifyPubKey !== void 0) {
-      const sig = resp.headers.get("X-Atbash-Signature");
-      if (!sig) {
-        throw new SignatureVerificationError(
-          "missing X-Atbash-Signature header"
-        );
-      }
-      let ok;
-      try {
-        ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
-      } catch (err) {
-        throw new SignatureVerificationError(
-          `signature verification threw: ${errorMessage(err)}`
-        );
-      }
-      if (!ok) {
-        throw new SignatureVerificationError(
-          "signature does not verify against configured verifyPubKey"
-        );
-      }
+      verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
     const data = parseJson(bodyBytes);
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
     return {
       verdict: normalizeVerdict(data.verdict),
-      allow: canonicalAllow(data),
+      allow: this.executable(data),
       actionType: normalizeActionType(data.action_type),
       reason: String(data.reason ?? ""),
       confidence: Number(data.confidence ?? 0),
@@ -3879,7 +3924,8 @@ var Atbash = class _Atbash {
       enforced: Boolean(data.enforced),
       enforcementMode: String(data.enforcement_mode ?? ""),
       status: String(data.status ?? ""),
-      score
+      score,
+      refusal: explicitRefusal(data)
     };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
@@ -3912,77 +3958,125 @@ var Atbash = class _Atbash {
     }
     try {
       this.logger.info?.("[atbash] judge API called", { tool: toolName });
-      const result = await this.judgeAction(actionText, contextText, {
-        toolName,
-        toolArgsJson: argsJson,
-        orgName: this.orgName,
-        // Passed through unredacted — caller vouches for the contents.
-        resolved: input.resolved
-      });
-      if (result.verdict === "No verdict") {
-        if (result.status !== "logged") {
-          return this.failJudge(
-            `judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`,
-            void 0,
-            result.toolCallId
-          );
-        }
-        return {
-          allow: true,
-          verdict: "ALLOW",
-          reason: result.reason || "audit tier \u2014 request logged on-chain, no AI enforcement",
-          toolCallId: result.toolCallId
-        };
-      }
-      const action = result.actionType;
-      if (action === "block") {
+      const result = await withDeadline(
+        this.judgeAction(actionText, contextText, {
+          toolName,
+          toolArgsJson: argsJson,
+          orgName: this.orgName,
+          // Passed through unredacted — caller vouches for the contents.
+          resolved: input.resolved
+        }),
+        this.decisionTimeoutMs
+      );
+      return this.decide(result);
+    } catch (err) {
+      if (err instanceof SignatureVerificationError) {
+        this.failJudge(errorMessage(err), err);
         return {
           allow: false,
-          verdict: "BLOCK",
-          reason: result.reason,
-          toolCallId: result.toolCallId
+          verdict: "ERROR",
+          reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
-      if (action === "hold_for_user_confirm") {
-        return {
-          allow: false,
-          verdict: "HOLD",
-          reason: result.reason || "held for human confirmation",
-          toolCallId: result.toolCallId
-        };
+      return this.failJudge(errorMessage(err), err);
+    }
+  }
+  /**
+   * The verify key for one call (R4, governor tier-2 review). A per-call key
+   * may only narrow what the client accepts: on a client pinned to a judge
+   * key it must be that same key, never a replacement; on an unpinned client
+   * it adds the check.
+   */
+  effectiveVerifyKey(perCall) {
+    if (perCall === void 0) return this.verifyPubKey;
+    const key3 = perCall.trim().toLowerCase();
+    if (this.verifyPubKey !== void 0 && key3 !== this.verifyPubKey) {
+      throw new SignatureVerificationError(
+        "a per-call verifyPubKey cannot replace the judge key this client is pinned to"
+      );
+    }
+    return key3;
+  }
+  /**
+   * Collapse a judge result into a {@link Decision}. The most restrictive
+   * signal wins (security review 2026-09-30, H1): `action_type`, `verdict`
+   * and the canonical `allow` are each able to deny, and only a result where
+   * all three agree may execute. A present `allow` / `decision.allow` that is
+   * not exactly `true` is the judge declining to grant permission, so it
+   * denies even under `failClosed: false` — that option relaxes *errors*, it
+   * never overrides a refusal.
+   */
+  decide(result) {
+    const toolCallId = result.toolCallId;
+    const deny = (verdict, reason) => ({
+      allow: false,
+      verdict,
+      reason,
+      toolCallId
+    });
+    const notGranted = "the judge response did not grant permission";
+    const held = deny("HOLD", result.reason || "held for human confirmation");
+    const blocked = deny("BLOCK", result.reason || notGranted);
+    if (result.refusal === "BLOCK") return blocked;
+    if (result.verdict === "No verdict") {
+      if (result.actionType === "block") {
+        return blocked;
+      }
+      if (result.actionType === "hold_for_user_confirm") {
+        return held;
+      }
+      if (result.refusal === "HOLD") return held;
+      if (result.status !== "logged") {
+        return this.failJudge(
+          `judge returned no verdict without an audit-tier marker (status: ${result.status || "absent"})`,
+          void 0,
+          toolCallId
+        );
       }
-      if (action === "allow") {
-        if (result.verdict === "HOLD") {
-          return {
-            allow: false,
-            verdict: "HOLD",
-            reason: result.reason,
-            toolCallId: result.toolCallId
-          };
-        }
-        if (result.verdict === "BLOCK") {
-          return {
-            allow: false,
-            verdict: "BLOCK",
-            reason: result.reason,
-            toolCallId: result.toolCallId
-          };
-        }
+      if (this.requireEnforcement) {
+        this.logger.warn?.(
+          "[atbash] judge did not enforce this action (audit tier) and requireEnforcement is on: denied",
+          { toolCallId }
+        );
         return {
-          allow: true,
-          verdict: "ALLOW",
-          reason: result.reason,
-          toolCallId: result.toolCallId
+          allow: false,
+          verdict: "ERROR",
+          reason: "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
+          toolCallId
         };
       }
-      return this.failJudge(
-        "unrecognized action_type from judge",
-        void 0,
-        result.toolCallId
-      );
-    } catch (err) {
-      return this.failJudge(errorMessage(err), err);
+      if (result.allow !== true) return deny("BLOCK", notGranted);
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: result.reason || "audit tier \u2014 request logged on-chain, no AI enforcement",
+        toolCallId
+      };
+    }
+    const action = result.actionType;
+    if (action === "block") {
+      return deny("BLOCK", result.reason || "Blocked by your organisation's Atbash policy.");
     }
+    if (action === "hold_for_user_confirm") {
+      return held;
+    }
+    if (result.refusal === "HOLD") return held;
+    if (action === "allow") {
+      if (result.verdict === "HOLD") return held;
+      if (result.verdict === "BLOCK") return blocked;
+      if (result.allow !== true) return deny("BLOCK", notGranted);
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: result.reason,
+        toolCallId
+      };
+    }
+    return this.failJudge(
+      "unrecognized action_type from judge",
+      void 0,
+      toolCallId
+    );
   }
   /**
    * One exit for every judge failure.
@@ -3994,18 +4088,30 @@ var Atbash = class _Atbash {
    */
   failJudge(reason, cause, toolCallId) {
     const api2 = cause instanceof AtbashAPIError ? cause : null;
+    const userReason = userFacingReason(reason, api2);
     const status = api2 ? ` status=${api2.status || "no-response"}` : "";
+    const detail = this.debug ? ` detail=${truncate(reason, 500)}` : "";
     const body = this.debug && api2?.body ? ` body=${truncate(api2.body, 500)}` : "";
     this.logger.warn?.(
-      `[atbash] judge API failed \u2014${status} reason=${truncate(reason, 300)}${body}`,
+      `[atbash] judge API failed \u2014${status} reason=${truncate(userReason, 300)}${detail}${body}`,
       {
-        reason,
-        ...api2 ? { status: api2.status, body: api2.body } : {},
+        reason: userReason,
+        ...api2 ? { status: api2.status } : {},
+        ...this.debug && api2 ? { body: api2.body, detail: reason } : {},
         endpoint: this.endpoint,
         ...toolCallId ? { toolCallId } : {}
       }
     );
-    return this.fail(reason, toolCallId);
+    return this.fail(userReason, toolCallId);
+  }
+  /**
+   * The canonical permission for a response body under this client's
+   * settings: {@link canonicalAllow}, minus the audit tier when
+   * `requireEnforcement` is on. Never more permissive than `auditToolCall`.
+   */
+  executable(data) {
+    if (!canonicalAllow(data)) return false;
+    return !(this.requireEnforcement && isAuditTierBody(data));
   }
   fail(reason, toolCallId) {
     return { allow: !this.failClosed, verdict: "ERROR", reason, toolCallId };
@@ -4031,11 +4137,16 @@ var Atbash = class _Atbash {
         this.authHeaders(brid)
       );
       await this.raiseIfError(resp);
-      const data = await this.json(resp) ?? {};
+      const bytes = Buffer.from(await resp.arrayBuffer());
+      if (this.verifyPubKey !== void 0) {
+        verifyResponseSignature(bytes, resp, this.verifyPubKey);
+      }
+      const parsed = tryParseJson(bytes.toString("utf-8"));
+      const data = isRecord2(parsed) ? parsed : {};
       return {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
-        allow: canonicalAllow(data),
+        allow: this.executable(data),
         reason: String(data.reason ?? ""),
         judgmentId: String(data.judgmentId ?? judgmentId),
         onChain: optBool(data.onChain),
@@ -4510,6 +4621,66 @@ var Atbash = class _Atbash {
     return native.containsEvasionCharacters(text);
   }
 };
+function userFacingReason(reason, api2) {
+  if (api2 && api2.status > 0) {
+    const where = ` (HTTP ${api2.status}${api2.path ? ` from ${api2.path}` : ""})`;
+    const b = api2.body.toLowerCase();
+    if (b.includes("agent not registered")) {
+      return `Agent not registered with Atbash: onboard it in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("jailed")) {
+      return `This agent is jailed; unjail it in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("agent has no policy") || b.includes("no policy configured")) {
+      return `This agent has no policy; attach one in the Atbash dashboard${where}.`;
+    }
+    if (b.includes("audit tier") || b.includes("verdict disabled") || b.includes("verdict not supported")) {
+      return `The organisation's plan does not include checked decisions${where}.`;
+    }
+    return `The Atbash judge answered with an error${where}, so the action was not approved.`;
+  }
+  const text = api2 ? api2.body || reason : reason;
+  return truncate(text.replace(/https?:\/\/[^\s)]+/g, "the judge"), 300);
+}
+var DEFAULT_DECISION_TIMEOUT_MS = 6e4;
+async function withDeadline(p, ms) {
+  let timer;
+  const deadline = new Promise((_, reject) => {
+    timer = setTimeout(
+      () => reject(
+        new Error(
+          `The judge did not give a decision within ${Math.round(ms / 1e3)} s, so the action was not approved. Check the network, or raise decisionTimeoutMs.`
+        )
+      ),
+      ms
+    );
+  });
+  p.catch(() => void 0);
+  try {
+    return await Promise.race([p, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function verifyResponseSignature(bodyBytes, resp, verifyPubKey) {
+  const sig = resp.headers.get("X-Atbash-Signature");
+  if (!sig) {
+    throw new SignatureVerificationError("missing X-Atbash-Signature header");
+  }
+  let ok;
+  try {
+    ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
+  } catch (err) {
+    throw new SignatureVerificationError(
+      `signature verification threw: ${errorMessage(err)}`
+    );
+  }
+  if (!ok) {
+    throw new SignatureVerificationError(
+      "signature does not verify against configured verifyPubKey"
+    );
+  }
+}
 function baseToolCall(raw2) {
   return {
     toolCallId: String(raw2.tool_call_id ?? ""),
@@ -4723,7 +4894,11 @@ async function scanMemory(entry, auth, opts) {
   const atbash = new Atbash(auth.privkey, {
     endpoint: opts?.endpoint,
     verifyPubKey: opts?.verifyPubKey,
-    orgName: opts?.orgName
+    orgName: opts?.orgName,
+    // Memory scans keep their existing audit-tier semantics (an audit-tier
+    // scan is not a defect the scanner invents). Whether an unenforced scan
+    // may commit memory is the memory-guard PR's decision, not H6's.
+    requireEnforcement: false
   });
   const result = await atbash.judgeAction(request.prompt, request.context, {
     toolName: opts?.toolName ?? "memory_write",
@@ -4759,6 +4934,7 @@ async function scanMemory(entry, auth, opts) {
       verdict = "yellow";
     }
   }
+  if (verdict === "green" && result.allow !== true) verdict = "red";
   const parsed = native.parseScoreFromReason(result.reason);
   const score = result.score ?? parsed.score ?? native.defaultScoreForVerdict(verdict);
   return {
@@ -42977,7 +43153,7 @@ async function commitMemoryVersion(plaintext, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ADD_AGENT_MEMORY,
       args: [
@@ -42990,6 +43166,9 @@ async function commitMemoryVersion(plaintext, auth, opts) {
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory transaction was not confirmed (status=${receipt.status})`);
+  }
 }
 async function decryptRow(row, key3) {
   const parsed = native.parseMemoryRow(gtvToFfiSafe(row));
@@ -43099,13 +43278,16 @@ async function rollbackMemory(toId, reason, auth, opts) {
   const chainOpts = await resolveChainOptsForOrg(opts, auth);
   const client = await buildChainClient(chainOpts);
   const { sigProvider } = buildSigner(auth);
-  await client.signAndSendUniqueTransaction(
+  const receipt = await client.signAndSendUniqueTransaction(
     {
       name: native.OP_ROLLBACK_AGENT_MEMORY,
       args: [toGtxBytes(args.agent_pubkey), args.to_id, args.reason]
     },
     sigProvider
   );
+  if (receipt.status !== index.ResponseStatus.Confirmed) {
+    throw new Error(`Memory rollback was not confirmed (status=${receipt.status})`);
+  }
 }
 
 // src-ts/memory/_json_safe.ts
@@ -43244,6 +43426,7 @@ async function guardMemoryWrite(input) {
     endpoint,
     verifyPubKey,
     orgName,
+    chainOpts,
     threshold,
     patterns,
     toolNames,
@@ -43300,23 +43483,41 @@ async function guardMemoryWrite(input) {
       committed: false
     };
   }
+  if (scanResult.verdict !== "green" && scanResult.verdict !== "yellow") {
+    const reason = "Memory scan returned an unrecognized verdict.";
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason } : { allow: true, reason },
+      scanResult,
+      committed: false
+    };
+  }
   const filePath = path3.basename(memEntry.key);
-  commitMemoryVersion(memEntry.value, auth, {
-    score: scanResult.score,
-    filePath,
-    orgName,
-    endpoint,
-    verifyPubKey
-  }).catch((err) => {
+  try {
+    await commitMemoryVersion(memEntry.value, auth, {
+      score: scanResult.score,
+      filePath,
+      orgName,
+      endpoint,
+      verifyPubKey,
+      chainOpts
+    });
+  } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     logger2?.warn?.("[atbash] memory commit to chain failed", {
       path: memEntry.key,
       filePath,
       reason
     });
-  });
+    return {
+      handled: true,
+      decision: enforce ? { allow: false, block: true, reason: `Memory commit failed: ${reason}` } : { allow: true, reason: `Memory commit failed: ${reason}` },
+      scanResult,
+      committed: false
+    };
+  }
   logger2?.info?.(
-    scanResult.verdict === "yellow" ? "[atbash] memory HOLD" : "[atbash] memory ALLOW",
+    scanResult.verdict === "yellow" ? "[atbash] memory ALLOW (yellow, low score)" : "[atbash] memory ALLOW",
     {
       path: memEntry.key,
       filePath,
@@ -43349,7 +43550,7 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
   if (withinTtl) {
     return { drifted: false, checked: false, pointer };
   }
-  const currentId = await getActiveMemoryId(auth, opts.chainOpts);
+  const currentId = await getActiveMemoryId(auth, opts.chainOpts, opts.filePath);
   const nextPointer = { activeId: currentId, checkedAt: now };
   if (currentId === pointer.activeId) {
     return { drifted: false, checked: true, pointer: nextPointer };
@@ -43431,13 +43632,16 @@ function formatMeta(meta) {
 }
 function createFileLogger(filePath, upstream) {
   let queue = Promise.resolve();
+  let writeError;
   async function ensureDir() {
     await fs2.mkdir(path5.dirname(filePath), { recursive: true });
   }
   function append(level, message, meta) {
     const line = `${(/* @__PURE__ */ new Date()).toISOString()} [${level}] ${message}${formatMeta(meta)}
 `;
-    queue = queue.then(ensureDir).then(() => fs2.appendFile(filePath, line, "utf8")).catch(() => {
+    queue = queue.then(ensureDir).then(() => fs2.appendFile(filePath, line, "utf8")).catch((error4) => {
+      writeError = error4 instanceof Error ? error4 : new Error(String(error4));
+      upstream?.warn("[atbash] plugin log write failed", { error: writeError.message });
     });
   }
   return {
@@ -43448,6 +43652,10 @@ function createFileLogger(filePath, upstream) {
     warn(message, meta) {
       upstream?.warn(message, meta ?? {});
       append("warn", message, meta);
+    },
+    async flush() {
+      await queue;
+      if (writeError) throw writeError;
     }
   };
 }
@@ -43537,7 +43745,15 @@ var MemoryGuardManager = class {
           orgName: this.opts.orgName
         });
         const resolved = await atbash.resolveChainForOrg(this.opts.orgName);
-        const chainOpts = { ...this.opts.chainOpts, network: resolved.network };
+        if (!await atbash.checkAgentExists(this.agentPubkeyHex, { network: resolved.network })) {
+          throw new Error(`agent is not registered on the resolved ${resolved.network} chain`);
+        }
+        const chainOpts = {
+          ...this.opts.chainOpts,
+          network: resolved.network,
+          blockchainRid: resolved.blockchainRid,
+          nodeUrls: this.opts.chainOpts?.nodeUrls ?? resolved.nodeUrls
+        };
         this._resolvedChainOpts = chainOpts;
         this.logger.info(
           `[atbash] resolved org \u2192 chain \u2014 org=${this.opts.orgName} network=${resolved.network}`
@@ -43546,9 +43762,9 @@ var MemoryGuardManager = class {
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
         this.logger.warn(
-          `[atbash] org \u2192 chain resolution failed (falling back to SDK default): ${msg}`
+          `[atbash] org \u2192 chain resolution failed (memory read will be blocked): ${msg}`
         );
-        return this.opts.chainOpts;
+        throw err;
       } finally {
         this._resolveChainInflight = void 0;
       }
@@ -43567,13 +43783,18 @@ var MemoryGuardManager = class {
       const result = await syncLocalMemory(this.opts.auth, seed, {
         ttlMs: 0,
         force: true,
-        chainOpts
+        chainOpts,
+        filePath: path6.basename(this.memoryFilePath)
       });
       if (!result.drifted && result.pointer.activeId == null) {
         this.logger.info(
           `[atbash] no active memory on chain for agent=${this.agentPubkeyHex.slice(0, 16)}\u2026 org=${this.opts.orgName ?? "(none)"} \u2014 either the agent isn't registered on this chain or hasn't written any memory. Sync will remain a no-op until a write lands.`
         );
       } else if (result.drifted && result.current) {
+        if (result.current.filePath !== path6.basename(this.memoryFilePath) || result.current.isActive !== true || result.current.decryptError) {
+          this.logger.warn("[atbash] boot sync REFUSED mismatched memory version");
+          return;
+        }
         if (result.current.score < this.rollbackMinScore) {
           this.logger.warn(
             `[atbash] boot sync REFUSED refresh \u2014 id=${result.current.id} score=${result.current.score} below threshold ${this.rollbackMinScore}. Leaving MEMORY.md and pointer untouched; next memory read will be blocked.`
@@ -43587,7 +43808,8 @@ var MemoryGuardManager = class {
           await this.writeMemoryAtomic(result.current.content);
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] boot sync write failed (serving whatever's on disk)", { error: msg });
+          this.logger.warn("[atbash] boot sync write failed; pointer remains unchanged", { error: msg });
+          return;
         }
       }
       await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
@@ -43601,9 +43823,9 @@ var MemoryGuardManager = class {
   }
   /**
    * Returns a `HookDecision` when the guard reached a decision about this event.
-   * Returns `null` when it did not — either the event isn't memory-related, or it
-   * is but the guard could not check it. In both cases the host falls through to
-   * its own audit.
+   * Returns `null` for non-memory events, other files this manager does not
+   * own, or unverified observe-mode reads. An enforced read of the managed
+   * file blocks when verification cannot complete.
    *
    * A returned decision carries `audited` (see `HookDecision`). Only
    * `{ allow: true, audited: true }` means "checked and cleared"; anything else
@@ -43639,6 +43861,7 @@ var MemoryGuardManager = class {
       endpoint: this.opts.judgeEndpoint,
       verifyPubKey: this.opts.judgeVerifyPubKey,
       orgName: this.opts.orgName,
+      chainOpts: this.opts.chainOpts,
       patterns: this.opts.memoryPathPatterns,
       toolNames: this.opts.memoryWriteToolNames,
       enforce: this.enforce,
@@ -43683,6 +43906,14 @@ var MemoryGuardManager = class {
         reason: `memory scan returned ${sr2.verdict} but this guard is not enforcing it`
       };
     }
+    if (guard.committed !== true) {
+      return {
+        allow: true,
+        audited: false,
+        verdict: sr2.verdict,
+        reason: "memory scan passed but chain commit did not confirm"
+      };
+    }
     return { allow: true, audited: true, verdict: sr2.verdict };
   }
   /**
@@ -43717,62 +43948,73 @@ var MemoryGuardManager = class {
     return found.every((p) => path6.resolve(p) === managed);
   }
   async handleMemoryRead(event, ctx) {
+    if (!this.vouchesForTarget(event, ctx)) return null;
     const pointer = await this.pointerStore.get(this.agentPubkeyHex);
     let result;
+    let chainOpts;
     try {
-      const chainOpts = await this.resolveChainOpts();
+      chainOpts = await this.resolveChainOpts();
       result = await syncLocalMemory(this.opts.auth, pointer, {
         ttlMs: this.ttlMs,
-        chainOpts
+        force: this.enforce,
+        chainOpts,
+        filePath: path6.basename(this.memoryFilePath)
       });
     } catch (err) {
       if (err instanceof MemoryIntegrityError) {
         const reason = `Memory integrity check failed on id ${err.id} \u2014 read blocked.`;
         this.logger.warn("[atbash] MEMORY INTEGRITY FAILURE", { id: err.id, error: err.message });
-        if (!this.enforce) return null;
-        return { block: true, blockReason: reason, allow: false, reason, audited: true };
+        return this.unverifiedRead(reason);
       }
       const msg = err instanceof Error ? err.message : String(err);
-      this.logger.warn("[atbash] memory sync failed (serving local copy)", { error: msg });
-      return null;
+      this.logger.warn("[atbash] memory sync failed", { error: msg });
+      return this.unverifiedRead(`Memory chain sync failed: ${msg}`);
     }
-    let onDiskIsCurrent = result.checked;
-    if (result.drifted) {
-      const fresh = result.current;
-      if (fresh) {
-        if (fresh.score < this.rollbackMinScore) {
-          const reason = `Rolled-back memory version #${fresh.id} scored ${fresh.score} (below threshold ${this.rollbackMinScore}) \u2014 read blocked.`;
-          this.logger.warn("[atbash] blocking read on low-score rollback", { id: fresh.id, score: fresh.score });
-          if (!this.enforce) return null;
-          return { block: true, blockReason: reason, allow: false, reason, audited: true };
-        }
-        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", {
-          id: fresh.id,
-          score: fresh.score
-        });
-        try {
-          await this.writeMemoryAtomic(fresh.content);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          this.logger.warn("[atbash] failed to write refreshed memory (serving old)", { error: msg });
-          onDiskIsCurrent = false;
-        }
-      } else {
-        this.logger.info("[atbash] active memory removed on chain", { pubkey: this.agentPubkeyHex });
-        onDiskIsCurrent = false;
-      }
+    if (!result.checked) return this.unverifiedRead("Memory chain state was not checked.");
+    const activeId = result.pointer.activeId;
+    if (activeId === null) {
+      return this.unverifiedRead("No active chain version exists for the managed memory file.");
     }
-    if (onDiskIsCurrent) {
-      await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
-    } else {
-      this.logger.warn(
-        "[atbash] not advancing memory pointer \u2014 local file is stale or revoked; reads stay unaudited until it is refreshed"
-      );
+    let active;
+    try {
+      active = result.drifted ? result.current : await getMemoryById(activeId, this.opts.auth, chainOpts);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] active memory row could not be verified", { error: msg });
+      return this.unverifiedRead(`Memory version could not be verified: ${msg}`);
     }
-    if (!onDiskIsCurrent) return null;
-    if (!this.vouchesForTarget(event, ctx)) return null;
+    const filePath = path6.basename(this.memoryFilePath);
+    if (!active || active.id !== activeId || active.filePath !== filePath || active.isActive !== true || active.decryptError) {
+      return this.unverifiedRead("Active memory version does not match the managed file.");
+    }
+    if (active.score < this.rollbackMinScore) {
+      return this.unverifiedRead(`Memory version #${active.id} is below the minimum safety score.`);
+    }
+    try {
+      if (result.drifted) {
+        this.logger.info("[atbash] memory drift detected \u2014 refreshing local file", { id: active.id });
+        await this.writeMemoryAtomic(active.content);
+      }
+      const onDisk = await fs3.readFile(this.memoryFilePath, "utf8");
+      if (onDisk !== active.content) {
+        return this.unverifiedRead("Local memory bytes do not match the active chain version.");
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      this.logger.warn("[atbash] managed memory file could not be verified", { error: msg });
+      return this.unverifiedRead(`Managed memory file could not be verified: ${msg}`);
+    }
+    await this.pointerStore.set(this.agentPubkeyHex, result.pointer);
     return { allow: true, audited: true };
   }
+  /** Complete queued audit-log writes before a host shuts down or removes its workspace. */
+  async flushLogs() {
+    await this.logger.flush();
+  }
+  unverifiedRead(reason) {
+    if (!this.enforce) return null;
+    return { block: true, blockReason: reason, allow: false, reason, audited: true };
+  }
   async writeMemoryAtomic(content) {
     await fs3.mkdir(path6.dirname(this.memoryFilePath), { recursive: true });
     const tmp = `${this.memoryFilePath}.${process.pid}.tmp`;