@atbash/sdk 0.19.2-dev.0 → 0.21.0-dev.0

package/dist/index.js

@@ -33,8 +33,6 @@ __export(src_ts_exports, {
   Atbash: () => Atbash,
   AtbashAPIError: () => AtbashAPIError,
   BOOT_SYNC_HINT: () => BOOT_SYNC_HINT,
-  DEFAULT_BLOCKCHAIN_RID: () => DEFAULT_BLOCKCHAIN_RID,
-  DEFAULT_CHROMIA_NODE_URLS: () => DEFAULT_CHROMIA_NODE_URLS,
   DEFAULT_ENDPOINT: () => DEFAULT_ENDPOINT,
   DEFAULT_MEMORY_PATH_PATTERNS: () => DEFAULT_MEMORY_PATH_PATTERNS,
   DEFAULT_MEMORY_READ_TOOL_NAMES: () => DEFAULT_MEMORY_READ_TOOL_NAMES,
@@ -42,11 +40,11 @@ __export(src_ts_exports, {
   EciesDomain: () => EciesDomain,
   HttpClient: () => HttpClient,
   HttpTransportError: () => HttpTransportError,
+  JudgeRefusalError: () => JudgeRefusalError,
   KEY_FILENAMES: () => KEY_FILENAMES,
   MemoryGuardManager: () => MemoryGuardManager,
   MemoryIntegrityError: () => MemoryIntegrityError,
   PRIVATE_CHAIN: () => PRIVATE_CHAIN,
-  PUBLIC_CHAIN: () => PUBLIC_CHAIN,
   PointerStore: () => PointerStore,
   SignatureVerificationError: () => SignatureVerificationError,
   bootSyncFailureLine: () => bootSyncFailureLine,
@@ -60,6 +58,7 @@ __export(src_ts_exports, {
   columnAad: () => columnAad,
   commitMemoryVersion: () => commitMemoryVersion,
   configureEvents: () => configureEvents,
+  configureJailHold: () => configureJailHold,
   containsEvasionCharacters: () => containsEvasionCharacters,
   containsSecret: () => containsSecret,
   createFileLogger: () => createFileLogger,
@@ -88,12 +87,14 @@ __export(src_ts_exports, {
   getRollbackHistory: () => getRollbackHistory,
   guardMemoryWrite: () => guardMemoryWrite,
   isEnvelope: () => isEnvelope,
+  isJailHeld: () => isJailHeld,
   isValidPrivateKey: () => isValidPrivateKey,
   keyFingerprintOf: () => keyFingerprintOf,
   keyPathCandidates: () => keyPathCandidates,
   loadAgent: () => loadAgent,
   loadAgentFromFile: () => loadAgentFromFile,
   loadUserConfig: () => loadUserConfig,
+  memorySlotOf: () => memorySlotOf,
   normalizeActionForHash: () => normalizeActionForHash,
   normalizeActionType: () => normalizeActionType,
   normalizeForMatching: () => normalizeForMatching,
@@ -107,6 +108,7 @@ __export(src_ts_exports, {
   recordEvent: () => recordEvent,
   redactJsonStrings: () => redactJsonStrings,
   redactSecrets: () => redactSecrets,
+  releaseJailHolds: () => releaseJailHolds,
   resolve: () => resolve,
   resolveKeyPath: () => resolveKeyPath,
   rollbackMemory: () => rollbackMemory,
@@ -170,32 +172,28 @@ function agentAuthHeaders(auth, blockchainRid) {
   return { Authorization: `Bearer ${agentAuthBearer(auth, blockchainRid)}` };
 }
 
-// src-ts/constants.ts
-var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
-var DEFAULT_CHROMIA_NODE_URLS = Object.freeze(
-  native.defaultChromiaNodeUrls()
-);
-var DEFAULT_BLOCKCHAIN_RID = native.DEFAULT_BLOCKCHAIN_RID;
-
 // src-ts/chain-config.ts
 var DEFAULT_PRIVATE_NODE_URLS = Object.freeze(
   native.defaultPrivateNodeUrls()
 );
 var DEFAULT_PRIVATE_BLOCKCHAIN_RID = native.DEFAULT_PRIVATE_BLOCKCHAIN_RID;
-var PUBLIC_CHAIN = {
-  network: "public",
-  blockchainRid: DEFAULT_BLOCKCHAIN_RID,
-  nodeUrls: DEFAULT_CHROMIA_NODE_URLS
-};
 var PRIVATE_CHAIN = {
   network: "private",
   blockchainRid: DEFAULT_PRIVATE_BLOCKCHAIN_RID,
   nodeUrls: DEFAULT_PRIVATE_NODE_URLS
 };
 function chainForNetwork(network) {
-  return network === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+  if (network !== "private") {
+    throw new Error(
+      `network must be "private" (the public chain is retired), got ${JSON.stringify(network)}`
+    );
+  }
+  return PRIVATE_CHAIN;
 }
 
+// src-ts/constants.ts
+var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
+
 // src-ts/encrypted-toolcall.ts
 function columnAad(toolCallId, column) {
   return `${toolCallId}:${column}`;
@@ -293,12 +291,12 @@ var AtbashAPIError = class extends Error {
    * ran does not carry. The path is the fact that settles it.
    */
   path;
-  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path5) {
-    super(enrich(status, body, statusText, endpoint, path5));
+  constructor(status, body, statusText = "", endpoint = DEFAULT_ENDPOINT, path4) {
+    super(enrich(status, body, statusText, endpoint, path4));
     this.name = "AtbashAPIError";
     this.status = status;
     this.body = body;
-    this.path = path5;
+    this.path = path4;
   }
 };
 var SignatureVerificationError = class extends Error {
@@ -307,9 +305,18 @@ var SignatureVerificationError = class extends Error {
     this.name = "SignatureVerificationError";
   }
 };
-function enrich(status, body, statusText, endpoint, path5) {
+var JudgeRefusalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "JudgeRefusalError";
+  }
+};
+function isRefusalStatus(status) {
+  return status >= 400 && status < 500 && status !== 408;
+}
+function enrich(status, body, statusText, endpoint, path4) {
   const dashboard = endpoint.replace(/\/+$/, "") || DEFAULT_ENDPOINT;
-  let msg = `API error ${status}${path5 ? ` from ${path5}` : ""}: ${body || statusText}`;
+  let msg = `API error ${status}${path4 ? ` from ${path4}` : ""}: ${body || statusText}`;
   const lowered = body.toLowerCase();
   if (lowered.includes("agent not registered")) {
     msg += `
@@ -330,6 +337,61 @@ function enrich(status, body, statusText, endpoint, path5) {
   return msg;
 }
 
+// src-ts/jail-hold.ts
+var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
+var holds = /* @__PURE__ */ new Map();
+var blockedAt = /* @__PURE__ */ new Map();
+var BLOCK_MEMORY_MS = 10 * 6e4;
+var config = { ...DEFAULTS };
+function isJailHeld(pubkey) {
+  return holds.has(pubkey);
+}
+function recordBlock(pubkey) {
+  const now = Date.now();
+  for (const [key, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key);
+  blockedAt.set(pubkey, now);
+}
+function blockedSince(pubkey, startedAt) {
+  const at = blockedAt.get(pubkey);
+  return at !== void 0 && startedAt <= at;
+}
+function holdJail(pubkey, confirmJailed, onGiveUp) {
+  if (holds.has(pubkey)) return;
+  const hold = { timer: null };
+  holds.set(pubkey, hold);
+  const deadline = Date.now() + config.ceilingMs;
+  const tick = async () => {
+    if (holds.get(pubkey) !== hold) return;
+    let jailed = false;
+    try {
+      jailed = await confirmJailed();
+    } catch {
+    }
+    if (holds.get(pubkey) !== hold) return;
+    if (jailed) {
+      holds.delete(pubkey);
+      return;
+    }
+    if (Date.now() >= deadline) {
+      holds.delete(pubkey);
+      onGiveUp?.();
+      return;
+    }
+    const timer = setTimeout(() => void tick(), config.pollMs);
+    timer.unref?.();
+    hold.timer = timer;
+  };
+  void tick();
+}
+function releaseJailHolds() {
+  for (const hold of holds.values()) if (hold.timer) clearTimeout(hold.timer);
+  holds.clear();
+  blockedAt.clear();
+}
+function configureJailHold(next) {
+  config = { ...DEFAULTS, ...next };
+}
+
 // src-ts/http/client.ts
 var HttpClient = class {
   baseUrl;
@@ -338,8 +400,8 @@ var HttpClient = class {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.timeoutMs = timeoutMs;
   }
-  buildUrl(path5, query) {
-    const url = new URL(this.baseUrl + path5);
+  buildUrl(path4, query) {
+    const url = new URL(this.baseUrl + path4);
     if (query) {
       for (const [k, v] of Object.entries(query)) {
         if (v !== void 0 && v !== null && v !== "") {
@@ -349,14 +411,14 @@ var HttpClient = class {
     }
     return url.toString();
   }
-  async get(path5, query, headers) {
-    return this.fetch(this.buildUrl(path5, query), {
+  async get(path4, query, headers) {
+    return this.fetch(this.buildUrl(path4, query), {
       method: "GET",
       ...headers && { headers }
     });
   }
-  async post(path5, body, headers) {
-    return this.fetch(this.buildUrl(path5), {
+  async post(path4, body, headers) {
+    return this.fetch(this.buildUrl(path4), {
       method: "POST",
       headers: { "Content-Type": "application/json", ...headers },
       body: JSON.stringify(body)
@@ -674,7 +736,7 @@ var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
 var import_exporter_logs_otlp_http = require("@opentelemetry/exporter-logs-otlp-http");
 var import_sdk_logs = require("@opentelemetry/sdk-logs");
 var import_node_crypto = require("crypto");
-var SDK_VERSION = true ? "0.19.2-dev.0" : "";
+var SDK_VERSION = true ? "0.21.0-dev.0" : "";
 var SDK_LANGUAGE = "node";
 function sdkResourceAttributes() {
   const attrs = {
@@ -705,8 +767,8 @@ function isTelemetryOptedOut() {
     const filePath = (0, import_node_path2.join)(home2, ".config", "atbash", "telemetry.json");
     const raw = (0, import_node_fs2.readFileSync)(filePath, "utf-8").trim();
     if (!raw) return false;
-    const config = JSON.parse(raw);
-    return config.enabled === false;
+    const config2 = JSON.parse(raw);
+    return config2.enabled === false;
   } catch {
     return false;
   }
@@ -751,26 +813,26 @@ function customCollector() {
   }
   return { url: url.replace(/\/+$/, ""), headers: () => headers };
 }
-function setupTelemetry(config) {
-  if (!config.enabled) return;
+function setupTelemetry(config2) {
+  if (!config2.enabled) return;
   if (isTelemetryOptedOut()) return;
-  if (config.source && !sourceExplicitlySet && SOURCE_SHAPE.test(config.source)) {
-    defaultSource = config.source;
+  if (config2.source && !sourceExplicitlySet && SOURCE_SHAPE.test(config2.source)) {
+    defaultSource = config2.source;
     sourceExplicitlySet = true;
   }
-  if (config.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
-    requestedExportIntervalMs = config.exportIntervalMs;
+  if (config2.exportIntervalMs !== void 0 && requestedExportIntervalMs === void 0) {
+    requestedExportIntervalMs = config2.exportIntervalMs;
   }
   if (meterProvider) return;
   const collector = customCollector();
-  if (!collector && (!config.endpoint || !config.getAuthHeaders)) return;
+  if (!collector && (!config2.endpoint || !config2.getAuthHeaders)) return;
   if (!collector && /^https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:|\/|$)/i.test(
-    config.endpoint
+    config2.endpoint
   ))
     return;
   const destination = collector ?? {
-    url: `${config.endpoint.replace(/\/+$/, "")}/api/telemetry`,
-    headers: () => config.getAuthHeaders()
+    url: `${config2.endpoint.replace(/\/+$/, "")}/api/telemetry`,
+    headers: () => config2.getAuthHeaders()
   };
   const proxyUrl = destination.url;
   const exporter = new import_exporter_metrics_otlp_http.OTLPMetricExporter({
@@ -805,7 +867,7 @@ function setupTelemetry(config) {
     description: "SDK function execution duration",
     unit: "ms"
   });
-  counterHasher = config.hashAgentKey ?? defaultAgentKeyHasher;
+  counterHasher = config2.hashAgentKey ?? defaultAgentKeyHasher;
   const logExporter = new import_exporter_logs_otlp_http.OTLPLogExporter({
     // A real collector takes OTLP at its own signal paths; the Atbash proxy
     // takes a query parameter, because it is one authenticated route.
@@ -824,8 +886,8 @@ function setupTelemetry(config) {
     });
   }
   configureEvents(loggerProvider.getLogger("atbash-sdk"), {
-    source: sourceOrDefault(config.source),
-    hashAgentKey: config.hashAgentKey ?? defaultAgentKeyHasher,
+    source: sourceOrDefault(config2.source),
+    hashAgentKey: config2.hashAgentKey ?? defaultAgentKeyHasher,
     version: SDK_VERSION
   });
 }
@@ -897,13 +959,13 @@ function loadUserConfig() {
     return {};
   }
 }
-function saveUserConfig(config) {
+function saveUserConfig(config2) {
   const dir = getConfigDir();
   if (!(0, import_node_fs3.existsSync)(dir)) {
     (0, import_node_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
   }
   const filePath = getConfigPath();
-  (0, import_node_fs3.writeFileSync)(filePath, JSON.stringify(config, null, 2) + "\n", {
+  (0, import_node_fs3.writeFileSync)(filePath, JSON.stringify(config2, null, 2) + "\n", {
     mode: 384
   });
   (0, import_node_fs3.chmodSync)(filePath, 384);
@@ -929,15 +991,16 @@ function resolve(key, flagValue) {
 function forcedChainNetwork(flagValue) {
   const raw = resolve("defaultChainNetwork", flagValue);
   if (!raw) return void 0;
-  if (raw !== "public" && raw !== "private") {
+  if (raw !== "private") {
     throw new Error(
-      `ATBASH_DEFAULT_CHAIN_NETWORK / defaultChainNetwork must be "public" or "private", got ${JSON.stringify(raw)} \u2014 unset it to let each org's chain decide.`
+      `ATBASH_DEFAULT_CHAIN_NETWORK / defaultChainNetwork must be "private" (the public chain is retired), got ${JSON.stringify(raw)} \u2014 unset it to let each org's chain decide.`
     );
   }
   return raw;
 }
 
 // src-ts/client.ts
+var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
 function generateToolCallId() {
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
@@ -947,15 +1010,13 @@ function resolveConstructorChain(options) {
   const hasBrid = options.blockchainRid !== void 0;
   if (hasNodeUrls !== hasBrid) {
     throw new Error(
-      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PUBLIC_CHAIN | PRIVATE_CHAIN` or `network: "public" | "private"`.'
+      'nodeUrls and blockchainRid must be provided together \u2014 passing one without the other 404s every chain request. Prefer `chain: PRIVATE_CHAIN` or `network: "private"`.'
     );
   }
   if (hasNodeUrls && hasBrid) {
-    const brid = options.blockchainRid;
-    const derivedNetwork = options.network ?? (brid === PUBLIC_CHAIN.blockchainRid ? "public" : brid === PRIVATE_CHAIN.blockchainRid ? "private" : "private");
     return {
-      network: derivedNetwork,
-      blockchainRid: brid,
+      network: "private",
+      blockchainRid: options.blockchainRid,
       nodeUrls: options.nodeUrls
     };
   }
@@ -1095,10 +1156,9 @@ var Atbash = class _Atbash {
     _Atbash.environmentLogged = true;
     const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
     this.logger.info?.(
-      `[atbash] environment \u2014 judge=${this.endpoint} publicChain=${brief(native.DEFAULT_BLOCKCHAIN_RID)} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
       {
         judgeEndpoint: this.endpoint,
-        publicBlockchainRid: native.DEFAULT_BLOCKCHAIN_RID,
         privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
         activeBlockchainRid: this.blockchainRid,
         responseSignatureCheck: Boolean(this.verifyPubKey)
@@ -1286,6 +1346,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * return the signed tx hex. The server broadcasts to chain.
    */
   async logToolCall(action, context = "", options = {}) {
+    return this._logToolCall(action, context, options, false);
+  }
+  /**
+   * `raisePreflightErrors` (the judge path, like Python's
+   * `raise_preflight_errors`): a failed registration check throws instead of
+   * becoming `{ success: false }`, so the caller can tell Atbash's "no"
+   * (not registered, or a 4xx) from an outage.
+   */
+  async _logToolCall(action, context, options, raisePreflightErrors) {
     const start = performance.now();
     recordCall("logToolCall", void 0, this.auth.pubkey);
     let exists;
@@ -1295,18 +1364,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       });
     } catch (err) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw err;
       return { success: false, toolCallId: null, error: errorMessage(err) };
     }
     if (!exists) {
       recordDuration("logToolCall", performance.now() - start, "error");
+      if (raisePreflightErrors) throw new JudgeRefusalError(AGENT_NOT_REGISTERED);
       return {
         success: false,
         toolCallId: null,
-        error: "Agent not registered. Onboard the agent at the dashboard before submitting actions."
+        error: AGENT_NOT_REGISTERED
       };
     }
     const toolCallId = generateToolCallId();
-    const brid = options.chainOpts?.blockchainRid || options.chainOpts?.network ? this.bridFromChainOpts(options.chainOpts) : await this.defaultOrgBrid() ?? this.blockchainRid;
+    const brid = await this.callBrid(options.chainOpts);
     const orgKey = options.orgEncryptionPubKey ?? this.orgEncryptionPubKey ?? this._orgKeyFromChain;
     try {
       const signedHex = orgKey ? signEncryptedToolCall(
@@ -1356,9 +1427,13 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
+    if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
+    const startedAt = Date.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
-      chainOpts = options.chainOpts ?? { network: this._defaultChain.network };
+      chainOpts = options.chainOpts ?? {
+        blockchainRid: this._defaultChain.blockchainRid
+      };
     } else if (options.orgName && this.forcedNetwork()) {
       chainOpts = { network: this.forcedNetwork() };
     } else if (options.orgName) {
@@ -1368,8 +1443,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       } else {
         const mapNetwork = await this.getActiveNetworkForOrg(options.orgName);
         if (mapNetwork) {
-          const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-          this._chainCache.set(options.orgName, chain);
+          this._chainCache.set(options.orgName, chainForNetwork(mapNetwork));
           chainOpts = { network: mapNetwork };
         } else if (!chainOpts?.blockchainRid) {
           const resolved = await this.resolveChainFromMap(
@@ -1380,12 +1454,13 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         }
       }
     }
-    const brid = this.bridFromChainOpts(chainOpts);
-    const logResult = await this.logToolCall(action, context, {
-      toolName: options.toolName,
-      toolArgsJson: options.toolArgsJson,
-      chainOpts
-    });
+    const brid = await this.callBrid(chainOpts);
+    const logResult = await this._logToolCall(
+      action,
+      context,
+      { toolName: options.toolName, toolArgsJson: options.toolArgsJson, chainOpts },
+      true
+    );
     if (!logResult.success || !logResult.toolCallId || !logResult.signedHex) {
       throw new Error(logResult.error || "Failed to sign log_tool_call");
     }
@@ -1422,10 +1497,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (verifyPubKey !== void 0) {
       verifyResponseSignature(bodyBytes, resp, verifyPubKey);
     }
-    const data = parseJson(bodyBytes);
+    const parsed = tryParseJson(bodyBytes.toString("utf-8"));
+    if (!isRecord2(parsed)) {
+      throw new JudgeRefusalError(
+        "The judge's reply could not be read, so the action was not approved."
+      );
+    }
+    const data = parsed;
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
-    return {
+    const result = {
       verdict: normalizeVerdict(data.verdict),
       allow: this.executable(data),
       actionType: normalizeActionType(data.action_type),
@@ -1441,6 +1522,45 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       score,
       refusal: explicitRefusal(data)
     };
+    return this.applyJailHold(result, startedAt);
+  }
+  /**
+   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
+   * Refuse any other result that lands while the agent is held, or whose
+   * request was already in flight when the block arrived: the server judged it
+   * on pre-jail state.
+   */
+  applyJailHold(result, startedAt) {
+    const pubkey = this.auth.pubkey;
+    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+      recordBlock(pubkey);
+      holdJail(
+        pubkey,
+        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+      );
+      return result;
+    }
+    return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
+  }
+  /** The server's jailed refusal, produced locally while the agent is held. */
+  localJailBlock(toolCallId = generateToolCallId()) {
+    return {
+      verdict: "BLOCK",
+      allow: false,
+      actionType: "block",
+      reason: "Agent is jailed. All actions are blocked until the organization owner unjails this agent.",
+      confidence: 1,
+      provider: "policy",
+      latencyMs: 0,
+      toolCallId,
+      onChain: false,
+      enforced: true,
+      enforcementMode: "enforce",
+      status: "",
+      score: void 0,
+      refusal: "BLOCK"
+    };
   }
   /* ── audit_tool_call (redact → judge → decision) ───────────────────────── */
   /**
@@ -1492,6 +1612,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
           reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
         };
       }
+      if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
+        return { ...this.failJudge(errorMessage(err), err), allow: false };
+      }
       return this.failJudge(errorMessage(err), err);
     }
   }
@@ -1521,6 +1644,15 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
+    const inner = this.decideInner(result);
+    if (!result.enforcementMode) return inner;
+    return {
+      ...inner,
+      enforced: result.enforced,
+      enforcementMode: result.enforcementMode
+    };
+  }
+  decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
       allow: false,
@@ -1634,17 +1766,17 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   /**
    * Return the current status of a previously submitted judgment.
    *
-   * `chainOpts` names which chain the judgment was signed against. The
-   * server's GET /api/v1/judge routes to that chain when the SDK sends
-   * a `brid` query param; without it, the server falls back to public.
-   * Callers on the private chain must pass a `chainOpts` (or configure
-   * the client on the private chain) — otherwise polling a POSTed
-   * judgment on the private chain 404s at the server.
+   * `chainOpts` names which chain the judgment was signed against; the SDK
+   * sends it as the `brid` query param the server routes by. Without it the
+   * read uses the same chain `judgeAction` signs for (see `callBrid`): the
+   * client's org chain when it has an `orgName`, else the client default.
+   * A judgment signed with an explicit per-call `chainOpts` (or a per-call
+   * `orgName` on another chain) must be polled with that same `chainOpts`.
    */
   async getJudgmentStatus(judgmentId, agentPubkey, chainOpts) {
     const pk = agentPubkey ?? this.auth.pubkey;
-    const brid = this.bridFromChainOpts(chainOpts);
     return this.track("getJudgmentStatus", pk, async () => {
+      const brid = await this.callBrid(chainOpts);
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
@@ -1849,21 +1981,16 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     }
     if (resp.status !== 200) throw await this.httpError(resp);
     const data = await this.json(resp);
-    if (data?.network === "public" || data?.network === "private") {
-      return data.network;
-    }
+    if (data?.network === "private") return data.network;
     return null;
   }
   /**
    * Resolve which chain an org's actions should run against. Cached
    * per-client by orgName. Resolution order:
    *   1. `org_networks` map (authoritative).
-   *   2. Per-chain subscription fallback — public + private records
-   *      are fetched in parallel, with `is_private_blockchain` and
-   *      `assigned_at` reconciling mixed states.
-   * A lookup that names exactly one chain wins outright. Where it names
-   * neither (a brand-new org) or cannot choose between them, the client's
-   * configured default decides.
+   *   2. Subscription fallback — the org's subscription row on the chain.
+   * A lookup that finds the org wins outright. Where it finds nothing (a
+   * brand-new org), the client's configured default decides.
    */
   async resolveChainForOrg(orgName) {
     const name = orgName.trim();
@@ -1885,35 +2012,14 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const cached = this._chainCache.get(orgName);
     if (cached) return cached;
     if (mapNetwork) {
-      const chain = mapNetwork === "private" ? PRIVATE_CHAIN : PUBLIC_CHAIN;
-      this._chainCache.set(orgName, chain);
-      return chain;
-    }
-    const [pubRes, privRes] = await Promise.allSettled([
-      this.getOrgSubscription(orgName, "public"),
-      this.getOrgSubscription(orgName, "private")
-    ]);
-    const pubSub = pubRes.status === "fulfilled" ? pubRes.value : null;
-    const privSub = privRes.status === "fulfilled" ? privRes.value : null;
-    const failure2 = pubRes.status === "rejected" ? pubRes.reason : privRes.status === "rejected" ? privRes.reason : null;
-    if (pubSub?.is_private_blockchain) {
-      this._chainCache.set(orgName, PRIVATE_CHAIN);
-      return PRIVATE_CHAIN;
-    }
-    if (pubSub && privSub) {
-      const chain = privSub.assigned_at === pubSub.assigned_at ? this._defaultChain : privSub.assigned_at > pubSub.assigned_at ? PRIVATE_CHAIN : PUBLIC_CHAIN;
+      const chain = chainForNetwork(mapNetwork);
       this._chainCache.set(orgName, chain);
       return chain;
     }
-    if (pubSub) {
-      this._chainCache.set(orgName, PUBLIC_CHAIN);
-      return PUBLIC_CHAIN;
-    }
-    if (privSub?.is_private_blockchain) {
-      this._chainCache.set(orgName, PRIVATE_CHAIN);
-      return PRIVATE_CHAIN;
-    }
-    if (failure2) {
+    let privSub;
+    try {
+      privSub = await this.getOrgSubscription(orgName, "private");
+    } catch (failure2) {
       const detail = failure2 instanceof Error ? failure2.message : String(failure2);
       throw new AtbashAPIError(
         failure2 instanceof AtbashAPIError ? failure2.status : 0,
@@ -1922,6 +2028,10 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         this.endpoint
       );
     }
+    if (privSub) {
+      this._chainCache.set(orgName, PRIVATE_CHAIN);
+      return PRIVATE_CHAIN;
+    }
     this._chainCache.set(orgName, this._defaultChain);
     return this._defaultChain;
   }
@@ -1978,10 +2088,21 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    */
   bridFromChainOpts(chainOpts) {
     if (chainOpts?.blockchainRid) return chainOpts.blockchainRid;
-    if (chainOpts?.network === "private") return PRIVATE_CHAIN.blockchainRid;
-    if (chainOpts?.network === "public") return PUBLIC_CHAIN.blockchainRid;
+    if (chainOpts?.network) return chainForNetwork(chainOpts.network).blockchainRid;
     return this.blockchainRid;
   }
+  /**
+   * The chain one call's transactions are signed for: the per-call override
+   * when given, otherwise the client's org, otherwise the client default.
+   * log_tool_call, judge_action and the judgment-status read all use this, so
+   * a request never pairs transactions signed for two different chains.
+   */
+  async callBrid(chainOpts) {
+    if (chainOpts?.blockchainRid || chainOpts?.network) {
+      return this.bridFromChainOpts(chainOpts);
+    }
+    return await this.defaultOrgBrid() ?? this.blockchainRid;
+  }
   /**
    * Resolve the dashboard chain used by agent metadata/policy reads.
    * Explicit per-call network overrides win; otherwise use the supplied org
@@ -2027,8 +2148,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
   async riskEnginePost(body, network, brid) {
     let resp;
     try {
-      const path5 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
-      resp = await this.http.post(path5, body, this.authHeaders(brid));
+      const path4 = network ? `/api/risk-engine?network=${encodeURIComponent(network)}` : "/api/risk-engine";
+      resp = await this.http.post(path4, body, this.authHeaders(brid));
     } catch (err) {
       throw this.transportError(err);
     }
@@ -2289,10 +2410,6 @@ function tryParseJson(text) {
     return void 0;
   }
 }
-function parseJson(bytes) {
-  const parsed = tryParseJson(bytes.toString("utf-8"));
-  return parsed === void 0 ? {} : parsed;
-}
 function requestPath(url) {
   if (!url) return void 0;
   try {
@@ -2568,13 +2685,13 @@ function resolveBlockchainRid(chainOpts) {
   if (chainOpts?.blockchainRid !== void 0) return chainOpts.blockchainRid;
   if (chainOpts?.nodeUrls !== void 0) {
     throw new Error(
-      'chainOpts.nodeUrls no longer selects a chain on its own \u2014 memory reaches the chain through the Atbash service, not a node. Set `blockchainRid`, or `network: "public" | "private"`.'
+      'chainOpts.nodeUrls no longer selects a chain on its own \u2014 memory reaches the chain through the Atbash service, not a node. Set `blockchainRid`, or `network: "private"`.'
     );
   }
-  const config = chainForNetwork(
+  const config2 = chainForNetwork(
     chainOpts?.network ?? forcedChainNetwork() ?? "private"
   );
-  return config.blockchainRid;
+  return config2.blockchainRid;
 }
 async function commitMemoryVersion(plaintext, auth, opts) {
   const key = await deriveMemoryKey(auth.privkey);
@@ -2800,7 +2917,34 @@ function classifyMemoryWrite(event, ctx, opts = {}) {
 // src-ts/memory/guard.ts
 var import_node_fs4 = require("fs");
 var import_node_os4 = __toESM(require("os"));
+
+// src-ts/memory/slot.ts
 var import_node_path4 = __toESM(require("path"));
+function asciiLower(s) {
+  return s.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) | 32));
+}
+function spelledAs(target, base, p = import_node_path4.default) {
+  const resolved = p.resolve(base);
+  if (p.sep !== "\\") return resolved;
+  const prefix = resolved.replace(/[\\/]+$/, "");
+  const t = asciiLower(target);
+  const b = asciiLower(prefix);
+  if (t === b || t.startsWith(b + "\\") || t.startsWith(b + "/")) {
+    return target.slice(0, prefix.length);
+  }
+  return resolved;
+}
+function memorySlotOf(target, home2, root, extraHomes, p = import_node_path4.default) {
+  const resolved = p.resolve(target);
+  return native.memorySlotForPath(
+    resolved,
+    home2 ? spelledAs(resolved, home2, p) : "",
+    root ? spelledAs(resolved, root, p) : void 0,
+    extraHomes
+  );
+}
+
+// src-ts/memory/guard.ts
 function emitDebugProbe(event, ctx, memEntry, logger2) {
   if (!logger2?.info) return;
   const ev = event ?? {};
@@ -2826,7 +2970,7 @@ function emitDebugProbe(event, ctx, memEntry, logger2) {
 }
 function memorySlotFor(key, root, extraHomes) {
   const home2 = process.env.HOME || import_node_os4.default.homedir() || "";
-  return native.memorySlotForPath(import_node_path4.default.resolve(key), home2, root, extraHomes);
+  return memorySlotOf(key, home2, root, extraHomes);
 }
 async function resultingDocument(memEntry, event, ctx) {
   const edits = native.extractMemoryEdits(event, ctx);
@@ -3579,12 +3723,7 @@ var MemoryGuardManager = class {
    */
   slotFor(target) {
     const home2 = process.env.HOME || import_node_os5.default.homedir() || "";
-    return native.memorySlotForPath(
-      import_node_path7.default.resolve(target),
-      home2,
-      this.opts.memoryRoot,
-      this.opts.agentHomeDirs
-    );
+    return memorySlotOf(target, home2, this.opts.memoryRoot, this.opts.agentHomeDirs);
   }
   /**
    * Verify every memory file this call reads, each against its own chain slot.
@@ -3865,8 +4004,6 @@ function diffMemorySnapshots(before, after) {
   Atbash,
   AtbashAPIError,
   BOOT_SYNC_HINT,
-  DEFAULT_BLOCKCHAIN_RID,
-  DEFAULT_CHROMIA_NODE_URLS,
   DEFAULT_ENDPOINT,
   DEFAULT_MEMORY_PATH_PATTERNS,
   DEFAULT_MEMORY_READ_TOOL_NAMES,
@@ -3874,11 +4011,11 @@ function diffMemorySnapshots(before, after) {
   EciesDomain,
   HttpClient,
   HttpTransportError,
+  JudgeRefusalError,
   KEY_FILENAMES,
   MemoryGuardManager,
   MemoryIntegrityError,
   PRIVATE_CHAIN,
-  PUBLIC_CHAIN,
   PointerStore,
   SignatureVerificationError,
   bootSyncFailureLine,
@@ -3892,6 +4029,7 @@ function diffMemorySnapshots(before, after) {
   columnAad,
   commitMemoryVersion,
   configureEvents,
+  configureJailHold,
   containsEvasionCharacters,
   containsSecret,
   createFileLogger,
@@ -3920,12 +4058,14 @@ function diffMemorySnapshots(before, after) {
   getRollbackHistory,
   guardMemoryWrite,
   isEnvelope,
+  isJailHeld,
   isValidPrivateKey,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent,
   loadAgentFromFile,
   loadUserConfig,
+  memorySlotOf,
   normalizeActionForHash,
   normalizeActionType,
   normalizeForMatching,
@@ -3939,6 +4079,7 @@ function diffMemorySnapshots(before, after) {
   recordEvent,
   redactJsonStrings,
   redactSecrets,
+  releaseJailHolds,
   resolve,
   resolveKeyPath,
   rollbackMemory,