@atbash/sdk 0.22.0-dev.0 → 0.23.0-dev.0

package/dist/browser.mjs

@@ -33,6 +33,14 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
   mod2
 ));
 
+// <define:__ATBASH_DEV_JUDGE_PINS__>
+var define_ATBASH_DEV_JUDGE_PINS_default;
+var init_define_ATBASH_DEV_JUDGE_PINS = __esm({
+  "<define:__ATBASH_DEV_JUDGE_PINS__>"() {
+    define_ATBASH_DEV_JUDGE_PINS_default = ["03f1632c850eb126edf64923484a21713d3b3931a0755258a2cb6090d4a1859d3a"];
+  }
+});
+
 // <define:__ATBASH_PRIVATE_NODE_URLS__>
 var define_ATBASH_PRIVATE_NODE_URLS_default;
 var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
@@ -41,11 +49,21 @@ var init_define_ATBASH_PRIVATE_NODE_URLS = __esm({
   }
 });
 
+// <define:__ATBASH_PROD_JUDGE_PINS__>
+var define_ATBASH_PROD_JUDGE_PINS_default;
+var init_define_ATBASH_PROD_JUDGE_PINS = __esm({
+  "<define:__ATBASH_PROD_JUDGE_PINS__>"() {
+    define_ATBASH_PROD_JUDGE_PINS_default = [];
+  }
+});
+
 // (disabled):node_modules/buffer/index.js
 var require_buffer = __commonJS({
   "(disabled):node_modules/buffer/index.js"() {
     "use strict";
+    init_define_ATBASH_DEV_JUDGE_PINS();
     init_define_ATBASH_PRIVATE_NODE_URLS();
+    init_define_ATBASH_PROD_JUDGE_PINS();
   }
 });
 
@@ -53,7 +71,9 @@ var require_buffer = __commonJS({
 var require_bn = __commonJS({
   "node_modules/bn.js/lib/bn.js"(exports, module) {
     "use strict";
+    init_define_ATBASH_DEV_JUDGE_PINS();
     init_define_ATBASH_PRIVATE_NODE_URLS();
+    init_define_ATBASH_PROD_JUDGE_PINS();
     (function(module2, exports2) {
       "use strict";
       function assert2(val, msg) {
@@ -2872,22 +2892,34 @@ var require_bn = __commonJS({
 });
 
 // src-ts/index.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // src-ts/browser/native.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/curves/secp256k1.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/hashes/sha2.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/hashes/_md.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/hashes/utils.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -3309,10 +3341,14 @@ var sha256 = /* @__PURE__ */ createHasher(
 );
 
 // node_modules/@noble/curves/abstract/curve.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/curves/utils.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
 var bytesToHex2 = bytesToHex;
@@ -3465,7 +3501,9 @@ function validateObject(object, fields = {}, optFields = {}) {
 }
 
 // node_modules/@noble/curves/abstract/modular.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var _0n2 = /* @__PURE__ */ BigInt(0);
 var _1n2 = /* @__PURE__ */ BigInt(1);
 var _2n = /* @__PURE__ */ BigInt(2);
@@ -4114,10 +4152,14 @@ function createKeygen(randomSecretKey, getPublicKey) {
 }
 
 // node_modules/@noble/curves/abstract/weierstrass.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/hashes/hmac.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var _HMAC = class {
   oHash;
   iHash;
@@ -5149,7 +5191,9 @@ var Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
 var secp256k1 = /* @__PURE__ */ ecdsa(Pointk1, sha256);
 
 // node_modules/postchain-client/built/esm/index.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var import_bn = __toESM(require_bn(), 1);
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
 function getDefaultExportFromCjs(x) {
@@ -43375,6 +43419,17 @@ function verifySignature(body, signatureHex, pubkeyHex) {
   const sigBytes = hexToBytes2(sigClean);
   return secp256k1.verify(sigBytes, digest9, pkBytes, { prehash: false });
 }
+function pinnedJudgeVerifyKeys(host) {
+  const h = host.trim().toLowerCase();
+  if (h === "atbash.ai" || h === "www.atbash.ai") return [...define_ATBASH_PROD_JUDGE_PINS_default];
+  let devHost = "";
+  try {
+    devHost = "https://chromia-verified-ai-dev-two.vercel.app" ? new URL("https://chromia-verified-ai-dev-two.vercel.app").hostname.toLowerCase() : "";
+  } catch {
+    devHost = "";
+  }
+  return devHost !== "" && h === devHost ? [...define_ATBASH_DEV_JUDGE_PINS_default] : [];
+}
 var STUB_MSG = "not available in @atbash/sdk browser bundle \u2014 call from Node or handle server-side";
 function redactSecrets(input) {
   return { redacted: input, found: [] };
@@ -43416,6 +43471,7 @@ var native = {
   signLogToolCall,
   signJudgeAction,
   verifySignature,
+  pinnedJudgeVerifyKeys,
   normalizeForMatching,
   containsEvasionCharacters,
   redactSecrets,
@@ -43496,10 +43552,14 @@ var native = {
 };
 
 // src-ts/client.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // src-ts/random.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function randomBytes4(size) {
   const buf = new Uint8Array(size);
   globalThis.crypto.getRandomValues(buf);
@@ -43515,7 +43575,9 @@ function randomHex(size) {
 }
 
 // src-ts/auth-bearer.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var BEARER_TTL_MS = 4 * 60 * 1e3;
 var bearers = /* @__PURE__ */ new Map();
 function agentAuthBearer(auth, blockchainRid) {
@@ -43540,7 +43602,9 @@ function agentAuthHeaders(auth, blockchainRid) {
 }
 
 // src-ts/chain-config.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var DEFAULT_PRIVATE_NODE_URLS = Object.freeze(
   native.defaultPrivateNodeUrls()
 );
@@ -43560,17 +43624,25 @@ function chainForNetwork(network) {
 }
 
 // src-ts/constants.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var DEFAULT_ENDPOINT = native.DEFAULT_ENDPOINT;
 
 // src-ts/browser/encrypted-toolcall.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // src-ts/browser/crypto-ecies.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/hashes/hkdf.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function extract(hash3, ikm, salt) {
   ahash(hash3);
   if (salt === void 0)
@@ -43611,13 +43683,19 @@ function expand2(hash3, prk, info2, length = 32) {
 var hkdf = (hash3, ikm, salt, info2, length) => expand2(hash3, extract(hash3, ikm, salt), info2, length);
 
 // node_modules/@noble/ciphers/aes.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/ciphers/_polyval.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // node_modules/@noble/ciphers/utils.js
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function isBytes3(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
@@ -44210,7 +44288,9 @@ function encryptedLength(plaintextByteLength) {
 }
 
 // src-ts/crypto/envelope.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var PREFIX = "atb1";
 var SEPARATOR = ".";
 function toBase64(bytes) {
@@ -44343,7 +44423,9 @@ function signEncryptedToolCall(toolCallId, action, context, toolName, toolArgsJs
 }
 
 // src-ts/endpoint.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function buildAllowedJudgeHosts() {
   return /* @__PURE__ */ new Set([
     "atbash.ai",
@@ -44359,6 +44441,23 @@ function isAllowlistedJudgeHost(endpoint) {
     return false;
   }
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var loopbackJudgePins = [];
+function setLoopbackJudgePinsForTests(keys2) {
+  loopbackJudgePins = keys2.map((k) => k.trim().toLowerCase());
+}
+function judgeVerifyKeys(endpoint, configuredKey) {
+  const host = new URL(endpoint).hostname.toLowerCase();
+  const pins = LOOPBACK_HOSTS.has(host) ? loopbackJudgePins : native.pinnedJudgeVerifyKeys(host);
+  const key3 = configuredKey?.trim().toLowerCase();
+  if (pins.length === 0) return key3 ? [key3] : [];
+  if (key3 && !pins.includes(key3)) {
+    throw new Error(
+      `[atbash] verifyPubKey ${key3} is not the response-signing key pinned for ${host}. Refusing to load \u2014 an Atbash host's replies are checked against the key built into the SDK; remove verifyPubKey, or set it to the pinned key.`
+    );
+  }
+  return pins;
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -44401,7 +44500,9 @@ function validateJudgeEndpoint(judge) {
 }
 
 // src-ts/errors.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var AtbashAPIError = class extends Error {
   /** HTTP status code (or 0 if the request never completed). */
   status;
@@ -44465,7 +44566,9 @@ function enrich(status, body, statusText, endpoint, path3) {
 }
 
 // src-ts/jail-hold.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var DEFAULTS = { ceilingMs: 3e4, pollMs: 1e3 };
 var holds = /* @__PURE__ */ new Map();
 var blockedAt = /* @__PURE__ */ new Map();
@@ -44475,7 +44578,7 @@ function isJailHeld(pubkey) {
   return holds.has(pubkey);
 }
 function recordBlock(pubkey) {
-  const now = Date.now();
+  const now = performance.now();
   for (const [key3, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key3);
   blockedAt.set(pubkey, now);
 }
@@ -44521,7 +44624,9 @@ function configureJailHold(next) {
 }
 
 // src-ts/http/client.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var HttpClient = class {
   baseUrl;
   timeoutMs;
@@ -44626,7 +44731,9 @@ function classifyTransportError(err, url, method, timeoutMs) {
 }
 
 // src-ts/browser/keyLoader.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var NOT_AVAILABLE = "keyLoader is not available in the browser bundle \u2014 pass `agentKey` explicitly to Atbash.fromConfig or use `new Atbash(privkey, opts)`.";
 function resolveKeyPath(_input) {
   throw new Error(NOT_AVAILABLE);
@@ -44636,10 +44743,14 @@ function loadAgentFromFile(_keyPath) {
 }
 
 // src-ts/decision.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // src-ts/normalize.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function wireText(raw2, fallback = "") {
   if (raw2 === null || raw2 === void 0) return fallback;
   if (typeof raw2 === "object" || typeof raw2 === "function") return fallback;
@@ -44750,7 +44861,9 @@ function canonicalAllow(data) {
 }
 
 // src-ts/opentel/events.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var SLOW_MS = 1500;
 var SUCCESS_SAMPLE_RATE = 10;
 var logger2 = null;
@@ -44805,7 +44918,9 @@ function recordEvent(e) {
 }
 
 // src-ts/browser/opentel/telemetry.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function setupTelemetry(_config) {
 }
 function recordCall(_functionName, _source, _agentPubkey) {
@@ -44818,7 +44933,9 @@ async function shutdownTelemetry() {
 }
 
 // src-ts/browser/userConfig.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var NOT_AVAILABLE2 = "userConfig file I/O is not available in the browser bundle.";
 function getConfigDir() {
   throw new Error(NOT_AVAILABLE2);
@@ -44847,7 +44964,10 @@ function strandedAgentKey() {
 
 // src-ts/client.ts
 var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
+var TOOL_CALL_IDS_FOR_TESTS = /* @__PURE__ */ Symbol.for("@atbash/sdk.toolCallIdsForTests");
 function generateToolCallId() {
+  const fixed = globalThis[TOOL_CALL_IDS_FOR_TESTS];
+  if (fixed && fixed.ids.length > 0) return fixed.ids[fixed.next++ % fixed.ids.length];
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
 function resolveConstructorChain(options) {
@@ -44884,12 +45004,21 @@ var Atbash = class _Atbash {
   orgName;
   /** Default judge response-signing pubkey, if configured (see fromConfig). */
   verifyPubKey;
+  /**
+   * The keys every judge reply must be signed by: the host's pinned keys, or
+   * the configured `verifyPubKey` on a host with none. Empty means unchecked.
+   */
+  verifyKeys;
   /** Default org encryption key — see {@link AtbashOptions.orgEncryptionPubKey}. */
   orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
   /** When true (default), an unenforced (audit-tier) answer is refused. */
   requireEnforcement;
+  /** When true, a signed non-enforcing mode never relaxes a verdict. */
+  enforceLocally;
+  /** Results whose enforcement mode came signed and bound to their call. */
+  modeTrusted = /* @__PURE__ */ new WeakSet();
   /** Overall deadline for one auditToolCall decision, in ms. */
   decisionTimeoutMs;
   /** Org key learned from the last agent-exists check, for this agent only. */
@@ -44953,9 +45082,11 @@ var Atbash = class _Atbash {
     this._forcedNetwork = forcedChainNetwork();
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
+    this.verifyKeys = judgeVerifyKeys(this.endpoint, this.verifyPubKey);
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
     this.requireEnforcement = options.requireEnforcement !== false;
+    this.enforceLocally = options.enforceLocally === true;
     this.decisionTimeoutMs = options.decisionTimeoutMs ?? DEFAULT_DECISION_TIMEOUT_MS;
     this.debug = options.debug === true;
     this.logger = options.logger ?? {};
@@ -44964,7 +45095,7 @@ var Atbash = class _Atbash {
     if (this.endpoint !== DEFAULT_ENDPOINT) {
       this.logger.warn?.("[atbash] running on non-default judge endpoint", {
         endpoint: this.endpoint,
-        verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
+        verifying: this.verifyKeys.length > 0 ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
     if (isAllowlistedJudgeHost(this.endpoint)) {
@@ -45002,12 +45133,12 @@ var Atbash = class _Atbash {
     _Atbash.environmentLogged = true;
     const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
     this.logger.info?.(
-      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyKeys.length > 0 ? "on" : "off"}`,
       {
         judgeEndpoint: this.endpoint,
         privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
         activeBlockchainRid: this.blockchainRid,
-        responseSignatureCheck: Boolean(this.verifyPubKey)
+        responseSignatureCheck: this.verifyKeys.length > 0
       }
     );
   }
@@ -45125,6 +45256,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       verifyPubKey: validated.verifyPubKey ?? void 0,
       failClosed: options.failClosed,
       requireEnforcement: options.requireEnforcement,
+      enforceLocally: options.enforceLocally,
       decisionTimeoutMs: options.decisionTimeoutMs,
       // ATBASH_DEBUG lets an operator turn diagnostics on without editing a
       // host's plugin config, which is usually the harder half.
@@ -45259,22 +45391,34 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * response bytes via the Rust core's `verifySignature`.
    */
   async judgeAction(action, context = "", options = {}) {
+    return this.judgeTracked(action, context, options, false);
+  }
+  /**
+   * judgeAction, optionally asking the judge for the true verdict and the
+   * organisation's enforcement mode so this client applies the mode itself.
+   *
+   * Only auditToolCall opts in: judgeAction's callers keep the server-side
+   * downgrade they gate on today.
+   *
+   * @param clientEnforces - Send `X-Atbash-Client-Enforcement` when the reply can be trusted.
+   */
+  judgeTracked(action, context, options, clientEnforces) {
     return this.track("judgeAction", this.auth.pubkey, async () => {
       try {
-        return await this._judgeAction(action, context, options);
+        return await this._judgeAction(action, context, options, clientEnforces);
       } catch (err) {
         if (!isEncryptionStateMismatch(err)) throw err;
         this._orgKeyFromChain = null;
-        return await this._judgeAction(action, context, options);
+        return await this._judgeAction(action, context, options, clientEnforces);
       }
     });
   }
-  async _judgeAction(action, context, options) {
+  async _judgeAction(action, context, options, clientEnforces = false) {
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
     if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
-    const startedAt = Date.now();
+    const startedAt = performance.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
       chainOpts = options.chainOpts ?? {
@@ -45331,17 +45475,23 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
+    const verifyKeys = this.effectiveVerifyKeys(options.verifyPubKey);
+    const optIn = clientEnforces && (verifyKeys.length > 0 || this.enforceLocally);
+    const optInValue = this.enforceLocally ? "strict" : "1";
     let resp;
     try {
-      resp = await this.http.post("/api/v1/judge", body);
+      resp = await this.http.post(
+        "/api/v1/judge",
+        body,
+        optIn ? { "X-Atbash-Client-Enforcement": optInValue } : void 0
+      );
     } catch (err) {
       throw this.transportError(err);
     }
     if (!resp.ok) throw await this.httpError(resp);
     const bodyBytes = Buffer.from(await resp.arrayBuffer());
-    const verifyPubKey = this.effectiveVerifyKey(options.verifyPubKey);
-    if (verifyPubKey !== void 0) {
-      verifyResponseSignature(bodyBytes, resp, verifyPubKey);
+    if (verifyKeys.length > 0) {
+      verifyResponseSignature(bodyBytes, resp, verifyKeys);
     }
     const parsed = tryParseJson(bodyBytes.toString("utf-8"));
     if (!isRecord2(parsed)) {
@@ -45361,6 +45511,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       provider: wireText(data.provider),
       latencyMs: wireNumber(data.latency_ms),
       toolCallId: wireText(data.tool_call_id, logResult.toolCallId),
+      ...wireText(data.judgment_id) ? { judgmentId: wireText(data.judgment_id) } : {},
       onChain: Boolean(data.on_chain),
       enforced: Boolean(data.enforced),
       enforcementMode: wireText(data.enforcement_mode),
@@ -45368,23 +45519,46 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       score,
       refusal: explicitRefusal(data)
     };
-    return this.applyJailHold(result, startedAt);
+    if (optIn) {
+      const echo = data.client_enforcement;
+      if (echo !== void 0 && echo !== optInValue || echo === void 0 && this.enforceLocally) {
+        throw new SignatureVerificationError(
+          "the reply does not confirm the enforcement this client asked for"
+        );
+      }
+      if (verifyKeys.length > 0) {
+        const statedId = wireText(data.tool_call_id);
+        const statedJudgment = wireText(data.judgment_id);
+        if (statedId && statedId !== logResult.toolCallId && statedId !== judgmentId || statedJudgment && statedJudgment !== judgmentId) {
+          throw new SignatureVerificationError(
+            `the signed reply is for call ${statedJudgment || statedId}, not this one`
+          );
+        }
+        if (statedId && echo === optInValue) this.modeTrusted.add(result);
+      }
+    }
+    return this.applyJailHold(result, startedAt, wireText(data.on_chain_status));
   }
   /**
-   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
-   * Refuse any other result that lands while the agent is held, or whose
-   * request was already in flight when the block arrived: the server judged it
-   * on pre-jail state.
+   * Start a local hold on an enforced BLOCK that jails: one already on chain,
+   * or one the judge answered before its chain write landed
+   * (`on_chain_status: "pending"`), which jails once it lands. Refuse any other
+   * result that lands while the agent is held, or whose request was already in
+   * flight when the block arrived: the server judged it on pre-jail state.
+   *
+   * @param onChainStatus - The reply's `on_chain_status`; empty when absent.
    */
-  applyJailHold(result, startedAt) {
+  applyJailHold(result, startedAt, onChainStatus = "") {
     const pubkey = this.auth.pubkey;
-    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+    if (result.verdict === "BLOCK" && result.enforced) {
       recordBlock(pubkey);
-      holdJail(
-        pubkey,
-        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
-        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
-      );
+      if (result.onChain || onChainStatus === "pending") {
+        holdJail(
+          pubkey,
+          () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+          () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+        );
+      }
       return result;
     }
     return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
@@ -45439,13 +45613,18 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     try {
       this.logger.info?.("[atbash] judge API called", { tool: toolName });
       const result = await withDeadline(
-        this.judgeAction(actionText, contextText, {
-          toolName,
-          toolArgsJson: argsJson,
-          orgName: this.orgName,
-          // Passed through unredacted — caller vouches for the contents.
-          resolved: input.resolved
-        }),
+        this.judgeTracked(
+          actionText,
+          contextText,
+          {
+            toolName,
+            toolArgsJson: argsJson,
+            orgName: this.orgName,
+            // Passed through unredacted — caller vouches for the contents.
+            resolved: input.resolved
+          },
+          true
+        ),
         this.decisionTimeoutMs
       );
       return this.decide(result);
@@ -45455,7 +45634,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         return {
           allow: false,
           verdict: "ERROR",
-          reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
+          reason: `The judge's reply was not trusted (${errorMessage(err)}).`
         };
       }
       if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
@@ -45465,20 +45644,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     }
   }
   /**
-   * The verify key for one call (R4, governor tier-2 review). A per-call key
-   * may only narrow what the client accepts: on a client pinned to a judge
-   * key it must be that same key, never a replacement; on an unpinned client
-   * it adds the check.
+   * The verify keys for one call (R4, governor tier-2 review). A per-call key
+   * may only narrow what the client accepts: on a client pinned to judge keys
+   * it must be one of them, never a replacement; on an unpinned client it
+   * adds the check.
    */
-  effectiveVerifyKey(perCall) {
-    if (perCall === void 0) return this.verifyPubKey;
+  effectiveVerifyKeys(perCall) {
+    if (perCall === void 0) return this.verifyKeys;
     const key3 = perCall.trim().toLowerCase();
-    if (this.verifyPubKey !== void 0 && key3 !== this.verifyPubKey) {
+    if (this.verifyKeys.length > 0 && !this.verifyKeys.includes(key3)) {
       throw new SignatureVerificationError(
         "a per-call verifyPubKey cannot replace the judge key this client is pinned to"
       );
     }
-    return key3;
+    return [key3];
   }
   /**
    * Collapse a judge result into a {@link Decision}. The most restrictive
@@ -45490,7 +45669,8 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
-    const inner = this.decideInner(result);
+    const decided = this.applyMode(result);
+    const inner = result.judgmentId ? { ...decided, judgmentId: result.judgmentId } : decided;
     if (!result.enforcementMode) return inner;
     return {
       ...inner,
@@ -45498,6 +45678,50 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       enforcementMode: result.enforcementMode
     };
   }
+  /**
+   * Apply the organisation's enforcement mode to the judge's true verdict.
+   *
+   * Only a mode that arrived signed and bound to this call counts; a missing,
+   * unsigned or unknown mode, or enforceLocally, means enforce. Under
+   * `shadow`, `monitor` or `off` a BLOCK or HOLD runs, reported in
+   * `wouldVerdict`. An ERROR stays an error: it is not a verdict.
+   */
+  applyMode(result) {
+    const mode = result.enforcementMode;
+    const relaxes = this.modeTrusted.has(result) && (mode === "shadow" || mode === "monitor" || mode === "off");
+    if (result.status === "shadow_recorded" && result.verdict === "No verdict") {
+      if (!relaxes || this.enforceLocally) {
+        return {
+          allow: false,
+          verdict: "ERROR",
+          reason: "Atbash recorded this action without judging it (the organisation is not enforcing), and this client requires a verdict.",
+          toolCallId: result.toolCallId
+        };
+      }
+      this.logger.info?.(`[atbash] recorded in ${mode} mode; not judged yet`, {
+        toolCallId: result.toolCallId
+      });
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: `Recorded in ${mode} mode; the verdict appears in the dashboard.`,
+        toolCallId: result.toolCallId
+      };
+    }
+    const inner = this.decideInner(result);
+    if (!relaxes || this.enforceLocally || inner.allow) return inner;
+    if (inner.verdict !== "BLOCK" && inner.verdict !== "HOLD") return inner;
+    this.logger.warn?.(`[atbash] would ${inner.verdict.toLowerCase()} (${mode} mode): ${inner.reason ?? ""}`, {
+      toolCallId: inner.toolCallId
+    });
+    return {
+      allow: true,
+      verdict: "ALLOW",
+      reason: inner.reason,
+      toolCallId: inner.toolCallId,
+      wouldVerdict: inner.verdict
+    };
+  }
   decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
@@ -45533,7 +45757,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         return {
           allow: false,
           verdict: "ERROR",
-          reason: "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
+          // The judge's own reason says why it did not check (the plan, a
+          // deactivated agent); a fixed "audit-tier plan" hid which.
+          reason: result.reason ? `Atbash did not check this action, and this client requires a checked decision. The judge said: ${result.reason}` : "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
           toolCallId
         };
       }
@@ -45623,32 +45849,52 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const pk = agentPubkey ?? this.auth.pubkey;
     return this.track("getJudgmentStatus", pk, async () => {
       const brid = await this.callBrid(chainOpts);
+      const optIn = this.verifyKeys.length > 0 || this.enforceLocally;
+      const optInValue = this.enforceLocally ? "strict" : "1";
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
-        this.authHeaders(brid)
+        {
+          ...this.authHeaders(brid),
+          ...optIn ? { "X-Atbash-Client-Enforcement": optInValue } : {}
+        }
       );
       await this.raiseIfError(resp);
       const bytes = Buffer.from(await resp.arrayBuffer());
-      if (this.verifyPubKey !== void 0) {
-        verifyResponseSignature(bytes, resp, this.verifyPubKey);
+      if (this.verifyKeys.length > 0) {
+        verifyResponseSignature(bytes, resp, this.verifyKeys);
       }
       const parsed = tryParseJson(bytes.toString("utf-8"));
       const data = isRecord2(parsed) ? parsed : {};
-      const rawId = data.tool_call_id ?? data.judgmentId;
+      const rawId = data.tool_call_id;
       const statedId = wireText(rawId);
       const sameCall = rawId === void 0 || rawId === null || statedId === judgmentId;
-      return {
+      let modeTrusted = false;
+      if (optIn) {
+        const echo = data.client_enforcement;
+        if (echo !== void 0 && echo !== optInValue || echo === void 0 && this.enforceLocally) {
+          throw new SignatureVerificationError(
+            "the status does not confirm the enforcement this client asked for"
+          );
+        }
+        modeTrusted = this.verifyKeys.length > 0 && echo === optInValue && statedId === judgmentId;
+      }
+      const status = {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
         allow: sameCall && this.executable(data),
         reason: wireText(data.reason),
         judgmentId: statedId || judgmentId,
-        onChain: optBool(data.onChain),
-        cached: optBool(data.cached),
-        // The Dashboard sends response_time_ms; responseTimeMs is the spec name.
-        responseTimeMs: optNumber(data.responseTimeMs ?? data.response_time_ms)
+        responseTimeMs: optNumber(data.response_time_ms)
       };
+      const mode = wireText(data.enforcement_mode);
+      if (!modeTrusted || this.enforceLocally || !(mode === "shadow" || mode === "monitor" || mode === "off") || status.verdict !== "BLOCK" && status.verdict !== "HOLD") {
+        return status;
+      }
+      this.logger.warn?.(`[atbash] would ${status.verdict.toLowerCase()} (${mode} mode): ${status.reason}`, {
+        toolCallId: judgmentId
+      });
+      return { ...status, verdict: "ALLOW", allow: true, wouldVerdict: status.verdict };
     });
   }
   /* ── risk-engine queries (action-dispatched GET) ───────────────────────── */
@@ -46150,14 +46396,14 @@ async function withDeadline(p, ms) {
     clearTimeout(timer);
   }
 }
-function verifyResponseSignature(bodyBytes, resp, verifyPubKey) {
+function verifyResponseSignature(bodyBytes, resp, verifyKeys) {
   const sig = resp.headers.get("X-Atbash-Signature");
   if (!sig) {
     throw new SignatureVerificationError("missing X-Atbash-Signature header");
   }
-  let ok;
+  let ok = false;
   try {
-    ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
+    ok = verifyKeys.some((key3) => native.verifySignature(bodyBytes, sig, key3));
   } catch (err) {
     throw new SignatureVerificationError(
       `signature verification threw: ${errorMessage(err)}`
@@ -46249,10 +46495,6 @@ function optNumber(v) {
   const n = Number(v);
   return Number.isFinite(n) ? n : void 0;
 }
-function optBool(v) {
-  if (v === null || v === void 0) return void 0;
-  return Boolean(v);
-}
 function tryParseJson(text) {
   try {
     return JSON.parse(text);
@@ -46298,7 +46540,9 @@ function truncate(text, limit = MAX_ACTION_LEN) {
 }
 
 // src-ts/browser/key-path.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var KEY_FILENAMES = ["guard-client-key", "atbash-client-key"];
 var unavailable = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
@@ -46311,7 +46555,9 @@ function chooseKeyPath(_input, _exists) {
 }
 
 // src-ts/redact.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function redactJsonStrings(value) {
   if (typeof value === "string") {
     return native.redactSecrets(value).redacted;
@@ -46330,7 +46576,9 @@ function redactJsonStrings(value) {
 }
 
 // src-ts/signature.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
   if (!signatureHex) {
     return { ok: false, reason: "missing X-Atbash-Signature header" };
@@ -46353,7 +46601,9 @@ function verifyJudgeResponseSignature(bodyBytes, signatureHex, pubKeyHex) {
 }
 
 // src-ts/memory/boot-sync-message.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var BOOT_SYNC_HINT = "check the chain endpoint and orgName if the cause above does not explain it";
 function bootSyncFailureLine(cause) {
   const reason = cause instanceof Error ? cause.message : String(cause);
@@ -46365,10 +46615,14 @@ function bootSyncFailureLine(cause) {
 }
 
 // src-ts/memory/index.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 
 // src-ts/browser/memory-crypto.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var { Buffer: Buffer4 } = index;
 var HKDF_INFO = new TextEncoder().encode("atbash:memory-encryption");
 var KEY_LEN = 32;
@@ -46443,7 +46697,9 @@ async function decryptMemoryContent2(ciphertext, nonce, key3) {
 }
 
 // src-ts/browser/memory-scan.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var STUB_MSG2 = "not available in @atbash/sdk browser bundle \u2014 scan memory server-side";
 async function scanMemory(_entry, _auth, _opts) {
   throw new Error(`scanMemory ${STUB_MSG2}`);
@@ -46453,7 +46709,9 @@ async function scanMemoryBatch(_entries, _auth, _opts) {
 }
 
 // src-ts/browser/memory-chain.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var STUB_MSG3 = "not available in @atbash/sdk browser bundle \u2014 commit/rollback memory server-side";
 async function commitMemoryVersion(_plaintext, _auth, _opts) {
   throw new Error(`commitMemoryVersion ${STUB_MSG3}`);
@@ -46481,7 +46739,9 @@ async function rollbackMemory(_toId, _reason, _auth, _opts) {
 }
 
 // src-ts/browser/memory-classifier.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var STUB_MSG4 = "not available in @atbash/sdk browser bundle \u2014 classify memory writes server-side";
 var DEFAULT_MEMORY_WRITE_TOOL_NAMES = [
   "write",
@@ -46504,14 +46764,18 @@ function classifyMemoryWrite(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/browser/memory-guard.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var STUB_MSG5 = "not available in @atbash/sdk browser bundle \u2014 guard memory writes agent-side";
 async function guardMemoryWrite(_input) {
   throw new Error(`guardMemoryWrite ${STUB_MSG5}`);
 }
 
 // src-ts/browser/memory-slot.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var unavailable2 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -46520,7 +46784,9 @@ function memorySlotOf(_target, _home, _root2, _extraHomes, _p) {
 }
 
 // src-ts/memory/sync.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var MemoryIntegrityError = class extends Error {
   constructor(id, reason) {
     super(`memory integrity check failed on id ${id}: ${reason}`);
@@ -46553,7 +46819,9 @@ async function syncLocalMemory(auth, pointer, opts = {}) {
 }
 
 // src-ts/browser/memory-pointer-store.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var unavailable3 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -46572,7 +46840,9 @@ function defaultPointerPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-file-logger.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var unavailable4 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -46584,7 +46854,9 @@ function defaultPluginLogPath(_workspaceDir) {
 }
 
 // src-ts/browser/memory-read-classifier.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var STUB_MSG6 = "not available in @atbash/sdk browser bundle \u2014 classify memory reads server-side";
 var DEFAULT_MEMORY_READ_TOOL_NAMES = [
   "memory_search",
@@ -46595,7 +46867,9 @@ function classifyMemoryRead(_event, _ctx, _opts = {}) {
 }
 
 // src-ts/browser/memory-guard-manager.ts
+init_define_ATBASH_DEV_JUDGE_PINS();
 init_define_ATBASH_PRIVATE_NODE_URLS();
+init_define_ATBASH_PROD_JUDGE_PINS();
 var unavailable5 = (name2) => {
   throw new Error(`${name2} is not available in the browser bundle`);
 };
@@ -46734,6 +47008,7 @@ export {
   isEnvelope,
   isJailHeld,
   isValidPrivateKey2 as isValidPrivateKey,
+  judgeVerifyKeys,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent2 as loadAgent,
@@ -46760,6 +47035,7 @@ export {
   saveUserConfig,
   scanMemory,
   scanMemoryBatch,
+  setLoopbackJudgePinsForTests,
   setupTelemetry,
   shutdownTelemetry,
   signEncryptedToolCall,