@atbash/sdk 0.22.0-dev.0 → 0.24.0-dev.0

package/dist/index.js

@@ -89,6 +89,7 @@ __export(src_ts_exports, {
   isEnvelope: () => isEnvelope,
   isJailHeld: () => isJailHeld,
   isValidPrivateKey: () => isValidPrivateKey,
+  judgeVerifyKeys: () => judgeVerifyKeys,
   keyFingerprintOf: () => keyFingerprintOf,
   keyPathCandidates: () => keyPathCandidates,
   loadAgent: () => loadAgent,
@@ -115,6 +116,7 @@ __export(src_ts_exports, {
   saveUserConfig: () => saveUserConfig,
   scanMemory: () => scanMemory,
   scanMemoryBatch: () => scanMemoryBatch,
+  setLoopbackJudgePinsForTests: () => setLoopbackJudgePinsForTests,
   setupTelemetry: () => setupTelemetry,
   shutdownTelemetry: () => shutdownTelemetry,
   signEncryptedToolCall: () => signEncryptedToolCall,
@@ -233,6 +235,23 @@ function isAllowlistedJudgeHost(endpoint) {
     return false;
   }
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+var loopbackJudgePins = [];
+function setLoopbackJudgePinsForTests(keys) {
+  loopbackJudgePins = keys.map((k) => k.trim().toLowerCase());
+}
+function judgeVerifyKeys(endpoint, configuredKey) {
+  const host = new URL(endpoint).hostname.toLowerCase();
+  const pins = LOOPBACK_HOSTS.has(host) ? loopbackJudgePins : native.pinnedJudgeVerifyKeys(host);
+  const key = configuredKey?.trim().toLowerCase();
+  if (pins.length === 0) return key ? [key] : [];
+  if (key && !pins.includes(key)) {
+    throw new Error(
+      `[atbash] verifyPubKey ${key} is not the response-signing key pinned for ${host}. Refusing to load \u2014 an Atbash host's replies are checked against the key built into the SDK; remove verifyPubKey, or set it to the pinned key.`
+    );
+  }
+  return pins;
+}
 function validateJudgeEndpoint(judge) {
   const policy = judge?.policy === "self-hosted" ? "self-hosted" : "default";
   const candidate = judge?.endpoint?.trim() || DEFAULT_ENDPOINT;
@@ -347,7 +366,7 @@ function isJailHeld(pubkey) {
   return holds.has(pubkey);
 }
 function recordBlock(pubkey) {
-  const now = Date.now();
+  const now = performance.now();
   for (const [key, at] of blockedAt) if (now - at > BLOCK_MEMORY_MS) blockedAt.delete(key);
   blockedAt.set(pubkey, now);
 }
@@ -736,7 +755,7 @@ var import_sdk_metrics = require("@opentelemetry/sdk-metrics");
 var import_exporter_logs_otlp_http = require("@opentelemetry/exporter-logs-otlp-http");
 var import_sdk_logs = require("@opentelemetry/sdk-logs");
 var import_node_crypto = require("crypto");
-var SDK_VERSION = true ? "0.22.0-dev.0" : "";
+var SDK_VERSION = true ? "0.24.0-dev.0" : "";
 var SDK_LANGUAGE = "node";
 function sdkResourceAttributes() {
   const attrs = {
@@ -1001,7 +1020,10 @@ function forcedChainNetwork(flagValue) {
 
 // src-ts/client.ts
 var AGENT_NOT_REGISTERED = "Agent not registered. Onboard the agent at the dashboard before submitting actions.";
+var TOOL_CALL_IDS_FOR_TESTS = /* @__PURE__ */ Symbol.for("@atbash/sdk.toolCallIdsForTests");
 function generateToolCallId() {
+  const fixed = globalThis[TOOL_CALL_IDS_FOR_TESTS];
+  if (fixed && fixed.ids.length > 0) return fixed.ids[fixed.next++ % fixed.ids.length];
   return `tc-${Date.now()}-${randomHex(4)}`;
 }
 function resolveConstructorChain(options) {
@@ -1038,12 +1060,21 @@ var Atbash = class _Atbash {
   orgName;
   /** Default judge response-signing pubkey, if configured (see fromConfig). */
   verifyPubKey;
+  /**
+   * The keys every judge reply must be signed by: the host's pinned keys, or
+   * the configured `verifyPubKey` on a host with none. Empty means unchecked.
+   */
+  verifyKeys;
   /** Default org encryption key — see {@link AtbashOptions.orgEncryptionPubKey}. */
   orgEncryptionPubKey;
   /** When true (default), `auditToolCall` denies on any error. */
   failClosed;
   /** When true (default), an unenforced (audit-tier) answer is refused. */
   requireEnforcement;
+  /** When true, a signed non-enforcing mode never relaxes a verdict. */
+  enforceLocally;
+  /** Results whose enforcement mode came signed and bound to their call. */
+  modeTrusted = /* @__PURE__ */ new WeakSet();
   /** Overall deadline for one auditToolCall decision, in ms. */
   decisionTimeoutMs;
   /** Org key learned from the last agent-exists check, for this agent only. */
@@ -1107,9 +1138,11 @@ var Atbash = class _Atbash {
     this._forcedNetwork = forcedChainNetwork();
     this.orgName = options.orgName;
     this.verifyPubKey = validated.verifyPubKey ?? void 0;
+    this.verifyKeys = judgeVerifyKeys(this.endpoint, this.verifyPubKey);
     this.orgEncryptionPubKey = options.orgEncryptionPubKey;
     this.failClosed = options.failClosed !== false;
     this.requireEnforcement = options.requireEnforcement !== false;
+    this.enforceLocally = options.enforceLocally === true;
     this.decisionTimeoutMs = options.decisionTimeoutMs ?? DEFAULT_DECISION_TIMEOUT_MS;
     this.debug = options.debug === true;
     this.logger = options.logger ?? {};
@@ -1118,7 +1151,7 @@ var Atbash = class _Atbash {
     if (this.endpoint !== DEFAULT_ENDPOINT) {
       this.logger.warn?.("[atbash] running on non-default judge endpoint", {
         endpoint: this.endpoint,
-        verifying: this.verifyPubKey ? "with response-signature pubkey configured" : "without signature verification"
+        verifying: this.verifyKeys.length > 0 ? "with response-signature pubkey configured" : "without signature verification"
       });
     }
     if (isAllowlistedJudgeHost(this.endpoint)) {
@@ -1156,12 +1189,12 @@ var Atbash = class _Atbash {
     _Atbash.environmentLogged = true;
     const brief = (rid) => rid ? `${rid.slice(0, 8)}\u2026` : "(unset)";
     this.logger.info?.(
-      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyPubKey ? "on" : "off"}`,
+      `[atbash] environment \u2014 judge=${this.endpoint} privateChain=${brief(native.DEFAULT_PRIVATE_BLOCKCHAIN_RID)} activeChain=${brief(this.blockchainRid)} responseSignatureCheck=${this.verifyKeys.length > 0 ? "on" : "off"}`,
       {
         judgeEndpoint: this.endpoint,
         privateBlockchainRid: native.DEFAULT_PRIVATE_BLOCKCHAIN_RID,
         activeBlockchainRid: this.blockchainRid,
-        responseSignatureCheck: Boolean(this.verifyPubKey)
+        responseSignatureCheck: this.verifyKeys.length > 0
       }
     );
   }
@@ -1279,6 +1312,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       verifyPubKey: validated.verifyPubKey ?? void 0,
       failClosed: options.failClosed,
       requireEnforcement: options.requireEnforcement,
+      enforceLocally: options.enforceLocally,
       decisionTimeoutMs: options.decisionTimeoutMs,
       // ATBASH_DEBUG lets an operator turn diagnostics on without editing a
       // host's plugin config, which is usually the harder half.
@@ -1413,22 +1447,34 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * response bytes via the Rust core's `verifySignature`.
    */
   async judgeAction(action, context = "", options = {}) {
+    return this.judgeTracked(action, context, options, false);
+  }
+  /**
+   * judgeAction, optionally asking the judge for the true verdict and the
+   * organisation's enforcement mode so this client applies the mode itself.
+   *
+   * Only auditToolCall opts in: judgeAction's callers keep the server-side
+   * downgrade they gate on today.
+   *
+   * @param clientEnforces - Send `X-Atbash-Client-Enforcement` when the reply can be trusted.
+   */
+  judgeTracked(action, context, options, clientEnforces) {
     return this.track("judgeAction", this.auth.pubkey, async () => {
       try {
-        return await this._judgeAction(action, context, options);
+        return await this._judgeAction(action, context, options, clientEnforces);
       } catch (err) {
         if (!isEncryptionStateMismatch(err)) throw err;
         this._orgKeyFromChain = null;
-        return await this._judgeAction(action, context, options);
+        return await this._judgeAction(action, context, options, clientEnforces);
       }
     });
   }
-  async _judgeAction(action, context, options) {
+  async _judgeAction(action, context, options, clientEnforces = false) {
     if (!action?.trim()) {
       throw new Error("action is required and cannot be empty.");
     }
     if (isJailHeld(this.auth.pubkey)) return this.localJailBlock();
-    const startedAt = Date.now();
+    const startedAt = performance.now();
     let chainOpts = options.chainOpts;
     if (options.orgName && this._explicitChain) {
       chainOpts = options.chainOpts ?? {
@@ -1485,17 +1531,23 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     if (options.toolArgsJson) body.tool_args_json = options.toolArgsJson;
     if (options.resolved) body.resolved = options.resolved;
     if (options.mode) body.mode = options.mode;
+    const verifyKeys = this.effectiveVerifyKeys(options.verifyPubKey);
+    const optIn = clientEnforces && (verifyKeys.length > 0 || this.enforceLocally);
+    const optInValue = this.enforceLocally ? "strict" : "1";
     let resp;
     try {
-      resp = await this.http.post("/api/v1/judge", body);
+      resp = await this.http.post(
+        "/api/v1/judge",
+        body,
+        optIn ? { "X-Atbash-Client-Enforcement": optInValue } : void 0
+      );
     } catch (err) {
       throw this.transportError(err);
     }
     if (!resp.ok) throw await this.httpError(resp);
     const bodyBytes = Buffer.from(await resp.arrayBuffer());
-    const verifyPubKey = this.effectiveVerifyKey(options.verifyPubKey);
-    if (verifyPubKey !== void 0) {
-      verifyResponseSignature(bodyBytes, resp, verifyPubKey);
+    if (verifyKeys.length > 0) {
+      verifyResponseSignature(bodyBytes, resp, verifyKeys);
     }
     const parsed = tryParseJson(bodyBytes.toString("utf-8"));
     if (!isRecord2(parsed)) {
@@ -1506,6 +1558,12 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const data = parsed;
     const rawScore = data.score;
     const score = typeof rawScore === "number" && Number.isInteger(rawScore) && rawScore >= 1 && rawScore <= 10 ? rawScore : void 0;
+    const statedId = wireText(data.tool_call_id);
+    const statedJudgment = wireText(data.judgment_id);
+    const statedStatus = wireText(data.on_chain_status);
+    const statedJudgeStatus = typeof data.status === "string" ? data.status : "";
+    const boundToCall = (statedId === logResult.toolCallId || statedId === judgmentId) && (!statedJudgment || statedJudgment === judgmentId);
+    const signatureChecked = verifyKeys.length > 0;
     const result = {
       verdict: normalizeVerdict(data.verdict),
       allow: this.executable(data),
@@ -1515,30 +1573,65 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       provider: wireText(data.provider),
       latencyMs: wireNumber(data.latency_ms),
       toolCallId: wireText(data.tool_call_id, logResult.toolCallId),
+      ...wireText(data.judgment_id) ? { judgmentId: wireText(data.judgment_id) } : {},
       onChain: Boolean(data.on_chain),
+      // Only a stated boolean is a statement: `onChain` above reads silence as false.
+      ...typeof data.on_chain === "boolean" ? {
+        record: {
+          onChain: data.on_chain,
+          ...statedStatus ? { status: statedStatus } : {},
+          boundToCall,
+          signatureChecked,
+          ...statedJudgeStatus ? { judgeStatus: statedJudgeStatus } : {},
+          // A judge status marks a reply that carries no verdict: a shadow
+          // ack, or an answer that was only logged.
+          verdictRecorded: data.on_chain && boundToCall && signatureChecked && !statedJudgeStatus
+        }
+      } : {},
       enforced: Boolean(data.enforced),
       enforcementMode: wireText(data.enforcement_mode),
       status: wireText(data.status),
       score,
       refusal: explicitRefusal(data)
     };
-    return this.applyJailHold(result, startedAt);
+    if (optIn) {
+      const echo = data.client_enforcement;
+      if (echo !== void 0 && echo !== optInValue || echo === void 0 && this.enforceLocally) {
+        throw new SignatureVerificationError(
+          "the reply does not confirm the enforcement this client asked for"
+        );
+      }
+      if (verifyKeys.length > 0) {
+        if (statedId && statedId !== logResult.toolCallId && statedId !== judgmentId || statedJudgment && statedJudgment !== judgmentId) {
+          throw new SignatureVerificationError(
+            `the signed reply is for call ${statedJudgment || statedId}, not this one`
+          );
+        }
+        if (statedId && echo === optInValue) this.modeTrusted.add(result);
+      }
+    }
+    return this.applyJailHold(result, startedAt, statedStatus);
   }
   /**
-   * Start a local hold on an enforced, on-chain BLOCK (the verdict that jails).
-   * Refuse any other result that lands while the agent is held, or whose
-   * request was already in flight when the block arrived: the server judged it
-   * on pre-jail state.
+   * Start a local hold on an enforced BLOCK that jails: one already on chain,
+   * or one the judge answered before its chain write landed
+   * (`on_chain_status: "pending"`), which jails once it lands. Refuse any other
+   * result that lands while the agent is held, or whose request was already in
+   * flight when the block arrived: the server judged it on pre-jail state.
+   *
+   * @param onChainStatus - The reply's `on_chain_status`; empty when absent.
    */
-  applyJailHold(result, startedAt) {
+  applyJailHold(result, startedAt, onChainStatus = "") {
     const pubkey = this.auth.pubkey;
-    if (result.verdict === "BLOCK" && result.enforced && result.onChain) {
+    if (result.verdict === "BLOCK" && result.enforced) {
       recordBlock(pubkey);
-      holdJail(
-        pubkey,
-        () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
-        () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
-      );
+      if (result.onChain || onChainStatus === "pending") {
+        holdJail(
+          pubkey,
+          () => this.getAgentPolicy(pubkey).then((p) => p.isJailed),
+          () => this.logger.warn?.("[atbash] local jail hold released: the chain did not confirm the jail in time")
+        );
+      }
       return result;
     }
     return isJailHeld(pubkey) || blockedSince(pubkey, startedAt) ? this.localJailBlock(result.toolCallId) : result;
@@ -1549,7 +1642,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       verdict: "BLOCK",
       allow: false,
       actionType: "block",
-      reason: "Agent is jailed. All actions are blocked until the organization owner unjails this agent.",
+      reason: `Agent is jailed. All actions are blocked until the organization owner unjails this agent at ${this.endpoint.replace(/\/+$/, "")}/risk-engine/agents.`,
       confidence: 1,
       provider: "policy",
       latencyMs: 0,
@@ -1593,13 +1686,18 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     try {
       this.logger.info?.("[atbash] judge API called", { tool: toolName });
       const result = await withDeadline(
-        this.judgeAction(actionText, contextText, {
-          toolName,
-          toolArgsJson: argsJson,
-          orgName: this.orgName,
-          // Passed through unredacted — caller vouches for the contents.
-          resolved: input.resolved
-        }),
+        this.judgeTracked(
+          actionText,
+          contextText,
+          {
+            toolName,
+            toolArgsJson: argsJson,
+            orgName: this.orgName,
+            // Passed through unredacted — caller vouches for the contents.
+            resolved: input.resolved
+          },
+          true
+        ),
         this.decisionTimeoutMs
       );
       return this.decide(result);
@@ -1609,7 +1707,7 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         return {
           allow: false,
           verdict: "ERROR",
-          reason: `The judge's reply failed its signature check (${errorMessage(err)}), so it was not trusted.`
+          reason: `The judge's reply was not trusted (${errorMessage(err)}).`
         };
       }
       if (err instanceof JudgeRefusalError || err instanceof AtbashAPIError && isRefusalStatus(err.status)) {
@@ -1619,20 +1717,20 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     }
   }
   /**
-   * The verify key for one call (R4, governor tier-2 review). A per-call key
-   * may only narrow what the client accepts: on a client pinned to a judge
-   * key it must be that same key, never a replacement; on an unpinned client
-   * it adds the check.
+   * The verify keys for one call (R4, governor tier-2 review). A per-call key
+   * may only narrow what the client accepts: on a client pinned to judge keys
+   * it must be one of them, never a replacement; on an unpinned client it
+   * adds the check.
    */
-  effectiveVerifyKey(perCall) {
-    if (perCall === void 0) return this.verifyPubKey;
+  effectiveVerifyKeys(perCall) {
+    if (perCall === void 0) return this.verifyKeys;
     const key = perCall.trim().toLowerCase();
-    if (this.verifyPubKey !== void 0 && key !== this.verifyPubKey) {
+    if (this.verifyKeys.length > 0 && !this.verifyKeys.includes(key)) {
       throw new SignatureVerificationError(
         "a per-call verifyPubKey cannot replace the judge key this client is pinned to"
       );
     }
-    return key;
+    return [key];
   }
   /**
    * Collapse a judge result into a {@link Decision}. The most restrictive
@@ -1644,7 +1742,12 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
    * never overrides a refusal.
    */
   decide(result) {
-    const inner = this.decideInner(result);
+    const decided = this.applyMode(result);
+    const inner = {
+      ...decided,
+      ...result.judgmentId ? { judgmentId: result.judgmentId } : {},
+      ...result.record ? { record: result.record } : {}
+    };
     if (!result.enforcementMode) return inner;
     return {
       ...inner,
@@ -1652,6 +1755,50 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
       enforcementMode: result.enforcementMode
     };
   }
+  /**
+   * Apply the organisation's enforcement mode to the judge's true verdict.
+   *
+   * Only a mode that arrived signed and bound to this call counts; a missing,
+   * unsigned or unknown mode, or enforceLocally, means enforce. Under
+   * `shadow`, `monitor` or `off` a BLOCK or HOLD runs, reported in
+   * `wouldVerdict`. An ERROR stays an error: it is not a verdict.
+   */
+  applyMode(result) {
+    const mode = result.enforcementMode;
+    const relaxes = this.modeTrusted.has(result) && (mode === "shadow" || mode === "monitor" || mode === "off");
+    if (result.status === "shadow_recorded" && result.verdict === "No verdict") {
+      if (!relaxes || this.enforceLocally) {
+        return {
+          allow: false,
+          verdict: "ERROR",
+          reason: "Atbash recorded this action without judging it (the organisation is not enforcing), and this client requires a verdict.",
+          toolCallId: result.toolCallId
+        };
+      }
+      this.logger.info?.(`[atbash] recorded in ${mode} mode; not judged yet`, {
+        toolCallId: result.toolCallId
+      });
+      return {
+        allow: true,
+        verdict: "ALLOW",
+        reason: `Recorded in ${mode} mode; the verdict appears in the dashboard.`,
+        toolCallId: result.toolCallId
+      };
+    }
+    const inner = this.decideInner(result);
+    if (!relaxes || this.enforceLocally || inner.allow) return inner;
+    if (inner.verdict !== "BLOCK" && inner.verdict !== "HOLD") return inner;
+    this.logger.warn?.(`[atbash] would ${inner.verdict.toLowerCase()} (${mode} mode): ${inner.reason ?? ""}`, {
+      toolCallId: inner.toolCallId
+    });
+    return {
+      allow: true,
+      verdict: "ALLOW",
+      reason: inner.reason,
+      toolCallId: inner.toolCallId,
+      wouldVerdict: inner.verdict
+    };
+  }
   decideInner(result) {
     const toolCallId = result.toolCallId;
     const deny = (verdict, reason) => ({
@@ -1687,7 +1834,9 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
         return {
           allow: false,
           verdict: "ERROR",
-          reason: "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
+          // The judge's own reason says why it did not check (the plan, a
+          // deactivated agent); a fixed "audit-tier plan" hid which.
+          reason: result.reason ? `Atbash did not check this action, and this client requires a checked decision. The judge said: ${result.reason}` : "Atbash logged this action but did not check it (audit-tier plan), and this client requires a checked decision. Upgrade the plan, or set requireEnforcement: false for log-only mode.",
           toolCallId
         };
       }
@@ -1777,32 +1926,52 @@ config.json still holds an "agentKey" (${identity}), but a settings file no long
     const pk = agentPubkey ?? this.auth.pubkey;
     return this.track("getJudgmentStatus", pk, async () => {
       const brid = await this.callBrid(chainOpts);
+      const optIn = this.verifyKeys.length > 0 || this.enforceLocally;
+      const optInValue = this.enforceLocally ? "strict" : "1";
       const resp = await this.http.get(
         "/api/v1/judge",
         { tool_call_id: judgmentId, agent_pubkey: pk, brid },
-        this.authHeaders(brid)
+        {
+          ...this.authHeaders(brid),
+          ...optIn ? { "X-Atbash-Client-Enforcement": optInValue } : {}
+        }
       );
       await this.raiseIfError(resp);
       const bytes = Buffer.from(await resp.arrayBuffer());
-      if (this.verifyPubKey !== void 0) {
-        verifyResponseSignature(bytes, resp, this.verifyPubKey);
+      if (this.verifyKeys.length > 0) {
+        verifyResponseSignature(bytes, resp, this.verifyKeys);
       }
       const parsed = tryParseJson(bytes.toString("utf-8"));
       const data = isRecord2(parsed) ? parsed : {};
-      const rawId = data.tool_call_id ?? data.judgmentId;
+      const rawId = data.tool_call_id;
       const statedId = wireText(rawId);
       const sameCall = rawId === void 0 || rawId === null || statedId === judgmentId;
-      return {
+      let modeTrusted = false;
+      if (optIn) {
+        const echo = data.client_enforcement;
+        if (echo !== void 0 && echo !== optInValue || echo === void 0 && this.enforceLocally) {
+          throw new SignatureVerificationError(
+            "the status does not confirm the enforcement this client asked for"
+          );
+        }
+        modeTrusted = this.verifyKeys.length > 0 && echo === optInValue && statedId === judgmentId;
+      }
+      const status = {
         status: normalizeStatus(data.status),
         verdict: normalizeVerdict(data.verdict),
         allow: sameCall && this.executable(data),
         reason: wireText(data.reason),
         judgmentId: statedId || judgmentId,
-        onChain: optBool(data.onChain),
-        cached: optBool(data.cached),
-        // The Dashboard sends response_time_ms; responseTimeMs is the spec name.
-        responseTimeMs: optNumber(data.responseTimeMs ?? data.response_time_ms)
+        responseTimeMs: optNumber(data.response_time_ms)
       };
+      const mode = wireText(data.enforcement_mode);
+      if (!modeTrusted || this.enforceLocally || !(mode === "shadow" || mode === "monitor" || mode === "off") || status.verdict !== "BLOCK" && status.verdict !== "HOLD") {
+        return status;
+      }
+      this.logger.warn?.(`[atbash] would ${status.verdict.toLowerCase()} (${mode} mode): ${status.reason}`, {
+        toolCallId: judgmentId
+      });
+      return { ...status, verdict: "ALLOW", allow: true, wouldVerdict: status.verdict };
     });
   }
   /* ── risk-engine queries (action-dispatched GET) ───────────────────────── */
@@ -2304,14 +2473,14 @@ async function withDeadline(p, ms) {
     clearTimeout(timer);
   }
 }
-function verifyResponseSignature(bodyBytes, resp, verifyPubKey) {
+function verifyResponseSignature(bodyBytes, resp, verifyKeys) {
   const sig = resp.headers.get("X-Atbash-Signature");
   if (!sig) {
     throw new SignatureVerificationError("missing X-Atbash-Signature header");
   }
-  let ok;
+  let ok = false;
   try {
-    ok = native.verifySignature(bodyBytes, sig, verifyPubKey);
+    ok = verifyKeys.some((key) => native.verifySignature(bodyBytes, sig, key));
   } catch (err) {
     throw new SignatureVerificationError(
       `signature verification threw: ${errorMessage(err)}`
@@ -2403,10 +2572,6 @@ function optNumber(v) {
   const n = Number(v);
   return Number.isFinite(n) ? n : void 0;
 }
-function optBool(v) {
-  if (v === null || v === void 0) return void 0;
-  return Boolean(v);
-}
 function tryParseJson(text) {
   try {
     return JSON.parse(text);
@@ -4086,6 +4251,7 @@ function diffMemorySnapshots(before, after) {
   isEnvelope,
   isJailHeld,
   isValidPrivateKey,
+  judgeVerifyKeys,
   keyFingerprintOf,
   keyPathCandidates,
   loadAgent,
@@ -4112,6 +4278,7 @@ function diffMemorySnapshots(before, after) {
   saveUserConfig,
   scanMemory,
   scanMemoryBatch,
+  setLoopbackJudgePinsForTests,
   setupTelemetry,
   shutdownTelemetry,
   signEncryptedToolCall,