@brightbeamai/chap-coordinator 0.2.12 → 0.3.0

package/dist/index.cjs

@@ -35,8 +35,12 @@ __export(src_exports, {
   deriveKeypair: () => deriveKeypair,
   deriveSeed: () => deriveSeed,
   diffJsonPatch: () => diffJsonPatch,
+  entryCall: () => entryCall,
+  entryRecord: () => entryRecord,
+  isRefusal: () => isRefusal,
   isValidEnvelope: () => isValidEnvelope,
   jwkFromPrivateKey: () => jwkFromPrivateKey,
+  linkHash: () => linkHash,
   makeApi: () => makeApi,
   makeDefaultPolicy: () => makeDefaultPolicy,
   modeLE: () => modeLE,
@@ -57,7 +61,21 @@ var import_node_crypto = require("crypto");
 var ZERO_HASH = "sha256:" + "0".repeat(64);
 var NON_INTEGER_ERROR = 'CHAP canonical numbers must be integers; represent decimals as strings (e.g. "8.2") so the hash is deterministic across implementations.';
 var NUMBER_RANGE_ERROR = "CHAP canonical integers must be within the safe-integer range (abs value <= Number.MAX_SAFE_INTEGER); represent larger numbers as strings.";
+var LONE_SURROGATE_ERROR = "CHAP canonical strings must be valid Unicode (I-JSON / RFC 7493); unpaired UTF-16 surrogates are not permitted.";
+function assertNoLoneSurrogate(s) {
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c >= 55296 && c <= 56319) {
+      const next = i + 1 < s.length ? s.charCodeAt(i + 1) : 0;
+      if (next < 56320 || next > 57343) throw new Error(LONE_SURROGATE_ERROR);
+      i++;
+    } else if (c >= 56320 && c <= 57343) {
+      throw new Error(LONE_SURROGATE_ERROR);
+    }
+  }
+}
 function canonicalString(s) {
+  assertNoLoneSurrogate(s);
   return JSON.stringify(s);
 }
 function canonicalNumber(n) {
@@ -106,6 +124,55 @@ function contentHash(content) {
   return sha256Hex(canonicalize(content));
 }
 
+// src/catalogue.ts
+var OWNING_PROFILE = Object.freeze({
+  "abstain.declare": "review/1.0",
+  "audit.read": "core/1.0",
+  "audit.submit_to_scitt": "audit-scitt/1.0",
+  "audit.verify_chain": "audit-scitt/1.0",
+  "audit.verify_receipt": "audit-scitt/1.0",
+  "control.cancel": "control/1.0",
+  "control.pause": "control/1.0",
+  "control.resume": "control/1.0",
+  "control.rollback": "control/1.0",
+  "control.set_mode_ceiling": "control/1.0",
+  "control.snapshot": "control/1.0",
+  "control.supersede": "control/1.0",
+  "decide.approve": "review/1.0",
+  "decide.override": "review/1.0",
+  "decide.reject": "review/1.0",
+  "deliberate.close": "deliberation/1.0",
+  "deliberate.comment": "deliberation/1.0",
+  "deliberate.open": "deliberation/1.0",
+  "deliberate.vote": "deliberation/1.0",
+  "escalate.auto": "routing/1.0",
+  "escalate.raise": "review/1.0",
+  "handoff.accept": "handoff/1.0",
+  "handoff.decline": "handoff/1.0",
+  "handoff.propose": "handoff/1.0",
+  "participant.join": "core/1.0",
+  "participant.leave": "core/1.0",
+  "participant.revoke_key": "core/1.0",
+  "participant.rotate_key": "core/1.0",
+  "review.depth": "routing/1.0",
+  "review.request": "review/1.0",
+  "task.complete": "core/1.0",
+  "task.create": "core/1.0",
+  "task.route": "routing/1.0",
+  "task.update": "core/1.0",
+  "whisper.answer": "whisper/1.0",
+  "whisper.ask": "whisper/1.0",
+  "workspace.create": "core/1.0",
+  "workspace.describe": "core/1.0",
+  "workspace.set_profiles": "core/1.0"
+});
+var ALWAYS_AVAILABLE = /* @__PURE__ */ new Set([
+  "workspace.describe",
+  "audit.read",
+  "audit.verify_chain",
+  "audit.verify_receipt"
+]);
+
 // src/crypto.ts
 var import_node_crypto2 = require("crypto");
 var ED25519_OID = Buffer.from("302a300506032b6570032100", "hex");
@@ -319,11 +386,84 @@ function isValidEnvelope(env) {
   return e.jsonrpc === "2.0";
 }
 
+// src/audit.ts
+function entryRecord(entry) {
+  if (entry.outcome != null) return { outcome: entry.outcome, request: entry.request };
+  return entry.envelope;
+}
+function entryCall(entry) {
+  return entry.envelope ?? entry.request ?? void 0;
+}
+function isRefusal(entry) {
+  return entry.outcome != null;
+}
+function isCall(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const v = value;
+  return v.jsonrpc === "2.0" && typeof v.method === "string";
+}
+function entryIsWellFormed(entry) {
+  const accepted = entry.envelope != null;
+  const refused = entry.request != null;
+  if (accepted === refused) return false;
+  if (accepted) return isCall(entry.envelope) && entry.outcome == null;
+  const o = entry.outcome;
+  return isCall(entry.request) && o != null && typeof o === "object" && o.status === "refused" && Number.isInteger(o.code);
+}
+function isSigned(call2) {
+  return call2 !== null && typeof call2 === "object" && typeof call2.sig === "string";
+}
+function signedDigest(call2) {
+  const signed = { ...call2 };
+  delete signed.sig;
+  return sha256Hex(canonicalize(signed));
+}
+function linkHash(record, prev) {
+  return sha256Hex(Buffer.concat([canonicalize(record), Buffer.from(prev, "utf-8")]));
+}
+var UNRECORDED_CODES = /* @__PURE__ */ new Set([
+  E.PARSE,
+  E.REQUEST,
+  E.PARAMS,
+  E.INTERNAL,
+  E.SIG_VERIFY_FAILED,
+  E.SIG_KEY_NOT_FOUND,
+  E.SIG_KEY_REVOKED,
+  E.SIG_ROTATION_KEY_MISMATCH
+]);
+var UNRECORDED_METHODS = /* @__PURE__ */ new Set(["workspace.create", "participant.join"]);
+function refusalIsRecorded(method, error, privileged) {
+  if (!Number.isInteger(error.code)) return false;
+  if (UNRECORDED_METHODS.has(method)) return false;
+  if (UNRECORDED_CODES.has(error.code)) return false;
+  if (error.code === E.METHOD) {
+    const data = error.data;
+    return typeof data?.profile === "string" && privileged.has(method);
+  }
+  return true;
+}
+
 // src/patch.ts
 var PatchError = class extends Error {
 };
 var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 var ARRAY_INDEX_RE = /^(0|[1-9][0-9]*)$/;
+function jsonType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  switch (typeof value) {
+    case "object":
+      return "object";
+    case "string":
+      return "string";
+    case "number":
+      return "number";
+    case "boolean":
+      return "boolean";
+    default:
+      return "null";
+  }
+}
 function arrayIndex(seg) {
   if (!ARRAY_INDEX_RE.test(seg)) throw new PatchError(`Array index expected at ${JSON.stringify(seg)}`);
   return Number(seg);
@@ -363,7 +503,7 @@ function navigate(doc, parts) {
       }
       parent = parent[part];
     } else {
-      throw new PatchError(`Cannot traverse into ${typeof parent} at ${JSON.stringify(part)}`);
+      throw new PatchError(`Cannot traverse into ${jsonType(parent)} at ${JSON.stringify(part)}`);
     }
   }
   const last = parts[parts.length - 1];
@@ -433,7 +573,7 @@ function applyOne(doc, op) {
     } else if (parent !== null && typeof parent === "object") {
       parent[key] = op.value;
     } else {
-      throw new PatchError(`Cannot add into ${typeof parent}`);
+      throw new PatchError(`Cannot add into ${jsonType(parent)}`);
     }
     return doc;
   }
@@ -443,7 +583,7 @@ function applyOne(doc, op) {
     if (parts.length === 0) return op.value;
     const [parent, key] = navigate(doc, parts);
     if (Array.isArray(parent)) {
-      const idx = key;
+      const idx = key === "-" ? -1 : key;
       if (idx < 0 || idx >= parent.length) {
         throw new PatchError(`Path not found for replace: ${path}`);
       }
@@ -454,7 +594,7 @@ function applyOne(doc, op) {
       }
       parent[key] = op.value;
     } else {
-      throw new PatchError(`Cannot replace in ${typeof parent}`);
+      throw new PatchError(`Cannot replace in ${jsonType(parent)}`);
     }
     return doc;
   }
@@ -463,7 +603,7 @@ function applyOne(doc, op) {
     if (parts.length === 0) throw new PatchError("Cannot remove root.");
     const [parent, key] = navigate(doc, parts);
     if (Array.isArray(parent)) {
-      const idx = key;
+      const idx = key === "-" ? -1 : key;
       if (idx < 0 || idx >= parent.length) {
         throw new PatchError(`Index out of range for remove: ${path}`);
       }
@@ -474,7 +614,7 @@ function applyOne(doc, op) {
       }
       delete parent[key];
     } else {
-      throw new PatchError(`Cannot remove from ${typeof parent}`);
+      throw new PatchError(`Cannot remove from ${jsonType(parent)}`);
     }
     return doc;
   }
@@ -682,7 +822,8 @@ function modeLE(a, ceiling) {
 }
 
 // src/profiles/audit_scitt.ts
-function buildStatement(workspaceId, envelope, issuer) {
+var MALFORMED = "sha256:malformed";
+function buildStatement(workspaceId, record, issuer) {
   return {
     protected: {
       alg: -8,
@@ -690,9 +831,9 @@ function buildStatement(workspaceId, envelope, issuer) {
       iss: issuer,
       kid: "scitt-issuer",
       cwt_claims: { sub: workspaceId, iat: null },
-      "content-type": "application/chap+json;version=0.2"
+      "content-type": "application/chap+json;version=0.3"
     },
-    payload: canonicalize(envelope).toString("utf-8"),
+    payload: canonicalize(record).toString("utf-8"),
     signature: "<deployment-supplied>"
   };
 }
@@ -705,7 +846,7 @@ function registerAuditScitt(coord) {
     const toSeq = range.to_seq ?? ws.audit.length;
     const issuer = p.issuer ?? "service:coordinator";
     if (!coord.options.scittSubmitter) {
-      const statements = ws.audit.slice(fromSeq, toSeq).map((e) => buildStatement(ws.id, e.envelope, issuer));
+      const statements = ws.audit.slice(fromSeq, toSeq).map((e) => buildStatement(ws.id, entryRecord(e), issuer));
       return { result: {
         statements,
         note: "No scittSubmitter configured; submit these out-of-band"
@@ -713,7 +854,7 @@ function registerAuditScitt(coord) {
     }
     const receipts = [];
     for (const entry of ws.audit.slice(fromSeq, toSeq)) {
-      const statement = buildStatement(ws.id, entry.envelope, issuer);
+      const statement = buildStatement(ws.id, entryRecord(entry), issuer);
       let receipt;
       try {
         receipt = coord.options.scittSubmitter(statement);
@@ -765,12 +906,20 @@ function registerAuditScitt(coord) {
     if (start < 0) start = ws.audit.length;
     const errors = [];
     let prev = ZERO_HASH;
+    let resync = false;
     for (const e of ws.audit.slice(start)) {
-      const expectedPrev = prev;
+      const expectedPrev = resync && typeof e.prev_hash === "string" ? e.prev_hash : prev;
+      resync = false;
       if (e.prev_hash !== expectedPrev) {
         errors.push(`seq ${e.seq}: prev_hash mismatch`);
       }
-      prev = sha256Hex(Buffer.concat([canonicalize(e.envelope), Buffer.from(expectedPrev, "utf-8")]));
+      if (!entryIsWellFormed(e)) {
+        errors.push(`seq ${e.seq}: malformed entry`);
+        prev = MALFORMED;
+        resync = true;
+        continue;
+      }
+      prev = linkHash(entryRecord(e), expectedPrev);
     }
     const storedHead = ws.chain_head === void 0 || ws.chain_head === null ? ZERO_HASH : ws.chain_head;
     if (prev !== storedHead) {
@@ -825,6 +974,7 @@ function registerControl(coord) {
       }
       task.paused = true;
       const prior = task.state;
+      if (prior !== "paused") task.paused_from = prior;
       task.state = "paused";
       task.updated_at = coord.now();
       task.history.push({ ts: task.updated_at, from: p.from, state: "paused", note: `was ${prior}` });
@@ -858,10 +1008,12 @@ function registerControl(coord) {
         return { error: rpcError(E.CONTROL_NOT_AUTHORISED, `Cannot resume ${task.state} task`) };
       }
       task.paused = false;
-      task.state = "in_progress";
+      const restored = task.paused_from ?? "in_progress";
+      task.paused_from = void 0;
+      task.state = restored;
       task.updated_at = coord.now();
-      task.history.push({ ts: task.updated_at, from: p.from, state: "in_progress" });
-      return { result: { scope: "task", task_id: task.id, state: "in_progress" } };
+      task.history.push({ ts: task.updated_at, from: p.from, state: restored });
+      return { result: { scope: "task", task_id: task.id, state: restored } };
     }
     if (scope === "participant") {
       const uri = p.participant_uri || p.uri;
@@ -888,36 +1040,56 @@ function registerControl(coord) {
   coord.handlers.set("control.snapshot", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
-    const include = p.include ?? ["members", "open_tasks", "mode_ceiling"];
+    if (Array.isArray(p.include) && p.include.length === 0) {
+      return { error: rpcError(E.PARAMS, "include must not be empty") };
+    }
+    const include = Array.isArray(p.include) ? [...p.include] : ["members", "open_tasks", "mode_ceiling"];
     const state = {};
     if (include.includes("members")) {
-      state.members = Array.from(ws.members.values()).map((m) => ({
+      const members = Array.from(ws.members.values()).map((m) => ({
         uri: m.uri,
         type: m.type,
-        role: m.role,
-        scopes: m.scopes
+        ...m.role ? { role: m.role } : {},
+        ...m.scopes?.length ? { scopes: m.scopes } : {}
       }));
+      if (members.length) state.members = members;
     }
     if (include.includes("open_tasks")) {
-      state.open_tasks = Array.from(ws.tasks.values()).filter((t) => t.state !== "completed" && t.state !== "declined" && t.state !== "cancelled" && t.state !== "superseded").map((t) => ({ id: t.id, kind: t.kind, state: t.state, assignee: t.assignee }));
+      const tasks = Array.from(ws.tasks.values()).filter((t) => t.state !== "completed" && t.state !== "declined" && t.state !== "cancelled" && t.state !== "superseded").map((t) => ({
+        id: t.id,
+        kind: t.kind,
+        state: t.state,
+        ...t.assignee ? { assignee: t.assignee } : {}
+      }));
+      if (tasks.length) state.open_tasks = tasks;
     }
     if (include.includes("mode_ceiling")) state.mode_ceiling = ws.mode_ceiling;
-    if (include.includes("policy")) state.routing_policy_uri = ws.routing_policy_uri;
+    if (include.includes("policy") && ws.routing_policy_uri) state.routing_policy_uri = ws.routing_policy_uri;
     if (include.includes("audit") || include.includes("all")) state.audit_seq = ws.audit.length;
+    const content = structuredClone({
+      workspace: ws.id,
+      audit_seq: ws.audit.length,
+      include,
+      state,
+      ...p.label ? { label: p.label } : {}
+    });
     const snapId = coord.ids.artefactId();
     const snap = {
       id: snapId,
       kind: "snapshot",
-      ts: coord.now(),
-      by: p.from,
-      workspace: ws.id,
-      audit_seq: ws.audit.length,
-      label: p.label,
-      include,
-      state
+      produced_at: coord.now(),
+      produced_by: p.from,
+      content_hash: contentHash(content),
+      content
     };
     ws.snapshots.set(snapId, snap);
-    return { result: { snapshot_artefact_id: snapId, audit_seq: snap.audit_seq, artefact: snap } };
+    return {
+      result: {
+        snapshot_artefact_id: snapId,
+        audit_seq: snap.content.audit_seq,
+        artefact: structuredClone(snap)
+      }
+    };
   });
   coord.handlers.set("control.rollback", (p) => {
     const ws = coord.workspaces.get(p.workspace);
@@ -926,31 +1098,34 @@ function registerControl(coord) {
     if (!snapId) return { error: rpcError(E.PARAMS, "to_snapshot_artefact_id is required") };
     const snap = ws.snapshots.get(snapId);
     if (!snap) return { error: rpcError(E.CONTROL_SNAPSHOT_NOT_FOUND, `Unknown snapshot: ${snapId}`) };
-    const what = p.what_to_restore ?? snap.include;
+    if (Array.isArray(p.what_to_restore) && p.what_to_restore.length === 0) {
+      return { error: rpcError(E.PARAMS, "what_to_restore must not be empty") };
+    }
+    const what = p.what_to_restore ?? snap.content.include;
     const restored = [];
-    if (what.includes("mode_ceiling") && snap.state.mode_ceiling) {
-      ws.mode_ceiling = snap.state.mode_ceiling;
+    if (what.includes("mode_ceiling") && snap.content.state.mode_ceiling) {
+      ws.mode_ceiling = snap.content.state.mode_ceiling;
       restored.push("mode_ceiling");
     }
-    if (what.includes("members") && Array.isArray(snap.state.members)) {
+    if (what.includes("members") && Array.isArray(snap.content.state.members)) {
       const snapByUri = /* @__PURE__ */ new Map();
-      for (const m of snap.state.members) {
+      for (const m of snap.content.state.members) {
         snapByUri.set(m.uri, m);
       }
       for (const [uri, snapM] of snapByUri) {
         if (ws.members.has(uri)) {
           const cur = ws.members.get(uri);
           cur.role = snapM.role ?? cur.role;
-          cur.scopes = snapM.scopes;
+          cur.scopes = Array.isArray(snapM.scopes) ? [...snapM.scopes] : void 0;
         }
       }
       restored.push("members");
     }
     return { result: {
       rolled_back_to: snapId,
-      audit_seq: snap.audit_seq,
+      audit_seq: snap.content.audit_seq,
       restored,
-      reason: p.reason
+      ...p.reason ? { reason: p.reason } : {}
     } };
   });
   coord.handlers.set("control.supersede", (p) => {
@@ -964,16 +1139,25 @@ function registerControl(coord) {
       return { error: rpcError(E.PARAMS, "successor_task must include kind") };
     }
     const assignee = newSpec.assignee || old.assignee;
-    if (!ws.members.has(assignee)) {
+    if (typeof assignee !== "string" || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "successor assignee not in workspace") };
     }
-    const requestedMode = newSpec.mode ?? old.mode;
+    if (ws.members.get(assignee).paused) {
+      return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${assignee} is paused`) };
+    }
+    if (newSpec.mode !== void 0 && newSpec.mode !== null && typeof newSpec.mode !== "string") {
+      return { error: rpcError(E.PARAMS, "successor_task.mode must be a string") };
+    }
+    const requestedMode = newSpec.mode || old.mode;
     if (!modeLE(requestedMode, ws.mode_ceiling)) {
       return { error: rpcError(
         E.MODE_CEILING_EXCEEDED,
         `Requested mode ${requestedMode} exceeds ceiling ${ws.mode_ceiling}`
       ) };
     }
+    if (newSpec.review_required !== void 0 && newSpec.review_required !== null && typeof newSpec.review_required !== "boolean") {
+      return { error: rpcError(E.PARAMS, "successor_task.review_required must be a boolean") };
+    }
     const now = coord.now();
     const newId = coord.ids.taskId();
     const newTask = {
@@ -995,8 +1179,11 @@ function registerControl(coord) {
       }],
       paused: false
     };
-    if (ws.profiles.some((pr) => pr.startsWith("modes/")) && newTask.mode === "trial") newTask.review_required = true;
-    else if ("review_required" in newSpec) newTask.review_required = !!newSpec.review_required;
+    if (old.review_required || ws.profiles.some((pr) => pr.startsWith("modes/")) && newTask.mode === "trial") {
+      newTask.review_required = true;
+    } else if ("review_required" in newSpec) {
+      newTask.review_required = !!newSpec.review_required;
+    }
     ws.tasks.set(newId, newTask);
     old.state = "superseded";
     old.superseded_by = newId;
@@ -1293,8 +1480,14 @@ function registerHandoff(coord) {
         ) };
       }
     }
+    if (ws.members.get(acceptor).paused) {
+      return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Acceptor ${acceptor} is paused`) };
+    }
+    if (Array.isArray(p.accepted_task_ids) && p.accepted_task_ids.length === 0) {
+      return { error: rpcError(E.PARAMS, "accepted_task_ids must not be empty") };
+    }
     const validIds = new Set(ho.tasks.map((t) => t.task_id));
-    const acceptedIds = Array.isArray(p.accepted_task_ids) ? p.accepted_task_ids : ho.tasks.map((t) => t.task_id);
+    const acceptedIds = Array.isArray(p.accepted_task_ids) ? [...p.accepted_task_ids] : ho.tasks.map((t) => t.task_id);
     for (const tid of acceptedIds) {
       if (!validIds.has(tid)) {
         return { error: rpcError(E.PARAMS, `Task ${tid} not in this handoff`) };
@@ -1365,6 +1558,9 @@ function registerRouting(coord) {
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (p.candidates !== void 0 && p.candidates !== null && !Array.isArray(p.candidates)) {
+      return { error: rpcError(E.PARAMS, "candidates must be a list") };
+    }
     const candidates = p.candidates ?? [];
     if (!candidates.length) {
       return { error: rpcError(E.ROUTING_CANDIDATES_EMPTY, "candidates array was empty") };
@@ -1381,19 +1577,29 @@ function registerRouting(coord) {
         return { error: rpcError(E.ROUTING_POLICY_UNREACHABLE, `routing policy error: ${msg}`) };
       }
     } else {
-      const eligible = candidates.filter((c) => ws.members.has(c));
+      const memberOf = (c) => typeof c === "string" ? ws.members.get(c) : void 0;
+      const eligible = candidates.filter((c) => {
+        const m = memberOf(c);
+        return !!m && !m.paused;
+      });
       if (!eligible.length) {
-        return { error: rpcError(E.ROUTING_NO_ELIGIBLE_ASSIGNEE, "No candidate is a workspace member") };
+        return { error: rpcError(E.ROUTING_NO_ELIGIBLE_ASSIGNEE, "No candidate is a workspace member who is not paused") };
       }
       selected = eligible[0];
+      const alternatives = [];
+      let chosen = false;
+      for (const c of candidates) {
+        const m = memberOf(c);
+        if (!m) continue;
+        if (m.paused) alternatives.push({ candidate: c, reason_excluded: "paused" });
+        else if (!chosen) chosen = true;
+        else alternatives.push({ candidate: c, reason_excluded: "not first eligible" });
+      }
       rationale = {
         policy_id: "default",
         hints_used: Object.keys(task.routing_hints ?? {}),
         summary: "default policy: first eligible candidate",
-        alternatives_considered: eligible.slice(1).map((c) => ({
-          candidate: c,
-          reason_excluded: "not first eligible"
-        }))
+        alternatives_considered: alternatives
       };
     }
     if (!ws.members.has(selected)) {
@@ -1402,6 +1608,9 @@ function registerRouting(coord) {
         `Selected ${JSON.stringify(selected)} is not a member`
       ) };
     }
+    if (ws.members.get(selected).paused) {
+      return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${selected} is paused`) };
+    }
     task.assignee = selected;
     task.updated_at = coord.now();
     task.history.push({
@@ -1519,6 +1728,18 @@ function registerRouting(coord) {
         hints_used: ["criticality", "confidence"]
       };
     }
+    if (escalate) {
+      if (!to) return { error: rpcError(
+        E.ROUTING_ESC_TARGET_UNAVAILABLE,
+        "Escalation triggered but no target available"
+      ) };
+      if (!to.startsWith("group:") && !ws.members.has(to)) {
+        return { error: rpcError(
+          E.ROUTING_ESC_TARGET_UNAVAILABLE,
+          `Escalation target ${to} is not a member or group`
+        ) };
+      }
+    }
     const artId = coord.ids.artefactId();
     const artefact = {
       id: artId,
@@ -1535,17 +1756,7 @@ function registerRouting(coord) {
     };
     ws.route_decisions.set(artId, artefact);
     if (escalate) {
-      if (!to) return { error: rpcError(
-        E.ROUTING_ESC_TARGET_UNAVAILABLE,
-        "Escalation triggered but no target available"
-      ) };
-      if (!to.startsWith("group:") && !ws.members.has(to)) {
-        return { error: rpcError(
-          E.ROUTING_ESC_TARGET_UNAVAILABLE,
-          `Escalation target ${to} is not a member or group`
-        ) };
-      }
-      if (coord.options.onAutoEscalate) {
+      if (coord.options.onAutoEscalate && to) {
         try {
           coord.options.onAutoEscalate(task, to);
         } catch {
@@ -1615,6 +1826,12 @@ function registerSecuritySigned(coord) {
 function parseIso(ts) {
   return new Date(ts).getTime();
 }
+function present(v) {
+  if (v === void 0 || v === null || v === false || v === 0 || v === "") return false;
+  if (Array.isArray(v)) return v.length > 0;
+  if (typeof v === "object") return Object.keys(v).length > 0;
+  return true;
+}
 function registerWhisper(coord) {
   coord.handlers.set("whisper.ask", (p) => {
     const ws = coord.workspaces.get(p.workspace);
@@ -1625,6 +1842,9 @@ function registerWhisper(coord) {
     if (!ws.tasks.has(p.task_id)) {
       return { error: rpcError(E.PARAMS, "Unknown task") };
     }
+    if (p.options !== void 0 && p.options !== null && !Array.isArray(p.options)) {
+      return { error: rpcError(E.PARAMS, "options must be a list") };
+    }
     const to = p.to;
     const askee = Array.isArray(to) ? to : [to];
     const id = p.whisper_id || coord.ids.artefactId();
@@ -1668,22 +1888,21 @@ function registerWhisper(coord) {
       return { error: rpcError(E.WHISPER_LAPSED, "Whisper already lapsed") };
     }
     const answerOption = p.answer_option;
-    const answerText = p.answer ?? p.answer_text;
+    const hasOption = answerOption !== void 0 && answerOption !== null;
+    const answerText = present(p.answer) ? p.answer : p.answer_text;
     if (prompt.options && prompt.options.length) {
-      if (answerOption === void 0) {
+      if (!hasOption) {
         return { error: rpcError(E.PARAMS, "answer_option is required when options are defined") };
       }
       const valid = new Set(prompt.options.map((o) => o.id));
       if (!valid.has(answerOption)) {
         return { error: rpcError(
           E.WHISPER_OPTION_NOT_IN_SET,
-          `Answer option ${JSON.stringify(answerOption)} not in option set`
+          `Answer option ${canonicalize(answerOption).toString("utf-8")} not in option set`
         ) };
       }
-    } else {
-      if (answerText === void 0 && answerOption === void 0) {
-        return { error: rpcError(E.PARAMS, "answer or answer_option required") };
-      }
+    } else if (!present(answerText) && !hasOption) {
+      return { error: rpcError(E.PARAMS, "answer or answer_option required") };
     }
     prompt.state = "answered";
     prompt.answered_at = coord.now();
@@ -1691,7 +1910,6 @@ function registerWhisper(coord) {
     prompt.answer_option = answerOption;
     prompt.answer_text = answerText;
     prompt.comment = p.comment;
-    p.task_id = prompt.task_id;
     return { result: { answered: true, whisper_id: prompt.id, task_id: prompt.task_id } };
   });
   coord.checkWhisperLapses = (workspaceId, now) => {
@@ -1744,14 +1962,38 @@ var PRIVILEGED_METHODS = /* @__PURE__ */ new Set([
   "participant.rotate_key",
   "participant.revoke_key"
 ]);
+var MEMBER_ONLY_METHODS = /* @__PURE__ */ new Set([
+  "task.route",
+  "review.depth",
+  "escalate.auto",
+  "participant.leave"
+]);
 var READ_ONLY_METHODS = /* @__PURE__ */ new Set([
   "workspace.describe",
   "audit.read",
   "audit.verify_chain",
-  "audit.verify_receipt"
+  "audit.verify_receipt",
+  // Submitting the chain to a transparency service reads it and sends it
+  // onward. Recording the submission would append to the very log being
+  // submitted, so the receipt would attest a chain one entry shorter.
+  "audit.submit_to_scitt"
 ]);
 var MAX_IDEMPOTENCY_KEYS = 1e4;
 var DEFAULT_MAX_ENVELOPE_BYTES = 1048576;
+var MAX_NESTING = 64;
+function withinNesting(value, limit) {
+  const stack = [[value, 1]];
+  while (stack.length) {
+    const [node, depth] = stack.pop();
+    if (depth > limit) return false;
+    if (Array.isArray(node)) {
+      for (const v of node) stack.push([v, depth + 1]);
+    } else if (node !== null && typeof node === "object") {
+      for (const v of Object.values(node)) stack.push([v, depth + 1]);
+    }
+  }
+  return true;
+}
 function nowIso(clockMs) {
   const d = clockMs === void 0 ? /* @__PURE__ */ new Date() : new Date(clockMs);
   return d.toISOString().replace(/\.(\d{3})Z$/, ".$1Z");
@@ -1767,9 +2009,6 @@ function tagsError(p) {
   }
   return null;
 }
-function linkHash(envelope, prev) {
-  return sha256Hex(Buffer.concat([canonicalize(envelope), Buffer.from(prev, "utf-8")]));
-}
 function reviewRuleSupported(rule) {
   if (rule === "any_one_approves" || rule === "all_approve") return true;
   if (rule.startsWith("quorum:")) {
@@ -1795,14 +2034,35 @@ function reply(env, body) {
   else out.result = body.result;
   return out;
 }
+function indexSigned(index, entry) {
+  const call2 = entryCall(entry);
+  if (!isSigned(call2)) return;
+  let digest;
+  try {
+    digest = signedDigest(call2);
+  } catch {
+    return;
+  }
+  if (entry.outcome != null) index.refused.set(digest, { seq: entry.seq, code: entry.outcome.code });
+  else index.accepted.add(digest);
+}
+var REVIEW_REQUEST_STOPPED = ["cancelled", "superseded", "paused"];
 var Coordinator = class {
   workspaces = /* @__PURE__ */ new Map();
   options;
   ids;
   store;
   wsVersions = /* @__PURE__ */ new Map();
+  saveChains = /* @__PURE__ */ new Map();
   clockMs;
+  frozenNow;
   auditListeners = [];
+  /**
+   * The signed calls on each workspace's log, by what their senders signed:
+   * recorded refusals with their seq and code, and accepted calls. Rebuilt
+   * from the log when missing, so a snapshot never carries it.
+   */
+  signedIndexes = /* @__PURE__ */ new WeakMap();
   /** Method handler registry; profiles plug into this. */
   handlers = /* @__PURE__ */ new Map();
   /** Custom lapse-check function (whisper/1.0). Set by the whisper profile. */
@@ -1844,42 +2104,72 @@ var Coordinator = class {
     this.applyRecords(records);
   }
   applyRecords(records) {
-    this.workspaces.clear();
     this.wsVersions.clear();
-    for (const r of records) {
-      this.restore([r.data]);
-      this.wsVersions.set(r.id, r.version);
-    }
+    this.restore(records.map((r) => r.data));
+    for (const r of records) this.wsVersions.set(r.id, r.version);
   }
   /** Persist the current snapshot of one workspace to the store. */
   persist(ws) {
     const next = (this.wsVersions.get(ws.id) ?? 0) + 1;
     this.wsVersions.set(ws.id, next);
+    let record;
     try {
       const all = this.snapshot();
       const data = all.find((w) => w.id === ws.id);
       if (!data) return;
-      const result = this.store.save({
-        id: ws.id,
-        data,
-        version: next,
-        updated_at: this.now()
-      });
-      if (result instanceof Promise) {
-        result.catch(() => {
-        });
-      }
+      record = { id: ws.id, data, version: next, updated_at: this.now() };
     } catch {
+      return;
+    }
+    const pending = this.saveChains.get(ws.id);
+    if (pending) {
+      this.trackSave(pending.then(() => this.store.save(record)), record);
+      return;
+    }
+    let result;
+    try {
+      result = this.store.save(record);
+    } catch (err) {
+      this.reportStoreError(err, record);
+      return;
+    }
+    if (result instanceof Promise) {
+      this.trackSave(result, record);
+    }
+  }
+  trackSave(save, record) {
+    const guarded = save.catch((err) => this.reportStoreError(err, record));
+    this.saveChains.set(record.id, guarded);
+    void guarded.then(() => {
+      if (this.saveChains.get(record.id) === guarded) {
+        this.saveChains.delete(record.id);
+      }
+    });
+  }
+  reportStoreError(err, record) {
+    if (this.options.onStoreError) {
+      try {
+        this.options.onStoreError(err, { id: record.id, version: record.version });
+      } catch {
+      }
+    }
+  }
+  async drainSaves() {
+    while (this.saveChains.size) {
+      await Promise.allSettled([...this.saveChains.values()]);
     }
   }
   // -- lifecycle -----------------------------------------------------
-  now() {
+  advanceClock() {
     if (this.clockMs !== void 0) {
       this.clockMs += 1e3;
       return nowIso(this.clockMs);
     }
     return nowIso();
   }
+  now() {
+    return this.frozenNow ?? this.advanceClock();
+  }
   onAudit(listener) {
     this.auditListeners.push(listener);
     return () => {
@@ -1904,8 +2194,11 @@ var Coordinator = class {
    * error-table divergence is tracked separately.)
    */
   requireMember(ws, sender) {
-    if (typeof sender !== "string" || !ws.members.has(sender)) {
-      return { error: rpcError(E.NOT_AUTHORISED, `Not a workspace member: ${String(sender)}`) };
+    if (typeof sender !== "string") {
+      return { error: rpcError(E.NOT_AUTHORISED, "Not a workspace member: from is not a participant URI") };
+    }
+    if (!ws.members.has(sender)) {
+      return { error: rpcError(E.NOT_AUTHORISED, `Not a workspace member: ${sender}`) };
     }
     return null;
   }
@@ -2002,8 +2295,40 @@ var Coordinator = class {
         ws.deliberations.set(x.id, x);
       for (const x of w.handoffs ?? [])
         ws.handoffs.set(x.id, x);
-      for (const x of w.snapshots ?? [])
-        ws.snapshots.set(x.id, x);
+      for (const x of w.snapshots ?? []) {
+        const content = structuredClone(x.content ?? {
+          workspace: x.workspace,
+          audit_seq: x.audit_seq,
+          include: x.include,
+          state: x.state,
+          ...x.label ? { label: x.label } : {}
+        });
+        if (!x.content) {
+          const oldState = content.state;
+          const state = {};
+          for (const key of ["mode_ceiling", "routing_policy_uri", "audit_seq"]) {
+            if (oldState[key] != null && oldState[key] !== "") state[key] = oldState[key];
+          }
+          for (const [key, fields] of [
+            ["members", ["uri", "type", "role", "scopes"]],
+            ["open_tasks", ["id", "kind", "state", "assignee"]]
+          ]) {
+            const items = oldState[key];
+            if (Array.isArray(items) && items.length) {
+              state[key] = items.map((item) => Object.fromEntries(fields.filter((field) => item[field] != null && item[field] !== "" && (!Array.isArray(item[field]) || item[field].length > 0)).map((field) => [field, item[field]])));
+            }
+          }
+          content.state = state;
+        }
+        ws.snapshots.set(x.id, {
+          id: x.id,
+          kind: "snapshot",
+          produced_by: x.produced_by ?? x.by,
+          produced_at: x.produced_at ?? x.ts,
+          content_hash: x.content_hash ?? contentHash(content),
+          content
+        });
+      }
       for (const x of w.route_decisions ?? [])
         ws.route_decisions.set(x.id, x);
       this.workspaces.set(ws.id, ws);
@@ -2011,14 +2336,29 @@ var Coordinator = class {
   }
   // -- dispatch ------------------------------------------------------
   dispatch(envelope) {
-    if (!isValidEnvelope(envelope) || !envelope.method) {
+    this.frozenNow = this.advanceClock();
+    try {
+      const response = this._dispatch(envelope);
+      if (response.error) this.recordRefusal(envelope, response.error);
+      return response;
+    } finally {
+      this.frozenNow = void 0;
+    }
+  }
+  _dispatch(envelope) {
+    if (!isValidEnvelope(envelope) || typeof envelope.method !== "string" || !envelope.method) {
       return reply(envelope, { error: rpcError(E.REQUEST, "Invalid JSON-RPC 2.0 request") });
     }
+    if (!withinNesting(envelope, MAX_NESTING)) {
+      return reply(envelope, { error: rpcError(E.REQUEST, `Envelope nests deeper than ${MAX_NESTING} levels`) });
+    }
     const maxBytes = this.options.maxEnvelopeBytes ?? DEFAULT_MAX_ENVELOPE_BYTES;
     let size = 0;
+    let canonicalError;
     try {
       size = canonicalize(envelope).length;
-    } catch {
+    } catch (e) {
+      canonicalError = e;
     }
     if (size > maxBytes) {
       return reply(envelope, { error: rpcError(
@@ -2032,6 +2372,28 @@ var Coordinator = class {
       return reply(envelope, { error: rpcError(E.PARAMS, "Invalid params: expected an object") });
     }
     const params = rawParams ?? {};
+    const handler = this.handlers.get(method);
+    if (!handler) {
+      return reply(envelope, { error: rpcError(E.METHOD, `Unknown method: ${method}`) });
+    }
+    if (canonicalError !== void 0) {
+      const msg = canonicalError instanceof Error ? canonicalError.message : String(canonicalError);
+      return reply(envelope, { error: rpcError(E.PARAMS, msg) });
+    }
+    if (isSigned(envelope)) {
+      const wsId2 = params.workspace;
+      const ws = typeof wsId2 === "string" ? this.workspaces.get(wsId2) : void 0;
+      if (ws) {
+        const prior = this.signedIndex(ws).refused.get(signedDigest(envelope));
+        if (prior) {
+          return reply(envelope, { error: rpcError(
+            prior.code,
+            `Refused at seq ${prior.seq}; a refused request is not evaluated again`,
+            { refused_at_seq: prior.seq }
+          ) });
+        }
+      }
+    }
     if (this.options.requireSignatures && method !== "participant.join" && method !== "workspace.create") {
       const sigErr = this.verifySignature(envelope);
       if (sigErr) return reply(envelope, { error: sigErr });
@@ -2050,7 +2412,11 @@ var Coordinator = class {
       const stale = this.checkStepUp(params);
       if (stale) return reply(envelope, { error: stale });
     }
-    if (method.startsWith("control.") || method.startsWith("deliberate.") || method.startsWith("handoff.") || method.startsWith("whisper.")) {
+    {
+      const gate = this.profileGate(method, params);
+      if (gate) return reply(envelope, { error: gate });
+    }
+    if (method.startsWith("control.") || method.startsWith("deliberate.") || method.startsWith("handoff.") || method.startsWith("whisper.") || MEMBER_ONLY_METHODS.has(method)) {
       const wsId2 = params.workspace;
       const ws = typeof wsId2 === "string" ? this.workspaces.get(wsId2) : void 0;
       if (ws) {
@@ -2085,16 +2451,6 @@ var Coordinator = class {
         if (task) return reply(envelope, { result: { task_id: existingId, state: task.state } });
       }
     }
-    const handler = this.handlers.get(method);
-    if (!handler) {
-      return reply(envelope, { error: rpcError(E.METHOD, `Unknown method: ${method}`) });
-    }
-    try {
-      canonicalize(envelope);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      return reply(envelope, { error: rpcError(E.PARAMS, msg) });
-    }
     let out;
     try {
       out = handler(params);
@@ -2112,17 +2468,56 @@ var Coordinator = class {
   }
   // -- audit ---------------------------------------------------------
   recordAudit(ws, envelope) {
-    const entry = {
-      seq: ws.audit.length,
-      arrived: this.now(),
-      envelope: JSON.parse(JSON.stringify(envelope))
-    };
+    this.appendEntry(ws, { envelope: JSON.parse(JSON.stringify(envelope)) });
+  }
+  /**
+   * SPECIFICATION 10.1: record a refused call when it is a governed attempt.
+   * The caller must be a member of an existing workspace, the call must be a
+   * JSON-RPC call for a method that is not a read, and the refusal must be one
+   * `refusalIsRecorded` names. The request is kept as it arrived, so a
+   * signature on it still verifies. Every call that reaches a recorded refusal
+   * has passed the canonical check, so it can be hashed into the chain.
+   */
+  recordRefusal(envelope, error) {
+    if (!isValidEnvelope(envelope) || typeof envelope.method !== "string") return;
+    const method = envelope.method;
+    if (READ_ONLY_METHODS.has(method)) return;
+    if (!refusalIsRecorded(method, error, PRIVILEGED_METHODS)) return;
+    const raw = envelope.params;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return;
+    const params = raw;
+    const ws = typeof params.workspace === "string" ? this.workspaces.get(params.workspace) : void 0;
+    if (!ws || typeof params.from !== "string" || !ws.members.has(params.from)) return;
+    if (isSigned(envelope)) {
+      const index = this.signedIndex(ws);
+      const digest = signedDigest(envelope);
+      if (index.refused.has(digest) || index.accepted.has(digest)) return;
+    }
+    this.appendEntry(ws, {
+      request: JSON.parse(JSON.stringify(envelope)),
+      outcome: { status: "refused", code: error.code }
+    });
+  }
+  /** The signed calls on this workspace's log, built from the log when missing. */
+  signedIndex(ws) {
+    let index = this.signedIndexes.get(ws);
+    if (!index) {
+      index = { refused: /* @__PURE__ */ new Map(), accepted: /* @__PURE__ */ new Set() };
+      for (const entry of ws.audit) indexSigned(index, entry);
+      this.signedIndexes.set(ws, index);
+    }
+    return index;
+  }
+  appendEntry(ws, record) {
+    const entry = { seq: ws.audit.length, arrived: this.now(), ...record };
     if (ws.chain_enabled || this.options.enableChain) {
       const prev = ws.chain_head ?? ZERO_HASH;
       entry.prev_hash = prev;
-      ws.chain_head = linkHash(entry.envelope, prev);
+      ws.chain_head = linkHash(entryRecord(entry), prev);
     }
     ws.audit.push(entry);
+    const index = this.signedIndexes.get(ws);
+    if (index) indexSigned(index, entry);
     for (const l of this.auditListeners) {
       try {
         l(ws, entry);
@@ -2145,10 +2540,14 @@ var Coordinator = class {
     const params = envelope.params ?? {};
     const sender = params.from;
     const wsId = params.workspace;
-    const ts = params.ts ?? this.now();
-    if (!sender || !wsId) {
+    const rawTs = params.ts;
+    if (typeof sender !== "string" || !sender || typeof wsId !== "string" || !wsId) {
       return rpcError(E.SIG_VERIFY_FAILED, "Cannot verify signature: missing from/workspace");
     }
+    if (rawTs !== void 0 && rawTs !== null && typeof rawTs !== "string") {
+      return rpcError(E.SIG_VERIFY_FAILED, "Cannot verify signature: ts must be a string");
+    }
+    const ts = rawTs ?? this.now();
     const ws = this.workspaces.get(wsId);
     if (!ws) {
       return rpcError(E.SIG_VERIFY_FAILED, "Cannot verify signature: unknown workspace");
@@ -2193,10 +2592,34 @@ var Coordinator = class {
     return null;
   }
   // -- step-up (identity-oidc/1.0) -----------------------------------
+  /**
+   * The SPECIFICATION 15.4 check, per method rather than per namespace.
+   *
+   * Core is always present, so a core method is never gated. The reads in
+   * ALWAYS_AVAILABLE are never gated either: a workspace must be able to ask
+   * what it is and to check its own chain, and `audit.verify_chain` belongs to
+   * `audit-scitt/1.0` while chaining also turns on through an option, so
+   * gating it would let a workspace write a hash-linked chain it is refused
+   * permission to verify.
+   */
+  profileGate(method, params) {
+    const owner = OWNING_PROFILE[method];
+    if (owner === void 0 || owner === "core/1.0" || ALWAYS_AVAILABLE.has(method)) return void 0;
+    const wsId = params.workspace;
+    const ws = typeof wsId === "string" ? this.workspaces.get(wsId) : void 0;
+    if (!ws) return void 0;
+    const name = owner.split("/")[0];
+    if (ws.profiles.some((p) => p === name || p.startsWith(name + "/"))) return void 0;
+    return rpcError(
+      E.METHOD,
+      `Unknown method: ${method}`,
+      { profile: owner, advertised: [...ws.profiles] }
+    );
+  }
   checkStepUp(params) {
     const wsId = params.workspace;
     const sender = params.from;
-    if (!wsId || !sender) return null;
+    if (typeof wsId !== "string" || typeof sender !== "string" || !wsId || !sender) return null;
     const ws = this.workspaces.get(wsId);
     if (!ws) return null;
     const member = ws.members.get(sender);
@@ -2260,6 +2683,20 @@ var Coordinator = class {
     if (typeof id !== "string") return { error: rpcError(E.PARAMS, "workspace must be a string id") };
     if (this.workspaces.has(id)) return { error: rpcError(E.PARAMS, `workspace already exists: ${id}`) };
     const profiles = Array.isArray(p.profiles) ? [...p.profiles] : [...this.options.defaultProfiles ?? ["core/1.0", "review/1.0"]];
+    for (const [profile, enforced, option] of [
+      ["security-signed/1.0", !!this.options.requireSignatures, "requireSignatures"],
+      ["identity-oidc/1.0", this.options.verifyOidcToken !== void 0, "verifyOidcToken"]
+    ]) {
+      const name = profile.split("/")[0];
+      const advertised = profiles.some((x) => x === name || x.startsWith(name + "/"));
+      if (enforced && !advertised) profiles.push(profile);
+      else if (advertised && !enforced) {
+        return { error: rpcError(
+          E.PARAMS,
+          `${profile} is advertised but ${option} is not configured. A workspace that advertises it and does not enforce it describes a guarantee it does not give.`
+        ) };
+      }
+    }
     const chainEnabled = profiles.includes("audit-scitt/1.0") || !!this.options.enableChain;
     const ws = {
       id,
@@ -2309,7 +2746,10 @@ var Coordinator = class {
       audit_count: ws.audit.length,
       task_count: ws.tasks.size,
       override_count: ws.overrides.size,
-      evidence_head: ws.chain_head,
+      // Omitted where the workspace has no chain, which is what the Python
+      // reference now sends too: JSON.stringify drops an undefined value, so
+      // the two answered the same call differently on the wire.
+      ...ws.chain_head ? { evidence_head: ws.chain_head } : {},
       ...ws.routing_policy_uri ? { routing_policy_uri: ws.routing_policy_uri } : {}
     } };
   }
@@ -2343,6 +2783,8 @@ var Coordinator = class {
     }
     const uri = p.from;
     const now = this.now();
+    const existing = ws.members.get(uri);
+    let tokenVerified = false;
     const member = {
       uri,
       type: p.type,
@@ -2357,20 +2799,41 @@ var Coordinator = class {
     if (this.options.verifyOidcToken && typeof p.oidc_token === "string") {
       const claims = this.options.verifyOidcToken(p.oidc_token);
       if (claims === null) return { error: rpcError(E.OIDC_TOKEN_INVALID, "OIDC token invalid") };
-      member.oidc_sub = claims.sub;
+      const boundUri = claims.chap_participant_uri;
+      const sub = typeof claims.sub === "string" && claims.sub !== "" ? claims.sub : void 0;
+      if (boundUri != null && boundUri !== uri) {
+        return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token is bound to another participant") };
+      }
+      if (existing) {
+        if (existing.oidc_sub != null) {
+          if (sub !== existing.oidc_sub) {
+            return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token subject does not match the member") };
+          }
+        } else if (boundUri !== uri) {
+          return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token does not name this member") };
+        }
+      }
+      member.oidc_sub = sub;
+      tokenVerified = true;
       const at = claims.auth_time;
       if (typeof at === "number") member.oidc_auth_time = at;
-      member.oidc_acr = claims.acr;
+      member.oidc_acr = typeof claims.acr === "string" ? claims.acr : void 0;
       const cnf = claims.cnf;
       const cnfJwk = cnf?.jwk;
       if (cnfJwk && typeof cnfJwk.kid === "string") {
         member.keys.push({ jwk: cnfJwk, kid: cnfJwk.kid, valid_from: now });
       }
     }
-    if (this.options.verifyVc && typeof p.vc_presentation === "object" && p.vc_presentation !== null) {
+    if (this.options.verifyVc && typeof p.vc_presentation === "object" && p.vc_presentation !== null && !Array.isArray(p.vc_presentation)) {
       const subject = this.options.verifyVc(p.vc_presentation);
       if (subject === null) return { error: rpcError(E.VC_VP_INVALID, "VC presentation invalid") };
-      member.vc_holder = subject.holder ?? subject.id;
+      const holder = [subject.holder, subject.id].find(
+        (h) => typeof h === "string" && h !== ""
+      );
+      if (existing && (existing.vc_holder == null || holder !== existing.vc_holder)) {
+        return { error: rpcError(E.VC_HOLDER_BINDING_INVALID, "Presentation holder does not match the member") };
+      }
+      member.vc_holder = holder;
       const vpJwk = subject.cnf_jwk;
       if (vpJwk && typeof vpJwk.kid === "string") {
         member.keys.push({ jwk: vpJwk, kid: vpJwk.kid, valid_from: now });
@@ -2385,11 +2848,11 @@ var Coordinator = class {
         }
       }
     }
-    const existing = ws.members.get(uri);
     if (existing) {
       if (member.oidc_sub !== void 0) existing.oidc_sub = member.oidc_sub;
       if (member.oidc_auth_time !== void 0) existing.oidc_auth_time = member.oidc_auth_time;
       if (member.oidc_acr !== void 0) existing.oidc_acr = member.oidc_acr;
+      if (tokenVerified) existing.oidc_acr = member.oidc_acr;
       if (member.vc_holder !== void 0) existing.vc_holder = member.vc_holder;
       for (const k of attested) {
         if (!existing.keys.some((x) => x.kid === k.kid)) existing.keys.push(k);
@@ -2413,12 +2876,15 @@ var Coordinator = class {
     const notMember = this.requireMember(ws, p.from);
     if (notMember) return notMember;
     const assignee = p.assignee || p.to;
-    if (!assignee || !ws.members.has(assignee)) {
+    if (typeof assignee !== "string" || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "Assignee not in workspace") };
     }
     if (ws.members.get(assignee).paused) {
       return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${assignee} is paused`) };
     }
+    if (p.mode !== void 0 && p.mode !== null && typeof p.mode !== "string") {
+      return { error: rpcError(E.PARAMS, "mode must be a string") };
+    }
     const requestedMode = p.mode || ws.mode;
     if (!modeLE(requestedMode, ws.mode_ceiling)) {
       return { error: rpcError(
@@ -2426,6 +2892,9 @@ var Coordinator = class {
         `Requested mode ${requestedMode} exceeds ceiling ${ws.mode_ceiling}`
       ) };
     }
+    if (p.review_required !== void 0 && p.review_required !== null && typeof p.review_required !== "boolean") {
+      return { error: rpcError(E.PARAMS, "review_required must be a boolean") };
+    }
     const taskId = this.ids.taskId();
     const now = this.now();
     const task = {
@@ -2462,14 +2931,20 @@ var Coordinator = class {
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
     const newState = p.state;
     const legal = {
-      created: ["in_progress", "declined", "paused"],
-      in_progress: ["in_progress", "completed", "declined", "review_requested", "paused"],
+      created: ["in_progress", "declined"],
+      in_progress: ["in_progress", "completed", "declined"],
       review_requested: ["in_progress"],
-      paused: ["in_progress", "cancelled"]
+      paused: ["cancelled"]
     };
     if (!legal[task.state]?.includes(newState)) {
       return { error: rpcError(E.PARAMS, `Illegal transition ${task.state} -> ${newState}`) };
     }
+    if (newState === "completed" && task.review_required) {
+      return { error: rpcError(
+        E.PARAMS,
+        "This task requires review. Submit the output with task.complete, which opens the review; a reviewer decision completes it."
+      ) };
+    }
     task.state = newState;
     task.updated_at = this.now();
     task.history.push({
@@ -2492,18 +2967,18 @@ var Coordinator = class {
     }
     if (task.review_required) {
       const now = this.now();
-      task.pending_artefact = p.output;
       if (!task.review) {
         const producer = p.from;
-        const eligible = [...ws.members.keys()].filter((uri) => uri !== producer && uri !== task.assignee);
+        const eligible = [...ws.members.entries()].filter(([uri, member]) => uri !== producer && uri !== task.assignee && member.type === "human").map(([uri]) => uri);
         if (eligible.length === 0) {
           return { error: rpcError(
             E.NOT_AUTHORISED,
-            "Task requires review but has no eligible reviewer (needs a member other than its assignee and completer)"
+            "Task requires review but has no eligible human reviewer (needs a human member other than its assignee and completer)"
           ) };
         }
         task.review = { requested_at: now, requested_to: eligible, rule: "any_one_approves", decisions: [] };
       }
+      task.pending_artefact = p.output;
       task.state = "review_requested";
       task.updated_at = now;
       task.history.push({
@@ -2530,23 +3005,39 @@ var Coordinator = class {
     }
     const range = p.range ?? {};
     const filter = p.filter ?? {};
+    if (filter.outcome != null && filter.outcome !== "accepted" && filter.outcome !== "refused") {
+      return { error: rpcError(E.PARAMS, "filter.outcome must be 'accepted' or 'refused'") };
+    }
     const fromSeq = range.from_seq ?? 0;
     const toSeq = range.to_seq ?? ws.audit.length;
     const out = [];
     for (const entry of ws.audit.slice(fromSeq, toSeq)) {
-      const ep = entry.envelope.params ?? {};
-      if (filter.method && entry.envelope.method !== filter.method) continue;
+      const refused = entry.outcome != null;
+      if (filter.outcome === "accepted" && refused) continue;
+      if (filter.outcome === "refused" && !refused) continue;
+      const call2 = entryCall(entry) ?? {};
+      const ep = call2.params ?? {};
+      if (filter.method && call2.method !== filter.method) continue;
       if (filter.from && ep.from !== filter.from) continue;
-      if (filter.task_id && ep.task_id !== filter.task_id) continue;
-      const item = {
-        seq: entry.seq,
-        arrived: entry.arrived,
-        envelope: entry.envelope
-      };
+      if (filter.task_id) {
+        let taskId = ep.task_id;
+        if (call2.method === "whisper.answer") {
+          const prompt = ws.whispers.get(ep.whisper_id);
+          taskId = prompt ? prompt.task_id : void 0;
+        }
+        if (taskId !== filter.task_id) continue;
+      }
+      const item = { seq: entry.seq, arrived: entry.arrived };
+      if (refused) {
+        item.request = entry.request;
+        item.outcome = entry.outcome;
+      } else {
+        item.envelope = entry.envelope;
+      }
       if (entry.prev_hash) item.prev_hash = entry.prev_hash;
       out.push(item);
     }
-    return { result: { entries: out, next_seq: toSeq } };
+    return { result: { entries: out, next_seq: Math.min(toSeq, ws.audit.length) } };
   }
   // ==========================================================
   //   review/1.0 handlers
@@ -2560,11 +3051,15 @@ var Coordinator = class {
     if (notMember) return notMember;
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (REVIEW_REQUEST_STOPPED.includes(task.state)) {
+      return { error: rpcError(E.NOT_REVIEWABLE, `Cannot request review for task in state: ${task.state}`) };
+    }
     const to = p.to;
     const reviewers = Array.isArray(to) ? to : typeof to === "string" ? [to] : [];
     if (!reviewers.length) return { error: rpcError(E.PARAMS, "review.request needs 'to'") };
     const now = this.now();
-    const rule = p.rule || "any_one_approves";
+    const declaredRule = p.rule;
+    const rule = declaredRule || "any_one_approves";
     if (!reviewRuleSupported(rule)) {
       return { error: rpcError(E.PARAMS, `Unsupported review rule ${JSON.stringify(rule)}: review/1.0 supports any_one_approves, all_approve, quorum:<n>`) };
     }
@@ -2575,7 +3070,7 @@ var Coordinator = class {
           "A review is already open on this task with different content. Decide, abstain, escalate or cancel it before requesting review of a new artefact."
         ) };
       }
-      if (rule !== task.review.rule) {
+      if (declaredRule !== void 0 && declaredRule !== task.review.rule) {
         return { error: rpcError(
           E.REVIEW_ALREADY_OPEN,
           `Cannot change the decision rule of an open review (currently ${task.review.rule})`
@@ -2767,16 +3262,34 @@ var Coordinator = class {
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
     if (notMember) return notMember;
-    const orig = ws.tasks.get(p.original_task_id);
+    const origId = p.original_task_id;
+    const orig = typeof origId === "string" ? ws.tasks.get(origId) : void 0;
     if (!orig) return { error: rpcError(E.PARAMS, "Unknown original task") };
     if (orig.state === "completed" || orig.state === "cancelled" || orig.state === "superseded") {
       return { error: rpcError(E.PARAMS, `Cannot escalate a terminal task: ${orig.state}`) };
     }
+    if (p.new_task === null || typeof p.new_task !== "object" || Array.isArray(p.new_task)) {
+      return { error: rpcError(E.PARAMS, "new_task must be an object") };
+    }
     const nt = p.new_task;
     const assignee = nt.assignee;
-    if (!assignee || !ws.members.has(assignee)) {
+    if (typeof assignee !== "string" || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "Escalation assignee not in workspace") };
     }
+    const named = nt.mode;
+    if (named !== void 0 && named !== null && typeof named !== "string") {
+      return { error: rpcError(E.PARAMS, "new_task.mode must be a string") };
+    }
+    if (ws.members.get(assignee).paused) {
+      return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${assignee} is paused`) };
+    }
+    const mode = named || orig.mode;
+    if (!modeLE(mode, ws.mode_ceiling)) {
+      return { error: rpcError(
+        E.MODE_CEILING_EXCEEDED,
+        `Requested mode ${mode} exceeds ceiling ${ws.mode_ceiling}`
+      ) };
+    }
     const now = this.now();
     const newId = this.ids.taskId();
     const newTask = {
@@ -2788,11 +3301,14 @@ var Coordinator = class {
       input: nt.input ?? {},
       created_at: now,
       updated_at: now,
-      mode: orig.mode,
+      mode,
       supersedes: orig.id,
       history: [{ ts: now, from: p.from, state: "created", note: `escalated from ${orig.id}` }],
       paused: false
     };
+    if (orig.review_required || ws.profiles.some((pr) => pr.startsWith("modes/")) && newTask.mode === "trial") {
+      newTask.review_required = true;
+    }
     ws.tasks.set(newId, newTask);
     orig.state = "escalated";
     orig.updated_at = now;
@@ -2933,11 +3449,13 @@ function wrapMcpToolCall(coord, workspace, options) {
     method: "task.update",
     params: { workspace, from: options.caller, task_id: taskId, state: "in_progress" }
   });
+  const output = { result: options.result, citations };
+  if (options.fulfils) output.fulfils = options.fulfils;
   const completeParams = {
     workspace,
     from: options.caller,
     task_id: taskId,
-    output: { result: options.result, citations }
+    output
   };
   if (options.confidence !== void 0) completeParams.confidence = options.confidence;
   const completeResp = coord.dispatch({
@@ -2989,11 +3507,13 @@ function wrapA2aMessageExchange(coord, workspace, options) {
       state: "in_progress"
     }
   });
+  const output = { received: options.received, citations: [citation] };
+  if (options.fulfils) output.fulfils = options.fulfils;
   const completeParams = {
     workspace,
     from: options.bridgeUri,
     task_id: taskId,
-    output: { received: options.received, citations: [citation] }
+    output
   };
   if (options.confidence !== void 0) completeParams.confidence = options.confidence;
   const completeResp = coord.dispatch({
@@ -3022,8 +3542,12 @@ function wrapA2aMessageExchange(coord, workspace, options) {
   deriveKeypair,
   deriveSeed,
   diffJsonPatch,
+  entryCall,
+  entryRecord,
+  isRefusal,
   isValidEnvelope,
   jwkFromPrivateKey,
+  linkHash,
   makeApi,
   makeDefaultPolicy,
   modeLE,