@brightbeamai/chap-coordinator 0.2.8

package/dist/index.js

@@ -0,0 +1,2762 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/canonical.ts
+import { createHash } from "crypto";
+var ZERO_HASH = "sha256:" + "0".repeat(64);
+var NON_INTEGER_ERROR = 'CHAP canonical numbers must be integers; represent decimals as strings (e.g. "8.2") so the hash is deterministic across implementations.';
+var NUMBER_RANGE_ERROR = "CHAP canonical integers must be within the safe-integer range (abs value <= Number.MAX_SAFE_INTEGER); represent larger numbers as strings.";
+function canonicalString(s) {
+  return JSON.stringify(s);
+}
+function canonicalNumber(n) {
+  if (!Number.isFinite(n)) {
+    throw new Error(
+      "Non-finite numbers are not permitted in a CHAP canonical value"
+    );
+  }
+  if (!Number.isInteger(n)) {
+    throw new Error(NON_INTEGER_ERROR);
+  }
+  if (Math.abs(n) > Number.MAX_SAFE_INTEGER) {
+    throw new Error(NUMBER_RANGE_ERROR);
+  }
+  return n.toString();
+}
+function canon(value) {
+  if (value === null) return "null";
+  if (value === true) return "true";
+  if (value === false) return "false";
+  if (typeof value === "string") return canonicalString(value);
+  if (typeof value === "number") return canonicalNumber(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(canon).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const parts = [];
+    for (const key of keys) {
+      parts.push(canonicalString(key) + ":" + canon(obj[key]));
+    }
+    return "{" + parts.join(",") + "}";
+  }
+  throw new TypeError(`Cannot canonicalise value of type ${typeof value}`);
+}
+function canonicalize(value) {
+  return Buffer.from(canon(value), "utf-8");
+}
+function sha256Hex(data) {
+  const h = createHash("sha256");
+  h.update(typeof data === "string" ? Buffer.from(data, "utf-8") : data);
+  return "sha256:" + h.digest("hex");
+}
+function contentHash(content) {
+  return sha256Hex(canonicalize(content));
+}
+
+// src/crypto.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  sign as nodeSign,
+  verify as nodeVerify,
+  createHash as createHash2
+} from "crypto";
+var ED25519_OID = Buffer.from("302a300506032b6570032100", "hex");
+function b64urlNoPad(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function b64urlDecode(s) {
+  const pad = "=".repeat((4 - s.length % 4) % 4);
+  return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+function deriveSeed(uri) {
+  return createHash2("sha256").update("chap:" + uri).digest();
+}
+function privateKeyFromSeed(seed) {
+  if (seed.length !== 32) {
+    throw new Error("Ed25519 seed must be 32 bytes");
+  }
+  const pkcs8 = Buffer.concat([
+    Buffer.from("302e020100300506032b657004220420", "hex"),
+    seed
+  ]);
+  return createPrivateKey({ key: pkcs8, format: "der", type: "pkcs8" });
+}
+function publicKeyBytes(privateKey) {
+  const pub = createPublicKey(privateKey);
+  const der = pub.export({ format: "der", type: "spki" });
+  return der.subarray(der.length - 32);
+}
+function publicKeyFromRaw(raw) {
+  if (raw.length !== 32) {
+    throw new Error("Ed25519 public key must be 32 bytes");
+  }
+  const der = Buffer.concat([ED25519_OID, raw]);
+  return createPublicKey({ key: der, format: "der", type: "spki" });
+}
+function jwkFromPrivateKey(uri, key) {
+  const pub = publicKeyBytes(key);
+  return {
+    kty: "OKP",
+    crv: "Ed25519",
+    kid: createHash2("sha256").update(uri).digest("hex").slice(0, 16),
+    use: "sig",
+    alg: "EdDSA",
+    x: b64urlNoPad(pub)
+  };
+}
+function signEnvelope(canonical, privateKey, kid) {
+  const sig = nodeSign(null, canonical, privateKey);
+  return `ed25519:${kid}:${sig.toString("base64")}`;
+}
+function verifyEnvelope(canonical, sigTag, publicKey) {
+  if (!sigTag.startsWith("ed25519:")) return false;
+  const parts = sigTag.split(":");
+  if (parts.length < 2) return false;
+  const sigB64 = parts[parts.length - 1];
+  try {
+    const sig = Buffer.from(sigB64, "base64");
+    return nodeVerify(null, canonical, publicKey, sig);
+  } catch {
+    return false;
+  }
+}
+function publicKeyFromJwk(jwk) {
+  return publicKeyFromRaw(b64urlDecode(jwk.x));
+}
+function deriveKeypair(uri) {
+  const seed = deriveSeed(uri);
+  const privateKey = privateKeyFromSeed(seed);
+  return { privateKey, jwk: jwkFromPrivateKey(uri, privateKey) };
+}
+
+// src/ids.ts
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function encode(value, length) {
+  let out = "";
+  for (let i = 0; i < length; i++) {
+    const idx = Number(value & 31n);
+    out = ALPHABET[idx] + out;
+    value >>= 5n;
+  }
+  return out;
+}
+var IdFactory = class {
+  constructor(deterministic = false, seed = 0n, startMs = 17e11) {
+    this.deterministic = deterministic;
+    this.counter = seed;
+    this.clockMs = startMs;
+  }
+  deterministic;
+  counter;
+  clockMs;
+  nowMs() {
+    if (this.deterministic) {
+      this.clockMs += 1;
+      return this.clockMs;
+    }
+    return Date.now();
+  }
+  randomness() {
+    if (this.deterministic) {
+      this.counter += 1n;
+      return this.counter * 0x9E3779B97F4A7C15n & (1n << 80n) - 1n;
+    }
+    const buf = new Uint8Array(10);
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      crypto.getRandomValues(buf);
+    } else {
+      const nodeCrypto = __require("crypto");
+      buf.set(nodeCrypto.randomBytes(10));
+    }
+    let n = 0n;
+    for (const b of buf) n = n << 8n | BigInt(b);
+    return n;
+  }
+  ulid() {
+    const ts = BigInt(this.nowMs()) & (1n << 48n) - 1n;
+    const rand = this.randomness();
+    return encode(ts, 10) + encode(rand, 16);
+  }
+  envelopeId() {
+    return this.ulid();
+  }
+  taskId() {
+    return "tsk_" + this.ulid();
+  }
+  artefactId() {
+    return "art_" + this.ulid();
+  }
+  logicalId() {
+    return "lgl_" + this.ulid();
+  }
+  workspaceId() {
+    return "wsp_" + this.ulid();
+  }
+  deliberationId() {
+    return "dlb_" + this.ulid();
+  }
+  handoffId() {
+    return "hnd_" + this.ulid();
+  }
+  snapshotId() {
+    return "snp_" + this.ulid();
+  }
+};
+
+// src/jsonrpc.ts
+var E = {
+  // JSON-RPC 2.0 standard
+  PARSE: -32700,
+  REQUEST: -32600,
+  METHOD: -32601,
+  PARAMS: -32602,
+  INTERNAL: -32603,
+  // review/1.0 profile
+  NOT_REVIEWABLE: -32010,
+  NOT_AUTHORISED: -32011,
+  PATCH_FAILED: -32012,
+  REVIEW_LAPSED: -32013,
+  // whisper/1.0 profile (profiles/whisper.md S6)
+  WHISPER_ALREADY_ANSWERED: -32020,
+  WHISPER_LAPSED: -32021,
+  WHISPER_OPTION_NOT_IN_SET: -32022,
+  // deliberation/1.0 profile (profiles/deliberation.md S5)
+  DELIB_VOTER_NOT_IN_LIST: -32030,
+  DELIB_ALREADY_VOTED: -32031,
+  DELIB_CLOSED_OR_LAPSED: -32032,
+  DELIB_UNKNOWN_RULE: -32033,
+  // modes/1.0 profile (profiles/modes.md S6)
+  MODE_CEILING_EXCEEDED: -32040,
+  MODE_STEP_UP_REQUIRED: -32041,
+  // handoff/1.0 profile (profiles/handoff.md S6)
+  HANDOFF_TASKS_NOT_ASSIGNED_TO_PROPOSER: -32050,
+  HANDOFF_ALREADY_RESOLVED: -32051,
+  HANDOFF_RECIPIENT_NOT_MEMBER: -32052,
+  // control/1.0 profile (profiles/control.md S6)
+  CONTROL_STEP_UP_REQUIRED: -32060,
+  CONTROL_NOT_AUTHORISED: -32061,
+  CONTROL_SNAPSHOT_NOT_FOUND: -32062,
+  CONTROL_WORKSPACE_PAUSED: -32063,
+  // security-signed/1.0 profile (profiles/security-signed.md S7)
+  SIG_VERIFY_FAILED: -32070,
+  SIG_KEY_NOT_FOUND: -32071,
+  SIG_KEY_REVOKED: -32072,
+  SIG_ROTATION_KEY_MISMATCH: -32073,
+  // audit-scitt/1.0 profile (profiles/audit-scitt.md S8)
+  SCITT_UNREACHABLE: -32080,
+  SCITT_STATEMENT_REJECTED: -32081,
+  SCITT_RECEIPT_INVALID: -32082,
+  // identity-oidc/1.0 profile (profiles/identity-oidc.md S8)
+  OIDC_STEP_UP_REQUIRED: -32402,
+  OIDC_TOKEN_INVALID: -32403,
+  OIDC_CNF_MISMATCH: -32404,
+  OIDC_SCOPE_MISSING: -32405,
+  // identity-vc/1.0 profile (profiles/identity-vc.md S8)
+  VC_VP_INVALID: -32410,
+  VC_HOLDER_BINDING_INVALID: -32411,
+  VC_CREDENTIAL_REVOKED: -32412,
+  VC_SCHEMA_UNKNOWN: -32413,
+  // routing/1.0 profile (profiles/routing.md S3-S5)
+  ROUTING_NO_ELIGIBLE_ASSIGNEE: -32510,
+  ROUTING_POLICY_VIOLATION: -32511,
+  ROUTING_AUTO_ESCALATION_TRIGGERED: -32512,
+  ROUTING_CANDIDATES_EMPTY: -32513,
+  ROUTING_DEPTH_NOT_APPLICABLE: -32514,
+  ROUTING_POLICY_UNREACHABLE: -32515,
+  ROUTING_ESC_TARGET_UNAVAILABLE: -32516
+};
+function rpcError(code, message, data) {
+  return { code, message, ...data !== void 0 ? { data } : {} };
+}
+function isValidEnvelope(env) {
+  if (typeof env !== "object" || env === null) return false;
+  const e = env;
+  return e.jsonrpc === "2.0";
+}
+
+// src/patch.ts
+var PatchError = class extends Error {
+};
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function unescape(token) {
+  return token.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function splitPath(path) {
+  if (path === "") return [];
+  if (!path.startsWith("/")) {
+    throw new PatchError(`JSON Pointer must start with '/': ${JSON.stringify(path)}`);
+  }
+  const segments = path.slice(1).split("/").map(unescape);
+  for (const seg of segments) {
+    if (DANGEROUS_KEYS.has(seg)) {
+      throw new PatchError(`Refusing unsafe path segment ${JSON.stringify(seg)}`);
+    }
+  }
+  return segments;
+}
+function navigate(doc, parts) {
+  if (parts.length === 0) {
+    throw new PatchError("Cannot operate on root with this helper.");
+  }
+  let parent = doc;
+  for (let i = 0; i < parts.length - 1; i++) {
+    const part = parts[i];
+    if (Array.isArray(parent)) {
+      const idx = Number(part);
+      if (!Number.isInteger(idx) || idx < 0 || idx >= parent.length) {
+        throw new PatchError(`Index out of range at /${parts.slice(0, i + 1).join("/")}`);
+      }
+      parent = parent[idx];
+    } else if (parent !== null && typeof parent === "object") {
+      if (!Object.prototype.hasOwnProperty.call(parent, part)) {
+        throw new PatchError(`Path not found: /${parts.slice(0, i + 1).join("/")}`);
+      }
+      parent = parent[part];
+    } else {
+      throw new PatchError(`Cannot traverse into ${typeof parent} at ${JSON.stringify(part)}`);
+    }
+  }
+  const last = parts[parts.length - 1];
+  if (Array.isArray(parent)) {
+    if (last === "-") return [parent, "-"];
+    const idx = Number(last);
+    if (!Number.isInteger(idx)) {
+      throw new PatchError(`Array index expected at ${JSON.stringify(last)}`);
+    }
+    return [parent, idx];
+  }
+  return [parent, last];
+}
+function getAt(doc, path) {
+  const parts = splitPath(path);
+  if (parts.length === 0) return doc;
+  const [parent, key] = navigate(doc, parts);
+  if (Array.isArray(parent)) {
+    if (key === "-") throw new PatchError("Cannot read '-' position.");
+    const idx = key;
+    if (idx < 0 || idx >= parent.length) throw new PatchError(`Index out of range: ${path}`);
+    return parent[idx];
+  }
+  if (parent === null || typeof parent !== "object" || !Object.prototype.hasOwnProperty.call(parent, key)) {
+    throw new PatchError(`Path not found: ${path}`);
+  }
+  return parent[key];
+}
+function clone(v) {
+  return v === void 0 ? v : JSON.parse(JSON.stringify(v));
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (a === null || b === null) return a === b;
+  if (typeof a !== typeof b) return false;
+  if (typeof a !== "object") return a === b;
+  const aArr = Array.isArray(a);
+  if (aArr !== Array.isArray(b)) return false;
+  if (aArr) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) if (!deepEqual(a[i], b[i])) return false;
+    return true;
+  }
+  const ak = Object.keys(a);
+  const bk = Object.keys(b);
+  if (ak.length !== bk.length) return false;
+  for (const k of ak) {
+    if (!Object.prototype.hasOwnProperty.call(b, k)) return false;
+    if (!deepEqual(a[k], b[k])) return false;
+  }
+  return true;
+}
+function applyOne(doc, op) {
+  const kind = op.op;
+  const path = op.path ?? "";
+  if (kind === "add") {
+    if (!("value" in op)) throw new PatchError("'add' requires 'value'");
+    const parts = splitPath(path);
+    if (parts.length === 0) return op.value;
+    const [parent, key] = navigate(doc, parts);
+    if (Array.isArray(parent)) {
+      if (key === "-") {
+        parent.push(op.value);
+      } else {
+        const idx = key;
+        if (idx < 0 || idx > parent.length) {
+          throw new PatchError(`Index out of range for add: ${path}`);
+        }
+        parent.splice(idx, 0, op.value);
+      }
+    } else if (parent !== null && typeof parent === "object") {
+      parent[key] = op.value;
+    } else {
+      throw new PatchError(`Cannot add into ${typeof parent}`);
+    }
+    return doc;
+  }
+  if (kind === "replace") {
+    if (!("value" in op)) throw new PatchError("'replace' requires 'value'");
+    const parts = splitPath(path);
+    if (parts.length === 0) return op.value;
+    const [parent, key] = navigate(doc, parts);
+    if (Array.isArray(parent)) {
+      const idx = key;
+      if (idx < 0 || idx >= parent.length) {
+        throw new PatchError(`Path not found for replace: ${path}`);
+      }
+      parent[idx] = op.value;
+    } else if (parent !== null && typeof parent === "object") {
+      if (!Object.prototype.hasOwnProperty.call(parent, key)) {
+        throw new PatchError(`Path not found for replace: ${path}`);
+      }
+      parent[key] = op.value;
+    } else {
+      throw new PatchError(`Cannot replace in ${typeof parent}`);
+    }
+    return doc;
+  }
+  if (kind === "remove") {
+    const parts = splitPath(path);
+    if (parts.length === 0) throw new PatchError("Cannot remove root.");
+    const [parent, key] = navigate(doc, parts);
+    if (Array.isArray(parent)) {
+      const idx = key;
+      if (idx < 0 || idx >= parent.length) {
+        throw new PatchError(`Index out of range for remove: ${path}`);
+      }
+      parent.splice(idx, 1);
+    } else if (parent !== null && typeof parent === "object") {
+      if (!Object.prototype.hasOwnProperty.call(parent, key)) {
+        throw new PatchError(`Path not found for remove: ${path}`);
+      }
+      delete parent[key];
+    } else {
+      throw new PatchError(`Cannot remove from ${typeof parent}`);
+    }
+    return doc;
+  }
+  if (kind === "copy") {
+    const src = op.from;
+    if (src === void 0) throw new PatchError("'copy' requires 'from'");
+    const value = clone(getAt(doc, src));
+    return applyOne(doc, { op: "add", path, value });
+  }
+  if (kind === "move") {
+    const src = op.from;
+    if (src === void 0) throw new PatchError("'move' requires 'from'");
+    if (path.startsWith(src + "/")) {
+      throw new PatchError("'move' cannot move a location into its own child.");
+    }
+    const value = clone(getAt(doc, src));
+    doc = applyOne(doc, { op: "remove", path: src });
+    return applyOne(doc, { op: "add", path, value });
+  }
+  if (kind === "test") {
+    if (!("value" in op)) throw new PatchError("'test' requires 'value'");
+    const actual = getAt(doc, path);
+    if (!deepEqual(actual, op.value)) throw new PatchError(`'test' failed at ${path}`);
+    return doc;
+  }
+  throw new PatchError(`Unsupported op: ${JSON.stringify(kind)}`);
+}
+var MAX_PATCH_OPS = 1e3;
+var MAX_DOCUMENT_NODES = 1e5;
+function nodeCount(value) {
+  if (Array.isArray(value)) {
+    let n = 1;
+    for (const v of value) n += nodeCount(v);
+    return n;
+  }
+  if (value !== null && typeof value === "object") {
+    let n = 1;
+    for (const v of Object.values(value)) n += nodeCount(v);
+    return n;
+  }
+  return 1;
+}
+function applyJsonPatch(doc, ops) {
+  if (ops.length > MAX_PATCH_OPS) {
+    throw new PatchError(`Patch has too many operations (${ops.length} > ${MAX_PATCH_OPS})`);
+  }
+  let out = JSON.parse(JSON.stringify(doc));
+  for (const op of ops) {
+    out = applyOne(out, op);
+    if (nodeCount(out) > MAX_DOCUMENT_NODES) {
+      throw new PatchError(`Patched document exceeds the node limit (${MAX_DOCUMENT_NODES})`);
+    }
+  }
+  return out;
+}
+function diffJsonPatch(from, to, basePath = "") {
+  const ops = [];
+  if (typeof from !== typeof to || Array.isArray(from) !== Array.isArray(to)) {
+    ops.push({ op: "replace", path: basePath || "/", value: to });
+    return ops;
+  }
+  if (from === null || to === null || typeof from !== "object") {
+    if (from !== to) {
+      ops.push({ op: "replace", path: basePath || "/", value: to });
+    }
+    return ops;
+  }
+  if (Array.isArray(from) && Array.isArray(to)) {
+    if (JSON.stringify(from) !== JSON.stringify(to)) {
+      ops.push({ op: "replace", path: basePath || "/", value: to });
+    }
+    return ops;
+  }
+  const fromObj = from;
+  const toObj = to;
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(fromObj), ...Object.keys(toObj)]);
+  for (const key of allKeys) {
+    const escaped = key.replace(/~/g, "~0").replace(/\//g, "~1");
+    const path = `${basePath}/${escaped}`;
+    if (!(key in fromObj)) {
+      ops.push({ op: "add", path, value: toObj[key] });
+    } else if (!(key in toObj)) {
+      ops.push({ op: "remove", path });
+    } else {
+      ops.push(...diffJsonPatch(fromObj[key], toObj[key], path));
+    }
+  }
+  return ops;
+}
+
+// src/storage/store.ts
+var MemoryStore = class {
+  records = /* @__PURE__ */ new Map();
+  load() {
+    return Array.from(this.records.values());
+  }
+  save(record) {
+    this.records.set(record.id, record);
+  }
+  delete(id) {
+    this.records.delete(id);
+  }
+  close() {
+    this.records.clear();
+  }
+};
+
+// src/api.ts
+var CoordinatorError = class extends Error {
+  code;
+  data;
+  constructor(code, message, data) {
+    super(message);
+    this.name = "CoordinatorError";
+    this.code = code;
+    this.data = data;
+  }
+};
+function call(coord, method, params) {
+  const envelope = {
+    jsonrpc: "2.0",
+    id: coord.ids.envelopeId(),
+    method,
+    params
+  };
+  const out = coord.dispatch(envelope);
+  if (out.error) {
+    throw new CoordinatorError(out.error.code, out.error.message, out.error.data);
+  }
+  return out.result;
+}
+function makeApi(coord) {
+  const c = (m, p) => call(coord, m, p);
+  return {
+    workspace: {
+      create: (p) => c("workspace.create", p),
+      describe: (p) => c("workspace.describe", p),
+      set_profiles: (p) => c("workspace.set_profiles", p)
+    },
+    participant: {
+      join: (p) => c("participant.join", p),
+      leave: (p) => c("participant.leave", p),
+      rotate_key: (p) => c("participant.rotate_key", p),
+      revoke_key: (p) => c("participant.revoke_key", p)
+    },
+    task: {
+      create: (p) => c("task.create", p),
+      update: (p) => c("task.update", p),
+      complete: (p) => c("task.complete", p),
+      route: (p) => c("task.route", p)
+    },
+    review: {
+      request: (p) => c("review.request", p),
+      depth: (p) => c("review.depth", p)
+    },
+    decide: {
+      approve: (p) => c("decide.approve", p),
+      reject: (p) => c("decide.reject", p),
+      override: (p) => c("decide.override", p)
+    },
+    abstain: {
+      declare: (p) => c("abstain.declare", p)
+    },
+    escalate: {
+      raise: (p) => c("escalate.raise", p),
+      auto: (p) => c("escalate.auto", p)
+    },
+    whisper: {
+      ask: (p) => c("whisper.ask", p),
+      answer: (p) => c("whisper.answer", p)
+    },
+    deliberate: {
+      open: (p) => c("deliberate.open", p),
+      comment: (p) => c("deliberate.comment", p),
+      vote: (p) => c("deliberate.vote", p),
+      close: (p) => c("deliberate.close", p)
+    },
+    handoff: {
+      propose: (p) => c("handoff.propose", p),
+      accept: (p) => c("handoff.accept", p),
+      decline: (p) => c("handoff.decline", p)
+    },
+    control: {
+      pause: (p) => c("control.pause", p),
+      resume: (p) => c("control.resume", p),
+      cancel: (p) => c("control.cancel", p),
+      supersede: (p) => c("control.supersede", p),
+      snapshot: (p) => c("control.snapshot", p),
+      rollback: (p) => c("control.rollback", p),
+      set_mode_ceiling: (p) => c("control.set_mode_ceiling", p)
+    },
+    audit: {
+      read: (p) => c("audit.read", p),
+      submit_to_scitt: (p) => c("audit.submit_to_scitt", p),
+      verify_receipt: (p) => c("audit.verify_receipt", p),
+      verify_chain: (p) => c("audit.verify_chain", p)
+    }
+  };
+}
+
+// src/types.ts
+function modeLE(a, ceiling) {
+  const order = { shadow: 0, trial: 1, production: 2 };
+  return order[a] <= order[ceiling];
+}
+
+// src/profiles/audit_scitt.ts
+function buildStatement(workspaceId, envelope, issuer) {
+  return {
+    protected: {
+      alg: -8,
+      // Ed25519 per COSE
+      iss: issuer,
+      kid: "scitt-issuer",
+      cwt_claims: { sub: workspaceId, iat: null },
+      "content-type": "application/chap+json;version=0.2"
+    },
+    payload: canonicalize(envelope).toString("utf-8"),
+    signature: "<deployment-supplied>"
+  };
+}
+function registerAuditScitt(coord) {
+  coord.handlers.set("audit.submit_to_scitt", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const range = p.range ?? {};
+    const fromSeq = range.from_seq ?? 0;
+    const toSeq = range.to_seq ?? ws.audit.length;
+    const issuer = p.issuer ?? "service:coordinator";
+    if (!coord.options.scittSubmitter) {
+      const statements = ws.audit.slice(fromSeq, toSeq).map((e) => buildStatement(ws.id, e.envelope, issuer));
+      return { result: {
+        statements,
+        note: "No scittSubmitter configured; submit these out-of-band"
+      } };
+    }
+    const receipts = [];
+    for (const entry of ws.audit.slice(fromSeq, toSeq)) {
+      const statement = buildStatement(ws.id, entry.envelope, issuer);
+      let receipt;
+      try {
+        receipt = coord.options.scittSubmitter(statement);
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { error: rpcError(E.SCITT_UNREACHABLE, `SCITT submission error: ${msg}`) };
+      }
+      if (receipt === null) {
+        return { error: rpcError(
+          E.SCITT_STATEMENT_REJECTED,
+          `Statement rejected at seq ${entry.seq}`
+        ) };
+      }
+      receipts.push({ seq: entry.seq, receipt });
+    }
+    return { result: { receipts } };
+  });
+  coord.handlers.set("audit.verify_receipt", (p) => {
+    const receipt = p.receipt;
+    if (typeof receipt !== "object" || receipt === null) {
+      return { error: rpcError(E.PARAMS, "receipt must be an object") };
+    }
+    if (coord.options.verifyScittReceipt) {
+      let ok;
+      try {
+        ok = !!coord.options.verifyScittReceipt(receipt);
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { error: rpcError(E.SCITT_RECEIPT_INVALID, `verify error: ${msg}`) };
+      }
+      if (!ok) return { error: rpcError(E.SCITT_RECEIPT_INVALID, "Receipt did not verify") };
+      return { result: { verified: true } };
+    }
+    return { error: rpcError(E.SCITT_RECEIPT_INVALID, "No verifyScittReceipt hook configured; receipt not verified") };
+  });
+  coord.handlers.set("audit.verify_chain", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    if (!(ws.chain_enabled || coord.options.enableChain)) {
+      return { error: rpcError(E.PARAMS, "Chain not enabled for this workspace") };
+    }
+    let start = ws.audit.findIndex((e) => e.prev_hash != null);
+    if (start < 0) start = ws.audit.length;
+    const errors = [];
+    let prev = ZERO_HASH;
+    for (const e of ws.audit.slice(start)) {
+      const expectedPrev = prev;
+      if (e.prev_hash !== expectedPrev) {
+        errors.push(`seq ${e.seq}: prev_hash mismatch`);
+      }
+      prev = sha256Hex(Buffer.concat([canonicalize(e.envelope), Buffer.from(expectedPrev, "utf-8")]));
+    }
+    const storedHead = ws.chain_head ?? ZERO_HASH;
+    if (prev !== storedHead) {
+      errors.push("chain_head mismatch: replay does not match stored head");
+    }
+    if (errors.length) {
+      return { error: rpcError(E.PARAMS, errors.join("; ")) };
+    }
+    return { result: {
+      ok: true,
+      entries_checked: ws.audit.length - start,
+      chain_head: storedHead
+    } };
+  });
+}
+
+// src/profiles/control.ts
+var VALID_MODES = /* @__PURE__ */ new Set(["shadow", "trial", "production"]);
+var VALID_SCOPES = /* @__PURE__ */ new Set(["task", "participant", "workspace"]);
+function registerControl(coord) {
+  coord.handlers.set("control.pause", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const scope = p.scope || "task";
+    if (!VALID_SCOPES.has(scope)) {
+      return { error: rpcError(E.PARAMS, `scope must be task/participant/workspace`) };
+    }
+    if (scope === "task") {
+      const task = ws.tasks.get(p.task_id);
+      if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+      if (task.state === "completed" || task.state === "declined" || task.state === "cancelled") {
+        return { error: rpcError(E.CONTROL_NOT_AUTHORISED, `Cannot pause ${task.state} task`) };
+      }
+      task.paused = true;
+      const prior = task.state;
+      task.state = "paused";
+      task.updated_at = coord.now();
+      task.history.push({ ts: task.updated_at, from: p.from, state: "paused", note: `was ${prior}` });
+      return { result: { scope: "task", task_id: task.id, state: "paused" } };
+    }
+    if (scope === "participant") {
+      const uri = p.participant_uri || p.uri;
+      if (!uri || !ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
+      ws.members.get(uri).paused = true;
+      return { result: {
+        scope: "participant",
+        participant_uri: uri,
+        paused: true,
+        in_flight_policy: p.in_flight_policy || "allow_to_complete"
+      } };
+    }
+    ws.state = "paused";
+    return { result: { scope: "workspace", workspace: ws.id, state: "paused" } };
+  });
+  coord.handlers.set("control.resume", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const scope = p.scope || "task";
+    if (!VALID_SCOPES.has(scope)) {
+      return { error: rpcError(E.PARAMS, `scope must be task/participant/workspace`) };
+    }
+    if (scope === "task") {
+      const task = ws.tasks.get(p.task_id);
+      if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+      if (task.state !== "paused") {
+        return { error: rpcError(E.CONTROL_NOT_AUTHORISED, `Cannot resume ${task.state} task`) };
+      }
+      task.paused = false;
+      task.state = "in_progress";
+      task.updated_at = coord.now();
+      task.history.push({ ts: task.updated_at, from: p.from, state: "in_progress" });
+      return { result: { scope: "task", task_id: task.id, state: "in_progress" } };
+    }
+    if (scope === "participant") {
+      const uri = p.participant_uri || p.uri;
+      if (!uri || !ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
+      ws.members.get(uri).paused = false;
+      return { result: { scope: "participant", participant_uri: uri, paused: false } };
+    }
+    ws.state = "active";
+    return { result: { scope: "workspace", workspace: ws.id, state: "active" } };
+  });
+  coord.handlers.set("control.cancel", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state === "completed" || task.state === "declined" || task.state === "cancelled") {
+      return { error: rpcError(E.CONTROL_NOT_AUTHORISED, `Cannot cancel ${task.state} task`) };
+    }
+    task.state = "cancelled";
+    task.updated_at = coord.now();
+    task.history.push({ ts: task.updated_at, from: p.from, state: "cancelled", note: p.reason });
+    return { result: { state: "cancelled" } };
+  });
+  coord.handlers.set("control.snapshot", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const include = p.include ?? ["members", "open_tasks", "mode_ceiling"];
+    const state = {};
+    if (include.includes("members")) {
+      state.members = Array.from(ws.members.values()).map((m) => ({
+        uri: m.uri,
+        type: m.type,
+        role: m.role,
+        scopes: m.scopes
+      }));
+    }
+    if (include.includes("open_tasks")) {
+      state.open_tasks = Array.from(ws.tasks.values()).filter((t) => t.state !== "completed" && t.state !== "declined" && t.state !== "cancelled").map((t) => ({ id: t.id, kind: t.kind, state: t.state, assignee: t.assignee }));
+    }
+    if (include.includes("mode_ceiling")) state.mode_ceiling = ws.mode_ceiling;
+    if (include.includes("policy")) state.routing_policy_uri = ws.routing_policy_uri;
+    if (include.includes("audit") || include.includes("all")) state.audit_seq = ws.audit.length;
+    const snapId = coord.ids.artefactId();
+    const snap = {
+      id: snapId,
+      kind: "snapshot",
+      ts: coord.now(),
+      by: p.from,
+      workspace: ws.id,
+      audit_seq: ws.audit.length,
+      label: p.label,
+      include,
+      state
+    };
+    ws.snapshots.set(snapId, snap);
+    return { result: { snapshot_artefact_id: snapId, audit_seq: snap.audit_seq, artefact: snap } };
+  });
+  coord.handlers.set("control.rollback", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const snapId = p.to_snapshot_artefact_id || p.snapshot_artefact_id || p.snapshot_id;
+    if (!snapId) return { error: rpcError(E.PARAMS, "to_snapshot_artefact_id is required") };
+    const snap = ws.snapshots.get(snapId);
+    if (!snap) return { error: rpcError(E.CONTROL_SNAPSHOT_NOT_FOUND, `Unknown snapshot: ${snapId}`) };
+    const what = p.what_to_restore ?? snap.include;
+    const restored = [];
+    if (what.includes("mode_ceiling") && snap.state.mode_ceiling) {
+      ws.mode_ceiling = snap.state.mode_ceiling;
+      restored.push("mode_ceiling");
+    }
+    if (what.includes("members") && Array.isArray(snap.state.members)) {
+      const snapByUri = /* @__PURE__ */ new Map();
+      for (const m of snap.state.members) {
+        snapByUri.set(m.uri, m);
+      }
+      for (const [uri, snapM] of snapByUri) {
+        if (ws.members.has(uri)) {
+          const cur = ws.members.get(uri);
+          cur.role = snapM.role ?? cur.role;
+          cur.scopes = snapM.scopes;
+        }
+      }
+      restored.push("members");
+    }
+    return { result: {
+      rolled_back_to: snapId,
+      audit_seq: snap.audit_seq,
+      restored,
+      reason: p.reason
+    } };
+  });
+  coord.handlers.set("control.supersede", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const oldId = p.task_id;
+    const old = ws.tasks.get(oldId);
+    if (!old) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const newSpec = p.successor_task ?? {};
+    if (!newSpec.kind) {
+      return { error: rpcError(E.PARAMS, "successor_task must include kind") };
+    }
+    const assignee = newSpec.assignee || old.assignee;
+    if (!ws.members.has(assignee)) {
+      return { error: rpcError(E.PARAMS, "successor assignee not in workspace") };
+    }
+    const now = coord.now();
+    const newId = coord.ids.taskId();
+    const newTask = {
+      id: newId,
+      kind: newSpec.kind,
+      state: "created",
+      assignee,
+      delegator: p.from,
+      input: newSpec.input ?? {},
+      created_at: now,
+      updated_at: now,
+      mode: newSpec.mode ?? old.mode,
+      supersedes: old.id,
+      history: [{
+        ts: now,
+        from: p.from,
+        state: "created",
+        note: `supersedes ${old.id}: ${p.reason || ""}`
+      }],
+      paused: false
+    };
+    ws.tasks.set(newId, newTask);
+    old.state = "superseded";
+    old.superseded_by = newId;
+    old.updated_at = now;
+    old.history.push({
+      ts: now,
+      from: p.from,
+      state: "superseded",
+      note: `-> ${newId}: ${p.reason || ""}`
+    });
+    return { result: { superseded_task_id: old.id, new_task_id: newId, reason: p.reason } };
+  });
+  coord.handlers.set("control.set_mode_ceiling", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const m = p.new_ceiling ?? p.mode_ceiling;
+    if (!VALID_MODES.has(m)) {
+      return { error: rpcError(E.PARAMS, `new_ceiling must be shadow/trial/production`) };
+    }
+    ws.mode_ceiling = m;
+    return { result: { mode_ceiling: ws.mode_ceiling, reason: p.reason } };
+  });
+}
+
+// src/profiles/deliberation.ts
+function parseRule(rule) {
+  if (rule.includes(":")) {
+    const [kind, arg] = rule.split(":", 2);
+    if (kind === "quorum") return { kind, params: { n: parseInt(arg, 10) } };
+    if (kind === "weighted_vote" || kind === "weighted_vote_with_veto") {
+      return { kind, params: { threshold: parseFloat(arg) } };
+    }
+  }
+  if (rule === "any_one_approves" || rule === "all_approve") return { kind: rule, params: {} };
+  throw new Error(`Unknown rule: ${rule}`);
+}
+function computeOutcome(delib) {
+  const parsed = parseRule(delib.rule);
+  const yea = delib.votes.filter((v) => v.vote === "yea");
+  const nay = delib.votes.filter((v) => v.vote === "nay");
+  const vetoes = delib.votes.filter((v) => v.veto_invoked && (delib.veto ?? {})[v.voter]);
+  const weights = delib.weights ?? {};
+  const weighted = (vs) => vs.reduce((s, v) => s + (weights[v.voter] ?? 1), 0);
+  if (parsed.kind === "any_one_approves") {
+    return {
+      outcome: yea.length >= 1 ? "approved" : "rejected",
+      rule: delib.rule,
+      tally: { yea: yea.length, nay: nay.length },
+      vetoes: vetoes.map((v) => v.voter)
+    };
+  }
+  if (parsed.kind === "all_approve") {
+    const passed = yea.length === delib.participants.length && nay.length === 0;
+    return {
+      outcome: passed ? "approved" : "rejected",
+      rule: delib.rule,
+      tally: { yea: yea.length, nay: nay.length },
+      vetoes: vetoes.map((v) => v.voter)
+    };
+  }
+  if (parsed.kind === "quorum") {
+    const n = parsed.params.n;
+    const cast = yea.length + nay.length;
+    if (cast < n) {
+      return {
+        outcome: "rejected",
+        reason: "quorum not met",
+        rule: delib.rule,
+        tally: { yea: yea.length, nay: nay.length },
+        vetoes: []
+      };
+    }
+    return {
+      outcome: yea.length > nay.length ? "approved" : "rejected",
+      rule: delib.rule,
+      tally: { yea: yea.length, nay: nay.length },
+      vetoes: []
+    };
+  }
+  if (parsed.kind === "weighted_vote") {
+    const yeaW = weighted(yea), nayW = weighted(nay);
+    return {
+      outcome: yeaW >= parsed.params.threshold ? "approved" : "rejected",
+      rule: delib.rule,
+      tally: { yea: yeaW, nay: nayW },
+      vetoes: []
+    };
+  }
+  if (parsed.kind === "weighted_vote_with_veto") {
+    if (vetoes.length) {
+      return {
+        outcome: "rejected",
+        rule: delib.rule,
+        tally: { yea: 0, nay: 0 },
+        vetoes: vetoes.map((v) => v.voter)
+      };
+    }
+    const yeaW = weighted(yea), nayW = weighted(nay);
+    return {
+      outcome: yeaW >= parsed.params.threshold ? "approved" : "rejected",
+      rule: delib.rule,
+      tally: { yea: yeaW, nay: nayW },
+      vetoes: []
+    };
+  }
+  return { outcome: "error", rule: delib.rule, reason: `unsupported rule ${parsed.kind}` };
+}
+function registerDeliberation(coord) {
+  coord.handlers.set("deliberate.open", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "rule"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const to = p.to ?? p.participants;
+    const participants = Array.isArray(to) ? to : typeof to === "string" ? [to] : [];
+    if (!participants.length) {
+      return { error: rpcError(E.PARAMS, "deliberate.open needs 'to' (participants list)") };
+    }
+    try {
+      parseRule(p.rule);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return { error: rpcError(E.DELIB_UNKNOWN_RULE, msg) };
+    }
+    const id = p.deliberation_id || coord.ids.deliberationId();
+    const delib = {
+      id,
+      task_id: p.task_id,
+      opener: p.from,
+      participants,
+      rule: p.rule,
+      question: p.question,
+      weights: p.weights,
+      veto: p.veto,
+      deadline: p.deadline,
+      state: "open",
+      comments: [],
+      votes: [],
+      opened_at: coord.now()
+    };
+    ws.deliberations.set(id, delib);
+    return { result: { deliberation_id: id, state: "open" } };
+  });
+  coord.handlers.set("deliberate.comment", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const delib = ws.deliberations.get(p.deliberation_id);
+    if (!delib) return { error: rpcError(E.PARAMS, "Unknown deliberation") };
+    if (delib.state !== "open") {
+      return { error: rpcError(E.DELIB_CLOSED_OR_LAPSED, "Deliberation not open") };
+    }
+    delib.comments.push({
+      ts: coord.now(),
+      from: p.from,
+      text: p.comment || p.text || ""
+    });
+    return { result: { accepted: true } };
+  });
+  coord.handlers.set("deliberate.vote", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const delib = ws.deliberations.get(p.deliberation_id);
+    if (!delib) return { error: rpcError(E.PARAMS, "Unknown deliberation") };
+    if (delib.state !== "open") {
+      return { error: rpcError(E.DELIB_CLOSED_OR_LAPSED, "Deliberation not open") };
+    }
+    for (const f of ["from", "vote"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const v = p.vote;
+    if (v !== "yea" && v !== "nay" && v !== "abstain") {
+      return { error: rpcError(E.PARAMS, "vote must be yea/nay/abstain") };
+    }
+    const voter = p.from;
+    if (!delib.participants.includes(voter)) {
+      return { error: rpcError(
+        E.DELIB_VOTER_NOT_IN_LIST,
+        `Voter ${voter} not in participant list`
+      ) };
+    }
+    if (delib.votes.some((x) => x.voter === voter)) {
+      return { error: rpcError(E.DELIB_ALREADY_VOTED, `Voter ${voter} has already voted`) };
+    }
+    delib.votes.push({
+      ts: coord.now(),
+      voter,
+      vote: v,
+      weight: p.weight,
+      comment: p.comment,
+      veto_invoked: !!p.veto_invoked
+    });
+    return { result: { recorded: true } };
+  });
+  coord.handlers.set("deliberate.close", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const delib = ws.deliberations.get(p.deliberation_id);
+    if (!delib) return { error: rpcError(E.PARAMS, "Unknown deliberation") };
+    if (delib.state === "closed") return { result: delib.outcome };
+    delib.state = "closed";
+    delib.outcome = computeOutcome(delib);
+    return { result: delib.outcome };
+  });
+}
+
+// src/profiles/handoff.ts
+function registerHandoff(coord) {
+  coord.handlers.set("handoff.propose", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "to", "tasks"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const proposer = p.from;
+    const recipient = p.to;
+    if (typeof recipient === "string" && !recipient.startsWith("group:")) {
+      if (!ws.members.has(recipient)) {
+        return { error: rpcError(
+          E.HANDOFF_RECIPIENT_NOT_MEMBER,
+          `Recipient ${recipient} is not a member`
+        ) };
+      }
+    }
+    const tasksIn = p.tasks;
+    if (!Array.isArray(tasksIn) || !tasksIn.length) {
+      return { error: rpcError(E.PARAMS, "tasks must be a non-empty list") };
+    }
+    const proposed = [];
+    for (const t of tasksIn) {
+      const tid = t.task_id;
+      if (!tid || !ws.tasks.has(tid)) {
+        return { error: rpcError(E.PARAMS, `Unknown task in handoff: ${tid}`) };
+      }
+      const task = ws.tasks.get(tid);
+      if (task.assignee !== proposer) {
+        return { error: rpcError(
+          E.HANDOFF_TASKS_NOT_ASSIGNED_TO_PROPOSER,
+          `Task ${tid} is not currently assigned to ${proposer}`
+        ) };
+      }
+      proposed.push({
+        task_id: tid,
+        title: t.title,
+        status_summary: t.status_summary,
+        next_action: t.next_action,
+        blockers: t.blockers ?? []
+      });
+    }
+    const id = p.handoff_id || coord.ids.handoffId();
+    const ho = {
+      id,
+      proposer,
+      recipient,
+      proposed_at: coord.now(),
+      tasks: proposed,
+      summary: p.summary,
+      context_links: p.context_links ?? [],
+      state: "proposed"
+    };
+    ws.handoffs.set(id, ho);
+    return { result: { handoff_id: id, state: "proposed", task_ids: proposed.map((t) => t.task_id) } };
+  });
+  coord.handlers.set("handoff.accept", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "handoff_id"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const ho = ws.handoffs.get(p.handoff_id);
+    if (!ho) return { error: rpcError(E.PARAMS, "Unknown handoff") };
+    if (ho.state !== "proposed") {
+      return { error: rpcError(E.HANDOFF_ALREADY_RESOLVED, `Handoff already ${ho.state}`) };
+    }
+    const acceptor = p.from;
+    if (ho.recipient.startsWith("group:")) {
+      if (!ws.members.has(acceptor)) {
+        return { error: rpcError(
+          E.HANDOFF_RECIPIENT_NOT_MEMBER,
+          "Acceptor is not a workspace member"
+        ) };
+      }
+    } else {
+      if (acceptor !== ho.recipient) {
+        return { error: rpcError(
+          E.HANDOFF_RECIPIENT_NOT_MEMBER,
+          "Acceptor is not the named recipient"
+        ) };
+      }
+      if (!ws.members.has(acceptor)) {
+        return { error: rpcError(
+          E.HANDOFF_RECIPIENT_NOT_MEMBER,
+          "Acceptor is not a workspace member"
+        ) };
+      }
+    }
+    const validIds = new Set(ho.tasks.map((t) => t.task_id));
+    const acceptedIds = Array.isArray(p.accepted_task_ids) ? p.accepted_task_ids : ho.tasks.map((t) => t.task_id);
+    for (const tid of acceptedIds) {
+      if (!validIds.has(tid)) {
+        return { error: rpcError(E.PARAMS, `Task ${tid} not in this handoff`) };
+      }
+    }
+    const now = coord.now();
+    for (const tid of acceptedIds) {
+      const task = ws.tasks.get(tid);
+      task.assignee = acceptor;
+      task.updated_at = now;
+      task.history.push({
+        ts: now,
+        from: acceptor,
+        state: task.state,
+        note: `handoff accepted from ${ho.proposer}`
+      });
+    }
+    ho.state = "accepted";
+    ho.accepted_by = acceptor;
+    ho.accepted_task_ids = [...acceptedIds];
+    ho.accept_comment = p.comment;
+    ho.resolved_at = now;
+    return { result: { accepted: true, task_ids: [...acceptedIds], assignee: acceptor } };
+  });
+  coord.handlers.set("handoff.decline", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "handoff_id"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const ho = ws.handoffs.get(p.handoff_id);
+    if (!ho) return { error: rpcError(E.PARAMS, "Unknown handoff") };
+    if (ho.state !== "proposed") {
+      return { error: rpcError(E.HANDOFF_ALREADY_RESOLVED, `Handoff already ${ho.state}`) };
+    }
+    const decliner = p.from;
+    ho.decline_reason = p.reason;
+    ho.decline_suggested_target = p.suggested_target;
+    if (!ho.recipient.startsWith("group:") && decliner === ho.recipient) {
+      ho.state = "declined";
+      ho.resolved_at = coord.now();
+    }
+    return { result: { recorded: true, state: ho.state } };
+  });
+}
+
+// src/profiles/routing.ts
+var CRIT = { low: 0, medium: 1, high: 2, critical: 3 };
+function defaultDepth(hints) {
+  const crit = hints.criticality ?? "medium";
+  let conf = 1;
+  try {
+    conf = Number(hints.confidence ?? 1);
+  } catch {
+    conf = 1;
+  }
+  if (isNaN(conf)) conf = 1;
+  const r = CRIT[crit] ?? 1;
+  if (r >= 3) return { depth: "full", summary: "criticality=critical: full review" };
+  if (r === 2 && conf < 0.7) return { depth: "full", summary: "criticality=high and confidence<0.7: full review" };
+  if (r === 0 && conf >= 0.95) return { depth: "skip", summary: "very low criticality + very high confidence: skip" };
+  if (r <= 1 && conf >= 0.85) return { depth: "spot_check", sampling: 0.1, summary: "low criticality + high confidence: 10% sample" };
+  return { depth: "spot_check", sampling: 0.25, summary: "default mid-confidence: 25% sample" };
+}
+function registerRouting(coord) {
+  coord.handlers.set("task.route", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const candidates = p.candidates ?? [];
+    if (!candidates.length) {
+      return { error: rpcError(E.ROUTING_CANDIDATES_EMPTY, "candidates array was empty") };
+    }
+    let selected;
+    let rationale;
+    if (coord.options.routingPolicy) {
+      try {
+        const d = coord.options.routingPolicy(task, [...candidates]);
+        selected = d.selected;
+        rationale = d.rationale;
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { error: rpcError(E.ROUTING_POLICY_UNREACHABLE, `routing policy error: ${msg}`) };
+      }
+    } else {
+      const eligible = candidates.filter((c) => ws.members.has(c));
+      if (!eligible.length) {
+        return { error: rpcError(E.ROUTING_NO_ELIGIBLE_ASSIGNEE, "No candidate is a workspace member") };
+      }
+      selected = eligible[0];
+      rationale = {
+        policy_id: "default",
+        hints_used: Object.keys(task.routing_hints ?? {}),
+        summary: "default policy: first eligible candidate",
+        alternatives_considered: eligible.slice(1).map((c) => ({
+          candidate: c,
+          reason_excluded: "not first eligible"
+        }))
+      };
+    }
+    if (!ws.members.has(selected)) {
+      return { error: rpcError(
+        E.ROUTING_NO_ELIGIBLE_ASSIGNEE,
+        `Selected ${JSON.stringify(selected)} is not a member`
+      ) };
+    }
+    task.assignee = selected;
+    task.updated_at = coord.now();
+    task.history.push({
+      ts: task.updated_at,
+      from: "service:coordinator",
+      state: task.state,
+      note: `routed to ${selected}`
+    });
+    const artId = coord.ids.artefactId();
+    const artefact = {
+      id: artId,
+      kind: "route_decision",
+      decision_type: "task.route",
+      outcome: selected,
+      produced_by: "service:coordinator",
+      produced_at: task.updated_at,
+      task: task.id,
+      policy_id: rationale.policy_id,
+      hints_observed: { ...task.routing_hints ?? {} },
+      rationale: rationale.summary ?? "",
+      alternatives_considered: rationale.alternatives_considered
+    };
+    ws.route_decisions.set(artId, artefact);
+    return { result: { selected, decision_artefact: artId, rationale } };
+  });
+  coord.handlers.set("review.depth", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const hints = {
+      ...task.routing_hints ?? {},
+      ...p.artefact_routing_hints ?? {}
+    };
+    if (!Object.keys(hints).length) {
+      return { error: rpcError(E.ROUTING_DEPTH_NOT_APPLICABLE, "No routing_hints to consult") };
+    }
+    let depth;
+    let sampling;
+    let summary;
+    let policyId;
+    if (coord.options.reviewDepthPolicy) {
+      try {
+        const d = coord.options.reviewDepthPolicy(task, hints);
+        depth = d.depth;
+        sampling = d.sampling_probability;
+        summary = d.rationale.summary ?? "operator policy";
+        policyId = d.rationale.policy_id ?? "operator";
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { error: rpcError(E.ROUTING_POLICY_UNREACHABLE, `depth policy error: ${msg}`) };
+      }
+    } else {
+      const d = defaultDepth(hints);
+      depth = d.depth;
+      sampling = d.sampling;
+      summary = d.summary;
+      policyId = "default";
+    }
+    const artId = coord.ids.artefactId();
+    const artefact = {
+      id: artId,
+      kind: "route_decision",
+      decision_type: "review.depth",
+      outcome: depth,
+      produced_by: "service:coordinator",
+      produced_at: coord.now(),
+      task: task.id,
+      policy_id: policyId,
+      hints_observed: hints,
+      rationale: summary,
+      ...sampling !== void 0 ? { sampling_probability: sampling } : {}
+    };
+    ws.route_decisions.set(artId, artefact);
+    const result = {
+      depth,
+      decision_artefact: artId,
+      rationale: { policy_id: policyId, hints_used: Object.keys(hints), summary }
+    };
+    if (sampling !== void 0) result.sampling_probability = sampling;
+    return { result };
+  });
+  coord.handlers.set("escalate.auto", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const hints = { ...task.routing_hints ?? {} };
+    let escalate, to, rule;
+    if (coord.options.escalationPolicy) {
+      try {
+        const d = coord.options.escalationPolicy(task, hints);
+        escalate = !!d.escalate;
+        to = d.to;
+        rule = d.triggered_rule ?? {};
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        return { error: rpcError(E.ROUTING_POLICY_UNREACHABLE, `escalation policy error: ${msg}`) };
+      }
+    } else {
+      const crit = hints.criticality ?? "medium";
+      let conf = 1;
+      try {
+        conf = Number(hints.confidence ?? 1);
+      } catch {
+        conf = 1;
+      }
+      if (isNaN(conf)) conf = 1;
+      const r = CRIT[crit] ?? 1;
+      escalate = r >= 3 || r >= 2 && conf < 0.6;
+      to = p.default_escalation_target;
+      rule = {
+        rule_id: "default-auto-esc",
+        summary: "criticality=critical OR (criticality>=high AND confidence<0.6)",
+        hints_used: ["criticality", "confidence"]
+      };
+    }
+    const artId = coord.ids.artefactId();
+    const artefact = {
+      id: artId,
+      kind: "route_decision",
+      decision_type: "escalate.auto",
+      outcome: escalate ? { escalate: true, to } : { escalate: false },
+      produced_by: "service:coordinator",
+      produced_at: coord.now(),
+      task: task.id,
+      policy_id: rule.rule_id,
+      hints_observed: hints,
+      rationale: rule.summary ?? "",
+      ...escalate ? { escalation_target: to } : {}
+    };
+    ws.route_decisions.set(artId, artefact);
+    if (escalate) {
+      if (!to) return { error: rpcError(
+        E.ROUTING_ESC_TARGET_UNAVAILABLE,
+        "Escalation triggered but no target available"
+      ) };
+      if (!to.startsWith("group:") && !ws.members.has(to)) {
+        return { error: rpcError(
+          E.ROUTING_ESC_TARGET_UNAVAILABLE,
+          `Escalation target ${to} is not a member or group`
+        ) };
+      }
+      if (coord.options.onAutoEscalate) {
+        try {
+          coord.options.onAutoEscalate(task, to);
+        } catch {
+        }
+      }
+      return { result: { escalate: true, to, decision_artefact: artId, triggered_rule: rule } };
+    }
+    return { result: { escalate: false, decision_artefact: artId } };
+  });
+}
+
+// src/profiles/security_signed.ts
+function registerSecuritySigned(coord) {
+  coord.handlers.set("participant.rotate_key", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "old_kid", "new_jwk"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const member = ws.members.get(p.from);
+    if (!member) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `Unknown participant: ${p.from}`) };
+    const oldKid = p.old_kid;
+    const oldKey = member.keys.find((k) => k.kid === oldKid);
+    if (!oldKey) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `No key ${oldKid} for ${p.from}`) };
+    if (oldKey.revoked_at) return { error: rpcError(E.SIG_KEY_REVOKED, `Key ${oldKid} is revoked`) };
+    const newJwk = p.new_jwk;
+    if (!newJwk || typeof newJwk.kid !== "string") {
+      return { error: rpcError(E.PARAMS, "new_jwk must include kid") };
+    }
+    const now = coord.now();
+    oldKey.valid_until = now;
+    member.keys.push({
+      jwk: newJwk,
+      kid: newJwk.kid,
+      valid_from: now
+    });
+    return { result: { rotated: true, old_kid: oldKid, new_kid: newJwk.kid, valid_from: now } };
+  });
+  coord.handlers.set("participant.revoke_key", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["target_uri", "kid"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const member = ws.members.get(p.target_uri);
+    if (!member) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `Unknown target: ${p.target_uri}`) };
+    const key = member.keys.find((k) => k.kid === p.kid);
+    if (!key) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `No key ${p.kid} for target`) };
+    const now = coord.now();
+    key.revoked_at = now;
+    key.revoked_reason = p.reason || "unspecified";
+    return { result: { revoked: true, kid: key.kid, revoked_at: now, reason: key.revoked_reason } };
+  });
+}
+
+// src/profiles/whisper.ts
+function parseIso(ts) {
+  return new Date(ts).getTime();
+}
+function registerWhisper(coord) {
+  coord.handlers.set("whisper.ask", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "to", "task_id", "question", "deadline_ms", "default_if_lapsed"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    if (!ws.tasks.has(p.task_id)) {
+      return { error: rpcError(E.PARAMS, "Unknown task") };
+    }
+    const to = p.to;
+    const askee = Array.isArray(to) ? to : [to];
+    const id = p.whisper_id || coord.ids.artefactId();
+    const prompt = {
+      id,
+      task_id: p.task_id,
+      asker: p.from,
+      askee,
+      question: p.question,
+      options: p.options,
+      asked_at: coord.now(),
+      deadline_ms: Number(p.deadline_ms),
+      default_if_lapsed: p.default_if_lapsed,
+      urgency: p.urgency || "low",
+      state: "pending"
+    };
+    ws.whispers.set(id, prompt);
+    return { result: { whisper_id: id, deadline_ms: prompt.deadline_ms } };
+  });
+  coord.handlers.set("whisper.answer", (p) => {
+    const ws = coord.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    for (const f of ["from", "whisper_id"]) {
+      if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
+    }
+    const prompt = ws.whispers.get(p.whisper_id);
+    if (!prompt) return { error: rpcError(E.PARAMS, "Unknown whisper id") };
+    const answerer = p.from;
+    const broadcast = prompt.askee.some((a) => typeof a === "string" && (a.startsWith("workspace:") || a.startsWith("group:")));
+    if (broadcast) {
+      if (!ws.members.has(answerer)) {
+        return { error: rpcError(E.NOT_AUTHORISED, `Not a workspace member: ${answerer}`) };
+      }
+    } else if (!prompt.askee.includes(answerer)) {
+      return { error: rpcError(E.NOT_AUTHORISED, `Whisper was not addressed to ${answerer}`) };
+    }
+    if (prompt.state === "answered") {
+      return { error: rpcError(E.WHISPER_ALREADY_ANSWERED, "Whisper already answered") };
+    }
+    if (prompt.state === "lapsed") {
+      return { error: rpcError(E.WHISPER_LAPSED, "Whisper already lapsed") };
+    }
+    const answerOption = p.answer_option;
+    const answerText = p.answer ?? p.answer_text;
+    if (prompt.options && prompt.options.length) {
+      if (answerOption === void 0) {
+        return { error: rpcError(E.PARAMS, "answer_option is required when options are defined") };
+      }
+      const valid = new Set(prompt.options.map((o) => o.id));
+      if (!valid.has(answerOption)) {
+        return { error: rpcError(
+          E.WHISPER_OPTION_NOT_IN_SET,
+          `Answer option ${JSON.stringify(answerOption)} not in option set`
+        ) };
+      }
+    } else {
+      if (answerText === void 0 && answerOption === void 0) {
+        return { error: rpcError(E.PARAMS, "answer or answer_option required") };
+      }
+    }
+    prompt.state = "answered";
+    prompt.answered_at = coord.now();
+    prompt.answered_by = p.from;
+    prompt.answer_option = answerOption;
+    prompt.answer_text = answerText;
+    prompt.comment = p.comment;
+    return { result: { answered: true, whisper_id: prompt.id } };
+  });
+  coord.checkWhisperLapses = (workspaceId, now) => {
+    const ws = coord.workspaces.get(workspaceId);
+    if (!ws) return [];
+    const cutoff = parseIso(now ?? coord.now());
+    const emitted = [];
+    for (const prompt of ws.whispers.values()) {
+      if (prompt.state !== "pending") continue;
+      const asked = parseIso(prompt.asked_at);
+      const deadline = asked + prompt.deadline_ms;
+      if (cutoff < deadline) continue;
+      prompt.state = "lapsed";
+      prompt.default_applied = prompt.default_if_lapsed;
+      const notify = {
+        jsonrpc: "2.0",
+        method: "notify.message",
+        params: {
+          workspace: ws.id,
+          from: "service:coordinator",
+          to: [prompt.asker, ...prompt.askee],
+          ts: coord.now(),
+          kind: "whisper_lapsed",
+          whisper_id: prompt.id,
+          default_applied: prompt.default_if_lapsed
+        }
+      };
+      coord.recordAudit(ws, notify);
+      emitted.push(notify);
+    }
+    return emitted;
+  };
+}
+
+// src/coordinator.ts
+var PRIVILEGED_METHODS = /* @__PURE__ */ new Set([
+  "control.pause",
+  "control.resume",
+  "control.cancel",
+  "control.supersede",
+  "control.snapshot",
+  "control.rollback",
+  "control.set_mode_ceiling",
+  "workspace.set_profiles",
+  "participant.rotate_key",
+  "participant.revoke_key"
+]);
+var READ_ONLY_METHODS = /* @__PURE__ */ new Set([
+  "workspace.describe",
+  "audit.read",
+  "audit.verify_chain",
+  "audit.verify_receipt"
+]);
+function nowIso(clockMs) {
+  const d = clockMs === void 0 ? /* @__PURE__ */ new Date() : new Date(clockMs);
+  return d.toISOString().replace(/\.(\d{3})Z$/, ".$1Z");
+}
+function missing(params, fields) {
+  for (const f of fields) if (!(f in params)) return f;
+  return null;
+}
+function tagsError(p) {
+  const tags = p.tags;
+  if (tags !== void 0 && (!Array.isArray(tags) || !tags.every((t) => typeof t === "string"))) {
+    return { error: rpcError(E.PARAMS, "tags must be a list of strings") };
+  }
+  return null;
+}
+function linkHash(envelope, prev) {
+  return sha256Hex(Buffer.concat([canonicalize(envelope), Buffer.from(prev, "utf-8")]));
+}
+function reply(env, body) {
+  const out = { jsonrpc: "2.0", id: env.id };
+  if (body.error !== void 0) out.error = body.error;
+  else out.result = body.result;
+  return out;
+}
+var Coordinator = class {
+  workspaces = /* @__PURE__ */ new Map();
+  options;
+  ids;
+  store;
+  wsVersions = /* @__PURE__ */ new Map();
+  clockMs;
+  auditListeners = [];
+  /** Method handler registry; profiles plug into this. */
+  handlers = /* @__PURE__ */ new Map();
+  /** Custom lapse-check function (whisper/1.0). Set by the whisper profile. */
+  checkWhisperLapses;
+  /** Typed method facade. Defined via getter in the constructor. */
+  api;
+  /** @internal cached facade instance */
+  _api;
+  constructor(options = {}) {
+    this.options = options;
+    this.store = options.store ?? new MemoryStore();
+    this.ids = new IdFactory(!!options.deterministicIds, 0n, 17e11);
+    if (options.deterministicClock) this.clockMs = 17e11;
+    if (options.onAudit) this.auditListeners.push(options.onAudit);
+    this.registerCoreHandlers();
+    this.registerProfileHandlers();
+    Object.defineProperty(this, "api", {
+      get: () => {
+        if (!this._api) this._api = makeApi(this);
+        return this._api;
+      },
+      enumerable: false,
+      configurable: true
+    });
+    try {
+      const loaded = this.store.load();
+      if (!(loaded instanceof Promise)) {
+        this.applyRecords(loaded);
+      }
+    } catch {
+    }
+  }
+  /**
+   * Asynchronously hydrate workspaces from the store. Required only for
+   * stores whose `load()` returns a Promise. Idempotent.
+   */
+  async start() {
+    const records = await this.store.load();
+    this.applyRecords(records);
+  }
+  applyRecords(records) {
+    this.workspaces.clear();
+    this.wsVersions.clear();
+    for (const r of records) {
+      this.restore([r.data]);
+      this.wsVersions.set(r.id, r.version);
+    }
+  }
+  /** Persist the current snapshot of one workspace to the store. */
+  persist(ws) {
+    const next = (this.wsVersions.get(ws.id) ?? 0) + 1;
+    this.wsVersions.set(ws.id, next);
+    try {
+      const all = this.snapshot();
+      const data = all.find((w) => w.id === ws.id);
+      if (!data) return;
+      const result = this.store.save({
+        id: ws.id,
+        data,
+        version: next,
+        updated_at: this.now()
+      });
+      if (result instanceof Promise) {
+        result.catch(() => {
+        });
+      }
+    } catch {
+    }
+  }
+  // -- lifecycle -----------------------------------------------------
+  now() {
+    if (this.clockMs !== void 0) {
+      this.clockMs += 1e3;
+      return nowIso(this.clockMs);
+    }
+    return nowIso();
+  }
+  onAudit(listener) {
+    this.auditListeners.push(listener);
+    return () => {
+      const i = this.auditListeners.indexOf(listener);
+      if (i >= 0) this.auditListeners.splice(i, 1);
+    };
+  }
+  /** Convenience: get a workspace by id, or undefined. */
+  getWorkspace(id) {
+    return this.workspaces.get(id);
+  }
+  // ----- authorisation preconditions -----
+  /**
+   * Assert that `sender` is a joined member of `ws`. Returns an error
+   * fragment if not, else null. Every actor-action method runs this on
+   * its `from` so a decision, completion, or review request can never
+   * be attributed to a participant who never joined. See
+   * SPECIFICATION.md S6.3 and the `unknown_participant` condition in
+   * S13.3. (The published spec assigns -32403; the reference
+   * implementations use NOT_AUTHORISED -32011 because -32403 already
+   * denotes OIDC_TOKEN_INVALID in their private range. The spec/impl
+   * error-table divergence is tracked separately.)
+   */
+  requireMember(ws, sender) {
+    if (typeof sender !== "string" || !ws.members.has(sender)) {
+      return { error: rpcError(E.NOT_AUTHORISED, `Not a workspace member: ${String(sender)}`) };
+    }
+    return null;
+  }
+  /**
+   * Assert that `sender` was addressed in the task's review. Applied to
+   * review-decision methods (decide.* and abstain.declare): to act on a
+   * review you must be one of the reviewers it was addressed to (the
+   * `to` set on review.request). Membership is the floor; this is the
+   * eligibility ceiling for decisions. Returns an error fragment if not
+   * eligible, else null.
+   */
+  requireReviewer(task, sender) {
+    const review = task.review;
+    if (!review || !review.requested_to || review.requested_to.length === 0) {
+      return null;
+    }
+    if (review.requested_to.some((r) => typeof r === "string" && (r.startsWith("workspace:") || r.startsWith("group:")))) {
+      return null;
+    }
+    if (typeof sender !== "string" || !review.requested_to.includes(sender)) {
+      return { error: rpcError(E.NOT_AUTHORISED, `Not an addressed reviewer for this task: ${String(sender)}`) };
+    }
+    return null;
+  }
+  /** Serialise all workspaces to a JSON-safe structure for persistence. */
+  snapshot() {
+    const out = [];
+    for (const ws of this.workspaces.values()) {
+      out.push({
+        id: ws.id,
+        created: ws.created,
+        state: ws.state,
+        profiles: ws.profiles,
+        mode: ws.mode,
+        mode_ceiling: ws.mode_ceiling,
+        routing_policy_uri: ws.routing_policy_uri,
+        step_up_window_sec: ws.step_up_window_sec,
+        members: Array.from(ws.members.values()),
+        tasks: Array.from(ws.tasks.values()),
+        overrides: Array.from(ws.overrides.values()),
+        whispers: Array.from(ws.whispers.values()),
+        deliberations: Array.from(ws.deliberations.values()),
+        handoffs: Array.from(ws.handoffs.values()),
+        snapshots: Array.from(ws.snapshots.values()),
+        route_decisions: Array.from(ws.route_decisions.values()),
+        audit: ws.audit,
+        chain_head: ws.chain_head,
+        chain_enabled: ws.chain_enabled
+      });
+    }
+    return out;
+  }
+  /** Restore from a snapshot produced by ``snapshot()``. Replaces
+   *  any existing in-memory workspaces. */
+  restore(data) {
+    this.workspaces.clear();
+    if (!Array.isArray(data)) return;
+    for (const w of data) {
+      const ws = {
+        id: w.id,
+        created: w.created,
+        state: w.state ?? "active",
+        profiles: w.profiles ?? [],
+        mode: w.mode ?? "trial",
+        mode_ceiling: w.mode_ceiling ?? "production",
+        routing_policy_uri: w.routing_policy_uri,
+        step_up_window_sec: w.step_up_window_sec ?? 300,
+        members: /* @__PURE__ */ new Map(),
+        tasks: /* @__PURE__ */ new Map(),
+        overrides: /* @__PURE__ */ new Map(),
+        whispers: /* @__PURE__ */ new Map(),
+        deliberations: /* @__PURE__ */ new Map(),
+        handoffs: /* @__PURE__ */ new Map(),
+        snapshots: /* @__PURE__ */ new Map(),
+        route_decisions: /* @__PURE__ */ new Map(),
+        audit: w.audit ?? [],
+        chain_head: w.chain_head,
+        chain_enabled: !!w.chain_enabled
+      };
+      for (const m of w.members ?? []) {
+        if (!Array.isArray(m.keys)) m.keys = [];
+        if (m.paused === void 0) m.paused = false;
+        ws.members.set(m.uri, m);
+      }
+      for (const t of w.tasks ?? []) ws.tasks.set(t.id, t);
+      for (const o of w.overrides ?? []) ws.overrides.set(o.id, o);
+      for (const x of w.whispers ?? [])
+        ws.whispers.set(x.id, x);
+      for (const x of w.deliberations ?? [])
+        ws.deliberations.set(x.id, x);
+      for (const x of w.handoffs ?? [])
+        ws.handoffs.set(x.id, x);
+      for (const x of w.snapshots ?? [])
+        ws.snapshots.set(x.id, x);
+      for (const x of w.route_decisions ?? [])
+        ws.route_decisions.set(x.id, x);
+      this.workspaces.set(ws.id, ws);
+    }
+  }
+  // -- dispatch ------------------------------------------------------
+  dispatch(envelope) {
+    if (!isValidEnvelope(envelope) || !envelope.method) {
+      return reply(envelope, { error: rpcError(E.REQUEST, "Invalid JSON-RPC 2.0 request") });
+    }
+    const method = envelope.method;
+    const rawParams = envelope.params;
+    if (rawParams !== void 0 && rawParams !== null && (typeof rawParams !== "object" || Array.isArray(rawParams))) {
+      return reply(envelope, { error: rpcError(E.PARAMS, "Invalid params: expected an object") });
+    }
+    const params = rawParams ?? {};
+    if (this.options.requireSignatures && method !== "participant.join" && method !== "workspace.create") {
+      const sigErr = this.verifySignature(envelope);
+      if (sigErr) return reply(envelope, { error: sigErr });
+    }
+    if (this.options.enforceStepUp && PRIVILEGED_METHODS.has(method)) {
+      const stale = this.checkStepUp(params);
+      if (stale) return reply(envelope, { error: stale });
+    }
+    if (method.startsWith("control.") || method.startsWith("deliberate.") || method.startsWith("handoff.")) {
+      const wsId2 = params.workspace;
+      const ws = typeof wsId2 === "string" ? this.workspaces.get(wsId2) : void 0;
+      if (ws) {
+        const notMember = this.requireMember(ws, params.from);
+        if (notMember) return reply(envelope, { error: notMember.error });
+      }
+    }
+    const exempt = /* @__PURE__ */ new Set([
+      "workspace.create",
+      "workspace.describe",
+      "control.resume",
+      "audit.read",
+      "participant.join",
+      "participant.leave"
+    ]);
+    if (!exempt.has(method)) {
+      const wsId2 = params.workspace;
+      if (typeof wsId2 === "string") {
+        const ws = this.workspaces.get(wsId2);
+        if (ws && ws.state === "paused") {
+          return reply(envelope, { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Workspace ${wsId2} is paused`) });
+        }
+      }
+    }
+    const handler = this.handlers.get(method);
+    if (!handler) {
+      return reply(envelope, { error: rpcError(E.METHOD, `Unknown method: ${method}`) });
+    }
+    try {
+      canonicalize(envelope);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return reply(envelope, { error: rpcError(E.PARAMS, msg) });
+    }
+    let out;
+    try {
+      out = handler(params);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return reply(envelope, { error: rpcError(E.INTERNAL, "Internal error", { detail: msg }) });
+    }
+    if (out.error) return reply(envelope, { error: out.error });
+    const wsId = params.workspace;
+    if (typeof wsId === "string" && !READ_ONLY_METHODS.has(method)) {
+      const ws = this.workspaces.get(wsId);
+      if (ws) this.recordAudit(ws, envelope);
+    }
+    return reply(envelope, { result: out.result });
+  }
+  // -- audit ---------------------------------------------------------
+  recordAudit(ws, envelope) {
+    const entry = {
+      seq: ws.audit.length,
+      arrived: this.now(),
+      envelope: JSON.parse(JSON.stringify(envelope))
+    };
+    if (ws.chain_enabled || this.options.enableChain) {
+      const prev = ws.chain_head ?? ZERO_HASH;
+      entry.prev_hash = prev;
+      ws.chain_head = linkHash(entry.envelope, prev);
+    }
+    ws.audit.push(entry);
+    for (const l of this.auditListeners) {
+      try {
+        l(ws, entry);
+      } catch {
+      }
+    }
+    this.persist(ws);
+  }
+  // -- signature verification (security-signed/1.0) -----------------
+  verifySignature(envelope) {
+    const sig = envelope.sig;
+    if (!sig || typeof sig !== "string") {
+      return rpcError(E.SIG_VERIFY_FAILED, "Missing top-level `sig` field");
+    }
+    const parts = sig.split(":");
+    if (parts.length !== 3 || parts[0] !== "ed25519") {
+      return rpcError(E.SIG_VERIFY_FAILED, "Malformed signature tag");
+    }
+    const kid = parts[1];
+    const params = envelope.params ?? {};
+    const sender = params.from;
+    const wsId = params.workspace;
+    const ts = params.ts ?? this.now();
+    if (!sender || !wsId) {
+      return rpcError(E.SIG_VERIFY_FAILED, "Cannot verify signature: missing from/workspace");
+    }
+    const ws = this.workspaces.get(wsId);
+    if (!ws) {
+      return rpcError(E.SIG_VERIFY_FAILED, "Cannot verify signature: unknown workspace");
+    }
+    const member = ws.members.get(sender);
+    if (!member) return rpcError(E.SIG_KEY_NOT_FOUND, `No member: ${sender}`);
+    const now = this.now();
+    if (member.keys.some((k) => k.kid === kid && k.revoked_at !== void 0 && now >= k.revoked_at)) {
+      return rpcError(E.SIG_KEY_REVOKED, `Key ${kid} is revoked`);
+    }
+    const key = this.lookupKey(member, kid, ts);
+    if (!key) {
+      const revoked = member.keys.find((k) => k.kid === kid && k.revoked_at);
+      if (revoked) return rpcError(E.SIG_KEY_REVOKED, `Key ${kid} is revoked`);
+      return rpcError(E.SIG_KEY_NOT_FOUND, `No key ${kid} valid at ${ts} for ${sender}`);
+    }
+    try {
+      const stripped = JSON.parse(JSON.stringify(envelope));
+      delete stripped.sig;
+      const canonical = canonicalize(stripped);
+      const pub = publicKeyFromJwk(key.jwk);
+      if (!verifyEnvelope(canonical, sig, pub)) {
+        return rpcError(E.SIG_VERIFY_FAILED, "Signature failed verification");
+      }
+      return null;
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return rpcError(E.INTERNAL, `Signature check error: ${msg}`);
+    }
+  }
+  /** Lookup the key valid for a given participant at a given time. */
+  lookupKey(member, kid, ts) {
+    for (const k of member.keys) {
+      if (k.kid !== kid) continue;
+      if (k.revoked_at !== void 0 && ts >= k.revoked_at) continue;
+      if (ts < k.valid_from) continue;
+      if (k.valid_until !== void 0 && ts >= k.valid_until) continue;
+      return k;
+    }
+    return null;
+  }
+  // -- step-up (identity-oidc/1.0) -----------------------------------
+  checkStepUp(params) {
+    const wsId = params.workspace;
+    const sender = params.from;
+    if (!wsId || !sender) return null;
+    const ws = this.workspaces.get(wsId);
+    if (!ws) return null;
+    const member = ws.members.get(sender);
+    if (!member || member.oidc_auth_time === void 0) return null;
+    const nowSec = Math.floor(Date.now() / 1e3);
+    const age = nowSec - member.oidc_auth_time;
+    if (age > ws.step_up_window_sec) {
+      return rpcError(E.OIDC_STEP_UP_REQUIRED, "Step-up authentication required", {
+        window_sec: ws.step_up_window_sec,
+        age_sec: age
+      });
+    }
+    return null;
+  }
+  // ==========================================================
+  //   Registration
+  // ==========================================================
+  registerCoreHandlers() {
+    this.handlers.set("workspace.create", (p) => this.opWorkspaceCreate(p));
+    this.handlers.set("workspace.describe", (p) => this.opWorkspaceDescribe(p));
+    this.handlers.set("workspace.set_profiles", (p) => this.opWorkspaceSetProfiles(p));
+    this.handlers.set("participant.join", (p) => this.opParticipantJoin(p));
+    this.handlers.set("participant.leave", (p) => this.opParticipantLeave(p));
+    this.handlers.set("task.create", (p) => this.opTaskCreate(p));
+    this.handlers.set("task.update", (p) => this.opTaskUpdate(p));
+    this.handlers.set("task.complete", (p) => this.opTaskComplete(p));
+    this.handlers.set("audit.read", (p) => this.opAuditRead(p));
+    this.handlers.set("review.request", (p) => this.opReviewRequest(p));
+    this.handlers.set("decide.approve", (p) => this.opDecide(p, "approve"));
+    this.handlers.set("decide.reject", (p) => this.opDecide(p, "reject"));
+    this.handlers.set("decide.override", (p) => this.opDecideOverride(p));
+    this.handlers.set("abstain.declare", (p) => this.opAbstainDeclare(p));
+    this.handlers.set("escalate.raise", (p) => this.opEscalateRaise(p));
+  }
+  registerProfileHandlers() {
+    registerWhisper(this);
+    registerDeliberation(this);
+    registerHandoff(this);
+    registerControl(this);
+    registerRouting(this);
+    registerSecuritySigned(this);
+    registerAuditScitt(this);
+  }
+  // ==========================================================
+  //   Core method handlers
+  // ==========================================================
+  opWorkspaceCreate(p) {
+    const id = p.workspace || this.ids.workspaceId();
+    if (typeof id !== "string") return { error: rpcError(E.PARAMS, "workspace must be a string id") };
+    if (this.workspaces.has(id)) return { error: rpcError(E.PARAMS, `workspace already exists: ${id}`) };
+    const profiles = Array.isArray(p.profiles) ? [...p.profiles] : [...this.options.defaultProfiles ?? ["core/1.0", "review/1.0"]];
+    const chainEnabled = profiles.includes("audit-scitt/1.0") || !!this.options.enableChain;
+    const ws = {
+      id,
+      created: this.now(),
+      state: "active",
+      profiles,
+      mode: p.mode ?? "trial",
+      mode_ceiling: p.mode_ceiling ?? "production",
+      routing_policy_uri: p.routing_policy_uri,
+      step_up_window_sec: typeof p.step_up_window_sec === "number" ? p.step_up_window_sec : 300,
+      members: /* @__PURE__ */ new Map(),
+      tasks: /* @__PURE__ */ new Map(),
+      overrides: /* @__PURE__ */ new Map(),
+      whispers: /* @__PURE__ */ new Map(),
+      deliberations: /* @__PURE__ */ new Map(),
+      handoffs: /* @__PURE__ */ new Map(),
+      snapshots: /* @__PURE__ */ new Map(),
+      route_decisions: /* @__PURE__ */ new Map(),
+      audit: [],
+      chain_enabled: chainEnabled,
+      chain_head: chainEnabled ? ZERO_HASH : void 0
+    };
+    this.workspaces.set(id, ws);
+    return { result: { workspace: id, created: ws.created } };
+  }
+  opWorkspaceDescribe(p) {
+    const miss = missing(p, ["workspace"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, `Unknown workspace: ${p.workspace}`) };
+    return { result: {
+      id: ws.id,
+      created: ws.created,
+      state: ws.state,
+      mode: ws.mode,
+      mode_ceiling: ws.mode_ceiling,
+      step_up_window_sec: ws.step_up_window_sec,
+      profiles: ws.profiles,
+      members: Array.from(ws.members.values()).map(memberToDict),
+      audit_count: ws.audit.length,
+      task_count: ws.tasks.size,
+      override_count: ws.overrides.size,
+      evidence_head: ws.chain_head,
+      ...ws.routing_policy_uri ? { routing_policy_uri: ws.routing_policy_uri } : {}
+    } };
+  }
+  opWorkspaceSetProfiles(p) {
+    const miss = missing(p, ["workspace", "profiles"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const newProfiles = [...p.profiles];
+    if (!newProfiles.some((pr) => pr.startsWith("core/"))) newProfiles.push("core/1.0");
+    ws.profiles = newProfiles;
+    if (newProfiles.includes("audit-scitt/1.0") && !ws.chain_enabled) {
+      ws.chain_enabled = true;
+      ws.chain_head = ZERO_HASH;
+    }
+    return { result: { profiles: ws.profiles } };
+  }
+  opParticipantJoin(p) {
+    const miss = missing(p, ["workspace", "from", "type"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    let ws = this.workspaces.get(p.workspace);
+    if (!ws) {
+      const create = this.opWorkspaceCreate({ workspace: p.workspace });
+      if (create.error) return create;
+      ws = this.workspaces.get(p.workspace);
+    }
+    const uri = p.from;
+    const now = this.now();
+    const member = {
+      uri,
+      type: p.type,
+      role: p.role || "participant",
+      joined: now,
+      display_name: p.display_name,
+      capabilities: p.capabilities,
+      scopes: p.scopes,
+      keys: [],
+      paused: false
+    };
+    if (this.options.verifyOidcToken && typeof p.oidc_token === "string") {
+      const claims = this.options.verifyOidcToken(p.oidc_token);
+      if (claims === null) return { error: rpcError(E.OIDC_TOKEN_INVALID, "OIDC token invalid") };
+      member.oidc_sub = claims.sub;
+      const at = claims.auth_time;
+      if (typeof at === "number") member.oidc_auth_time = at;
+      const cnf = claims.cnf;
+      const cnfJwk = cnf?.jwk;
+      if (cnfJwk && typeof cnfJwk.kid === "string") {
+        member.keys.push({ jwk: cnfJwk, kid: cnfJwk.kid, valid_from: now });
+      }
+    }
+    if (this.options.verifyVc && typeof p.vc_presentation === "object" && p.vc_presentation !== null) {
+      const subject = this.options.verifyVc(p.vc_presentation);
+      if (subject === null) return { error: rpcError(E.VC_VP_INVALID, "VC presentation invalid") };
+      member.vc_holder = subject.holder ?? subject.id;
+      const vpJwk = subject.cnf_jwk;
+      if (vpJwk && typeof vpJwk.kid === "string") {
+        member.keys.push({ jwk: vpJwk, kid: vpJwk.kid, valid_from: now });
+      }
+    }
+    const attested = [...member.keys];
+    const jwks = p.jwks;
+    if (jwks?.keys && attested.length === 0) {
+      for (const j of jwks.keys) {
+        if (j.kid && !member.keys.some((k) => k.kid === j.kid)) {
+          member.keys.push({ jwk: j, kid: j.kid, valid_from: now });
+        }
+      }
+    }
+    const existing = ws.members.get(uri);
+    if (existing) {
+      if (member.oidc_sub !== void 0) existing.oidc_sub = member.oidc_sub;
+      if (member.oidc_auth_time !== void 0) existing.oidc_auth_time = member.oidc_auth_time;
+      if (member.vc_holder !== void 0) existing.vc_holder = member.vc_holder;
+      for (const k of attested) {
+        if (!existing.keys.some((x) => x.kid === k.kid)) existing.keys.push(k);
+      }
+      return { result: { joined: true, as: uri } };
+    }
+    ws.members.set(uri, member);
+    return { result: { joined: true, as: uri } };
+  }
+  opParticipantLeave(p) {
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    ws.members.delete(p.from);
+    return { result: { left: true } };
+  }
+  opTaskCreate(p) {
+    const miss = missing(p, ["workspace", "from", "kind", "input"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const assignee = p.assignee || p.to;
+    if (!assignee || !ws.members.has(assignee)) {
+      return { error: rpcError(E.PARAMS, "Assignee not in workspace") };
+    }
+    if (ws.members.get(assignee).paused) {
+      return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${assignee} is paused`) };
+    }
+    const requestedMode = p.mode || ws.mode;
+    if (!modeLE(requestedMode, ws.mode_ceiling)) {
+      return { error: rpcError(
+        E.MODE_CEILING_EXCEEDED,
+        `Requested mode ${requestedMode} exceeds ceiling ${ws.mode_ceiling}`
+      ) };
+    }
+    const taskId = this.ids.taskId();
+    const now = this.now();
+    const task = {
+      id: taskId,
+      kind: p.kind,
+      state: "created",
+      assignee,
+      delegator: p.from,
+      input: p.input,
+      created_at: now,
+      updated_at: now,
+      deadline: p.deadline,
+      mode: requestedMode,
+      routing_hints: p.routing_hints,
+      history: [{ ts: now, from: p.from, state: "created" }],
+      paused: false
+    };
+    if (task.mode === "trial") task.review_required = true;
+    else if ("review_required" in p) task.review_required = !!p.review_required;
+    ws.tasks.set(taskId, task);
+    return { result: { task_id: taskId, state: "created" } };
+  }
+  opTaskUpdate(p) {
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const newState = p.state;
+    const legal = {
+      created: ["in_progress", "declined", "paused"],
+      in_progress: ["in_progress", "completed", "declined", "review_requested", "paused"],
+      review_requested: ["in_progress", "completed", "declined"],
+      paused: ["in_progress", "cancelled"]
+    };
+    if (!legal[task.state]?.includes(newState)) {
+      return { error: rpcError(E.PARAMS, `Illegal transition ${task.state} -> ${newState}`) };
+    }
+    task.state = newState;
+    task.updated_at = this.now();
+    task.history.push({
+      ts: task.updated_at,
+      from: p.from,
+      state: newState,
+      note: p.progress_note
+    });
+    return { result: { state: newState } };
+  }
+  opTaskComplete(p) {
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state !== "created" && task.state !== "in_progress") {
+      return { error: rpcError(E.PARAMS, `Cannot complete task in state: ${task.state}`) };
+    }
+    task.output = p.output;
+    if (typeof p.confidence === "number" || typeof p.confidence === "string") task.confidence = p.confidence;
+    task.state = "completed";
+    task.updated_at = this.now();
+    task.history.push({ ts: task.updated_at, from: p.from, state: "completed" });
+    return { result: { state: "completed" } };
+  }
+  opAuditRead(p) {
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const range = p.range ?? {};
+    const filter = p.filter ?? {};
+    const fromSeq = range.from_seq ?? 0;
+    const toSeq = range.to_seq ?? ws.audit.length;
+    const out = [];
+    for (const entry of ws.audit.slice(fromSeq, toSeq)) {
+      const ep = entry.envelope.params ?? {};
+      if (filter.method && entry.envelope.method !== filter.method) continue;
+      if (filter.from && ep.from !== filter.from) continue;
+      if (filter.task_id && ep.task_id !== filter.task_id) continue;
+      const item = {
+        seq: entry.seq,
+        arrived: entry.arrived,
+        envelope: entry.envelope
+      };
+      if (entry.prev_hash) item.prev_hash = entry.prev_hash;
+      out.push(item);
+    }
+    return { result: { entries: out, next_seq: toSeq } };
+  }
+  // ==========================================================
+  //   review/1.0 handlers
+  // ==========================================================
+  opReviewRequest(p) {
+    const miss = missing(p, ["workspace", "from", "task_id", "artefact"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const to = p.to;
+    const reviewers = Array.isArray(to) ? to : typeof to === "string" ? [to] : [];
+    if (!reviewers.length) return { error: rpcError(E.PARAMS, "review.request needs 'to'") };
+    const now = this.now();
+    task.state = "review_requested";
+    task.updated_at = now;
+    task.review = {
+      requested_at: now,
+      requested_to: reviewers,
+      rule: p.rule || "any_one_approves",
+      deadline: p.deadline,
+      decisions: []
+    };
+    task.history.push({ ts: now, from: p.from, state: "review_requested" });
+    task.pending_artefact = p.artefact;
+    return { result: { state: "review_requested", review_id: task.id } };
+  }
+  opDecide(p, kind) {
+    const miss = missing(p, ["workspace", "from", "task_id"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const badTags = tagsError(p);
+    if (badTags) return badTags;
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state !== "review_requested") {
+      return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
+    }
+    const notReviewer = this.requireReviewer(task, p.from);
+    if (notReviewer) return notReviewer;
+    const now = this.now();
+    task.review.decisions.push({
+      reviewer: p.from,
+      kind,
+      ts: now,
+      comment: p.comment,
+      tags: p.tags
+    });
+    if (kind === "approve") {
+      task.output = task.pending_artefact;
+      task.state = "completed";
+    } else {
+      task.state = p.request_revision ? "in_progress" : "declined";
+    }
+    task.updated_at = now;
+    task.history.push({ ts: now, from: p.from, state: task.state });
+    return { result: { state: task.state } };
+  }
+  opDecideOverride(p) {
+    const miss = missing(p, ["workspace", "from", "task_id", "diff", "rationale"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const badTags = tagsError(p);
+    if (badTags) return badTags;
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state !== "review_requested") {
+      return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
+    }
+    const notReviewer = this.requireReviewer(task, p.from);
+    if (notReviewer) return notReviewer;
+    const base = task.pending_artefact;
+    if (base === void 0) return { error: rpcError(E.PARAMS, "No base artefact for override") };
+    let applied;
+    try {
+      applied = applyJsonPatch(base, p.diff);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      return { error: rpcError(E.PATCH_FAILED, msg) };
+    }
+    const now = this.now();
+    const id = this.ids.artefactId();
+    const override = {
+      id,
+      task_id: task.id,
+      reviewer: p.from,
+      based_on_artefact: base,
+      diff: p.diff,
+      result: applied,
+      rationale: p.rationale,
+      tags: p.tags ?? [],
+      policy_refs: p.policy_refs ?? [],
+      ts: now,
+      logical_id: p.logical_id,
+      instance_id: p.instance_id,
+      intent_preserved: p.intent_preserved
+    };
+    ws.overrides.set(id, override);
+    task.review.decisions.push({
+      reviewer: p.from,
+      kind: "override",
+      ts: now,
+      tags: override.tags,
+      override_artefact_id: id
+    });
+    task.output = applied;
+    task.state = "completed";
+    task.updated_at = now;
+    task.history.push({ ts: now, from: p.from, state: "completed", note: "override applied" });
+    return { result: { state: "completed", override_artefact_id: id, applied } };
+  }
+  opAbstainDeclare(p) {
+    const miss = missing(p, ["workspace", "from", "task_id", "reason"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state !== "review_requested") {
+      return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
+    }
+    const notReviewer = this.requireReviewer(task, p.from);
+    if (notReviewer) return notReviewer;
+    const now = this.now();
+    task.review.decisions.push({
+      reviewer: p.from,
+      kind: "abstain",
+      ts: now,
+      comment: p.reason,
+      abstain_category: p.category || "other"
+    });
+    task.state = "abstained";
+    task.updated_at = now;
+    task.history.push({ ts: now, from: p.from, state: "abstained", note: p.reason });
+    return { result: { state: "abstained" } };
+  }
+  opEscalateRaise(p) {
+    const miss = missing(p, ["workspace", "from", "original_task_id", "new_task"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const orig = ws.tasks.get(p.original_task_id);
+    if (!orig) return { error: rpcError(E.PARAMS, "Unknown original task") };
+    if (orig.state === "completed" || orig.state === "cancelled" || orig.state === "superseded") {
+      return { error: rpcError(E.PARAMS, `Cannot escalate a terminal task: ${orig.state}`) };
+    }
+    const nt = p.new_task;
+    const assignee = nt.assignee;
+    if (!assignee || !ws.members.has(assignee)) {
+      return { error: rpcError(E.PARAMS, "Escalation assignee not in workspace") };
+    }
+    const now = this.now();
+    const newId = this.ids.taskId();
+    const newTask = {
+      id: newId,
+      kind: nt.kind || orig.kind,
+      state: "created",
+      assignee,
+      delegator: p.from,
+      input: nt.input ?? {},
+      created_at: now,
+      updated_at: now,
+      mode: orig.mode,
+      supersedes: orig.id,
+      history: [{ ts: now, from: p.from, state: "created", note: `escalated from ${orig.id}` }],
+      paused: false
+    };
+    ws.tasks.set(newId, newTask);
+    orig.state = "escalated";
+    orig.updated_at = now;
+    orig.superseded_by = newId;
+    orig.history.push({ ts: now, from: p.from, state: "escalated", note: `-> ${newId}` });
+    return { result: { new_task_id: newId, escalated_from: orig.id } };
+  }
+};
+function memberToDict(m) {
+  const out = {
+    uri: m.uri,
+    type: m.type,
+    role: m.role,
+    joined: m.joined
+  };
+  if (m.display_name) out.display_name = m.display_name;
+  if (m.capabilities) out.capabilities = m.capabilities;
+  if (m.scopes) out.scopes = m.scopes;
+  if (m.keys.length) {
+    out.jwks = { keys: m.keys.filter((k) => !k.revoked_at && !k.valid_until).map((k) => k.jwk) };
+    out.key_history = m.keys;
+  }
+  if (m.paused) out.paused = true;
+  if (m.oidc_sub) out.oidc_sub = m.oidc_sub;
+  if (m.vc_holder) out.vc_holder = m.vc_holder;
+  return out;
+}
+
+// src/policy.ts
+var CRIT2 = { low: 0, medium: 1, high: 2, critical: 3 };
+function makeDefaultPolicy(seniorTarget) {
+  const routingPolicy = (task, candidates) => {
+    const eligible = candidates;
+    return {
+      selected: eligible[0],
+      rationale: {
+        policy_id: "default",
+        hints_used: Object.keys(task.routing_hints ?? {}),
+        summary: "default policy: first eligible candidate",
+        alternatives_considered: eligible.slice(1).map((c) => ({
+          candidate: c,
+          reason_excluded: "not first eligible"
+        }))
+      }
+    };
+  };
+  const reviewDepthPolicy = (_task, hints) => {
+    const crit = hints.criticality ?? "medium";
+    let conf = 1;
+    try {
+      conf = Number(hints.confidence ?? 1);
+    } catch {
+      conf = 1;
+    }
+    if (isNaN(conf)) conf = 1;
+    const r = CRIT2[crit] ?? 1;
+    if (r >= 3) return {
+      depth: "full",
+      rationale: { policy_id: "default", summary: "criticality=critical: full review" }
+    };
+    if (r === 2 && conf < 0.7) return {
+      depth: "full",
+      rationale: { policy_id: "default", summary: "criticality=high and confidence<0.7: full review" }
+    };
+    if (r === 0 && conf >= 0.95) return {
+      depth: "skip",
+      rationale: { policy_id: "default", summary: "very low criticality + very high confidence: skip" }
+    };
+    if (r <= 1 && conf >= 0.85) return {
+      depth: "spot_check",
+      sampling_probability: 0.1,
+      rationale: { policy_id: "default", summary: "low criticality + high confidence: 10% sample" }
+    };
+    return {
+      depth: "spot_check",
+      sampling_probability: 0.25,
+      rationale: { policy_id: "default", summary: "default mid-confidence: 25% sample" }
+    };
+  };
+  const escalationPolicy = (_task, hints) => {
+    const crit = hints.criticality ?? "medium";
+    let conf = 1;
+    try {
+      conf = Number(hints.confidence ?? 1);
+    } catch {
+      conf = 1;
+    }
+    if (isNaN(conf)) conf = 1;
+    const r = CRIT2[crit] ?? 1;
+    const escalate = r >= 3 || r >= 2 && conf < 0.6;
+    return {
+      escalate,
+      to: escalate ? seniorTarget : void 0,
+      triggered_rule: {
+        rule_id: "default-auto-esc",
+        summary: "criticality=critical OR (criticality>=high AND confidence<0.6)",
+        hints_used: ["criticality", "confidence"]
+      }
+    };
+  };
+  return { routingPolicy, reviewDepthPolicy, escalationPolicy };
+}
+
+// src/transports/wrap.ts
+function wrapMcpToolCall(coord, workspace, options) {
+  if (!workspace) throw new Error("workspace is required");
+  if (!options.caller) throw new Error("caller is required");
+  if (!options.tool) throw new Error("tool is required");
+  const inputHash = contentHash(options.args);
+  const outputHash = contentHash(options.result);
+  const kind = options.taskKind ?? `mcp_call:${options.tool}`;
+  const citations = [{
+    kind: "mcp_tool_call",
+    server: options.server ?? "unknown",
+    tool: options.tool,
+    input_hash: inputHash,
+    output_hash: outputHash
+  }];
+  const createParams = {
+    workspace,
+    from: options.caller,
+    kind,
+    assignee: options.caller,
+    input: options.args
+  };
+  if (options.routingHints) createParams.routing_hints = { ...options.routingHints };
+  const createResp = coord.dispatch({
+    jsonrpc: "2.0",
+    id: `wrap-${options.tool}-create`,
+    method: "task.create",
+    params: createParams
+  });
+  if (createResp.error) throw new Error(`task.create failed: ${JSON.stringify(createResp.error)}`);
+  const taskId = createResp.result.task_id;
+  coord.dispatch({
+    jsonrpc: "2.0",
+    id: `wrap-${options.tool}-update`,
+    method: "task.update",
+    params: { workspace, from: options.caller, task_id: taskId, state: "in_progress" }
+  });
+  const completeParams = {
+    workspace,
+    from: options.caller,
+    task_id: taskId,
+    output: { result: options.result, citations }
+  };
+  if (options.confidence !== void 0) completeParams.confidence = options.confidence;
+  const completeResp = coord.dispatch({
+    jsonrpc: "2.0",
+    id: `wrap-${options.tool}-complete`,
+    method: "task.complete",
+    params: completeParams
+  });
+  if (completeResp.error) throw new Error(`task.complete failed: ${JSON.stringify(completeResp.error)}`);
+  return { task_id: taskId, input_hash: inputHash, output_hash: outputHash };
+}
+function wrapA2aMessageExchange(coord, workspace, options) {
+  if (!workspace) throw new Error("workspace is required");
+  if (!options.bridgeUri) throw new Error("bridgeUri is required");
+  if (!options.remoteAgent) throw new Error("remoteAgent is required");
+  const sentHash = contentHash(options.sent);
+  const receivedHash = contentHash(options.received);
+  const kind = options.taskKind ?? "a2a_exchange";
+  const citation = {
+    kind: "a2a_exchange",
+    remote_agent: options.remoteAgent,
+    sent_hash: sentHash,
+    received_hash: receivedHash
+  };
+  const createParams = {
+    workspace,
+    from: options.bridgeUri,
+    kind,
+    assignee: options.bridgeUri,
+    input: { remote_agent: options.remoteAgent, sent: options.sent }
+  };
+  if (options.routingHints) createParams.routing_hints = { ...options.routingHints };
+  const createResp = coord.dispatch({
+    jsonrpc: "2.0",
+    id: "wrap-a2a-create",
+    method: "task.create",
+    params: createParams
+  });
+  if (createResp.error) throw new Error(`task.create failed: ${JSON.stringify(createResp.error)}`);
+  const taskId = createResp.result.task_id;
+  coord.dispatch({
+    jsonrpc: "2.0",
+    id: "wrap-a2a-update",
+    method: "task.update",
+    params: {
+      workspace,
+      from: options.bridgeUri,
+      task_id: taskId,
+      state: "in_progress"
+    }
+  });
+  const completeParams = {
+    workspace,
+    from: options.bridgeUri,
+    task_id: taskId,
+    output: { received: options.received, citations: [citation] }
+  };
+  if (options.confidence !== void 0) completeParams.confidence = options.confidence;
+  const completeResp = coord.dispatch({
+    jsonrpc: "2.0",
+    id: "wrap-a2a-complete",
+    method: "task.complete",
+    params: completeParams
+  });
+  if (completeResp.error) throw new Error(`task.complete failed: ${JSON.stringify(completeResp.error)}`);
+  return { task_id: taskId, sent_hash: sentHash, received_hash: receivedHash };
+}
+export {
+  Coordinator,
+  CoordinatorError,
+  E,
+  IdFactory,
+  MemoryStore,
+  PRIVILEGED_METHODS,
+  PatchError,
+  ZERO_HASH,
+  applyJsonPatch,
+  call,
+  canonicalize,
+  contentHash,
+  deriveKeypair,
+  deriveSeed,
+  diffJsonPatch,
+  isValidEnvelope,
+  jwkFromPrivateKey,
+  makeApi,
+  makeDefaultPolicy,
+  modeLE,
+  publicKeyBytes,
+  publicKeyFromJwk,
+  publicKeyFromRaw,
+  rpcError,
+  sha256Hex,
+  signEnvelope,
+  verifyEnvelope,
+  wrapA2aMessageExchange,
+  wrapMcpToolCall
+};
+//# sourceMappingURL=index.js.map