@brightbeamai/chap-coordinator 0.3.4 → 0.3.5

package/dist/index.js

@@ -2,7 +2,7 @@
 import { createHash } from "crypto";
 var ZERO_HASH = "sha256:" + "0".repeat(64);
 var NON_INTEGER_ERROR = 'CHAP canonical numbers must be integers; represent decimals as strings (e.g. "8.2") so the hash is deterministic across implementations.';
-var NUMBER_RANGE_ERROR = "CHAP canonical integers must be within the safe-integer range (abs value <= Number.MAX_SAFE_INTEGER); represent larger numbers as strings.";
+var NUMBER_RANGE_ERROR = "CHAP canonical integers must be within the safe-integer range (abs value <= 2^53 - 1); represent larger numbers as strings.";
 var LONE_SURROGATE_ERROR = "CHAP canonical strings must be valid Unicode (I-JSON / RFC 7493); unpaired UTF-16 surrogates are not permitted.";
 function assertNoLoneSurrogate(s) {
   for (let i = 0; i < s.length; i++) {
@@ -23,7 +23,7 @@ function canonicalString(s) {
 function canonicalNumber(n) {
   if (!Number.isFinite(n)) {
     throw new Error(
-      "Non-finite numbers are not permitted in a CHAP canonical value"
+      "Non-finite numbers are not permitted in a CHAP canonical value."
     );
   }
   if (!Number.isInteger(n)) {
@@ -96,6 +96,7 @@ var OWNING_PROFILE = Object.freeze({
   "participant.leave": "core/1.0",
   "participant.revoke_key": "core/1.0",
   "participant.rotate_key": "core/1.0",
+  "review.acknowledge": "review/1.0",
   "review.depth": "routing/1.0",
   "review.request": "review/1.0",
   "task.complete": "core/1.0",
@@ -106,6 +107,7 @@ var OWNING_PROFILE = Object.freeze({
   "whisper.ask": "whisper/1.0",
   "workspace.create": "core/1.0",
   "workspace.describe": "core/1.0",
+  "workspace.invite": "core/1.0",
   "workspace.set_profiles": "core/1.0"
 });
 var ALWAYS_AVAILABLE = /* @__PURE__ */ new Set([
@@ -114,6 +116,20 @@ var ALWAYS_AVAILABLE = /* @__PURE__ */ new Set([
   "audit.verify_chain",
   "audit.verify_receipt"
 ]);
+var PROFILE_VERSIONS = Object.freeze({
+  "audit-scitt": "1.0",
+  "control": "1.0",
+  "core": "1.0",
+  "deliberation": "1.0",
+  "handoff": "1.0",
+  "identity-oidc": "1.0",
+  "identity-vc": "1.0",
+  "modes": "1.0",
+  "review": "1.0",
+  "routing": "1.0",
+  "security-signed": "1.0",
+  "whisper": "1.0"
+});
 
 // src/crypto.ts
 import {
@@ -171,21 +187,132 @@ function signEnvelope(canonical, privateKey, kid) {
   const sig = nodeSign(null, canonical, privateKey);
   return `ed25519:${kid}:${sig.toString("base64")}`;
 }
+function strictBase64(s) {
+  const bytes = Buffer.from(s, "base64");
+  return bytes.toString("base64") === s ? bytes : void 0;
+}
 function verifyEnvelope(canonical, sigTag, publicKey) {
   if (!sigTag.startsWith("ed25519:")) return false;
   const parts = sigTag.split(":");
   if (parts.length < 2) return false;
-  const sigB64 = parts[parts.length - 1];
+  const sig = strictBase64(parts[parts.length - 1]);
+  if (sig === void 0) return false;
   try {
-    const sig = Buffer.from(sigB64, "base64");
     return nodeVerify(null, canonical, publicKey, sig);
   } catch {
     return false;
   }
 }
+function isEd25519Key(jwk) {
+  if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) return false;
+  const key = jwk;
+  return key.kty === "OKP" && key.crv === "Ed25519" && typeof key.x === "string" && COORDINATE.test(key.x);
+}
 function publicKeyFromJwk(jwk) {
   return publicKeyFromRaw(b64urlDecode(jwk.x));
 }
+function jwkThumbprint(jwk) {
+  if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) return void 0;
+  const key = jwk;
+  const names = key.kty === "OKP" ? ["crv", "kty", "x"] : key.kty === "EC" ? ["crv", "kty", "x", "y"] : void 0;
+  if (!names || names.some((n) => typeof key[n] !== "string")) return void 0;
+  const members = Object.fromEntries(names.map((n) => [n, key[n]]));
+  return b64urlNoPad(createHash2("sha256").update(canonicalize(members)).digest());
+}
+var B64URL = /^[A-Za-z0-9_-]+$/;
+function parseWebAuthnAssertion(part) {
+  const pieces = part.split(".");
+  if (pieces.length !== 3 || pieces.some((p) => !B64URL.test(p) || p.length % 4 === 1)) return void 0;
+  const [authenticatorData, clientDataJSON, signature] = pieces.map((p) => Buffer.from(p, "base64url"));
+  return { authenticatorData, clientDataJSON, signature };
+}
+var COORDINATE = /^[A-Za-z0-9_-]{43}$/;
+function isWebAuthnKey(jwk) {
+  if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) return false;
+  const key = jwk;
+  const w = key.webauthn;
+  return key.kty === "EC" && key.crv === "P-256" && typeof key.x === "string" && COORDINATE.test(key.x) && typeof key.y === "string" && COORDINATE.test(key.y) && (key.alg === void 0 || key.alg === "ES256") && w !== null && typeof w === "object" && !Array.isArray(w) && typeof w.rp_id === "string" && w.rp_id !== "" && (w.origins === void 0 || Array.isArray(w.origins) && w.origins.every((o) => typeof o === "string"));
+}
+var UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+var MAX_CLIENT_DATA_NESTING = 64;
+function jsonDepth(text) {
+  let depth = 0;
+  let deepest = 0;
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (ch === "\\") i++;
+      else if (ch === '"') inString = false;
+    } else if (ch === '"') {
+      inString = true;
+    } else if (ch === "{" || ch === "[") {
+      deepest = Math.max(deepest, ++depth);
+    } else if (ch === "}" || ch === "]") {
+      depth--;
+    }
+  }
+  return deepest;
+}
+var UP = 1;
+var UV = 4;
+var BE = 8;
+var BS = 16;
+var AT = 64;
+var ED = 128;
+function webAuthnFailure(canonical, assertion, jwk) {
+  const w = jwk.webauthn;
+  if (!Array.isArray(w.origins) || w.origins.length === 0) return "WebAuthn key lists no origin";
+  let text;
+  try {
+    text = UTF8.decode(assertion.clientDataJSON);
+  } catch {
+    text = void 0;
+  }
+  if (text !== void 0 && jsonDepth(text) > MAX_CLIENT_DATA_NESTING) {
+    return `WebAuthn clientDataJSON nests deeper than ${MAX_CLIENT_DATA_NESTING} levels`;
+  }
+  let client;
+  try {
+    client = text === void 0 ? void 0 : JSON.parse(text);
+  } catch {
+    client = void 0;
+  }
+  if (client === null || typeof client !== "object" || Array.isArray(client)) {
+    return "WebAuthn clientDataJSON is not a JSON object";
+  }
+  const data = client;
+  if (data.type !== "webauthn.get") return "WebAuthn clientDataJSON type is not webauthn.get";
+  if (data.challenge !== b64urlNoPad(createHash2("sha256").update(canonical).digest())) {
+    return "WebAuthn challenge is not the digest of this request";
+  }
+  if (!w.origins.includes(data.origin)) return "WebAuthn origin is not one the key allows";
+  if (data.crossOrigin === true || data.topOrigin !== void 0) {
+    return "WebAuthn assertion was made in a cross-origin frame";
+  }
+  const auth = assertion.authenticatorData;
+  if (auth.length < 37) return "WebAuthn authenticatorData is too short";
+  if (!auth.subarray(0, 32).equals(createHash2("sha256").update(w.rp_id, "utf-8").digest())) {
+    return "WebAuthn rpIdHash does not match the key's rp_id";
+  }
+  const flags = auth[32];
+  if ((flags & (UP | UV)) !== (UP | UV)) return "WebAuthn assertion lacks user presence or verification";
+  if (flags & BS && !(flags & BE)) return "WebAuthn assertion is backed up but not backup eligible";
+  if (flags & AT) return "WebAuthn assertion carries attested credential data";
+  if (flags & ED ? auth.length === 37 : auth.length !== 37) {
+    return "WebAuthn authenticatorData does not end where its flags say";
+  }
+  try {
+    const key = createPublicKey({
+      key: { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y },
+      format: "jwk"
+    });
+    const signed = Buffer.concat([auth, createHash2("sha256").update(assertion.clientDataJSON).digest()]);
+    return nodeVerify("sha256", signed, { key, dsaEncoding: "der" }, assertion.signature) ? null : "Signature failed verification";
+  } catch {
+    return "Signature failed verification";
+  }
+}
 function deriveKeypair(uri) {
   const seed = deriveSeed(uri);
   const privateKey = privateKeyFromSeed(seed);
@@ -302,6 +429,7 @@ var E = {
   SIG_KEY_REVOKED: -32072,
   SIG_ROTATION_KEY_MISMATCH: -32073,
   SIG_ARTEFACT_DIGEST_MISMATCH: -32074,
+  SIG_ALREADY_ACCEPTED: -32075,
   // audit-scitt/1.0 profile (profiles/audit-scitt.md S8)
   SCITT_UNREACHABLE: -32080,
   SCITT_STATEMENT_REJECTED: -32081,
@@ -334,6 +462,44 @@ function isValidEnvelope(env) {
   return e.jsonrpc === "2.0";
 }
 
+// src/params.ts
+var NAMES = {
+  string: "a string",
+  strings: "a list of strings",
+  boolean: "a boolean",
+  object: "an object",
+  list: "a list",
+  integer: "an integer"
+};
+function isKind(value, kind) {
+  switch (kind) {
+    case "string":
+      return typeof value === "string";
+    case "strings":
+      return Array.isArray(value) && value.every((v) => typeof v === "string");
+    case "boolean":
+      return typeof value === "boolean";
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    case "list":
+      return Array.isArray(value);
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+  }
+}
+function paramsError(params, checks) {
+  for (const [name, kind] of checks) {
+    let value = params;
+    for (const part of name.split(".")) {
+      value = typeof value === "object" && value !== null && !Array.isArray(value) ? value[part] : void 0;
+    }
+    if (value !== void 0 && value !== null && !isKind(value, kind)) {
+      return { error: rpcError(E.PARAMS, `${name} must be ${NAMES[kind]}`) };
+    }
+  }
+  return null;
+}
+
 // src/audit.ts
 function entryRecord(entry) {
   if (entry.outcome != null) return { outcome: entry.outcome, request: entry.request };
@@ -377,7 +543,8 @@ var UNRECORDED_CODES = /* @__PURE__ */ new Set([
   E.SIG_VERIFY_FAILED,
   E.SIG_KEY_NOT_FOUND,
   E.SIG_KEY_REVOKED,
-  E.SIG_ROTATION_KEY_MISMATCH
+  E.SIG_ROTATION_KEY_MISMATCH,
+  E.SIG_ALREADY_ACCEPTED
 ]);
 var UNRECORDED_METHODS = /* @__PURE__ */ new Set(["workspace.create", "participant.join"]);
 function refusalIsRecorded(method, error, privileged) {
@@ -794,7 +961,8 @@ var COLLECTIONS = [
   "deliberations",
   "handoffs",
   "snapshots",
-  "route_decisions"
+  "route_decisions",
+  "invitations"
 ];
 var IDEMPOTENCY_KEYS = "idempotency_keys";
 var StoreConflictError = class extends Error {
@@ -805,7 +973,7 @@ var StoreConflictError = class extends Error {
   base;
   constructor(workspace, held, base) {
     super(
-      `The store holds ${held} audit entries for workspace ${workspace} and this write expected ${base}, so nothing was written. Another coordinator may be writing to this workspace, the store may have been changed outside this coordinator, or this coordinator could not load the workspace when it started. Restart this coordinator to reload.`
+      `The store holds ${held} audit entries for workspace ${workspace} and this write expected ${base}, so nothing was written. Another coordinator may be writing to this workspace, or the store may have been changed outside this coordinator. A coordinator reloads the workspace and answers the call as failed, and the call may be sent again.`
     );
     this.name = "StoreConflictError";
     this.workspace = workspace;
@@ -882,20 +1050,24 @@ function assembleSnapshot(meta, entries, objects) {
 var MemoryStore = class {
   held = /* @__PURE__ */ new Map();
   load() {
-    const out = [];
-    for (const [id, h] of this.held) {
-      const objects = [];
-      for (const [collection, items] of h.objects) {
-        for (const [key, value] of items) objects.push([collection, key, JSON.parse(value)]);
-      }
-      out.push({
-        id,
-        data: assembleSnapshot(JSON.parse(h.meta), h.entries.map((e) => JSON.parse(e)), objects),
-        version: h.version,
-        updated_at: h.updated_at
-      });
+    return [...this.held.keys()].map((id) => this.loadOne(id));
+  }
+  loadOne(id) {
+    const h = this.held.get(id);
+    if (!h) return void 0;
+    const objects = [];
+    for (const [collection, items] of h.objects) {
+      for (const [key, value] of items) objects.push([collection, key, JSON.parse(value)]);
     }
-    return out;
+    return {
+      id,
+      data: assembleSnapshot(JSON.parse(h.meta), h.entries.map((e) => JSON.parse(e)), objects),
+      version: h.version,
+      updated_at: h.updated_at
+    };
+  }
+  version(id) {
+    return this.held.get(id)?.entries.length;
   }
   save(record) {
     this.apply(changeFromRecord(record));
@@ -1022,7 +1194,8 @@ function makeApi(coord) {
     workspace: {
       create: (p) => c("workspace.create", p),
       describe: (p) => c("workspace.describe", p),
-      set_profiles: (p) => c("workspace.set_profiles", p)
+      set_profiles: (p) => c("workspace.set_profiles", p),
+      invite: (p) => c("workspace.invite", p)
     },
     participant: {
       join: (p) => c("participant.join", p),
@@ -1038,6 +1211,7 @@ function makeApi(coord) {
     },
     review: {
       request: (p) => c("review.request", p),
+      acknowledge: (p) => c("review.acknowledge", p),
       depth: (p) => c("review.depth", p)
     },
     decide: {
@@ -1111,10 +1285,17 @@ function registerAuditScitt(coord) {
   coord.handlers.set("audit.submit_to_scitt", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [
+      ["range", "object"],
+      ["range.from_seq", "integer"],
+      ["range.to_seq", "integer"],
+      ["issuer", "string"]
+    ]);
+    if (bad) return bad;
     const range = p.range ?? {};
     const fromSeq = range.from_seq ?? 0;
     const toSeq = range.to_seq ?? ws.audit.length;
-    const issuer = p.issuer ?? "service:coordinator";
+    const issuer = p.issuer || "service:coordinator";
     if (!coord.options.scittSubmitter) {
       const statements = ws.audit.slice(fromSeq, toSeq).map((e) => buildStatement(ws.id, entryRecord(e), issuer));
       return { result: {
@@ -1144,7 +1325,7 @@ function registerAuditScitt(coord) {
   });
   coord.handlers.set("audit.verify_receipt", (p) => {
     const receipt = p.receipt;
-    if (typeof receipt !== "object" || receipt === null) {
+    if (typeof receipt !== "object" || receipt === null || Array.isArray(receipt)) {
       return { error: rpcError(E.PARAMS, "receipt must be an object") };
     }
     if (coord.options.verifyScittReceipt) {
@@ -1158,7 +1339,7 @@ function registerAuditScitt(coord) {
       if (!ok) return { error: rpcError(E.SCITT_RECEIPT_INVALID, "Receipt did not verify") };
       return { result: { verified: true } };
     }
-    return { error: rpcError(E.SCITT_RECEIPT_INVALID, "No verifyScittReceipt hook configured; receipt not verified") };
+    return { error: rpcError(E.SCITT_RECEIPT_INVALID, "No receipt verifier is configured; receipt not verified") };
   });
   coord.handlers.set("audit.verify_chain", (p) => {
     const ws = coord.workspaces.get(p.workspace);
@@ -1166,7 +1347,7 @@ function registerAuditScitt(coord) {
     if (!(ws.chain_enabled || coord.options.enableChain)) {
       return { error: rpcError(E.PARAMS, "Chain not enabled for this workspace") };
     }
-    if (p.from_seq !== void 0 || p.to_seq !== void 0) {
+    if (p.from_seq != null || p.to_seq != null) {
       return { error: rpcError(
         E.PARAMS,
         "Range verification is not implemented; omit from_seq and to_seq to verify the whole log."
@@ -1228,13 +1409,21 @@ function registerAuditScitt(coord) {
 // src/profiles/control.ts
 var VALID_MODES = /* @__PURE__ */ new Set(["shadow", "trial", "production"]);
 var VALID_SCOPES = /* @__PURE__ */ new Set(["task", "participant", "workspace"]);
+var SCOPE_ERROR = "scope must be task, participant or workspace";
 function registerControl(coord) {
   coord.handlers.set("control.pause", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [
+      ["scope", "string"],
+      ["participant_uri", "string"],
+      ["uri", "string"],
+      ["in_flight_policy", "string"]
+    ]);
+    if (bad) return bad;
     const scope = p.scope || "task";
     if (!VALID_SCOPES.has(scope)) {
-      return { error: rpcError(E.PARAMS, `scope must be task/participant/workspace`) };
+      return { error: rpcError(E.PARAMS, SCOPE_ERROR) };
     }
     if (scope === "task") {
       const task = ws.tasks.get(p.task_id);
@@ -1252,7 +1441,8 @@ function registerControl(coord) {
     }
     if (scope === "participant") {
       const uri = p.participant_uri || p.uri;
-      if (!uri || !ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
+      if (!uri) return { error: rpcError(E.PARAMS, "participant_uri is required") };
+      if (!ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
       ws.members.get(uri).paused = true;
       return { result: {
         scope: "participant",
@@ -1267,9 +1457,11 @@ function registerControl(coord) {
   coord.handlers.set("control.resume", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [["scope", "string"], ["participant_uri", "string"], ["uri", "string"]]);
+    if (bad) return bad;
     const scope = p.scope || "task";
     if (!VALID_SCOPES.has(scope)) {
-      return { error: rpcError(E.PARAMS, `scope must be task/participant/workspace`) };
+      return { error: rpcError(E.PARAMS, SCOPE_ERROR) };
     }
     if (scope === "task") {
       const task = ws.tasks.get(p.task_id);
@@ -1287,7 +1479,9 @@ function registerControl(coord) {
     }
     if (scope === "participant") {
       const uri = p.participant_uri || p.uri;
-      if (!uri || !ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
+      if (!uri) return { error: rpcError(E.PARAMS, "participant_uri is required") };
+      if (!ws.members.has(uri)) return { error: rpcError(E.PARAMS, `Unknown participant: ${uri}`) };
+      if (uri === p.from) return { error: rpcError(E.NOT_AUTHORISED, "A paused participant does not lift its own pause") };
       ws.members.get(uri).paused = false;
       return { result: { scope: "participant", participant_uri: uri, paused: false } };
     }
@@ -1302,6 +1496,12 @@ function registerControl(coord) {
     if (task.state === "completed" || task.state === "declined" || task.state === "cancelled" || task.state === "superseded") {
       return { error: rpcError(E.CONTROL_NOT_AUTHORISED, `Cannot cancel ${task.state} task`) };
     }
+    if (openRequiredReviewAuthors(ws, task).includes(p.from)) {
+      return { error: rpcError(
+        E.NOT_AUTHORISED,
+        "The authors of the work under review cannot end its review without a decision"
+      ) };
+    }
     task.state = "cancelled";
     task.updated_at = coord.now();
     task.history.push({ ts: task.updated_at, from: p.from, state: "cancelled", note: p.reason });
@@ -1310,6 +1510,8 @@ function registerControl(coord) {
   coord.handlers.set("control.snapshot", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [["include", "strings"], ["label", "string"]]);
+    if (bad) return bad;
     if (Array.isArray(p.include) && p.include.length === 0) {
       return { error: rpcError(E.PARAMS, "include must not be empty") };
     }
@@ -1364,6 +1566,14 @@ function registerControl(coord) {
   coord.handlers.set("control.rollback", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [
+      ["to_snapshot_artefact_id", "string"],
+      ["snapshot_artefact_id", "string"],
+      ["snapshot_id", "string"],
+      ["what_to_restore", "strings"],
+      ["reason", "string"]
+    ]);
+    if (bad) return bad;
     const snapId = p.to_snapshot_artefact_id || p.snapshot_artefact_id || p.snapshot_id;
     if (!snapId) return { error: rpcError(E.PARAMS, "to_snapshot_artefact_id is required") };
     const snap = ws.snapshots.get(snapId);
@@ -1385,7 +1595,8 @@ function registerControl(coord) {
       for (const [uri, snapM] of snapByUri) {
         if (ws.members.has(uri)) {
           const cur = ws.members.get(uri);
-          cur.role = snapM.role ?? cur.role;
+          const role = snapM.role ?? cur.role;
+          if (role !== "admin" && cur.role !== "admin") cur.role = role;
           cur.scopes = Array.isArray(snapM.scopes) ? [...snapM.scopes] : void 0;
         }
       }
@@ -1404,10 +1615,18 @@ function registerControl(coord) {
     const oldId = p.task_id;
     const old = ws.tasks.get(oldId);
     if (!old) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (openRequiredReviewAuthors(ws, old).includes(p.from)) {
+      return { error: rpcError(
+        E.NOT_AUTHORISED,
+        "The authors of the work under review cannot end its review without a decision"
+      ) };
+    }
     const newSpec = p.successor_task ?? {};
-    if (!newSpec.kind) {
+    if (typeof newSpec.kind !== "string" || !newSpec.kind) {
       return { error: rpcError(E.PARAMS, "successor_task must include kind") };
     }
+    const bad = paramsError(p, [["successor_task.assignee", "string"], ["reason", "string"]]);
+    if (bad) return bad;
     const assignee = newSpec.assignee || old.assignee;
     if (typeof assignee !== "string" || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "successor assignee not in workspace") };
@@ -1454,6 +1673,7 @@ function registerControl(coord) {
     } else if ("review_required" in newSpec) {
       newTask.review_required = !!newSpec.review_required;
     }
+    newTask.prior_authors = successorAuthors(old, p.from);
     ws.tasks.set(newId, newTask);
     old.state = "superseded";
     old.superseded_by = newId;
@@ -1464,27 +1684,37 @@ function registerControl(coord) {
       state: "superseded",
       note: `-> ${newId}: ${p.reason || ""}`
     });
-    return { result: { superseded_task_id: old.id, new_task_id: newId, reason: p.reason } };
+    return { result: {
+      superseded_task_id: old.id,
+      new_task_id: newId,
+      ...p.reason != null ? { reason: p.reason } : {}
+    } };
   });
   coord.handlers.set("control.set_mode_ceiling", (p) => {
     const ws = coord.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const bad = paramsError(p, [["reason", "string"]]);
+    if (bad) return bad;
     const m = p.new_ceiling ?? p.mode_ceiling;
     if (!VALID_MODES.has(m)) {
-      return { error: rpcError(E.PARAMS, `new_ceiling must be shadow/trial/production`) };
+      return { error: rpcError(E.PARAMS, "new_ceiling must be shadow, trial or production") };
     }
     ws.mode_ceiling = m;
-    return { result: { mode_ceiling: ws.mode_ceiling, reason: p.reason } };
+    return { result: { mode_ceiling: ws.mode_ceiling, ...p.reason != null ? { reason: p.reason } : {} } };
   });
 }
 
 // src/profiles/deliberation.ts
 var RESERVED_IDS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var QUORUM_ARG = /^[0-9]+$/;
+var THRESHOLD_ARG = /^[0-9]+(\.[0-9]+)?$/;
 function parseRule(rule) {
-  if (rule.includes(":")) {
-    const [kind, arg] = rule.split(":", 2);
-    if (kind === "quorum") return { kind, params: { n: parseInt(arg, 10) } };
-    if (kind === "weighted_vote" || kind === "weighted_vote_with_veto") {
+  const colon = rule.indexOf(":");
+  if (colon >= 0) {
+    const kind = rule.slice(0, colon);
+    const arg = rule.slice(colon + 1);
+    if (kind === "quorum" && QUORUM_ARG.test(arg)) return { kind, params: { n: parseInt(arg, 10) } };
+    if ((kind === "weighted_vote" || kind === "weighted_vote_with_veto") && THRESHOLD_ARG.test(arg)) {
       return { kind, params: { threshold: parseFloat(arg) } };
     }
   }
@@ -1569,6 +1799,23 @@ function registerDeliberation(coord) {
     for (const f of ["from", "rule"]) {
       if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
     }
+    for (const name of ["to", "participants"]) {
+      const v = p[name];
+      if (v != null && typeof v !== "string" && !(Array.isArray(v) && v.every((x) => typeof x === "string"))) {
+        return { error: rpcError(E.PARAMS, `${name} must be a string or a list of strings`) };
+      }
+    }
+    if (typeof p.rule !== "string") return { error: rpcError(E.PARAMS, "rule must be a string") };
+    const bad = paramsError(p, [["weights", "object"], ["veto", "object"]]);
+    if (bad) return bad;
+    const weights = p.weights ?? {};
+    if (!Object.values(weights).every((w) => typeof w === "number" && Number.isInteger(w))) {
+      return { error: rpcError(E.PARAMS, "weights must map participants to integers") };
+    }
+    const veto = p.veto ?? {};
+    if (!Object.values(veto).every((v) => typeof v === "boolean")) {
+      return { error: rpcError(E.PARAMS, "veto must map participants to booleans") };
+    }
     const to = p.to ?? p.participants;
     const participants = Array.isArray(to) ? to : typeof to === "string" ? [to] : [];
     if (!participants.length) {
@@ -1619,6 +1866,8 @@ function registerDeliberation(coord) {
     if (delib.state !== "open") {
       return { error: rpcError(E.DELIB_CLOSED_OR_LAPSED, "Deliberation not open") };
     }
+    const bad = paramsError(p, [["comment", "string"], ["text", "string"]]);
+    if (bad) return bad;
     delib.comments.push({
       ts: coord.now(),
       from: p.from,
@@ -1641,6 +1890,8 @@ function registerDeliberation(coord) {
     if (v !== "yea" && v !== "nay" && v !== "abstain") {
       return { error: rpcError(E.PARAMS, "vote must be yea/nay/abstain") };
     }
+    const bad = paramsError(p, [["veto_invoked", "boolean"]]);
+    if (bad) return bad;
     const voter = p.from;
     if (!delib.participants.includes(voter)) {
       return { error: rpcError(
@@ -1682,6 +1933,9 @@ function registerHandoff(coord) {
     for (const f of ["from", "to", "tasks"]) {
       if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
     }
+    if (typeof p.to !== "string") return { error: rpcError(E.PARAMS, "to must be a string") };
+    const bad = paramsError(p, [["context_links", "strings"]]);
+    if (bad) return bad;
     const proposer = p.from;
     const recipient = p.to;
     if (typeof recipient === "string" && !recipient.startsWith("group:")) {
@@ -1698,6 +1952,11 @@ function registerHandoff(coord) {
     }
     const proposed = [];
     for (const t of tasksIn) {
+      if (t === null || typeof t !== "object" || Array.isArray(t) || typeof t.task_id !== "string") {
+        return { error: rpcError(E.PARAMS, "each entry in tasks must be an object with a string task_id") };
+      }
+      const badItem = paramsError(t, [["blockers", "strings"]]);
+      if (badItem) return badItem;
       const tid = t.task_id;
       if (!tid || !ws.tasks.has(tid)) {
         return { error: rpcError(E.PARAMS, `Unknown task in handoff: ${tid}`) };
@@ -1779,6 +2038,8 @@ function registerHandoff(coord) {
     if (ws.members.get(acceptor).paused) {
       return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Acceptor ${acceptor} is paused`) };
     }
+    const bad = paramsError(p, [["accepted_task_ids", "strings"]]);
+    if (bad) return bad;
     if (Array.isArray(p.accepted_task_ids) && p.accepted_task_ids.length === 0) {
       return { error: rpcError(E.PARAMS, "accepted_task_ids must not be empty") };
     }
@@ -1789,9 +2050,18 @@ function registerHandoff(coord) {
         return { error: rpcError(E.PARAMS, `Task ${tid} not in this handoff`) };
       }
     }
+    for (const tid of acceptedIds) {
+      if (ws.tasks.get(tid)?.assignee !== ho.proposer) {
+        return { error: rpcError(
+          E.HANDOFF_TASKS_NOT_ASSIGNED_TO_PROPOSER,
+          `Task ${tid} is not currently assigned to ${ho.proposer}`
+        ) };
+      }
+    }
     const now = coord.now();
     for (const tid of acceptedIds) {
       const task = ws.tasks.get(tid);
+      if (acceptor !== task.assignee) task.prior_authors = unionOf(task.prior_authors ?? [], heldBy(task, ho.proposer));
       task.assignee = acceptor;
       task.updated_at = now;
       task.history.push({
@@ -1832,16 +2102,20 @@ function registerHandoff(coord) {
 
 // src/profiles/routing.ts
 var CRIT = { low: 0, medium: 1, high: 2, critical: 3 };
-function defaultDepth(hints) {
+var DECIMAL = /^-?[0-9]+(\.[0-9]+)?$/;
+function confidenceOf(hints) {
+  const v = hints.confidence;
+  if (typeof v === "number" && Number.isInteger(v)) return v;
+  if (typeof v === "string" && DECIMAL.test(v)) return Number(v);
+  return 1;
+}
+function criticalityOf(hints) {
   const crit = hints.criticality ?? "medium";
-  let conf = 1;
-  try {
-    conf = Number(hints.confidence ?? 1);
-  } catch {
-    conf = 1;
-  }
-  if (isNaN(conf)) conf = 1;
-  const r = CRIT[crit] ?? 1;
+  return typeof crit === "string" && Object.prototype.hasOwnProperty.call(CRIT, crit) ? CRIT[crit] : 1;
+}
+function defaultDepth(hints) {
+  const conf = confidenceOf(hints);
+  const r = criticalityOf(hints);
   if (r >= 3) return { depth: "full", summary: "criticality=critical: full review" };
   if (r === 2 && conf < 0.7) return { depth: "full", summary: "criticality=high and confidence<0.7: full review" };
   if (r === 0 && conf >= 0.95) return { depth: "skip", summary: "very low criticality + very high confidence: skip" };
@@ -1907,6 +2181,8 @@ function registerRouting(coord) {
     if (ws.members.get(selected).paused) {
       return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${selected} is paused`) };
     }
+    const leaving = heldBy(task, p.from);
+    if (selected !== task.assignee && leaving.length) task.prior_authors = unionOf(task.prior_authors ?? [], leaving);
     task.assignee = selected;
     task.updated_at = coord.now();
     task.history.push({
@@ -1937,6 +2213,8 @@ function registerRouting(coord) {
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const bad = paramsError(p, [["artefact_routing_hints", "object"]]);
+    if (bad) return bad;
     const hints = {
       ...task.routing_hints ?? {},
       ...p.artefact_routing_hints ?? {}
@@ -1994,6 +2272,8 @@ function registerRouting(coord) {
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    const bad = paramsError(p, [["default_escalation_target", "string"]]);
+    if (bad) return bad;
     const hints = { ...task.routing_hints ?? {} };
     let escalate, to, rule;
     if (coord.options.escalationPolicy) {
@@ -2007,15 +2287,8 @@ function registerRouting(coord) {
         return { error: rpcError(E.ROUTING_POLICY_UNREACHABLE, `escalation policy error: ${msg}`) };
       }
     } else {
-      const crit = hints.criticality ?? "medium";
-      let conf = 1;
-      try {
-        conf = Number(hints.confidence ?? 1);
-      } catch {
-        conf = 1;
-      }
-      if (isNaN(conf)) conf = 1;
-      const r = CRIT[crit] ?? 1;
+      const conf = confidenceOf(hints);
+      const r = criticalityOf(hints);
       escalate = r >= 3 || r >= 2 && conf < 0.6;
       to = p.default_escalation_target;
       rule = {
@@ -2072,6 +2345,9 @@ function registerSecuritySigned(coord) {
     for (const f of ["from", "old_kid", "new_jwk"]) {
       if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
     }
+    for (const f of ["from", "old_kid"]) {
+      if (typeof p[f] !== "string") return { error: rpcError(E.PARAMS, `${f} must be a string`) };
+    }
     const member = ws.members.get(p.from);
     if (!member) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `Unknown participant: ${p.from}`) };
     const oldKid = p.old_kid;
@@ -2082,6 +2358,9 @@ function registerSecuritySigned(coord) {
     if (!newJwk || typeof newJwk.kid !== "string") {
       return { error: rpcError(E.PARAMS, "new_jwk must include kid") };
     }
+    if (member.keys.some((k) => k.kid === newJwk.kid)) {
+      return { error: rpcError(E.PARAMS, `${p.from} already holds a key ${newJwk.kid}; a new key takes a kid of its own`) };
+    }
     const now = coord.now();
     oldKey.valid_until = now;
     member.keys.push({
@@ -2097,6 +2376,11 @@ function registerSecuritySigned(coord) {
     for (const f of ["target_uri", "kid"]) {
       if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
     }
+    for (const f of ["target_uri", "kid"]) {
+      if (typeof p[f] !== "string") return { error: rpcError(E.PARAMS, `${f} must be a string`) };
+    }
+    const bad = paramsError(p, [["from", "string"], ["reason", "string"]]);
+    if (bad) return bad;
     const sender = p.from;
     if (sender !== p.target_uri) {
       const caller = sender ? ws.members.get(sender) : void 0;
@@ -2139,8 +2423,10 @@ function registerWhisper(coord) {
     if (!ws.tasks.has(p.task_id)) {
       return { error: rpcError(E.PARAMS, "Unknown task") };
     }
-    if (p.options !== void 0 && p.options !== null && !Array.isArray(p.options)) {
-      return { error: rpcError(E.PARAMS, "options must be a list") };
+    const bad = paramsError(p, [["options", "list"], ["urgency", "string"]]);
+    if (bad) return bad;
+    if (typeof p.deadline_ms !== "number" || !Number.isInteger(p.deadline_ms)) {
+      return { error: rpcError(E.PARAMS, "deadline_ms must be an integer") };
     }
     const to = p.to;
     const askee = Array.isArray(to) ? to : [to];
@@ -2203,7 +2489,7 @@ function registerWhisper(coord) {
       if (!hasOption) {
         return { error: rpcError(E.PARAMS, "answer_option is required when options are defined") };
       }
-      const valid = new Set(prompt.options.map((o) => o.id));
+      const valid = new Set(prompt.options.filter((o) => o !== null && typeof o === "object" && !Array.isArray(o)).map((o) => o.id));
       if (!valid.has(answerOption)) {
         return { error: rpcError(
           E.WHISPER_OPTION_NOT_IN_SET,
@@ -2221,12 +2507,13 @@ function registerWhisper(coord) {
     prompt.comment = p.comment;
     return { result: { answered: true, whisper_id: prompt.id, task_id: prompt.task_id } };
   });
-  coord.checkWhisperLapses = (workspaceId, now) => {
+  coord.checkWhisperLapses = (workspaceId, now) => coord.outsideCall(workspaceId, () => lapse(workspaceId, now));
+  function lapse(workspaceId, now) {
     const ws = coord.workspaces.get(workspaceId);
     if (!ws) return [];
     const cutoff = parseIso(now ?? coord.now());
     const emitted = [];
-    for (const prompt of ws.whispers.values()) {
+    for (const prompt of rawValues(ws.whispers)) {
       if (prompt.state !== "pending") continue;
       const asked = parseIso(prompt.asked_at);
       const deadline = asked + prompt.deadline_ms;
@@ -2256,7 +2543,7 @@ function registerWhisper(coord) {
       emitted.push(notify);
     }
     return emitted;
-  };
+  }
 }
 
 // src/coordinator.ts
@@ -2269,6 +2556,7 @@ var PRIVILEGED_METHODS = /* @__PURE__ */ new Set([
   "control.rollback",
   "control.set_mode_ceiling",
   "workspace.set_profiles",
+  "workspace.invite",
   "participant.rotate_key",
   "participant.revoke_key"
 ]);
@@ -2312,12 +2600,9 @@ function missing(params, fields) {
   for (const f of fields) if (!(f in params)) return f;
   return null;
 }
-function tagsError(p) {
-  const tags = p.tags;
-  if (tags !== void 0 && (!Array.isArray(tags) || !tags.every((t) => typeof t === "string"))) {
-    return { error: rpcError(E.PARAMS, "tags must be a list of strings") };
-  }
-  return null;
+var MODES = /* @__PURE__ */ new Set(["shadow", "trial", "production"]);
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function reviewRuleSupported(rule) {
   if (rule === "any_one_approves" || rule === "all_approve") return true;
@@ -2338,8 +2623,214 @@ function reviewSatisfied(review) {
   if (rule.startsWith("quorum:")) return approvers.size >= parseInt(rule.slice("quorum:".length), 10);
   return approvers.size >= 1;
 }
+function advertises(ws, name) {
+  return ws.profiles.some((p) => p === name || p.startsWith(name + "/"));
+}
+function knownProfile(id) {
+  const m = /^([a-z][a-z0-9-]*)\/(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.exec(id);
+  if (!m || !Object.prototype.hasOwnProperty.call(PROFILE_VERSIONS, m[1])) return false;
+  return PROFILE_VERSIONS[m[1]].split(".")[0] === m[2];
+}
+var LASTING_PROFILES = ["security-signed", "identity-oidc", "identity-vc"];
+function profilesError(profiles) {
+  const unknown = profiles.find((x) => !knownProfile(x));
+  if (unknown === void 0) return null;
+  return { error: rpcError(
+    E.PARAMS,
+    `Unknown profile ${JSON.stringify(unknown)}: a profile id is <name>/<major>.<minor> for a profile the catalogue lists`
+  ) };
+}
+var RESERVED_KEYS = ["__proto__", "constructor", "prototype"];
+var PARTICIPANT_TYPES = ["human", "agent", "service", "group", "workspace"];
+var ADMIN_TYPES = ["human", "service"];
+function participantError(type, uri, field) {
+  if (!PARTICIPANT_TYPES.includes(type)) {
+    return { error: rpcError(E.PARAMS, "type must be human, agent, service, group or workspace") };
+  }
+  if (!uri.startsWith(`${type}:`)) {
+    return { error: rpcError(E.PARAMS, `${field} must start with "${type}:" for type ${type}`) };
+  }
+  if (type === "group" || type === "workspace") {
+    return { error: rpcError(E.PARAMS, "group: and workspace: URIs name address scopes, which cannot join") };
+  }
+  return null;
+}
+function inForce(key, now) {
+  return !(key.revoked_at !== void 0 && now >= key.revoked_at) && !(key.valid_until !== void 0 && now >= key.valid_until);
+}
+function sameKey(a, b) {
+  const material = (k) => jwkThumbprint(k) ?? canonicalize(k).toString("utf-8");
+  return a.kid === b.kid && material(a) === material(b);
+}
+function credentialKeys(cnf, nonce, joinKeys) {
+  if (isObject(cnf)) {
+    const kid = typeof cnf.kid === "string" && cnf.kid !== "" ? cnf.kid : jwkThumbprint(cnf);
+    if (kid === void 0) return null;
+    const key = { ...cnf, kid };
+    return joinKeys.every((j) => sameKey(key, j)) ? [key] : null;
+  }
+  if (typeof nonce === "string") return joinKeys.every((j) => jwkThumbprint(j) === nonce) ? joinKeys : null;
+  return void 0;
+}
+function rawInvitation(ws, uri) {
+  return Map.prototype.get.call(ws.invitations, uri);
+}
+function awaitsFirstMember(ws) {
+  if (ws.members.size > 0) return false;
+  return !ws.audit.some((e) => e.outcome == null && entryCall(e)?.method === "participant.join");
+}
+function signingKeys(jwks) {
+  const keys = isObject(jwks) && Array.isArray(jwks.keys) ? jwks.keys : [];
+  return keys.filter((j) => isObject(j) && typeof j.kid === "string" && j.kid !== "");
+}
+function recordedForm(envelope) {
+  if (envelope.method !== "participant.join" || !isObject(envelope.params)) return envelope;
+  const params = { ...envelope.params };
+  if (typeof params.oidc_token === "string") params.oidc_token = sha256Hex(params.oidc_token);
+  if (isObject(params.vc_presentation)) params.vc_presentation = contentHash(params.vc_presentation);
+  return { ...envelope, params };
+}
+function storeFailed() {
+  return rpcError(E.INTERNAL, "Internal error", { reason: "store" });
+}
+function targetOf(envelope) {
+  const params = isObject(envelope) ? envelope.params : void 0;
+  const id = isObject(params) ? params.workspace : void 0;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+var KEPT_NULLS = { whispers: ["default_if_lapsed"] };
+function dropNulls(o, keep = []) {
+  for (const key of Object.keys(o)) if (o[key] === null && !keep.includes(key)) delete o[key];
+}
+function shapeObject(name, item) {
+  if (name === "route_decisions") {
+    const extra = item.extra;
+    delete item.extra;
+    if (isObject(extra)) Object.assign(item, extra);
+    item.kind = "route_decision";
+  }
+  dropNulls(item, KEPT_NULLS[name]);
+  const each = (o, field, f) => {
+    if (!Array.isArray(o[field])) return;
+    for (const x of o[field]) {
+      if (isObject(x)) {
+        dropNulls(x);
+        f?.(x);
+      }
+    }
+  };
+  if (name === "members") each(item, "keys");
+  if (name === "tasks") {
+    each(item, "history", (h) => {
+      if (h.from === void 0 && typeof h.from_ === "string") h.from = h.from_;
+      delete h.from_;
+    });
+    if (isObject(item.review)) {
+      dropNulls(item.review);
+      each(item.review, "decisions");
+    }
+  }
+  if (name === "deliberations") each(item, "votes");
+  if (name === "handoffs") {
+    each(item, "tasks");
+    if (Array.isArray(item.accepted_task_ids) && item.accepted_task_ids.length === 0) delete item.accepted_task_ids;
+  }
+  return item;
+}
+function storedCopy(name, item) {
+  return shapeObject(name, structuredClone(item));
+}
+function shapeSnapshot(w) {
+  const out = { ...w };
+  dropNulls(out);
+  for (const name of COLLECTIONS) {
+    if (Array.isArray(out[name])) {
+      out[name] = out[name].map((x) => isObject(x) ? storedCopy(name, x) : x);
+    }
+  }
+  return out;
+}
+function reviewRequired(ws, task) {
+  return task.review_required === true || task.mode === "trial" && advertises(ws, "modes");
+}
+function rawMember(ws, uri) {
+  return typeof uri === "string" ? Map.prototype.get.call(ws.members, uri) : void 0;
+}
+function unionOf(...lists) {
+  const out = [];
+  for (const list of lists) for (const uri of list) if (!out.includes(uri)) out.push(uri);
+  return out;
+}
+function authorsOf(task, completer) {
+  const authors = [task.assignee];
+  if (typeof completer === "string" && completer !== task.assignee) authors.push(completer);
+  return unionOf(authors, Array.isArray(task.prior_authors) ? task.prior_authors : []);
+}
+function stateBefore(history, i) {
+  for (let j = i - 1; j >= 0; j--) {
+    if (history[j].state !== "paused") return history[j].state;
+  }
+  return void 0;
+}
+function workCompletion(history, i) {
+  if (history[i].state !== "completed") return false;
+  const before = stateBefore(history, i);
+  return before !== "review_requested" && before !== "completed";
+}
+function lastCompleter(task) {
+  for (let i = task.history.length - 1; i >= 0; i--) {
+    if (workCompletion(task.history, i)) return task.history[i].from;
+  }
+  return void 0;
+}
+var OPENED_ON_COMPLETE = "review required; opened on task.complete";
+var NEW_ROUND_ON_COMPLETE = "a new round of the review; opened on task.complete";
+function storedAuthors(task) {
+  let requester;
+  const withRequester = (authors) => unionOf(authors, requester !== void 0 ? [requester] : []);
+  for (let i = task.history.length - 1; i >= 0; i--) {
+    const h = task.history[i];
+    const opens = h.state === "review_requested" && stateBefore(task.history, i) !== "review_requested";
+    if (opens && (h.note === OPENED_ON_COMPLETE || h.note === NEW_ROUND_ON_COMPLETE)) return withRequester(authorsOf(task, h.from));
+    if (opens && requester === void 0) requester = h.from;
+    if (workCompletion(task.history, i)) return withRequester(authorsOf(task, h.from));
+  }
+  return withRequester(authorsOf(task, void 0));
+}
+var ENDED = ["completed", "declined", "cancelled", "superseded", "escalated"];
+function reviewHolds(ws, task) {
+  const seen = /* @__PURE__ */ new Set();
+  for (let t = task; t && !seen.has(t.id); t = typeof t.supersedes === "string" ? ws.tasks.get(t.supersedes) : void 0) {
+    seen.add(t.id);
+    if (!reviewRequired(ws, t)) return [];
+    if (t.review) {
+      const decided = t.review.decisions.some((d) => d.kind === "reject" || d.kind === "override") || reviewSatisfied(t.review);
+      return decided ? [] : t.review.authors;
+    }
+  }
+  return [];
+}
+function openRequiredReviewAuthors(ws, task) {
+  return ENDED.includes(task.state) ? [] : reviewHolds(ws, task);
+}
+function heldBy(task, mover) {
+  return mover === task.assignee ? [task.assignee] : [];
+}
+function successorAuthors(old, mover) {
+  const completer = lastCompleter(old);
+  return unionOf(
+    old.review ? old.review.authors : [],
+    heldBy(old, mover),
+    completer !== void 0 ? [completer] : [],
+    Array.isArray(old.prior_authors) ? old.prior_authors : []
+  );
+}
+function isScope(uri) {
+  return typeof uri === "string" && (uri.startsWith("workspace:") || uri.startsWith("group:"));
+}
 function reply(env, body) {
-  const out = { jsonrpc: "2.0", id: env.id };
+  const sent = env !== null && typeof env === "object" && !Array.isArray(env) ? env.id : void 0;
+  const out = { jsonrpc: "2.0", id: sent ?? null };
   if (body.error !== void 0) out.error = body.error;
   else out.result = body.result;
   return out;
@@ -2354,7 +2845,7 @@ function indexSigned(index, entry) {
     return;
   }
   if (entry.outcome != null) index.refused.set(digest, { seq: entry.seq, code: entry.outcome.code });
-  else index.accepted.add(digest);
+  else if (!index.accepted.has(digest)) index.accepted.set(digest, entry.seq);
 }
 function isThenable(value) {
   return typeof value?.then === "function";
@@ -2382,13 +2873,21 @@ var Coordinator = class {
   unflushed = /* @__PURE__ */ new Set();
   /** Workspaces with a write queued behind an async write in flight. */
   flushQueued = /* @__PURE__ */ new Set();
+  /**
+   * Workspaces whose store copy may differ from memory after a synchronous
+   * write failed or conflicted. Each is reloaded from the store before the
+   * next call on it, which is refused while the reload fails.
+   */
+  held = /* @__PURE__ */ new Set();
+  /** Entries appended and not yet written, which the audit listeners hear of once they are. */
+  unannounced = /* @__PURE__ */ new WeakMap();
   clockMs;
   frozenNow;
   auditListeners = [];
   /**
    * The signed calls on each workspace's log, by what their senders signed:
-   * recorded refusals with their seq and code, and accepted calls. Rebuilt
-   * from the log when missing, so a snapshot never carries it.
+   * recorded refusals with their seq and code, and accepted calls with their
+   * seq. Rebuilt from the log when missing, so a snapshot never carries it.
    */
   signedIndexes = /* @__PURE__ */ new WeakMap();
   /** Method handler registry; profiles plug into this. */
@@ -2524,6 +3023,7 @@ var Coordinator = class {
       change = this.takeChange(ws, p);
     } catch (err) {
       p.replace = true;
+      if (this.options.storeErrors !== "log") this.held.add(ws.id);
       this.reportStoreError(err, { id: ws.id, version: ws.audit.length });
       return;
     }
@@ -2532,6 +3032,7 @@ var Coordinator = class {
     const done = () => {
       p.seq = taken.version;
       if (taken.replace) p.replace = false;
+      this.announce(ws, taken.version);
     };
     const failed = (err) => {
       this.giveBack(ws, p, taken);
@@ -2541,13 +3042,34 @@ var Coordinator = class {
     try {
       result = this.store.apply(taken);
     } catch (err) {
+      if (err instanceof StoreConflictError || this.options.storeErrors !== "log") this.held.add(ws.id);
       failed(err);
       return;
     }
     if (isThenable(result)) return Promise.resolve(result).then(done, failed);
     done();
   }
-  /** The change since the last write, taking the recorded keys with it. */
+  /** Tell the audit listeners of the entries now written, up to `upTo`. */
+  announce(ws, upTo) {
+    const queued = this.unannounced.get(ws);
+    if (!queued?.length) return;
+    const now = queued.filter((e) => e.seq < upTo);
+    this.unannounced.set(ws, queued.filter((e) => e.seq >= upTo));
+    for (const entry of now) {
+      for (const l of this.auditListeners) {
+        try {
+          l(ws, entry);
+        } catch {
+        }
+      }
+    }
+  }
+  /**
+   * The change since the last write, taking the recorded keys with it. Each
+   * object is written as a copy in the shape a restore gives back, so a
+   * coordinator restarted on the store holds what this one holds, and the
+   * workspace's own objects are left as they are.
+   */
   takeChange(ws, p) {
     const replace = p.replace;
     const objects = {};
@@ -2556,12 +3078,15 @@ var Coordinator = class {
       if (replace) {
         const all = {};
         for (const [key, value] of Map.prototype.entries.call(map)) {
-          all[key] = value;
+          all[key] = storedCopy(name, value);
         }
         objects[name] = all;
       } else if (map.dirty.size) {
         const changed = {};
-        for (const key of map.dirty) changed[key] = map.peek(key) ?? null;
+        for (const key of map.dirty) {
+          const value = map.peek(key);
+          changed[key] = value === void 0 ? null : storedCopy(name, value);
+        }
         objects[name] = changed;
       }
       map.dirty.clear();
@@ -2613,24 +3138,28 @@ var Coordinator = class {
       this.reportStoreError(err, { id: ws.id, version: next });
       return;
     }
+    const upTo = ws.audit.length;
     const pending = this.saveChains.get(ws.id);
     if (pending) {
-      this.trackSave(pending.then(() => this.store.save(record)), record);
+      this.trackSave(pending.then(() => this.store.save(record)), record, () => this.announce(ws, upTo));
       return;
     }
     let result;
     try {
       result = this.store.save(record);
     } catch (err) {
+      if (this.options.storeErrors !== "log") this.held.add(ws.id);
       this.reportStoreError(err, record);
       return;
     }
     if (isThenable(result)) {
-      this.trackSave(Promise.resolve(result), record);
+      this.trackSave(Promise.resolve(result), record, () => this.announce(ws, upTo));
+      return;
     }
+    this.announce(ws, upTo);
   }
-  trackSave(save, record) {
-    const guarded = save.catch((err) => this.reportStoreError(err, record));
+  trackSave(save, record, saved) {
+    const guarded = save.then(saved, (err) => this.reportStoreError(err, record));
     this.saveChains.set(record.id, guarded);
     void guarded.then(() => {
       if (this.saveChains.get(record.id) === guarded) {
@@ -2638,6 +3167,17 @@ var Coordinator = class {
       }
     });
   }
+  reportInternalError(err, method, workspace) {
+    const call2 = { method, ...workspace !== void 0 ? { workspace } : {} };
+    if (this.options.onInternalError) {
+      try {
+        this.options.onInternalError(err, call2);
+      } catch {
+      }
+      return;
+    }
+    console.error(`chap coordinator: ${method} failed with an internal error:`, err);
+  }
   reportStoreError(err, record) {
     if (this.options.onStoreError) {
       try {
@@ -2647,7 +3187,9 @@ var Coordinator = class {
       return;
     }
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`chap coordinator: writing workspace ${record.id} to the store failed: ${message}`);
+    const line = `chap coordinator: writing workspace ${record.id} to the store failed: ${message}`;
+    if (err instanceof StoreConflictError) console.warn(line);
+    else console.error(line);
   }
   async drainSaves() {
     while (this.saveChains.size) {
@@ -2698,16 +3240,25 @@ var Coordinator = class {
     return null;
   }
   /**
-   * Assert that `sender` was addressed in the task's review. Applied to
-   * review-decision methods (decide.* and abstain.declare): to act on a
-   * review you must be one of the reviewers it was addressed to (the
-   * `to` set on review.request). Membership is the floor; this is the
-   * eligibility ceiling for decisions. Returns an error fragment if not
-   * eligible, else null.
+   * Assert that `sender` may decide the task's open review. Applied to
+   * review-decision methods (decide.* and abstain.declare) and to
+   * review.acknowledge: to act on a review you must not be an author of the
+   * work under review, must be a human member where the task requires
+   * review, and must be one of the reviewers it was addressed to (the `to`
+   * set on review.request).
+   * Membership is the floor; this is the eligibility ceiling for decisions.
+   * Returns an error fragment if not eligible, else null.
    */
-  requireReviewer(task, sender) {
+  requireReviewer(ws, task, sender) {
     const review = task.review;
-    if (!review || !review.requested_to || review.requested_to.length === 0) {
+    if (!review) return null;
+    if (typeof sender === "string" && review.authors.includes(sender)) {
+      return { error: rpcError(E.NOT_AUTHORISED, "The author of the work under review cannot decide it") };
+    }
+    if (reviewRequired(ws, task) && rawMember(ws, sender)?.type !== "human") {
+      return { error: rpcError(E.NOT_AUTHORISED, `This task requires a person's review: ${String(sender)} is not a human member`) };
+    }
+    if (!review.requested_to || review.requested_to.length === 0) {
       return null;
     }
     if (review.requested_to.some((r) => typeof r === "string" && (r.startsWith("workspace:") || r.startsWith("group:")))) {
@@ -2736,23 +3287,31 @@ var Coordinator = class {
       routing_policy_uri: ws.routing_policy_uri,
       step_up_window_sec: ws.step_up_window_sec,
       min_acr: ws.min_acr,
+      signature_policy: ws.signature_policy,
+      join_policy: ws.join_policy,
+      review_rule: ws.review_rule,
       chain_head: ws.chain_head,
       chain_enabled: ws.chain_enabled
     };
   }
-  /** One workspace as `snapshot()` holds it. Reads nothing as a change. */
+  /**
+   * One workspace as `snapshot()` holds it: each object of its collections a
+   * copy in the shape the store keeps. Reads nothing as a change.
+   */
   snapshotOf(ws) {
     const { chain_head, chain_enabled, ...own } = this.metaOf(ws);
+    const stored = (name) => Array.from(rawValues(ws[name])).map((v) => storedCopy(name, v));
     return {
       ...own,
-      members: Array.from(rawValues(ws.members)),
-      tasks: Array.from(rawValues(ws.tasks)),
-      overrides: Array.from(rawValues(ws.overrides)),
-      whispers: Array.from(rawValues(ws.whispers)),
-      deliberations: Array.from(rawValues(ws.deliberations)),
-      handoffs: Array.from(rawValues(ws.handoffs)),
-      snapshots: Array.from(rawValues(ws.snapshots)),
-      route_decisions: Array.from(rawValues(ws.route_decisions)),
+      members: stored("members"),
+      tasks: stored("tasks"),
+      overrides: stored("overrides"),
+      whispers: stored("whispers"),
+      deliberations: stored("deliberations"),
+      handoffs: stored("handoffs"),
+      snapshots: stored("snapshots"),
+      route_decisions: stored("route_decisions"),
+      invitations: stored("invitations"),
       idempotency_keys: { ...ws.idempotency_keys },
       audit: ws.audit,
       chain_head,
@@ -2780,7 +3339,8 @@ var Coordinator = class {
     }
   }
   /** One workspace from a snapshot entry, its maps tracked. */
-  rebuild(w) {
+  rebuild(snapshot) {
+    const w = shapeSnapshot(snapshot);
     const ws = {
       id: w.id,
       created: w.created,
@@ -2791,6 +3351,11 @@ var Coordinator = class {
       routing_policy_uri: w.routing_policy_uri,
       step_up_window_sec: w.step_up_window_sec ?? 300,
       min_acr: w.min_acr,
+      // A workspace written before the policy existed verified every call,
+      // and one written before the join policy existed admitted anyone.
+      signature_policy: w.signature_policy === "humans" ? "humans" : "all",
+      join_policy: w.join_policy === "invite" ? "invite" : "open",
+      review_rule: typeof w.review_rule === "string" && reviewRuleSupported(w.review_rule) ? w.review_rule : void 0,
       members: this.newMap(),
       tasks: this.newMap(),
       overrides: this.newMap(),
@@ -2799,6 +3364,7 @@ var Coordinator = class {
       handoffs: this.newMap(),
       snapshots: this.newMap(),
       route_decisions: this.newMap(),
+      invitations: this.newMap(),
       idempotency_keys: w.idempotency_keys ?? {},
       audit: w.audit ?? [],
       chain_head: w.chain_head,
@@ -2807,9 +3373,16 @@ var Coordinator = class {
     for (const m of w.members ?? []) {
       if (!Array.isArray(m.keys)) m.keys = [];
       if (m.paused === void 0) m.paused = false;
+      const scheme = typeof m.uri === "string" ? m.uri.split(":")[0] : "";
+      if (PARTICIPANT_TYPES.includes(scheme)) m.type = scheme;
+      if (m.role === "admin" && !ADMIN_TYPES.includes(m.type)) m.role = "participant";
       ws.members.set(m.uri, m);
     }
-    for (const t of w.tasks ?? []) ws.tasks.set(t.id, t);
+    for (const t of w.tasks ?? []) {
+      if (t.review && !Array.isArray(t.review.authors)) t.review.authors = storedAuthors(t);
+      if (t.review && !Array.isArray(t.review.acknowledgements)) t.review.acknowledgements = [];
+      ws.tasks.set(t.id, t);
+    }
     for (const o of w.overrides ?? []) ws.overrides.set(o.id, o);
     for (const x of w.whispers ?? [])
       ws.whispers.set(x.id, x);
@@ -2853,20 +3426,119 @@ var Coordinator = class {
     }
     for (const x of w.route_decisions ?? [])
       ws.route_decisions.set(x.id, x);
+    for (const x of w.invitations ?? []) ws.invitations.set(x.uri, x);
     return ws;
   }
   // -- dispatch ------------------------------------------------------
   dispatch(envelope) {
     this.frozenNow = this.advanceClock();
     this.tracker.depth++;
+    let response;
+    let target;
+    let ran = false;
     try {
-      const response = this._dispatch(envelope);
-      if (response.error) this.recordRefusal(envelope, response.error);
-      return response;
+      target = targetOf(envelope);
+      const refused = target === void 0 ? null : this.keepUp(target);
+      if (refused) {
+        response = reply(envelope, { error: refused });
+      } else {
+        ran = true;
+        response = this._dispatch(envelope);
+        if (response.error) this.recordRefusal(envelope, response.error);
+        else if (target === void 0 && envelope.method === "workspace.create") {
+          target = response.result?.workspace;
+        }
+      }
     } finally {
       if (--this.tracker.depth === 0) this.flushUnflushed();
       this.frozenNow = void 0;
     }
+    if (ran && target !== void 0 && this.tracker.depth === 0 && this.held.has(target)) {
+      this.reload(target);
+      return reply(envelope, { error: storeFailed() });
+    }
+    return response;
+  }
+  /**
+   * Work that changes a workspace outside any call, a whisper lapse check
+   * for one, kept to the rules a call keeps (SPECIFICATION 10.3): the
+   * workspace is first brought up to date with the store, and left alone
+   * as long as it is held; what the work changed is written once, when it ends;
+   * and where that write fails, the workspace goes back to what the store
+   * holds and the work's results are dropped, since none took effect.
+   */
+  outsideCall(id, work) {
+    if (this.tracker.depth > 0) return work();
+    if (this.keepUp(id)) return [];
+    this.tracker.depth++;
+    let out;
+    try {
+      out = work();
+    } finally {
+      if (--this.tracker.depth === 0) this.flushUnflushed();
+    }
+    if (this.held.has(id)) {
+      this.reload(id);
+      return [];
+    }
+    return out;
+  }
+  /**
+   * Before a call on a workspace: where the store holds a different number of
+   * audit entries for it than this instance last wrote, another writer has
+   * written it, and it is reloaded. A workspace held after a failed write is
+   * reloaded as well, and the call refused while that fails.
+   */
+  keepUp(id) {
+    if (this.held.has(id)) return this.reload(id) ? null : storeFailed();
+    if (typeof this.store.version !== "function" || this.saveChains.has(id)) return null;
+    let stored;
+    try {
+      stored = this.store.version(id);
+    } catch {
+      return null;
+    }
+    if (isThenable(stored)) return null;
+    const ws = this.workspaces.get(id);
+    const p = ws ? this.persisted.get(ws) : void 0;
+    if (ws && (!p || p.replace)) return null;
+    if (stored === p?.seq) return null;
+    return this.reload(id) ? null : storeFailed();
+  }
+  /** Replace a workspace with what the store holds of it. False when it cannot be read. */
+  reload(id) {
+    let record;
+    try {
+      if (typeof this.store.loadOne === "function") {
+        record = this.store.loadOne(id);
+      } else {
+        const all = this.store.load();
+        if (isThenable(all)) return false;
+        record = all.find((r) => r.id === id);
+      }
+      if (isThenable(record)) return false;
+    } catch (err) {
+      this.reportStoreError(err, { id, version: this.workspaces.get(id)?.audit.length ?? 0 });
+      return false;
+    }
+    const old = this.workspaces.get(id);
+    if (old) this.unflushed.delete(old);
+    if (record) {
+      let ws;
+      try {
+        ws = this.rebuild(record.data);
+      } catch (err) {
+        this.reportStoreError(err, { id, version: record.version });
+        return false;
+      }
+      this.workspaces.set(id, ws);
+      this.markWritten(ws);
+      this.wsVersions.set(id, record.version);
+    } else {
+      this.workspaces.delete(id);
+    }
+    this.held.delete(id);
+    return true;
   }
   _dispatch(envelope) {
     if (!isValidEnvelope(envelope) || typeof envelope.method !== "string" || !envelope.method) {
@@ -2903,11 +3575,16 @@ var Coordinator = class {
       const msg = canonicalError instanceof Error ? canonicalError.message : String(canonicalError);
       return reply(envelope, { error: rpcError(E.PARAMS, msg) });
     }
+    if (params.workspace !== void 0 && (typeof params.workspace !== "string" || !params.workspace)) {
+      return reply(envelope, { error: rpcError(E.PARAMS, "workspace must be a non-empty string") });
+    }
     if (isSigned(envelope)) {
       const wsId2 = params.workspace;
       const ws = typeof wsId2 === "string" ? this.workspaces.get(wsId2) : void 0;
       if (ws) {
-        const prior = this.signedIndex(ws).refused.get(signedDigest(envelope));
+        const index = this.signedIndex(ws);
+        const digest = signedDigest(recordedForm(envelope));
+        const prior = index.refused.get(digest);
         if (prior) {
           return reply(envelope, { error: rpcError(
             prior.code,
@@ -2915,15 +3592,24 @@ var Coordinator = class {
             { refused_at_seq: prior.seq }
           ) });
         }
+        const accepted = index.accepted.get(digest);
+        if (accepted !== void 0) {
+          return reply(envelope, { error: rpcError(
+            E.SIG_ALREADY_ACCEPTED,
+            `Accepted at seq ${accepted}; a signed request takes effect once`,
+            { accepted_at_seq: accepted }
+          ) });
+        }
       }
     }
-    if (this.options.requireSignatures && method !== "participant.join" && method !== "workspace.create") {
+    const target = typeof params.workspace === "string" ? this.workspaces.get(params.workspace) : void 0;
+    if (this.requiresSignatures(target) && method !== "participant.join" && method !== "workspace.create" && !(!isSigned(envelope) && target !== void 0 && !this.mustSign(target, rawMember(target, params.from)?.type))) {
       const sigErr = this.verifySignature(envelope);
       if (sigErr) return reply(envelope, { error: sigErr });
       if (method === "participant.rotate_key") {
         const signingKid = envelope.sig.split(":")[1];
         const oldKid = params.old_kid;
-        if (oldKid !== void 0 && signingKid !== oldKid) {
+        if (oldKid != null && signingKid !== oldKid) {
           return reply(envelope, { error: rpcError(
             E.SIG_ROTATION_KEY_MISMATCH,
             "Rotation must be signed with the old key"
@@ -2978,14 +3664,14 @@ var Coordinator = class {
     try {
       out = handler(ownCopy(params));
     } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      return reply(envelope, { error: rpcError(E.INTERNAL, "Internal error", { detail: msg }) });
+      this.reportInternalError(e, method, params.workspace);
+      return reply(envelope, { error: rpcError(E.INTERNAL, "Internal error") });
     }
     if (out.error) return reply(envelope, { error: out.error });
-    const wsId = params.workspace;
+    const wsId = method === "workspace.create" ? out.result.workspace : params.workspace;
     if (typeof wsId === "string" && !READ_ONLY_METHODS.has(method)) {
       const ws = this.workspaces.get(wsId);
-      if (ws) this.recordAudit(ws, envelope);
+      if (ws) this.recordAudit(ws, recordedForm(envelope));
     }
     return reply(envelope, { result: ownCopy(out.result) });
   }
@@ -3025,7 +3711,7 @@ var Coordinator = class {
   signedIndex(ws) {
     let index = this.signedIndexes.get(ws);
     if (!index) {
-      index = { refused: /* @__PURE__ */ new Map(), accepted: /* @__PURE__ */ new Set() };
+      index = { refused: /* @__PURE__ */ new Map(), accepted: /* @__PURE__ */ new Map() };
       for (const entry of ws.audit) indexSigned(index, entry);
       this.signedIndexes.set(ws, index);
     }
@@ -3041,12 +3727,9 @@ var Coordinator = class {
     ws.audit.push(entry);
     const index = this.signedIndexes.get(ws);
     if (index) indexSigned(index, entry);
-    for (const l of this.auditListeners) {
-      try {
-        l(ws, entry);
-      } catch {
-      }
-    }
+    const queued = this.unannounced.get(ws);
+    if (queued) queued.push(entry);
+    else this.unannounced.set(ws, [entry]);
     this.persist(ws);
   }
   // -- signature verification (security-signed/1.0) -----------------
@@ -3056,7 +3739,12 @@ var Coordinator = class {
       return rpcError(E.SIG_VERIFY_FAILED, "Missing top-level `sig` field");
     }
     const parts = sig.split(":");
-    if (parts.length !== 3 || parts[0] !== "ed25519") {
+    const scheme = parts[0];
+    if (parts.length !== 3 || scheme !== "ed25519" && scheme !== "webauthn") {
+      return rpcError(E.SIG_VERIFY_FAILED, "Malformed signature tag");
+    }
+    const assertion = scheme === "webauthn" ? parseWebAuthnAssertion(parts[2]) : void 0;
+    if (scheme === "webauthn" && !assertion) {
       return rpcError(E.SIG_VERIFY_FAILED, "Malformed signature tag");
     }
     const kid = parts[1];
@@ -3090,6 +3778,14 @@ var Coordinator = class {
       if (revoked) return rpcError(E.SIG_KEY_REVOKED, `Key ${kid} is revoked`);
       return rpcError(E.SIG_KEY_NOT_FOUND, `No key ${kid} valid at ${ts} for ${sender}`);
     }
+    if (assertion) {
+      if (!isWebAuthnKey(key.jwk)) return rpcError(E.SIG_VERIFY_FAILED, `Key ${kid} is not a WebAuthn key`);
+      const stripped = JSON.parse(JSON.stringify(envelope));
+      delete stripped.sig;
+      const failure = webAuthnFailure(canonicalize(stripped), assertion, key.jwk);
+      return failure === null ? null : rpcError(E.SIG_VERIFY_FAILED, failure);
+    }
+    if (!isEd25519Key(key.jwk)) return rpcError(E.SIG_VERIFY_FAILED, `Key ${kid} is not an Ed25519 key`);
     try {
       const stripped = JSON.parse(JSON.stringify(envelope));
       delete stripped.sig;
@@ -3103,6 +3799,39 @@ var Coordinator = class {
       return rpcError(E.SIG_VERIFY_FAILED, "Signature failed verification");
     }
   }
+  /**
+   * SPECIFICATION 6.5: an identity profile states that a verifier checks
+   * people's credentials, so advertising one this coordinator has no
+   * verifier for describes a guarantee it does not give.
+   */
+  unverifiedIdentity(profiles) {
+    const named = (name) => profiles.some((x) => x === name || x.startsWith(name + "/"));
+    if (named("identity-oidc") && this.options.verifyOidcToken === void 0) {
+      return rpcError(
+        E.PARAMS,
+        "identity-oidc/1.0 is advertised but no token verifier is configured. A workspace that advertises it and does not enforce it describes a guarantee it does not give."
+      );
+    }
+    if (named("identity-vc") && this.options.verifyVc === void 0) {
+      return rpcError(
+        E.PARAMS,
+        "identity-vc/1.0 is advertised but no presentation verifier is configured. A workspace that advertises it and does not enforce it describes a guarantee it does not give."
+      );
+    }
+    return null;
+  }
+  /** Whether a workspace requires signatures: it advertises security-signed/1.0, or this coordinator is configured to. */
+  requiresSignatures(ws) {
+    return !!this.options.requireSignatures || ws !== void 0 && advertises(ws, "security-signed");
+  }
+  /**
+   * Whether a participant of this type signs its calls in a workspace that
+   * requires signatures: every participant under "all", and every one but an
+   * agent under "humans". A non-member signs.
+   */
+  mustSign(ws, type) {
+    return ws.signature_policy === "all" || type !== "agent";
+  }
   /** Lookup the key valid for a given participant at a given time. */
   lookupKey(member, kid, ts) {
     for (const k of member.keys) {
@@ -3176,6 +3905,7 @@ var Coordinator = class {
     this.handlers.set("workspace.create", (p) => this.opWorkspaceCreate(p));
     this.handlers.set("workspace.describe", (p) => this.opWorkspaceDescribe(p));
     this.handlers.set("workspace.set_profiles", (p) => this.opWorkspaceSetProfiles(p));
+    this.handlers.set("workspace.invite", (p) => this.opWorkspaceInvite(p));
     this.handlers.set("participant.join", (p) => this.opParticipantJoin(p));
     this.handlers.set("participant.leave", (p) => this.opParticipantLeave(p));
     this.handlers.set("task.create", (p) => this.opTaskCreate(p));
@@ -3183,6 +3913,7 @@ var Coordinator = class {
     this.handlers.set("task.complete", (p) => this.opTaskComplete(p));
     this.handlers.set("audit.read", (p) => this.opAuditRead(p));
     this.handlers.set("review.request", (p) => this.opReviewRequest(p));
+    this.handlers.set("review.acknowledge", (p) => this.opReviewAcknowledge(p));
     this.handlers.set("decide.approve", (p) => this.opDecide(p, "approve"));
     this.handlers.set("decide.reject", (p) => this.opDecide(p, "reject"));
     this.handlers.set("decide.override", (p) => this.opDecideOverride(p));
@@ -3202,24 +3933,59 @@ var Coordinator = class {
   //   Core method handlers
   // ==========================================================
   opWorkspaceCreate(p) {
+    const built = this.buildWorkspace(p);
+    if (built.error) return { error: built.error };
+    this.addWorkspace(built.ws);
+    return { result: { workspace: built.ws.id, created: built.ws.created } };
+  }
+  /**
+   * The workspace a workspace.create with these params makes, or why it
+   * cannot be made. Nothing is registered, so participant.join can judge a
+   * join by the workspace it would make and make it only once the join
+   * passes.
+   */
+  buildWorkspace(p) {
+    const bad = paramsError(p, [
+      ["profiles", "strings"],
+      ["mode", "string"],
+      ["mode_ceiling", "string"],
+      ["routing_policy_uri", "string"],
+      ["step_up_window_sec", "integer"],
+      ["min_acr", "string"]
+    ]);
+    if (bad) return bad;
+    for (const name of ["mode", "mode_ceiling"]) {
+      if (p[name] != null && !MODES.has(p[name])) {
+        return { error: rpcError(E.PARAMS, `${name} must be shadow, trial or production`) };
+      }
+    }
+    const policy = p.signature_policy ?? this.options.signaturePolicy ?? "all";
+    if (policy !== "all" && policy !== "humans") {
+      return { error: rpcError(E.PARAMS, "signature_policy must be all or humans") };
+    }
+    const joinPolicy = p.join_policy ?? this.options.joinPolicy ?? "open";
+    if (joinPolicy !== "open" && joinPolicy !== "invite") {
+      return { error: rpcError(E.PARAMS, "join_policy must be open or invite") };
+    }
+    const reviewRule = p.review_rule ?? void 0;
+    if (reviewRule !== void 0 && (typeof reviewRule !== "string" || !reviewRuleSupported(reviewRule))) {
+      return { error: rpcError(E.PARAMS, "review_rule must be any_one_approves, all_approve or quorum:<n>") };
+    }
     const id = p.workspace || this.ids.workspaceId();
-    if (typeof id !== "string") return { error: rpcError(E.PARAMS, "workspace must be a string id") };
     if (this.workspaces.has(id)) return { error: rpcError(E.PARAMS, `workspace already exists: ${id}`) };
-    const profiles = Array.isArray(p.profiles) ? [...p.profiles] : [...this.options.defaultProfiles ?? ["core/1.0", "review/1.0"]];
-    for (const [profile, enforced, option] of [
-      ["security-signed/1.0", !!this.options.requireSignatures, "requireSignatures"],
-      ["identity-oidc/1.0", this.options.verifyOidcToken !== void 0, "verifyOidcToken"]
-    ]) {
-      const name = profile.split("/")[0];
-      const advertised = profiles.some((x) => x === name || x.startsWith(name + "/"));
-      if (enforced && !advertised) profiles.push(profile);
-      else if (advertised && !enforced) {
-        return { error: rpcError(
-          E.PARAMS,
-          `${profile} is advertised but ${option} is not configured. A workspace that advertises it and does not enforce it describes a guarantee it does not give.`
-        ) };
-      }
+    if (Array.isArray(p.profiles)) {
+      const unknown = profilesError(p.profiles);
+      if (unknown) return unknown;
     }
+    const profiles = Array.isArray(p.profiles) ? [...p.profiles] : [...this.options.defaultProfiles ?? ["core/1.0", "review/1.0"]];
+    const signed = profiles.some((x) => x === "security-signed" || x.startsWith("security-signed/"));
+    if (this.options.requireSignatures && !signed) profiles.push("security-signed/1.0");
+    const oidc = profiles.some((x) => x === "identity-oidc" || x.startsWith("identity-oidc/"));
+    if (this.options.verifyOidcToken !== void 0 && !oidc) profiles.push("identity-oidc/1.0");
+    const vc = profiles.some((x) => x === "identity-vc" || x.startsWith("identity-vc/"));
+    if (this.options.verifyVc !== void 0 && !vc) profiles.push("identity-vc/1.0");
+    const unverified = this.unverifiedIdentity(profiles);
+    if (unverified) return { error: unverified };
     const chainEnabled = profiles.includes("audit-scitt/1.0") || !!this.options.enableChain;
     const ws = {
       id,
@@ -3228,9 +3994,14 @@ var Coordinator = class {
       profiles,
       mode: p.mode ?? "trial",
       mode_ceiling: p.mode_ceiling ?? "production",
-      routing_policy_uri: p.routing_policy_uri,
-      step_up_window_sec: typeof p.step_up_window_sec === "number" ? p.step_up_window_sec : 300,
-      min_acr: p.min_acr,
+      // A param given as null gives no value, as in the Python reference: a
+      // null min_acr sets no minimum.
+      routing_policy_uri: p.routing_policy_uri ?? void 0,
+      step_up_window_sec: p.step_up_window_sec ?? 300,
+      min_acr: p.min_acr ?? void 0,
+      signature_policy: policy,
+      join_policy: joinPolicy,
+      ...reviewRule !== void 0 ? { review_rule: reviewRule } : {},
       members: this.newMap(),
       tasks: this.newMap(),
       overrides: this.newMap(),
@@ -3239,14 +4010,17 @@ var Coordinator = class {
       handoffs: this.newMap(),
       snapshots: this.newMap(),
       route_decisions: this.newMap(),
+      invitations: this.newMap(),
       idempotency_keys: {},
       audit: [],
       chain_enabled: chainEnabled,
       chain_head: chainEnabled ? ZERO_HASH : void 0
     };
-    this.workspaces.set(id, ws);
+    return { ws };
+  }
+  addWorkspace(ws) {
+    this.workspaces.set(ws.id, ws);
     this.persisted.set(ws, { seq: 0, replace: false, keys: /* @__PURE__ */ new Set() });
-    return { result: { workspace: id, created: ws.created } };
   }
   opWorkspaceDescribe(p) {
     const miss = missing(p, ["workspace"]);
@@ -3265,6 +4039,9 @@ var Coordinator = class {
       mode_ceiling: ws.mode_ceiling,
       max_envelope_bytes: this.options.maxEnvelopeBytes ?? DEFAULT_MAX_ENVELOPE_BYTES,
       step_up_window_sec: ws.step_up_window_sec,
+      signature_policy: ws.signature_policy,
+      join_policy: ws.join_policy,
+      review_rule: ws.review_rule ?? "any_one_approves",
       profiles: ws.profiles,
       members: Array.from(rawValues(ws.members)).map(memberToDict),
       audit_count: ws.audit.length,
@@ -3280,6 +4057,11 @@ var Coordinator = class {
   opWorkspaceSetProfiles(p) {
     const miss = missing(p, ["workspace", "from", "profiles"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    if (!Array.isArray(p.profiles) || !p.profiles.every((x) => typeof x === "string")) {
+      return { error: rpcError(E.PARAMS, "profiles must be a list of strings") };
+    }
+    const unknown = profilesError(p.profiles);
+    if (unknown) return unknown;
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
@@ -3288,6 +4070,14 @@ var Coordinator = class {
       return { error: rpcError(E.NOT_AUTHORISED, "workspace.set_profiles requires the admin role") };
     }
     const newProfiles = [...p.profiles];
+    for (const name of LASTING_PROFILES) {
+      const held = ws.profiles.find((x) => x === name || x.startsWith(name + "/"));
+      if (held !== void 0 && !newProfiles.some((x) => x.startsWith(name + "/"))) {
+        return { error: rpcError(E.NOT_AUTHORISED, `${held} cannot be removed once advertised`) };
+      }
+    }
+    const unverified = this.unverifiedIdentity(newProfiles);
+    if (unverified) return { error: unverified };
     if (!newProfiles.some((pr) => pr.startsWith("core/"))) newProfiles.push("core/1.0");
     ws.profiles = newProfiles;
     if (newProfiles.includes("audit-scitt/1.0") && !ws.chain_enabled) {
@@ -3299,20 +4089,76 @@ var Coordinator = class {
   opParticipantJoin(p) {
     const miss = missing(p, ["workspace", "from", "type"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    for (const f of ["from", "type"]) {
+      if (typeof p[f] !== "string") return { error: rpcError(E.PARAMS, `${f} must be a string`) };
+    }
+    const type = p.type;
+    const named = participantError(type, p.from, "from");
+    if (named) return named;
+    const bad = paramsError(p, [
+      ["role", "string"],
+      ["display_name", "string"],
+      ["scopes", "strings"],
+      ["capabilities", "object"],
+      ["jwks", "object"],
+      ["jwks.keys", "list"],
+      ["oidc_token", "string"],
+      ["vc_presentation", "object"]
+    ]);
+    if (bad) return bad;
+    if (p.role === "admin" && !ADMIN_TYPES.includes(type)) {
+      return { error: rpcError(E.PARAMS, "The admin role is held by a human or a service") };
+    }
     let ws = this.workspaces.get(p.workspace);
+    const made = ws === void 0;
     if (!ws) {
-      const create = this.opWorkspaceCreate({ workspace: p.workspace });
-      if (create.error) return create;
-      ws = this.workspaces.get(p.workspace);
+      const built = this.buildWorkspace({ workspace: p.workspace });
+      if (built.error) return { error: built.error };
+      ws = built.ws;
     }
     const uri = p.from;
     const now = this.now();
     const existing = ws.members.get(uri);
     let tokenVerified = false;
+    let holderVerified = false;
+    let credentialBound = false;
+    const invitation = existing ? void 0 : rawInvitation(ws, uri);
+    const asked = typeof p.role === "string" && p.role !== "" ? p.role : void 0;
+    let role = asked ?? "participant";
+    if (!existing) {
+      const first = awaitsFirstMember(ws);
+      if (ws.join_policy === "invite" && !invitation && !(first && ADMIN_TYPES.includes(type))) {
+        return { error: rpcError(E.NOT_AUTHORISED, `${uri} has no invitation to this workspace`) };
+      }
+      if (invitation?.role !== void 0) {
+        if (asked === "admin" && invitation.role !== "admin") {
+          return { error: rpcError(E.NOT_AUTHORISED, "The admin role is granted by an admin") };
+        }
+        role = invitation.role;
+      } else if (first && ws.join_policy === "invite") {
+        if (asked !== void 0 && asked !== "admin") {
+          return { error: rpcError(
+            E.PARAMS,
+            "The first member of a workspace that admits by invitation is its admin"
+          ) };
+        }
+        role = "admin";
+      } else if (asked === "admin" && !first) {
+        return { error: rpcError(E.NOT_AUTHORISED, "The admin role is granted by an admin") };
+      }
+    }
+    if (type === "human") {
+      const oidc = this.options.verifyOidcToken !== void 0 && advertises(ws, "identity-oidc");
+      const vc = this.options.verifyVc !== void 0 && advertises(ws, "identity-vc");
+      const presented = oidc && typeof p.oidc_token === "string" || vc && isObject(p.vc_presentation);
+      if ((oidc || vc) && !presented) {
+        return { error: oidc ? rpcError(E.OIDC_TOKEN_INVALID, vc ? "An oidc_token or a vc_presentation is required to join as a human participant" : "An oidc_token is required to join as a human participant") : rpcError(E.VC_VP_INVALID, "A vc_presentation is required to join as a human participant") };
+      }
+    }
     const member = {
       uri,
-      type: p.type,
-      role: p.role || "participant",
+      type,
+      role,
       joined: now,
       display_name: p.display_name,
       capabilities: p.capabilities,
@@ -3320,6 +4166,9 @@ var Coordinator = class {
       keys: [],
       paused: false
     };
+    if (invitation?.oidc_sub !== void 0 && (this.options.verifyOidcToken === void 0 || typeof p.oidc_token !== "string")) {
+      return { error: rpcError(E.OIDC_TOKEN_INVALID, "An oidc_token is required: the invitation names a token subject") };
+    }
     if (this.options.verifyOidcToken && typeof p.oidc_token === "string") {
       const claims = this.options.verifyOidcToken(p.oidc_token);
       if (claims === null) return { error: rpcError(E.OIDC_TOKEN_INVALID, "OIDC token invalid") };
@@ -3328,6 +4177,9 @@ var Coordinator = class {
       if (boundUri != null && boundUri !== uri) {
         return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token is bound to another participant") };
       }
+      if (invitation?.oidc_sub !== void 0 && sub !== invitation.oidc_sub) {
+        return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token subject does not match the invitation") };
+      }
       if (existing) {
         if (existing.oidc_sub != null) {
           if (sub !== existing.oidc_sub) {
@@ -3336,19 +4188,23 @@ var Coordinator = class {
         } else if (boundUri !== uri) {
           return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token does not name this member") };
         }
+      } else if (type === "human" && boundUri !== uri && invitation?.oidc_sub === void 0) {
+        return { error: rpcError(E.OIDC_CNF_MISMATCH, "OIDC token does not name this participant") };
       }
       member.oidc_sub = sub;
       tokenVerified = true;
       const at = claims.auth_time;
-      if (typeof at === "number") member.oidc_auth_time = at;
+      if (typeof at === "number" && Number.isFinite(at) && Math.abs(at) <= Number.MAX_SAFE_INTEGER) member.oidc_auth_time = Math.floor(at);
       member.oidc_acr = typeof claims.acr === "string" ? claims.acr : void 0;
-      const cnf = claims.cnf;
-      const cnfJwk = cnf?.jwk;
-      if (cnfJwk && typeof cnfJwk.kid === "string") {
-        member.keys.push({ jwk: cnfJwk, kid: cnfJwk.kid, valid_from: now });
+      const cnf = isObject(claims.cnf) ? claims.cnf.jwk : void 0;
+      const bound = credentialKeys(cnf, cnf == null ? claims.nonce : void 0, signingKeys(p.jwks));
+      if (bound === null) return { error: rpcError(E.OIDC_CNF_MISMATCH, "The join's keys are not the key the token binds") };
+      if (bound !== void 0) {
+        credentialBound = true;
+        for (const j of bound) member.keys.push({ jwk: j, kid: j.kid, valid_from: now });
       }
     }
-    if (this.options.verifyVc && typeof p.vc_presentation === "object" && p.vc_presentation !== null && !Array.isArray(p.vc_presentation)) {
+    if (this.options.verifyVc && isObject(p.vc_presentation)) {
       const subject = this.options.verifyVc(p.vc_presentation);
       if (subject === null) return { error: rpcError(E.VC_VP_INVALID, "VC presentation invalid") };
       const holder = [subject.holder, subject.id].find(
@@ -3358,21 +4214,54 @@ var Coordinator = class {
         return { error: rpcError(E.VC_HOLDER_BINDING_INVALID, "Presentation holder does not match the member") };
       }
       member.vc_holder = holder;
-      const vpJwk = subject.cnf_jwk;
-      if (vpJwk && typeof vpJwk.kid === "string") {
-        member.keys.push({ jwk: vpJwk, kid: vpJwk.kid, valid_from: now });
+      holderVerified = true;
+      const bound = credentialKeys(subject.cnf_jwk, void 0, signingKeys(p.jwks));
+      if (bound === null) {
+        return { error: rpcError(E.VC_HOLDER_BINDING_INVALID, "The join's keys are not the key the presentation binds") };
+      }
+      if (bound !== void 0) {
+        credentialBound = true;
+        for (const j of bound) member.keys.push({ jwk: j, kid: j.kid, valid_from: now });
       }
     }
+    if (!existing && type === "human" && (tokenVerified || holderVerified) && !credentialBound && !invitation?.jwks && signingKeys(p.jwks).length > 0) {
+      return { error: tokenVerified ? rpcError(E.OIDC_CNF_MISMATCH, "The token binds no key: a person it verifies signs with a key it binds") : rpcError(
+        E.VC_HOLDER_BINDING_INVALID,
+        "The presentation binds no key: a person it verifies signs with a key it binds"
+      ) };
+    }
+    const pinned = invitation?.jwks?.keys;
+    if (pinned) {
+      const strays = [...signingKeys(p.jwks), ...member.keys.map((k) => k.jwk)].filter((j) => !pinned.some((k) => sameKey(k, j)));
+      if (strays.length) {
+        return { error: rpcError(
+          E.NOT_AUTHORISED,
+          `${uri} joins with keys its invitation does not name`,
+          { kids: [...new Set(strays.map((j) => j.kid))] }
+        ) };
+      }
+      member.keys = pinned.map((j) => ({ jwk: j, kid: j.kid, valid_from: now }));
+    }
     const attested = [...member.keys];
-    const jwks = p.jwks;
-    if (jwks?.keys && attested.length === 0) {
-      for (const j of jwks.keys) {
-        if (j.kid && !member.keys.some((k) => k.kid === j.kid)) {
+    if (attested.length === 0) {
+      for (const j of signingKeys(p.jwks)) {
+        if (!member.keys.some((k) => k.kid === j.kid)) {
           member.keys.push({ jwk: j, kid: j.kid, valid_from: now });
         }
       }
     }
     if (existing) {
+      if (attested.length === 0) {
+        const keys = signingKeys(p.jwks);
+        const held = keys.some((j) => existing.keys.some((k) => sameKey(k.jwk, j)));
+        if (keys.length > 0 && !held) {
+          return { error: rpcError(
+            E.NOT_AUTHORISED,
+            `${uri} is already a member, with other keys; a new key arrives through participant.rotate_key`,
+            { kids: [...new Set(keys.map((j) => j.kid))] }
+          ) };
+        }
+      }
       if (member.oidc_sub !== void 0) existing.oidc_sub = member.oidc_sub;
       if (member.oidc_auth_time !== void 0) existing.oidc_auth_time = member.oidc_auth_time;
       if (member.oidc_acr !== void 0) existing.oidc_acr = member.oidc_acr;
@@ -3383,18 +4272,126 @@ var Coordinator = class {
       }
       return { result: { joined: true, as: uri } };
     }
+    if (this.requiresSignatures(ws) && this.mustSign(ws, type) && member.keys.length === 0) {
+      return { error: rpcError(E.PARAMS, `${uri} must sign in this workspace, and joins with no key`) };
+    }
+    if (made) this.addWorkspace(ws);
     ws.members.set(uri, member);
+    if (invitation) ws.invitations.delete(uri);
     return { result: { joined: true, as: uri } };
   }
+  /**
+   * SPECIFICATION 6.3.3: an admin invites a participant. For a URI that is
+   * not a member it records an invitation, which the invitee's join takes
+   * up. For a member that holds no key in force it registers the
+   * invitation's keys: the way back for a member whose keys were all revoked,
+   * or who joined a workspace that requires signatures with none.
+   */
+  opWorkspaceInvite(p) {
+    const miss = missing(p, ["workspace", "from", "uri", "type"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    for (const f of ["uri", "type"]) {
+      if (typeof p[f] !== "string") return { error: rpcError(E.PARAMS, `${f} must be a string`) };
+    }
+    const bad = paramsError(p, [
+      ["role", "string"],
+      ["jwks", "object"],
+      ["jwks.keys", "list"],
+      ["oidc_sub", "string"]
+    ]);
+    if (bad) return bad;
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    if (rawMember(ws, p.from).role !== "admin") {
+      return { error: rpcError(E.NOT_AUTHORISED, "workspace.invite requires the admin role") };
+    }
+    const uri = p.uri;
+    const type = p.type;
+    const named = participantError(type, uri, "uri");
+    if (named) return named;
+    const role = typeof p.role === "string" && p.role !== "" ? p.role : void 0;
+    if (role === "admin" && !ADMIN_TYPES.includes(type)) {
+      return { error: rpcError(E.PARAMS, "The admin role is held by a human or a service") };
+    }
+    const sub = typeof p.oidc_sub === "string" ? p.oidc_sub : void 0;
+    if (sub !== void 0 && this.options.verifyOidcToken === void 0) {
+      return { error: rpcError(E.PARAMS, "oidc_sub names a token subject, and this Coordinator has no token verifier") };
+    }
+    let pinned;
+    if (p.jwks != null) {
+      pinned = signingKeys(p.jwks);
+      if (pinned.length === 0) return { error: rpcError(E.PARAMS, "jwks names no key: each key needs a kid") };
+    }
+    const now = this.now();
+    const member = ws.members.get(uri);
+    if (member) {
+      if (member.keys.some((k) => inForce(k, now))) {
+        return { error: rpcError(
+          E.PARAMS,
+          `${uri} is a member and holds a key in force; its keys change through participant.rotate_key`
+        ) };
+      }
+      if (!pinned) {
+        return { error: rpcError(E.PARAMS, `${uri} is a member; an invitation for a member registers the keys its jwks names`) };
+      }
+      if (this.options.verifyOidcToken !== void 0 && (member.type === "human" || member.oidc_sub !== void 0) || this.options.verifyVc !== void 0 && (member.type === "human" || member.vc_holder !== void 0)) {
+        return { error: rpcError(
+          E.PARAMS,
+          `${uri} registers a new key by joining again with a token that binds it; an invitation does not register a person's keys here`
+        ) };
+      }
+      if (role !== void 0 && role !== member.role || sub !== void 0 && sub !== member.oidc_sub) {
+        return { error: rpcError(E.PARAMS, `${uri} is a member; an invitation for a member registers keys and changes nothing else`) };
+      }
+      const reused = pinned.find((j) => member.keys.some((k) => k.kid === j.kid));
+      if (reused) return { error: rpcError(E.PARAMS, `Key ${reused.kid} was ${uri}'s; a new key takes a new kid`) };
+      for (const j of pinned) member.keys.push({ jwk: j, kid: j.kid, valid_from: now });
+      return { result: { invited: true, uri, registered: pinned.map((j) => j.kid) } };
+    }
+    if (pinned && (type === "human" || sub !== void 0) && (this.options.verifyOidcToken !== void 0 || this.options.verifyVc !== void 0)) {
+      return { error: rpcError(
+        E.PARAMS,
+        `${uri} joins with a token that binds its key; an invitation does not register a person's keys here`
+      ) };
+    }
+    const invitation = {
+      uri,
+      type,
+      invited_by: p.from,
+      invited_at: now
+    };
+    if (role !== void 0) invitation.role = role;
+    if (pinned) invitation.jwks = { keys: pinned };
+    if (sub !== void 0) invitation.oidc_sub = sub;
+    ws.invitations.set(uri, invitation);
+    return { result: { invited: true, uri } };
+  }
   opParticipantLeave(p) {
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    if (rawMember(ws, p.from)?.paused) {
+      return { error: rpcError(E.NOT_AUTHORISED, "A paused participant does not leave until another member lifts its pause") };
+    }
     ws.members.delete(p.from);
     return { result: { left: true } };
   }
   opTaskCreate(p) {
     const miss = missing(p, ["workspace", "from", "kind", "input"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const bad = paramsError(p, [
+      ["assignee", "string"],
+      ["to", "string"],
+      ["mode", "string"],
+      ["review_required", "boolean"],
+      ["routing_hints", "object"],
+      ["idempotency_key", "string"]
+    ]);
+    if (bad) return bad;
+    if (RESERVED_KEYS.includes(p.idempotency_key)) {
+      return { error: rpcError(E.PARAMS, "idempotency_key must not be __proto__, constructor or prototype") };
+    }
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
@@ -3406,9 +4403,6 @@ var Coordinator = class {
     if (ws.members.get(assignee).paused) {
       return { error: rpcError(E.CONTROL_WORKSPACE_PAUSED, `Assignee ${assignee} is paused`) };
     }
-    if (p.mode !== void 0 && p.mode !== null && typeof p.mode !== "string") {
-      return { error: rpcError(E.PARAMS, "mode must be a string") };
-    }
     const requestedMode = p.mode || ws.mode;
     if (!modeLE(requestedMode, ws.mode_ceiling)) {
       return { error: rpcError(
@@ -3416,9 +4410,6 @@ var Coordinator = class {
         `Requested mode ${requestedMode} exceeds ceiling ${ws.mode_ceiling}`
       ) };
     }
-    if (p.review_required !== void 0 && p.review_required !== null && typeof p.review_required !== "boolean") {
-      return { error: rpcError(E.PARAMS, "review_required must be a boolean") };
-    }
     const taskId = this.ids.taskId();
     const now = this.now();
     const task = {
@@ -3457,6 +4448,7 @@ var Coordinator = class {
     if (notMember) return notMember;
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (typeof p.state !== "string") return { error: rpcError(E.PARAMS, "state must be a string") };
     const newState = p.state;
     const legal = {
       created: ["in_progress", "declined"],
@@ -3467,12 +4459,42 @@ var Coordinator = class {
     if (!legal[task.state]?.includes(newState)) {
       return { error: rpcError(E.PARAMS, `Illegal transition ${task.state} -> ${newState}`) };
     }
-    if (newState === "completed" && task.review_required) {
+    if (newState === "completed" && reviewRequired(ws, task)) {
       return { error: rpcError(
         E.PARAMS,
         "This task requires review. Submit the output with task.complete, which opens the review; a reviewer decision completes it."
       ) };
     }
+    if (newState === "completed" && task.review) {
+      return { error: rpcError(
+        E.PARAMS,
+        "This task holds a review. Submit the output with task.complete, which opens a new round; a reviewer decision completes it."
+      ) };
+    }
+    if (task.state === "review_requested" && !task.review.authors.includes(p.from)) {
+      return { error: rpcError(
+        E.NOT_AUTHORISED,
+        "Only the authors of the work under review take it back from review"
+      ) };
+    }
+    if (newState === "cancelled" && openRequiredReviewAuthors(ws, task).includes(p.from)) {
+      return { error: rpcError(
+        E.NOT_AUTHORISED,
+        "The authors of the work under review cannot end its review without a decision"
+      ) };
+    }
+    if (newState === "declined" && task.review && !task.review.decisions.some((d) => d.kind === "reject")) {
+      return { error: rpcError(
+        E.PARAMS,
+        "This task holds a review no decision has closed; a reviewer's decision ends it"
+      ) };
+    }
+    if (newState === "declined" && !task.review && openRequiredReviewAuthors(ws, task).length > 0) {
+      return { error: rpcError(
+        E.PARAMS,
+        "This task carries on a review no decision has closed; completing it opens the review a reviewer decides"
+      ) };
+    }
     task.state = newState;
     task.updated_at = this.now();
     task.history.push({
@@ -3493,42 +4515,60 @@ var Coordinator = class {
     if (task.state !== "created" && task.state !== "in_progress") {
       return { error: rpcError(E.PARAMS, `Cannot complete task in state: ${task.state}`) };
     }
-    if (task.review_required) {
+    if (p.confidence != null && typeof p.confidence !== "number" && typeof p.confidence !== "string") {
+      return { error: rpcError(E.PARAMS, "confidence must be a number or a string") };
+    }
+    const required = reviewRequired(ws, task);
+    if (required && p.from !== task.assignee) {
+      return { error: rpcError(E.NOT_AUTHORISED, "Only the assignee completes a task that requires review") };
+    }
+    if (required || task.review) {
       const now = this.now();
+      const authors = authorsOf(task, p.from);
+      let note = OPENED_ON_COMPLETE;
       if (!task.review) {
-        const producer = p.from;
-        const eligible = [...rawEntries(ws.members)].filter(([uri, member]) => uri !== producer && uri !== task.assignee && member.type === "human").map(([uri]) => uri);
+        const eligible = [...rawEntries(ws.members)].filter(([uri, member]) => !authors.includes(uri) && member.type === "human").map(([uri]) => uri);
         if (eligible.length === 0) {
           return { error: rpcError(
             E.NOT_AUTHORISED,
             "Task requires review but has no eligible human reviewer (needs a human member other than its assignee and completer)"
           ) };
         }
-        task.review = { requested_at: now, requested_to: eligible, rule: "any_one_approves", decisions: [] };
+        task.review = {
+          requested_at: now,
+          requested_to: eligible,
+          rule: ws.review_rule ?? "any_one_approves",
+          decisions: [],
+          authors,
+          acknowledgements: []
+        };
       } else {
-        const author = p.from;
-        const reviewers = task.review.requested_to.filter((r) => r !== author);
+        const roundAuthors = unionOf(task.review.authors, authors);
+        const reviewers = task.review.requested_to.filter((r) => !roundAuthors.includes(r) && !(required && rawMember(ws, r) !== void 0 && rawMember(ws, r).type !== "human"));
         if (reviewers.length === 0) {
           return { error: rpcError(
             E.NOT_AUTHORISED,
-            "Task requires review but has no reviewer other than its completer"
+            "No reviewer of this task remains once the authors of the work are left out"
           ) };
         }
-        task.review = { ...task.review, requested_at: now, requested_to: reviewers, decisions: [] };
+        task.review = {
+          ...task.review,
+          requested_at: now,
+          requested_to: reviewers,
+          decisions: [],
+          authors: roundAuthors,
+          acknowledgements: []
+        };
+        note = NEW_ROUND_ON_COMPLETE;
       }
       task.pending_artefact = p.output;
       task.state = "review_requested";
       task.updated_at = now;
-      task.history.push({
-        ts: now,
-        from: p.from,
-        state: "review_requested",
-        note: "review required; opened on task.complete"
-      });
+      task.history.push({ ts: now, from: p.from, state: "review_requested", note });
       return { result: { state: "review_requested", review_id: task.id } };
     }
     task.output = p.output;
-    if (typeof p.confidence === "number" || typeof p.confidence === "string") task.confidence = p.confidence;
+    if (p.confidence != null) task.confidence = p.confidence;
     task.state = "completed";
     task.updated_at = this.now();
     task.history.push({ ts: task.updated_at, from: p.from, state: "completed" });
@@ -3541,8 +4581,16 @@ var Coordinator = class {
       const notMember = this.requireMember(ws, p.from);
       if (notMember) return notMember;
     }
-    const range = p.range ?? {};
-    const filter = p.filter ?? {};
+    const bad = paramsError(p, [
+      ["range.from_seq", "integer"],
+      ["range.to_seq", "integer"],
+      ["filter.method", "string"],
+      ["filter.from", "string"],
+      ["filter.task_id", "string"]
+    ]);
+    if (bad) return bad;
+    const range = isObject(p.range) ? p.range : {};
+    const filter = isObject(p.filter) ? p.filter : {};
     if (filter.outcome != null && filter.outcome !== "accepted" && filter.outcome !== "refused") {
       return { error: rpcError(E.PARAMS, "filter.outcome must be 'accepted' or 'refused'") };
     }
@@ -3593,37 +4641,73 @@ var Coordinator = class {
       return { error: rpcError(E.NOT_REVIEWABLE, `Cannot request review for task in state: ${task.state}`) };
     }
     const to = p.to;
+    if (to != null && typeof to !== "string" && !(Array.isArray(to) && to.every((r) => typeof r === "string"))) {
+      return { error: rpcError(E.PARAMS, "to must be a string or a list of strings") };
+    }
     const reviewers = Array.isArray(to) ? to : typeof to === "string" ? [to] : [];
     if (!reviewers.length) return { error: rpcError(E.PARAMS, "review.request needs 'to'") };
+    const bad = paramsError(p, [["rule", "string"]]);
+    if (bad) return bad;
     const now = this.now();
     const declaredRule = p.rule;
     const rule = declaredRule || "any_one_approves";
     if (!reviewRuleSupported(rule)) {
       return { error: rpcError(E.PARAMS, `Unsupported review rule ${JSON.stringify(rule)}: review/1.0 supports any_one_approves, all_approve, quorum:<n>`) };
     }
-    if (task.state === "review_requested" && task.review) {
-      if (contentHash(task.pending_artefact) !== contentHash(p.artefact)) {
+    const open = task.state === "review_requested" ? task.review : void 0;
+    if (open) {
+      if (contentHash(task.pending_artefact ?? null) !== contentHash(p.artefact ?? null)) {
         return { error: rpcError(
           E.REVIEW_ALREADY_OPEN,
           "A review is already open on this task with different content. Decide, abstain, escalate or cancel it before requesting review of a new artefact."
         ) };
       }
-      if (declaredRule !== void 0 && declaredRule !== task.review.rule) {
+      if (declaredRule != null && declaredRule !== open.rule) {
         return { error: rpcError(
           E.REVIEW_ALREADY_OPEN,
-          `Cannot change the decision rule of an open review (currently ${task.review.rule})`
+          `Cannot change the decision rule of an open review (currently ${open.rule})`
+        ) };
+      }
+    }
+    const authors = open ? open.authors : unionOf(task.review ? task.review.authors : [], authorsOf(task, lastCompleter(task)));
+    if (reviewRequired(ws, task)) {
+      if (!open) {
+        return { error: rpcError(
+          E.NOT_AUTHORISED,
+          "This task requires a person's review, which opens on task.complete; review.request only adds reviewers to it once it is open"
+        ) };
+      }
+      if (authors.includes(p.from)) {
+        return { error: rpcError(E.NOT_AUTHORISED, "The author of the work under review cannot request its review") };
+      }
+      const scope = reviewers.find(isScope);
+      if (scope !== void 0) {
+        return { error: rpcError(
+          E.PARAMS,
+          `A review that requires a person names its reviewers, and ${scope} is an address scope`
         ) };
       }
       for (const r of reviewers) {
-        if (!task.review.requested_to.includes(r)) task.review.requested_to.push(r);
+        if (authors.includes(r)) {
+          return { error: rpcError(E.NOT_AUTHORISED, `The author of the work under review cannot review it: ${r}`) };
+        }
+        const member = rawMember(ws, r);
+        if (member && member.type !== "human") {
+          return { error: rpcError(E.NOT_AUTHORISED, `This task requires a person's review: ${r} is not a human member`) };
+        }
       }
-      if (p.deadline !== void 0) task.review.deadline = p.deadline;
+    }
+    if (open) {
+      for (const r of reviewers) {
+        if (!open.requested_to.includes(r)) open.requested_to.push(r);
+      }
+      if (p.deadline != null) open.deadline = p.deadline;
       task.updated_at = now;
       return { result: {
         state: "review_requested",
         review_id: task.id,
         amended: true,
-        requested_to: [...task.review.requested_to]
+        requested_to: [...open.requested_to]
       } };
     }
     task.state = "review_requested";
@@ -3633,12 +4717,41 @@ var Coordinator = class {
       requested_to: reviewers,
       rule,
       deadline: p.deadline,
-      decisions: []
+      decisions: [],
+      authors,
+      acknowledgements: []
     };
     task.history.push({ ts: now, from: p.from, state: "review_requested" });
     task.pending_artefact = p.artefact;
     return { result: { state: "review_requested", review_id: task.id } };
   }
+  /**
+   * review/1.0 S3.6: a reviewer says they have begun the open review. Only
+   * someone who may decide it can, so the log's record of who took a review
+   * up, and when, names reviewers alone. It changes nothing else: the review
+   * stays open and the acknowledgement counts towards no rule.
+   */
+  opReviewAcknowledge(p) {
+    const miss = missing(p, ["workspace", "from", "task_id"]);
+    if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const ws = this.workspaces.get(p.workspace);
+    if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    const task = ws.tasks.get(p.task_id);
+    if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
+    if (task.state !== "review_requested") {
+      return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
+    }
+    const notReviewer = this.requireReviewer(ws, task, p.from);
+    if (notReviewer) return notReviewer;
+    const review = task.review;
+    if (review.acknowledgements.some((a) => a.reviewer === p.from)) {
+      return { error: rpcError(E.PARAMS, "Already acknowledged in this round") };
+    }
+    review.acknowledgements.push({ reviewer: p.from, ts: this.now() });
+    return { result: { acknowledged: true, requested_at: review.requested_at } };
+  }
   /**
    * Verify an optional `approved_artefact_digest` against the artefact under
    * review (review/1.0 S3.2).
@@ -3657,7 +4770,7 @@ var Coordinator = class {
     if (typeof declared !== "string") {
       return { error: rpcError(E.PARAMS, "approved_artefact_digest must be a string") };
     }
-    if (task.pending_artefact === void 0) {
+    if (task.pending_artefact === void 0 || task.pending_artefact === null) {
       return { error: rpcError(E.PARAMS, "No artefact under review to bind a digest to") };
     }
     const actual = contentHash(task.pending_artefact);
@@ -3673,8 +4786,8 @@ var Coordinator = class {
   opDecide(p, kind) {
     const miss = missing(p, ["workspace", "from", "task_id"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
-    const badTags = tagsError(p);
-    if (badTags) return badTags;
+    const bad = paramsError(p, [["tags", "strings"], ["request_revision", "boolean"]]);
+    if (bad) return bad;
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
@@ -3684,7 +4797,7 @@ var Coordinator = class {
     if (task.state !== "review_requested") {
       return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
     }
-    const notReviewer = this.requireReviewer(task, p.from);
+    const notReviewer = this.requireReviewer(ws, task, p.from);
     if (notReviewer) return notReviewer;
     const digestError = this.checkArtefactDigest(p, task);
     if (digestError) return digestError;
@@ -3711,8 +4824,8 @@ var Coordinator = class {
   opDecideOverride(p) {
     const miss = missing(p, ["workspace", "from", "task_id", "diff", "rationale"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
-    const badTags = tagsError(p);
-    if (badTags) return badTags;
+    const bad = paramsError(p, [["tags", "strings"], ["policy_refs", "strings"]]);
+    if (bad) return bad;
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
@@ -3722,12 +4835,12 @@ var Coordinator = class {
     if (task.state !== "review_requested") {
       return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
     }
-    const notReviewer = this.requireReviewer(task, p.from);
+    const notReviewer = this.requireReviewer(ws, task, p.from);
     if (notReviewer) return notReviewer;
     const digestError = this.checkArtefactDigest(p, task);
     if (digestError) return digestError;
     const base = task.pending_artefact;
-    if (base === void 0) return { error: rpcError(E.PARAMS, "No base artefact for override") };
+    if (base === void 0 || base === null) return { error: rpcError(E.PARAMS, "No base artefact for override") };
     let applied;
     try {
       applied = applyJsonPatch(base, p.diff, {
@@ -3771,6 +4884,8 @@ var Coordinator = class {
   opAbstainDeclare(p) {
     const miss = missing(p, ["workspace", "from", "task_id", "reason"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
+    const bad = paramsError(p, [["category", "string"]]);
+    if (bad) return bad;
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
     const notMember = this.requireMember(ws, p.from);
@@ -3780,7 +4895,7 @@ var Coordinator = class {
     if (task.state !== "review_requested") {
       return { error: rpcError(E.NOT_REVIEWABLE, `Task not awaiting review: ${task.state}`) };
     }
-    const notReviewer = this.requireReviewer(task, p.from);
+    const notReviewer = this.requireReviewer(ws, task, p.from);
     if (notReviewer) return notReviewer;
     const now = this.now();
     task.review.decisions.push({
@@ -3812,6 +4927,8 @@ var Coordinator = class {
       return { error: rpcError(E.PARAMS, "new_task must be an object") };
     }
     const nt = p.new_task;
+    const bad = paramsError(p, [["new_task.kind", "string"]]);
+    if (bad) return bad;
     const assignee = nt.assignee;
     if (typeof assignee !== "string" || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "Escalation assignee not in workspace") };
@@ -3846,9 +4963,10 @@ var Coordinator = class {
       history: [{ ts: now, from: p.from, state: "created", note: `escalated from ${orig.id}` }],
       paused: false
     };
-    if (orig.review_required || ws.profiles.some((pr) => pr.startsWith("modes/")) && newTask.mode === "trial") {
+    if (orig.review_required || orig.review !== void 0 || ws.profiles.some((pr) => pr.startsWith("modes/")) && newTask.mode === "trial") {
       newTask.review_required = true;
     }
+    newTask.prior_authors = successorAuthors(orig, p.from);
     ws.tasks.set(newId, newTask);
     orig.state = "escalated";
     orig.updated_at = now;
@@ -3865,8 +4983,8 @@ function memberToDict(m) {
     joined: m.joined
   };
   if (m.display_name) out.display_name = m.display_name;
-  if (m.capabilities) out.capabilities = m.capabilities;
-  if (m.scopes) out.scopes = m.scopes;
+  if (m.capabilities && Object.keys(m.capabilities).length) out.capabilities = m.capabilities;
+  if (m.scopes?.length) out.scopes = m.scopes;
   if (m.keys.length) {
     out.jwks = { keys: m.keys.filter((k) => !k.revoked_at && !k.valid_until).map((k) => k.jwk) };
     out.key_history = m.keys;
@@ -3878,7 +4996,6 @@ function memberToDict(m) {
 }
 
 // src/policy.ts
-var CRIT2 = { low: 0, medium: 1, high: 2, critical: 3 };
 function makeDefaultPolicy(seniorTarget) {
   const routingPolicy = (task, candidates) => {
     const eligible = candidates;
@@ -3896,15 +5013,8 @@ function makeDefaultPolicy(seniorTarget) {
     };
   };
   const reviewDepthPolicy = (_task, hints) => {
-    const crit = hints.criticality ?? "medium";
-    let conf = 1;
-    try {
-      conf = Number(hints.confidence ?? 1);
-    } catch {
-      conf = 1;
-    }
-    if (isNaN(conf)) conf = 1;
-    const r = CRIT2[crit] ?? 1;
+    const conf = confidenceOf(hints);
+    const r = criticalityOf(hints);
     if (r >= 3) return {
       depth: "full",
       rationale: { policy_id: "default", summary: "criticality=critical: full review" }
@@ -3929,15 +5039,8 @@ function makeDefaultPolicy(seniorTarget) {
     };
   };
   const escalationPolicy = (_task, hints) => {
-    const crit = hints.criticality ?? "medium";
-    let conf = 1;
-    try {
-      conf = Number(hints.confidence ?? 1);
-    } catch {
-      conf = 1;
-    }
-    if (isNaN(conf)) conf = 1;
-    const r = CRIT2[crit] ?? 1;
+    const conf = confidenceOf(hints);
+    const r = criticalityOf(hints);
     const escalate = r >= 3 || r >= 2 && conf < 0.6;
     return {
       escalate,
@@ -3957,6 +5060,19 @@ function wrapMcpToolCall(coord, workspace, options) {
   if (!workspace) throw new Error("workspace is required");
   if (!options.caller) throw new Error("caller is required");
   if (!options.tool) throw new Error("tool is required");
+  if (options.reviewRequired) {
+    const described = coord.dispatch({
+      jsonrpc: "2.0",
+      id: `wrap-${options.tool}-describe`,
+      method: "workspace.describe",
+      params: { workspace, from: options.caller }
+    });
+    if (described.error) throw new Error(`workspace.describe failed: ${JSON.stringify(described.error)}`);
+    const members = described.result.members;
+    if (!members.some((m) => m.type === "human" && m.uri !== options.caller)) {
+      throw new Error("review_required needs a human member other than the caller to review the result; nothing was recorded");
+    }
+  }
   const inputHash = contentHash(options.args);
   const outputHash = contentHash(options.result);
   const kind = options.taskKind ?? `mcp_call:${options.tool}`;
@@ -3975,6 +5091,7 @@ function wrapMcpToolCall(coord, workspace, options) {
     input: options.args
   };
   if (options.routingHints) createParams.routing_hints = { ...options.routingHints };
+  if (options.reviewRequired) createParams.review_required = true;
   const createResp = coord.dispatch({
     jsonrpc: "2.0",
     id: `wrap-${options.tool}-create`,
@@ -4004,7 +5121,7 @@ function wrapMcpToolCall(coord, workspace, options) {
     method: "task.complete",
     params: completeParams
   });
-  if (completeResp.error) throw new Error(`task.complete failed: ${JSON.stringify(completeResp.error)}`);
+  if (completeResp.error) throw new Error(`task.complete failed for ${taskId}: ${JSON.stringify(completeResp.error)}`);
   return { task_id: taskId, input_hash: inputHash, output_hash: outputHash };
 }
 function wrapA2aMessageExchange(coord, workspace, options) {