@cello-protocol/daemon 0.0.23 → 0.0.25

package/dist/bin/cello-daemon.js

@@ -13,9 +13,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { startDaemon } from "../daemon.js";
 import { createDirectoryEndpointResolver } from "../directory-bootstrap.js";
-import { FileManifestProvider } from "../file-manifest-provider.js";
-import { RandomizedPollScheduler } from "../manifest-poll-scheduler.js";
-import { ManifestDirectoryChallengeVerifier } from "@cello-protocol/transport";
+import { buildManifestDeps } from "../manifest-deps.js";
 const MAX_CONNECTIONS = 16;
 // Composition root: stdout JSON logger
 const logger = {
@@ -40,73 +38,26 @@ const celloDir = process.env.CELLO_DIR || join(homedir(), ".cello");
 const socketPath = join(celloDir, "daemon.sock");
 const lockFilePath = join(celloDir, "daemon.lock");
 const version = process.env.CELLO_VERSION || "0.0.1";
-/**
- * Build the optional consortium-manifest deps from the environment (M7 J-AUTH).
- *
- *   CELLO_CONSORTIUM_MANIFEST    absolute path to the manifest JSON
- *   CELLO_CONSORTIUM_ROOT_KEYS   comma-separated officer root pubkeys (hex)
- *   CELLO_CONSORTIUM_THRESHOLD   minimum officer signatures (integer)
- *
- * When the manifest path is unset, returns {} — step-6 stays off (M6 compat).
- * One FileManifestProvider instance is shared between startDaemon's loadAndVerify
- * call and the ManifestDirectoryChallengeVerifier, so step-6 reads the same cached,
- * verified manifest.
- */
-function buildManifestDeps(logger) {
-    const manifestPath = process.env.CELLO_CONSORTIUM_MANIFEST;
-    if (!manifestPath)
-        return {};
-    const rootKeysRaw = process.env.CELLO_CONSORTIUM_ROOT_KEYS ?? "";
-    const manifestRootKeys = rootKeysRaw.split(",").map((k) => k.trim()).filter((k) => k.length > 0);
-    const manifestThreshold = Number.parseInt(process.env.CELLO_CONSORTIUM_THRESHOLD ?? "", 10);
-    if (manifestRootKeys.length === 0 || Number.isNaN(manifestThreshold)) {
-        throw new Error("CELLO_CONSORTIUM_MANIFEST is set but CELLO_CONSORTIUM_ROOT_KEYS / CELLO_CONSORTIUM_THRESHOLD are missing or invalid");
-    }
-    const manifestProvider = new FileManifestProvider({ path: manifestPath });
-    const challengeVerifier = new ManifestDirectoryChallengeVerifier(manifestProvider);
-    // Anti-rollback (DOD-AUTH-2 / TUF): the last-verified manifest version is persisted to refuse a
-    // manifest whose version regressed across restarts. PERSIST-002 (AC-008): this now lives in the
-    // encrypted manifest_state table (a manifest-version.json file is no longer written) — startDaemon
-    // constructs the DB-backed store itself after opening the DB, so the bin injects nothing here.
-    // DOD-AUTH-2: background manifest poll. The directory is re-polled on a randomized
-    // 6–12h interval (thundering-herd avoidance) and a newer signed manifest is adopted.
-    // The interval is env-injectable so the live binary test can poll sub-second instead
-    // of waiting hours; production leaves these unset → the 6–12h default window.
-    // Both-or-neither, positive, min <= max — a partial/invalid override fails LOUDLY
-    // rather than silently reverting to 6–12h or producing a negative (tight-loop) delay.
-    const rawPollMin = process.env.CELLO_MANIFEST_POLL_MIN_MS;
-    const rawPollMax = process.env.CELLO_MANIFEST_POLL_MAX_MS;
-    let pollOpts;
-    if (rawPollMin !== undefined || rawPollMax !== undefined) {
-        const minMs = Number.parseInt(rawPollMin ?? "", 10);
-        const maxMs = Number.parseInt(rawPollMax ?? "", 10);
-        if (Number.isNaN(minMs) || Number.isNaN(maxMs) || minMs <= 0 || maxMs < minMs) {
-            throw new Error("CELLO_MANIFEST_POLL_MIN_MS / _MAX_MS must BOTH be set to positive integers with min <= max");
-        }
-        pollOpts = { minMs, maxMs };
-    }
-    const manifestPollScheduler = new RandomizedPollScheduler(pollOpts);
-    logger.info("daemon.manifest.configured", {
-        manifestPath,
-        rootKeyCount: manifestRootKeys.length,
-        threshold: manifestThreshold,
-        pollMinMs: pollOpts?.minMs ?? null,
-        pollMaxMs: pollOpts?.maxMs ?? null,
-    });
-    return { manifestProvider, manifestRootKeys, manifestThreshold, challengeVerifier, manifestPollScheduler };
-}
 async function main() {
     // M7 Keystone (Part 1): give the daemon its door to the directory. The resolver
     // discovers the directory endpoint via GET ${CELLO_DIRECTORY_URL}/bootstrap (the
     // proven M6 path); startDaemon builds the real signalingConnect from it + the
     // primary agent identity.
-    const directoryEndpointResolver = createDirectoryEndpointResolver({ logger });
-    // M7 J-AUTH (DOD-AUTH-1/2): the consortium-manifest hardening is OPT-IN. When the
-    // operator (or the live harness) configures a manifest, the daemon loads + verifies
-    // it (threshold officer signatures + validity window) and verifies the directory's
-    // step-6 identity proof against the node pubkeys in that manifest. When unset, the
-    // daemon runs the M6 backward-compat path: no challengeVerifier → step-6 skipped.
-    // Both dialers (keystone + per-agent) receive the verifier via startDaemon.
+    // FINDING-4: this resolver is wrapped by the daemon's roster-aware failover resolver, which owns
+    // ALL fallback semantics (roster + sticky). staleFallback:false makes it report a dead primary as
+    // null on a fresh /bootstrap failure — WITHOUT it, the wrapper would keep receiving the stale dead
+    // endpoint and never fail over (the exact live kill-primary bug). The roster is the real fallback.
+    const directoryEndpointResolver = createDirectoryEndpointResolver({ logger, staleFallback: false });
+    // M7 J-AUTH (DOD-AUTH-1/2) + FINDING-4: consortium-manifest deps. buildManifestDeps chooses:
+    //   - DEFAULT (no CELLO_CONSORTIUM_MANIFEST) — load the COMPILED-IN production roster + step-6
+    //     directory identity auth, so a cold-boot daemon knows every directory and can fail over to a
+    //     reachable one (redundancy invariant). Gated on CELLO_DIRECTORY_URL actually being a bundled
+    //     node — a daemon pointed at a local/non-bundled directory (local dev, e2e spine harness) gets
+    //     the M6 backward-compat path (no roster, no step-6) instead of wrongly failing step-6.
+    //   - OVERRIDE (CELLO_CONSORTIUM_MANIFEST set) — operator-supplied manifest FILE + env root keys /
+    //     threshold + optional /manifest poll (the pre-FINDING-4 opt-in path).
+    // When a manifest is active, the daemon verifies the directory's step-6 identity proof against the
+    // node pubkeys in it. Both dialers (keystone + per-agent) receive the verifier via startDaemon.
     const manifest = buildManifestDeps(logger);
     const handle = await startDaemon({
         celloDir,

package/dist/bin/cello-daemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"cello-daemon.js","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,OAAO,EAAE,kCAAkC,EAAqH,MAAM,2BAA2B,CAAC;AAElM,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,uCAAuC;AACvC,MAAM,MAAM,GAAW;IACrB,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,MAAc;IAQvC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAC3D,IAAI,CAAC,YAAY;QAAE,OAAO,EAAE,CAAC;IAE7B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACjE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjG,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,MAAM,iBAAiB,GAAG,IAAI,kCAAkC,CAAC,gBAAgB,CAAC,CAAC;IACnF,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,mFAAmF;IACnF,qFAAqF;IACrF,qFAAqF;IACrF,8EAA8E;IAC9E,kFAAkF;IAClF,sFAAsF;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1D,IAAI,QAAsD,CAAC;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,qBAAqB,GAAG,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;QACxC,YAAY;QACZ,YAAY,EAAE,gBAAgB,CAAC,MAAM;QACrC,SAAS,EAAE,iBAAiB;QAC5B,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;QAClC,SAAS,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;KACnC,CAAC,CAAC;IACH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,0BAA0B;IAC1B,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAE9E,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,mFAAmF;IACnF,kFAAkF;IAClF,4EAA4E;IAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,eAAe;QAC/B,OAAO;QACP,MAAM;QACN,yBAAyB;QACzB,GAAG,QAAQ;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;QACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cello-daemon.js","sourceRoot":"","sources":["../../src/bin/cello-daemon.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,uCAAuC;AACvC,MAAM,MAAM,GAAW;IACrB,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,KAAa,EAAE,OAAgC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,KAAa,EAAE,OAAgC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACjD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC;AAErD,KAAK,UAAU,IAAI;IACjB,gFAAgF;IAChF,iFAAiF;IACjF,8EAA8E;IAC9E,0BAA0B;IAC1B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,mGAAmG;IACnG,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpG,6FAA6F;IAC7F,+FAA+F;IAC/F,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,4FAA4F;IAC5F,mGAAmG;IACnG,2EAA2E;IAC3E,mGAAmG;IACnG,gGAAgG;IAChG,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;QAC/B,QAAQ;QACR,UAAU;QACV,YAAY;QACZ,cAAc,EAAE,eAAe;QAC/B,OAAO;QACP,MAAM;QACN,yBAAyB;QACzB,GAAG,QAAQ;KACZ,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE;QACvD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC;YACH,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACzC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,SAAS;oBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACxC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBACrC,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;QACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/bundled-consortium-manifest.d.ts

@@ -0,0 +1,45 @@
+/**
+ * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
+ *
+ * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
+ * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
+ * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
+ * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
+ * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
+ * roster-aware dialer was correct but the roster was empty), so a single directory being down
+ * stranded the client at startup, violating the redundancy invariant.
+ *
+ * Trust model:
+ *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
+ *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
+ *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
+ *     network adversary).
+ *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
+ *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
+ *     to) a directory, the directory must sign the client's challenge with the matching node key,
+ *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
+ *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
+ *     adversarial defense; it is enabled by default alongside the roster.
+ *
+ * nodeId MUST equal the directory's reported NODE_ID (its AWS region string); the step-6 verifier
+ * looks the node up by nodeId. pubkey MUST equal /cello/<env>/directory/manifest-signer-pubkey for
+ * that region (derived from the directory's node-private-key). endpoint is the HTTP /bootstrap base.
+ *
+ * Regeneration: on directory node-key or officer-key rotation, re-sign with
+ * infra/scripts/sign-consortium-manifest and update this constant + BUNDLED_CONSORTIUM_ROOT_KEYS.
+ * The officer signing key lives in Secrets Manager (cello/<env>/consortium/officer-key-0); only its
+ * PUBLIC key is embedded here.
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
+ */
+import type { ConsortiumManifestInput } from "@cello-protocol/crypto";
+/** The signed consortium manifest (roster of sovereign directory nodes). */
+export declare const BUNDLED_CONSORTIUM_MANIFEST: ConsortiumManifestInput;
+/**
+ * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
+ * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
+ */
+export declare const BUNDLED_CONSORTIUM_ROOT_KEYS: readonly string[];
+/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
+export declare const BUNDLED_CONSORTIUM_THRESHOLD = 1;
+//# sourceMappingURL=bundled-consortium-manifest.d.ts.map

package/dist/bundled-consortium-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-consortium-manifest.d.ts","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEtE,4EAA4E;AAC5E,eAAO,MAAM,2BAA2B,EAAE,uBAkCzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAEzD,CAAC;AAEF,uGAAuG;AACvG,eAAO,MAAM,4BAA4B,IAAI,CAAC"}

package/dist/bundled-consortium-manifest.js

@@ -0,0 +1,79 @@
+/**
+ * FINDING-4 — the bundled consortium roster (sovereign-node REDUNDANCY invariant).
+ *
+ * This is the signed list of the sovereign directory nodes that make up the CELLO consortium,
+ * COMPILED INTO the client. It is loaded by default (when the operator does not override it via
+ * CELLO_CONSORTIUM_MANIFEST) so that a cold-boot daemon already knows every directory — and can
+ * fail over to a reachable one — even when its configured/primary directory is unreachable. Without
+ * a bundled roster the failover resolver has nothing to route to (the exact FINDING-4 gap: the
+ * roster-aware dialer was correct but the roster was empty), so a single directory being down
+ * stranded the client at startup, violating the redundancy invariant.
+ *
+ * Trust model:
+ *   - The manifest is threshold-signed by the consortium officer key(s). At load the client
+ *     RE-VERIFIES it against BUNDLED_CONSORTIUM_ROOT_KEYS (a self-consistency / anti-corruption
+ *     gate — the manifest and root keys ship together, so this catches a bad regeneration, not a
+ *     network adversary).
+ *   - The node `pubkey`s are the directories' Ed25519 node keys. They are the trust anchor for
+ *     step-6 directory identity auth (M7-MANIFEST-002): when the client connects to (or fails over
+ *     to) a directory, the directory must sign the client's challenge with the matching node key,
+ *     proving it is the real consortium node for that nodeId — defeating a MITM on the plaintext
+ *     /bootstrap that would otherwise redirect the client to a rogue directory. THIS is the
+ *     adversarial defense; it is enabled by default alongside the roster.
+ *
+ * nodeId MUST equal the directory's reported NODE_ID (its AWS region string); the step-6 verifier
+ * looks the node up by nodeId. pubkey MUST equal /cello/<env>/directory/manifest-signer-pubkey for
+ * that region (derived from the directory's node-private-key). endpoint is the HTTP /bootstrap base.
+ *
+ * Regeneration: on directory node-key or officer-key rotation, re-sign with
+ * infra/scripts/sign-consortium-manifest and update this constant + BUNDLED_CONSORTIUM_ROOT_KEYS.
+ * The officer signing key lives in Secrets Manager (cello/<env>/consortium/officer-key-0); only its
+ * PUBLIC key is embedded here.
+ *
+ * Crypto reference: RFC 8032 (Ed25519 threshold signatures, verified by verifyManifest).
+ */
+/** The signed consortium manifest (roster of sovereign directory nodes). */
+export const BUNDLED_CONSORTIUM_MANIFEST = {
+    version: 1,
+    not_before: "2026-01-01T00:00:00Z",
+    expires: "2030-01-01T00:00:00Z",
+    nodes: [
+        {
+            nodeId: "us-east-1",
+            pubkey: "167ca6b145bfdd3696af8f4befd883c3dc610f4a9c8d52a30f6a22f669dc27b5",
+            region: "us-east-1",
+            provider: "aws",
+            endpoint: "http://directory-us1.cello.mygentic.ai",
+        },
+        {
+            nodeId: "eu-central-1",
+            pubkey: "8105b180b753d97b50039a7e94433fd2b419f43d61f9ad7caf2ac15ad5cd1b45",
+            region: "eu-central-1",
+            provider: "aws",
+            endpoint: "http://directory-eu1.cello.mygentic.ai",
+        },
+        {
+            nodeId: "ap-northeast-1",
+            pubkey: "9b4b673a16487ba47363e3eaff844bf68f19736d82967918fb896b813e39b984",
+            region: "ap-northeast-1",
+            provider: "aws",
+            endpoint: "http://directory-ap1.cello.mygentic.ai",
+        },
+    ],
+    signatures: [
+        {
+            officerIndex: 0,
+            signature: "1a372676e83ae323be8dbc6f8b786b3424706999efcccd70027798cbca91fe0b60cb35ac1e1af21078f24618d1f740b61bdcf06da03c5f90acc48d954039a104",
+        },
+    ],
+};
+/**
+ * Pinned consortium officer root public key(s). Officer 0's Ed25519 public key (hex). The client
+ * verifies BUNDLED_CONSORTIUM_MANIFEST's threshold signatures against this set. Public data.
+ */
+export const BUNDLED_CONSORTIUM_ROOT_KEYS = [
+    "8e9b99e5aa5505f2f50ec9f933f497a64956614575edce3427ec8a096c864199",
+];
+/** Minimum number of distinct valid officer signatures required (dev: single officer, threshold 1). */
+export const BUNDLED_CONSORTIUM_THRESHOLD = 1;
+//# sourceMappingURL=bundled-consortium-manifest.js.map

package/dist/bundled-consortium-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-consortium-manifest.js","sourceRoot":"","sources":["../src/bundled-consortium-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAA4B;IAClE,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,sBAAsB;IAClC,OAAO,EAAE,sBAAsB;IAC/B,KAAK,EAAE;QACL;YACE,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,wCAAwC;SACnD;QACD;YACE,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,wCAAwC;SACnD;QACD;YACE,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,kEAAkE;YAC1E,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,wCAAwC;SACnD;KACF;IACD,UAAU,EAAE;QACV;YACE,YAAY,EAAE,CAAC;YACf,SAAS,EACP,kIAAkI;SACrI;KACF;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,kEAAkE;CACnE,CAAC;AAEF,uGAAuG;AACvG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC"}

package/dist/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EASrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAqB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAqInF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAqmI7E"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EASrB,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAM/D,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAsB7G,OAAO,KAAK,EAAE,kBAAkB,EAA+C,MAAM,yBAAyB,CAAC;AAM/G,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA0InF,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,SAAS,IAAI,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,qBAAqB,IAAI,kBAAkB,CAAC;IAC5C;;;;;;;;OAQG;IACH,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,IAAI,kBAAkB,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,IAAI,eAAe,CAAC;CACtC;AAyCD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwwI7E"}

package/dist/daemon.js

@@ -45,6 +45,7 @@ import { DbRegistrationPersistence, DbIdentityStore } from "./db-identity-store.
 import { DbManifestVersionStore } from "./manifest-version-store-db.js";
 import { verify as ed25519Verify, sealToRecipient, generateKLocalSeed, InMemoryKeyProvider, hash as cryptoHash } from "@cello-protocol/crypto";
 import { attemptSealUpgrade as attemptSealUpgradeImpl, verifyUpgradeConfirmedCert } from "./seal-upgrade.js";
+import { upgradeAbsentToRecovered, hasAbsentParticipant } from "./seal-receipt-upgrade.js";
 // CELLO-M7-MSG-001 (AC-013/AC-018): the single application content-size cap, enforced
 // at the send point here (the receive point lives in the transport content decode).
 import { MAX_CONTENT_BYTES, computeGenesisPrevRoot, buildAgentRevocationTbs } from "@cello-protocol/protocol-types";
@@ -52,10 +53,10 @@ import { resolveCelloEnv, createTransportSelector, isProductionVariant, } from "
 import { selectAdvertisedAddress } from "./transport-selector.js";
 import { parseSessionAssignment, sessionRequestErrorReason } from "./session-assignment-parser.js";
 import { wireSessionCeremonyHandler, wireSessionOfferHandler, wireSealCeremonyHandler, verifyUnilateralCertificate, verifyBilateralSealCertificate, runAgentRefresh } from "./session-ceremony.js";
-import { reDeriveFrontiers, findInflatedFrontier } from "./seal-frontier-verify.js";
+import { reDeriveFrontiers, findInflatedFrontier, checkUnilateralFrontier } from "./seal-frontier-verify.js";
 import { LocalAutoNatStub } from "@cello-protocol/transport";
 import { startHttpManifestPoll } from "./http-manifest-poll.js";
-import { resolveDirectoryUrl, manifestNodesToEndpoints } from "./directory-bootstrap.js";
+import { resolveDirectoryUrl, manifestNodesToEndpoints, createRosterAwareEndpointResolver, } from "./directory-bootstrap.js";
 /**
  * M7-SESSION-001 (H-1): canonical byte encoding of a SEAL-INTERRUPTED leaf for
  * Ed25519 signing/verification. Field order is fixed and deterministic. Both the
@@ -330,6 +331,25 @@ export async function startDaemon(config) {
         const m = manifestProvider?.getCurrentManifest();
         return m ? await manifestNodesToEndpoints(m.nodes, { logger }) : null;
     };
+    // FINDING-4: roster-aware directory failover (bootstrap SPOF fix). The injected
+    // directoryEndpointResolver only ever probes the single configured node (CELLO_DIRECTORY_URL),
+    // so a down primary stranded the client at startup even though it held the other nodes'
+    // addresses. Wrap it with the consortium roster so the signaling dialer — and the ceremony
+    // endpoint that shares this same instance — route AROUND a down primary (primary-first,
+    // sticky-until-fail, randomized fallback), honoring the sovereign-node REDUNDANCY invariant.
+    // ONE instance → shared sticky state so signaling + ceremonies stay on the SAME directory node
+    // and fail over together. Undefined on the in-process test path (no directoryEndpointResolver),
+    // where the shared manager uses an injected signalingConnect instead.
+    const failoverEndpointResolver = directoryEndpointResolver
+        ? createRosterAwareEndpointResolver({
+            primaryResolver: directoryEndpointResolver,
+            getConsortiumRoster: resolveConsortiumRoster,
+            logger,
+        })
+        : undefined;
+    // Null-safe accessor for the ceremony/handler getDirectoryEndpoint sites (mirrors the old
+    // `directoryEndpointResolver ? ... : null` wrapper, now routed through the failover resolver).
+    const getFailoverEndpoint = async () => failoverEndpointResolver ? await failoverEndpointResolver() : null;
     // CELLO-M7-CONN-001 (DOD-CONN-3): start the daemon-level HTTP manifest poll. It fetches
     // ${directoryHttpUrl}/manifest, verifies the threshold signature against the locally-pinned
     // root keys, applies anti-rollback + expiry, and adopts a newer manifest — independent of any
@@ -484,7 +504,10 @@ export async function startDaemon(config) {
         if (!directoryEndpointResolver) {
             throw new Error("getAgentSignaling: no directory endpoint resolver configured (and no shared manager)");
         }
-        const resolver = directoryEndpointResolver;
+        // FINDING-4: dial through the roster-aware failover resolver so this agent's signaling
+        // stream routes around a down primary node. (failoverEndpointResolver is defined here
+        // because it is built iff directoryEndpointResolver is — guarded non-null just above.)
+        const resolver = failoverEndpointResolver ?? directoryEndpointResolver;
         let nodeRef = null;
         const connect = createSignalingConnect({
             getDirectoryEndpoint: resolver,
@@ -513,7 +536,7 @@ export async function startDaemon(config) {
             persistence: getPersistence(agentName),
             agentPubkeyHex,
             getNode: entry.getNode,
-            getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getDirectoryEndpoint: getFailoverEndpoint,
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
@@ -524,7 +547,7 @@ export async function startDaemon(config) {
             persistence: getPersistence(agentName),
             agentPubkeyHex,
             getNode: entry.getNode,
-            getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getDirectoryEndpoint: getFailoverEndpoint,
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
@@ -591,7 +614,7 @@ export async function startDaemon(config) {
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
-            getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getDirectoryEndpoint: getFailoverEndpoint,
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
@@ -601,7 +624,7 @@ export async function startDaemon(config) {
             persistence: getPersistence(agent.name),
             agentPubkeyHex: agent.pubkey,
             getNode: getDirectoryNode,
-            getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getDirectoryEndpoint: getFailoverEndpoint,
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: mgr,
             logger,
@@ -1444,9 +1467,16 @@ export async function startDaemon(config) {
         registrationInProgress = true;
         try {
             // Resolve the directory endpoint once for this registration (the context's
-            // getDirectoryEndpoint is synchronous; the daemon's resolver is async with a
-            // last-known-good fallback). The endpoint is stable for the duration of one
-            // registration — if it changed mid-flow the DKG streams would break anyway.
+            // getDirectoryEndpoint is synchronous; the daemon's resolver is async).
+            // FINDING-4 scope note: this uses the PRIMARY resolver directly (not the roster-aware
+            // failover resolver — registration is deliberately out of FINDING-4's "signaling +
+            // ceremony" scope). Because that primary is now built with staleFallback:false (so the
+            // failover wrapper sees a dead primary as null), a transient /bootstrap blip here resolves
+            // to null → directory_unreachable rather than riding through on a stale last-known-good;
+            // registration is a rare, manual, retryable op, so failing fast (retry) is acceptable. With
+            // a manifest configured the DKG fans out over the independently-probed roster regardless of
+            // this endpoint. The endpoint is stable for one registration — if it changed mid-flow the
+            // DKG streams would break anyway.
             const ep = await directoryEndpointResolver();
             if (!ep || !ep.multiaddr) {
                 // FROST DKG must dial the directory's /cello/frost/1.0.0 — a dialable
@@ -1769,6 +1799,84 @@ export async function startDaemon(config) {
                 // seal still completes — surfaced loudly so this can never masquerade as a produced receipt.
                 const rootHex = Buffer.from(sealedRoot).toString("hex");
                 const legibility = normalizeLegibility(frame["legibility"]);
+                // M8B FINDING-5 (SI-002): before persisting, INDEPENDENTLY re-derive each CLIENT-VERIFIABLE
+                // ('live', the present party) frontier from the signed frontier_leaves and OVERRIDE an inflated
+                // directory-published value DOWN to the provable one (the directory cannot forge signed leaves,
+                // so the re-derived value is truth). We OVERRIDE, never reject — the unilateral seal has a
+                // directory-side dedup guard that makes a client rejection unrecoverable (a retry close is
+                // silently ignored → no receipt ever, worse than FINDING-3; cascade-2 reviewer Critical 2). The
+                // absent party's frontier stays directory-attested (its remainder is not re-derivable here). No
+                // frontier_leaves (pre-FINDING-5 directory) → the cert stays directory-attested (FINDING-3).
+                // A receipt is ALWAYS persisted; the close never dead-ends here.
+                if (legibility !== undefined) {
+                    const rawParticipants = legibility.participants ?? [];
+                    const guardParticipants = rawParticipants
+                        .filter((p) => typeof p.pubkey === "string" && typeof p.attestation_mode === "string")
+                        .map((p) => ({
+                        pubkey: p.pubkey,
+                        content_frontier_seq: typeof p.content_frontier_seq === "number" ? p.content_frontier_seq : 0,
+                        attestation_mode: p.attestation_mode,
+                    }));
+                    const frontierLeavesRaw = frame["frontier_leaves"];
+                    const toU8f = (v) => (v instanceof Uint8Array ? v : new Uint8Array(v));
+                    const parsedFrontierLeaves = Array.isArray(frontierLeavesRaw) && frontierLeavesRaw.length > 0
+                        ? frontierLeavesRaw.map((l) => {
+                            const o = l;
+                            return {
+                                structure1_cbor: toU8f(o["structure1_cbor"]),
+                                sender_pubkey: toU8f(o["sender_pubkey"]),
+                                sender_signature: toU8f(o["sender_signature"]),
+                            };
+                        })
+                        : undefined;
+                    const check = checkUnilateralFrontier(guardParticipants, parsedFrontierLeaves, sessionId);
+                    // Apply any frontier corrections to the object we persist — override inflated 'live'
+                    // frontier(s) DOWN to the provable value, so the stored receipt never claims more than the
+                    // signed leaves support. Runs for both 'corrected' (valid leaves) and 'leaves_invalid'
+                    // (forged leaves → corrected to 0). Never rejects → the close never dead-ends.
+                    if (check.corrections.size > 0) {
+                        for (const p of rawParticipants) {
+                            if (typeof p.pubkey === "string" && check.corrections.has(p.pubkey.toLowerCase())) {
+                                p.content_frontier_seq = check.corrections.get(p.pubkey.toLowerCase());
+                            }
+                        }
+                    }
+                    if (check.status === "corrected") {
+                        logger.error("seal.certificate.frontier.overridden", {
+                            sessionId: sidHex,
+                            corrections: [...check.corrections.entries()].map(([party, seq]) => ({ party, correctedTo: seq })),
+                            path: "unilateral",
+                        });
+                    }
+                    else if (check.status === "verified") {
+                        logger.info("seal.certificate.frontier.verified", {
+                            sessionId: sidHex,
+                            parties: guardParticipants.filter((p) => p.attestation_mode === "live").length,
+                            path: "unilateral",
+                        });
+                    }
+                    else if (check.status === "leaves_invalid") {
+                        // Forged / cross-session leaves — a tamper signal. The 'live' frontier(s) have been
+                        // corrected to 0 above (zero trustworthy evidence); persist that (never reject → never
+                        // dead-end). Surfaced loudly for audit.
+                        logger.error("seal.certificate.frontier.leaves_invalid", {
+                            sessionId: sidHex,
+                            reason: check.reason,
+                            corrections: [...check.corrections.entries()].map(([party, seq]) => ({ party, correctedTo: seq })),
+                            path: "unilateral",
+                        });
+                    }
+                    else {
+                        // directory_attested: no frontier_leaves shipped (pre-FINDING-5 directory). Frontiers stay
+                        // DIRECTORY-attested (already marked per-participant) — visible/auditable, never silently
+                        // presented as client-verified.
+                        logger.warn("seal.certificate.frontier.directory_attested", {
+                            sessionId: sidHex,
+                            reason: "no_frontier_leaves",
+                            path: "unilateral",
+                        });
+                    }
+                }
                 if (legibility !== undefined) {
                     try {
                         sessionNodeManager.recordSealCertificate(agentName, sidHex, rootHex, JSON.stringify(legibility));
@@ -1819,7 +1927,7 @@ export async function startDaemon(config) {
             return;
         sealUpgradeInFlight.add(key);
         try {
-            await attemptSealUpgradeImpl({
+            const result = await attemptSealUpgradeImpl({
                 logger, agentName, agentPubkeyHex,
                 getReadiness: (a, s) => sessionNodeManager.getSealUpgradeReadiness(a, s),
                 getContentLeafCount: (a, s) => sessionNodeManager.getSessionTree(a, s).size(),
@@ -1827,6 +1935,44 @@ export async function startDaemon(config) {
                 getKeyProvider: (a) => keyProviders.get(a),
                 sendRaw: (f) => signaling.sendRaw(f),
             }, sidHex, frame);
+            // M8B FINDING-6 (3b): the ABSENT party (B) persists its UNILATERAL receipt from the
+            // notification's legibility — but ONLY after the KERNEL content-recovery/verify gate passed.
+            // `result.sent` is true iff attemptSealUpgradeImpl recovered + integrity-verified the content
+            // behind R1 and sent the ratification request; a tampered/unrecoverable/incomplete case returns
+            // sent:false → NO receipt (never a receipt for content B could not verify). B may hold no local
+            // `sessions` row (recordSealCertificateEnsuringRow inserts a stub, counterparty = A's pubkey).
+            // The notification carries no frontier_leaves (FINDING-5 ships those only on the present party's
+            // confirm frame), so B's legibility is directory-attested — consistent with FINDING-5's
+            // directory_attested path; B trusts its own KERNEL-verified content, not a re-derivation.
+            if (result.sent) {
+                try {
+                    // ONE-WAY RATCHET (cascade-2 FINDING-6 review): a re-delivered seal_unilateral_notification
+                    // (reconnect burst) re-runs this path and would re-persist the notification's ORIGINAL
+                    // legibility (counterparty 'absent'). If a prior upgrade already flipped the stored receipt
+                    // to 'recovered' (no 'absent' participant), re-persisting would REGRESS it — and no later
+                    // event restores 'recovered' (the directory dedups the duplicate as already_bilateral →
+                    // seal_upgrade_rejected, which only logs). So skip the re-persist once the cert is upgraded.
+                    const existing = sessionNodeManager.getSealCertificate(agentName, sidHex);
+                    if (existing && !hasAbsentParticipant(existing.legibility)) {
+                        logger.debug("session.unilateral.receipt.persist.skipped", { sessionId: sidHex, reason: "already_upgraded" });
+                    }
+                    else {
+                        const legibility = normalizeLegibility(frame["legibility"]);
+                        const rootHex = frameValueToHex(frame["sealed_root"]);
+                        const counterpartyHex = frameValueToHex(frame["present_pubkey"]); // A — the present party
+                        if (legibility !== undefined && rootHex && counterpartyHex) {
+                            sessionNodeManager.recordSealCertificateEnsuringRow(agentName, sidHex, counterpartyHex, rootHex, JSON.stringify(legibility));
+                            logger.info("session.unilateral.receipt.persisted", { sessionId: sidHex, sealedRoot: rootHex, party: "absent" });
+                        }
+                        else if (legibility === undefined) {
+                            logger.warn("session.unilateral.receipt.absent", { sessionId: sidHex, reason: "no_legibility_on_notification" });
+                        }
+                    }
+                }
+                catch (error) {
+                    logger.warn("seal.certificate.persist.failed", { sessionId: sidHex, reason: error instanceof Error ? error.message : String(error) });
+                }
+            }
         }
         finally {
             // Clear the guard so a later reconnect can retry if the request never reached the directory;
@@ -1844,6 +1990,24 @@ export async function startDaemon(config) {
         if (!result.ok)
             return; // cert.invalid already logged inside; do NOT accept as bilateral.
         logger.info("session.seal.upgraded", { sessionId: sidHex, agentName, party: result.party });
+        // M8B FINDING-6 (3a): the seal is now BILATERAL (verified) — upgrade THIS party's own stored
+        // receipt so the counterparty recorded 'absent' becomes 'recovered'. Client-side: the directory
+        // ships no bilateral legibility at upgrade time (the seal leaves aren't persisted there), so each
+        // party rebuilds from the cert it already holds — the present party's from its unilateral close
+        // (FINDING-3), the returning party's from the notification it persisted after the KERNEL gate
+        // (3b). The seal signatures do not bind the (unsigned) legibility, so mutating it is sound; only
+        // the attestation flips (frontiers unchanged — never overstated). No-op if no cert is stored yet.
+        const stored = sessionNodeManager.getSealCertificate(agentName, sidHex);
+        if (stored) {
+            try {
+                const upgraded = upgradeAbsentToRecovered(stored.legibility);
+                sessionNodeManager.recordSealCertificate(agentName, sidHex, stored.sealed_root, JSON.stringify(upgraded));
+                logger.info("session.seal.receipt.upgraded", { sessionId: sidHex, agentName, party: result.party });
+            }
+            catch (error) {
+                logger.warn("seal.certificate.persist.failed", { sessionId: sidHex, reason: error instanceof Error ? error.message : String(error) });
+            }
+        }
         void sessionNodeManager.destroySessionNode(agentName, sidHex, "sealed");
     }
     /**
@@ -1901,7 +2065,7 @@ export async function startDaemon(config) {
             persistence: getPersistence(agentName),
             agentPubkeyHex: loaded.pubkey,
             getNode: entry.getNode,
-            getDirectoryEndpoint: async () => (directoryEndpointResolver ? (await directoryEndpointResolver()) ?? null : null),
+            getDirectoryEndpoint: getFailoverEndpoint,
             getConsortiumEndpoints: resolveConsortiumRoster,
             signaling: entry.signaling,
             logger,