@decionis/mcp 0.2.0 → 0.4.0

package/dist/{chunk-NF5JL6QR.js → chunk-5Q6BCK32.js}

@@ -29,9 +29,9 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
-// ../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/getPluginName.js
+// ../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/getPluginName.js
 var require_getPluginName = __commonJS({
-  "../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/getPluginName.js"(exports, module) {
+  "../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/getPluginName.js"(exports, module) {
     "use strict";
     var fpStackTracePattern = /at\s(?:.*\.)?plugin\s.*\n\s*(.*)/;
     var fileNamePattern = /(\w*(\.\w*)*)\..*/;
@@ -54,9 +54,9 @@ var require_getPluginName = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/toCamelCase.js
+// ../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/toCamelCase.js
 var require_toCamelCase = __commonJS({
-  "../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/toCamelCase.js"(exports, module) {
+  "../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/lib/toCamelCase.js"(exports, module) {
     "use strict";
     module.exports = function toCamelCase(name) {
       if (name[0] === "@") {
@@ -69,9 +69,9 @@ var require_toCamelCase = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/index.js
+// ../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/index.js
 var require_fastify_plugin = __commonJS({
-  "../../node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/index.js"(exports, module) {
+  "../../../Decionis/node_modules/.pnpm/fastify-plugin@6.0.0/node_modules/fastify-plugin/index.js"(exports, module) {
     "use strict";
     var getPluginName = require_getPluginName();
     var toCamelCase = require_toCamelCase();
@@ -119,9 +119,9 @@ var require_fastify_plugin = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/toad-cache@3.7.0/node_modules/toad-cache/dist/toad-cache.cjs
+// ../../../Decionis/node_modules/.pnpm/toad-cache@3.7.0/node_modules/toad-cache/dist/toad-cache.cjs
 var require_toad_cache = __commonJS({
-  "../../node_modules/.pnpm/toad-cache@3.7.0/node_modules/toad-cache/dist/toad-cache.cjs"(exports) {
+  "../../../Decionis/node_modules/.pnpm/toad-cache@3.7.0/node_modules/toad-cache/dist/toad-cache.cjs"(exports) {
     "use strict";
     var FifoMap = class {
       constructor(max = 1e3, ttlInMsecs = 0) {
@@ -802,9 +802,9 @@ var require_toad_cache = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/vary.js
+// ../../../Decionis/node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/vary.js
 var require_vary = __commonJS({
-  "../../node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/vary.js"(exports, module) {
+  "../../../Decionis/node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/vary.js"(exports, module) {
     "use strict";
     var { FifoMap: FifoCache } = require_toad_cache();
     var validFieldnameRE = /^[!#$%&'*+\-.^\w`|~]+$/u;
@@ -883,9 +883,9 @@ var require_vary = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/index.js
+// ../../../Decionis/node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/index.js
 var require_cors = __commonJS({
-  "../../node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/index.js"(exports, module) {
+  "../../../Decionis/node_modules/.pnpm/@fastify+cors@11.3.0/node_modules/@fastify/cors/index.js"(exports, module) {
     "use strict";
     var fp = require_fastify_plugin();
     var {
@@ -1129,14 +1129,14 @@ var require_cors = __commonJS({
   }
 });
 
-// ../protocol/src/app.ts
+// ../../../Decionis/apps/protocol/src/app.ts
 var import_cors = __toESM(require_cors(), 1);
 import Fastify from "fastify";
 
-// ../protocol/src/store/MemoryProtocolStore.ts
+// ../../../Decionis/apps/protocol/src/store/MemoryProtocolStore.ts
 import { randomUUID } from "crypto";
 
-// ../../packages/shared/src/Domain/DomainEnums.ts
+// ../../../Decionis/packages/shared/src/Domain/DomainEnums.ts
 var Band = {
   NONE: "NONE",
   LOW: "LOW",
@@ -1225,7 +1225,7 @@ var TopFrictionArea = {
   ORIGIN_TRACKING: "ORIGIN_TRACKING"
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -1337,7 +1337,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -1471,7 +1471,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -1589,7 +1589,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -1692,7 +1692,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -1701,7 +1701,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -1811,14 +1811,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
+// ../../../Decionis/node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -5266,7 +5266,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../../packages/shared/src/Domain/DomainSchemas.ts
+// ../../../Decionis/packages/shared/src/Domain/DomainSchemas.ts
 var SignalExtractionSchema = external_exports.object({
   team_size: external_exports.enum(["SOLO", "SMALL", "MID", "LARGE"]),
   revenue: external_exports.enum(["PRE_REVENUE", "UNPREDICTABLE", "PREDICTABLE", "PROFITABLE"]),
@@ -5350,7 +5350,7 @@ var SignalSetDbShape = external_exports.object({
   cognitive_load: external_exports.nativeEnum(Band)
 }).strict();
 
-// ../../packages/shared/src/Decisioning/AiIntentContracts.ts
+// ../../../Decionis/packages/shared/src/Decisioning/AiIntentContracts.ts
 var AIIntentSurfaceSchema = external_exports.enum([
   "webex",
   "power_automate",
@@ -5451,7 +5451,7 @@ var AIIntentInterceptionResultContractSchema = external_exports.object({
   handoff: AIIntentHandoffContractSchema
 }).strict();
 
-// ../../packages/shared/src/Decisioning/ExecutionBinding.ts
+// ../../../Decionis/packages/shared/src/Decisioning/ExecutionBinding.ts
 var EXECUTION_BINDING_SCHEMA_VERSION = "1.0";
 var EXECUTION_BINDING_DIGEST_ALGORITHM = "SHA-256";
 var JCS_CANONICALIZATION_PROFILE = "RFC8785/JCS";
@@ -5787,7 +5787,7 @@ function assertUnicodeScalarString(value) {
   }
 }
 
-// ../../packages/shared/src/Decisioning/DecisionDossierIntegrity.ts
+// ../../../Decionis/packages/shared/src/Decisioning/DecisionDossierIntegrity.ts
 var DOSSIER_CONTENT_DIGEST_PROFILE = "DECIONIS_DOSSIER_CONTENT_V2";
 var DOSSIER_CONTENT_DIGEST_CANONICALIZATION = "RFC8785/JCS";
 var DECISION_DOSSIER_PROOF_ARTIFACT_SHAPES = {
@@ -5960,7 +5960,7 @@ function computeDecisionDossierContentSha256(dossierPayload) {
   return DecisionDossierIntegrity.computeContentSha256(dossierPayload);
 }
 
-// ../../packages/shared/src/Decisioning/DecisioningContracts.ts
+// ../../../Decionis/packages/shared/src/Decisioning/DecisioningContracts.ts
 var EvidenceRefSchema = external_exports.object({
   tool_event_id: external_exports.string().min(1).max(200),
   output_hash: external_exports.string().min(16).max(128),
@@ -6042,7 +6042,7 @@ var EvidenceBackedClaimSchema = external_exports.object({
   evidence: external_exports.array(EvidenceRefSchema).min(1)
 }).strict();
 
-// ../../packages/shared/src/Decisioning/SnapshotValidity.ts
+// ../../../Decionis/packages/shared/src/Decisioning/SnapshotValidity.ts
 var SnapshotValidity = class _SnapshotValidity {
   /** Default snapshot lifetime (24h). */
   static DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -6110,7 +6110,7 @@ function withRollingValidity(template, options = {}) {
   return SnapshotValidity.withRollingValidity(template, options);
 }
 
-// ../../packages/shared/src/Decisioning/EnforcementMode.ts
+// ../../../Decionis/packages/shared/src/Decisioning/EnforcementMode.ts
 var ENFORCEMENT_SPELLINGS = /* @__PURE__ */ new Set(["enforce", "enforced", "enforcement"]);
 function normalizeEnforcementMode(value, fallback = "SHADOW") {
   if (typeof value !== "string") return fallback;
@@ -6121,7 +6121,7 @@ function normalizeEnforcementMode(value, fallback = "SHADOW") {
   return fallback;
 }
 
-// ../../packages/shared/src/Decisioning/PolicyResolution.ts
+// ../../../Decionis/packages/shared/src/Decisioning/PolicyResolution.ts
 var EVALUATE_DECISION_POLICY_RESOLUTIONS = [
   /** A policy guard stopped the evaluation before rules ran. */
   "policy_guard_blocked",
@@ -6156,7 +6156,7 @@ var RESERVED_REQUEST_FACTS = [
   "requested_policy_version"
 ];
 
-// ../../packages/shared/src/Decisioning/EffectEvidence.ts
+// ../../../Decionis/packages/shared/src/Decisioning/EffectEvidence.ts
 var EFFECT_EVIDENCE_VERSION = "1.0";
 var EffectObservationMethodSchema = external_exports.enum([
   "DOWNSTREAM_ACK",
@@ -6228,7 +6228,7 @@ var EffectEvidenceSchema = external_exports.object({
   }
 });
 
-// ../../packages/shared/src/Decisioning/SemanticSignals.ts
+// ../../../Decionis/packages/shared/src/Decisioning/SemanticSignals.ts
 var SEMANTIC_SIGNAL_SCHEMA_VERSION = "1.0";
 var BUILT_IN_SEMANTIC_SIGNAL_KINDS = [
   "intent_risk",
@@ -6404,7 +6404,7 @@ function stringOrNull(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
-// ../../packages/shared/src/Decisioning/UpstreamAuthorization.ts
+// ../../../Decionis/packages/shared/src/Decisioning/UpstreamAuthorization.ts
 var AUTHZEN_PROTOCOL = "authzen/1.0";
 var sha256Digest3 = external_exports.string().regex(/^sha256:[0-9a-f]{64}$/);
 var bounded = external_exports.string().trim().min(1).max(200);
@@ -6438,7 +6438,7 @@ var UpstreamAuthorizationValueSchema = external_exports.object({
   reasons: external_exports.array(bounded).max(50).optional()
 }).strict();
 
-// ../../packages/shared/src/Decisioning/AuthoritySemantics.ts
+// ../../../Decionis/packages/shared/src/Decisioning/AuthoritySemantics.ts
 var DECIONIS_PROTOCOL_AUTHORITY_VERSION = "1.1";
 var DECIONIS_EVALUATOR_VERSION = "policy-graph/1.1";
 var DECIONIS_POLICY_SCHEMA_VERSION = "1.0";
@@ -6677,7 +6677,7 @@ function buildAuthorityEvidence(input) {
   });
 }
 
-// ../../packages/shared/src/Decisioning/ExecutionRevalidation.ts
+// ../../../Decionis/packages/shared/src/Decisioning/ExecutionRevalidation.ts
 var EXECUTION_REVALIDATION_REASON_CODES = [
   "EXECUTION_BINDING_VALID",
   "PAYLOAD_BINDING_MISMATCH",
@@ -6766,6 +6766,19 @@ var FinalizationEffectEvidenceSchema = external_exports.union([
   EffectEvidenceSchema,
   ExecutionEffectEvidenceSchema
 ]);
+var EffectReceiptRecordSchema = external_exports.object({
+  token: external_exports.string().min(1).max(2e4),
+  token_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
+  verified: external_exports.boolean(),
+  verification_code: external_exports.string().min(1).max(100),
+  provider_key_id: external_exports.string().min(1).max(200).nullable(),
+  issuer: external_exports.string().min(1).max(500).nullable(),
+  receipt_jti: external_exports.string().min(1).max(200).nullable(),
+  effect_status: external_exports.enum(["EFFECTED", "REFUSED", "INDETERMINATE"]).nullable(),
+  effect_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/).nullable(),
+  effect_reference: external_exports.string().min(1).max(2e3).nullable(),
+  effected_at: external_exports.string().datetime().nullable()
+}).strict();
 function validateExecutionEffectEvidence(input) {
   if (!input.expected_request_digest) return "EFFECT_REQUEST_BINDING_UNAVAILABLE";
   if (input.effect_evidence.request_digest !== input.expected_request_digest) {
@@ -6789,6 +6802,7 @@ var ExecutionCommitEvidenceSchema = external_exports.object({
   recorded_at: external_exports.string().datetime(),
   downstream_evidence_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
   effect_evidence: FinalizationEffectEvidenceSchema.nullable().optional(),
+  effect_receipt: EffectReceiptRecordSchema.nullable().optional(),
   evidence_hash: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/)
 }).strict().superRefine((evidence, context) => {
   const expectedClaimState = evidence.commit_outcome === "COMMITTED" ? "FINALIZED" : evidence.commit_outcome === "FAILED" ? "FAILED" : "INDETERMINATE";
@@ -6801,7 +6815,142 @@ var ExecutionCommitEvidenceSchema = external_exports.object({
   }
 });
 
-// ../../packages/shared/src/Decisioning/ReasonCodes.ts
+// ../../../Decionis/packages/shared/src/Decisioning/RuntimeSignals.ts
+var token = external_exports.string().trim().min(1).max(200).regex(/^[a-z0-9][\w.:/-]*$/i);
+var bounded2 = (max) => external_exports.string().trim().min(1).max(max);
+var RUNTIME_SIGNAL_ROOTS = ["enforcement_boundary", "workload"];
+var RUNTIME_ATTRIBUTION_FACT = "runtime_attribution";
+var WORKLOAD_TRUST_LEVELS = ["unverified", "supplied", "observed", "verified"];
+var BoundaryPlacementSchema = external_exports.object({
+  cluster_id: token.optional(),
+  namespace: token.optional(),
+  region: token.optional(),
+  workload_id: token.optional()
+}).strict();
+var EnforcementBoundarySignalSchema = external_exports.object({
+  boundary_id: token,
+  agentsafe_version: bounded2(80),
+  protocol_version: external_exports.literal("agent-safe.intent/1"),
+  deployment_type: token,
+  environment: token.optional(),
+  conformance_version: bounded2(120).optional(),
+  placement: BoundaryPlacementSchema.optional()
+}).strict();
+var WorkloadProvenanceSchema = external_exports.object({
+  source: token,
+  trust_level: external_exports.enum(WORKLOAD_TRUST_LEVELS)
+}).strict();
+var WorkloadSignalSchema = external_exports.object({
+  runtime: token.optional(),
+  artifact_type: token.optional(),
+  // An OCI reference and a publisher name, held to the character classes a
+  // reference and a name actually use. The producer constrains these where
+  // it reads them, but Decionis receives this shape from any producer, and
+  // these values reach signed evidence and an operator's console: free text
+  // arriving here would be free text leaving there.
+  image: external_exports.string().trim().min(1).max(500).regex(/^[\w.:/@-]+$/).optional(),
+  digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/).optional(),
+  publisher: external_exports.string().trim().min(1).max(200).regex(/^[\w .:/@-]+$/).optional(),
+  provenance: WorkloadProvenanceSchema
+}).strict();
+var RuntimeSignals = class _RuntimeSignals {
+  static parse(context) {
+    const boundaryRaw = context.enforcement_boundary;
+    const workloadRaw = context.workload;
+    let boundary = null;
+    let workload = null;
+    if (boundaryRaw !== void 0 && boundaryRaw !== null) {
+      const parsed = EnforcementBoundarySignalSchema.safeParse(boundaryRaw);
+      if (!parsed.success) {
+        return {
+          ok: false,
+          path: "context.enforcement_boundary",
+          message: _RuntimeSignals.messageOf(parsed.error)
+        };
+      }
+      boundary = parsed.data;
+    }
+    if (workloadRaw !== void 0 && workloadRaw !== null) {
+      const parsed = WorkloadSignalSchema.safeParse(workloadRaw);
+      if (!parsed.success) {
+        return {
+          ok: false,
+          path: "context.workload",
+          message: _RuntimeSignals.messageOf(parsed.error)
+        };
+      }
+      workload = parsed.data;
+    }
+    return { ok: true, boundary, workload };
+  }
+  /**
+   * The first problem, named by its own path. Bounded and structural: it
+   * repeats no value the caller sent, so a refusal cannot echo a payload back
+   * into a log.
+   */
+  static messageOf(error) {
+    const issue = error.issues[0];
+    if (!issue) return "invalid";
+    const where = issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    return `${where}: ${issue.code}`;
+  }
+  /** What Decionis says about the report, computed from the parsed signals alone. */
+  static attributionOf(input) {
+    const { boundary, workload } = input;
+    const placement = boundary?.placement;
+    return {
+      reported: boundary !== null || workload !== null,
+      boundary_id: boundary?.boundary_id ?? null,
+      deployment_type: boundary?.deployment_type ?? null,
+      environment: boundary?.environment ?? null,
+      cluster_id: placement?.cluster_id ?? null,
+      namespace: placement?.namespace ?? null,
+      region: placement?.region ?? null,
+      workload_digest: workload?.digest ?? null,
+      workload_image: workload?.image ?? null,
+      workload_publisher: workload?.publisher ?? null,
+      workload_runtime: workload?.runtime ?? null,
+      trust_level: workload?.provenance.trust_level ?? null,
+      trust_source: workload?.provenance.source ?? null,
+      // Nothing in this chain verified an artifact. When something does, it
+      // sets this, and every policy written against it starts meaning more
+      // without being rewritten.
+      platform_verified: false
+    };
+  }
+  /**
+   * What reaches signed evidence: the boundary that admitted the action and
+   * the artifact that proposed it, with the platform's own statement about
+   * how far that goes.
+   *
+   * The placement is included because an operator's own cluster and namespace
+   * are theirs and are what a policy means by "production in eu". The
+   * instance is not, and never arrives: the producer leaves the container,
+   * pod and node out of what it binds.
+   */
+  static evidenceOf(attribution) {
+    if (!attribution.reported) return null;
+    return {
+      boundary_id: attribution.boundary_id,
+      deployment_type: attribution.deployment_type,
+      environment: attribution.environment,
+      cluster_id: attribution.cluster_id,
+      namespace: attribution.namespace,
+      region: attribution.region,
+      workload_digest: attribution.workload_digest,
+      workload_image: attribution.workload_image,
+      workload_publisher: attribution.workload_publisher,
+      trust_level: attribution.trust_level,
+      trust_source: attribution.trust_source,
+      platform_verified: attribution.platform_verified
+    };
+  }
+};
+var parseRuntimeSignals = RuntimeSignals.parse.bind(RuntimeSignals);
+var runtimeAttributionOf = RuntimeSignals.attributionOf.bind(RuntimeSignals);
+var runtimeAttributionEvidence = RuntimeSignals.evidenceOf.bind(RuntimeSignals);
+
+// ../../../Decionis/packages/shared/src/Decisioning/ReasonCodes.ts
 var ReasonCodes = class _ReasonCodes {
   static codes = [
     "PROTOCOL_OUTCOME_APPROVE",
@@ -7120,7 +7269,7 @@ function buildProtocolDecisionReasonCodes(response) {
   return ReasonCodes.buildProtocolDecisionReasonCodes(response);
 }
 
-// ../../packages/shared/src/Authority/AuthorityRequirement.ts
+// ../../../Decionis/packages/shared/src/Authority/AuthorityRequirement.ts
 var AUTHORITY_REQUIREMENT_VERSION = "decionis.authority_requirement/1";
 var SYSTEM_APPROVER_ROLE_ID = "APPROVER";
 var AuthoritySelectorSchema = external_exports.discriminatedUnion("kind", [
@@ -7160,10 +7309,22 @@ var AuthorityVerificationRequirementsSchema = external_exports.object({
     });
   }
 });
+var AuthorityApprovalTierSchema = external_exports.object({
+  priority: external_exports.number().int().min(1).max(5),
+  principal_ids: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(10)
+}).strict();
 var AuthorityResolutionPolicySchema = external_exports.object({
   quorum: external_exports.literal(1),
   delegation: external_exports.enum(["DISALLOWED", "REQUIREMENT_REFRESH"]),
-  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([])
+  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([]),
+  /**
+   * An approval chain. Absent, the requirement is one ceremony by one subject
+   * (`quorum` 1). Present, the policy names who approves in priority tiers and
+   * the requirement is met only by one valid proof from every tier; Decionis
+   * keeps no chain state — the orchestrator (or Presence) runs it and Decionis
+   * verifies each proof against the tier it comes from.
+   */
+  tiers: external_exports.array(AuthorityApprovalTierSchema).min(1).max(5).optional()
 }).strict().superRefine((policy, context) => {
   if (new Set(policy.fallback_role_ids).size !== policy.fallback_role_ids.length) {
     context.addIssue({
@@ -7172,6 +7333,24 @@ var AuthorityResolutionPolicySchema = external_exports.object({
       message: "fallback role ids must be unique"
     });
   }
+  if (policy.tiers) {
+    const priorities = policy.tiers.map((tier) => tier.priority);
+    if (priorities.some((priority, index) => index > 0 && priority <= priorities[index - 1])) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["tiers"],
+        message: "tier priorities must be unique and ascending"
+      });
+    }
+    const principals = policy.tiers.flatMap((tier) => tier.principal_ids);
+    if (new Set(principals).size !== principals.length) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["tiers"],
+        message: "a principal belongs to one tier only"
+      });
+    }
+  }
 });
 var AuthorityRequirementOriginatorSchema = external_exports.object({
   organization_id: external_exports.string().min(1).max(200),
@@ -7237,6 +7416,13 @@ var AuthorityRequirementSchema = external_exports.object({
       message: "fallback roles must not repeat the primary role"
     });
   }
+  if (requirement.resolution.tiers && requirement.selector.kind !== "ROLE") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["resolution", "tiers"],
+      message: "an approval chain names its members' trusted role through a ROLE selector"
+    });
+  }
   if (requirement.orchestration?.mode === "MANAGED" && requirement.selector.kind === "PRINCIPAL" && requirement.selector.role_id === void 0) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -7246,7 +7432,7 @@ var AuthorityRequirementSchema = external_exports.object({
   }
 });
 
-// ../../packages/shared/src/Marketplaces.ts
+// ../../../Decionis/packages/shared/src/Marketplaces.ts
 var Marketplaces = class {
   static targets = [
     "atlassian",
@@ -7289,8 +7475,10 @@ var Marketplaces = class {
       launch_state: "pilot_ready"
     },
     aws: {
-      // EventBridge + Bedrock guards, PrivateLink endpoint, and Marketplace
-      // metering/entitlement are built (docs/brief/decionis.aws.md Phase 0-2); listing not yet GA.
+      // The AWS adapter is Commerce Gate's AgentSaaS (API-based SaaS) and
+      // AgentOps (its container for Bedrock AgentCore), built in the Commerce
+      // repository; they replaced the customer-VPC Lambda and Bedrock guards,
+      // retired on 2026-09-26. Listing not yet GA.
       adapter_state: "available",
       workflow_state: "available",
       docs_state: "available",
@@ -7373,10 +7561,11 @@ var Marketplaces = class {
       // classic checkout, core COGS, HPOS order CRUD, and the signed dossier were
       // verified end to end on a staging store with real credentials — including
       // an admin-enabled ENFORCEMENT block — before the listing went live.
+      // Production (Festus, 2026-09-26); each store still starts in Shadow Mode.
       adapter_state: "available",
       workflow_state: "available",
       docs_state: "available",
-      launch_state: "pilot_ready"
+      launch_state: "production"
     },
     tiktok: {
       // Post-purchase fulfillment circuit breaker: OAuth + refresh, signed Open API,
@@ -7402,19 +7591,23 @@ var Marketplaces = class {
       // referral fee + shipping), and Acknowledge-Order release/hold are built and
       // unit-tested. Production Solution Provider credentials are issued and every
       // previously guessed API detail is verified against the Walmart Developer Portal
-      // (2026-08-16; decionis/Commerce docs/walmart/ConfirmBeforeLive.md). A live
-      // seller verification remains before per-seller enforcement (shadow-first).
+      // (2026-08-16; decionis/Commerce docs/walmart/ConfirmBeforeLive.md). On
+      // 2026-09-16 Walmart approved Decionis, Inc. as a Marketplace Solution
+      // Provider (Specialty Partner — Orders) and the Decionis Commerce Gate app
+      // passed review and was published in the Seller Center App Store, where
+      // sellers install it in one click. Production since then (Festus,
+      // 2026-09-26); each seller still starts in Shadow Mode.
       adapter_state: "available",
       workflow_state: "available",
       docs_state: "partial",
-      launch_state: "pilot_ready"
+      launch_state: "production"
     }
   };
 };
 var MARKETPLACE_TARGETS = Marketplaces.targets;
 var MARKETPLACE_READINESS_BY_TARGET = Marketplaces.readinessByTarget;
 
-// ../../packages/shared/src/Patterns/ExecutionPatternClassifier.ts
+// ../../../Decionis/packages/shared/src/Patterns/ExecutionPatternClassifier.ts
 var EXECUTION_PATTERN_RULES = [
   {
     pattern: "mcp-egress",
@@ -7521,7 +7714,7 @@ var EXECUTION_PATTERN_RECIPE_TAGS = Object.fromEntries(
   EXECUTION_PATTERN_RULES.map((rule) => [rule.pattern, rule.recipeTags])
 );
 
-// ../../packages/shared/src/PolicyPacks/PolicyPackRegistry.ts
+// ../../../Decionis/packages/shared/src/PolicyPacks/PolicyPackRegistry.ts
 var DISCOUNT_GUARDRAILS = {
   id: "discount-guardrails",
   name: "Discount Guardrails",
@@ -7625,7 +7818,7 @@ var POLICY_PACKS = [
 ];
 var POLICY_PACK_IDS = POLICY_PACKS.map((pack) => pack.id);
 
-// ../../packages/shared/src/capital/CapitalContracts.ts
+// ../../../Decionis/packages/shared/src/capital/CapitalContracts.ts
 var defaultCapitalPolicySnapshot = withRollingValidity({
   policyVersion: "capital-multiplier-v1",
   // Shadow by default: observe and quantify before anything moves money.
@@ -7658,7 +7851,7 @@ var defaultCapitalPolicySnapshot = withRollingValidity({
   }
 });
 
-// ../../packages/shared/src/capital/CapitalCopy.ts
+// ../../../Decionis/packages/shared/src/capital/CapitalCopy.ts
 var CapitalCopy = class _CapitalCopy {
   static defaultCopy = {
     early_payment_yield: {
@@ -7830,7 +8023,7 @@ var CapitalCopy = class _CapitalCopy {
 };
 var CAPITAL_COPY_BY_PLATFORM = CapitalCopy.copyByPlatform;
 
-// ../../packages/shared/src/capital/CapitalCards.ts
+// ../../../Decionis/packages/shared/src/capital/CapitalCards.ts
 var CapitalCards = class _CapitalCards {
   static actionVerbs = {
     approve: "capital.recommendation.approve",
@@ -7948,7 +8141,7 @@ ${rec.disposition.replace(/_/g, " ")}` }
 };
 var capitalRecommendationActionVerbs = CapitalCards.actionVerbs;
 
-// ../../packages/shared/src/Microsoft/MicrosoftDecisionDossier.ts
+// ../../../Decionis/packages/shared/src/Microsoft/MicrosoftDecisionDossier.ts
 var MicrosoftDecisionDossierFactory = class _MicrosoftDecisionDossierFactory {
   static actionVerbs = {
     approve: "decision.dossier.approve",
@@ -8286,7 +8479,7 @@ ${dossier.reason}`,
 };
 var microsoftTeamsDecisionDossierActionVerbs = MicrosoftDecisionDossierFactory.actionVerbs;
 
-// ../../packages/shared/src/Procure/ProcureContracts.ts
+// ../../../Decionis/packages/shared/src/Procure/ProcureContracts.ts
 var ProcureDisposition = {
   APPROVE: "APPROVE",
   REJECT: "REJECT",
@@ -8336,7 +8529,7 @@ var ProcureDecisionStepOutputSchema = external_exports.object({
   referral_id: external_exports.string().uuid().optional()
 }).strict();
 
-// ../../packages/shared/src/Procure/ProcureDsl.ts
+// ../../../Decionis/packages/shared/src/Procure/ProcureDsl.ts
 var PrimitiveSchema = external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean(), external_exports.null()]);
 var ProcureDslConditionSchema = external_exports.lazy(
   () => external_exports.union([
@@ -8397,7 +8590,7 @@ var ProcureDslSchema = external_exports.object({
   fallback: ProcureDslThenSchema
 }).strict();
 
-// ../../packages/shared/src/Sidecar/SidecarContracts.ts
+// ../../../Decionis/packages/shared/src/Sidecar/SidecarContracts.ts
 var ReaderArtifactTypeSchema = external_exports.enum([
   "DECISION_DOSSIER",
   "DECISION_CHAIN",
@@ -8597,8 +8790,10 @@ var ExtensionConfigResponseSchema = external_exports.object({
   generated_at: external_exports.string()
 }).strict();
 
-// ../protocol/src/ledger/LedgerChain.ts
+// ../../../Decionis/apps/protocol/src/ledger/LedgerChain.ts
 import { createHash } from "crypto";
+var LEDGER_FORK_RESOLVED_EVENT_TYPE = "LEDGER_FORK_RESOLVED";
+var LEDGER_ORPHAN_ISSUE_INDEX = -1;
 var LedgerChain = class _LedgerChain {
   static computeLedgerEntryHash(input) {
     const canonicalPayload = {
@@ -8730,6 +8925,87 @@ var LedgerChain = class _LedgerChain {
       issues
     };
   }
+  /**
+   * Verify registered fork orphans. Each must be a well-formed entry whose
+   * hash recomputes over its own predecessor, whose predecessor is a real
+   * entry, and which a non-orphaned LEDGER_FORK_RESOLVED entry commits to (by
+   * id, entry hash and predecessor hash) — so the registry can exclude only
+   * what the hash chain itself records as excluded.
+   */
+  static verifyLedgerOrphans(orgId, candidates) {
+    const issues = [];
+    const orphaned = [];
+    for (const candidate of candidates) {
+      const registration = candidate.registration;
+      const issuesBefore = issues.length;
+      const issue = (reason, expected, actual) => issues.push({
+        ledger_entry_id: registration.ledger_entry_id,
+        index: LEDGER_ORPHAN_ISSUE_INDEX,
+        reason,
+        ...expected !== void 0 ? { expected } : {},
+        ...actual !== void 0 ? { actual } : {}
+      });
+      const entry = candidate.entry;
+      if (!entry || entry.ledger_entry_id !== registration.ledger_entry_id) {
+        issue("ORPHAN_REGISTRY_MISMATCH");
+        orphaned.push(_LedgerChain.orphanReport(registration, null, false));
+        continue;
+      }
+      const own = _LedgerChain.verifyLedgerChainPage(orgId, [entry], {
+        checked: 0,
+        expected_prev_hash: entry.prev_hash,
+        tail_hash: null,
+        head_hash: null,
+        issues: []
+      });
+      for (const found of own.issues) {
+        issues.push({ ...found, index: LEDGER_ORPHAN_ISSUE_INDEX });
+      }
+      const entryHash = _LedgerChain.normalizeHash(entry.entry_hash);
+      const prevHash = _LedgerChain.normalizeHash(entry.prev_hash);
+      if (_LedgerChain.normalizeHash(registration.entry_hash) !== entryHash || _LedgerChain.normalizeHash(registration.fork_prev_hash) !== prevHash) {
+        issue("ORPHAN_REGISTRY_MISMATCH", registration.entry_hash, entry.entry_hash);
+      }
+      if (!prevHash || !candidate.predecessor_exists) {
+        issue("ORPHAN_PREDECESSOR_MISSING", null, entry.prev_hash);
+      }
+      if (!registration.resolution_entry_id) {
+        issue("ORPHAN_UNRESOLVED");
+      } else if (!_LedgerChain.resolutionCommitsToOrphan(orgId, registration, entry, candidate.resolution)) {
+        issue("ORPHAN_RESOLUTION_MISMATCH", registration.resolution_entry_id, null);
+      }
+      orphaned.push(_LedgerChain.orphanReport(registration, entry, issues.length === issuesBefore));
+    }
+    return { orphaned, issues };
+  }
+  static resolutionCommitsToOrphan(orgId, registration, entry, resolution) {
+    if (!resolution || resolution.orphaned) return false;
+    const envelope = resolution.entry.payload;
+    if (resolution.entry.ledger_entry_id !== registration.resolution_entry_id || envelope.event_type !== LEDGER_FORK_RESOLVED_EVENT_TYPE || envelope.org_id !== orgId) {
+      return false;
+    }
+    const committed = _LedgerChain.asRecord(envelope.payload);
+    const canonicalHead = _LedgerChain.asRecord(committed.canonical_head);
+    if (committed.org_id !== orgId || _LedgerChain.normalizeHash(canonicalHead.entry_hash) !== _LedgerChain.normalizeHash(resolution.entry.prev_hash)) {
+      return false;
+    }
+    const orphans = Array.isArray(committed.orphans) ? committed.orphans : [];
+    return orphans.some((item) => {
+      const orphan = _LedgerChain.asRecord(item);
+      return orphan.ledger_entry_id === entry.ledger_entry_id && _LedgerChain.normalizeHash(orphan.entry_hash) === _LedgerChain.normalizeHash(entry.entry_hash) && _LedgerChain.normalizeHash(orphan.prev_hash) === _LedgerChain.normalizeHash(entry.prev_hash);
+    });
+  }
+  static orphanReport(registration, entry, verified) {
+    return {
+      ledger_entry_id: registration.ledger_entry_id,
+      entry_hash: entry?.entry_hash ?? registration.entry_hash,
+      prev_hash: entry ? entry.prev_hash : registration.fork_prev_hash,
+      status: "orphaned",
+      reason: registration.reason,
+      resolution_entry_id: registration.resolution_entry_id,
+      verified
+    };
+  }
   static normalizeHash(value) {
     if (typeof value !== "string") return null;
     const hash = value.trim();
@@ -8776,19 +9052,26 @@ function bindLedgerEntryToPrevious(payload, previousHash) {
 function verifyLedgerChain(orgId, entries) {
   return LedgerChain.verifyLedgerChain(orgId, entries);
 }
+function verifyLedgerOrphans(orgId, candidates) {
+  return LedgerChain.verifyLedgerOrphans(orgId, candidates);
+}
 
-// ../protocol/src/store/StoreContracts.ts
+// ../../../Decionis/apps/protocol/src/store/StoreContracts.ts
 var DECISION_CHAIN_PROJECTION_LIMIT = 500;
+var AUDIT_LEDGER_NOT_APPENDABLE = "AUDIT_LEDGER_NOT_APPENDABLE";
 var ProtocolStoreValidationError = class extends Error {
   issues;
-  constructor(message, issues) {
+  /** Stable machine-readable code for failures callers must tell apart. */
+  code;
+  constructor(message, issues, options) {
     super(message);
     this.name = "ProtocolStoreValidationError";
     this.issues = issues;
+    if (options?.code) this.code = options.code;
   }
 };
 
-// ../protocol/src/store/DecisionDossierImmutability.ts
+// ../../../Decionis/apps/protocol/src/store/DecisionDossierImmutability.ts
 function evaluationCommitmentFromInput(input, evaluationId) {
   return {
     id: evaluationId,
@@ -8870,7 +9153,7 @@ function assertCanonicalDecisionDossierRetry(input) {
   return committedEvaluation;
 }
 
-// ../protocol/src/store/StoreHelpers.ts
+// ../../../Decionis/apps/protocol/src/store/StoreHelpers.ts
 var UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var ARTIFACT_ID_FIELDS = {
   signal_envelope: "envelope_id",
@@ -8953,7 +9236,7 @@ function getOccurredAt(kind, payload) {
   return StoreHelpers.getOccurredAt(kind, payload);
 }
 
-// ../protocol/src/store/MemoryProtocolStore.ts
+// ../../../Decionis/apps/protocol/src/store/MemoryProtocolStore.ts
 var DECISION_CHAIN_LEDGER_ACTION_ORDER = {
   "protocol.execution.precommit_revalidated": 0,
   "protocol.execution.dispatched": 1,
@@ -8976,6 +9259,8 @@ function compareDecisionChainLedgerRows(left, right) {
 var MemoryProtocolStore = class _MemoryProtocolStore {
   byKey = /* @__PURE__ */ new Map();
   auditLedgerChainById = /* @__PURE__ */ new Map();
+  /** Mirror of `decionis_protocol.audit_ledger_orphans`. */
+  auditLedgerOrphans = /* @__PURE__ */ new Map();
   auditLedgerAppendOrdinal = 0n;
   orgVerticalPacks = /* @__PURE__ */ new Map();
   evaluationById = /* @__PURE__ */ new Map();
@@ -9077,8 +9362,18 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
           entry_hash: existingLedgerRow.entry_hash
         };
       }
-      const currentHead = Array.from(this.auditLedgerChainById.values()).filter((row) => row.org_id === orgId).sort(_MemoryProtocolStore.compareCanonicalLedgerRows).at(-1);
-      const bound = bindLedgerEntryToPrevious(payload, currentHead?.entry_hash ?? null);
+      const orgRows = Array.from(this.auditLedgerChainById.values()).filter(
+        (row) => row.org_id === orgId
+      );
+      const heads = this.candidateAuditLedgerHeads(orgRows);
+      if (orgRows.length === 0 && heads.length !== 0 || orgRows.length > 0 && heads.length !== 1) {
+        throw new ProtocolStoreValidationError(
+          "Audit ledger is not appendable",
+          [{ path: "chain.prev_hash", message: "canonical ledger has no unique head" }],
+          { code: AUDIT_LEDGER_NOT_APPENDABLE }
+        );
+      }
+      const bound = bindLedgerEntryToPrevious(payload, heads[0]?.entry_hash ?? null);
       persistedPayload = bound.payload;
       const chain = persistedPayload.chain && typeof persistedPayload.chain === "object" && !Array.isArray(persistedPayload.chain) ? persistedPayload.chain : {};
       const entryHash = typeof chain.entry_hash === "string" ? chain.entry_hash.toLowerCase() : "";
@@ -9126,8 +9421,101 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
     }).slice(0, input.limit);
     return rows.map((row) => row.payload);
   }
+  candidateAuditLedgerHeads(orgRows) {
+    const predecessors = new Set(
+      orgRows.map((row) => row.prev_hash).filter((hash) => hash !== null)
+    );
+    return orgRows.filter(
+      (row) => !predecessors.has(row.entry_hash) && !this.auditLedgerOrphans.has(row.ledger_entry_id)
+    );
+  }
+  withLedgerMembership(row) {
+    const orphan = this.auditLedgerOrphans.get(row.ledger_entry_id);
+    return orphan && orphan.org_id === row.org_id ? {
+      ...row,
+      ledger_membership: "orphaned",
+      orphan_resolution_entry_id: orphan.resolution_entry_id
+    } : row;
+  }
+  auditLedgerOrphanCandidates(orgId) {
+    const orgRows = Array.from(this.auditLedgerChainById.values()).filter(
+      (row) => row.org_id === orgId
+    );
+    const hashes = new Set(orgRows.map((row) => row.entry_hash));
+    const occurredAt = (id) => this.auditLedgerChainById.get(id)?.occurred_at ?? "";
+    return Array.from(this.auditLedgerOrphans.values()).filter((orphan) => orphan.org_id === orgId).sort(
+      (left, right) => occurredAt(left.ledger_entry_id).localeCompare(occurredAt(right.ledger_entry_id)) || left.ledger_entry_id.localeCompare(right.ledger_entry_id)
+    ).map((orphan) => {
+      const entry = this.auditLedgerChainById.get(orphan.ledger_entry_id);
+      const resolution = orphan.resolution_entry_id ? this.auditLedgerChainById.get(orphan.resolution_entry_id) : void 0;
+      return {
+        registration: {
+          ledger_entry_id: orphan.ledger_entry_id,
+          entry_hash: orphan.entry_hash,
+          fork_prev_hash: orphan.fork_prev_hash,
+          reason: orphan.reason,
+          resolution_entry_id: orphan.resolution_entry_id
+        },
+        entry: entry && entry.org_id === orgId ? structuredClone(entry) : null,
+        predecessor_exists: entry?.prev_hash ? hashes.has(entry.prev_hash) : false,
+        resolution: resolution && resolution.org_id === orgId ? {
+          entry: structuredClone(resolution),
+          orphaned: this.auditLedgerOrphans.has(resolution.ledger_entry_id)
+        } : null
+      };
+    });
+  }
+  /**
+   * Mirror of the operator registry insert (`audit_ledger_orphans`) with the
+   * same integrity rules its trigger enforces: the entry exists in this org's
+   * ledger, the recorded hashes are the entry's own, and nothing is registered
+   * twice. The chain itself is never modified.
+   */
+  async registerAuditLedgerOrphans(input) {
+    const staged = [];
+    for (const orphan of input.orphans) {
+      const entry = this.auditLedgerChainById.get(orphan.ledger_entry_id);
+      if (!entry || entry.org_id !== input.orgId) {
+        throw new ProtocolStoreValidationError("Audit ledger orphan is not a ledger entry", [
+          { path: "ledger_entry_id", message: "must name an entry of this org's ledger" }
+        ]);
+      }
+      if (this.auditLedgerOrphans.has(orphan.ledger_entry_id) || staged.some((row) => row.ledger_entry_id === orphan.ledger_entry_id)) {
+        throw new ProtocolStoreValidationError("Audit ledger orphan is already registered", [
+          { path: "ledger_entry_id", message: "an orphan is registered once" }
+        ]);
+      }
+      staged.push({
+        ledger_entry_id: entry.ledger_entry_id,
+        org_id: input.orgId,
+        entry_hash: entry.entry_hash,
+        fork_prev_hash: entry.prev_hash,
+        reason: orphan.reason,
+        resolution_entry_id: null,
+        recorded_at: (/* @__PURE__ */ new Date()).toISOString(),
+        recorded_by: input.recordedBy
+      });
+    }
+    for (const row of staged) this.auditLedgerOrphans.set(row.ledger_entry_id, row);
+  }
+  /** Mirror of the one permitted registry update: name the resolution entry, once. */
+  async setAuditLedgerOrphanResolution(input) {
+    const resolution = this.auditLedgerChainById.get(input.resolutionEntryId);
+    if (!resolution || resolution.org_id !== input.orgId) {
+      throw new ProtocolStoreValidationError("Audit ledger resolution entry is unknown", [
+        { path: "resolution_entry_id", message: "must name an entry of this org's ledger" }
+      ]);
+    }
+    const rows = input.ledgerEntryIds.map((id) => this.auditLedgerOrphans.get(id));
+    if (rows.some((row) => !row || row.org_id !== input.orgId || row.resolution_entry_id !== null)) {
+      throw new ProtocolStoreValidationError("Audit ledger orphan resolution is immutable", [
+        { path: "resolution_entry_id", message: "set once, on a registered unresolved orphan" }
+      ]);
+    }
+    for (const row of rows) row.resolution_entry_id = input.resolutionEntryId;
+  }
   async getLatestAuditLedgerHead(orgId) {
-    const latest = Array.from(this.auditLedgerChainById.values()).filter((row) => row.org_id === orgId).sort(_MemoryProtocolStore.compareCanonicalLedgerRows).at(-1);
+    const latest = Array.from(this.auditLedgerChainById.values()).filter((row) => row.org_id === orgId && !this.auditLedgerOrphans.has(row.ledger_entry_id)).sort(_MemoryProtocolStore.compareCanonicalLedgerRows).at(-1);
     if (!latest) return null;
     return {
       ledger_entry_id: latest.ledger_entry_id,
@@ -9137,7 +9525,7 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
   }
   async getAuditLedgerEntry(input) {
     const row = this.auditLedgerChainById.get(input.ledgerEntryId);
-    return row?.org_id === input.orgId ? structuredClone(row) : null;
+    return row?.org_id === input.orgId ? structuredClone(this.withLedgerMembership(row)) : null;
   }
   async listSignalEnvelopes(input) {
     const wanted = new Set(input.signalIds);
@@ -9155,12 +9543,12 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
     return Array.from(latest.values()).map((row) => row.payload);
   }
   async verifyAuditLedgerChain(input) {
-    const rows = Array.from(this.byKey.values()).filter((row) => row.kind === "audit_ledger_entry").filter((row) => row.org_id === input.orgId).sort((left, right) => {
+    const rows = Array.from(this.byKey.values()).filter((row) => row.kind === "audit_ledger_entry").filter((row) => row.org_id === input.orgId).filter((row) => !this.auditLedgerOrphans.has(row.artifact_id)).sort((left, right) => {
       const leftTs = left.occurred_at?.getTime() ?? 0;
       const rightTs = right.occurred_at?.getTime() ?? 0;
       return leftTs - rightTs;
     }).slice(0, Math.max(1, Math.min(input.limit, 5e3)));
-    return verifyLedgerChain(
+    const verification = verifyLedgerChain(
       input.orgId,
       rows.map((row) => {
         const chain = row.payload.chain ?? {};
@@ -9172,10 +9560,21 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
         };
       })
     );
+    const candidates = this.auditLedgerOrphanCandidates(input.orgId);
+    if (candidates.length === 0) return verification;
+    const verifiedOrphans = verifyLedgerOrphans(input.orgId, candidates);
+    const issues = [...verification.issues, ...verifiedOrphans.issues];
+    return {
+      ...verification,
+      broken_links: issues.length,
+      valid: issues.length === 0,
+      issues,
+      orphaned: verifiedOrphans.orphaned
+    };
   }
   async verifyAuditLedgerContinuity(input) {
     const rows = Array.from(this.auditLedgerChainById.values()).filter(
-      (row) => row.org_id === input.orgId
+      (row) => row.org_id === input.orgId && !this.auditLedgerOrphans.has(row.ledger_entry_id)
     );
     rows.sort(_MemoryProtocolStore.compareCanonicalLedgerRows);
     const maxEntries = input.maxEntries === void 0 ? rows.length : Number.isFinite(input.maxEntries) ? Math.max(1, Math.min(Math.floor(input.maxEntries), Number.MAX_SAFE_INTEGER)) : 1;
@@ -9188,14 +9587,19 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
         algorithm: typeof row.payload.chain?.algorithm === "string" ? row.payload.chain.algorithm : void 0
       }))
     );
+    const verifiedOrphans = verifyLedgerOrphans(
+      input.orgId,
+      this.auditLedgerOrphanCandidates(input.orgId)
+    );
     return {
       org_id: verification.org_id,
       checked: verification.checked,
-      valid: complete && verification.valid,
+      valid: complete && verification.valid && verifiedOrphans.issues.length === 0,
       complete,
-      broken_links: verification.broken_links,
+      broken_links: verification.broken_links + verifiedOrphans.issues.length,
       head_hash: verification.head_hash,
-      tail_hash: verification.tail_hash
+      tail_hash: verification.tail_hash,
+      ...verifiedOrphans.orphaned.length > 0 ? { orphaned: verifiedOrphans.orphaned } : {}
     };
   }
   async listPolicyBundles(input) {
@@ -9404,7 +9808,7 @@ var MemoryProtocolStore = class _MemoryProtocolStore {
     const matching = Array.from(this.auditLedgerChainById.values()).filter((row) => row.org_id === input.orgId).filter((row) => {
       const payload = row.payload.payload;
       return payload !== null && typeof payload === "object" && !Array.isArray(payload) && payload.chain_id === input.chainId;
-    }).sort(compareDecisionChainLedgerRows);
+    }).sort(compareDecisionChainLedgerRows).map((row) => this.withLedgerMembership(row));
     return {
       entries: matching.slice(0, limit),
       limit,
@@ -9481,7 +9885,7 @@ function createMemoryProtocolStore() {
   return new MemoryProtocolStore();
 }
 
-// ../protocol/src/auth/McpAuth.ts
+// ../../../Decionis/apps/protocol/src/auth/McpAuth.ts
 import { createHash as createHash2 } from "crypto";
 var McpAuth = class _McpAuth {
   static hashApiKey(rawKey, env = process.env) {
@@ -9551,7 +9955,7 @@ function hasAnyScope(grantedScopes, requiredScopes) {
   return McpAuth.hasAnyScope(grantedScopes, requiredScopes);
 }
 
-// ../protocol/src/mcp/McpContracts.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpContracts.ts
 var MCP_PROTOCOL_VERSIONS = [
   "2025-11-25",
   "2025-06-18",
@@ -9565,7 +9969,7 @@ var MCP_OAUTH_USER_EMAIL_ARGUMENT = "__decionis_oauth_user_email";
 var DEFAULT_PUBLIC_BASE_URL = "https://protocol.decionis.com";
 var MCP_HTTP_PATHS = ["/mcp", "/v1/protocol/mcp"];
 
-// ../protocol/src/http/InternalAccessGuard.ts
+// ../../../Decionis/apps/protocol/src/http/InternalAccessGuard.ts
 import { timingSafeEqual } from "crypto";
 var MCP_DISCOVERY_SUFFIXES = [
   "/.well-known/oauth-protected-resource",
@@ -9657,7 +10061,7 @@ function registerInternalAccessGuard(app, env = process.env, tenantAuthLookup =
   });
 }
 
-// ../protocol/src/http/InternalRouteInvoker.ts
+// ../../../Decionis/apps/protocol/src/http/InternalRouteInvoker.ts
 function injectInternalProtocolRoute(app, input) {
   const internalSecret = resolveInternalSecret();
   return app.inject({
@@ -9671,7 +10075,7 @@ function injectInternalProtocolRoute(app, input) {
   });
 }
 
-// ../protocol/src/mcp/McpSupport.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpSupport.ts
 var McpSupport = class {
   static asRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return null;
@@ -9783,10 +10187,11 @@ function withQuery(path, query) {
   return McpSupport.withQuery(path, query);
 }
 
-// ../protocol/src/mcp/McpAuthGuard.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpAuthGuard.ts
 var orgScopedToolNames = /* @__PURE__ */ new Set([
   "decionis.get_started",
   "get_started",
+  "explore",
   "decionis.evaluate_decision",
   "evaluate_decision",
   "decionis.explain_decision",
@@ -9809,6 +10214,8 @@ var orgScopedToolNames = /* @__PURE__ */ new Set([
   "list_enforcement_rollouts",
   "decionis.upsert_enforcement_rollout",
   "upsert_enforcement_rollout",
+  "decionis.seed_policy_pack",
+  "seed_policy_pack",
   "decionis.resolve_vertical_pack",
   "resolve_vertical_pack",
   "decionis.run_shadow_decisioning",
@@ -9934,6 +10341,10 @@ var McpAuthGuard = class _McpAuthGuard {
     if (!_McpAuthGuard.isOAuthClientAuth(auth)) return prompts;
     return prompts.filter((prompt) => conversationalOAuthPromptNames.has(prompt.name));
   }
+  /** Whether an org API key is confined to its own organization for this tool. */
+  static isOrgScopedTool(name) {
+    return orgScopedToolNames.has(name);
+  }
   static findTargetOrgIdForTool(name, args) {
     if (orgScopedToolNames.has(name)) {
       return asString(args.org_id);
@@ -9984,6 +10395,9 @@ var McpAuthGuard = class _McpAuthGuard {
     if (name === "decionis.upsert_enforcement_rollout" || name === "upsert_enforcement_rollout") {
       return ["decision:write", "decision:*", "org:*"];
     }
+    if (name === "decionis.seed_policy_pack" || name === "seed_policy_pack") {
+      return ["policy:write", "policy:*", "org:*"];
+    }
     return [];
   }
   static readAuthorizationForResource(uri) {
@@ -10090,10 +10504,10 @@ function authorizeResourceRead(auth, uri) {
   return McpAuthGuard.authorizeResourceRead(auth, uri);
 }
 
-// ../protocol/src/mcp/McpRoutes.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpRoutes.ts
 import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
 
-// ../../packages/shared/src/Connectors/ConnectorRegistry.ts
+// ../../../Decionis/packages/shared/src/Connectors/ConnectorRegistry.ts
 var SITE = "https://decionis.com";
 var connectors = [
   // ── Commerce ──────────────────────────────────────────────────────────
@@ -10127,6 +10541,14 @@ var connectors = [
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "marketplace_install", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "STRICT",
+      whenUnavailable: "Checkout keeps enforcing the signed policy snapshot already pushed to the store, so an outage changes nothing until that snapshot expires after seven days. After that, or if the snapshot is missing, checkout is blocked.",
+      configurable: 'Each rule has an "If Decionis is unreachable" setting in the app, fail closed by default.',
+      ungovernedMarker: null,
+      evidence: "decionis/Commerce: apps/shopify/extensions/*-hard-gate; app/lib/policies/RuleEnforcement.server.ts",
+      knownGap: "Only the net-margin rule's setting reaches checkout today; the other rules' settings are stored but not applied. A product with no cost on file is margin-checked as if its cost were zero."
+    },
     marketplaceListingId: "shopify-app",
     providerId: "SHOPIFY"
   },
@@ -10161,6 +10583,14 @@ var connectors = [
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "If the store cannot reach Decionis, checkout continues by default.",
+      configurable: '"If Decionis is unreachable" in the plugin settings: fail open (the default) or fail closed.',
+      ungovernedMarker: "The order records the decision as bypassed, with the reason.",
+      evidence: "decionis/Commerce: connectors/woo/plugin/includes/checkout/RuntimeClient.php; includes/orders/DossierMetadata.php",
+      knownGap: "An error inside the gate is still answered as allow, so the order proceeds even when fail closed is set. An order with no cost on file proceeds without a margin check."
+    },
     marketplaceTarget: "woo",
     marketplaceListingId: "woo-plugin",
     providerId: "WOO"
@@ -10177,7 +10607,7 @@ var connectors = [
     vendor: "eBay",
     category: "commerce",
     status: "installable",
-    summary: "Margin and promo-hygiene guardrails for eBay Sell-API listings, orders, and promotions \u2014 eBay OAuth connect, production-approved, shadow-mode dossiers with enforcement pending write-scope approval.",
+    summary: "Margin and promotion guardrails for your eBay listings, orders and promotions. Connect with eBay sign-in; it starts in Shadow Mode, with a signed Decision Dossier for every decision.",
     capabilities: ["margin-guardrails", "promo-hygiene", "shadow-mode", "signed-decision-dossier"],
     decisionsSupported: ["listing-change", "order-fulfillment", "promotion"],
     installation: [
@@ -10196,6 +10626,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "Listings are left as they are; the monitor never reprices or withdraws a listing without an answer.",
+      configurable: null,
+      ungovernedMarker: "The sweep result reports the listing as observed, with the enforcement error.",
+      evidence: "decionis/Commerce: connectors/adapters/ebay/src/enforcement/Enforcer.ts; connectors/ebay/src/Monitor.ts"
+    },
     marketplaceTarget: "ebay",
     providerId: "EBAY"
   },
@@ -10248,6 +10685,14 @@ var connectors = [
     distribution: { download: true, guidedInstall: false, remoteInstall: false },
     activation: { method: "enrollment_token", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "Checkout continues: the Magento hook is optional with a two-second timeout, and an engine error is answered as success.",
+      configurable: null,
+      ungovernedMarker: "Log lines at checkout; the post-placement sweep records orders it could not check.",
+      evidence: "decionis/Commerce: connectors/adobe/magento-module/etc/webhooks.xml; connectors/adobe/src/App.ts",
+      knownGap: "A skipped checkout check is only logged, not stored as a decision record."
+    },
     marketplaceTarget: "adobe-commerce",
     providerId: "ADOBE_COMMERCE"
   },
@@ -10259,7 +10704,7 @@ var connectors = [
     vendor: "Amazon",
     category: "commerce",
     status: "validated",
-    summary: "Margin and pricing guardrails for Amazon SP-API listings and orders \u2014 Login with Amazon connect, shadow-mode first while live seller validation completes.",
+    summary: "Margin and pricing guardrails for your Amazon listings and orders. Connect with Login with Amazon; it starts in Shadow Mode.",
     capabilities: ["margin-guardrails", "shadow-mode", "signed-decision-dossier"],
     decisionsSupported: ["listing-change", "order"],
     installation: [],
@@ -10267,6 +10712,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "OBSERVE_ONLY",
+      whenUnavailable: "Amazon has no way to hold an order, so Commerce Gate records decisions only. During an outage the order ships untouched.",
+      configurable: null,
+      ungovernedMarker: "The sweep is recorded as failed.",
+      evidence: "decionis/Commerce: connectors/amazon/src/orders/AmazonOrderGate.ts"
+    },
     marketplaceTarget: "amazon",
     providerId: "AMAZON"
   },
@@ -10288,6 +10740,14 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "Orders are released without a margin check, after the buyer-remorse hold where one applies.",
+      configurable: null,
+      ungovernedMarker: null,
+      evidence: "decionis/Commerce: connectors/tiktok/src/interception/OrderInterceptor.ts",
+      knownGap: "Nothing is stored for an order released this way, and the returned detail reads as a missing cost rather than an outage."
+    },
     marketplaceTarget: "tiktok",
     providerId: "TIKTOK_SHOP"
   },
@@ -10296,19 +10756,46 @@ var connectors = [
     // verification, margin gate, Acknowledge-Order release/hold — built and
     // unit-tested; Solution Provider approval and live seller verification
     // remain (shared readiness provenance).
+    // Approved Walmart Marketplace Solution Provider (Specialty Partner —
+    // Orders) with the Decionis Commerce Gate app reviewed and published in
+    // the Seller Center App Store on 2026-09-16 (Walmart's notices). The
+    // Sellers install it in one click from the listing; Walmart sends them to
+    // the registered App Login URL and they authorize the app. The listing
+    // sits behind a seller login and no public directory page exists (checked
+    // 2026-09-22), so the channel names Seller Center itself — which resolves
+    // publicly to Walmart's seller sign-in — and the listing by its name.
     slug: "walmart",
-    name: "Decionis for Walmart Marketplace",
+    name: "Decionis Commerce Gate for Walmart Marketplace",
     vendor: "Walmart",
     category: "commerce",
-    status: "validated",
-    summary: "Post-purchase fulfillment circuit breaker for Walmart Marketplace \u2014 purchase orders clear a margin gate (COGS + referral fee + shipping) before Acknowledge-Order release.",
+    status: "installable",
+    summary: "Stop loss-making Walmart orders before you acknowledge them: every purchase order clears a margin check (cost of goods, referral fee and shipping) first. Install Decionis Commerce Gate in one click from the Seller Center App Store.",
     capabilities: ["fulfillment-circuit-breaker", "margin-guardrails", "signed-decision-dossier"],
     decisionsSupported: ["order-acknowledgement"],
-    installation: [],
+    installation: [
+      {
+        kind: "marketplace",
+        url: "https://seller.walmart.com/",
+        label: "Walmart Marketplace App Store in Seller Center (seller login): Decionis Commerce Gate \u2014 Policy Controls for Walmart Marketplace"
+      }
+    ],
     documentation: `${SITE}/marketplace/walmart`,
+    verification: {
+      validatedBy: "Walmart Marketplace (Solution Provider approval; app review and publication)",
+      evidence: "Decionis, Inc. approved as a Walmart Marketplace Solution Provider (Specialty Partner \u2014 Orders) and the Decionis Commerce Gate app validated by the Developer Portal review and published to the Seller Center App Store, all on 2026-09-16 per Walmart's notices. Sellers install it in one click from the listing. The listing is inside Seller Center (seller login); no public directory page on 2026-09-22.",
+      lastValidated: "2026-09-16"
+    },
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
-    activation: { method: "oauth", requiresWorkspace: true },
+    activation: { method: "marketplace_install", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "Orders are acknowledged without a margin check. Refunds up to the fallback limit proceed, and larger refunds are held until the check is back.",
+      configurable: "The refund fallback limit is set per deployment (1,000 by default); order acknowledgment behaviour is fixed.",
+      ungovernedMarker: "Order Guard records the order as released without a margin check.",
+      evidence: "decionis/Commerce: connectors/walmart/src/interception/OrderInterceptor.ts; src/policy/RefundPolicyGate.ts",
+      knownGap: "An engine fault is recorded with the same wording as a missing cost, and the refund record does not say the fallback limit was used."
+    },
     marketplaceTarget: "walmart",
     providerId: "WALMART_MARKETPLACE"
   },
@@ -10330,6 +10817,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "STRICT",
+      whenUnavailable: "Commerce Gate does not release the order; it stays in the seller's own Jumia workflow.",
+      configurable: "release_mode decides whether Commerce Gate releases orders at all (advisory by default).",
+      ungovernedMarker: "The intercept is recorded as observed, or as failed when a release attempt fails.",
+      evidence: "decionis/Commerce: connectors/jumia/src/interception/OrderInterceptor.ts; connectors/adapters/jumia/src/settings/JumiaSettings.ts"
+    },
     marketplaceTarget: "jumia",
     providerId: "JUMIA"
   },
@@ -10341,7 +10835,7 @@ var connectors = [
     vendor: "BigCommerce",
     category: "commerce",
     status: "validated",
-    summary: "Checkout margin gate for BigCommerce headless and Open Checkout storefronts \u2014 built and unit-tested, pending validation against a live store.",
+    summary: "Checkout margin gate for BigCommerce headless and Open Checkout storefronts. It fails open, so an engine error never blocks a sale.",
     capabilities: ["margin-floor-enforcement", "checkout-policy-enforcement"],
     decisionsSupported: ["checkout-order"],
     installation: [],
@@ -10349,6 +10843,14 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "An engine error is answered as allow and the order proceeds.",
+      configurable: null,
+      ungovernedMarker: "The response says bypassed; nothing is stored.",
+      evidence: "decionis/Commerce: connectors/bigcommerce/src/App.ts",
+      knownGap: "How the storefront handles a timeout is outside the connector repository and is not stated here."
+    },
     marketplaceTarget: "bigcommerce"
   },
   {
@@ -10360,7 +10862,7 @@ var connectors = [
     vendor: "Shopware",
     category: "commerce",
     status: "validated",
-    summary: "Fail-open synchronous checkout gate for Shopware 6 \u2014 App System registration handshake, shop-signed webhooks, and promo-hygiene checks, pending validation against a live store.",
+    summary: "Fail-open checkout gate for Shopware 6, with signed webhooks and promotion checks.",
     capabilities: [
       "margin-floor-enforcement",
       "checkout-policy-enforcement",
@@ -10373,22 +10875,34 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "BOUNDED_CONTINUITY",
+      whenUnavailable: "An engine error is answered as allow and the order proceeds.",
+      configurable: null,
+      ungovernedMarker: "The response says bypassed; nothing is stored.",
+      evidence: "decionis/Commerce: connectors/shopware/src/App.ts",
+      knownGap: "How the storefront handles a timeout is outside the connector repository and is not stated here."
+    },
     marketplaceTarget: "shopware"
   },
   // ── Enterprise ────────────────────────────────────────────────────────
   {
     // SAP PartnerEdge Solution Review approved 2026-06-22 (solution id
-    // 2004368, docs/marketplace/sap/solution-hub-listing.md). The PartnerEdge
+    // 2004368; listing evidence now lives in decionis/Commerce
+    // docs/marketplace/sap/solution-hub-listing.md). The PartnerEdge
     // solution URL is partner-gated (anonymous fetch 404s — sweep
-    // 2026-08-10), so it is deliberately NOT an install channel here; the
-    // customer-deployable BTP deployment kit ships next. Dual-gate wording
-    // from the owning listing copy.
+    // 2026-08-10), so it is deliberately NOT an install channel here.
+    // The CAP application and the customer-deployable BTP kit are
+    // Commerce-owned (decionis/Commerce apps/sap + commerce-dashboard): the
+    // decionis.com channel URLs below 301 to commerce.decionis.com like every
+    // other Commerce-owned row, and this repo no longer ships the kit
+    // artifacts or pins their version (drift-gated in Commerce, not here).
+    // Dual-gate wording from the owning listing copy.
     slug: "sap",
     name: "Decionis Governed Execution Gate for SAP",
     vendor: "SAP",
     category: "enterprise",
     status: "validated",
-    version: "0.1.0",
     summary: "Dual-gate governed execution for SAP S/4HANA, BTP, and CAP-side workflows \u2014 vendor payment release, procurement approval, and finance controls checked before they execute, with a signed Decision Dossier written back to the governed document.",
     capabilities: [
       "dual-gate-execution",
@@ -10405,29 +10919,31 @@ var connectors = [
     installation: [
       {
         // Customer-deployed BTP kit (curated CAP source, mbt build →
-        // cf deploy) — shipped in the same change that makes the URL resolve
-        // (rule 1.1 by construction).
+        // cf deploy). The kit page, zip, checksum, manifest and SBOM are
+        // served by Commerce; this URL resolves through the reviewed 301 in
+        // CommerceOwnership.mjs (rule 1.1 by redirect, not by local file).
         kind: "hosted_download",
         url: `${SITE}/marketplace/sap/deployment-kit`,
         label: "SAP BTP deployment kit (customer-deployed)"
       }
     ],
-    package: {
-      artifact: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.zip",
-      sha256Path: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.sha256.txt",
-      manifestPath: "/marketplace/sap/deployment-kit/manifest.json",
-      sbomPath: "/marketplace/sap/deployment-kit/SBOM.json",
-      format: "sap-mta-deployment-kit"
-    },
     documentation: `${SITE}/marketplace/sap`,
     verification: {
       validatedBy: "SAP PartnerEdge Solution Review",
-      evidence: "Solution Review completed and approved 2026-06-22 (SAP PartnerEdge solution id 2004368); SAP Store content listing is the next, contract-gated step.",
+      evidence: "SAP PartnerEdge Solution Review completed and approved on 22 June 2026 (solution 2004368).",
       lastValidated: "2026-06-22"
     },
     distribution: { download: true, guidedInstall: false, remoteInstall: false },
     activation: { method: "enrollment_token", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "CUSTOM",
+      whenUnavailable: "If the Decionis gate cannot be reached, a local fallback gate decides with fixed rules (allow, block, delay or escalate), and a request missing required fields is blocked.",
+      configurable: "Set DECIONIS_PROTOCOL_FAIL_CLOSED=1 to block instead.",
+      ungovernedMarker: "The dossier is marked federated: false, with a local id.",
+      evidence: "decionis/Commerce: apps/sap/srv/decionis-client.js; apps/sap/docs/runtime-config.md",
+      knownGap: "The call to the Decionis gate has no timeout."
+    },
     providerId: "SAP"
   },
   {
@@ -10466,6 +10982,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "enrollment_token", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "STRICT",
+      whenUnavailable: "The governed Flow action stops and downstream updates are halted, in every mode. The shadow observers only record, after the record is saved.",
+      configurable: null,
+      ungovernedMarker: null,
+      evidence: "apps/servicenow/app/script-includes/DecionisControlPlaneUtils.script.js; DecionisVerifyIntentAction.script.js"
+    },
     marketplaceTarget: "servicenow",
     providerId: "SERVICENOW"
   },
@@ -10479,7 +11002,7 @@ var connectors = [
     vendor: "Salesforce",
     category: "enterprise",
     status: "installable",
-    summary: "Pre-execution Action Gate for Salesforce \u2014 Flow, Apex, and Agentforce actions checked before they run (allow / hold / escalate) with signed Decision Dossiers on the record. Customer-deployed starter package, shadow-first rollout.",
+    summary: "Check Salesforce Flow, Apex and Agentforce actions before they run (allow, hold or escalate), with signed Decision Dossiers on the record. Install the starter package in your org; it starts in Shadow Mode.",
     capabilities: [
       "pre-execution-action-gate",
       "shadow-mode",
@@ -10503,6 +11026,13 @@ var connectors = [
     distribution: { download: true, guidedInstall: false, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "CUSTOM",
+      whenUnavailable: "The action returns an error message and no decision. A Flow that requires continueAction to be true stops; a Flow that does not check it continues.",
+      configurable: "Your Flow's condition on continueAction.",
+      ungovernedMarker: "errorMessage is set and continueAction is empty.",
+      evidence: "docs/marketplace/salesforce/starter-package/force-app/main/default/classes/DecionisActionGate.cls"
+    },
     marketplaceTarget: "salesforce",
     marketplaceListingId: "salesforce-app",
     providerId: "SALESFORCE"
@@ -10530,6 +11060,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "STRICT",
+      whenUnavailable: "The step retries once, then Zapier replays it; later steps in the Zap do not run until Decionis answers.",
+      configurable: null,
+      ungovernedMarker: null,
+      evidence: "packages/zapier-decionis/creates/DecisionDossierClient.js"
+    },
     marketplaceListingId: "zapier"
   },
   {
@@ -10555,31 +11092,45 @@ var connectors = [
     documentation: `${SITE}/docs/automation-connectors#make`,
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
-    presenceSupport: "planned"
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "CUSTOM",
+      whenUnavailable: "Make connects through its HTTP module. Decionis answers 502, and your scenario's error handling decides whether the next module runs.",
+      configurable: "The error handler on your scenario's HTTP module.",
+      ungovernedMarker: null,
+      evidence: "apps/web/app/docs/automation-connectors/page.tsx (Make recipe); apps/api/src/routes/ProtocolRoutes.ts"
+    }
   },
   {
-    // Community node published on npm (registry sweep 2026-08-10:
-    // n8n-nodes-decionis@0.1.0).
+    // The n8n community node (n8n-nodes-decionis) was retired on 2026-09-26.
+    // n8n stays a recipe: an HTTP Request node calls the same gate, and the
+    // four example workflows under /examples/n8n use only built-in nodes.
     slug: "n8n",
     name: "Decionis for n8n",
     vendor: "n8n",
     category: "automation",
-    status: "production",
-    version: "0.1.0",
-    summary: "Every automation step asks permission before it executes \u2014 install the n8n community node from npm, or start from the HTTP Request recipe and four importable example workflows.",
+    status: "installable",
+    summary: "Every automation step asks permission before it executes \u2014 add an HTTP Request node before the protected step, or start from four importable example workflows that use only built-in nodes.",
     capabilities: ["automation-step-governance", "signed-decision-dossier"],
     decisionsSupported: ["automation-step"],
     installation: [
       {
-        kind: "npm",
-        url: "https://www.npmjs.com/package/n8n-nodes-decionis",
-        label: "n8n community node on npm"
+        kind: "docs",
+        url: `${SITE}/docs/automation-connectors#n8n`,
+        label: "HTTP Request recipe and example workflows"
       }
     ],
     documentation: `${SITE}/docs/automation-connectors#n8n`,
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
-    presenceSupport: "planned"
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "CUSTOM",
+      whenUnavailable: "n8n connects through its HTTP Request node. Decionis answers 502, and your workflow's error handling decides whether the next node runs.",
+      configurable: "The HTTP Request node's On Error setting, and the IF branch on the outcome.",
+      ungovernedMarker: null,
+      evidence: "apps/web/app/docs/automation-connectors/page.tsx (n8n recipe); apps/api/src/routes/ProtocolRoutes.ts"
+    }
   },
   // ── Platform ──────────────────────────────────────────────────────────
   {
@@ -10604,6 +11155,13 @@ var connectors = [
     distribution: { download: false, guidedInstall: false, remoteInstall: false },
     activation: { method: "api_key", requiresWorkspace: true },
     presenceSupport: "planned",
+    failurePosture: {
+      posture: "OBSERVE_ONLY",
+      whenUnavailable: "Webhooks carry signals in and decisions out; they never hold an action themselves. Senders should retry 5xx answers and timeouts with backoff.",
+      configurable: null,
+      ungovernedMarker: null,
+      evidence: "apps/web/app/docs/webhooks/page.tsx"
+    },
     providerId: "WEBHOOK"
   },
   {
@@ -10627,10 +11185,17 @@ var connectors = [
         label: "Docker Hub"
       }
     ],
-    documentation: `${SITE}/docs/protocol-mcp`,
+    documentation: "https://decionis.ai/mcp",
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "enrollment_token", requiresWorkspace: true },
-    presenceSupport: "planned"
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "OBSERVE_ONLY",
+      whenUnavailable: "The extension shows decisions and verifies records offline; it does not hold container actions.",
+      configurable: null,
+      ungovernedMarker: null,
+      evidence: "Registry scope (visibility and offline verification); extension source at github.com/decionis/docker"
+    }
     // No providerId: like zapier/make, this surface connects through
     // connector_enrollments, never an org_integrations row.
   },
@@ -10659,14 +11224,21 @@ var connectors = [
       },
       {
         kind: "docs",
-        url: `${SITE}/docs/protocol-mcp#try-hosted`,
+        url: "https://decionis.ai/mcp#hosted",
         label: "Hosted connector guide"
       }
     ],
-    documentation: `${SITE}/docs/protocol-mcp`,
+    documentation: "https://decionis.ai/mcp",
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
-    presenceSupport: "planned"
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "OBSERVE_ONLY",
+      whenUnavailable: "The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.",
+      configurable: null,
+      ungovernedMarker: "The tool result is marked as an error.",
+      evidence: "apps/protocol/src/mcp/McpTools.ts"
+    }
   },
   {
     // ChatGPT connects through the same hosted MCP OAuth connector: the
@@ -10694,14 +11266,67 @@ var connectors = [
       },
       {
         kind: "docs",
-        url: `${SITE}/docs/protocol-mcp#try-hosted`,
+        url: "https://decionis.ai/mcp#hosted",
         label: "Hosted connector guide"
       }
     ],
-    documentation: `${SITE}/docs/protocol-mcp`,
+    documentation: "https://decionis.ai/mcp",
     distribution: { download: false, guidedInstall: true, remoteInstall: false },
     activation: { method: "oauth", requiresWorkspace: true },
-    presenceSupport: "planned"
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "OBSERVE_ONLY",
+      whenUnavailable: "The connector never runs the action itself. If Decionis cannot answer, the tool returns an error and no authority card; what the assistant does next is up to the assistant and you.",
+      configurable: null,
+      ungovernedMarker: "The tool result is marked as an error.",
+      evidence: "apps/protocol/src/mcp/McpTools.ts"
+    }
+  },
+  {
+    // Not a vendor connector: the Node SDK's AuthZEN input adapter, which
+    // carries an enterprise policy decision point's answer into evaluation
+    // as a material signal. `validated` = exercised against a real AuthZEN
+    // 1.0 PDP (Cerbos PDP 0.55.0) on 2026-09-22 with the exchange recorded
+    // and replayed through the starter bundle. The npm channel was added
+    // once @decionis/sdk 0.3.0 (the first version carrying the provider)
+    // was confirmed on the registry: published 2026-09-22T07:23Z, tarball
+    // shasum 37d6915a7a7e273eb51f4baa7b67987d62595b3f.
+    slug: "authzen",
+    name: "AuthZEN input adapter (Node SDK)",
+    vendor: "OpenID AuthZEN 1.0 policy decision points",
+    category: "platform",
+    status: "validated",
+    summary: "Carry an enterprise policy decision point's OpenID AuthZEN 1.0 answer into a Decionis evaluation as a material signal: the PDP decides access, Decionis decides whether this exact execution has authority, and the answer travels inside the signed inputs snapshot.",
+    capabilities: [
+      "upstream-authorization-signal",
+      "authzen-1-0-evaluation",
+      "allow-listed-discovery",
+      "signed-decision-dossier"
+    ],
+    decisionsSupported: ["any-evaluate-decision-request", "payment.release (starter bundle)"],
+    installation: [
+      {
+        kind: "npm",
+        url: "https://www.npmjs.com/package/@decionis/sdk",
+        label: "npm install @decionis/sdk (0.3.0 or later)"
+      }
+    ],
+    documentation: `${SITE}/docs/authzen-interoperability`,
+    verification: {
+      validatedBy: "Decionis engineering (recorded interoperability run, self-attested)",
+      evidence: "AuthZEN 1.0 discovery and evaluation against Cerbos PDP 0.55.0 recorded on 2026-09-22 (packages/sdk-node/test/fixtures/authzen-cerbos-interop.json) and replayed verbatim through the starter bundle by apps/protocol/test/UpstreamAuthorizationRecordedPdp.test.ts: permit \u2192 ALLOW within the desk limit / ESCALATE above it, deny \u2192 BLOCK; SDK and Protocol digests agree on the real material. Cerbos is the decision point used, not a partner. The provider ships in @decionis/sdk 0.3.0, on npm since 2026-09-22.",
+      lastValidated: "2026-09-22"
+    },
+    distribution: { download: false, guidedInstall: false, remoteInstall: false },
+    activation: { method: "api_key", requiresWorkspace: true },
+    presenceSupport: "planned",
+    failurePosture: {
+      posture: "CUSTOM",
+      whenUnavailable: "AuthZEN feeds Decionis a signal; it is not a gate. If Decionis is down, the SDK call it feeds decides, strict by default. If your PDP is down, no signal is sent and your policy's rule for a missing signal applies; the starter policy holds the action for review.",
+      configurable: "required_signals and on_failure in your policy, and the PDP timeout (five seconds by default).",
+      ungovernedMarker: null,
+      evidence: "packages/sdk-node/src/AuthZenEntitlementProvider.ts; docs/architecture/authzen-input-adapter.md"
+    }
   }
 ];
 var ConnectorRegistry = class {
@@ -10723,7 +11348,36 @@ var CONNECTOR_REGISTRY = ConnectorRegistry.connectors;
 var getConnector = ConnectorRegistry.bySlug;
 var CONNECTOR_SLUGS = ConnectorRegistry.slugs();
 
-// ../protocol/src/mcp/McpResources.ts
+// ../../../Decionis/packages/shared/src/Connectors/FailurePosture.ts
+var FAILURE_POSTURES = {
+  STRICT: {
+    label: "Strict",
+    meaning: "If Decionis cannot be reached, the action does not run. It is refused or held until an evaluation can happen.",
+    appropriateFor: [
+      "Payments and treasury releases",
+      "Privileged infrastructure changes",
+      "Machine-initiated actions with no natural limit on loss"
+    ]
+  },
+  BOUNDED_CONTINUITY: {
+    label: "Bounded continuity",
+    meaning: "If Decionis cannot be reached, the action may continue without an evaluation. It is ungoverned, not approved, and it is available only where a surface was configured for it.",
+    appropriateFor: ["A shopper at checkout, where the exposure per order is small and bounded"]
+  },
+  CUSTOM: {
+    label: "Custom",
+    meaning: "The institution sets the behaviour per rule or per signal, for example holding an action for review when one input is unavailable.",
+    appropriateFor: ["Institution-defined rules"]
+  }
+};
+var SURFACE_POSTURE_LABEL = {
+  STRICT: FAILURE_POSTURES.STRICT.label,
+  BOUNDED_CONTINUITY: FAILURE_POSTURES.BOUNDED_CONTINUITY.label,
+  CUSTOM: FAILURE_POSTURES.CUSTOM.label,
+  OBSERVE_ONLY: "Observe only"
+};
+
+// ../../../Decionis/apps/protocol/src/mcp/McpResources.ts
 var McpResources = class {
   static buildStaticResources(publicBaseUrl, serviceName, serviceVersion) {
     return [
@@ -11086,7 +11740,7 @@ function readResource(app, uri, options) {
   return McpResources.readResource(app, uri, options);
 }
 
-// ../protocol/src/mcp/McpPrompts.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpPrompts.ts
 var McpPrompts = class {
   static buildPrompts(publicBaseUrl, authDescription) {
     return [
@@ -11422,7 +12076,7 @@ function buildPrompts(publicBaseUrl, authDescription) {
   return McpPrompts.buildPrompts(publicBaseUrl, authDescription);
 }
 
-// ../protocol/src/support/Parsing.ts
+// ../../../Decionis/apps/protocol/src/support/Parsing.ts
 var Parsing = class {
   static asRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -11517,7 +12171,7 @@ function parseInstantMs(value) {
   return Parsing.parseInstantMs(value);
 }
 
-// ../protocol/src/mcp/DecisionConversation.ts
+// ../../../Decionis/apps/protocol/src/mcp/DecisionConversation.ts
 var INTERNAL_CONTEXT_KEYS = /* @__PURE__ */ new Set([
   "source_surface",
   "source_protocol",
@@ -11778,7 +12432,7 @@ function buildAuthoritySummary(input) {
   return DecisionConversation.buildAuthoritySummary(input);
 }
 
-// ../protocol/src/mcp/PresenceMcpIntegration.ts
+// ../../../Decionis/apps/protocol/src/mcp/PresenceMcpIntegration.ts
 import { createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var DEFAULT_PRESENCE_BASE_URL = "https://presence.decionis.com";
 var DEFAULT_TIMEOUT_MS = 1e4;
@@ -12135,7 +12789,7 @@ function sanitizePresenceDecisionContext(input) {
   };
 }
 
-// ../protocol/src/mcp/McpTools.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpTools.ts
 var GET_STARTED_SCENARIOS = [
   {
     user_question: "Can you send a $250,000 wire to Northstar Components?",
@@ -13287,7 +13941,7 @@ function findTool(tools, name) {
   return McpTools.findTool(tools, name);
 }
 
-// ../protocol/src/mcp/McpOriginPolicy.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpOriginPolicy.ts
 var DEFAULT_MCP_ALLOWED_ORIGINS = [
   "https://claude.ai",
   "https://chatgpt.com",
@@ -13321,7 +13975,7 @@ function isMcpOriginAllowed(origin2, allowedOrigins) {
   return parsed !== null && allowedOrigins.has(parsed);
 }
 
-// ../protocol/src/mcp/McpRoutes.ts
+// ../../../Decionis/apps/protocol/src/mcp/McpRoutes.ts
 function buildMcpOriginGuard(publicBaseUrl) {
   const allowedOrigins = buildMcpAllowedOrigins(publicBaseUrl);
   return async (req, reply) => {
@@ -13529,7 +14183,7 @@ async function handleJsonRpcRequest(app, requestBody, options) {
       }
       const toolStartedAt = process.hrtime.bigint();
       const args = asRecord2(params.arguments) ?? {};
-      const authError = authorizeToolInvocation(options.auth, name, args);
+      const authError = authorizeToolInvocation(options.auth, tool.name, args);
       if (authError) {
         const toolDurationMs2 = durationMs(toolStartedAt);
         await recordTelemetryBatch(app, options.telemetry, [
@@ -13566,7 +14220,10 @@ async function handleJsonRpcRequest(app, requestBody, options) {
           payload: jsonRpcError(id, authError.code, authError.message)
         };
       }
-      const result = await handleToolCall(tool, bindAuthenticatedOrgId(options.auth, name, args));
+      const result = await handleToolCall(
+        tool,
+        bindAuthenticatedOrgId(options.auth, tool.name, args)
+      );
       const outcome = canonicalAuthorizationOutcome(result.structuredContent);
       const toolDurationMs = durationMs(toolStartedAt);
       const terminalEvents = [
@@ -13777,7 +14434,7 @@ async function handleLegacyToolCall(app, store, auth, body) {
     };
   }
   const args = asRecord2(body.input) ?? {};
-  const authError = authorizeToolInvocation(auth, body.tool_name, args);
+  const authError = authorizeToolInvocation(auth, tool.name, args);
   if (authError) {
     return {
       error: "FORBIDDEN",
@@ -13786,7 +14443,7 @@ async function handleLegacyToolCall(app, store, auth, body) {
       is_error: true
     };
   }
-  const result = await handleToolCall(tool, bindAuthenticatedOrgId(auth, body.tool_name, args));
+  const result = await handleToolCall(tool, bindAuthenticatedOrgId(auth, tool.name, args));
   return {
     output: result.structuredContent ?? { text: result.content[0]?.text ?? "" },
     event: {
@@ -13961,7 +14618,7 @@ function registerProtocolMcpRoutes(app, options) {
     authorization_servers: [authorizationServerBaseUrl],
     bearer_methods_supported: ["header"],
     scopes_supported: ["decision:read", "decision:run", "decision:write"],
-    resource_documentation: "https://decionis.com/docs/protocol-mcp"
+    resource_documentation: "https://decionis.ai/mcp"
   };
   const oauthAuthorizationServer = {
     issuer: authorizationServerBaseUrl,
@@ -14013,7 +14670,7 @@ function registerProtocolMcpRoutes(app, options) {
   }
 }
 
-// ../protocol/src/execution-gating/ExecutionGatingSupport.ts
+// ../../../Decionis/apps/protocol/src/execution-gating/ExecutionGatingSupport.ts
 import { createHash as createHash5, createHmac as createHmac2, randomUUID as randomUUID3, timingSafeEqual as timingSafeEqual3 } from "crypto";
 var DEFAULT_POLICY_LIMITS = {
   max_single_payment_usd: 2,
@@ -14140,7 +14797,7 @@ function hashLedgerEntry(input) {
   return sha256(input);
 }
 
-// ../protocol/src/execution-gating/ExecutionGatingService.ts
+// ../../../Decionis/apps/protocol/src/execution-gating/ExecutionGatingService.ts
 var ExecutionGatingService = class {
   secret;
   tokenTtlSeconds;
@@ -14381,15 +15038,15 @@ var ExecutionGatingService = class {
     };
     const payload = base64UrlEncode(stableStringify(claims));
     const signature = sign(payload, this.secret);
-    const token = `exec_tok_${payload}.${signature}`;
-    const tokenHash = sha256(token);
+    const token2 = `exec_tok_${payload}.${signature}`;
+    const tokenHash = sha256(token2);
     this.tokens.set(claims.jti, {
       claims,
       token_hash: tokenHash,
       consumed_at: null
     });
     return {
-      token,
+      token: token2,
       claims,
       token_hash: tokenHash,
       expires_at: new Date(claims.exp * 1e3).toISOString()
@@ -14424,11 +15081,11 @@ var ExecutionGatingService = class {
     this.dossiers.set(dossier.dossier_id, dossier);
     return dossier;
   }
-  parseToken(token) {
-    if (!token.startsWith("exec_tok_")) {
+  parseToken(token2) {
+    if (!token2.startsWith("exec_tok_")) {
       return { valid: false, reason_codes: ["MALFORMED_EXECUTION_TOKEN"], claims: null };
     }
-    const compact = token.slice("exec_tok_".length);
+    const compact = token2.slice("exec_tok_".length);
     const [payload, signature] = compact.split(".");
     if (!payload || !signature) {
       return { valid: false, reason_codes: ["MALFORMED_EXECUTION_TOKEN"], claims: null };
@@ -14468,7 +15125,7 @@ var ExecutionGatingService = class {
     const evaluation = this.evaluatePolicy(request);
     const shadow = request.mode === "SHADOW";
     const status = evaluation.status;
-    const token = bindExecution && !shadow && status === "ALLOW" ? this.issueToken({ request, decision_id, chain_id, action_hash }) : null;
+    const token2 = bindExecution && !shadow && status === "ALLOW" ? this.issueToken({ request, decision_id, chain_id, action_hash }) : null;
     const ledgerEntry = this.appendLedger({
       tenant_id: request.tenant_id,
       event_type: status === "ALLOW" ? "tool.execution.allowed" : "tool.execution.blocked",
@@ -14483,10 +15140,10 @@ var ExecutionGatingService = class {
       metadata: {
         action_hash,
         target: request.downstream_target,
-        token_issued: Boolean(token)
+        token_issued: Boolean(token2)
       }
     });
-    if (token) {
+    if (token2) {
       this.appendLedger({
         tenant_id: request.tenant_id,
         event_type: "execution.token.issued",
@@ -14498,7 +15155,7 @@ var ExecutionGatingService = class {
         amount: request.action.amount,
         status: "ISSUED",
         reason_codes: ["EXECUTION_TOKEN_ISSUED"],
-        metadata: { token_hash: token.token_hash, expires_at: token.expires_at }
+        metadata: { token_hash: token2.token_hash, expires_at: token2.expires_at }
       });
     }
     this.decisions.set(decision_id, {
@@ -14518,7 +15175,7 @@ var ExecutionGatingService = class {
       status,
       reason_codes: evaluation.reason_codes,
       telemetry: evaluation.telemetry,
-      token_hash: token?.token_hash ?? null
+      token_hash: token2?.token_hash ?? null
     });
     const responseBase = {
       decision_id,
@@ -14529,15 +15186,15 @@ var ExecutionGatingService = class {
       should_execute: shadow ? true : status === "ALLOW",
       evaluation_mode: request.mode,
       authority_classification: shadow ? "OBSERVATIONAL" : "AUTHORITATIVE",
-      execution_eligible: token !== null,
+      execution_eligible: token2 !== null,
       reason_codes: evaluation.reason_codes,
       policy_snapshot: POLICY_SNAPSHOT,
       risk_score: evaluation.risk_score,
       blast_radius: request.action.amount && request.action.amount > 1 ? "medium" : "low",
       required_escalation: null,
       action_hash,
-      execution_token: token?.token ?? null,
-      execution_token_expires_at: token?.expires_at ?? null,
+      execution_token: token2?.token ?? null,
+      execution_token_expires_at: token2?.expires_at ?? null,
       dossier_id: dossier.dossier_id,
       dossier_url: `/v1/authority/dossiers/${dossier.dossier_id}`,
       ledger_entry_id: ledgerEntry.event_id
@@ -14555,7 +15212,7 @@ function createExecutionGatingService(options = {}) {
   return new ExecutionGatingService(options);
 }
 
-// ../protocol/src/execution-gating/ExecutionGatingRoutes.ts
+// ../../../Decionis/apps/protocol/src/execution-gating/ExecutionGatingRoutes.ts
 function verificationInputFromBody(body, tokenFallback) {
   const input = asRecord4(body);
   const target = asRecord4(input.downstream_target);
@@ -14796,7 +15453,7 @@ function registerExecutionGatingRoutes(app, options) {
   ExecutionGatingRoutes.register(app, options);
 }
 
-// ../protocol/src/authority/AuthorityPolicyParser.ts
+// ../../../Decionis/apps/protocol/src/authority/AuthorityPolicyParser.ts
 var ROLE_ID = /^[A-Z][A-Z0-9_]{1,63}$/;
 var REASON_CODE = /^[A-Z][A-Z0-9_]{1,119}$/;
 var METHODS = /* @__PURE__ */ new Set(["WEBAUTHN", "MOBILE_DEVICE", "ACTIVE_LIVENESS"]);
@@ -14809,7 +15466,8 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     const verification = _AuthorityPolicyParser.parseVerification(record.verification_requirements);
     const resolution = _AuthorityPolicyParser.parseResolution(record.resolution, selector);
     const expiresInSeconds = asNumber(record.expires_in_seconds);
-    if (!reasonCodes || !selector || !verification || !resolution || expiresInSeconds == null || !Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 3600) {
+    const maxExpiresInSeconds = resolution?.tiers === void 0 ? _AuthorityPolicyParser.MAX_CEREMONY_SECONDS : _AuthorityPolicyParser.MAX_CHAIN_SECONDS;
+    if (!reasonCodes || !selector || !verification || !resolution || expiresInSeconds == null || !Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > maxExpiresInSeconds) {
       return null;
     }
     return {
@@ -14820,6 +15478,8 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
       expires_in_seconds: expiresInSeconds
     };
   }
+  static MAX_CEREMONY_SECONDS = 3600;
+  static MAX_CHAIN_SECONDS = 7 * 24 * 3600;
   static policyKeys = /* @__PURE__ */ new Set([
     "reason_codes",
     "selector",
@@ -14901,7 +15561,7 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     const record = asRecord3(input);
     if (!_AuthorityPolicyParser.hasOnlyKeys(
       record,
-      /* @__PURE__ */ new Set(["quorum", "delegation", "fallback_role_ids"])
+      /* @__PURE__ */ new Set(["quorum", "delegation", "fallback_role_ids", "tiers"])
     ) || record.quorum !== 1 || record.delegation !== "DISALLOWED" && record.delegation !== "REQUIREMENT_REFRESH" || !Array.isArray(record.fallback_role_ids) || record.fallback_role_ids.length > 10) {
       return null;
     }
@@ -14911,12 +15571,46 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     if (fallbackRoles.length !== record.fallback_role_ids.length || new Set(fallbackRoles).size !== fallbackRoles.length || selector?.kind === "ROLE" && fallbackRoles.includes(selector.role_id)) {
       return null;
     }
+    const tiers = _AuthorityPolicyParser.parseTiers(record.tiers);
+    if (record.tiers !== void 0 && tiers === null) return null;
+    if (tiers && selector?.kind !== "ROLE") return null;
     return {
       quorum: 1,
       delegation: record.delegation,
-      fallback_role_ids: fallbackRoles
+      fallback_role_ids: fallbackRoles,
+      ...tiers ? { tiers } : {}
     };
   }
+  /** Priority tiers of principals; unique ascending priorities, a principal in one tier only. */
+  static parseTiers(input) {
+    if (input === void 0) return null;
+    if (!Array.isArray(input) || input.length < 1 || input.length > 5) return null;
+    const tiers = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const value of input) {
+      const tier = asRecord3(value);
+      if (!_AuthorityPolicyParser.hasOnlyKeys(tier, /* @__PURE__ */ new Set(["priority", "principal_ids"]))) {
+        return null;
+      }
+      const priority = asNumber(tier.priority);
+      if (priority == null || !Number.isInteger(priority) || priority < 1 || priority > 5 || tiers.length > 0 && priority <= tiers[tiers.length - 1].priority) {
+        return null;
+      }
+      if (!Array.isArray(tier.principal_ids) || tier.principal_ids.length < 1 || tier.principal_ids.length > 10) {
+        return null;
+      }
+      const principalIds = tier.principal_ids.filter(
+        (id) => typeof id === "string" && id.length >= 1 && id.length <= 200
+      );
+      if (principalIds.length !== tier.principal_ids.length) return null;
+      for (const id of principalIds) {
+        if (seen.has(id)) return null;
+        seen.add(id);
+      }
+      tiers.push({ priority, principal_ids: principalIds });
+    }
+    return tiers;
+  }
   static parseRegions(input) {
     if (input === void 0) return null;
     if (!Array.isArray(input) || input.length < 1 || input.length > 100) return null;
@@ -14932,10 +15626,10 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
   }
 };
 
-// ../protocol/src/support/Hashing.ts
+// ../../../Decionis/apps/protocol/src/support/Hashing.ts
 import { createHash as createHash6 } from "crypto";
 
-// ../protocol/src/integrity/DossierIntegrity.ts
+// ../../../Decionis/apps/protocol/src/integrity/DossierIntegrity.ts
 var DECISION_DOSSIER_JWKS_PATH2 = "/.well-known/decision-dossier-jwks.json";
 var DossierIntegrity = class _DossierIntegrity {
   static stableJsonStringify(value) {
@@ -15045,7 +15739,7 @@ function buildDecisionDossierVerificationStatus(input) {
   return DossierIntegrity.buildDecisionDossierVerificationStatus(input);
 }
 
-// ../protocol/src/support/Hashing.ts
+// ../../../Decionis/apps/protocol/src/support/Hashing.ts
 var Hashing = class {
   static sha256Hex(input) {
     return createHash6("sha256").update(input, "utf8").digest("hex");
@@ -15073,7 +15767,7 @@ function canonicalizeForHash(value) {
   return Hashing.canonicalizeForHash(value);
 }
 
-// ../protocol/src/policy-graph/PolicyGraph.ts
+// ../../../Decionis/apps/protocol/src/policy-graph/PolicyGraph.ts
 var PolicyGraph = class _PolicyGraph {
   static sortPolicyBundlesNewestFirst(left, right) {
     const leftEffective = parseInstantMs(left.effective_from) ?? Number.MIN_SAFE_INTEGER;
@@ -15378,6 +16072,14 @@ var PolicyGraph = class _PolicyGraph {
    * a dotted path is used as-is, so history facts (`history.window`) and
    * top-level facts can be required too. Deterministic: derived from the
    * bundle alone.
+   *
+   * The one exception is a bare name that IS a reserved root — the runtime
+   * signals an enforcement boundary reports, and the attribution the platform
+   * computes from them. Those live at the top of the fact set, not under
+   * `signals.`, so resolving `workload` to `signals.workload` would make it
+   * permanently missing and every evaluation a fail-safe ESCALATE. A bundle
+   * that means "refuse unless a workload was reported" writes `workload`, and
+   * gets what it meant.
    */
   static resolveRequiredSignalPaths(bundle) {
     const declared = asRecord3(bundle.payload).required_signals;
@@ -15387,7 +16089,8 @@ var PolicyGraph = class _PolicyGraph {
     for (const entry of entries.slice(0, 50)) {
       const raw = asString2(entry)?.trim();
       if (!raw) continue;
-      const path = raw.includes(".") ? raw : `signals.${raw}`;
+      const reservedRoot = raw === RUNTIME_ATTRIBUTION_FACT || RUNTIME_SIGNAL_ROOTS.includes(raw);
+      const path = raw.includes(".") || reservedRoot ? raw : `signals.${raw}`;
       if (!paths.includes(path)) paths.push(path);
     }
     return paths;
@@ -15465,6 +16168,10 @@ var PolicyGraph = class _PolicyGraph {
       signals[key] = normalized.value;
       if (normalized.provenance) signalProvenance[key] = normalized.provenance;
     }
+    const runtimeSignals = RuntimeSignals.parse(context);
+    const runtimeAttribution = RuntimeSignals.attributionOf(
+      runtimeSignals.ok ? runtimeSignals : { boundary: null, workload: null }
+    );
     const history = asRecord3(context.history);
     const override = asRecord3(context.override);
     const evidence = asRecord3(context.evidence);
@@ -15488,7 +16195,15 @@ var PolicyGraph = class _PolicyGraph {
       intake: context,
       // Reserved fact namespaces — these keys shadow same-named context keys
       // (the spread above runs first): signals, signal_provenance, history,
-      // override, evidence, attachments, attachment_count, policy.
+      // override, evidence, attachments, attachment_count, policy,
+      // runtime_attribution.
+      //
+      // `runtime_attribution` is the platform's own statement about the
+      // boundary's report, and `platform_verified` on it is the field that
+      // means "Decionis established this" rather than "our gateway said so".
+      // It is computed here and shadows anything of that name a caller sent,
+      // which the request parser refuses outright anyway.
+      [RUNTIME_ATTRIBUTION_FACT]: runtimeAttribution,
       signals,
       signal_provenance: signalProvenance,
       signal_admission: {
@@ -15915,7 +16630,7 @@ function toEvaluatePolicySnapshot(input) {
   return PolicyGraph.toEvaluatePolicySnapshot(input);
 }
 
-// ../protocol/src/agent-gateway/AgentTaskPolicyResolver.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentTaskPolicyResolver.ts
 var PolicyGraphAgentTaskPolicyResolver = class {
   constructor(store) {
     this.store = store;
@@ -16083,7 +16798,7 @@ var PolicyGraphAgentTaskPolicyResolver = class {
   }
 };
 
-// ../protocol/src/agent-gateway/MemoryAgentTaskReservationStore.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/MemoryAgentTaskReservationStore.ts
 import { randomUUID as randomUUID4 } from "crypto";
 var MemoryAgentTaskReservationStore = class {
   reservations = /* @__PURE__ */ new Map();
@@ -16243,7 +16958,7 @@ function createMemoryAgentTaskReservationStore() {
   return new MemoryAgentTaskReservationStore();
 }
 
-// ../protocol/src/agent-gateway/AgentTaskCostEstimator.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentTaskCostEstimator.ts
 var TOKENS_PER_MILLION = 1e6;
 var AgentTaskCostEstimator = class {
   project(intent, policy) {
@@ -16305,7 +17020,7 @@ var AgentTaskCostEstimator = class {
   }
 };
 
-// ../protocol/src/agent-gateway/AgentTaskIntentParser.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentTaskIntentParser.ts
 import { createHash as createHash7 } from "crypto";
 var AgentTaskIntentParser = class _AgentTaskIntentParser {
   static parse(input) {
@@ -16409,7 +17124,7 @@ var AgentTaskIntentParser = class _AgentTaskIntentParser {
   }
 };
 
-// ../protocol/src/agent-gateway/AgentTaskGatewayService.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentTaskGatewayService.ts
 var AgentTaskGatewayService = class {
   constructor(store, policyResolver, authority, estimator = new AgentTaskCostEstimator(), options = {}) {
     this.store = store;
@@ -16595,7 +17310,7 @@ var AgentTaskGatewayService = class {
   }
 };
 
-// ../protocol/src/agent-gateway/AgentGatewayAuthGuard.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentGatewayAuthGuard.ts
 import { timingSafeEqual as timingSafeEqual4 } from "crypto";
 var AgentGatewayAuthGuard = class {
   constructor(lookup, env = process.env) {
@@ -16648,7 +17363,7 @@ var AgentGatewayAuthGuard = class {
   }
 };
 
-// ../protocol/src/agent-gateway/AgentProviderProxy.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentProviderProxy.ts
 var AgentProviderProxy = class {
   constructor(gateway, options = {}) {
     this.gateway = gateway;
@@ -16853,10 +17568,10 @@ var AgentProviderProxy = class {
   }
 };
 
-// ../protocol/src/agent-gateway/providers/AnthropicProviderAdapter.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/providers/AnthropicProviderAdapter.ts
 import { createHash as createHash8 } from "crypto";
 
-// ../protocol/src/agent-gateway/providers/AgentProviderAdapter.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/providers/AgentProviderAdapter.ts
 var AgentProviderValues = class _AgentProviderValues {
   static asRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -16897,7 +17612,7 @@ var AgentProviderValues = class _AgentProviderValues {
   }
 };
 
-// ../protocol/src/agent-gateway/providers/AnthropicProviderAdapter.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/providers/AnthropicProviderAdapter.ts
 var AnthropicProviderAdapter = class {
   provider = "anthropic";
   operation = "messages.create";
@@ -16984,7 +17699,7 @@ var AnthropicProviderAdapter = class {
   }
 };
 
-// ../protocol/src/agent-gateway/providers/OpenAiProviderAdapter.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/providers/OpenAiProviderAdapter.ts
 import { createHash as createHash9 } from "crypto";
 var OpenAiProviderAdapter = class {
   provider = "openai";
@@ -17083,7 +17798,7 @@ var OpenAiProviderAdapter = class {
   }
 };
 
-// ../protocol/src/agent-gateway/providers/AgentProviderRegistry.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/providers/AgentProviderRegistry.ts
 var AgentProviderRegistry = class {
   adapters;
   constructor(adapters = [
@@ -17097,7 +17812,7 @@ var AgentProviderRegistry = class {
   }
 };
 
-// ../protocol/src/agent-gateway/AgentTaskGatewayRoutes.ts
+// ../../../Decionis/apps/protocol/src/agent-gateway/AgentTaskGatewayRoutes.ts
 var AgentTaskGatewayRoutes = class {
   static register(app, options) {
     const auth = new AgentGatewayAuthGuard(options.authLookup);
@@ -17248,11 +17963,24 @@ var AgentTaskGatewayRoutes = class {
   }
 };
 
-// ../protocol/src/ProtocolInfo.ts
+// ../../../Decionis/apps/protocol/src/ProtocolInfo.ts
 var PROTOCOL_SERVICE = "decionis-protocol";
 var PROTOCOL_VERSION = "1.0.0";
 
-// ../protocol/src/health/HealthRoutes.ts
+// ../../../Decionis/apps/protocol/src/discovery/GlamaClaimRoutes.ts
+var GlamaClaimRoutes = class {
+  register(app) {
+    app.get(
+      "/.well-known/glama.json",
+      async (_request, reply) => reply.header("cache-control", "public, max-age=300").send({
+        $schema: "https://glama.ai/mcp/schemas/connector.json",
+        claim: "glama_claim_BUHrLznF-9qs1cZEwwb2AN5CkXK7tNjS"
+      })
+    );
+  }
+};
+
+// ../../../Decionis/apps/protocol/src/health/HealthRoutes.ts
 function registerHealthRoutes(app, deps) {
   const { store } = deps;
   app.get("/v1/protocol/health", async () => ({
@@ -17277,14 +18005,14 @@ function registerHealthRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/finance-overrides/FinanceOverrideRoutes.ts
+// ../../../Decionis/apps/protocol/src/finance-overrides/FinanceOverrideRoutes.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
-// ../protocol/src/validation/ProtocolArtifacts.ts
+// ../../../Decionis/apps/protocol/src/validation/ProtocolArtifacts.ts
 import Ajv2020 from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
 
-// ../../docs/decionis.protocol.schemas/v1/audit-ledger-entry.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/audit-ledger-entry.schema.json
 var audit_ledger_entry_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/audit-ledger-entry.schema.json",
@@ -17314,7 +18042,8 @@ var audit_ledger_entry_schema_default = {
         "EXECUTION_STATUS_CHANGED",
         "EXPORT_GENERATED",
         "ACCESS_GRANTED",
-        "ACCESS_REVOKED"
+        "ACCESS_REVOKED",
+        "LEDGER_FORK_RESOLVED"
       ]
     },
     occurred_at: {
@@ -17445,7 +18174,7 @@ var audit_ledger_entry_schema_default = {
   ]
 };
 
-// ../../docs/decionis.protocol.schemas/v1/context-snapshot.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/context-snapshot.schema.json
 var context_snapshot_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/context-snapshot.schema.json",
@@ -17600,7 +18329,7 @@ var context_snapshot_schema_default = {
   ]
 };
 
-// ../../docs/decionis.protocol.schemas/v1/decision-resolution.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/decision-resolution.schema.json
 var decision_resolution_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/decision-resolution.schema.json",
@@ -17773,7 +18502,7 @@ var decision_resolution_schema_default = {
   ]
 };
 
-// ../../docs/decionis.protocol.schemas/v1/execution-dispatch.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/execution-dispatch.schema.json
 var execution_dispatch_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/execution-dispatch.schema.json",
@@ -17892,7 +18621,7 @@ var execution_dispatch_schema_default = {
   ]
 };
 
-// ../../docs/decionis.protocol.schemas/v1/policy-bundle.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/policy-bundle.schema.json
 var policy_bundle_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/policy-bundle.schema.json",
@@ -18171,6 +18900,27 @@ var policy_bundle_schema_default = {
           maxItems: 10,
           uniqueItems: true,
           items: { type: "string", pattern: "^[A-Z][A-Z0-9_]{1,63}$" }
+        },
+        tiers: {
+          type: "array",
+          minItems: 1,
+          maxItems: 5,
+          description: "An approval chain: priority tiers of principals, asked at once; one valid proof from every tier satisfies the requirement. Requires a ROLE selector naming the members' trusted role.",
+          items: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              priority: { type: "integer", minimum: 1, maximum: 5 },
+              principal_ids: {
+                type: "array",
+                minItems: 1,
+                maxItems: 10,
+                uniqueItems: true,
+                items: { type: "string", minLength: 1, maxLength: 200 }
+              }
+            },
+            required: ["priority", "principal_ids"]
+          }
         }
       },
       required: ["quorum", "delegation", "fallback_role_ids"]
@@ -18194,7 +18944,8 @@ var policy_bundle_schema_default = {
         expires_in_seconds: {
           type: "integer",
           minimum: 60,
-          maximum: 3600
+          maximum: 604800,
+          description: "How long the requirement lives. At most 3600 for one ceremony; a requirement whose resolution names tiers is an approval chain and may run to a week."
         }
       },
       required: [
@@ -18562,7 +19313,7 @@ var policy_bundle_schema_default = {
   required: ["protocol_version", "bundle_id", "org_id", "version", "effective_from", "rules"]
 };
 
-// ../../docs/decionis.protocol.schemas/v1/signal-envelope.schema.json
+// ../../../Decionis/docs/decionis.protocol.schemas/v1/signal-envelope.schema.json
 var signal_envelope_schema_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://decionis.io/protocol/schemas/v1/signal-envelope.schema.json",
@@ -18776,7 +19527,7 @@ var signal_envelope_schema_default = {
   ]
 };
 
-// ../protocol/src/validation/ProtocolArtifacts.ts
+// ../../../Decionis/apps/protocol/src/validation/ProtocolArtifacts.ts
 var ajv = new Ajv2020({ allErrors: true, strict: false });
 addFormats(ajv);
 var ProtocolArtifacts = class _ProtocolArtifacts {
@@ -18811,7 +19562,7 @@ function validateProtocolArtifact(artifact, payload) {
   return ProtocolArtifacts.validate(artifact, payload);
 }
 
-// ../protocol/src/finance-overrides/FinanceOverrideContracts.ts
+// ../../../Decionis/apps/protocol/src/finance-overrides/FinanceOverrideContracts.ts
 var FINANCE_OVERRIDE_REASON_CODES = [
   "POLICY_EXCEPTION",
   "RISK_THRESHOLD_OVERRIDE",
@@ -18823,7 +19574,7 @@ var FINANCE_OVERRIDE_REASON_CODES = [
   "MANUAL_VERIFICATION_REQUIRED"
 ];
 
-// ../protocol/src/finance-overrides/FinanceOverrides.ts
+// ../../../Decionis/apps/protocol/src/finance-overrides/FinanceOverrides.ts
 import { createHash as createHash10, randomUUID as randomUUID5 } from "crypto";
 var FinanceOverrides = class {
   static parseActorType(value) {
@@ -19126,7 +19877,7 @@ function appendFinanceOverrideLedgerEvent(store, input) {
   return FinanceOverrides.appendFinanceOverrideLedgerEvent(store, input);
 }
 
-// ../protocol/src/finance-overrides/FinanceOverrideRoutes.ts
+// ../../../Decionis/apps/protocol/src/finance-overrides/FinanceOverrideRoutes.ts
 function registerFinanceOverrideRoutes(app, deps) {
   const { store } = deps;
   app.get("/v1/protocol/finance/override-reason-codes", async () => ({
@@ -19332,10 +20083,10 @@ function registerFinanceOverrideRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/evaluate-decision/EvaluateDecisionRoutes.ts
+// ../../../Decionis/apps/protocol/src/evaluate-decision/EvaluateDecisionRoutes.ts
 import { createHash as createHash14, randomUUID as randomUUID10 } from "crypto";
 
-// ../protocol/src/support/Performance.ts
+// ../../../Decionis/apps/protocol/src/support/Performance.ts
 var ProtocolPerformance = class {
   static durationMs(startedAt) {
     return Number(process.hrtime.bigint() - startedAt) / 1e6;
@@ -19395,7 +20146,7 @@ function toProtocolPerformanceSnapshot(value) {
   return ProtocolPerformance.toProtocolPerformanceSnapshot(value);
 }
 
-// ../protocol/src/verticals/affiliate-rewards/AffiliateRewardsPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/affiliate-rewards/AffiliateRewardsPack.ts
 var affiliateRewardsVerticalPack = {
   key: "affiliate_rewards",
   display_name: "Affiliate Rewards",
@@ -19480,7 +20231,172 @@ var affiliateRewardsVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/core/CorePack.ts
+// ../../../Decionis/apps/protocol/src/verticals/commerce/CommercePack.ts
+var commerceVerticalPack = {
+  key: "commerce",
+  display_name: "Commerce Gate",
+  description: "Governance for storefront and marketplace decisions \u2014 price and promotion changes, inventory mutations, order acceptance and release, and refunds \u2014 against the merchant's margin, inventory and refund floors.",
+  workflow_keys: [
+    "commerce",
+    "commerce_order_release",
+    "commerce_refund_approve",
+    "commerce_refund_request",
+    "commerce_price_change",
+    "commerce_promotion_change",
+    "commerce_inventory_mutation",
+    "commerce_order_acceptance"
+  ],
+  default_domain: "COMMERCE",
+  signal_mappings: [
+    { domain: "COMMERCE", metric_name: "net_margin_percent", source_hint: "commerce_connector" },
+    { domain: "COMMERCE", metric_name: "available_inventory", source_hint: "commerce_connector" },
+    { domain: "COMMERCE", metric_name: "refund_amount", source_hint: "commerce_connector" }
+  ],
+  policy_bundle: {
+    version: "commerce-v1",
+    rules: [
+      {
+        rule_id: "reject_refund_above_refundable",
+        name: "Reject refunds above the refundable balance",
+        decision_domain: "COMMERCE",
+        when: {
+          all: [{ field: "signals.refund_exceeds_refundable", operator: "EQ", value: true }]
+        },
+        then: { action: "AUTO_REJECT", severity: "urgent", sla_minutes: 60 },
+        priority: 400,
+        enabled: true,
+        rationale: "A refund that exceeds what the order has left to refund is never sent."
+      },
+      {
+        rule_id: "escalate_order_release",
+        name: "A held order is released only by an approver",
+        decision_domain: "COMMERCE",
+        when: {
+          all: [{ field: "workflow_key", operator: "EQ", value: "commerce_order_release" }]
+        },
+        then: { action: "ESCALATE", severity: "elevated", sla_minutes: 240 },
+        priority: 360,
+        enabled: true,
+        rationale: "Releasing an order the gate held is its own decision and needs an approver to prove who made it."
+      },
+      {
+        rule_id: "escalate_large_refund",
+        name: "Escalate refunds above the unattended limit",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.refund_amount", operator: "GT", value: 1e3 }] },
+        then: { action: "ESCALATE", severity: "elevated", sla_minutes: 240 },
+        priority: 350,
+        enabled: true,
+        rationale: "A refund above the unattended limit needs a named approver before it is sent."
+      },
+      {
+        rule_id: "review_repeat_refund",
+        name: "Review a second refund on the same line",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.prior_refund_count", operator: "GT", value: 0 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 340,
+        enabled: true,
+        rationale: "A refund on an order line that was already refunded is the double-refund case."
+      },
+      {
+        rule_id: "review_margin_floor",
+        name: "Protect minimum margin",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.net_margin_percent", operator: "LT", value: 12 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 300,
+        enabled: true,
+        rationale: "Review commerce actions that would take net margin below the merchant floor."
+      },
+      {
+        rule_id: "review_inventory_floor",
+        name: "Protect low inventory",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.available_inventory", operator: "LT", value: 10 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 250,
+        enabled: true,
+        rationale: "Review fulfilment when source-of-truth inventory is below the safety floor."
+      },
+      {
+        rule_id: "review_discount_stacking",
+        name: "Review stacked promotions",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.discount_count", operator: "GT", value: 1 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 200,
+        enabled: true,
+        rationale: "Review carts that combine more discount sources than the merchant allows."
+      },
+      {
+        rule_id: "approve_routine_commerce",
+        name: "Approve routine commerce actions",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "decision_type", operator: "EXISTS", value: true }] },
+        then: { action: "AUTO_APPROVE", severity: "routine", sla_minutes: 30 },
+        priority: 10,
+        enabled: true,
+        rationale: "A storefront action proceeds when no floor is breached and nothing is held."
+      }
+    ]
+  },
+  resolver_overrides: {
+    // Whatever engine scored it, a storefront decision is a commerce decision.
+    domain_by_engine: {
+      finance: "COMMERCE",
+      software: "COMMERCE",
+      procure: "COMMERCE",
+      hiring: "COMMERCE"
+    },
+    intent_domain_hints: [
+      {
+        domain: "COMMERCE",
+        keywords: [
+          "commerce",
+          "order",
+          "refund",
+          "price",
+          "promotion",
+          "discount",
+          "inventory",
+          "listing",
+          "cart",
+          "checkout",
+          "merchant",
+          "storefront",
+          "marketplace"
+        ]
+      }
+    ],
+    evidence_required_keywords: ["refund", "release"],
+    missing_evidence_fields: ["purchase_order_id"],
+    base_confidence: 0.6,
+    attachment_confidence_bonus: 0.08,
+    intake_confidence_bonus: 0.02,
+    missing_evidence_penalty: 0.2
+  },
+  execution_templates: {
+    SUCCEEDED: [
+      "Apply the storefront change",
+      "Record the decision dossier",
+      "Notify the merchant"
+    ],
+    NEEDS_EVIDENCE: ["Attach cost or refund evidence", "Confirm the approver", "Re-run evaluation"],
+    FAILED: [
+      "Hold the order or change",
+      "Escalate to the merchant's approver",
+      "Capture the override reason"
+    ]
+  },
+  ui_copy: {
+    recommendation_success: "Proceed with the {domain} action; the merchant's floors hold.",
+    recommendation_needs_evidence: "Attach the cost or refund evidence {domain} needs before approval.",
+    recommendation_failed: "Hold the {domain} action for the merchant's approver."
+  }
+};
+
+// ../../../Decionis/apps/protocol/src/verticals/core/CorePack.ts
 var coreVerticalPack = {
   key: "core",
   display_name: "Core Operations",
@@ -19559,7 +20475,7 @@ var coreVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/devops/DevopsPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/devops/DevopsPack.ts
 var devopsVerticalPack = {
   key: "devops",
   display_name: "DevOps & CI",
@@ -19685,7 +20601,7 @@ var devopsVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/finance/FinancePack.ts
+// ../../../Decionis/apps/protocol/src/verticals/finance/FinancePack.ts
 var financeVerticalPack = {
   key: "finance",
   display_name: "Financial Decision Authority",
@@ -19838,7 +20754,7 @@ var financeVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/hospitality/HospitalityPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/hospitality/HospitalityPack.ts
 var hospitalityVerticalPack = {
   key: "hospitality",
   display_name: "Hospitality Operations",
@@ -19936,7 +20852,7 @@ var hospitalityVerticalPack = {
   }
 };
 
-// ../../packages/shared/src/Verticals/OpsDualGate.ts
+// ../../../Decionis/packages/shared/src/Verticals/OpsDualGate.ts
 var OpsDualGate = class _OpsDualGate {
   static requiredSpendFields = ["amount", "currency", "vendor_id"];
   static authorizedRoles = /* @__PURE__ */ new Set([
@@ -20416,7 +21332,7 @@ function cleanOpsReason(gate) {
   return OpsDualGate.cleanReason(gate);
 }
 
-// ../protocol/src/verticals/personal/PersonalPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/personal/PersonalPack.ts
 var personalVerticalPack = {
   key: "personal_productivity",
   display_name: "Personal Productivity",
@@ -20522,7 +21438,7 @@ var personalVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/salesforce/SalesforcePack.ts
+// ../../../Decionis/apps/protocol/src/verticals/salesforce/SalesforcePack.ts
 var salesforceVerticalPack = {
   key: "salesforce",
   display_name: "Salesforce Revenue Execution",
@@ -20787,7 +21703,7 @@ var salesforceVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/sap/SapPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/sap/SapPack.ts
 var sapVerticalPack = {
   key: "sap",
   display_name: "SAP Execution Authority",
@@ -21053,7 +21969,7 @@ var sapVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/template/TemplatePack.ts
+// ../../../Decionis/apps/protocol/src/verticals/template/TemplatePack.ts
 var templateVerticalPack = {
   key: "template",
   display_name: "Template Vertical Pack",
@@ -21106,7 +22022,7 @@ var templateVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/workday/WorkdayPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/workday/WorkdayPack.ts
 var workdayVerticalPack = {
   key: "workday",
   display_name: "Workday HR Governance",
@@ -21406,7 +22322,7 @@ var workdayVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/workday-financials/WorkdayFinancialsPack.ts
+// ../../../Decionis/apps/protocol/src/verticals/workday-financials/WorkdayFinancialsPack.ts
 var workdayFinancialsVerticalPack = {
   key: "workday_financials",
   display_name: "Workday Financials Circuit Breaker",
@@ -21627,7 +22543,7 @@ var workdayFinancialsVerticalPack = {
   }
 };
 
-// ../protocol/src/verticals/workflows/WorkflowPacks.ts
+// ../../../Decionis/apps/protocol/src/verticals/workflows/WorkflowPacks.ts
 var WorkflowPackFactory = class {
   static create(config) {
     return {
@@ -22272,11 +23188,12 @@ var workflowVerticalPacks = [
   })
 ];
 
-// ../protocol/src/verticals/VerticalRegistry.ts
+// ../../../Decionis/apps/protocol/src/verticals/VerticalRegistry.ts
 var DEFAULT_VERTICAL_PACK_KEY = "core";
 var packRegistry = new Map([
   [coreVerticalPack.key, coreVerticalPack],
   [affiliateRewardsVerticalPack.key, affiliateRewardsVerticalPack],
+  [commerceVerticalPack.key, commerceVerticalPack],
   [devopsVerticalPack.key, devopsVerticalPack],
   [financeVerticalPack.key, financeVerticalPack],
   [hospitalityVerticalPack.key, hospitalityVerticalPack],
@@ -22331,7 +23248,7 @@ function requireVerticalPack(key) {
   return VerticalRegistry.require(key);
 }
 
-// ../protocol/src/verticals/VerticalResolver.ts
+// ../../../Decionis/apps/protocol/src/verticals/VerticalResolver.ts
 var VerticalResolver = class _VerticalResolver {
   static async resolveForRequest(input) {
     const requested = getVerticalPack(input.requestedPackKey);
@@ -22377,13 +23294,13 @@ async function resolveVerticalPackForRequest(input) {
   return VerticalResolver.resolveForRequest(input);
 }
 
-// ../protocol/src/decision-chains/DecisionChains.ts
+// ../../../Decionis/apps/protocol/src/decision-chains/DecisionChains.ts
 import { randomUUID as randomUUID7 } from "crypto";
 
-// ../protocol/src/integrity/DossierProofVerifier.ts
+// ../../../Decionis/apps/protocol/src/integrity/DossierProofVerifier.ts
 import { createHash as createHash12, verify } from "crypto";
 
-// ../protocol/src/integrity/DossierProofBundle.ts
+// ../../../Decionis/apps/protocol/src/integrity/DossierProofBundle.ts
 import {
   createHash as createHash11,
   createPrivateKey,
@@ -22618,7 +23535,7 @@ function buildDecisionDossierPersistedProofBundle(input) {
   return DossierProofBundle.buildDecisionDossierPersistedProofBundle(input);
 }
 
-// ../protocol/src/integrity/DossierProofVerifier.ts
+// ../../../Decionis/apps/protocol/src/integrity/DossierProofVerifier.ts
 var PROOF_ARTIFACT_SHAPES = {
   portable_artifact: {
     document_path: "/portable_artifact",
@@ -22868,7 +23785,7 @@ function verifyDecisionDossierProofBundle(bundle, dossierPayload) {
   return DossierProofVerifier.verifyDecisionDossierProofBundle(bundle, dossierPayload);
 }
 
-// ../protocol/src/decision-chains/DecisionChains.ts
+// ../../../Decionis/apps/protocol/src/decision-chains/DecisionChains.ts
 var DECISION_CHAIN_EVIDENCE_LIMIT = DECISION_CHAIN_PROJECTION_LIMIT;
 var SHA256_HEX = /^[0-9a-f]{64}$/;
 var LEDGER_ACTION_ORDER = {
@@ -23372,7 +24289,8 @@ var DecisionChains = class {
           valid: input.ledgerVerification.valid,
           complete: input.ledgerVerification.complete,
           checked: input.ledgerVerification.checked,
-          max_entries: input.ledgerVerification.maxEntries
+          max_entries: input.ledgerVerification.maxEntries,
+          ...input.ledgerVerification.orphaned?.length ? { orphaned: input.ledgerVerification.orphaned } : {}
         }
       } : {},
       links,
@@ -23572,7 +24490,7 @@ function finalizeDecisionChainLinkInput(input) {
   return DecisionChains.finalizeDecisionChainLinkInput(input);
 }
 
-// ../protocol/src/support/PanDetection.ts
+// ../../../Decionis/apps/protocol/src/support/PanDetection.ts
 var PanDetection = class _PanDetection {
   static UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   static toDigits(value) {
@@ -23652,7 +24570,7 @@ function findRawPanPath(value, path, visited = /* @__PURE__ */ new Set()) {
   return PanDetection.findRawPanPath(value, path, visited);
 }
 
-// ../protocol/src/support/ProtocolUrls.ts
+// ../../../Decionis/apps/protocol/src/support/ProtocolUrls.ts
 var ProtocolUrls = class {
   static getProtocolPublicBaseUrl() {
     const raw = process.env.DECIONIS_PROTOCOL_PUBLIC_BASE_URL?.trim() ?? process.env.DECIONIS_PROTOCOL_BASE_URL?.trim() ?? "https://protocol.decionis.com";
@@ -23663,7 +24581,7 @@ function getProtocolPublicBaseUrl() {
   return ProtocolUrls.getProtocolPublicBaseUrl();
 }
 
-// ../protocol/src/evaluate-decision/EvaluateDecisionParsing.ts
+// ../../../Decionis/apps/protocol/src/evaluate-decision/EvaluateDecisionParsing.ts
 var EvaluateDecisionParsing = class {
   static parseEvaluateMode(value) {
     return normalizeEnforcementMode(value);
@@ -23712,6 +24630,19 @@ var EvaluateDecisionParsing = class {
         message: "context.authority_requirement is reserved for Decionis-issued policy output"
       };
     }
+    if (Object.prototype.hasOwnProperty.call(context, RUNTIME_ATTRIBUTION_FACT)) {
+      return {
+        ok: false,
+        message: `context.${RUNTIME_ATTRIBUTION_FACT} is reserved: Decionis computes it from the reported runtime signals, so a caller cannot assert what the platform established`
+      };
+    }
+    const runtimeSignals = RuntimeSignals.parse(context);
+    if (!runtimeSignals.ok) {
+      return {
+        ok: false,
+        message: `${runtimeSignals.path} is invalid (${runtimeSignals.message})`
+      };
+    }
     const verticalPack = asString2(record.vertical_pack) ?? asString2(context.vertical_pack);
     const workflowKey = asString2(record.workflow_key) ?? asString2(context.workflow_key);
     const parsedDecisionChain = parseDecisionChainRequest(record.decision_chain);
@@ -23943,7 +24874,7 @@ function hydrateCachedEvaluateResponse(existing) {
   return EvaluateDecisionParsing.hydrateCachedEvaluateResponse(existing);
 }
 
-// ../protocol/src/webex/WebexGovernance.ts
+// ../../../Decionis/apps/protocol/src/webex/WebexGovernance.ts
 var WebexGovernance = class {
   static parseWebexAgentIntentRequest(input, idempotencyHeader) {
     const record = asRecord3(input);
@@ -24281,7 +25212,7 @@ function buildWebexDossierEnhancements(input, response, generatedAt) {
   return WebexGovernance.buildWebexDossierEnhancements(input, response, generatedAt);
 }
 
-// ../protocol/src/dossiers/DossierBuilder.ts
+// ../../../Decionis/apps/protocol/src/dossiers/DossierBuilder.ts
 var DossierBuilder = class _DossierBuilder {
   /**
    * One canonical, public-safe snapshot shared by proof and authority evidence.
@@ -24291,6 +25222,7 @@ var DossierBuilder = class _DossierBuilder {
    */
   static buildInputsSnapshot(input, evaluationId) {
     const context = input.context ?? {};
+    const runtimeAttribution = _DossierBuilder.resolveRuntimeAttribution(input);
     return {
       decision_type: input.decision_type,
       channel: input.channel,
@@ -24304,6 +25236,7 @@ var DossierBuilder = class _DossierBuilder {
       transaction_type: input.transaction_type,
       amount: input.amount,
       risk_score: input.risk_score,
+      ...runtimeAttribution ? { runtime_attribution: runtimeAttribution } : {},
       context_commitment: {
         version: "1.0",
         canonicalization: "RFC8785/JCS",
@@ -24393,11 +25326,44 @@ var DossierBuilder = class _DossierBuilder {
     };
     return Object.keys(refs).length > 0 ? refs : null;
   }
+  /**
+   * How many signals the decision was evaluated against, for the signed
+   * portable artifact.
+   *
+   * The excluded keys are routing and identity, not inputs to a verdict:
+   * counting them would overstate, in a claim an auditor reads, how much
+   * evidence the decision actually had. The runtime signals an enforcement
+   * boundary reports are the same kind of thing — they say which door the
+   * action came through and what software proposed it, which the artifact
+   * records in its own right rather than as two more signals.
+   */
   static resolvePortableSignalsEvaluated(input) {
     const context = asRecord3(input.context);
-    return asNumber(context.signals_evaluated) ?? Object.keys(context).filter(
-      (key) => key !== "workflow_key" && key !== "vertical_pack" && key !== "trust_context"
-    ).length;
+    const excluded = /* @__PURE__ */ new Set([
+      "workflow_key",
+      "vertical_pack",
+      "trust_context",
+      ...RUNTIME_SIGNAL_ROOTS
+    ]);
+    return asNumber(context.signals_evaluated) ?? Object.keys(context).filter((key) => !excluded.has(key)).length;
+  }
+  /**
+   * The boundary that admitted the action and the artifact that proposed it,
+   * as the report reached the authority, with the platform's own statement
+   * about how far that report goes.
+   *
+   * This is the one place raw context values enter the dossier, and it is
+   * deliberate: the evidence chain the Decision Dossier exists to carry runs
+   * from artifact provenance through workload identity to the effect, and a
+   * digest of the whole context cannot answer *which boundary admitted this*
+   * offline. Every field here is an identifier, a digest or a level the
+   * operator's own manifest set; the producer keeps the container, pod and
+   * node out of what it binds, so none of them can arrive.
+   */
+  static resolveRuntimeAttribution(input) {
+    const parsed = RuntimeSignals.parse(asRecord3(input.context));
+    if (!parsed.ok) return null;
+    return RuntimeSignals.evidenceOf(RuntimeSignals.attributionOf(parsed));
   }
   static buildPortableDecisionDossierCore(input) {
     const protocolEnvelope = classifyAuthorityProtocolEnvelope(
@@ -24670,7 +25636,7 @@ function buildDecisionInputsSnapshot(input, evaluationId) {
   return DossierBuilder.buildInputsSnapshot(input, evaluationId);
 }
 
-// ../protocol/src/reproduce/ReproduceDecision.ts
+// ../../../Decionis/apps/protocol/src/reproduce/ReproduceDecision.ts
 var POLICY_GRAPH_1_1_SEMANTICS = {
   protocol_version: "1.1",
   evaluator_version: "policy-graph/1.1",
@@ -25101,7 +26067,7 @@ async function reproduceDecisionFromDossierPayload(input) {
   });
 }
 
-// ../protocol/src/support/FeatureFlags.ts
+// ../../../Decionis/apps/protocol/src/support/FeatureFlags.ts
 var FeatureFlags = class {
   static parseFeatureFlagAllowlist(raw) {
     return new Set(
@@ -25128,7 +26094,7 @@ function resolveFeatureFlagState(flag) {
   return FeatureFlags.resolveFeatureFlagState(flag);
 }
 
-// ../protocol/src/evaluate-decision/EvaluateDecisionGovernance.ts
+// ../../../Decionis/apps/protocol/src/evaluate-decision/EvaluateDecisionGovernance.ts
 var DOCKER_DESKTOP_GOVERNED_LIMIT = 25;
 var EvaluateDecisionGovernance = class _EvaluateDecisionGovernance {
   /**
@@ -25246,7 +26212,7 @@ function resolveEvaluateRolloutPolicy(store, input) {
   return EvaluateDecisionGovernance.resolveEvaluateRolloutPolicy(store, input);
 }
 
-// ../protocol/src/evaluate-decision/EvaluateDecisionResolution.ts
+// ../../../Decionis/apps/protocol/src/evaluate-decision/EvaluateDecisionResolution.ts
 import { createHash as createHash13, randomUUID as randomUUID8 } from "crypto";
 var POLICY_BUNDLE_UNRESOLVED_SENTINEL_ID = "00000000-0000-0000-0000-000000000000";
 var EvaluateDecisionResolution = class {
@@ -25446,9 +26412,10 @@ function appendEvaluateDecisionLedgerEvent(store, input) {
   return EvaluateDecisionResolution.appendEvaluateDecisionLedgerEvent(store, input);
 }
 
-// ../protocol/src/authority/AuthorityRequirementIssuer.ts
+// ../../../Decionis/apps/protocol/src/authority/AuthorityRequirementIssuer.ts
 import { randomBytes, randomUUID as randomUUID9 } from "crypto";
 var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
+  static MANAGED_CEREMONY_LIFETIME_MS = 5 * 6e4;
   requirementId;
   nonce;
   constructor(dependencies = {}) {
@@ -25480,10 +26447,12 @@ var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
     const intentExpiresAtMs = Date.parse(
       typeof agentSafe.expires_at === "string" ? agentSafe.expires_at : ""
     );
+    const chained = authorityPolicy.resolution.tiers !== void 0;
     const expiresAt = new Date(
       Math.min(
         issuedAtMs + authorityPolicy.expires_in_seconds * 1e3,
-        Number.isFinite(intentExpiresAtMs) ? intentExpiresAtMs : Number.POSITIVE_INFINITY
+        Number.isFinite(intentExpiresAtMs) ? intentExpiresAtMs : Number.POSITIVE_INFINITY,
+        managedEscalationId && !chained ? issuedAtMs + _AuthorityRequirementIssuer.MANAGED_CEREMONY_LIFETIME_MS : Number.POSITIVE_INFINITY
       )
     ).toISOString();
     return AuthorityRequirementSchema.parse({
@@ -25507,7 +26476,13 @@ var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
       },
       resolution: {
         ...authorityPolicy.resolution,
-        fallback_role_ids: [...authorityPolicy.resolution.fallback_role_ids]
+        fallback_role_ids: [...authorityPolicy.resolution.fallback_role_ids],
+        ...authorityPolicy.resolution.tiers ? {
+          tiers: authorityPolicy.resolution.tiers.map((tier) => ({
+            priority: tier.priority,
+            principal_ids: [...tier.principal_ids]
+          }))
+        } : {}
       },
       originator: {
         organization_id: input.request.org_id,
@@ -25650,7 +26625,7 @@ var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
   }
 };
 
-// ../protocol/src/execution-binding/ExecutionBindingBuilder.ts
+// ../../../Decionis/apps/protocol/src/execution-binding/ExecutionBindingBuilder.ts
 import { randomBytes as randomBytes2 } from "crypto";
 var ExecutionBindingBuilder = class _ExecutionBindingBuilder {
   static build(input) {
@@ -25878,7 +26853,7 @@ function normalizeDigest(value) {
   return /^sha256:[0-9a-f]{64}$/.test(normalized) ? normalized : null;
 }
 
-// ../protocol/src/decision-chains/SequenceContextProvider.ts
+// ../../../Decionis/apps/protocol/src/decision-chains/SequenceContextProvider.ts
 var SEQUENCE_CONTEXT_SCHEMA_VERSION = "1.0";
 var SEQUENCE_CONTEXT_KEY = "sequence";
 function actionFromLink(link) {
@@ -25967,7 +26942,7 @@ function withSequenceContext(context, sequence) {
   };
 }
 
-// ../protocol/src/evaluate-decision/EvaluateDecisionRoutes.ts
+// ../../../Decionis/apps/protocol/src/evaluate-decision/EvaluateDecisionRoutes.ts
 function registerEvaluateDecisionRoutes(app, deps) {
   const { store } = deps;
   const authorityRequirementIssuer = new AuthorityRequirementIssuer();
@@ -26438,6 +27413,12 @@ function registerEvaluateDecisionRoutes(app, deps) {
         }
       }
       app.log.error({ err }, "Evaluate-decision execution failed");
+      if (err instanceof ProtocolStoreValidationError && err.code === AUDIT_LEDGER_NOT_APPENDABLE) {
+        return reply.code(500).send({
+          error: AUDIT_LEDGER_NOT_APPENDABLE,
+          message: "Failed to evaluate decision: the organisation's audit ledger has no unique head and refuses appends until it is repaired"
+        });
+      }
       return reply.code(500).send({
         error: "EVALUATION_FAILED",
         message: "Failed to evaluate decision"
@@ -26474,7 +27455,7 @@ function registerEvaluateDecisionRoutes(app, deps) {
   app.post("/v1/protocol/decision-dossiers/reproduce", reproduceDecisionHandler);
 }
 
-// ../protocol/src/webex/WebexRoutes.ts
+// ../../../Decionis/apps/protocol/src/webex/WebexRoutes.ts
 function registerWebexRoutes(app, deps) {
   const { store } = deps;
   const evaluateWebexAgentIntentHandler = async (req, reply) => {
@@ -26644,13 +27625,13 @@ function registerWebexRoutes(app, deps) {
   app.post("/v1/protocol/webex/agent-intents/evaluate", evaluateWebexAgentIntentHandler);
 }
 
-// ../protocol/src/surface-verify/SapVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SapVerifyRoutes.ts
 import { randomUUID as randomUUID11 } from "crypto";
 
-// ../protocol/src/verticals/sap/SapSurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/sap/SapSurface.ts
 import { createHash as createHash15 } from "crypto";
 
-// ../protocol/src/verticals/shared/DuplicateDetection.ts
+// ../../../Decionis/apps/protocol/src/verticals/shared/DuplicateDetection.ts
 var DuplicateDetection = class _DuplicateDetection {
   /**
    * Vendor + invoice/amount fingerprint for duplicate-payment detection, or null.
@@ -26704,7 +27685,7 @@ async function deriveDuplicateFacts(input) {
   return DuplicateDetection.deriveFacts(input);
 }
 
-// ../protocol/src/verticals/sap/SapSurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/sap/SapSurface.ts
 var REQUIRED_STATE_FIELDS = ["amount", "currency", "vendor_id", "cost_center"];
 var AUTHORIZED_ROLES = /* @__PURE__ */ new Set(["ProcurementManager", "TreasuryHead", "Controller", "CFO"]);
 var PO_TREASURY_THRESHOLD = 5e4;
@@ -27033,7 +28014,7 @@ async function deriveSapDuplicateFacts(input) {
   return SapSurface.deriveDuplicateFacts(input);
 }
 
-// ../protocol/src/surface-verify/SurfaceVerifyShared.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SurfaceVerifyShared.ts
 var SAP_DEFAULT_ORG_ID = "5ab00000-0000-4000-8000-000000000001";
 var SAP_VERIFY_BASE_URL = "https://verify.decionis.com";
 var OPS_DEFAULT_ORG_ID = "09500000-0000-4000-8000-000000000001";
@@ -27041,7 +28022,7 @@ var WORKDAY_DEFAULT_ORG_ID = "d0d00000-0000-4000-8000-000000000001";
 var WORKDAY_FIN_DEFAULT_ORG_ID = "d0f00000-0000-4000-8000-000000000001";
 var DUPLICATE_LOOKBACK_DAYS = 90;
 
-// ../protocol/src/surface-verify/SapVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SapVerifyRoutes.ts
 function registerSapVerifyRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -27145,10 +28126,10 @@ function registerSapVerifyRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/surface-verify/SalesforceVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SalesforceVerifyRoutes.ts
 import { randomUUID as randomUUID12 } from "crypto";
 
-// ../protocol/src/verticals/salesforce/SalesforceSurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/salesforce/SalesforceSurface.ts
 import { createHash as createHash16 } from "crypto";
 var MATNR_MAX_LENGTH = 18;
 var MANUAL_DISCOUNT_THRESHOLD_PCT = 15;
@@ -27460,162 +28441,7 @@ function resolveSalesforceMode(payload) {
   return SalesforceSurface.resolveMode(payload);
 }
 
-// ../protocol/src/verticals/salesforce/SapCostBasis.ts
-var FETCH_TIMEOUT_MS = 2500;
-var DEFAULTS = {
-  servicePath: "/sap/opu/odata/sap/API_PRODUCT_SRV",
-  entitySet: "A_ProductValuationArea",
-  skuProperty: "Product",
-  costProperty: "StandardPrice"
-};
-var SapCostBasis = class _SapCostBasis {
-  /**
-   * Resolve the S/4HANA OData cost destination. With `orgId`, a per-org override in
-   * `DECIONIS_SAP_SOR_BY_ORG` wins (multi-tenant); otherwise the global env destination
-   * is used. Returns null when neither is configured.
-   */
-  static resolveConfig(env = process.env, orgId) {
-    const o = _SapCostBasis.readPerOrgCostOverride(env, orgId);
-    const baseUrl = String(o?.url ?? env.DECIONIS_SAP_SOR_URL ?? "").trim();
-    if (!baseUrl) return null;
-    return {
-      baseUrl: baseUrl.replace(/\/$/, ""),
-      token: String(o?.token ?? env.DECIONIS_SAP_SOR_TOKEN ?? "").trim() || null,
-      servicePath: String(
-        o?.servicePath ?? env.DECIONIS_SAP_SOR_SERVICE_PATH ?? DEFAULTS.servicePath
-      ).replace(/\/$/, ""),
-      entitySet: String(o?.entitySet ?? env.DECIONIS_SAP_SOR_ENTITY ?? DEFAULTS.entitySet),
-      skuProperty: String(
-        o?.skuProperty ?? env.DECIONIS_SAP_SOR_SKU_PROPERTY ?? DEFAULTS.skuProperty
-      ),
-      costProperty: String(
-        o?.costProperty ?? env.DECIONIS_SAP_SOR_COST_PROPERTY ?? DEFAULTS.costProperty
-      )
-    };
-  }
-  /** The destination is operator-configured, but require TLS and reject internal hosts. */
-  static isSafeUrl(rawUrl) {
-    let url;
-    try {
-      url = new URL(rawUrl);
-    } catch {
-      return false;
-    }
-    if (url.protocol !== "https:") return false;
-    const h = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
-    if (h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "169.254.169.254" || // cloud metadata
-    h.endsWith(".local") || h.endsWith(".internal") || h.startsWith("10.") || h.startsWith("192.168.") || /^172\.(1[6-9]|2\d|3[01])\./.test(h)) {
-      return false;
-    }
-    return true;
-  }
-  static buildCostQueryUrl(config, skus) {
-    const filter = skus.map((sku) => `${config.skuProperty} eq ${_SapCostBasis.odataString(sku)}`).join(" or ");
-    const params = new URLSearchParams({
-      $select: `${config.skuProperty},${config.costProperty}`,
-      $filter: filter,
-      $format: "json"
-    });
-    return `${config.baseUrl}${config.servicePath}/${config.entitySet}?${params.toString()}`;
-  }
-  /**
-   * Returns SKU → SAP cost (or null when SAP can't confirm it). Every requested SKU
-   * is present in the map. Fail-safe: returns all-null on SSRF rejection, missing
-   * transport, non-2xx, or error.
-   */
-  static async fetchCostBasis(config, skus, options = {}) {
-    const result = /* @__PURE__ */ new Map();
-    const unique = [...new Set(skus.filter(Boolean))];
-    for (const sku of unique) result.set(sku, null);
-    if (unique.length === 0) return result;
-    if (!_SapCostBasis.isSafeUrl(config.baseUrl)) return result;
-    const transport = options.transport ?? globalThis.fetch;
-    if (!transport) return result;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-    try {
-      const res = await transport(_SapCostBasis.buildCostQueryUrl(config, unique), {
-        method: "GET",
-        headers: {
-          accept: "application/json",
-          ...config.token ? { authorization: `Bearer ${config.token}` } : {}
-        },
-        signal: controller.signal
-      });
-      if (!res.ok) return result;
-      const rows = _SapCostBasis.extractRows(await res.json());
-      for (const row of rows) {
-        const sku = row[config.skuProperty];
-        if (typeof sku !== "string" || !result.has(sku)) continue;
-        const cost = Number(row[config.costProperty]);
-        result.set(sku, Number.isFinite(cost) ? cost : null);
-      }
-    } catch {
-    } finally {
-      clearTimeout(timer);
-    }
-    return result;
-  }
-  /**
-   * Override each order line's `cost_basis` with the SAP cost when available; lines
-   * SAP can't confirm keep their existing (payload) cost. Pure.
-   */
-  static applyCostBasis(payload, costMap) {
-    const items = Array.isArray(payload.order_items) ? payload.order_items : [];
-    return {
-      ...payload,
-      order_items: items.map((it) => {
-        const matnr = String(it.matnr ?? "");
-        const sapCost = matnr ? costMap.get(matnr) : null;
-        return sapCost != null ? { ...it, cost_basis: sapCost } : it;
-      })
-    };
-  }
-  /** True when at least one SKU got an authoritative SAP cost. */
-  static hasResolvedCost(costMap) {
-    for (const value of costMap.values()) if (value != null) return true;
-    return false;
-  }
-  /** Per-org SAP destination override from `DECIONIS_SAP_SOR_BY_ORG` (JSON keyed by org id). */
-  static readPerOrgCostOverride(env, orgId) {
-    if (!orgId) return null;
-    const raw = env.DECIONIS_SAP_SOR_BY_ORG;
-    if (!raw) return null;
-    try {
-      const map = JSON.parse(raw);
-      const entry = map && typeof map === "object" ? map[orgId] : null;
-      return entry && typeof entry === "object" ? entry : null;
-    } catch {
-      return null;
-    }
-  }
-  static odataString(value) {
-    return `'${value.replace(/'/g, "''")}'`;
-  }
-  /** OData v2 (`d.results`) and v4 (`value`) both supported. */
-  static extractRows(json) {
-    if (!json || typeof json !== "object") return [];
-    const v2 = json.d?.results;
-    if (Array.isArray(v2)) return v2;
-    const v4 = json.value;
-    if (Array.isArray(v4)) return v4;
-    return [];
-  }
-};
-function resolveSapCostConfig(env = process.env, orgId) {
-  return SapCostBasis.resolveConfig(env, orgId);
-}
-async function fetchSapCostBasis(config, skus, options = {}) {
-  return SapCostBasis.fetchCostBasis(config, skus, options);
-}
-function applySapCostBasis(payload, costMap) {
-  return SapCostBasis.applyCostBasis(payload, costMap);
-}
-function hasResolvedCost(costMap) {
-  return SapCostBasis.hasResolvedCost(costMap);
-}
-
-// ../protocol/src/surface-verify/SalesforceVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SalesforceVerifyRoutes.ts
 function registerSalesforceVerifyRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -27657,26 +28483,10 @@ function registerSalesforceVerifyRoutes(app, deps) {
     const candidateOrg = authedOrgId || asString2(ctx.org_id)?.trim() || process.env.DECIONIS_SALESFORCE_ORG_ID?.trim() || SAP_DEFAULT_ORG_ID;
     const orgId = isLikelyUuid(candidateOrg) ? candidateOrg : SAP_DEFAULT_ORG_ID;
     await ensureSalesforcePolicyBundle(orgId);
-    let evalPayload = payload;
-    let costBasisSource = "payload";
-    if (gate === "execution_authority") {
-      const costConfig = resolveSapCostConfig(process.env, orgId);
-      if (costConfig) {
-        try {
-          const skus = (payload.order_items ?? []).map((it) => String(it.matnr ?? "").trim()).filter(Boolean);
-          const costMap = await fetchSapCostBasis(costConfig, skus);
-          if (hasResolvedCost(costMap)) {
-            evalPayload = applySapCostBasis(payload, costMap);
-            costBasisSource = "sap";
-          }
-        } catch {
-        }
-      }
-    }
     const evalRes = await injectInternalProtocolRoute(app, {
       method: "POST",
       url: "/v1/protocol/evaluate-decision",
-      payload: buildSalesforceEvaluateRequest(evalPayload, gate, orgId)
+      payload: buildSalesforceEvaluateRequest(payload, gate, orgId)
     });
     if (evalRes.statusCode !== 200) {
       return reply.code(502).send({
@@ -27717,11 +28527,19 @@ function registerSalesforceVerifyRoutes(app, deps) {
       ledger_entry_hash: response.ledger_entry_hash ?? null,
       decision_chain: response.decision_chain ?? null,
       idempotent_replay: Boolean(response.idempotent_replay),
-      cost_basis_source: costBasisSource,
+      cost_basis_source: "payload",
       federated: true,
       pipeline: true
     });
   };
+  app.post(
+    "/v1/protocol/surfaces/salesforce/state-admission/verify",
+    (req, reply) => handleSalesforceGate("state_admission", req, reply)
+  );
+  app.post(
+    "/v1/protocol/surfaces/salesforce/execution-authority/verify",
+    (req, reply) => handleSalesforceGate("execution_authority", req, reply)
+  );
   app.post(
     "/salesforce/state-admission/verify",
     (req, reply) => handleSalesforceGate("state_admission", req, reply)
@@ -27740,10 +28558,10 @@ function registerSalesforceVerifyRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/surface-verify/OpsVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/OpsVerifyRoutes.ts
 import { randomUUID as randomUUID13 } from "crypto";
 
-// ../protocol/src/verticals/ops/OpsSurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/ops/OpsSurface.ts
 import { createHash as createHash17 } from "crypto";
 var OpsSurface = class _OpsSurface {
   /**
@@ -27821,7 +28639,7 @@ async function deriveOpsDuplicateFacts(input) {
   return OpsSurface.deriveDuplicateFacts(input);
 }
 
-// ../protocol/src/surface-verify/OpsVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/OpsVerifyRoutes.ts
 function registerOpsVerifyRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -27925,10 +28743,10 @@ function registerOpsVerifyRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/surface-verify/WorkdayVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/WorkdayVerifyRoutes.ts
 import { randomUUID as randomUUID14 } from "crypto";
 
-// ../protocol/src/verticals/workday/WorkdaySurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/workday/WorkdaySurface.ts
 import { createHash as createHash18 } from "crypto";
 var AUTHORIZED_HR_ROLES = /* @__PURE__ */ new Set([
   "HRBusinessPartner",
@@ -28281,7 +29099,7 @@ async function deriveWorkdayDuplicateFacts(input) {
   return WorkdaySurface.deriveDuplicateFacts(input);
 }
 
-// ../protocol/src/surface-verify/WorkdayVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/WorkdayVerifyRoutes.ts
 function registerWorkdayVerifyRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -28387,10 +29205,10 @@ function registerWorkdayVerifyRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/surface-verify/WorkdayFinancialsVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/WorkdayFinancialsVerifyRoutes.ts
 import { randomUUID as randomUUID15 } from "crypto";
 
-// ../protocol/src/verticals/workday-financials/WorkdayFinancialsSurface.ts
+// ../../../Decionis/apps/protocol/src/verticals/workday-financials/WorkdayFinancialsSurface.ts
 import { createHash as createHash19 } from "crypto";
 var AUTHORIZED_FINANCE_ROLES = /* @__PURE__ */ new Set([
   "PayrollAdministrator",
@@ -28742,7 +29560,7 @@ async function deriveWorkdayFinancialsDuplicateFacts(input) {
   return WorkdayFinancialsSurface.deriveDuplicateFacts(input);
 }
 
-// ../protocol/src/surface-verify/WorkdayFinancialsVerifyRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/WorkdayFinancialsVerifyRoutes.ts
 function registerWorkdayFinancialsVerifyRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -28850,7 +29668,7 @@ function registerWorkdayFinancialsVerifyRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/surface-verify/SurfaceDecisionRoutes.ts
+// ../../../Decionis/apps/protocol/src/surface-verify/SurfaceDecisionRoutes.ts
 import { randomUUID as randomUUID16 } from "crypto";
 function registerSurfaceDecisionRoutes(app, deps) {
   const { store } = deps;
@@ -28961,7 +29779,7 @@ function registerSurfaceDecisionRoutes(app, deps) {
   app.post("/v1/protocol/surfaces/decisions", handleSurfaceDecision);
 }
 
-// ../protocol/src/enforcement/EnforcementRolloutRoutes.ts
+// ../../../Decionis/apps/protocol/src/enforcement/EnforcementRolloutRoutes.ts
 var EnforcementRolloutParsing = class {
   static parseEnforcementRolloutMutation(input) {
     const record = asRecord3(input);
@@ -29062,7 +29880,7 @@ function registerEnforcementRolloutRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/integrity/ProofPacket.ts
+// ../../../Decionis/apps/protocol/src/integrity/ProofPacket.ts
 var VERIFY_STEPS = [
   "Canonicalize each proof-bundle artifact's source document with that artifact's declared canonicalization_profile (RFC8785/JCS or DECIONIS_SORTED_JSON_V1); historical artifacts without a profile use DECIONIS_SORTED_JSON_V1.",
   "Recompute SHA-256 over the canonical bytes and confirm it matches canonical_document_sha256.",
@@ -29240,7 +30058,7 @@ function buildDecisionChainProofPacket(input) {
   return ProofPacket.buildDecisionChainProofPacket(input);
 }
 
-// ../protocol/src/dossiers/ProofPacketAuth.ts
+// ../../../Decionis/apps/protocol/src/dossiers/ProofPacketAuth.ts
 var ProofPacketAuth = class {
   static async authorizeProofPacketRead(req, orgId, authLookup) {
     if (hasValidInternalCredential(req, resolveInternalSecrets())) return null;
@@ -29288,7 +30106,7 @@ async function authorizeProofPacketWrite(req, orgId, authLookup) {
   return null;
 }
 
-// ../protocol/src/interop/scitt/aac-v04/AgentActionCapsuleV04.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/aac-v04/AgentActionCapsuleV04.ts
 import { createHash as createHash20 } from "crypto";
 var AAC_V04_SPEC_VERSION = "draft-mih-scitt-agent-action-capsule-04";
 var AAC_V04_FORMAT_VERSION = "4";
@@ -29863,10 +30681,10 @@ function verifyAgentActionCapsuleV04Class1(value, options) {
   }
 }
 
-// ../protocol/src/interop/scitt/cose/ProducerEnvelope.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/cose/ProducerEnvelope.ts
 import { createPublicKey as createPublicKey2, verify as verifySignature } from "crypto";
 
-// ../protocol/src/interop/scitt/cose/Cbor.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/cose/Cbor.ts
 function concat(parts) {
   const length = parts.reduce((total, part) => total + part.length, 0);
   const output = new Uint8Array(length);
@@ -30013,7 +30831,7 @@ function decodeCbor(bytes2) {
   return decoded;
 }
 
-// ../protocol/src/interop/scitt/cose/ProducerEnvelope.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/cose/ProducerEnvelope.ts
 var AAC_PRODUCER_ENVELOPE_CONTENT_TYPE = "application/agent-action-capsule-id";
 var AAC_PRODUCER_ENVELOPE_MEDIA_TYPE = "application/cose";
 function rawCapsuleId(capsuleId) {
@@ -30149,7 +30967,7 @@ function verifyAgentActionCapsuleProducerEnvelope(envelope, capsuleId) {
   };
 }
 
-// ../protocol/src/interop/scitt/aac-v04/DossierMapper.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/aac-v04/DossierMapper.ts
 import { createHash as createHash21 } from "crypto";
 function digest(value) {
   return createHash21("sha256").update(jcsCanonicalize(value), "utf8").digest("hex");
@@ -30379,7 +31197,7 @@ function decisionDossierReference(dossier) {
   };
 }
 
-// ../protocol/src/integrity/DossierLedgerAnchor.ts
+// ../../../Decionis/apps/protocol/src/integrity/DossierLedgerAnchor.ts
 function normalizedSha256(value) {
   if (typeof value !== "string") return null;
   const candidate = value.trim().toLowerCase();
@@ -30400,7 +31218,9 @@ async function verifyDossierLedgerAnchor(input) {
       reason: "LEDGER_CONTINUITY_UNVERIFIED",
       ledger_entry_id: ledgerEntryId,
       declared_entry_hash: declaredHash,
-      stored_entry_hash: null
+      stored_entry_hash: null,
+      ledger_membership: null,
+      orphan_resolution_entry_id: null
     };
   }
   if (!ledgerEntryId || !isLikelyUuid(ledgerEntryId) || !declaredHash) {
@@ -30414,7 +31234,9 @@ async function verifyDossierLedgerAnchor(input) {
       reason: "ANCHOR_MISSING_OR_MALFORMED",
       ledger_entry_id: ledgerEntryId,
       declared_entry_hash: declaredHash,
-      stored_entry_hash: null
+      stored_entry_hash: null,
+      ledger_membership: null,
+      orphan_resolution_entry_id: null
     };
   }
   const row = await input.store.getAuditLedgerEntry({
@@ -30432,7 +31254,9 @@ async function verifyDossierLedgerAnchor(input) {
       reason: "ANCHOR_NOT_FOUND",
       ledger_entry_id: ledgerEntryId,
       declared_entry_hash: declaredHash,
-      stored_entry_hash: null
+      stored_entry_hash: null,
+      ledger_membership: null,
+      orphan_resolution_entry_id: null
     };
   }
   const storedHash = normalizedSha256(row.entry_hash);
@@ -30459,11 +31283,13 @@ async function verifyDossierLedgerAnchor(input) {
     reason,
     ledger_entry_id: ledgerEntryId,
     declared_entry_hash: declaredHash,
-    stored_entry_hash: storedHash
+    stored_entry_hash: storedHash,
+    ledger_membership: row.ledger_membership ?? "canonical",
+    orphan_resolution_entry_id: row.ledger_membership === "orphaned" ? row.orphan_resolution_entry_id ?? null : null
   };
 }
 
-// ../protocol/src/decision-chains/DecisionChainRoutes.ts
+// ../../../Decionis/apps/protocol/src/decision-chains/DecisionChainRoutes.ts
 var DEFAULT_DECISION_CHAIN_LEDGER_VERIFICATION_LIMIT = 5e3;
 var MAX_DECISION_CHAIN_LEDGER_VERIFICATION_LIMIT = 5e4;
 function resolveDecisionChainLedgerVerificationLimit(env = process.env) {
@@ -30571,7 +31397,8 @@ function registerDecisionChainRoutes(app, deps) {
           valid: ledger.valid,
           complete: ledger.complete,
           checked: ledger.checked,
-          maxEntries: ledgerVerificationLimit
+          maxEntries: ledgerVerificationLimit,
+          ...ledger.orphaned ? { orphaned: ledger.orphaned } : {}
         },
         proofVerifications: new Map(
           [...proofByDossierId].map(([dossierId, result]) => [
@@ -30633,7 +31460,8 @@ function registerDecisionChainRoutes(app, deps) {
           valid: ledger.valid,
           complete: ledger.complete,
           checked: ledger.checked,
-          maxEntries: ledgerVerificationLimit
+          maxEntries: ledgerVerificationLimit,
+          ...ledger.orphaned ? { orphaned: ledger.orphaned } : {}
         }
       })
     );
@@ -30686,14 +31514,15 @@ function registerDecisionChainRoutes(app, deps) {
           valid: ledger.valid,
           complete: ledger.complete,
           checked: ledger.checked,
-          maxEntries: ledgerVerificationLimit
+          maxEntries: ledgerVerificationLimit,
+          ...ledger.orphaned ? { orphaned: ledger.orphaned } : {}
         }
       })
     );
   });
 }
 
-// ../protocol/src/dossiers/DossierCapsuleExport.ts
+// ../../../Decionis/apps/protocol/src/dossiers/DossierCapsuleExport.ts
 function parentDossierIds(payload) {
   const direct = asRecord3(payload.decision_chain);
   const nested = asRecord3(asRecord3(payload.routing_decision).decision_chain);
@@ -30742,7 +31571,7 @@ async function buildDossierAgentActionCapsuleV04Export(input) {
   return { dossier, capsule, parent_capsule: parentCapsule, class_1: class1 };
 }
 
-// ../protocol/src/dossiers/DossierRoutes.ts
+// ../../../Decionis/apps/protocol/src/dossiers/DossierRoutes.ts
 function registerDossierRoutes(app, deps) {
   const { store } = deps;
   const protocolAuthLookup = deps.authLookup ?? null;
@@ -30985,7 +31814,7 @@ function registerDossierRoutes(app, deps) {
   );
 }
 
-// ../protocol/src/policy-graph/PolicyDecisionRegister.ts
+// ../../../Decionis/apps/protocol/src/policy-graph/PolicyDecisionRegister.ts
 function asRecord7(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -31171,7 +32000,7 @@ async function loadPolicyDecisionRegister(input) {
   });
 }
 
-// ../protocol/src/policy-graph/PolicyDecisionRegisterRoutes.ts
+// ../../../Decionis/apps/protocol/src/policy-graph/PolicyDecisionRegisterRoutes.ts
 var MAX_BUNDLE_LOOKBACK = 500;
 var DEFAULT_BUNDLE_LOOKBACK = 100;
 function registerPolicyDecisionRegisterRoutes(app, deps) {
@@ -31203,7 +32032,7 @@ function registerPolicyDecisionRegisterRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/artifacts/ArtifactIngestion.ts
+// ../../../Decionis/apps/protocol/src/artifacts/ArtifactIngestion.ts
 import { createHash as createHash22, randomUUID as randomUUID17 } from "crypto";
 var ArtifactIngestion = class {
   static createArtifactPayloads(request, shadow, resolvedVerticalPack, previousLedgerHash) {
@@ -31432,6 +32261,19 @@ var ArtifactIngestion = class {
         issues: validation.issues
       });
     }
+    if (kind === "audit_ledger_entry" && validation.value.event_type === LEDGER_FORK_RESOLVED_EVENT_TYPE) {
+      return reply.code(400).send({
+        error: "VALIDATION_ERROR",
+        message: `${LEDGER_FORK_RESOLVED_EVENT_TYPE} is reserved for the ledger fork repair command`,
+        issues: [
+          {
+            path: "/event_type",
+            keyword: "reserved",
+            message: "written only by the operator fork-resolution command"
+          }
+        ]
+      });
+    }
     if (kind === "signal_envelope") {
       const semantic = asRecord3(validation.value.semantic);
       if (Object.keys(semantic).length > 0) {
@@ -31503,7 +32345,7 @@ function ingestArtifact(app, reply, store, kind, payload) {
   return ArtifactIngestion.ingestArtifact(app, reply, store, kind, payload);
 }
 
-// ../protocol/src/artifacts/ArtifactRoutes.ts
+// ../../../Decionis/apps/protocol/src/artifacts/ArtifactRoutes.ts
 function registerArtifactRoutes(app, deps) {
   const { store } = deps;
   app.post(
@@ -31595,7 +32437,7 @@ function registerArtifactRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/marketplaces/MarketplaceProfiles.ts
+// ../../../Decionis/apps/protocol/src/marketplaces/MarketplaceProfiles.ts
 var commonContracts = [
   "signal_envelope",
   "context_snapshot",
@@ -32026,10 +32868,11 @@ var readiness = {
     // core COGS, HPOS order CRUD, and the signed dossier were verified end
     // to end on a staging store — including an admin-enabled ENFORCEMENT
     // block — before the listing went live (shared readiness provenance).
-    // The previous PLANNED states predated the public listing.
+    // The previous PLANNED states predated the public listing. In production
+    // since 2026-09-26 (Festus); each store still starts in Shadow Mode.
     adapter_state: "LIVE",
     docs_state: "LIVE",
-    launch_state: "BUILDING",
+    launch_state: "LIVE",
     next_milestone: "WordPress.org listing is live and self-serve; grow installs and collect the first live-store enforcement evidence for the listing's proof section"
   },
   jumia: {
@@ -32068,7 +32911,7 @@ function getMarketplaceReadiness(target) {
   return MarketplaceProfiles.getReadiness(target);
 }
 
-// ../protocol/src/marketplaces/MarketplaceContracts.ts
+// ../../../Decionis/apps/protocol/src/marketplaces/MarketplaceContracts.ts
 var PROTOCOL_MARKETPLACE_TARGETS = [
   "atlassian",
   "microsoft",
@@ -32090,7 +32933,7 @@ var PROTOCOL_MARKETPLACE_TARGETS = [
   "jumia"
 ];
 
-// ../protocol/src/marketplaces/MarketplaceRoutes.ts
+// ../../../Decionis/apps/protocol/src/marketplaces/MarketplaceRoutes.ts
 var MarketplaceRouteParsing = class {
   static parseMarketplaceTarget(input) {
     const value = asString2(input)?.toLowerCase();
@@ -32167,7 +33010,7 @@ function registerMarketplaceRoutes(app) {
   });
 }
 
-// ../protocol/src/verticals/VerticalRoutes.ts
+// ../../../Decionis/apps/protocol/src/verticals/VerticalRoutes.ts
 import { randomUUID as randomUUID18 } from "crypto";
 var VerticalRouteParsing = class {
   static parseVerticalPackMutation(input) {
@@ -32324,10 +33167,10 @@ function registerVerticalRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/shadow/ShadowRoutes.ts
+// ../../../Decionis/apps/protocol/src/shadow/ShadowRoutes.ts
 import { createHash as createHash23 } from "crypto";
 
-// ../protocol/src/shadow/ShadowDecisioning.ts
+// ../../../Decionis/apps/protocol/src/shadow/ShadowDecisioning.ts
 var ShadowDecisioning = class {
   static parseShadowRequest(input) {
     const record = asRecord3(input);
@@ -32462,7 +33305,7 @@ function buildShadowDecision(request, resolvedVerticalPack) {
   return ShadowDecisioning.buildShadowDecision(request, resolvedVerticalPack);
 }
 
-// ../protocol/src/shadow/ShadowReports.ts
+// ../../../Decionis/apps/protocol/src/shadow/ShadowReports.ts
 var ShadowReports = class {
   static shadowExecutionActionFromOutcome(outcome) {
     if (outcome === "APPROVE") return "CONTINUE";
@@ -32614,7 +33457,7 @@ function parseShadowEvaluateDecisionReportsQuery(input) {
   return ShadowReports.parseShadowEvaluateDecisionReportsQuery(input);
 }
 
-// ../protocol/src/shadow/ShadowRoutes.ts
+// ../../../Decionis/apps/protocol/src/shadow/ShadowRoutes.ts
 function registerShadowRoutes(app, deps) {
   const { store } = deps;
   app.get("/v1/protocol/shadow/evaluate-decision/reports", async (req, reply) => {
@@ -32747,7 +33590,7 @@ function registerShadowRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/execution-binding/ExecutionRevalidationState.ts
+// ../../../Decionis/apps/protocol/src/execution-binding/ExecutionRevalidationState.ts
 import { createHash as createHash24 } from "crypto";
 var ExecutionRevalidationState = class _ExecutionRevalidationState {
   static async resolve(input) {
@@ -32960,7 +33803,7 @@ function normalizeDigest2(value) {
   return /^sha256:[0-9a-f]{64}$/.test(normalized) ? normalized : null;
 }
 
-// ../protocol/src/execution-binding/ExecutionRevalidationRoutes.ts
+// ../../../Decionis/apps/protocol/src/execution-binding/ExecutionRevalidationRoutes.ts
 function registerExecutionRevalidationRoutes(app, deps) {
   const internalSecrets = deps.internalSecret === void 0 && deps.internalSecretPrevious === void 0 ? resolveInternalSecrets() : {
     current: deps.internalSecret ?? null,
@@ -33054,7 +33897,7 @@ function registerExecutionRevalidationRoutes(app, deps) {
   });
 }
 
-// ../protocol/src/interop/scitt/registration/ScittSignedStatement.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/registration/ScittSignedStatement.ts
 import { createPublicKey as createPublicKey3, verify as verifySignature2 } from "crypto";
 var SCITT_SIGNED_STATEMENT_MEDIA_TYPE = "application/scitt-statement+cose";
 var SCITT_RECEIPT_MEDIA_TYPE = "application/scitt-receipt+cose";
@@ -33173,7 +34016,7 @@ function verifyScittCapsuleIdSignedStatement(statement, capsuleId) {
   };
 }
 
-// ../protocol/src/interop/scitt/registration/ScittRegistrationService.ts
+// ../../../Decionis/apps/protocol/src/interop/scitt/registration/ScittRegistrationService.ts
 function origin(value) {
   try {
     const url = new URL(value);
@@ -33366,7 +34209,7 @@ var ScittRegistrationService = class {
   }
 };
 
-// ../protocol/src/app.ts
+// ../../../Decionis/apps/protocol/src/app.ts
 function buildProtocolApp(options) {
   const app = Fastify({
     logger: options?.logger ?? true
@@ -33413,6 +34256,7 @@ function buildProtocolApp(options) {
   const protocolAuthLookup = options?.mcpAuthLookup ?? null;
   registerInternalAccessGuard(app, process.env, protocolAuthLookup);
   registerHealthRoutes(app, { store });
+  new GlamaClaimRoutes().register(app);
   registerFinanceOverrideRoutes(app, { store });
   registerEvaluateDecisionRoutes(app, { store });
   registerWebexRoutes(app, { store });
@@ -33929,4 +34773,4 @@ toad-cache/dist/toad-cache.cjs:
    * @version 3.7.0
    *)
 */
-//# sourceMappingURL=chunk-NF5JL6QR.js.map
+//# sourceMappingURL=chunk-5Q6BCK32.js.map