@fased/fased 0.1.68 → 0.1.69

package/CHANGELOG.md

@@ -4,6 +4,21 @@ This changelog starts with the public Fased Agent release line. Required
 third-party and copied-code notices are kept in [LICENSE](./LICENSE) and
 [THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).
 
+## 0.1.69
+
+- Make new signer-owned Agent, Mining, and Vault wallets role-ready with one
+  verified RPC; preserve legacy deny-all wallets until explicit activation.
+- Make Agent wallet routing explicit, then skill-specific, Agent-specific, and
+  finally optional Default Agent fallback; creation never selects a fallback.
+- Separate the Hosting operator, Gateway, and signer identities; provide the
+  same native wallet lifecycle on Local and Hosting without ordinary root
+  helper commands.
+- Add signer-tombstoned, resumable Mining retirement and a distinct role-ready
+  successor.
+- Restore the exact fresh streamed Hosting command with verified tagged
+  handoff, retain exact-tag-only repair, and reset English/Chinese install and
+  wallet documentation around the tested behavior.
+
 ## 0.1.68
 
 - Unify signer-owned Agent, Mining, and Vault creation around one explicit role

package/README.md

@@ -33,10 +33,10 @@ Public install is repo-backed:
 
 ### Local vs VPS Hosting
 
-| Path          | Best for                                                                               | Security posture                                                                                                                                                | Access dependency                                                            |
-| ------------- | -------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
-| Local install | Your own computer: macOS Terminal, Windows with WSL2 Ubuntu, Linux desktop, or dev box | Lowest setup risk. Gateway stays on your machine; a home router usually does not expose it to the public internet. Tailscale is optional.                       | Your local OS login.                                                         |
-| VPS Hosting   | Always-on cloud node                                                                   | Higher exposure by default because a VPS is internet-reachable. Hosted setup closes public admin ports and requires Tailscale for private dashboard/SSH access. | Your Tailscale account plus the VPS provider console for emergency recovery. |
+| Path        | Runs where                            | Private access                           | Normal operator                            |
+| ----------- | ------------------------------------- | ---------------------------------------- | ------------------------------------------ |
+| Local       | macOS, Linux, or WSL2 Ubuntu          | Your local OS; Tailscale optional        | Your OS account                            |
+| VPS Hosting | Ubuntu/Fedora/RHEL-family systemd VPS | Tailscale plus provider-console recovery | `app`; Gateway isolated as `fased-gateway` |
 
 If you lose access to the Tailscale account used for a hosted VPS, normal
 dashboard and SSH access can be lost. Recovery then depends on the VPS
@@ -151,8 +151,8 @@ curl -fsSL https://raw.githubusercontent.com/fased-ai/fased/main/install.sh \
 
 It selects the stable release and verifies the tagged Hosting artifacts before
 privileged Fased installation. The
-[VPS Hosting guide](https://docs.fased.ai/install/vps#advanced-verify-the-bootstrap-first)
-also keeps an advanced procedure for verifying `install.sh` before it runs.
+[Advanced installer](https://docs.fased.ai/install/installer#exact-tag-pre-execution-verification)
+keeps the exact-tag procedure for verifying `install.sh` before it runs.
 
 The Fased installer bootstraps the attested hosted runtime itself. A fresh VPS
 does not need `git clone`; the installer installs the supported system tools and
@@ -161,16 +161,15 @@ exact tagged runtime instead of building an app-owned source checkout.
 If a minimal VPS image does not have `curl`, use the OS tab in the install docs
 to install only the downloader first, then rerun the same hosted command.
 
-If an earlier install stopped before creating the `app` runtime, repeat the
-same verified tagged bootstrap from the provider root console. Use the
-documented `--repair-hosting` path for an existing installation; do not repair
-Hosting from a moving `main` checkout.
+If an earlier install stopped before persistent Fased installer state was
+created, fix the reported prerequisite and repeat the same command. Use the
+documented exact-tag `--repair-hosting` path for an existing installation; do
+not repair Hosting from moving `main`.
 
-If you SSH into a fresh VPS as `root`, the installer creates a non-root `app`
-user, copies/clones the repo to `/home/app/fased`, and continues there. The
-temporary root checkout is removed after successful hosted onboarding. During
-Tailscale setup, copy the login URL printed in SSH and open it in your local
-computer's browser.
+If you SSH into a fresh VPS as `root`, the installer creates a human `app`
+operator, an isolated `fased-gateway` service account, and an isolated
+`fased-signer` service account. During Tailscale setup, copy the login URL
+printed in SSH and open it in your local computer's browser.
 
 The installer adds the VPS to the same Tailscale tailnet before onboarding can
 finish safely. When Fased prints a Tailscale login URL in the SSH terminal,
@@ -242,9 +241,9 @@ fased dashboard
 The `app` shell is a full Linux shell on the VPS and is configured to start in
 `/home/app/fased`.
 
-Hosted VPS setup uses the root-managed `fased-gateway.service`, and that
-service runs as the non-root `app` user. It should not ask for the `app`
-password to run `sudo loginctl enable-linger app`.
+Hosted VPS setup uses root-managed services. `fased-gateway.service` runs as
+the non-login `fased-gateway` account; the `app` operator uses a separate,
+restricted signer lifecycle socket and does not need broad sudo.
 
 `http://localhost:18789` is only the advanced SSH tunnel fallback. It works on
 your local computer after you start the tunnel shown by onboarding and leave
@@ -319,10 +318,9 @@ git pull --ff-only origin main
 ./install.sh
 ```
 
-On a hosted VPS, run that same development checkout flow as `app` from
-`/home/app/fased` and use `./install.sh --hosting`. Use
-`./install.sh --no-git-update` only when testing local changes that should not
-be replaced by Git.
+Privileged Hosting does not install from a mutable developer checkout. Test
+source changes as Local, or build a tagged Hosting artifact through the release
+workflow.
 
 Telegram, WhatsApp, Discord, and Slack install as official add-ons only when
 selected from **Agent > Channels**, onboarding, or `fased channels add`. Local

package/config/sat-runtime.env

@@ -2,9 +2,13 @@
 # Fased Agent writes this file after Mining Sync verifies the signed mainnet
 # manifest from https://satcoin.app/.well-known/sat-mainnet-addresses.json.
 #
-# For explicit local/devnet testing, set all four values through env or this
-# file. Public pre-launch installs intentionally ship without active SAT IDs.
+# Mining role baselines also require the verified manifest, detached signature,
+# and SHA-256 fields written by Mining Sync. Public pre-launch installs
+# intentionally ship without active SAT IDs or manifest authority.
 FASED_SAT_PROGRAM_ID=
 FASED_SAT_BOND_PROGRAM_ID=
 FASED_SAT_MINT_ADDRESS=
 FASED_SAT_MINT_PROGRAM_ID=
+FASED_SAT_RUNTIME_MANIFEST_PATH=
+FASED_SAT_RUNTIME_MANIFEST_SHA256=
+FASED_SAT_RUNTIME_MANIFEST_SIGNATURE_PATH=

package/config/signer-protocol-v2.json

@@ -24,12 +24,16 @@
     "atomicIdempotency",
     "ambiguousBroadcastReconciliation",
     "signerOwnedKeys",
+    "signerOwnedRoleBaselines",
+    "liveWalletReadiness",
     "signerOwnedSuccessorRotation",
+    "signerOwnedMiningRetirementEvidence",
     "permanentRetiredWalletPolicies",
     "signerOwnedRPC",
     "applicationNetworkBootstrap",
     "signerOwnedEncryptedRecovery",
     "signerOwnedRawExport",
+    "restrictedOperatorLifecycle",
     "typedSolanaTransactions",
     "typedA2aPaymentMemos",
     "typedA2aRefundMemos",
@@ -65,6 +69,8 @@
     "atomicIdempotency",
     "ambiguousBroadcastReconciliation",
     "signerOwnedKeys",
+    "signerOwnedRoleBaselines",
+    "liveWalletReadiness",
     "signerOwnedRPC",
     "applicationNetworkBootstrap",
     "typedSolanaTransactions",

package/dist/agents/tools/wallet-action-tool.js

@@ -227,11 +227,13 @@ function createWalletActionTool(opts) {
 			const scheduled = action === "schedule_plan";
 			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
 			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : undefined;
 			const selection = resolveAgentWalletSelection({
 				config: cfg,
 				walletHandle,
 				walletId,
 				agentId: requesterAgentId ?? ownerAgentId ?? undefined,
+				skillWalletId,
 				env: process.env
 			});
 			const rpcUrl = resolveScopedRpcUrlForWallet({

package/dist/agents/tools/wallet-tool.js

@@ -348,7 +348,7 @@ function createWalletTool(opts) {
 	return {
 		label: "Wallet",
 		name: "wallet",
-		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions require an Agent wallet via walletHandle, structured walletId, or default Agent wallet. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
+		description: "Query wallet status/list/balance/assets/address and prepare/send policy-limited Solana transactions via configured wallet provider. If the user asks for one exact @wallet handle or one external Solana address, call only that exact read action; do not also call balances/list. Use action=\"list\" to list local wallets with handles and action=\"balances\" only when the user asks for every/all local wallet balances. Use walletHandle=\"@wallet:<walletId>\" to select exact local wallets for read-only balance/assets/status/address and risky actions. Use action=\"assets\" for all visible Solana native and SPL balances, or address=\"<solana-address>\" for read-only external Solana balance/assets. For address/balance reads, omit chain when the user does not specify it; the tool returns the available Solana address or balance set. Risky prepare/send actions use explicit wallet, skill override, Agent assignment, then the optional Default Agent wallet fallback. For normal SOL amounts such as 0.1, pass amountFormat=\"human\"; decimal amounts without amountFormat are treated as human units. Destination wallet handles like @wallet:vault are resolved to receive addresses.",
 		parameters: WalletToolSchema,
 		execute: async (_toolCallId, args) => {
 			if (!access.ok) {
@@ -377,6 +377,9 @@ function createWalletTool(opts) {
 			const walletIdFromHandle = explicitWalletHandle ? parseWalletHandle(explicitWalletHandle) : undefined;
 			const selectedWalletId = walletIdFromHandle ?? explicitWalletId;
 			const explicitWalletName = readStringParam(params, "walletName");
+			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
+			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
+			const skillWalletId = permissions?.walletIds?.length === 1 ? permissions.walletIds[0] : undefined;
 			const walletSelection = riskyWalletAction ? resolveAgentWalletSelection({
 				config: cfg,
 				providerId: explicitProviderId,
@@ -384,6 +387,7 @@ function createWalletTool(opts) {
 				walletId: explicitWalletId,
 				walletName: explicitWalletName,
 				agentId: requesterAgentId ?? ownerAgentId ?? undefined,
+				skillWalletId,
 				env: process.env
 			}) : resolveWalletSelection({
 				providerId: explicitProviderId,
@@ -639,8 +643,6 @@ function createWalletTool(opts) {
 			if (chain === "solana" && payload.program) {
 				assertValidSolanaAddress(payload.program, "SPL mint address");
 			}
-			const requesterSkillId = opts?.requesterSkillId?.trim() || null;
-			const permissions = readSkillWalletActionPermissions(cfg, requesterSkillId);
 			await enforceWalletSkillPolicy({
 				cfg,
 				permissions,

package/dist/brand.js

@@ -2,7 +2,7 @@
 const FASED_BRAND_NAME = "Fased";
 const FASED_AGENT_NAME = "Fased Agent";
 const FASED_CONTROL_NAME = "Fased Control";
-const FASED_PRODUCT_VERSION = "0.1.68";
+const FASED_PRODUCT_VERSION = "0.1.69";
 const FASED_DISPLAY_VERSION = `v${FASED_PRODUCT_VERSION}`;
 function formatFasedDisplayLine() {
 	return `${FASED_AGENT_NAME} ${FASED_DISPLAY_VERSION}`;

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.68",
-  "commit": "ad0d395fdae5c0fbbbda8ad932b32276558b2cf2",
-  "builtAt": "2026-07-20T01:36:18.679Z"
+  "version": "0.1.69",
+  "commit": "a0ff463531b83e6c6040a0d5f88542fa962c668c",
+  "builtAt": "2026-07-20T20:47:15.486Z"
 }

package/dist/canvas-host/a2ui/.bundle.hash

@@ -1 +1 @@
-eb11c388af36ee3609b0db82a4da72350ca90ba7a06fec9f82f02a1db6307bfd
+55def76543727f5f2382ec4651338f60eda04013d15e65d1b8817b7444a13a6c

package/dist/cli/program/register.wallet.js

@@ -1,6 +1,7 @@
 import { defaultRuntime } from "../../runtime.js";
 import { runCommandWithRuntime } from "../cli-utils.js";
-import { walletCanaryCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletLegacyMigrationFinalizeCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRawExportCommand, walletRecoveryExportCommand, walletRecoveryImportCommand, walletRoleSetCommand, walletRotateKeysCommand, walletSetupCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
+import { walletCanaryCommand, walletInboundListCommand, walletInboundPollCommand, walletInboundReconcileCommand, walletLegacyMigrationFinalizeCommand, walletLimitOrdersConfigureCommand, walletMigrateCommand, walletPolicyActivateRoleBaselineCommand, walletPolicyProfileApplyCommand, walletProviderConfigureCommand, walletRawExportCommand, walletRecoveryExportCommand, walletRecoveryImportCommand, walletRetireCommand, walletRoleSetCommand, walletRotateKeysCommand, walletRpcSetCommand, walletSetupCommand, walletSignerDoctorCommand, walletSignerServeCommand, walletStatusCommand } from "../../commands/wallet.js";
+import { addGatewayClientOptions, callGatewayFromCli } from "../gateway-rpc.js";
 
 //#region src/cli/program/register.wallet.ts
 function resolvePublicWalletSetupChain(raw) {
@@ -26,7 +27,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	recovery.command("import").description("Restore an encrypted signer recovery package into a new Local wallet").requiredOption("--wallet-id <id>", "New registered signer-owned wallet id").requiredOption("--wallet-name <name>", "Wallet display name").requiredOption("--role <role>", "Permanent signer role: agent|mining|vault").requiredOption("--file <absolute-path>", "Owner-only encrypted recovery package").requiredOption("--rpc-url <url>", "One primary Solana RPC URL").action(async (opts) => {
+	recovery.command("restore").alias("import").description("Restore an encrypted signer recovery package into a new signer-owned wallet").requiredOption("--wallet-id <id>", "New registered signer-owned wallet id").requiredOption("--wallet-name <name>", "Wallet display name").requiredOption("--role <role>", "Permanent signer role: agent|mining|vault").requiredOption("--file <absolute-path>", "Owner-only encrypted recovery package").requiredOption("--rpc-url <url>", "One primary Solana RPC URL").action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletRecoveryImportCommand(defaultRuntime, {
 				walletId: String(opts.walletId),
@@ -46,6 +47,75 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
+	wallet.command("export-raw").description("Advanced: export a raw Solana keypair and reduce signer custody protection").requiredOption("--wallet-id <id>", "Registered signer-owned wallet id").requiredOption("--output <absolute-path>", "New owner-only raw keypair path").requiredOption("--acknowledge-custody-reduction", "Confirm that raw export makes the wallet key portable").action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await walletRawExportCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				output: String(opts.output),
+				acknowledgeCustodyReduction: Boolean(opts.acknowledgeCustodyReduction)
+			});
+		});
+	});
+	wallet.command("create").description("Create a role-ready signer-owned Solana wallet").option("--wallet-id <id>", "Named wallet id").option("--wallet-name <name>", "Wallet display name").option("--role <role>", "Permanent signer role: agent|mining|vault").option("--rpc-url <url>", "One primary Solana RPC URL").option("--force", "Resume only the same existing signer wallet and role", false).option("--non-interactive", "Do not prompt; require all inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await walletSetupCommand(defaultRuntime, {
+				mode: "local-signer-create",
+				chain: "solana",
+				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
+				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
+				role: typeof opts.role === "string" ? opts.role : undefined,
+				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
+				force: Boolean(opts.force),
+				nonInteractive: Boolean(opts.nonInteractive),
+				json: Boolean(opts.json)
+			});
+		});
+	});
+	wallet.command("import").description("Import an owner-only Solana keypair through the native signer lifecycle").option("--wallet-id <id>", "Named wallet id").option("--wallet-name <name>", "Wallet display name").option("--role <role>", "Permanent signer role: agent|mining|vault").option("--file <absolute-path>", "Owner-only Solana keypair JSON").option("--rpc-url <url>", "One primary Solana RPC URL").option("--non-interactive", "Do not prompt; require all inputs", false).option("--json", "Print JSON output", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await walletSetupCommand(defaultRuntime, {
+				mode: "local-signer-import",
+				chain: "solana",
+				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined,
+				walletName: typeof opts.walletName === "string" ? opts.walletName : undefined,
+				role: typeof opts.role === "string" ? opts.role : undefined,
+				importFile: typeof opts.file === "string" ? opts.file : undefined,
+				rpcUrl: typeof opts.rpcUrl === "string" ? opts.rpcUrl : undefined,
+				nonInteractive: Boolean(opts.nonInteractive),
+				json: Boolean(opts.json)
+			});
+		});
+	});
+	addGatewayClientOptions(wallet.command("retire").description("Safely retire and replace the active signer-owned Mining wallet").requiredOption("--wallet-id <id>", "Active Mining wallet id").requiredOption("--successor-wallet-id <id>", "New distinct Mining wallet id").requiredOption("--successor-wallet-name <name>", "New Mining wallet display name").requiredOption("--recovery-file <absolute-path>", "Encrypted recovery package for the old wallet").requiredOption("--rpc-url <url>", "One primary Solana RPC URL for the successor").option("--json", "Print JSON output", false)).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			let liveMiningStatus = {};
+			try {
+				await callGatewayFromCli("sat.stopMining", opts, {}, { progress: opts.json !== true });
+				liveMiningStatus = await callGatewayFromCli("sat.getMiningStatus", opts, {}, { progress: opts.json !== true });
+			} catch (error) {
+				liveMiningStatus = { retirementGatewayError: error instanceof Error ? error.message : String(error) };
+			}
+			await walletRetireCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				successorWalletId: String(opts.successorWalletId),
+				successorWalletName: String(opts.successorWalletName),
+				recoveryFile: String(opts.recoveryFile),
+				rpcUrl: String(opts.rpcUrl),
+				liveMiningStatus,
+				json: opts.json === true
+			});
+		});
+	});
+	const rpc = wallet.command("rpc").description("Signer-owned Solana RPC configuration");
+	rpc.command("set").description("Verify and set one primary Solana RPC").requiredOption("--wallet-id <id>", "Registered signer-owned wallet id").requiredOption("--rpc-url <url>", "Primary Solana RPC URL").option("--json", "Print JSON output", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await walletRpcSetCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				rpcUrl: String(opts.rpcUrl),
+				json: Boolean(opts.json)
+			});
+		});
+	});
 	wallet.command("setup").description("Create a signer-owned Solana wallet or configure a supported provider").option("--mode <mode>", "local-signer-create|local-signer-import|local-signer-recovery-import|local-signer|turnkey|alchemy").option("--chain <chain>", "solana", "solana").option("--wallet-id <id>", "Named wallet id (examples: agent, mining, vault)").option("--wallet-name <value>", "Friendly wallet display name (for UI/skills/plugins)").option("--role <role>", "Permanent signer role: agent|mining|vault").option("--import-file <absolute-path>", "Owner-only Solana keypair JSON for local-signer-import; secret is passed by file descriptor, never argv/env").option("--recovery-file <absolute-path>", "Owner-only encrypted package for local-signer-recovery-import").option("--api-key <value>", "Alchemy API key").option("--rpc-url <url>", "Solana RPC URL").option("--turnkey-api-public-key <value>", "Turnkey API public key (turnkey mode)").option("--turnkey-api-private-key <value>", "Turnkey API private key (turnkey mode)").option("--turnkey-organization-id <value>", "Turnkey organization ID (turnkey mode)").option("--turnkey-policy-id <value>", "Turnkey policy ID (turnkey mode)").option("--turnkey-base-url <value>", "Turnkey base URL override (turnkey mode)").option("--enable-limit-orders", "Legacy alias: configure Gateway Jupiter Swap API access (Trigger is signer-owned)", false).option("--disable-limit-orders", "Remove stored Gateway Jupiter Swap API key", false).option("--jupiter-api-key <value>", "Jupiter API key for Gateway swap crafting only").option("--non-interactive", "Do not prompt; require mode/inputs", false).option("--no-doctor", "Skip signer doctor in local-signer mode", false).option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletSetupCommand(defaultRuntime, {
@@ -83,9 +153,12 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("status").description("Show wallet service and policy status").option("--json", "Print JSON output", false).action(async (opts) => {
+	wallet.command("status").description("Show wallet service and policy status").option("--wallet-id <id>", "Show one registered wallet").option("--json", "Print JSON output", false).action(async (opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
-			await walletStatusCommand(defaultRuntime, { json: Boolean(opts.json) });
+			await walletStatusCommand(defaultRuntime, {
+				json: Boolean(opts.json),
+				walletId: typeof opts.walletId === "string" ? opts.walletId : undefined
+			});
 		});
 	});
 	wallet.command("rotate-keys").description("Removed Gateway key rotation; prints native/provider authority guidance").option("--json", "Print JSON output", false).action(async (opts) => {
@@ -102,7 +175,7 @@ function registerWalletCommands(program) {
 			});
 		});
 	});
-	wallet.command("role set <wallet-id> <role>").description("Set primary Agent fallback or initialize a missing Agent/Vault purpose. Existing purpose stays permanent.").option("--primary", "Make this Agent wallet the primary fallback", false).option("--json", "Print JSON output", false).action(async (walletId, role, opts) => {
+	wallet.command("role set <wallet-id> <role>").description("Set Default Agent wallet fallback or initialize a missing Agent/Vault purpose. Existing purpose stays permanent.").option("--primary", "Make this the Default Agent wallet fallback", false).option("--json", "Print JSON output", false).action(async (walletId, role, opts) => {
 		await runCommandWithRuntime(defaultRuntime, async () => {
 			await walletRoleSetCommand(defaultRuntime, {
 				walletId: String(walletId),
@@ -128,6 +201,16 @@ function registerWalletCommands(program) {
 		});
 	});
 	const policy = wallet.command("policy").description("Wallet policy presets and controls");
+	policy.command("activate-role-baseline").description("Explicitly migrate one existing deny-all signer wallet to its role baseline").requiredOption("--wallet-id <id>", "Registered signer-owned wallet id").requiredOption("--role <role>", "Immutable signer role: agent|mining|vault").requiredOption("--confirm", "Confirm activation after reviewing the selected role").option("--json", "Print JSON output", false).action(async (opts) => {
+		await runCommandWithRuntime(defaultRuntime, async () => {
+			await walletPolicyActivateRoleBaselineCommand(defaultRuntime, {
+				walletId: String(opts.walletId),
+				role: String(opts.role),
+				confirm: Boolean(opts.confirm),
+				json: Boolean(opts.json)
+			});
+		});
+	});
 	policy.command("profile <name>").description("Apply wallet policy profile (autonomous-strict|autonomous-moderate|manual-owner)").option("--allow-skill <id>", "Allow skill id (repeatable)", (v, acc) => [...acc, v], []).option("--allow-source <id>", "Allow source id (repeatable)", (v, acc) => [...acc, v], []).option("--json", "Print JSON output", false).action(async (name, opts) => {
 		if (name !== "autonomous-strict" && name !== "autonomous-moderate" && name !== "manual-owner") {
 			throw new Error("profile must be one of: autonomous-strict, autonomous-moderate, manual-owner");