@safebrowse/daemon 0.1.3 → 0.1.4

package/dist/server.js

@@ -1,11 +1,12 @@
-import { createHash, randomUUID } from "node:crypto";
-import { stat } from "node:fs/promises";
+import { createHash, createPublicKey, randomUUID } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
 import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { applyV4FailClosedMediation, attachCapabilitiesToPlannerInput, brokerArtifact, brokerArtifactV2, buildReplayBundle, compilePolicy, createApprovalGrantHash, evaluateAction, evaluateCapabilityUse, evaluateMemoryWrite, evaluateMemoryWriteV4, evaluateToolRequest, mintCapabilitiesForObservation, prepareToolOnboarding, prepareToolOnboardingV4, promoteMemoryRecordV4, rollbackMemoryRecordV4, sanitizeObservation, verifyToolCallback, verifyToolCallbackV4 } from "@safebrowse/core";
+import { applyV4FailClosedMediation, applyV5ObservationMediation, attachCapabilitiesToPlannerInput, brokerArtifact, brokerArtifactV2, buildReplayBundle, compilePolicy, createApprovalGrantHash, createApprovalIntentPayloadV5, evaluateAction, evaluateCapabilityUse, evaluateCapabilityUseV5, evaluateMemoryWrite, evaluateMemoryWriteV4, evaluateMemoryWriteV5, evaluateToolRequest, mintCapabilitiesForObservation, mintCapabilitiesForObservationV5, mintMemoryPromotionCapabilityV5, prepareToolOnboarding, prepareToolOnboardingV4, prepareToolOnboardingV5, promoteMemoryRecordV4, promoteMemoryRecordV5, promoteMemoryRecordV6, promoteStagedMemoryRecordV5, rollbackMemoryRecordV4, rollbackMemoryRecordV5, sanitizeObservation, stageMemoryRecordV6, stageMemoryRecordV5, issueApprovalEnvelopeV5, verifyApprovalIntentSignatureV5, verifyToolCallback, verifyToolCallbackV4, verifyToolCallbackV5 } from "@safebrowse/core";
 import { buildRegistryDefaults, loadKnowledgeBaseContext, loadVerifiedRegistryBundle, loadPolicyPackFromPaths, resolvePolicyLayerFiles } from "./loaders.js";
-import { compileObservationInIsolation, probeParserIsolation } from "./parserIsolation.js";
+import { createParserIsolationService } from "./parserIsolation.js";
+const PARSER_HEALTH_REFRESH_INTERVAL_MS = 30_000;
 function hashValue(input) {
     return createHash("sha256").update(JSON.stringify(input)).digest("hex");
 }
@@ -21,6 +22,13 @@ function writeJson(response, statusCode, payload) {
     response.setHeader("content-type", "application/json; charset=utf-8");
     response.end(JSON.stringify(payload, null, 2));
 }
+function logServerError(error) {
+    if (error instanceof Error) {
+        console.error("SafeBrowse daemon error:", error.stack ?? error.message);
+        return;
+    }
+    console.error("SafeBrowse daemon error:", error);
+}
 function legacyResponseMeta(route) {
     return {
         deprecated: true,
@@ -52,16 +60,34 @@ async function resolveDefaultRootDir() {
 }
 async function buildRuntimeContext(options) {
     const rootDir = options.rootDir ?? (await resolveDefaultRootDir());
+    const deploymentProfile = options.deploymentProfile === "secure_v6"
+        ? "secure_v5"
+        : (options.deploymentProfile ?? "development");
+    const secureDeployment = deploymentProfile === "secure_v5";
     const policyPack = options.policyPack ??
         (await loadPolicyPackFromPaths(resolvePolicyLayerFiles(resolve(rootDir))));
     const knowledgeBase = options.knowledgeBase ?? (await loadKnowledgeBaseContext(resolve(rootDir, "knowledge_base")));
     const verifiedRegistry = options.verifiedRegistry ??
         (await loadVerifiedRegistryBundle(buildRegistryDefaults(resolve(rootDir))).catch(() => undefined));
+    const approvalBrokerPublicKeyPem = options.approvalBrokerPublicKeyPem ??
+        (options.approvalBrokerPublicKeyPath
+            ? await readFile(options.approvalBrokerPublicKeyPath, "utf8").catch(() => undefined)
+            : await readFile(resolve(rootDir, "knowledge_base", "signing", "safebrowse_vf_ed25519_public.pem"), "utf8").catch(() => undefined));
     return {
         policy: compilePolicy(policyPack),
         knowledgeBase,
         verifiedRegistry,
-        parserAllowlistedEgress: options.parserAllowlistedEgress ?? []
+        parserAllowlistedEgress: options.parserAllowlistedEgress ?? [],
+        parserIsolationMode: secureDeployment
+            ? "node_permission_process"
+            : options.parserIsolationMode ?? "scrubbed_process",
+        deploymentProfile,
+        approvalBrokerPublicKey: approvalBrokerPublicKeyPem
+            ? createPublicKey(approvalBrokerPublicKeyPem)
+            : undefined,
+        approvalBrokerConfigured: Boolean(approvalBrokerPublicKeyPem),
+        approvalBrokerMode: secureDeployment ? "external_service" : options.approvalBrokerMode ?? "signature_verification",
+        claimBearingReady: false
     };
 }
 function plusMinutes(value, minutes) {
@@ -104,10 +130,15 @@ function createSessionState(request, runtime) {
         }),
         currentStep: 0,
         createdAt,
-        expiresAt: plusSeconds(createdAt, request.expiresInSeconds ?? 1800)
+        expiresAt: plusSeconds(createdAt, request.expiresInSeconds ?? 1800),
+        claimProfile: runtime.claimBearingReady ? secureClaimProfile(runtime) : undefined,
+        approvalBrokerRequired: isSecureDeploymentProfile(runtime.deploymentProfile),
+        legacyRoutesDisabled: isSecureDeploymentProfile(runtime.deploymentProfile)
     };
+    const memorySourceClasses = new Map();
     return {
         session,
+        observations: new Map(),
         capabilities: new Map(),
         usedCapabilities: new Set(),
         authorityReduced: false,
@@ -115,9 +146,43 @@ function createSessionState(request, runtime) {
         approvalGrants: new Map(),
         memoryRecords: new Map(),
         memorySnapshots: new Map(),
-        onboardingSessions: new Map()
+        onboardingSessions: new Map(),
+        observationsV5: new Map(),
+        capabilitiesV5: new Map(),
+        consumedCapabilitiesV5: new Map(),
+        usedCapabilitiesV5: new Set(),
+        approvalEnvelopesV5: new Map(),
+        onboardingSessionsV5: new Map(),
+        connectorHandlesV5: new Map(),
+        memorySourceClassesV5: memorySourceClasses,
+        memorySourceClassesV6: memorySourceClasses,
+        replayEvents: []
     };
 }
+function secureParserIsolationSatisfied(probe) {
+    return (probe.mode === "node_permission_process" &&
+        probe.processIsolated &&
+        probe.egressDenied &&
+        probe.permissionModelEnabled &&
+        probe.childProcessDenied &&
+        probe.workerThreadsDenied &&
+        probe.envKeys.length === 0);
+}
+function isSecureDeploymentProfile(deploymentProfile) {
+    return deploymentProfile === "secure_v5";
+}
+function secureClaimProfile(runtime) {
+    return "secure_v5";
+}
+function claimBearingReady(runtime, probe) {
+    return (isSecureDeploymentProfile(runtime.deploymentProfile) &&
+        runtime.approvalBrokerConfigured &&
+        Boolean(runtime.approvalBrokerPublicKey) &&
+        runtime.approvalBrokerMode === "external_service" &&
+        runtime.verifiedRegistry?.signatureVerified === true &&
+        runtime.parserIsolationMode === "node_permission_process" &&
+        secureParserIsolationSatisfied(probe));
+}
 function shouldReduceAuthority(sessionState, observation) {
     if (sessionState.authorityReduced) {
         return true;
@@ -213,7 +278,223 @@ function findSessionState(sessions, sessionId) {
     }
     return sessionState;
 }
+function legacyRoutesDisabled(runtime) {
+    return isSecureDeploymentProfile(runtime.deploymentProfile);
+}
+function isLegacyRoute(url) {
+    return url.startsWith("/v1/") || url.startsWith("/v2/") || url.startsWith("/v4/");
+}
+function lookupVerifiedRegistryEntry(runtime, toolId, registryEntryId) {
+    return runtime.verifiedRegistry?.entries.find((entry) => entry.registryEntryId === registryEntryId ||
+        entry.registryEntryId === toolId ||
+        entry.adapterId === toolId);
+}
+function resolveToolManifestRegistryEntry(runtime, capture) {
+    return runtime.verifiedRegistry?.entries.find((entry) => {
+        if (capture.toolId !== entry.adapterId && capture.toolId !== entry.registryEntryId) {
+            return false;
+        }
+        if (capture.authType && capture.authType !== entry.authType) {
+            return false;
+        }
+        if (capture.callbackUri && !entry.allowedRedirectUris.includes(capture.callbackUri)) {
+            return false;
+        }
+        if (capture.callbackOrigin &&
+            !entry.allowedCallbackOrigins.includes(capture.callbackOrigin)) {
+            return false;
+        }
+        if (capture.requestedScopes?.length &&
+            capture.requestedScopes.some((scope) => !entry.allowedScopes.includes(scope))) {
+            return false;
+        }
+        return true;
+    });
+}
+function getCapabilityV5(sessionState, capabilityId) {
+    if (!sessionState || !capabilityId) {
+        return undefined;
+    }
+    return (sessionState.capabilitiesV5.get(capabilityId) ??
+        sessionState.consumedCapabilitiesV5.get(capabilityId));
+}
+function consumeCapabilityV5(sessionState, capability, consumedAt = new Date().toISOString()) {
+    const consumedCapability = {
+        ...capability,
+        consumedAt
+    };
+    sessionState.capabilitiesV5.delete(capability.capabilityId);
+    sessionState.consumedCapabilitiesV5.set(capability.capabilityId, consumedCapability);
+    sessionState.usedCapabilitiesV5.add(capability.capabilityId);
+    return consumedCapability;
+}
+function getActiveApprovalEnvelopeForCapability(sessionState, capabilityId) {
+    if (!sessionState || !capabilityId) {
+        return undefined;
+    }
+    return [...sessionState.approvalEnvelopesV5.values()].find((envelope) => envelope.capabilityId === capabilityId &&
+        !envelope.consumedAt &&
+        new Date(envelope.expiresAt).getTime() > Date.now());
+}
+function buildMemorySnapshotState(sessionState, record) {
+    const priorTrustedBaseline = [...sessionState.memoryRecords.values()]
+        .filter((candidate) => candidate.sessionId === record.sessionId &&
+        candidate.key === record.key &&
+        candidate.tier === "trusted_durable" &&
+        candidate.recordId !== record.recordId)
+        .sort((left, right) => right.createdAt.localeCompare(left.createdAt))[0];
+    return {
+        snapshotId: randomUUID(),
+        sessionId: record.sessionId,
+        recordId: record.recordId,
+        key: record.key,
+        createdAt: new Date().toISOString(),
+        baselineAbsent: !priorTrustedBaseline,
+        snapshotRecord: priorTrustedBaseline
+            ? {
+                ...priorTrustedBaseline
+            }
+            : undefined
+    };
+}
+function retireObservationCapabilitiesV5(sessionState) {
+    const retiredCapabilityIds = [];
+    for (const [capabilityId, capability] of sessionState.capabilitiesV5.entries()) {
+        if (capability.kind !== "memory_promote") {
+            sessionState.capabilitiesV5.delete(capabilityId);
+            retiredCapabilityIds.push(capabilityId);
+        }
+    }
+    if (!retiredCapabilityIds.length) {
+        return;
+    }
+    for (const [approvalId, envelope] of sessionState.approvalEnvelopesV5.entries()) {
+        if (retiredCapabilityIds.includes(envelope.capabilityId) && !envelope.consumedAt) {
+            sessionState.approvalEnvelopesV5.delete(approvalId);
+        }
+    }
+}
+function buildV5ExecutionPlan(capability) {
+    if (!capability) {
+        return undefined;
+    }
+    return {
+        verb: capability.kind,
+        targetUrl: capability.targetUrl,
+        targetOrigin: capability.targetOrigin,
+        selector: capability.selector,
+        connectorId: capability.connectorId,
+        callbackUri: capability.callbackUri,
+        callbackOrigin: capability.callbackOrigin,
+        memoryRecordId: capability.memoryRecordId,
+        derivedSinkClass: capability.derivedSinkClass,
+        derivedSensitiveSink: capability.derivedSensitiveSink,
+        semanticDigest: capability.semanticDigest
+    };
+}
+function summarizeCapabilityV5(capability) {
+    return {
+        capabilityId: capability.capabilityId,
+        capabilityDigest: capability.capabilityDigest,
+        semanticDigest: capability.semanticDigest,
+        title: capability.title,
+        kind: capability.kind,
+        parameterSchema: capability.parameterSchema,
+        expiresAt: capability.expiresAt
+    };
+}
+function summarizeAuthorityCandidate(capability) {
+    return {
+        authorityId: capability.capabilityId,
+        authorityDigest: capability.capabilityDigest,
+        capabilityId: capability.capabilityId,
+        capabilityDigest: capability.capabilityDigest,
+        semanticDigest: capability.semanticDigest,
+        title: capability.title,
+        kind: capability.kind,
+        parameterSchema: capability.parameterSchema,
+        expiresAt: capability.expiresAt
+    };
+}
+function relabelClaimProfile(verdict, claimProfile) {
+    return {
+        ...verdict,
+        safeConstraints: {
+            ...(verdict.safeConstraints ?? {}),
+            claim_profile: claimProfile
+        }
+    };
+}
+function appendReplayEvent(sessionState, event) {
+    const replayEvent = {
+        eventId: randomUUID(),
+        timestamp: new Date().toISOString(),
+        ...event
+    };
+    sessionState?.replayEvents.push(replayEvent);
+    return replayEvent;
+}
+function buildV5ObservationDecision(compiledObservation) {
+    if (compiledObservation.parseStatus !== "compiled") {
+        return {
+            decision: "BLOCK",
+            reasonCodes: [
+                compiledObservation.parseStatus === "partial"
+                    ? "PARSE_STATUS_PARTIAL"
+                    : "PARSE_STATUS_UNSUPPORTED"
+            ],
+            riskScore: 0.98,
+            safeConstraints: {
+                authority_eligible: false
+            },
+            telemetryTags: ["v5_observation", "block"]
+        };
+    }
+    return {
+        decision: compiledObservation.authorityEligible ? "ALLOW" : "REPLAN_READ_ONLY",
+        reasonCodes: compiledObservation.authorityEligible ? [] : ["AUTHORITY_REDUCED_TO_FACTS_ONLY"],
+        riskScore: compiledObservation.riskScore,
+        safeConstraints: {
+            authority_eligible: compiledObservation.authorityEligible
+        },
+        telemetryTags: [
+            "v5_observation",
+            compiledObservation.authorityEligible ? "authority_eligible" : "facts_only"
+        ]
+    };
+}
+function buildV6ObservationDecision(compiledObservation) {
+    return buildV5ObservationDecision(compiledObservation);
+}
+function buildObservationDecisionForClaimProfile(compiledObservation, claimProfile) {
+    if (!compiledObservation) {
+        return relabelClaimProfile({
+            decision: "BLOCK",
+            reasonCodes: ["OBSERVATION_REQUIRED"],
+            riskScore: 0.99,
+            safeConstraints: {},
+            telemetryTags: [`${claimProfile}_observation`, "block"]
+        }, claimProfile);
+    }
+    return relabelClaimProfile(buildV5ObservationDecision(compiledObservation), claimProfile);
+}
+function canonicalReplayRoute(route) {
+    return route.replace(/^\/v6\//, "/v5/");
+}
 function buildLegacyObservationCapture(payload) {
+    if (payload.surfaceType === "html") {
+        return {
+            mimeType: "text/html",
+            sourceOrigin: payload.url,
+            viewerOrigin: payload.frameUrl ?? payload.url,
+            renderedText: payload.visibleText,
+            extractedText: payload.visibleText,
+            metadataText: payload.metadataText,
+            annotations: payload.annotations,
+            extractionMethod: "dom",
+            trustSignals: payload.trustSignals
+        };
+    }
     if (payload.surfaceType === "pdf") {
         return {
             mimeType: "application/pdf",
@@ -253,32 +534,107 @@ function buildLegacyObservationCapture(payload) {
     }
     return undefined;
 }
+function buildV5ArtifactRef(artifact, authorityEligible) {
+    return {
+        artifactId: artifact.artifactId,
+        surfaceKind: artifact.surfaceKind,
+        sourceOrigin: artifact.sourceOrigin,
+        viewerOrigin: artifact.viewerOrigin,
+        mismatchSignals: artifact.mismatchSignals,
+        metadataSignals: artifact.metadataSignals,
+        provenance: {
+            extractionMethod: artifact.extractionMethod,
+            lineageChain: artifact.lineageChain,
+            derivedTaintClass: artifact.derivedTaintClass
+        },
+        authorityEligible
+    };
+}
+const buildV6ArtifactRef = buildV5ArtifactRef;
 export async function createSafeBrowseServer(options = {}) {
     const runtime = await buildRuntimeContext(options);
+    const unifiedV5InSecureV6 = false;
+    const parserIsolationService = createParserIsolationService(runtime.parserIsolationMode, {
+        allowlistedEgress: runtime.parserAllowlistedEgress,
+        runtime: {
+            knowledgeBase: runtime.knowledgeBase
+        }
+    });
+    let parserProbeSnapshot = await parserIsolationService.refreshProbe();
+    runtime.claimBearingReady = claimBearingReady(runtime, parserProbeSnapshot.probe);
+    if (isSecureDeploymentProfile(runtime.deploymentProfile)) {
+        const secureProfile = runtime.deploymentProfile;
+        if (!runtime.verifiedRegistry?.signatureVerified) {
+            throw new Error(`${secureProfile} requires a signature-verified registry bundle`);
+        }
+        if (!runtime.approvalBrokerConfigured || !runtime.approvalBrokerPublicKey) {
+            throw new Error(`${secureProfile} requires an approval broker public key`);
+        }
+        if (runtime.approvalBrokerMode !== "external_service") {
+            throw new Error(`${secureProfile} requires approvalBrokerMode=external_service`);
+        }
+        if (runtime.parserIsolationMode !== "node_permission_process") {
+            throw new Error(`${secureProfile} requires parserIsolationMode=node_permission_process`);
+        }
+        if (!secureParserIsolationSatisfied(parserProbeSnapshot.probe)) {
+            throw new Error(`${secureProfile} requires a permission-constrained parser process with denied egress and scrubbed env`);
+        }
+    }
     const onboardingSessions = new Map();
     const sessions = new Map();
-    return createServer(async (request, response) => {
+    const parserHealthRefreshTimer = setInterval(() => {
+        void parserIsolationService
+            .refreshProbe()
+            .then((snapshot) => {
+            parserProbeSnapshot = snapshot;
+            runtime.claimBearingReady = claimBearingReady(runtime, snapshot.probe);
+        })
+            .catch(() => {
+            runtime.claimBearingReady = false;
+        });
+    }, PARSER_HEALTH_REFRESH_INTERVAL_MS);
+    parserHealthRefreshTimer.unref();
+    const server = createServer(async (request, response) => {
         if (!request.url) {
             writeJson(response, 400, { error: "missing_url" });
             return;
         }
+        if (request.url.startsWith("/v6/")) {
+            request.url = canonicalReplayRoute(request.url);
+        }
         try {
             if (request.method === "GET" && request.url === "/health") {
-                const parserProbe = await probeParserIsolation();
+                parserProbeSnapshot = await parserIsolationService.getCachedProbe();
+                const claimReady = claimBearingReady(runtime, parserProbeSnapshot.probe);
+                runtime.claimBearingReady = claimReady;
                 writeJson(response, 200, {
                     status: "ok",
                     profile: runtime.policy.profile,
+                    deploymentProfile: runtime.deploymentProfile,
+                    claimBearingReady: claimReady,
                     version: runtime.policy.version,
                     policyLayers: runtime.policy.layerProvenance,
+                    legacyRoutesEnabled: !legacyRoutesDisabled(runtime),
                     verifiedRegistry: runtime.verifiedRegistry
                         ? {
                             bundleId: runtime.verifiedRegistry.bundleId,
                             version: runtime.verifiedRegistry.version,
                             signatureVerified: runtime.verifiedRegistry.signatureVerified,
-                            entryCount: runtime.verifiedRegistry.entries.length
+                            entryCount: runtime.verifiedRegistry.entries.length,
+                            required: isSecureDeploymentProfile(runtime.deploymentProfile)
                         }
                         : undefined,
-                    parserIsolation: parserProbe
+                    parserIsolation: {
+                        ...parserProbeSnapshot.probe,
+                        lastCheckedAt: parserProbeSnapshot.lastCheckedAt,
+                        configuredMode: runtime.parserIsolationMode,
+                        enforced: isSecureDeploymentProfile(runtime.deploymentProfile)
+                    },
+                    approvalBroker: {
+                        required: isSecureDeploymentProfile(runtime.deploymentProfile),
+                        configured: runtime.approvalBrokerConfigured,
+                        mode: runtime.approvalBrokerMode
+                    }
                 });
                 return;
             }
@@ -286,6 +642,14 @@ export async function createSafeBrowseServer(options = {}) {
                 writeJson(response, 405, { error: "method_not_allowed" });
                 return;
             }
+            if (legacyRoutesDisabled(runtime) && isLegacyRoute(request.url)) {
+                writeJson(response, 403, {
+                    error: `route_disabled_in_${runtime.deploymentProfile}`,
+                    route: request.url,
+                    claimProfile: secureClaimProfile(runtime)
+                });
+                return;
+            }
             if (request.url === "/v1/observe") {
                 const payload = await readJson(request);
                 writeJson(response, 200, {
@@ -392,16 +756,26 @@ export async function createSafeBrowseServer(options = {}) {
                 });
                 return;
             }
-            if (request.url === "/v4/session/start") {
+            if (request.url === "/v6/session/start" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/session/start")) {
                 const payload = await readJson(request);
                 const sessionState = createSessionState(payload, runtime);
                 sessions.set(sessionState.session.sessionId, sessionState);
+                appendReplayEvent(sessionState, {
+                    kind: "verdict",
+                    actor: "system",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        sessionId: sessionState.session.sessionId,
+                        claimProfile: sessionState.session.claimProfile ?? "secure_v6"
+                    }
+                });
                 writeJson(response, 200, {
                     session: sessionState.session
                 });
                 return;
             }
-            if (request.url === "/v4/observe") {
+            if (request.url === "/v6/observe" || (unifiedV5InSecureV6 && request.url === "/v5/observe")) {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 if (!sessionState) {
@@ -413,134 +787,332 @@ export async function createSafeBrowseServer(options = {}) {
                     sessionId: payload.sessionId,
                     taskId: sessionState.session.taskId
                 };
-                const observation = await compileObservationInIsolation({
+                const observationResult = await parserIsolationService.compileObservation({
                     capture,
                     workflowHash: sessionState.session.workflowHash,
-                    allowlistedEgress: runtime.parserAllowlistedEgress,
-                    runtime: {
-                        knowledgeBase: runtime.knowledgeBase
-                    }
+                    compilerVersion: "v5"
                 });
-                const failClosedObservation = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "observe");
-                let capabilities = mintCapabilitiesForObservation(sessionState.session, observation.compiledObservation, {
-                    sourceObservationId: observation.compiledObservation.observationId
+                const compiledObservation = observationResult.compiledObservation;
+                const plannerView = observationResult.plannerView;
+                const verifiedEntry = capture.surfaceType === "tool_manifest"
+                    ? resolveToolManifestRegistryEntry(runtime, capture)
+                    : undefined;
+                const manifestHash = observationResult.toolManifestDigests?.manifestHash;
+                const schemaHash = observationResult.toolManifestDigests?.schemaHash;
+                retireObservationCapabilitiesV5(sessionState);
+                const capabilities = mintCapabilitiesForObservationV5(sessionState.session, compiledObservation, plannerView, {
+                    verifiedRegistryEntry: verifiedEntry,
+                    registryEntryId: capture.surfaceType === "tool_manifest" ? verifiedEntry?.registryEntryId : undefined,
+                    connectorId: capture.surfaceType === "tool_manifest"
+                        ? verifiedEntry?.adapterId ?? capture.toolId
+                        : undefined,
+                    requestedScopes: capture.surfaceType === "tool_manifest" ? capture.requestedScopes : undefined,
+                    callbackUri: capture.surfaceType === "tool_manifest" ? capture.callbackUri : undefined,
+                    callbackOrigin: capture.surfaceType === "tool_manifest" ? capture.callbackOrigin : undefined,
+                    manifestAuthType: capture.surfaceType === "tool_manifest" ? capture.authType : undefined,
+                    manifestHash,
+                    schemaHash
                 });
-                let plannerInput = failClosedObservation.plannerInput;
-                if (shouldReduceAuthority(sessionState, observation.compiledObservation)) {
-                    plannerInput = applyAuthorityReduction(sessionState, observation.compiledObservation, plannerInput);
-                    capabilities = [];
-                }
-                sessionState.capabilities.clear();
+                sessionState.latestObservationV5 = compiledObservation;
+                sessionState.observationsV5.set(compiledObservation.observationId, compiledObservation);
                 for (const capability of capabilities) {
-                    sessionState.capabilities.set(capability.capabilityId, capability);
+                    sessionState.capabilitiesV5.set(capability.capabilityId, capability);
                 }
-                sessionState.latestObservation = observation.compiledObservation;
+                const observationVerdict = relabelClaimProfile(buildV6ObservationDecision(compiledObservation), "secure_v6");
+                const artifactCapture = buildLegacyObservationCapture(capture);
+                const artifactRefs = artifactCapture
+                    ? [
+                        buildV6ArtifactRef(brokerArtifact(artifactCapture, runtime).artifact, compiledObservation.authorityEligible)
+                    ]
+                    : [];
+                const authorityCandidates = capabilities.map((capability) => ({
+                    authorityId: capability.capabilityId,
+                    authorityDigest: capability.capabilityDigest,
+                    semanticDigest: capability.semanticDigest,
+                    title: capability.title,
+                    kind: capability.kind,
+                    parameterSchema: capability.parameterSchema,
+                    expiresAt: capability.expiresAt
+                }));
+                const capabilityAliases = authorityCandidates.map((candidate) => ({
+                    capabilityId: candidate.authorityId,
+                    capabilityDigest: candidate.authorityDigest,
+                    semanticDigest: candidate.semanticDigest,
+                    title: candidate.title,
+                    kind: candidate.kind,
+                    parameterSchema: candidate.parameterSchema,
+                    expiresAt: candidate.expiresAt
+                }));
+                const replayEvent = appendReplayEvent(sessionState, {
+                    kind: "observation",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        observationId: compiledObservation.observationId,
+                        surfaceType: compiledObservation.surfaceType,
+                        authorityEligible: compiledObservation.authorityEligible,
+                        authorityCandidateCount: capabilities.length,
+                        verdict: observationVerdict.decision
+                    }
+                });
                 writeJson(response, 200, {
-                    compiledObservation: observation.compiledObservation,
-                    observationVerdict: failClosedObservation.verdict,
-                    plannerInput: attachCapabilitiesToPlannerInput(plannerInput, capabilities)
+                    compiledObservation,
+                    plannerView,
+                    capabilities: capabilityAliases,
+                    authorityCandidates,
+                    artifactRefs,
+                    observationVerdict,
+                    replayEventId: replayEvent.eventId
                 });
                 return;
             }
-            if (request.url === "/v4/action/evaluate") {
+            if (request.url === "/v6/action/evaluate" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/action/evaluate")) {
                 const payload = await readJson(request);
+                const authorityId = payload.authorityId ?? payload.capabilityId;
+                const authorityDigest = payload.authorityDigest ?? payload.capabilityDigest;
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const capability = sessionState?.capabilities.get(payload.capabilityId);
-                const verdict = evaluateCapabilityUse(payload, sessionState?.session, capability, {
-                    alreadyUsed: sessionState?.usedCapabilities.has(payload.capabilityId) ?? false
-                });
-                if (verdict.decision === "ALLOW" && sessionState && capability) {
-                    sessionState.capabilities.delete(payload.capabilityId);
-                    sessionState.usedCapabilities.add(payload.capabilityId);
+                const capability = authorityId ? getCapabilityV5(sessionState, authorityId) : undefined;
+                const authorityDecision = relabelClaimProfile(evaluateCapabilityUseV5({
+                    sessionId: payload.sessionId,
+                    capabilityId: authorityId ?? "",
+                    capabilityDigest: authorityDigest ?? "",
+                    parameters: payload.parameters
+                }, sessionState?.session, capability, {
+                    alreadyUsed: authorityId
+                        ? (sessionState?.usedCapabilitiesV5.has(authorityId) ?? false)
+                        : false
+                }), "secure_v6");
+                const observationDecision = relabelClaimProfile(sessionState?.latestObservationV5
+                    ? buildV6ObservationDecision(sessionState.latestObservationV5)
+                    : {
+                        decision: "BLOCK",
+                        reasonCodes: ["OBSERVATION_REQUIRED"],
+                        riskScore: 0.99,
+                        safeConstraints: {},
+                        telemetryTags: ["v6_observation", "block"]
+                    }, "secure_v6");
+                const effectDecision = observationDecision.decision === "ALLOW" &&
+                    authorityDecision.decision === "ALLOW"
+                    ? authorityDecision
+                    : relabelClaimProfile({
+                        decision: "BLOCK",
+                        reasonCodes: [...new Set([
+                                ...(observationDecision.decision === "ALLOW"
+                                    ? []
+                                    : ["OBSERVATION_NOT_EFFECT_ELIGIBLE"]),
+                                ...(authorityDecision.decision === "ALLOW"
+                                    ? []
+                                    : authorityDecision.reasonCodes)
+                            ])],
+                        riskScore: Math.max(observationDecision.riskScore, authorityDecision.riskScore),
+                        safeConstraints: {
+                            target_class: capability?.targetClass ?? "unknown"
+                        },
+                        telemetryTags: ["v6_action", "block"]
+                    }, "secure_v6");
+                if (effectDecision.decision === "ALLOW" && sessionState && capability) {
+                    consumeCapabilityV5(sessionState, capability);
                     sessionState.session = {
                         ...sessionState.session,
                         currentStep: sessionState.session.currentStep + 1
                     };
                 }
+                appendReplayEvent(sessionState, {
+                    kind: "action",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        authorityId: authorityId ?? null,
+                        observationDecision: observationDecision.decision,
+                        authorityDecision: authorityDecision.decision,
+                        effectDecision: effectDecision.decision
+                    }
+                });
                 writeJson(response, 200, {
-                    verdict,
-                    executionPlan: verdict.decision === "ALLOW" && capability
-                        ? {
-                            verb: capability.kind,
-                            targetUrl: capability.targetUrl,
-                            targetOrigin: capability.targetOrigin,
-                            selector: capability.selector,
-                            derivedSinkClass: capability.derivedSinkClass,
-                            derivedSensitiveSink: capability.derivedSensitiveSink
-                        }
-                        : undefined
+                    observationDecision,
+                    authorityDecision,
+                    effectDecision,
+                    verdict: effectDecision,
+                    executionPlan: buildV5ExecutionPlan(capability)
                 });
                 return;
             }
-            if (request.url === "/v4/approval/grant") {
+            if (request.url === "/v6/approval/issue" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/approval/issue")) {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                if (!sessionState) {
-                    writeJson(response, 404, { error: "unknown_session" });
+                const capability = sessionState?.capabilitiesV5.get(payload.capabilityId);
+                if (sessionState?.usedCapabilitiesV5.has(payload.capabilityId)) {
+                    writeJson(response, 200, {
+                        verdict: relabelClaimProfile({
+                            decision: "BLOCK",
+                            reasonCodes: ["CAPABILITY_REPLAYED"],
+                            riskScore: 0.99,
+                            safeConstraints: {},
+                            telemetryTags: ["approval_v6_issue", "block"]
+                        }, "secure_v6")
+                    });
                     return;
                 }
-                const unknownCapability = (payload.capabilityIds ?? []).find((capabilityId) => !sessionState.capabilities.has(capabilityId));
-                if (unknownCapability) {
-                    writeJson(response, 400, {
-                        error: "unknown_capability",
-                        capabilityId: unknownCapability
+                if (capability && payload.capabilityDigest !== capability.capabilityDigest) {
+                    writeJson(response, 200, {
+                        verdict: relabelClaimProfile({
+                            decision: "BLOCK",
+                            reasonCodes: ["CAPABILITY_DIGEST_MISMATCH"],
+                            riskScore: 0.99,
+                            safeConstraints: {},
+                            telemetryTags: ["approval_v6_issue", "block"]
+                        }, "secure_v6")
                     });
                     return;
                 }
-                if (payload.sinkClass === "connector_oauth" &&
-                    !(payload.capabilityIds ?? []).length) {
-                    writeJson(response, 400, {
-                        error: "capability_ids_required",
-                        sinkClass: payload.sinkClass
+                const activeApproval = getActiveApprovalEnvelopeForCapability(sessionState, payload.capabilityId);
+                if (activeApproval) {
+                    writeJson(response, 200, {
+                        verdict: relabelClaimProfile({
+                            decision: "BLOCK",
+                            reasonCodes: ["APPROVAL_ALREADY_ISSUED_FOR_CAPABILITY"],
+                            riskScore: 0.99,
+                            safeConstraints: {},
+                            telemetryTags: ["approval_v6_issue", "block"]
+                        }, "secure_v6"),
+                        approvalEnvelope: activeApproval
                     });
                     return;
                 }
-                const approvalGrant = issueApprovalGrant(payload, sessionState);
-                sessionState.approvalGrants.set(approvalGrant.approvalGrantId, approvalGrant);
+                const brokerPayload = sessionState && capability
+                    ? createApprovalIntentPayloadV5({
+                        sessionId: sessionState.session.sessionId,
+                        workflowHash: sessionState.session.workflowHash,
+                        capabilityId: capability.capabilityId,
+                        capabilityDigest: capability.capabilityDigest,
+                        expiresInSeconds: payload.expiresInSeconds
+                    })
+                    : "";
+                const brokerSignatureVerified = verifyApprovalIntentSignatureV5(brokerPayload, payload.brokerSignature, runtime.approvalBrokerPublicKey);
+                const issued = issueApprovalEnvelopeV5({
+                    session: sessionState?.session,
+                    capability,
+                    brokerSignature: payload.brokerSignature,
+                    brokerSignatureVerified,
+                    expiresInSeconds: payload.expiresInSeconds
+                });
+                if (issued.approvalEnvelope && sessionState) {
+                    sessionState.approvalEnvelopesV5.set(issued.approvalEnvelope.approvalId, issued.approvalEnvelope);
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        capabilityId: payload.capabilityId,
+                        verdict: issued.verdict.decision
+                    }
+                });
                 writeJson(response, 200, {
-                    approvalGrant
+                    ...issued,
+                    verdict: relabelClaimProfile(issued.verdict, "secure_v6")
                 });
                 return;
             }
-            if (request.url === "/v4/tool/prepare") {
+            if (request.url === "/v6/tool/prepare" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/tool/prepare")) {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
-                const prepared = prepareToolOnboardingV4({
-                    ...payload.request,
-                    approvalGrantId: payload.approvalGrantId
-                }, sessionState?.session, approvalGrant, runtime);
-                const onboardingSession = prepared.verdict.decision === "ALLOW" && payload.request.authType === "oauth" && approvalGrant
-                    ? createOnboardingSession(payload.request, runtime, approvalGrant, prepared.verifiedRegistryEntry)
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(payload.approvalId);
+                const capability = approvalEnvelope
+                    ? getCapabilityV5(sessionState, approvalEnvelope.capabilityId)
                     : undefined;
-                if (sessionState && onboardingSession) {
-                    sessionState.onboardingSessions.set(onboardingSession.sessionId, onboardingSession);
+                const verifiedEntry = approvalEnvelope
+                    ? lookupVerifiedRegistryEntry(runtime, approvalEnvelope.connectorId, approvalEnvelope.registryEntryId)
+                    : undefined;
+                const prepared = prepareToolOnboardingV5({
+                    session: sessionState?.session,
+                    capability,
+                    approvalEnvelope,
+                    verifiedRegistryEntry: verifiedEntry
+                });
+                if (sessionState && prepared.onboardingSession) {
+                    const consumedAt = new Date().toISOString();
+                    if (capability) {
+                        consumeCapabilityV5(sessionState, capability, consumedAt);
+                    }
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopesV5.set(payload.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt,
+                            onboardingSessionId: prepared.onboardingSession.onboardingSessionId
+                        });
+                    }
+                    sessionState.onboardingSessionsV5.set(prepared.onboardingSession.onboardingSessionId, prepared.onboardingSession);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
                 }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        approvalId: payload.approvalId,
+                        verdict: prepared.verdict.decision
+                    }
+                });
                 writeJson(response, 200, {
-                    verdict: prepared.verdict,
-                    approvalVerdict: prepared.approvalVerdict,
-                    verifiedRegistryEntry: prepared.verifiedRegistryEntry,
-                    workflowBinding: prepared.workflowBinding,
-                    onboardingSession
+                    verdict: relabelClaimProfile(prepared.verdict, "secure_v6"),
+                    approvalEnvelope: sessionState?.approvalEnvelopesV5.get(payload.approvalId) ?? approvalEnvelope,
+                    verifiedRegistryEntry: verifiedEntry,
+                    onboardingSession: prepared.onboardingSession
                 });
                 return;
             }
-            if (request.url === "/v4/tool/callback/verify") {
+            if (request.url === "/v6/tool/callback/verify" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/tool/callback/verify")) {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
-                const session = sessionState?.onboardingSessions.get(payload.request.sessionId);
-                const result = verifyToolCallbackV4(payload.request, sessionState?.session, session, approvalGrant, runtime);
-                if (sessionState && session) {
-                    sessionState.onboardingSessions.set(payload.request.sessionId, {
-                        ...session,
-                        status: result.verdict.decision === "ALLOW" ? "used" : session.status
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(payload.approvalId);
+                const capability = approvalEnvelope
+                    ? getCapabilityV5(sessionState, approvalEnvelope.capabilityId)
+                    : undefined;
+                const onboardingSession = sessionState?.onboardingSessionsV5.get(payload.onboardingSessionId);
+                const verifiedEntry = approvalEnvelope
+                    ? lookupVerifiedRegistryEntry(runtime, approvalEnvelope.connectorId, approvalEnvelope.registryEntryId)
+                    : undefined;
+                const verified = verifyToolCallbackV5({
+                    session: sessionState?.session,
+                    capability,
+                    approvalEnvelope,
+                    onboardingSession,
+                    verifiedRegistryEntry: verifiedEntry,
+                    request: payload.request
+                });
+                if (sessionState && onboardingSession && verified.verdict.decision === "ALLOW") {
+                    sessionState.onboardingSessionsV5.set(payload.onboardingSessionId, {
+                        ...onboardingSession,
+                        status: "used"
                     });
                 }
-                writeJson(response, 200, result);
+                if (sessionState && verified.connectorHandle) {
+                    sessionState.connectorHandlesV5.set(verified.connectorHandle.handleId, verified.connectorHandle);
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        onboardingSessionId: payload.onboardingSessionId,
+                        verdict: verified.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...verified,
+                    verdict: relabelClaimProfile(verified.verdict, "secure_v6")
+                });
                 return;
             }
-            if (request.url === "/v4/artifact/ingest") {
+            if (request.url === "/v6/artifact/ingest") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 if (!sessionState) {
@@ -552,72 +1124,1139 @@ export async function createSafeBrowseServer(options = {}) {
                     sessionId: payload.sessionId,
                     taskId: sessionState.session.taskId
                 };
-                const observation = await compileObservationInIsolation({
+                const observationResult = await parserIsolationService.compileObservation({
                     capture,
                     workflowHash: sessionState.session.workflowHash,
-                    allowlistedEgress: runtime.parserAllowlistedEgress,
-                    runtime: {
-                        knowledgeBase: runtime.knowledgeBase
-                    }
+                    compilerVersion: "v5"
                 });
-                const failClosedArtifact = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "artifact");
-                const legacyArtifact = buildLegacyObservationCapture(capture);
-                const artifactResult = legacyArtifact !== undefined ? brokerArtifact(legacyArtifact, runtime) : undefined;
-                sessionState.latestObservation = observation.compiledObservation;
-                const effectiveArtifactVerdict = failClosedArtifact.failClosed
-                    ? failClosedArtifact.verdict
-                    : artifactResult?.verdict;
-                const effectiveArtifact = failClosedArtifact.failClosed && artifactResult?.artifact
+                const compiledObservation = observationResult.compiledObservation;
+                const plannerView = observationResult.plannerView;
+                const artifactCapture = buildLegacyObservationCapture(capture);
+                const brokeredArtifact = artifactCapture
+                    ? brokerArtifact(artifactCapture, runtime)
+                    : brokerArtifact({
+                        mimeType: "application/octet-stream",
+                        surfaceKind: "document",
+                        sourceOrigin: capture.url,
+                        viewerOrigin: capture.frameUrl ?? capture.url,
+                        extractionMethod: "download",
+                        trustSignals: capture.trustSignals
+                    }, runtime);
+                const authorityEligible = compiledObservation.parseStatus === "compiled" &&
+                    compiledObservation.authorityEligible &&
+                    !brokeredArtifact.artifact.mismatchSignals.length &&
+                    !brokeredArtifact.artifact.metadataSignals.length;
+                const artifactVerdict = relabelClaimProfile(authorityEligible
                     ? {
-                        ...artifactResult.artifact,
-                        toolActivationPolicy: "block",
-                        approvalRequiredForFollowOn: true
+                        decision: "ALLOW",
+                        reasonCodes: [],
+                        riskScore: Math.max(compiledObservation.riskScore, brokeredArtifact.verdict.riskScore),
+                        safeConstraints: {
+                            authority_eligible: true,
+                            handoff_mode: "artifact_reference"
+                        },
+                        telemetryTags: ["artifact_v6", "allow"]
                     }
-                    : artifactResult?.artifact;
-                const plannerInput = shouldReduceAuthority(sessionState, observation.compiledObservation)
-                    ? applyAuthorityReduction(sessionState, observation.compiledObservation, failClosedArtifact.plannerInput)
-                    : failClosedArtifact.plannerInput;
+                    : {
+                        decision: brokeredArtifact.verdict.decision === "QUARANTINE_ARTIFACT" ||
+                            brokeredArtifact.artifact.mismatchSignals.length > 0 ||
+                            brokeredArtifact.artifact.metadataSignals.length > 0
+                            ? "QUARANTINE_ARTIFACT"
+                            : "BLOCK",
+                        reasonCodes: [...new Set([
+                                ...(compiledObservation.parseStatus === "compiled"
+                                    ? ["ARTIFACT_NOT_AUTHORITY_ELIGIBLE"]
+                                    : [
+                                        compiledObservation.parseStatus === "partial"
+                                            ? "PARSE_STATUS_PARTIAL"
+                                            : "PARSE_STATUS_UNSUPPORTED"
+                                    ]),
+                                ...brokeredArtifact.verdict.reasonCodes
+                            ])],
+                        riskScore: Math.max(0.95, brokeredArtifact.verdict.riskScore),
+                        safeConstraints: {
+                            authority_eligible: false,
+                            handoff_mode: "artifact_reference"
+                        },
+                        telemetryTags: ["artifact_v6", "quarantine"]
+                    }, "secure_v6");
+                sessionState.latestObservationV5 = compiledObservation;
+                sessionState.observationsV5.set(compiledObservation.observationId, compiledObservation);
+                const replayEvent = appendReplayEvent(sessionState, {
+                    kind: "artifact",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        artifactId: brokeredArtifact.artifact.artifactId,
+                        surfaceKind: brokeredArtifact.artifact.surfaceKind,
+                        verdict: artifactVerdict.decision
+                    }
+                });
                 writeJson(response, 200, {
-                    compiledObservation: observation.compiledObservation,
-                    plannerInput,
-                    artifactVerdict: effectiveArtifactVerdict,
-                    artifact: effectiveArtifact
+                    compiledObservation,
+                    plannerView,
+                    artifactRef: buildV6ArtifactRef(brokeredArtifact.artifact, authorityEligible),
+                    mismatchSignals: brokeredArtifact.artifact.mismatchSignals,
+                    artifactVerdict,
+                    replayEventId: replayEvent.eventId
                 });
                 return;
             }
-            if (request.url === "/v4/memory/write") {
+            if (request.url === "/v6/memory/stage" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/memory/stage")) {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const result = evaluateMemoryWriteV4(payload, sessionState?.session, runtime);
+                const result = stageMemoryRecordV6(payload, sessionState?.session);
+                let promotionTicket;
                 if (sessionState && result.record) {
                     sessionState.memoryRecords.set(result.record.recordId, result.record);
+                    sessionState.memorySourceClassesV6.set(result.record.recordId, payload.sourceClass);
+                    if (result.record.tier === "candidate_durable") {
+                        const capability = mintMemoryPromotionCapabilityV5(sessionState.session, {
+                            recordId: result.record.recordId,
+                            sourceDigest: result.record.sourceDigest,
+                            sourceObservationId: result.record.sourceObservationId,
+                            key: result.record.key,
+                            valueDigest: result.record.sourceDigest ?? hashValue(result.record.value)
+                        });
+                        sessionState.capabilitiesV5.set(capability.capabilityId, capability);
+                        promotionTicket = {
+                            ticketId: capability.capabilityId,
+                            ticketDigest: capability.capabilityDigest,
+                            semanticDigest: capability.semanticDigest,
+                            recordId: result.record.recordId,
+                            sourceClass: payload.sourceClass,
+                            expiresAt: capability.expiresAt
+                        };
+                    }
                 }
-                writeJson(response, 200, result);
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        recordId: result.record?.recordId ?? null,
+                        sourceClass: payload.sourceClass,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v6"),
+                    promotionTicket
+                });
                 return;
             }
-            if (request.url === "/v4/memory/promote") {
+            if (request.url === "/v6/memory/promote" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/memory/promote")) {
                 const payload = await readJson(request);
-                const sessionState = findSessionState(sessions, payload.sessionId);
-                const record = sessionState?.memoryRecords.get(payload.recordId);
-                const approvalGrant = payload.approvalGrantId && sessionState
-                    ? sessionState.approvalGrants.get(payload.approvalGrantId)
-                    : undefined;
-                const result = promoteMemoryRecordV4(payload, sessionState?.session, record, approvalGrant);
+                const normalizedPayload = {
+                    ...payload,
+                    ticketId: payload.ticketId ?? payload.capabilityId ?? "",
+                    ticketDigest: payload.ticketDigest ?? payload.capabilityDigest ?? ""
+                };
+                const sessionState = findSessionState(sessions, normalizedPayload.sessionId);
+                const record = sessionState?.memoryRecords.get(normalizedPayload.recordId);
+                const capability = sessionState?.capabilitiesV5.get(normalizedPayload.ticketId);
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(normalizedPayload.approvalId);
+                const snapshotState = sessionState && record ? buildMemorySnapshotState(sessionState, record) : undefined;
+                const result = promoteMemoryRecordV6(normalizedPayload, sessionState?.session, record, capability, approvalEnvelope, {
+                    sourceClass: record ? sessionState?.memorySourceClassesV6.get(record.recordId) : undefined,
+                    priorTrustedRecord: snapshotState?.snapshotRecord
+                });
                 if (sessionState && result.promotedRecord) {
-                    if (record && result.promotedRecord.snapshotId) {
+                    if (snapshotState && result.promotedRecord.snapshotId) {
                         sessionState.memorySnapshots.set(result.promotedRecord.snapshotId, {
-                            ...record,
-                            tier: "trusted_durable",
-                            summaryOnly: false,
-                            snapshotId: result.promotedRecord.snapshotId,
-                            rollbackPointId: result.promotedRecord.rollbackPointId
+                            ...snapshotState,
+                            snapshotId: result.promotedRecord.snapshotId
                         });
                     }
                     sessionState.memoryRecords.set(result.promotedRecord.recordId, result.promotedRecord);
+                    if (capability) {
+                        consumeCapabilityV5(sessionState, capability);
+                    }
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopesV5.set(payload.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt: new Date().toISOString()
+                        });
+                    }
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
                 }
-                writeJson(response, 200, result);
-                return;
-            }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        recordId: normalizedPayload.recordId,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v6"),
+                    approvalEnvelope: normalizedPayload.approvalId && sessionState
+                        ? sessionState.approvalEnvelopesV5.get(normalizedPayload.approvalId)
+                        : approvalEnvelope
+                });
+                return;
+            }
+            if (request.url === "/v6/memory/rollback" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/memory/rollback")) {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const record = sessionState?.memoryRecords.get(payload.recordId);
+                const snapshotState = sessionState?.memorySnapshots.get(payload.snapshotId);
+                const result = rollbackMemoryRecordV5(payload, sessionState?.session, record, {
+                    snapshotRecord: snapshotState?.snapshotRecord,
+                    baselineAbsent: snapshotState?.baselineAbsent
+                });
+                if (sessionState && result.verdict.decision === "ALLOW") {
+                    if (result.restoredRecord) {
+                        sessionState.memoryRecords.set(result.restoredRecord.recordId, result.restoredRecord);
+                    }
+                    else {
+                        sessionState.memoryRecords.delete(payload.recordId);
+                    }
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: canonicalReplayRoute(request.url),
+                        recordId: payload.recordId,
+                        snapshotId: payload.snapshotId,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v6"),
+                    rollbackEvent: result.verdict.decision === "ALLOW"
+                        ? {
+                            recordId: payload.recordId,
+                            snapshotId: payload.snapshotId,
+                            appliedAt: new Date().toISOString()
+                        }
+                        : undefined
+                });
+                return;
+            }
+            if (request.url === "/v6/replay/bundle" ||
+                (unifiedV5InSecureV6 && request.url === "/v5/replay/bundle")) {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                writeJson(response, 200, buildReplayBundle(sessionState.replayEvents, runtime));
+                return;
+            }
+            if (request.url === "/v5/session/start") {
+                const payload = await readJson(request);
+                const sessionState = createSessionState(payload, runtime);
+                sessions.set(sessionState.session.sessionId, sessionState);
+                appendReplayEvent(sessionState, {
+                    kind: "verdict",
+                    actor: "system",
+                    payload: {
+                        route: request.url,
+                        sessionId: sessionState.session.sessionId,
+                        claimProfile: sessionState.session.claimProfile ?? "secure_v5"
+                    }
+                });
+                writeJson(response, 200, {
+                    session: sessionState.session
+                });
+                return;
+            }
+            if (request.url === "/v5/observe") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const capture = {
+                    ...payload.capture,
+                    sessionId: payload.sessionId,
+                    taskId: sessionState.session.taskId
+                };
+                const observationResult = await parserIsolationService.compileObservation({
+                    capture,
+                    workflowHash: sessionState.session.workflowHash,
+                    compilerVersion: "v5"
+                });
+                const compiledObservation = observationResult.compiledObservation;
+                const plannerView = observationResult.plannerView;
+                const mediated = applyV5ObservationMediation(compiledObservation, plannerView);
+                const verifiedEntry = capture.surfaceType === "tool_manifest"
+                    ? resolveToolManifestRegistryEntry(runtime, capture)
+                    : undefined;
+                const manifestHash = observationResult.toolManifestDigests?.manifestHash;
+                const schemaHash = observationResult.toolManifestDigests?.schemaHash;
+                retireObservationCapabilitiesV5(sessionState);
+                const capabilities = mediated.failClosed
+                    ? []
+                    : mintCapabilitiesForObservationV5(sessionState.session, compiledObservation, mediated.plannerView, {
+                        verifiedRegistryEntry: verifiedEntry,
+                        registryEntryId: capture.surfaceType === "tool_manifest" ? verifiedEntry?.registryEntryId : undefined,
+                        connectorId: capture.surfaceType === "tool_manifest" ? verifiedEntry?.adapterId ?? capture.toolId : undefined,
+                        requestedScopes: capture.surfaceType === "tool_manifest" ? capture.requestedScopes : undefined,
+                        callbackUri: capture.surfaceType === "tool_manifest" ? capture.callbackUri : undefined,
+                        callbackOrigin: capture.surfaceType === "tool_manifest" ? capture.callbackOrigin : undefined,
+                        manifestAuthType: capture.surfaceType === "tool_manifest" ? capture.authType : undefined,
+                        manifestHash,
+                        schemaHash
+                    });
+                sessionState.latestObservationV5 = compiledObservation;
+                sessionState.observationsV5.set(compiledObservation.observationId, compiledObservation);
+                for (const capability of capabilities) {
+                    sessionState.capabilitiesV5.set(capability.capabilityId, capability);
+                }
+                const artifactCapture = buildLegacyObservationCapture(capture);
+                const artifactRefs = artifactCapture
+                    ? [
+                        buildV5ArtifactRef(brokerArtifact(artifactCapture, runtime).artifact, compiledObservation.authorityEligible)
+                    ]
+                    : [];
+                const observationVerdict = relabelClaimProfile(buildV5ObservationDecision(compiledObservation), "secure_v5");
+                const replayEvent = appendReplayEvent(sessionState, {
+                    kind: "observation",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        observationId: compiledObservation.observationId,
+                        surfaceType: compiledObservation.surfaceType,
+                        authorityEligible: compiledObservation.authorityEligible,
+                        authorityCandidateCount: capabilities.length,
+                        verdict: observationVerdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    compiledObservation,
+                    plannerView: mediated.plannerView,
+                    capabilities: capabilities.map(summarizeCapabilityV5),
+                    authorityCandidates: capabilities.map(summarizeAuthorityCandidate),
+                    artifactRefs,
+                    observationVerdict,
+                    replayEventId: replayEvent.eventId
+                });
+                return;
+            }
+            if (request.url === "/v5/action/evaluate") {
+                const payload = await readJson(request);
+                const authorityId = payload.authorityId ?? payload.capabilityId;
+                const authorityDigest = payload.authorityDigest ?? payload.capabilityDigest;
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const capability = authorityId ? getCapabilityV5(sessionState, authorityId) : undefined;
+                const authorityDecision = relabelClaimProfile(evaluateCapabilityUseV5({
+                    sessionId: payload.sessionId,
+                    capabilityId: authorityId ?? "",
+                    capabilityDigest: authorityDigest ?? "",
+                    parameters: payload.parameters
+                }, sessionState?.session, capability, {
+                    alreadyUsed: authorityId
+                        ? (sessionState?.usedCapabilitiesV5.has(authorityId) ?? false)
+                        : false
+                }), "secure_v5");
+                const observationDecision = buildObservationDecisionForClaimProfile(sessionState?.latestObservationV5, "secure_v5");
+                const effectDecision = observationDecision.decision === "ALLOW" && authorityDecision.decision === "ALLOW"
+                    ? authorityDecision
+                    : relabelClaimProfile({
+                        decision: "BLOCK",
+                        reasonCodes: [
+                            ...new Set([
+                                ...(observationDecision.decision === "ALLOW"
+                                    ? []
+                                    : ["OBSERVATION_NOT_EFFECT_ELIGIBLE"]),
+                                ...(authorityDecision.decision === "ALLOW"
+                                    ? []
+                                    : authorityDecision.reasonCodes)
+                            ])
+                        ],
+                        riskScore: Math.max(observationDecision.riskScore, authorityDecision.riskScore),
+                        safeConstraints: {
+                            target_class: capability?.targetClass ?? "unknown"
+                        },
+                        telemetryTags: ["v5_action", "block"]
+                    }, "secure_v5");
+                if (effectDecision.decision === "ALLOW" && sessionState && capability) {
+                    consumeCapabilityV5(sessionState, capability);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "action",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        authorityId: authorityId ?? null,
+                        observationDecision: observationDecision.decision,
+                        authorityDecision: authorityDecision.decision,
+                        effectDecision: effectDecision.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    observationDecision,
+                    authorityDecision,
+                    effectDecision,
+                    verdict: effectDecision,
+                    executionPlan: buildV5ExecutionPlan(capability)
+                });
+                return;
+            }
+            if (request.url === "/v5/capability/use") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const capability = getCapabilityV5(sessionState, payload.capabilityId);
+                const verdict = evaluateCapabilityUseV5(payload, sessionState?.session, capability, {
+                    alreadyUsed: sessionState?.usedCapabilitiesV5.has(payload.capabilityId) ?? false
+                });
+                if (verdict.decision === "ALLOW" && sessionState && capability) {
+                    consumeCapabilityV5(sessionState, capability);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "action",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        authorityId: payload.capabilityId,
+                        observationDecision: buildObservationDecisionForClaimProfile(sessionState?.latestObservationV5, "secure_v5").decision,
+                        authorityDecision: verdict.decision,
+                        effectDecision: verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    verdict: relabelClaimProfile(verdict, "secure_v5"),
+                    executionPlan: buildV5ExecutionPlan(capability)
+                });
+                return;
+            }
+            if (request.url === "/v5/approval/issue") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const capability = sessionState?.capabilitiesV5.get(payload.capabilityId);
+                if (sessionState?.usedCapabilitiesV5.has(payload.capabilityId)) {
+                    writeJson(response, 200, {
+                        verdict: {
+                            decision: "BLOCK",
+                            reasonCodes: ["CAPABILITY_REPLAYED"],
+                            riskScore: 0.99,
+                            safeConstraints: {
+                                claim_profile: "secure_v5"
+                            },
+                            telemetryTags: ["approval_v5_issue", "block"]
+                        }
+                    });
+                    return;
+                }
+                if (capability && payload.capabilityDigest !== capability.capabilityDigest) {
+                    writeJson(response, 200, {
+                        verdict: {
+                            decision: "BLOCK",
+                            reasonCodes: ["CAPABILITY_DIGEST_MISMATCH"],
+                            riskScore: 0.99,
+                            safeConstraints: {
+                                claim_profile: "secure_v5"
+                            },
+                            telemetryTags: ["approval_v5_issue", "block"]
+                        }
+                    });
+                    return;
+                }
+                const activeApproval = getActiveApprovalEnvelopeForCapability(sessionState, payload.capabilityId);
+                if (activeApproval) {
+                    writeJson(response, 200, {
+                        verdict: {
+                            decision: "BLOCK",
+                            reasonCodes: ["APPROVAL_ALREADY_ISSUED_FOR_CAPABILITY"],
+                            riskScore: 0.99,
+                            safeConstraints: {
+                                claim_profile: "secure_v5"
+                            },
+                            telemetryTags: ["approval_v5_issue", "block"]
+                        },
+                        approvalEnvelope: activeApproval
+                    });
+                    return;
+                }
+                const brokerPayload = sessionState && capability
+                    ? createApprovalIntentPayloadV5({
+                        sessionId: sessionState.session.sessionId,
+                        workflowHash: sessionState.session.workflowHash,
+                        capabilityId: capability.capabilityId,
+                        capabilityDigest: capability.capabilityDigest,
+                        expiresInSeconds: payload.expiresInSeconds
+                    })
+                    : "";
+                const brokerSignatureVerified = verifyApprovalIntentSignatureV5(brokerPayload, payload.brokerSignature, runtime.approvalBrokerPublicKey);
+                const issued = issueApprovalEnvelopeV5({
+                    session: sessionState?.session,
+                    capability,
+                    brokerSignature: payload.brokerSignature,
+                    brokerSignatureVerified,
+                    expiresInSeconds: payload.expiresInSeconds
+                });
+                if (issued.approvalEnvelope && sessionState) {
+                    sessionState.approvalEnvelopesV5.set(issued.approvalEnvelope.approvalId, issued.approvalEnvelope);
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        capabilityId: payload.capabilityId,
+                        verdict: issued.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...issued,
+                    verdict: relabelClaimProfile(issued.verdict, "secure_v5")
+                });
+                return;
+            }
+            if (request.url === "/v5/tool/prepare") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(payload.approvalId);
+                const capability = approvalEnvelope
+                    ? getCapabilityV5(sessionState, approvalEnvelope.capabilityId)
+                    : undefined;
+                const verifiedEntry = approvalEnvelope
+                    ? lookupVerifiedRegistryEntry(runtime, approvalEnvelope.connectorId, approvalEnvelope.registryEntryId)
+                    : undefined;
+                const prepared = prepareToolOnboardingV5({
+                    session: sessionState?.session,
+                    capability,
+                    approvalEnvelope,
+                    verifiedRegistryEntry: verifiedEntry
+                });
+                if (sessionState && prepared.onboardingSession) {
+                    const consumedAt = new Date().toISOString();
+                    if (capability) {
+                        consumeCapabilityV5(sessionState, capability, consumedAt);
+                    }
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopesV5.set(payload.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt,
+                            onboardingSessionId: prepared.onboardingSession.onboardingSessionId
+                        });
+                    }
+                    sessionState.onboardingSessionsV5.set(prepared.onboardingSession.onboardingSessionId, prepared.onboardingSession);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        approvalId: payload.approvalId,
+                        verdict: prepared.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    verdict: relabelClaimProfile(prepared.verdict, "secure_v5"),
+                    approvalEnvelope: sessionState?.approvalEnvelopesV5.get(payload.approvalId) ?? approvalEnvelope,
+                    verifiedRegistryEntry: verifiedEntry,
+                    onboardingSession: prepared.onboardingSession
+                });
+                return;
+            }
+            if (request.url === "/v5/tool/callback/verify") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(payload.approvalId);
+                const capability = approvalEnvelope
+                    ? getCapabilityV5(sessionState, approvalEnvelope.capabilityId)
+                    : undefined;
+                const onboardingSession = sessionState?.onboardingSessionsV5.get(payload.onboardingSessionId);
+                const verifiedEntry = approvalEnvelope
+                    ? lookupVerifiedRegistryEntry(runtime, approvalEnvelope.connectorId, approvalEnvelope.registryEntryId)
+                    : undefined;
+                const verified = verifyToolCallbackV5({
+                    session: sessionState?.session,
+                    capability,
+                    approvalEnvelope,
+                    onboardingSession,
+                    verifiedRegistryEntry: verifiedEntry,
+                    request: payload.request
+                });
+                if (sessionState && onboardingSession && verified.verdict.decision === "ALLOW") {
+                    sessionState.onboardingSessionsV5.set(payload.onboardingSessionId, {
+                        ...onboardingSession,
+                        status: "used"
+                    });
+                }
+                if (sessionState && verified.connectorHandle) {
+                    sessionState.connectorHandlesV5.set(verified.connectorHandle.handleId, verified.connectorHandle);
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        onboardingSessionId: payload.onboardingSessionId,
+                        verdict: verified.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...verified,
+                    verdict: relabelClaimProfile(verified.verdict, "secure_v5")
+                });
+                return;
+            }
+            if (request.url === "/v5/artifact/ingest") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const capture = {
+                    ...payload.capture,
+                    sessionId: payload.sessionId,
+                    taskId: sessionState.session.taskId
+                };
+                const observationResult = await parserIsolationService.compileObservation({
+                    capture,
+                    workflowHash: sessionState.session.workflowHash,
+                    compilerVersion: "v5"
+                });
+                const compiledObservation = observationResult.compiledObservation;
+                const plannerView = observationResult.plannerView;
+                const artifactCapture = buildLegacyObservationCapture(capture);
+                const brokeredArtifact = artifactCapture
+                    ? brokerArtifact(artifactCapture, runtime)
+                    : brokerArtifact({
+                        mimeType: "application/octet-stream",
+                        surfaceKind: "document",
+                        sourceOrigin: capture.url,
+                        viewerOrigin: capture.frameUrl ?? capture.url,
+                        extractionMethod: "download",
+                        trustSignals: capture.trustSignals
+                    }, runtime);
+                const artifactAuthoritative = compiledObservation.parseStatus === "compiled" &&
+                    compiledObservation.authorityEligible &&
+                    !brokeredArtifact.artifact.mismatchSignals.length &&
+                    !brokeredArtifact.artifact.metadataSignals.length;
+                const artifactVerdict = relabelClaimProfile(artifactAuthoritative
+                    ? {
+                        decision: "ALLOW",
+                        reasonCodes: [],
+                        riskScore: Math.max(compiledObservation.riskScore, brokeredArtifact.verdict.riskScore),
+                        safeConstraints: {
+                            authority_eligible: true,
+                            handoff_mode: "artifact_reference"
+                        },
+                        telemetryTags: ["artifact_v5", "allow"]
+                    }
+                    : {
+                        decision: brokeredArtifact.verdict.decision === "QUARANTINE_ARTIFACT" ||
+                            brokeredArtifact.artifact.mismatchSignals.length > 0 ||
+                            brokeredArtifact.artifact.metadataSignals.length > 0
+                            ? "QUARANTINE_ARTIFACT"
+                            : "BLOCK",
+                        reasonCodes: [...new Set([
+                                ...(compiledObservation.parseStatus === "compiled"
+                                    ? ["ARTIFACT_NOT_AUTHORITY_ELIGIBLE"]
+                                    : [
+                                        compiledObservation.parseStatus === "partial"
+                                            ? "PARSE_STATUS_PARTIAL"
+                                            : "PARSE_STATUS_UNSUPPORTED"
+                                    ]),
+                                ...brokeredArtifact.verdict.reasonCodes
+                            ])],
+                        riskScore: Math.max(0.95, brokeredArtifact.verdict.riskScore),
+                        safeConstraints: {
+                            authority_eligible: false,
+                            handoff_mode: "artifact_reference"
+                        },
+                        telemetryTags: ["artifact_v5", "quarantine"]
+                    }, "secure_v5");
+                sessionState.latestObservationV5 = compiledObservation;
+                sessionState.observationsV5.set(compiledObservation.observationId, compiledObservation);
+                const replayEvent = appendReplayEvent(sessionState, {
+                    kind: "artifact",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        artifactId: brokeredArtifact?.artifact.artifactId ?? null,
+                        surfaceKind: brokeredArtifact?.artifact.surfaceKind ?? capture.surfaceType,
+                        verdict: artifactVerdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    compiledObservation,
+                    plannerView,
+                    artifactVerdict,
+                    artifactRef: buildV5ArtifactRef(brokeredArtifact.artifact, artifactAuthoritative),
+                    mismatchSignals: brokeredArtifact.artifact.mismatchSignals,
+                    metadataSignals: brokeredArtifact.artifact.metadataSignals,
+                    replayEventId: replayEvent.eventId
+                });
+                return;
+            }
+            if (request.url === "/v5/memory/stage") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const result = stageMemoryRecordV5(payload, sessionState?.session);
+                let promotionCapability;
+                let promotionTicket;
+                if (sessionState && result.record) {
+                    sessionState.memoryRecords.set(result.record.recordId, result.record);
+                    sessionState.memorySourceClassesV5.set(result.record.recordId, payload.sourceClass);
+                    if (result.record.tier === "candidate_durable") {
+                        promotionCapability = mintMemoryPromotionCapabilityV5(sessionState.session, {
+                            recordId: result.record.recordId,
+                            sourceDigest: result.record.sourceDigest,
+                            sourceObservationId: result.record.sourceObservationId,
+                            key: result.record.key,
+                            valueDigest: result.record.sourceDigest ?? hashValue(result.record.value)
+                        });
+                        sessionState.capabilitiesV5.set(promotionCapability.capabilityId, promotionCapability);
+                        promotionTicket = {
+                            ticketId: promotionCapability.capabilityId,
+                            ticketDigest: promotionCapability.capabilityDigest,
+                            semanticDigest: promotionCapability.semanticDigest,
+                            recordId: result.record.recordId,
+                            sourceClass: payload.sourceClass,
+                            expiresAt: promotionCapability.expiresAt
+                        };
+                    }
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        recordId: result.record?.recordId ?? null,
+                        sourceClass: payload.sourceClass,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v5"),
+                    record: result.record
+                        ? {
+                            ...result.record,
+                            sourceClass: payload.sourceClass
+                        }
+                        : undefined,
+                    promotionCapability: promotionCapability
+                        ? {
+                            capabilityId: promotionCapability.capabilityId,
+                            capabilityDigest: promotionCapability.capabilityDigest,
+                            semanticDigest: promotionCapability.semanticDigest,
+                            title: promotionCapability.title,
+                            kind: promotionCapability.kind,
+                            expiresAt: promotionCapability.expiresAt
+                        }
+                        : undefined,
+                    promotionTicket
+                });
+                return;
+            }
+            if (request.url === "/v5/memory/write") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const result = evaluateMemoryWriteV5(payload, sessionState?.session);
+                let promotionCapability;
+                if (sessionState && result.record) {
+                    sessionState.memoryRecords.set(result.record.recordId, result.record);
+                    sessionState.memorySourceClassesV5.set(result.record.recordId, "user_note");
+                    if (result.record.tier === "candidate_durable") {
+                        promotionCapability = mintMemoryPromotionCapabilityV5(sessionState.session, {
+                            recordId: result.record.recordId,
+                            sourceDigest: result.record.sourceDigest,
+                            sourceObservationId: result.record.sourceObservationId,
+                            key: result.record.key,
+                            valueDigest: result.record.sourceDigest ?? hashValue(result.record.value)
+                        });
+                        sessionState.capabilitiesV5.set(promotionCapability.capabilityId, promotionCapability);
+                    }
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        recordId: result.record?.recordId ?? null,
+                        sourceClass: "user_note",
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v5"),
+                    promotionCapability: promotionCapability
+                        ? {
+                            capabilityId: promotionCapability.capabilityId,
+                            capabilityDigest: promotionCapability.capabilityDigest,
+                            semanticDigest: promotionCapability.semanticDigest,
+                            title: promotionCapability.title,
+                            kind: promotionCapability.kind,
+                            expiresAt: promotionCapability.expiresAt
+                        }
+                        : undefined,
+                    promotionTicket: promotionCapability
+                        ? {
+                            ticketId: promotionCapability.capabilityId,
+                            ticketDigest: promotionCapability.capabilityDigest,
+                            semanticDigest: promotionCapability.semanticDigest,
+                            recordId: result.record?.recordId,
+                            sourceClass: "user_note",
+                            expiresAt: promotionCapability.expiresAt
+                        }
+                        : undefined
+                });
+                return;
+            }
+            if (request.url === "/v5/memory/promote") {
+                const payload = await readJson(request);
+                const normalizedPayload = {
+                    ...payload,
+                    ticketId: payload.ticketId ?? payload.capabilityId ?? "",
+                    ticketDigest: payload.ticketDigest ?? payload.capabilityDigest ?? ""
+                };
+                const sessionState = findSessionState(sessions, normalizedPayload.sessionId);
+                const record = sessionState?.memoryRecords.get(normalizedPayload.recordId);
+                const capability = sessionState?.capabilitiesV5.get(normalizedPayload.ticketId);
+                const approvalEnvelope = sessionState?.approvalEnvelopesV5.get(normalizedPayload.approvalId);
+                const snapshotState = sessionState && record ? buildMemorySnapshotState(sessionState, record) : undefined;
+                const result = promoteStagedMemoryRecordV5(normalizedPayload, sessionState?.session, record, capability, approvalEnvelope, {
+                    sourceClass: record
+                        ? (sessionState?.memorySourceClassesV5.get(record.recordId) ?? "user_note")
+                        : undefined,
+                    priorTrustedRecord: snapshotState?.snapshotRecord
+                });
+                if (sessionState && result.promotedRecord) {
+                    if (snapshotState && result.promotedRecord.snapshotId) {
+                        sessionState.memorySnapshots.set(result.promotedRecord.snapshotId, {
+                            ...snapshotState,
+                            snapshotId: result.promotedRecord.snapshotId
+                        });
+                    }
+                    sessionState.memoryRecords.set(result.promotedRecord.recordId, result.promotedRecord);
+                    if (capability) {
+                        consumeCapabilityV5(sessionState, capability);
+                    }
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopesV5.set(normalizedPayload.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt: new Date().toISOString()
+                        });
+                    }
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        recordId: normalizedPayload.recordId,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v5"),
+                    approvalEnvelope: normalizedPayload.approvalId && sessionState
+                        ? sessionState.approvalEnvelopesV5.get(normalizedPayload.approvalId)
+                        : approvalEnvelope
+                });
+                return;
+            }
+            if (request.url === "/v5/memory/rollback") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const record = sessionState?.memoryRecords.get(payload.recordId);
+                const snapshotState = sessionState?.memorySnapshots.get(payload.snapshotId);
+                const result = rollbackMemoryRecordV5(payload, sessionState?.session, record, {
+                    snapshotRecord: snapshotState?.snapshotRecord,
+                    baselineAbsent: snapshotState?.baselineAbsent
+                });
+                if (sessionState && result.verdict.decision === "ALLOW") {
+                    if (result.restoredRecord) {
+                        sessionState.memoryRecords.set(result.restoredRecord.recordId, result.restoredRecord);
+                    }
+                    else {
+                        sessionState.memoryRecords.delete(payload.recordId);
+                    }
+                }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: request.url,
+                        recordId: payload.recordId,
+                        snapshotId: payload.snapshotId,
+                        verdict: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    verdict: relabelClaimProfile(result.verdict, "secure_v5"),
+                    rollbackEvent: result.verdict.decision === "ALLOW"
+                        ? {
+                            recordId: payload.recordId,
+                            snapshotId: payload.snapshotId,
+                            appliedAt: new Date().toISOString()
+                        }
+                        : undefined
+                });
+                return;
+            }
+            if (request.url === "/v5/replay/bundle") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                writeJson(response, 200, buildReplayBundle(sessionState.replayEvents, runtime));
+                return;
+            }
+            if (request.url === "/v4/session/start") {
+                const payload = await readJson(request);
+                const sessionState = createSessionState(payload, runtime);
+                sessions.set(sessionState.session.sessionId, sessionState);
+                writeJson(response, 200, {
+                    session: sessionState.session
+                });
+                return;
+            }
+            if (request.url === "/v4/observe") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const capture = {
+                    ...payload.capture,
+                    sessionId: payload.sessionId,
+                    taskId: sessionState.session.taskId
+                };
+                const observation = await parserIsolationService.compileObservation({
+                    capture,
+                    workflowHash: sessionState.session.workflowHash,
+                    compilerVersion: "v4"
+                });
+                const failClosedObservation = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "observe");
+                let capabilities = mintCapabilitiesForObservation(sessionState.session, observation.compiledObservation, {
+                    sourceObservationId: observation.compiledObservation.observationId
+                });
+                let plannerInput = failClosedObservation.plannerInput;
+                if (shouldReduceAuthority(sessionState, observation.compiledObservation)) {
+                    plannerInput = applyAuthorityReduction(sessionState, observation.compiledObservation, plannerInput);
+                    capabilities = [];
+                }
+                sessionState.capabilities.clear();
+                for (const capability of capabilities) {
+                    sessionState.capabilities.set(capability.capabilityId, capability);
+                }
+                sessionState.latestObservation = observation.compiledObservation;
+                sessionState.observations.set(observation.compiledObservation.observationId, observation.compiledObservation);
+                writeJson(response, 200, {
+                    compiledObservation: observation.compiledObservation,
+                    observationVerdict: failClosedObservation.verdict,
+                    plannerInput: attachCapabilitiesToPlannerInput(plannerInput, capabilities)
+                });
+                return;
+            }
+            if (request.url === "/v4/action/evaluate") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const capability = sessionState?.capabilities.get(payload.capabilityId);
+                const verdict = evaluateCapabilityUse(payload, sessionState?.session, capability, {
+                    alreadyUsed: sessionState?.usedCapabilities.has(payload.capabilityId) ?? false
+                });
+                if (verdict.decision === "ALLOW" && sessionState && capability) {
+                    sessionState.capabilities.delete(payload.capabilityId);
+                    sessionState.usedCapabilities.add(payload.capabilityId);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
+                }
+                writeJson(response, 200, {
+                    verdict,
+                    executionPlan: verdict.decision === "ALLOW" && capability
+                        ? {
+                            verb: capability.kind,
+                            targetUrl: capability.targetUrl,
+                            targetOrigin: capability.targetOrigin,
+                            selector: capability.selector,
+                            derivedSinkClass: capability.derivedSinkClass,
+                            derivedSensitiveSink: capability.derivedSensitiveSink
+                        }
+                        : undefined
+                });
+                return;
+            }
+            if (request.url === "/v4/approval/grant") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const unknownCapability = (payload.capabilityIds ?? []).find((capabilityId) => !sessionState.capabilities.has(capabilityId));
+                if (unknownCapability) {
+                    writeJson(response, 400, {
+                        error: "unknown_capability",
+                        capabilityId: unknownCapability
+                    });
+                    return;
+                }
+                if (payload.sinkClass === "connector_oauth" &&
+                    !(payload.capabilityIds ?? []).length) {
+                    writeJson(response, 400, {
+                        error: "capability_ids_required",
+                        sinkClass: payload.sinkClass
+                    });
+                    return;
+                }
+                const approvalGrant = issueApprovalGrant(payload, sessionState);
+                sessionState.approvalGrants.set(approvalGrant.approvalGrantId, approvalGrant);
+                writeJson(response, 200, {
+                    approvalGrant
+                });
+                return;
+            }
+            if (request.url === "/v4/tool/prepare") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
+                const prepared = prepareToolOnboardingV4({
+                    ...payload.request,
+                    approvalGrantId: payload.approvalGrantId
+                }, sessionState?.session, approvalGrant, runtime);
+                const onboardingSession = prepared.verdict.decision === "ALLOW" && payload.request.authType === "oauth" && approvalGrant
+                    ? createOnboardingSession(payload.request, runtime, approvalGrant, prepared.verifiedRegistryEntry)
+                    : undefined;
+                if (sessionState && onboardingSession) {
+                    sessionState.onboardingSessions.set(onboardingSession.sessionId, onboardingSession);
+                }
+                writeJson(response, 200, {
+                    verdict: prepared.verdict,
+                    approvalVerdict: prepared.approvalVerdict,
+                    verifiedRegistryEntry: prepared.verifiedRegistryEntry,
+                    workflowBinding: prepared.workflowBinding,
+                    onboardingSession
+                });
+                return;
+            }
+            if (request.url === "/v4/tool/callback/verify") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
+                const session = sessionState?.onboardingSessions.get(payload.request.sessionId);
+                const result = verifyToolCallbackV4(payload.request, sessionState?.session, session, approvalGrant, runtime);
+                if (sessionState && session) {
+                    sessionState.onboardingSessions.set(payload.request.sessionId, {
+                        ...session,
+                        status: result.verdict.decision === "ALLOW" ? "used" : session.status
+                    });
+                }
+                writeJson(response, 200, result);
+                return;
+            }
+            if (request.url === "/v4/artifact/ingest") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const capture = {
+                    ...payload.capture,
+                    sessionId: payload.sessionId,
+                    taskId: sessionState.session.taskId
+                };
+                const observation = await parserIsolationService.compileObservation({
+                    capture,
+                    workflowHash: sessionState.session.workflowHash,
+                    compilerVersion: "v4"
+                });
+                const failClosedArtifact = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "artifact");
+                const legacyArtifact = buildLegacyObservationCapture(capture);
+                const artifactResult = legacyArtifact !== undefined ? brokerArtifact(legacyArtifact, runtime) : undefined;
+                sessionState.latestObservation = observation.compiledObservation;
+                sessionState.observations.set(observation.compiledObservation.observationId, observation.compiledObservation);
+                const effectiveArtifactVerdict = failClosedArtifact.failClosed
+                    ? failClosedArtifact.verdict
+                    : artifactResult?.verdict;
+                const effectiveArtifact = failClosedArtifact.failClosed && artifactResult?.artifact
+                    ? {
+                        ...artifactResult.artifact,
+                        toolActivationPolicy: "block",
+                        approvalRequiredForFollowOn: true
+                    }
+                    : artifactResult?.artifact;
+                const plannerInput = shouldReduceAuthority(sessionState, observation.compiledObservation)
+                    ? applyAuthorityReduction(sessionState, observation.compiledObservation, failClosedArtifact.plannerInput)
+                    : failClosedArtifact.plannerInput;
+                writeJson(response, 200, {
+                    compiledObservation: observation.compiledObservation,
+                    plannerInput,
+                    artifactVerdict: effectiveArtifactVerdict,
+                    artifact: effectiveArtifact
+                });
+                return;
+            }
+            if (request.url === "/v4/memory/write") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const result = evaluateMemoryWriteV4(payload, sessionState?.session, runtime);
+                if (sessionState && result.record) {
+                    sessionState.memoryRecords.set(result.record.recordId, result.record);
+                }
+                writeJson(response, 200, result);
+                return;
+            }
+            if (request.url === "/v4/memory/promote") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                const record = sessionState?.memoryRecords.get(payload.recordId);
+                const approvalGrant = payload.approvalGrantId && sessionState
+                    ? sessionState.approvalGrants.get(payload.approvalGrantId)
+                    : undefined;
+                const result = promoteMemoryRecordV4(payload, sessionState?.session, record, approvalGrant);
+                if (sessionState && result.promotedRecord) {
+                    if (record && result.promotedRecord.snapshotId) {
+                        sessionState.memorySnapshots.set(result.promotedRecord.snapshotId, {
+                            ...record,
+                            tier: "trusted_durable",
+                            summaryOnly: false,
+                            snapshotId: result.promotedRecord.snapshotId,
+                            rollbackPointId: result.promotedRecord.rollbackPointId
+                        });
+                    }
+                    sessionState.memoryRecords.set(result.promotedRecord.recordId, result.promotedRecord);
+                }
+                writeJson(response, 200, result);
+                return;
+            }
             if (request.url === "/v4/memory/rollback") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
@@ -642,12 +2281,22 @@ export async function createSafeBrowseServer(options = {}) {
             writeJson(response, 404, { error: "not_found" });
         }
         catch (error) {
+            logServerError(error);
             writeJson(response, 500, {
-                error: "server_error",
-                message: error instanceof Error ? error.message : String(error)
+                error: "server_error"
             });
         }
     });
+    const originalClose = server.close.bind(server);
+    server.close = ((callback) => {
+        clearInterval(parserHealthRefreshTimer);
+        return originalClose((error) => {
+            void parserIsolationService.close().finally(() => {
+                callback?.(error);
+            });
+        });
+    });
+    return server;
 }
 export async function startSafeBrowseDaemon(options = {}) {
     const server = await createSafeBrowseServer(options);