@safebrowse/daemon 0.1.3 → 0.1.5

package/dist/server.js

@@ -1,11 +1,13 @@
-import { createHash, randomUUID } from "node:crypto";
-import { stat } from "node:fs/promises";
+import { createHash, createPublicKey, randomUUID } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
 import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { applyV4FailClosedMediation, attachCapabilitiesToPlannerInput, brokerArtifact, brokerArtifactV2, buildReplayBundle, compilePolicy, createApprovalGrantHash, evaluateAction, evaluateCapabilityUse, evaluateMemoryWrite, evaluateMemoryWriteV4, evaluateToolRequest, mintCapabilitiesForObservation, prepareToolOnboarding, prepareToolOnboardingV4, promoteMemoryRecordV4, rollbackMemoryRecordV4, sanitizeObservation, verifyToolCallback, verifyToolCallbackV4 } from "@safebrowse/core";
-import { buildRegistryDefaults, loadKnowledgeBaseContext, loadVerifiedRegistryBundle, loadPolicyPackFromPaths, resolvePolicyLayerFiles } from "./loaders.js";
-import { compileObservationInIsolation, probeParserIsolation } from "./parserIsolation.js";
+import { applyModelGuardAssessment, applyV6ObservationMediation, buildReplayBundle, buildModelGuardObservationRequest, compilePolicy, computeToolManifestHash, computeToolSchemaHash, createApprovalIntentPayloadV6, evaluateCapabilityUseV6, extractAttachmentGraphV6, issueApprovalEnvelopeV6, mintCapabilitiesForObservationV6, mintMemoryPromotionCapabilityV6, prepareToolOnboardingV6, promoteMemoryRecordV6, rollbackMemoryRecordV6, stageMemoryRecordV6, tightenAuthoritiesWithModelGuard, verifyApprovalIntentSignatureV6, verifyToolCallbackV6 } from "@safebrowse/core";
+import { buildRegistryDefaults, loadKnowledgeBaseContext, loadPolicyPackFromPaths, loadVerifiedRegistryBundle, resolvePolicyLayerFiles } from "./loaders.js";
+import { createModelGuardClient } from "./modelGuard.js";
+import { createParserIsolationService } from "./parserIsolation.js";
+const PARSER_HEALTH_REFRESH_INTERVAL_MS = 30_000;
 function hashValue(input) {
     return createHash("sha256").update(JSON.stringify(input)).digest("hex");
 }
@@ -21,16 +23,12 @@ function writeJson(response, statusCode, payload) {
     response.setHeader("content-type", "application/json; charset=utf-8");
     response.end(JSON.stringify(payload, null, 2));
 }
-function legacyResponseMeta(route) {
-    return {
-        deprecated: true,
-        telemetry: {
-            deprecated: true,
-            claimScope: "legacy_compatibility",
-            preventionClaim: false,
-            routeVersion: route
-        }
-    };
+function logServerError(error) {
+    if (error instanceof Error) {
+        console.error("SafeBrowse daemon error:", error.stack ?? error.message);
+        return;
+    }
+    console.error("SafeBrowse daemon error:", error);
 }
 async function fileExists(path) {
     try {
@@ -52,21 +50,36 @@ async function resolveDefaultRootDir() {
 }
 async function buildRuntimeContext(options) {
     const rootDir = options.rootDir ?? (await resolveDefaultRootDir());
+    const deploymentProfile = options.deploymentProfile ?? "development";
+    const secureDeployment = deploymentProfile === "secure_v6";
     const policyPack = options.policyPack ??
         (await loadPolicyPackFromPaths(resolvePolicyLayerFiles(resolve(rootDir))));
     const knowledgeBase = options.knowledgeBase ?? (await loadKnowledgeBaseContext(resolve(rootDir, "knowledge_base")));
     const verifiedRegistry = options.verifiedRegistry ??
         (await loadVerifiedRegistryBundle(buildRegistryDefaults(resolve(rootDir))).catch(() => undefined));
+    const approvalBrokerPublicKeyPem = options.approvalBrokerPublicKeyPem ??
+        (options.approvalBrokerPublicKeyPath
+            ? await readFile(options.approvalBrokerPublicKeyPath, "utf8").catch(() => undefined)
+            : await readFile(resolve(rootDir, "knowledge_base", "signing", "safebrowse_vf_ed25519_public.pem"), "utf8").catch(() => undefined));
     return {
         policy: compilePolicy(policyPack),
         knowledgeBase,
         verifiedRegistry,
-        parserAllowlistedEgress: options.parserAllowlistedEgress ?? []
+        parserAllowlistedEgress: options.parserAllowlistedEgress ?? [],
+        parserIsolationMode: secureDeployment
+            ? "node_permission_process"
+            : options.parserIsolationMode ?? "scrubbed_process",
+        deploymentProfile,
+        approvalBrokerPublicKey: approvalBrokerPublicKeyPem
+            ? createPublicKey(approvalBrokerPublicKeyPem)
+            : undefined,
+        approvalBrokerConfigured: Boolean(approvalBrokerPublicKeyPem),
+        approvalBrokerMode: secureDeployment ? "external_service" : options.approvalBrokerMode ?? "signature_verification",
+        modelGuardBaseUrl: options.modelGuardBaseUrl?.trim() || undefined,
+        modelGuardTimeoutMs: options.modelGuardTimeoutMs ?? 2_500,
+        modelGuardEnforcementMode: options.modelGuardEnforcementMode ?? "off"
     };
 }
-function plusMinutes(value, minutes) {
-    return new Date(new Date(value).getTime() + minutes * 60_000).toISOString();
-}
 function plusSeconds(value, seconds) {
     return new Date(new Date(value).getTime() + seconds * 1_000).toISOString();
 }
@@ -75,333 +88,312 @@ function createWorkflowHash(payload) {
         taskId: payload.taskId,
         userGoal: payload.userGoal,
         phase: payload.phase ?? "",
+        taskPurposeClass: payload.taskPurposeClass ?? "",
+        taskPhase: payload.taskPhase ?? "",
         allowedOrigins: payload.allowedOrigins ?? [],
         allowedVerbs: payload.allowedVerbs ?? [],
-        forbiddenSinks: payload.forbiddenSinks ?? []
+        forbiddenSinks: payload.forbiddenSinks ?? [],
+        allowedPathClasses: payload.allowedPathClasses ?? [],
+        approvalRequiredPathClasses: payload.approvalRequiredPathClasses ?? []
     });
 }
-function createSessionState(request, runtime) {
+function secureParserIsolationSatisfied(probe) {
+    return (probe.mode === "node_permission_process" &&
+        probe.processIsolated &&
+        probe.egressDenied &&
+        probe.permissionModelEnabled &&
+        probe.childProcessDenied &&
+        probe.workerThreadsDenied &&
+        probe.envKeys.length === 0);
+}
+function claimBearingReady(runtime, probe) {
+    return (runtime.deploymentProfile === "secure_v6" &&
+        runtime.approvalBrokerConfigured &&
+        Boolean(runtime.approvalBrokerPublicKey) &&
+        runtime.approvalBrokerMode === "external_service" &&
+        runtime.verifiedRegistry?.signatureVerified === true &&
+        runtime.parserIsolationMode === "node_permission_process" &&
+        secureParserIsolationSatisfied(probe));
+}
+function createSessionState(request, runtime, secureReady) {
     const createdAt = new Date().toISOString();
-    const allowedOrigins = request.allowedOrigins ??
-        [...runtime.policy.readOnlyOrigins, ...runtime.policy.writableOrigins];
+    const allowedOrigins = request.allowedOrigins ?? [...runtime.policy.readOnlyOrigins, ...runtime.policy.writableOrigins];
     const allowedVerbs = request.allowedVerbs ?? [...runtime.policy.allowedActions];
-    const forbiddenSinks = request.forbiddenSinks ?? [];
     const session = {
         sessionId: randomUUID(),
         taskId: request.taskId,
         userGoal: request.userGoal,
         phase: request.phase,
+        taskPurposeClass: request.taskPurposeClass,
+        taskPhase: request.taskPhase,
         allowedOrigins,
         allowedVerbs,
-        forbiddenSinks,
+        forbiddenSinks: request.forbiddenSinks ?? [],
+        allowedPathClasses: request.allowedPathClasses,
+        approvalRequiredPathClasses: request.approvalRequiredPathClasses,
         workflowHash: createWorkflowHash({
-            taskId: request.taskId,
-            userGoal: request.userGoal,
-            phase: request.phase,
+            ...request,
             allowedOrigins,
-            allowedVerbs,
-            forbiddenSinks
+            allowedVerbs
         }),
         currentStep: 0,
         createdAt,
-        expiresAt: plusSeconds(createdAt, request.expiresInSeconds ?? 1800)
+        expiresAt: plusSeconds(createdAt, request.expiresInSeconds ?? 1800),
+        claimProfile: secureReady ? "secure_v6" : undefined,
+        approvalBrokerRequired: runtime.deploymentProfile === "secure_v6",
+        legacyRoutesDisabled: true
     };
     return {
         session,
-        capabilities: new Map(),
-        usedCapabilities: new Set(),
-        authorityReduced: false,
-        authorityReductionReasons: [],
-        approvalGrants: new Map(),
+        observations: new Map(),
+        authorities: new Map(),
+        usedAuthorities: new Set(),
+        approvalEnvelopes: new Map(),
+        onboardingSessions: new Map(),
+        connectorHandles: new Map(),
         memoryRecords: new Map(),
+        memorySourceClasses: new Map(),
         memorySnapshots: new Map(),
-        onboardingSessions: new Map()
+        replayEvents: []
     };
 }
-function shouldReduceAuthority(sessionState, observation) {
-    if (sessionState.authorityReduced) {
-        return true;
+function findSessionState(sessions, sessionId) {
+    const sessionState = sessions.get(sessionId);
+    if (!sessionState) {
+        return undefined;
+    }
+    if (new Date(sessionState.session.expiresAt).getTime() <= Date.now()) {
+        sessions.delete(sessionId);
+        return undefined;
     }
-    const hasPriorSurface = Boolean(sessionState.latestObservation);
-    const hasMeaningfulRisk = observation.parseStatus !== "compiled" ||
-        observation.riskFindings.length > 0 ||
-        observation.secretFindings.length > 0;
-    return hasPriorSurface && hasMeaningfulRisk;
+    return sessionState;
 }
-function applyAuthorityReduction(sessionState, observation, plannerInput) {
-    const reasons = [
-        ...sessionState.authorityReductionReasons,
-        ...(observation.parseStatus !== "compiled"
-            ? [`parse_status_${observation.parseStatus}`]
-            : []),
-        ...observation.riskFindings,
-        ...(observation.secretFindings.length ? ["secret_redaction_boundary"] : [])
-    ];
-    sessionState.authorityReduced = true;
-    sessionState.authorityReductionReasons = [...new Set(reasons)];
-    sessionState.capabilities.clear();
+function appendReplayEvent(sessionState, event) {
+    if (!sessionState) {
+        return undefined;
+    }
+    const replayEvent = {
+        eventId: randomUUID(),
+        timestamp: new Date().toISOString(),
+        ...event
+    };
+    sessionState.replayEvents.push(replayEvent);
+    return replayEvent.eventId;
+}
+function authorityCandidateFromDescriptor(authority) {
     return {
-        ...plannerInput,
-        candidateCapabilities: [],
-        riskMarkers: [
-            ...new Set([
-                ...plannerInput.riskMarkers,
-                "multimodal_reducer_active",
-                ...sessionState.authorityReductionReasons.map((reason) => `chain:${reason}`)
-            ])
-        ]
+        authorityId: authority.capabilityId,
+        authorityDigest: authority.capabilityDigest,
+        semanticDigest: authority.semanticDigest,
+        title: authority.title,
+        kind: authority.kind,
+        operationClass: authority.operationClass,
+        targetPathClass: authority.targetPathClass,
+        requiresApproval: authority.requiresApproval,
+        evidenceSpanIds: authority.evidenceSpanIds,
+        providerId: authority.providerId,
+        operationId: authority.operationId,
+        method: authority.method,
+        pathTemplate: authority.pathTemplate,
+        mailboxId: authority.mailboxId,
+        accountId: authority.accountId,
+        messageId: authority.messageId,
+        threadId: authority.threadId,
+        recipientSetHash: authority.recipientSetHash,
+        subjectHash: authority.subjectHash,
+        bodyDigest: authority.bodyDigest,
+        attachmentDigestSet: authority.attachmentDigestSet,
+        parameterSchema: authority.parameterSchema,
+        expiresAt: authority.expiresAt
     };
 }
-function createOnboardingSession(request, runtime, approvalGrant, verifiedRegistryEntry) {
-    const callbackUri = verifiedRegistryEntry?.allowedRedirectUris[0] ??
-        request.oauthContext?.callbackUri ??
-        request.callbackUri ??
-        request.oauthContext?.redirectUri ??
-        request.requestedRedirectUri;
-    if (!callbackUri) {
-        return undefined;
-    }
-    const callbackOrigin = verifiedRegistryEntry?.allowedCallbackOrigins[0] ?? new URL(callbackUri).origin;
-    const createdAt = (runtime.now?.() ?? new Date()).toISOString();
+function consumeAuthority(sessionState, authority) {
+    sessionState.authorities.set(authority.capabilityId, {
+        ...authority,
+        consumedAt: new Date().toISOString()
+    });
+    sessionState.usedAuthorities.add(authority.capabilityId);
+}
+function lookupVerifiedRegistryEntry(runtime, toolId, registryEntryId) {
+    return runtime.verifiedRegistry?.entries.find((entry) => entry.registryEntryId === registryEntryId ||
+        entry.registryEntryId === toolId ||
+        entry.adapterId === toolId);
+}
+function lookupVerifiedApiProviderEntry(runtime, providerId) {
+    return runtime.verifiedRegistry?.apiProviders?.find((entry) => entry.providerId === providerId);
+}
+function buildArtifactRef(capture, observation) {
+    const extractionMethod = capture.surfaceType === "html"
+        ? "dom"
+        : capture.surfaceType === "email_message"
+            ? "mime"
+            : capture.surfaceType === "docx" ||
+                capture.surfaceType === "xlsx" ||
+                capture.surfaceType === "pptx"
+                ? "ooxml"
+                : capture.surfaceType === "attachment_bundle"
+                    ? "extractor"
+                    : capture.surfaceType === "tool_manifest" || capture.surfaceType === "memory_candidate"
+                        ? "api"
+                        : capture.surfaceType === "external_api_response"
+                            ? "api"
+                            : capture.surfaceType === "image"
+                                ? "ocr"
+                                : "download";
+    const surfaceKind = capture.surfaceType === "tool_manifest"
+        ? "tool_manifest"
+        : capture.surfaceType === "memory_candidate"
+            ? "memory"
+            : capture.surfaceType;
     return {
-        sessionId: randomUUID(),
-        approvalBindingId: approvalGrant.approvalGrantId,
-        workflowBindingId: request.sourceObservationId,
-        toolId: request.toolId,
-        registryEntryId: verifiedRegistryEntry?.registryEntryId ?? request.registryEntryId ?? request.toolId,
-        registryBundleId: verifiedRegistryEntry?.bundleId ??
-            request.registryBundleId ??
-            runtime.verifiedRegistry?.bundleId ??
-            "unverified-registry",
-        callbackUri,
-        callbackOrigin,
-        requestedScopes: approvalGrant.scopes,
-        state: randomUUID(),
-        pkceMethod: "S256",
-        createdAt,
-        expiresAt: plusMinutes(createdAt, 5),
-        status: "prepared"
+        artifactId: observation.observationId,
+        surfaceKind,
+        sourceOrigin: observation.sourceOrigin,
+        viewerOrigin: observation.frameOrigin,
+        mismatchSignals: observation.parseStatus === "compiled" ? [] : [`parse_status_${observation.parseStatus}`],
+        metadataSignals: observation.policyFindings.map((finding) => finding.code),
+        provenance: {
+            extractionMethod,
+            lineageChain: [],
+            derivedTaintClass: "tainted"
+        },
+        authorityEligible: observation.authorityEligible
     };
 }
-function issueApprovalGrant(request, sessionState) {
-    const issuedAt = new Date().toISOString();
-    const grantWithoutHash = {
-        approvalGrantId: randomUUID(),
+function buildMemorySnapshotState(sessionState, record) {
+    const priorTrustedRecord = [...sessionState.memoryRecords.values()]
+        .filter((candidate) => candidate.recordId !== record.recordId &&
+        candidate.key === record.key &&
+        candidate.tier === "trusted_durable")
+        .sort((left, right) => right.createdAt.localeCompare(left.createdAt))[0];
+    return {
+        snapshotId: "",
         sessionId: sessionState.session.sessionId,
-        workflowHash: sessionState.session.workflowHash,
-        connectorId: request.connectorId,
-        scopes: request.scopes ?? [],
-        sinkClass: request.sinkClass,
-        capabilityIds: request.capabilityIds ?? [],
-        targetOrigin: request.targetOrigin,
-        issuedAt,
-        expiresAt: plusSeconds(issuedAt, request.expiresInSeconds ?? 600)
+        recordId: record.recordId,
+        key: record.key,
+        createdAt: new Date().toISOString(),
+        baselineAbsent: !priorTrustedRecord,
+        snapshotRecord: priorTrustedRecord
     };
+}
+function retiredRouteResponse(route) {
     return {
-        ...grantWithoutHash,
-        grantHash: createApprovalGrantHash(grantWithoutHash)
+        error: "route_retired_use_v6",
+        route,
+        replacementPrefix: "/v6",
+        deprecated: true
     };
 }
-function findSessionState(sessions, sessionId) {
-    const sessionState = sessions.get(sessionId);
-    if (!sessionState) {
-        return undefined;
-    }
-    if (new Date(sessionState.session.expiresAt).getTime() <= Date.now()) {
-        sessions.delete(sessionId);
-        return undefined;
-    }
-    return sessionState;
-}
-function buildLegacyObservationCapture(payload) {
-    if (payload.surfaceType === "pdf") {
-        return {
-            mimeType: "application/pdf",
-            sourceOrigin: payload.url,
-            viewerOrigin: payload.frameUrl ?? payload.url,
-            renderedText: payload.renderedText,
-            extractedText: payload.extractedText,
-            ocrText: payload.ocrText,
-            annotations: payload.annotations,
-            metadataText: payload.metadataText,
-            extractionMethod: "download",
-            trustSignals: payload.trustSignals
-        };
-    }
-    if (payload.surfaceType === "image") {
-        return {
-            mimeType: "image/png",
-            sourceOrigin: payload.url,
-            viewerOrigin: payload.frameUrl ?? payload.url,
-            ocrText: payload.ocrText,
-            metadataText: payload.metadataText,
-            extractionMethod: "ocr",
-            trustSignals: payload.trustSignals
-        };
-    }
-    if (payload.surfaceType === "tool_manifest") {
-        return {
-            mimeType: "application/json",
-            surfaceKind: "tool_manifest",
-            sourceOrigin: payload.url,
-            viewerOrigin: payload.frameUrl ?? payload.url,
-            extractedText: payload.description,
-            metadataText: payload.schemaDescriptions,
-            extractionMethod: "api",
-            trustSignals: payload.trustSignals
-        };
-    }
-    return undefined;
+function isRetiredRoute(url) {
+    return (url.startsWith("/v1/") ||
+        url.startsWith("/v2/") ||
+        url.startsWith("/v4/") ||
+        url.startsWith("/v5/"));
 }
 export async function createSafeBrowseServer(options = {}) {
     const runtime = await buildRuntimeContext(options);
-    const onboardingSessions = new Map();
+    const modelGuardClient = createModelGuardClient({
+        baseUrl: runtime.modelGuardBaseUrl,
+        timeoutMs: runtime.modelGuardTimeoutMs,
+        enforcementMode: runtime.modelGuardEnforcementMode
+    });
+    const parserIsolationService = createParserIsolationService(runtime.parserIsolationMode, {
+        allowlistedEgress: runtime.parserAllowlistedEgress,
+        runtime
+    });
+    let parserProbeSnapshot = await parserIsolationService.refreshProbe();
+    let modelGuardHealthSnapshot = await modelGuardClient.refreshHealth();
+    const secureReady = claimBearingReady(runtime, parserProbeSnapshot.probe);
     const sessions = new Map();
-    return createServer(async (request, response) => {
-        if (!request.url) {
-            writeJson(response, 400, { error: "missing_url" });
-            return;
-        }
+    const parserHealthRefreshTimer = setInterval(() => {
+        void parserIsolationService
+            .refreshProbe()
+            .then((snapshot) => {
+            parserProbeSnapshot = snapshot;
+        })
+            .catch(() => undefined);
+        void modelGuardClient
+            .refreshHealth()
+            .then((snapshot) => {
+            modelGuardHealthSnapshot = snapshot;
+        })
+            .catch(() => undefined);
+    }, PARSER_HEALTH_REFRESH_INTERVAL_MS);
+    parserHealthRefreshTimer.unref?.();
+    const server = createServer(async (request, response) => {
         try {
-            if (request.method === "GET" && request.url === "/health") {
-                const parserProbe = await probeParserIsolation();
+            const requestUrl = request.url ?? "/";
+            if (request.method === "GET" && requestUrl === "/health") {
                 writeJson(response, 200, {
                     status: "ok",
-                    profile: runtime.policy.profile,
-                    version: runtime.policy.version,
-                    policyLayers: runtime.policy.layerProvenance,
+                    deploymentProfile: runtime.deploymentProfile,
+                    claimBearingReady: claimBearingReady(runtime, parserProbeSnapshot.probe),
+                    legacyRoutesEnabled: false,
+                    approvalBroker: {
+                        configured: runtime.approvalBrokerConfigured,
+                        mode: runtime.approvalBrokerMode
+                    },
+                    parserIsolation: {
+                        configuredMode: runtime.parserIsolationMode,
+                        lastCheckedAt: parserProbeSnapshot.lastCheckedAt,
+                        ...parserProbeSnapshot.probe
+                    },
                     verifiedRegistry: runtime.verifiedRegistry
                         ? {
                             bundleId: runtime.verifiedRegistry.bundleId,
                             version: runtime.verifiedRegistry.version,
+                            signer: runtime.verifiedRegistry.signer,
                             signatureVerified: runtime.verifiedRegistry.signatureVerified,
-                            entryCount: runtime.verifiedRegistry.entries.length
+                            apiProviderCount: runtime.verifiedRegistry.apiProviders?.length ?? 0,
+                            extractorProfileCount: runtime.verifiedRegistry.extractorProfiles?.length ?? 0
                         }
                         : undefined,
-                    parserIsolation: parserProbe
-                });
-                return;
-            }
-            if (request.method !== "POST") {
-                writeJson(response, 405, { error: "method_not_allowed" });
-                return;
-            }
-            if (request.url === "/v1/observe") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...sanitizeObservation(payload, runtime),
-                    ...legacyResponseMeta("/v1/observe")
-                });
-                return;
-            }
-            if (request.url === "/v1/action") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...evaluateAction(payload, runtime),
-                    ...legacyResponseMeta("/v1/action")
-                });
-                return;
-            }
-            if (request.url === "/v1/artifact") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...brokerArtifact(payload, runtime),
-                    ...legacyResponseMeta("/v1/artifact")
-                });
-                return;
-            }
-            if (request.url === "/v1/tool") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...evaluateToolRequest(payload, runtime),
-                    ...legacyResponseMeta("/v1/tool")
-                });
-                return;
-            }
-            if (request.url === "/v1/memory") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...evaluateMemoryWrite(payload, runtime),
-                    ...legacyResponseMeta("/v1/memory")
-                });
-                return;
-            }
-            if (request.url === "/v1/replay") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...buildReplayBundle(payload.events, runtime),
-                    ...legacyResponseMeta("/v1/replay")
-                });
-                return;
-            }
-            if (request.url === "/v2/tool/prepare") {
-                const payload = await readJson(request);
-                const prepared = prepareToolOnboarding(payload, runtime);
-                const onboardingSession = prepared.verdict.decision === "ALLOW" && payload.authType === "oauth"
-                    ? createOnboardingSession(payload, runtime, {
-                        approvalGrantId: payload.approvalBindingId ?? randomUUID(),
-                        sessionId: "legacy-session",
-                        workflowHash: hashValue(payload.sourceObservationId ?? payload.requestId),
-                        connectorId: payload.toolId,
-                        scopes: payload.requestedScopes ?? [],
-                        sinkClass: "connector_oauth",
-                        capabilityIds: payload.capabilityId ? [payload.capabilityId] : [],
-                        targetOrigin: payload.callbackOrigin ??
-                            payload.oauthContext?.callbackOrigin ??
-                            payload.callbackUri ??
-                            payload.requestedRedirectUri ??
-                            "unknown",
-                        issuedAt: new Date().toISOString(),
-                        expiresAt: plusMinutes(new Date().toISOString(), 10),
-                        grantHash: "legacy"
-                    })
-                    : undefined;
-                if (onboardingSession) {
-                    onboardingSessions.set(onboardingSession.sessionId, onboardingSession);
-                }
-                writeJson(response, 200, {
-                    verdict: prepared.verdict,
-                    verifiedRegistryEntry: prepared.verifiedRegistryEntry,
-                    workflowBinding: prepared.workflowBinding,
-                    onboardingSession,
-                    ...legacyResponseMeta("/v2/tool/prepare")
+                    policyLayers: runtime.policy.layerProvenance,
+                    captureAttestation: {
+                        htmlDom: true,
+                        required: true
+                    },
+                    modelGuard: {
+                        configured: modelGuardHealthSnapshot.configured,
+                        ready: modelGuardHealthSnapshot.ready,
+                        runtimeMode: modelGuardHealthSnapshot.runtimeMode,
+                        enforcementMode: modelGuardHealthSnapshot.enforcementMode,
+                        bundleVersion: modelGuardHealthSnapshot.bundleVersion,
+                        featureSchemaVersion: modelGuardHealthSnapshot.featureSchemaVersion,
+                        bundleDigest: modelGuardHealthSnapshot.bundleDigest,
+                        componentDigests: modelGuardHealthSnapshot.componentDigests,
+                        validationError: modelGuardHealthSnapshot.validationError
+                    }
                 });
                 return;
             }
-            if (request.url === "/v2/tool/callback/verify") {
-                const payload = await readJson(request);
-                const session = onboardingSessions.get(payload.sessionId);
-                const result = verifyToolCallback(payload, session, runtime);
-                if (session) {
-                    onboardingSessions.set(payload.sessionId, {
-                        ...session,
-                        status: result.verdict.decision === "ALLOW" ? "used" : session.status
-                    });
-                }
-                writeJson(response, 200, {
-                    ...result,
-                    ...legacyResponseMeta("/v2/tool/callback/verify")
-                });
+            if (isRetiredRoute(requestUrl)) {
+                writeJson(response, 410, retiredRouteResponse(requestUrl));
                 return;
             }
-            if (request.url === "/v2/artifact") {
-                const payload = await readJson(request);
-                writeJson(response, 200, {
-                    ...brokerArtifactV2(payload, runtime),
-                    ...legacyResponseMeta("/v2/artifact")
-                });
+            if (request.method !== "POST" || !requestUrl.startsWith("/v6/")) {
+                writeJson(response, 404, { error: "not_found" });
                 return;
             }
-            if (request.url === "/v4/session/start") {
+            if (requestUrl === "/v6/session/start") {
                 const payload = await readJson(request);
-                const sessionState = createSessionState(payload, runtime);
+                const sessionState = createSessionState(payload, runtime, secureReady);
                 sessions.set(sessionState.session.sessionId, sessionState);
+                appendReplayEvent(sessionState, {
+                    kind: "observation",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        sessionId: sessionState.session.sessionId,
+                        taskId: sessionState.session.taskId
+                    }
+                });
                 writeJson(response, 200, {
                     session: sessionState.session
                 });
                 return;
             }
-            if (request.url === "/v4/observe") {
+            if (requestUrl === "/v6/observe") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 if (!sessionState) {
@@ -413,134 +405,346 @@ export async function createSafeBrowseServer(options = {}) {
                     sessionId: payload.sessionId,
                     taskId: sessionState.session.taskId
                 };
-                const observation = await compileObservationInIsolation({
+                const parsed = await parserIsolationService.compileObservation({
                     capture,
                     workflowHash: sessionState.session.workflowHash,
-                    allowlistedEgress: runtime.parserAllowlistedEgress,
-                    runtime: {
-                        knowledgeBase: runtime.knowledgeBase
-                    }
+                    runtime,
+                    compilerVersion: "v6"
                 });
-                const failClosedObservation = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "observe");
-                let capabilities = mintCapabilitiesForObservation(sessionState.session, observation.compiledObservation, {
-                    sourceObservationId: observation.compiledObservation.observationId
-                });
-                let plannerInput = failClosedObservation.plannerInput;
-                if (shouldReduceAuthority(sessionState, observation.compiledObservation)) {
-                    plannerInput = applyAuthorityReduction(sessionState, observation.compiledObservation, plannerInput);
-                    capabilities = [];
+                let compiledObservation = parsed.compiledObservation;
+                let plannerView = parsed.plannerView;
+                let mediated = applyV6ObservationMediation(compiledObservation, plannerView);
+                const verifiedRegistryEntry = capture.surfaceType === "tool_manifest"
+                    ? lookupVerifiedRegistryEntry(runtime, capture.toolId, capture.toolId)
+                    : undefined;
+                const verifiedApiProviderEntry = "providerId" in capture && capture.providerId
+                    ? lookupVerifiedApiProviderEntry(runtime, capture.providerId)
+                    : undefined;
+                const manifestHash = capture.surfaceType === "tool_manifest"
+                    ? parsed.toolManifestDigests?.manifestHash ??
+                        computeToolManifestHash({
+                            toolId: capture.toolId,
+                            description: capture.description,
+                            authType: capture.authType,
+                            requestedScopes: capture.requestedScopes,
+                            callbackUri: capture.callbackUri
+                        })
+                    : undefined;
+                const schemaHash = capture.surfaceType === "tool_manifest"
+                    ? parsed.toolManifestDigests?.schemaHash ??
+                        computeToolSchemaHash(capture.schemaDescriptions)
+                    : undefined;
+                if (modelGuardClient.configured &&
+                    modelGuardClient.enforcementMode !== "off" &&
+                    mediated.verdict.decision === "ALLOW") {
+                    try {
+                        const scored = await modelGuardClient.scoreObservation(buildModelGuardObservationRequest(sessionState.session, compiledObservation, plannerView));
+                        if (modelGuardClient.enforcementMode === "shadow") {
+                            compiledObservation = {
+                                ...compiledObservation,
+                                modelAssessment: scored.assessment
+                            };
+                        }
+                        else {
+                            const applied = applyModelGuardAssessment(compiledObservation, plannerView, mediated.verdict, scored.assessment);
+                            compiledObservation = applied.compiledObservation;
+                            plannerView = applied.plannerView;
+                            mediated = {
+                                plannerView,
+                                verdict: applied.verdict,
+                                failClosed: false
+                            };
+                        }
+                    }
+                    catch {
+                        if (modelGuardClient.enforcementMode === "tighten") {
+                            compiledObservation = {
+                                ...compiledObservation,
+                                authorityEligible: false
+                            };
+                            plannerView = {
+                                ...plannerView,
+                                visibleExcerpt: "",
+                                riskMarkers: [...new Set([...plannerView.riskMarkers, "model_guard_unavailable"])]
+                            };
+                            mediated = {
+                                plannerView,
+                                verdict: {
+                                    decision: "REPLAN_READ_ONLY",
+                                    reasonCodes: ["MODEL_GUARD_UNAVAILABLE"],
+                                    riskScore: Math.max(0.6, compiledObservation.riskScore),
+                                    safeConstraints: {
+                                        claim_profile: "secure_v6",
+                                        authority_eligible: false
+                                    },
+                                    telemetryTags: ["v6_observation", "model_guard_unavailable"]
+                                },
+                                failClosed: false
+                            };
+                        }
+                    }
                 }
-                sessionState.capabilities.clear();
-                for (const capability of capabilities) {
-                    sessionState.capabilities.set(capability.capabilityId, capability);
+                const authorities = mediated.verdict.decision === "BLOCK"
+                    ? []
+                    : mintCapabilitiesForObservationV6(sessionState.session, compiledObservation, plannerView, {
+                        policy: runtime.policy,
+                        ...(capture.surfaceType === "tool_manifest" && verifiedRegistryEntry
+                            ? {
+                                verifiedRegistryEntry,
+                                registryEntryId: capture.toolId,
+                                connectorId: capture.toolId,
+                                requestedScopes: capture.requestedScopes,
+                                callbackUri: capture.callbackUri,
+                                callbackOrigin: capture.callbackOrigin,
+                                manifestAuthType: capture.authType,
+                                manifestHash,
+                                schemaHash
+                            }
+                            : verifiedApiProviderEntry
+                                ? {
+                                    verifiedApiProviderEntry
+                                }
+                                : {})
+                    });
+                const tightenedAuthorities = tightenAuthoritiesWithModelGuard(authorities, modelGuardClient.enforcementMode === "tighten"
+                    ? compiledObservation.modelAssessment
+                    : undefined);
+                for (const authority of tightenedAuthorities) {
+                    sessionState.authorities.set(authority.capabilityId, authority);
                 }
-                sessionState.latestObservation = observation.compiledObservation;
+                sessionState.latestObservation = compiledObservation;
+                sessionState.latestObservationVerdict = mediated.verdict;
+                sessionState.observations.set(compiledObservation.observationId, compiledObservation);
+                const replayEventId = appendReplayEvent(sessionState, {
+                    kind: "observation",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        observationId: compiledObservation.observationId,
+                        parseStatus: compiledObservation.parseStatus,
+                        authorityCount: tightenedAuthorities.length,
+                        decision: mediated.verdict.decision,
+                        surfaceType: capture.surfaceType,
+                        providerId: "providerId" in capture ? capture.providerId ?? null : null,
+                        extractorIds: "extractionAttestation" in capture && capture.extractionAttestation
+                            ? [capture.extractionAttestation.extractorId]
+                            : "extractionAttestations" in capture
+                                ? capture.extractionAttestations?.map((entry) => entry.extractorId) ?? []
+                                : [],
+                        modelAssessment: compiledObservation.modelAssessment
+                            ? {
+                                bundleVersion: compiledObservation.modelAssessment.bundleVersion,
+                                calibratedDecisionLabel: compiledObservation.modelAssessment.calibratedDecisionLabel,
+                                coarseReasonCodes: compiledObservation.modelAssessment.coarseReasonCodes,
+                                evidenceChunkIds: compiledObservation.modelAssessment.evidenceChunkIds
+                            }
+                            : null
+                    }
+                });
                 writeJson(response, 200, {
-                    compiledObservation: observation.compiledObservation,
-                    observationVerdict: failClosedObservation.verdict,
-                    plannerInput: attachCapabilitiesToPlannerInput(plannerInput, capabilities)
+                    compiledObservation,
+                    plannerView,
+                    authorityCandidates: tightenedAuthorities.map(authorityCandidateFromDescriptor),
+                    capabilities: tightenedAuthorities.map(authorityCandidateFromDescriptor),
+                    artifactRefs: [],
+                    observationVerdict: mediated.verdict,
+                    replayEventId: replayEventId ?? randomUUID()
                 });
                 return;
             }
-            if (request.url === "/v4/action/evaluate") {
+            if (requestUrl === "/v6/action/evaluate") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const capability = sessionState?.capabilities.get(payload.capabilityId);
-                const verdict = evaluateCapabilityUse(payload, sessionState?.session, capability, {
-                    alreadyUsed: sessionState?.usedCapabilities.has(payload.capabilityId) ?? false
+                const authority = sessionState?.authorities.get(payload.authorityId);
+                const approvalEnvelope = payload.approvalId && sessionState
+                    ? sessionState.approvalEnvelopes.get(payload.approvalId)
+                    : undefined;
+                const authorityDecision = evaluateCapabilityUseV6(payload, sessionState?.session, authority, {
+                    alreadyUsed: sessionState?.usedAuthorities.has(payload.authorityId) ?? false,
+                    approvalEnvelope
                 });
-                if (verdict.decision === "ALLOW" && sessionState && capability) {
-                    sessionState.capabilities.delete(payload.capabilityId);
-                    sessionState.usedCapabilities.add(payload.capabilityId);
+                if (sessionState && authority && authorityDecision.decision === "ALLOW") {
+                    consumeAuthority(sessionState, authority);
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopes.set(approvalEnvelope.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt: new Date().toISOString()
+                        });
+                    }
                     sessionState.session = {
                         ...sessionState.session,
                         currentStep: sessionState.session.currentStep + 1
                     };
                 }
+                appendReplayEvent(sessionState, {
+                    kind: "action",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        authorityId: payload.authorityId,
+                        decision: authorityDecision.decision,
+                        operationClass: authority?.operationClass ?? null,
+                        providerId: authority?.providerId ?? null,
+                        operationId: authority?.operationId ?? null
+                    }
+                });
                 writeJson(response, 200, {
-                    verdict,
-                    executionPlan: verdict.decision === "ALLOW" && capability
+                    observationDecision: sessionState?.latestObservationVerdict ?? {
+                        decision: "ALLOW",
+                        reasonCodes: [],
+                        riskScore: 0
+                    },
+                    authorityDecision,
+                    effectDecision: authorityDecision,
+                    executionPlan: authorityDecision.decision === "ALLOW" && authority
                         ? {
-                            verb: capability.kind,
-                            targetUrl: capability.targetUrl,
-                            targetOrigin: capability.targetOrigin,
-                            selector: capability.selector,
-                            derivedSinkClass: capability.derivedSinkClass,
-                            derivedSensitiveSink: capability.derivedSensitiveSink
+                            verb: authority.kind,
+                            operationClass: authority.operationClass,
+                            targetUrl: authority.targetUrl,
+                            targetOrigin: authority.targetOrigin,
+                            selector: authority.selector,
+                            targetPathClass: authority.targetPathClass,
+                            derivedSinkClass: authority.derivedSinkClass,
+                            derivedSensitiveSink: authority.derivedSensitiveSink,
+                            providerId: authority.providerId,
+                            operationId: authority.operationId,
+                            method: authority.method,
+                            pathTemplate: authority.pathTemplate,
+                            mailboxId: authority.mailboxId,
+                            accountId: authority.accountId,
+                            messageId: authority.messageId,
+                            threadId: authority.threadId,
+                            recipientSetHash: authority.recipientSetHash,
+                            subjectHash: authority.subjectHash,
+                            bodyDigest: authority.bodyDigest,
+                            attachmentDigestSet: authority.attachmentDigestSet
                         }
                         : undefined
                 });
                 return;
             }
-            if (request.url === "/v4/approval/grant") {
+            if (requestUrl === "/v6/approval/issue") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                if (!sessionState) {
-                    writeJson(response, 404, { error: "unknown_session" });
-                    return;
-                }
-                const unknownCapability = (payload.capabilityIds ?? []).find((capabilityId) => !sessionState.capabilities.has(capabilityId));
-                if (unknownCapability) {
-                    writeJson(response, 400, {
-                        error: "unknown_capability",
-                        capabilityId: unknownCapability
+                const authorityId = payload.authorityId ?? payload.capabilityId ?? "";
+                const authorityDigest = payload.authorityDigest ?? payload.capabilityDigest ?? "";
+                const authority = sessionState?.authorities.get(authorityId);
+                if (!sessionState || !authority) {
+                    writeJson(response, 404, {
+                        error: !sessionState ? "unknown_session" : "unknown_authority"
                     });
                     return;
                 }
-                if (payload.sinkClass === "connector_oauth" &&
-                    !(payload.capabilityIds ?? []).length) {
-                    writeJson(response, 400, {
-                        error: "capability_ids_required",
-                        sinkClass: payload.sinkClass
-                    });
-                    return;
+                const signatureValid = authority.capabilityDigest === authorityDigest &&
+                    verifyApprovalIntentSignatureV6(createApprovalIntentPayloadV6({
+                        sessionId: sessionState.session.sessionId,
+                        workflowHash: sessionState.session.workflowHash,
+                        capabilityId: authority.capabilityId,
+                        capabilityDigest: authority.capabilityDigest,
+                        expiresInSeconds: payload.expiresInSeconds
+                    }), payload.brokerSignature, runtime.approvalBrokerPublicKey);
+                const issued = issueApprovalEnvelopeV6({
+                    session: sessionState.session,
+                    capability: authority,
+                    brokerSignature: payload.brokerSignature,
+                    brokerSignatureVerified: signatureValid,
+                    expiresInSeconds: payload.expiresInSeconds
+                });
+                if (issued.approvalEnvelope) {
+                    sessionState.approvalEnvelopes.set(issued.approvalEnvelope.approvalId, issued.approvalEnvelope);
                 }
-                const approvalGrant = issueApprovalGrant(payload, sessionState);
-                sessionState.approvalGrants.set(approvalGrant.approvalGrantId, approvalGrant);
-                writeJson(response, 200, {
-                    approvalGrant
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        authorityId,
+                        decision: issued.verdict.decision
+                    }
                 });
+                writeJson(response, 200, issued);
                 return;
             }
-            if (request.url === "/v4/tool/prepare") {
+            if (requestUrl === "/v6/tool/prepare") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
-                const prepared = prepareToolOnboardingV4({
-                    ...payload.request,
-                    approvalGrantId: payload.approvalGrantId
-                }, sessionState?.session, approvalGrant, runtime);
-                const onboardingSession = prepared.verdict.decision === "ALLOW" && payload.request.authType === "oauth" && approvalGrant
-                    ? createOnboardingSession(payload.request, runtime, approvalGrant, prepared.verifiedRegistryEntry)
+                const approvalEnvelope = sessionState?.approvalEnvelopes.get(payload.approvalId);
+                const authority = approvalEnvelope && sessionState
+                    ? sessionState.authorities.get(approvalEnvelope.capabilityId)
+                    : undefined;
+                const verifiedRegistryEntry = authority?.registryEntryId
+                    ? lookupVerifiedRegistryEntry(runtime, authority.connectorId, authority.registryEntryId)
                     : undefined;
-                if (sessionState && onboardingSession) {
-                    sessionState.onboardingSessions.set(onboardingSession.sessionId, onboardingSession);
+                const prepared = prepareToolOnboardingV6({
+                    session: sessionState?.session,
+                    capability: authority,
+                    approvalEnvelope,
+                    verifiedRegistryEntry
+                });
+                if (sessionState && approvalEnvelope && authority && prepared.onboardingSession) {
+                    sessionState.onboardingSessions.set(prepared.onboardingSession.onboardingSessionId, prepared.onboardingSession);
+                    sessionState.approvalEnvelopes.set(approvalEnvelope.approvalId, {
+                        ...approvalEnvelope,
+                        consumedAt: new Date().toISOString(),
+                        onboardingSessionId: prepared.onboardingSession.onboardingSessionId
+                    });
+                    consumeAuthority(sessionState, authority);
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
                 }
-                writeJson(response, 200, {
-                    verdict: prepared.verdict,
-                    approvalVerdict: prepared.approvalVerdict,
-                    verifiedRegistryEntry: prepared.verifiedRegistryEntry,
-                    workflowBinding: prepared.workflowBinding,
-                    onboardingSession
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        approvalId: payload.approvalId,
+                        decision: prepared.verdict.decision
+                    }
                 });
+                writeJson(response, 200, prepared);
                 return;
             }
-            if (request.url === "/v4/tool/callback/verify") {
+            if (requestUrl === "/v6/tool/callback/verify") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const approvalGrant = sessionState?.approvalGrants.get(payload.approvalGrantId);
-                const session = sessionState?.onboardingSessions.get(payload.request.sessionId);
-                const result = verifyToolCallbackV4(payload.request, sessionState?.session, session, approvalGrant, runtime);
-                if (sessionState && session) {
-                    sessionState.onboardingSessions.set(payload.request.sessionId, {
-                        ...session,
-                        status: result.verdict.decision === "ALLOW" ? "used" : session.status
+                const approvalEnvelope = sessionState?.approvalEnvelopes.get(payload.approvalId);
+                const onboardingSession = sessionState?.onboardingSessions.get(payload.onboardingSessionId);
+                const authority = approvalEnvelope && sessionState
+                    ? sessionState.authorities.get(approvalEnvelope.capabilityId)
+                    : undefined;
+                const verifiedRegistryEntry = authority?.registryEntryId
+                    ? lookupVerifiedRegistryEntry(runtime, authority.connectorId, authority.registryEntryId)
+                    : undefined;
+                const verified = verifyToolCallbackV6({
+                    session: sessionState?.session,
+                    capability: authority,
+                    approvalEnvelope,
+                    onboardingSession,
+                    verifiedRegistryEntry,
+                    request: payload.request
+                });
+                if (sessionState && onboardingSession && verified.connectorHandle) {
+                    sessionState.onboardingSessions.set(onboardingSession.onboardingSessionId, {
+                        ...onboardingSession,
+                        status: "used"
                     });
+                    sessionState.connectorHandles.set(verified.connectorHandle.handleId, verified.connectorHandle);
                 }
-                writeJson(response, 200, result);
+                appendReplayEvent(sessionState, {
+                    kind: "tool",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        onboardingSessionId: payload.onboardingSessionId,
+                        decision: verified.verdict.decision
+                    }
+                });
+                writeJson(response, 200, verified);
                 return;
             }
-            if (request.url === "/v4/artifact/ingest") {
+            if (requestUrl === "/v6/artifact/ingest") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 if (!sessionState) {
@@ -552,81 +756,194 @@ export async function createSafeBrowseServer(options = {}) {
                     sessionId: payload.sessionId,
                     taskId: sessionState.session.taskId
                 };
-                const observation = await compileObservationInIsolation({
+                const parsed = await parserIsolationService.compileObservation({
                     capture,
                     workflowHash: sessionState.session.workflowHash,
-                    allowlistedEgress: runtime.parserAllowlistedEgress,
-                    runtime: {
-                        knowledgeBase: runtime.knowledgeBase
+                    runtime,
+                    compilerVersion: "v6"
+                });
+                const mediated = applyV6ObservationMediation(parsed.compiledObservation, parsed.plannerView);
+                const artifactRef = buildArtifactRef(capture, parsed.compiledObservation);
+                sessionState.latestObservation = parsed.compiledObservation;
+                sessionState.latestObservationVerdict = mediated.verdict;
+                sessionState.observations.set(parsed.compiledObservation.observationId, parsed.compiledObservation);
+                const replayEventId = appendReplayEvent(sessionState, {
+                    kind: "artifact",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        observationId: parsed.compiledObservation.observationId,
+                        decision: mediated.verdict.decision,
+                        surfaceType: capture.surfaceType,
+                        providerId: "providerId" in capture ? capture.providerId ?? null : null,
+                        extractorIds: "extractionAttestation" in capture && capture.extractionAttestation
+                            ? [capture.extractionAttestation.extractorId]
+                            : []
                     }
                 });
-                const failClosedArtifact = applyV4FailClosedMediation(observation.compiledObservation, observation.plannerInput, "artifact");
-                const legacyArtifact = buildLegacyObservationCapture(capture);
-                const artifactResult = legacyArtifact !== undefined ? brokerArtifact(legacyArtifact, runtime) : undefined;
-                sessionState.latestObservation = observation.compiledObservation;
-                const effectiveArtifactVerdict = failClosedArtifact.failClosed
-                    ? failClosedArtifact.verdict
-                    : artifactResult?.verdict;
-                const effectiveArtifact = failClosedArtifact.failClosed && artifactResult?.artifact
-                    ? {
-                        ...artifactResult.artifact,
-                        toolActivationPolicy: "block",
-                        approvalRequiredForFollowOn: true
+                writeJson(response, 200, {
+                    compiledObservation: parsed.compiledObservation,
+                    plannerView: mediated.plannerView,
+                    artifactRef,
+                    mismatchSignals: artifactRef.mismatchSignals,
+                    artifactVerdict: mediated.verdict,
+                    replayEventId: replayEventId ?? randomUUID()
+                });
+                return;
+            }
+            if (requestUrl === "/v6/artifact/extract") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                const result = extractAttachmentGraphV6({
+                    ...payload.capture,
+                    sessionId: payload.sessionId,
+                    taskId: sessionState.session.taskId
+                }, runtime);
+                const replayEventId = appendReplayEvent(sessionState, {
+                    kind: "artifact",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        rootNodeCount: result.artifactGraph.rootNodeIds.length,
+                        blockedChildren: result.blockedChildren.length,
+                        unsupportedChildren: result.unsupportedChildren.length,
+                        extractorIds: result.extractionAttestations.map((entry) => entry.extractorId),
+                        decision: result.artifactVerdict.decision
                     }
-                    : artifactResult?.artifact;
-                const plannerInput = shouldReduceAuthority(sessionState, observation.compiledObservation)
-                    ? applyAuthorityReduction(sessionState, observation.compiledObservation, failClosedArtifact.plannerInput)
-                    : failClosedArtifact.plannerInput;
+                });
                 writeJson(response, 200, {
-                    compiledObservation: observation.compiledObservation,
-                    plannerInput,
-                    artifactVerdict: effectiveArtifactVerdict,
-                    artifact: effectiveArtifact
+                    ...result,
+                    replayEventId: replayEventId ?? randomUUID()
                 });
                 return;
             }
-            if (request.url === "/v4/memory/write") {
+            if (requestUrl === "/v6/memory/stage") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
-                const result = evaluateMemoryWriteV4(payload, sessionState?.session, runtime);
+                const result = stageMemoryRecordV6(payload, sessionState?.session);
+                let promotionAuthority;
                 if (sessionState && result.record) {
                     sessionState.memoryRecords.set(result.record.recordId, result.record);
+                    sessionState.memorySourceClasses.set(result.record.recordId, payload.sourceClass);
+                    promotionAuthority = mintMemoryPromotionCapabilityV6(sessionState.session, {
+                        recordId: result.record.recordId,
+                        sourceDigest: result.record.sourceDigest,
+                        sourceObservationId: result.record.sourceObservationId,
+                        key: result.record.key,
+                        valueDigest: result.record.sourceDigest ?? hashValue(result.record.value)
+                    });
+                    sessionState.authorities.set(promotionAuthority.capabilityId, promotionAuthority);
                 }
-                writeJson(response, 200, result);
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        recordId: result.record?.recordId ?? null,
+                        decision: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    promotionAuthority: promotionAuthority
+                        ? authorityCandidateFromDescriptor(promotionAuthority)
+                        : undefined,
+                    promotionTicket: promotionAuthority
+                        ? {
+                            ticketId: promotionAuthority.capabilityId,
+                            ticketDigest: promotionAuthority.capabilityDigest,
+                            semanticDigest: promotionAuthority.semanticDigest,
+                            recordId: result.record?.recordId,
+                            sourceClass: payload.sourceClass,
+                            expiresAt: promotionAuthority.expiresAt
+                        }
+                        : undefined
+                });
                 return;
             }
-            if (request.url === "/v4/memory/promote") {
+            if (requestUrl === "/v6/memory/promote") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 const record = sessionState?.memoryRecords.get(payload.recordId);
-                const approvalGrant = payload.approvalGrantId && sessionState
-                    ? sessionState.approvalGrants.get(payload.approvalGrantId)
-                    : undefined;
-                const result = promoteMemoryRecordV4(payload, sessionState?.session, record, approvalGrant);
+                const authority = sessionState?.authorities.get(payload.ticketId);
+                const approvalEnvelope = sessionState?.approvalEnvelopes.get(payload.approvalId);
+                const snapshotState = sessionState && record ? buildMemorySnapshotState(sessionState, record) : undefined;
+                const result = promoteMemoryRecordV6(payload, sessionState?.session, record, authority, approvalEnvelope, {
+                    sourceClass: record
+                        ? sessionState?.memorySourceClasses.get(record.recordId)
+                        : undefined,
+                    priorTrustedRecord: snapshotState?.snapshotRecord
+                });
                 if (sessionState && result.promotedRecord) {
-                    if (record && result.promotedRecord.snapshotId) {
+                    if (snapshotState && result.promotedRecord.snapshotId) {
                         sessionState.memorySnapshots.set(result.promotedRecord.snapshotId, {
-                            ...record,
-                            tier: "trusted_durable",
-                            summaryOnly: false,
-                            snapshotId: result.promotedRecord.snapshotId,
-                            rollbackPointId: result.promotedRecord.rollbackPointId
+                            ...snapshotState,
+                            snapshotId: result.promotedRecord.snapshotId
                         });
                     }
                     sessionState.memoryRecords.set(result.promotedRecord.recordId, result.promotedRecord);
+                    if (authority) {
+                        consumeAuthority(sessionState, authority);
+                    }
+                    if (approvalEnvelope) {
+                        sessionState.approvalEnvelopes.set(payload.approvalId, {
+                            ...approvalEnvelope,
+                            consumedAt: new Date().toISOString()
+                        });
+                    }
+                    sessionState.session = {
+                        ...sessionState.session,
+                        currentStep: sessionState.session.currentStep + 1
+                    };
                 }
-                writeJson(response, 200, result);
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        recordId: payload.recordId,
+                        decision: result.verdict.decision
+                    }
+                });
+                writeJson(response, 200, {
+                    ...result,
+                    approvalEnvelope: payload.approvalId && sessionState
+                        ? sessionState.approvalEnvelopes.get(payload.approvalId)
+                        : approvalEnvelope
+                });
                 return;
             }
-            if (request.url === "/v4/memory/rollback") {
+            if (requestUrl === "/v6/memory/rollback") {
                 const payload = await readJson(request);
                 const sessionState = findSessionState(sessions, payload.sessionId);
                 const record = sessionState?.memoryRecords.get(payload.recordId);
-                const snapshotRecord = sessionState?.memorySnapshots.get(payload.snapshotId);
-                const result = rollbackMemoryRecordV4(payload, sessionState?.session, record, snapshotRecord);
-                if (sessionState && result.restoredRecord) {
-                    sessionState.memoryRecords.set(result.restoredRecord.recordId, result.restoredRecord);
+                const snapshotState = sessionState?.memorySnapshots.get(payload.snapshotId);
+                const result = rollbackMemoryRecordV6(payload, sessionState?.session, record, {
+                    snapshotRecord: snapshotState?.snapshotRecord,
+                    baselineAbsent: snapshotState?.baselineAbsent
+                });
+                if (sessionState && result.verdict.decision === "ALLOW") {
+                    if (result.restoredRecord) {
+                        sessionState.memoryRecords.set(result.restoredRecord.recordId, result.restoredRecord);
+                    }
+                    else {
+                        sessionState.memoryRecords.delete(payload.recordId);
+                    }
                 }
+                appendReplayEvent(sessionState, {
+                    kind: "memory",
+                    actor: "sdk",
+                    payload: {
+                        route: requestUrl,
+                        recordId: payload.recordId,
+                        snapshotId: payload.snapshotId,
+                        decision: result.verdict.decision
+                    }
+                });
                 writeJson(response, 200, {
                     ...result,
                     rollbackEvent: result.verdict.decision === "ALLOW"
@@ -639,15 +956,35 @@ export async function createSafeBrowseServer(options = {}) {
                 });
                 return;
             }
+            if (requestUrl === "/v6/replay/bundle") {
+                const payload = await readJson(request);
+                const sessionState = findSessionState(sessions, payload.sessionId);
+                if (!sessionState) {
+                    writeJson(response, 404, { error: "unknown_session" });
+                    return;
+                }
+                writeJson(response, 200, buildReplayBundle(sessionState.replayEvents, runtime));
+                return;
+            }
             writeJson(response, 404, { error: "not_found" });
         }
         catch (error) {
+            logServerError(error);
             writeJson(response, 500, {
-                error: "server_error",
-                message: error instanceof Error ? error.message : String(error)
+                error: "server_error"
             });
         }
     });
+    const originalClose = server.close.bind(server);
+    server.close = ((callback) => {
+        clearInterval(parserHealthRefreshTimer);
+        return originalClose((error) => {
+            void Promise.allSettled([parserIsolationService.close(), modelGuardClient.close()]).finally(() => {
+                callback?.(error);
+            });
+        });
+    });
+    return server;
 }
 export async function startSafeBrowseDaemon(options = {}) {
     const server = await createSafeBrowseServer(options);