@sanctuary-framework/mcp-server 1.2.11 → 1.2.13

package/dist/cli.cjs

@@ -17625,11 +17625,426 @@ var init_handoff_log = __esm({
       }
     };
     COORDINATION_VIEW_AUDIT_OPS = {
+      /** v1.3 Omega-1: operator opened the chronological handoff list. */
       VIEW_OPENED: "operator_coordination_view_opened",
-      ENTRY_DRILLED: "operator_handoff_entry_drilled"
+      /** v1.3 Omega-1: operator drilled into a single handoff for detail. */
+      ENTRY_DRILLED: "operator_handoff_entry_drilled",
+      /**
+       * v1.3 Omega-3: operator opened the Workflows sibling-view (list of
+       * multi-handoff workflows grouped by `workflow-grouper`). Mirrors
+       * VIEW_OPENED's shape so the dashboard activity feed can group both
+       * as "operator coordination surfaces."
+       */
+      WORKFLOW_VIEW_OPENED: "operator_workflow_view_opened",
+      /**
+       * v1.3 Omega-3: operator drilled into a single workflow for its
+       * timeline + member-handoffs detail. Mirrors ENTRY_DRILLED's shape.
+       */
+      WORKFLOW_DRILLED: "operator_workflow_drilled",
+      /**
+       * v1.3 Omega-3: server-side state transition observed on a
+       * workflow (e.g., in_progress -> stalled). Emitted by the route
+       * layer after the state tracker diffs against its prior snapshot.
+       * Distinct from the operator-action events above: this records what
+       * the workflow itself is doing, not what the operator clicked.
+       */
+      WORKFLOW_STATE_CHANGED: "coordination_workflow_state_changed"
+    };
+  }
+});
+
+// src/coordination/context-transfer-extractor.ts
+async function extractContextTransferBreakdown(detail, deps = {}) {
+  const pathA = tryStructuredPath(detail);
+  if (pathA) return pathA;
+  const pathB = tryCompositionPath(detail);
+  if (pathB) return pathB;
+  const pathC = tryHeuristicPath(detail);
+  if (pathC.confidence >= 0.5 || !deps.substrateSelector) {
+    return pathC;
+  }
+  const assist = await tryLlmAssistPath(detail, deps.substrateSelector);
+  return assist ?? pathC;
+}
+function tryStructuredPath(detail) {
+  const details = sourceDetails(detail.source_audit_entry);
+  if (!details) return null;
+  const transferredRaw = details["transferred"];
+  const withheldRaw = details["withheld"];
+  if (transferredRaw === void 0 && withheldRaw === void 0) return null;
+  const transferred = parseExplicitContextItems(transferredRaw);
+  const withheld = parseExplicitContextItems(withheldRaw);
+  return {
+    handoff_entry_id: detail.entry.entry_id,
+    transferred,
+    withheld,
+    source: "structured",
+    confidence: 1
+  };
+}
+function tryCompositionPath(detail) {
+  const op = detail.source_audit_entry.operation;
+  if (!op.startsWith("composition_completed")) return null;
+  const details = sourceDetails(detail.source_audit_entry);
+  if (!details) return null;
+  const receiptRaw = details["receipt"];
+  const sourceStateRaw = details["source_state_snapshot"];
+  if (receiptRaw === void 0) return null;
+  const transferred = parseExplicitContextItems(receiptRaw);
+  const withheld = [];
+  if (Array.isArray(sourceStateRaw)) {
+    const transferredKeys = new Set(
+      transferred.map((t) => `${t.category}:${t.summary}`)
+    );
+    for (const item of parseExplicitContextItems(sourceStateRaw)) {
+      const key = `${item.category}:${item.summary}`;
+      if (!transferredKeys.has(key)) withheld.push(item);
+    }
+  }
+  return {
+    handoff_entry_id: detail.entry.entry_id,
+    transferred,
+    withheld,
+    source: "composition",
+    confidence: 0.9
+  };
+}
+function tryHeuristicPath(detail) {
+  const entry = detail.entry;
+  const audit = detail.source_audit_entry;
+  const details = sourceDetails(audit);
+  if (audit.operation === "cross_harness_approval_aggregated") {
+    const ruleId = optString2(details, "policy_rule_id");
+    if (ruleId) {
+      const category = categoryFromPolicyRuleId(ruleId);
+      const summary = `${ruleId} (${entry.source_agent_id} -> operator)`;
+      return {
+        handoff_entry_id: entry.entry_id,
+        transferred: [
+          {
+            category,
+            summary: truncate(summary, SUMMARY_MAX_CHARS),
+            size_hint: "minimal"
+          }
+        ],
+        withheld: [],
+        source: "heuristic",
+        confidence: 0.5
+      };
+    }
+  }
+  if (audit.operation === "v1.1_local_handoff") {
+    const reasonClass = optString2(details, "reason_class");
+    const newStatus = optString2(details, "new_status");
+    const previousStatus = optString2(details, "previous_status");
+    const transferred = [];
+    const withheld = [];
+    if (newStatus === "denied" || newStatus === "failed") {
+      withheld.push({
+        category: "other",
+        summary: truncate(
+          `handoff ${newStatus}${reasonClass ? ` (${reasonClass})` : ""}: ${entry.source_agent_id} -> ${entry.target_agent_id}`,
+          SUMMARY_MAX_CHARS
+        ),
+        size_hint: "minimal"
+      });
+    } else if (newStatus === "accepted" || newStatus === "completed") {
+      transferred.push({
+        category: "other",
+        summary: truncate(
+          `handoff ${newStatus}${previousStatus ? ` (from ${previousStatus})` : ""}: ${entry.source_agent_id} -> ${entry.target_agent_id}`,
+          SUMMARY_MAX_CHARS
+        ),
+        size_hint: "small"
+      });
+    } else {
+      transferred.push({
+        category: "other",
+        summary: truncate(
+          `handoff ${entry.source_agent_id} -> ${entry.target_agent_id}${newStatus ? ` (${newStatus})` : ""}`,
+          SUMMARY_MAX_CHARS
+        ),
+        size_hint: "minimal"
+      });
+    }
+    return {
+      handoff_entry_id: entry.entry_id,
+      transferred,
+      withheld,
+      source: "heuristic",
+      confidence: reasonClass || newStatus ? 0.5 : 0.3
+    };
+  }
+  return {
+    handoff_entry_id: entry.entry_id,
+    transferred: [
+      {
+        category: "other",
+        summary: truncate(
+          `handoff ${entry.source_agent_id} -> ${entry.target_agent_id}`,
+          SUMMARY_MAX_CHARS
+        ),
+        size_hint: "minimal"
+      }
+    ],
+    withheld: [],
+    source: "heuristic",
+    confidence: 0.3
+  };
+}
+async function tryLlmAssistPath(detail, selector) {
+  const entry = detail.entry;
+  const audit = detail.source_audit_entry;
+  const probe = `event=${audit.operation} sender=${entry.source_agent_id} target=${entry.target_agent_id} summary=${entry.context_transfer_summary}`;
+  try {
+    const response = await selector.invokeClassify("sentinel-scoring", {
+      kind: "classify",
+      items: [probe],
+      categories: [...CATEGORY_VALUES]
+    });
+    if (response.body.kind !== "classify") return null;
+    const top = response.body.results[0];
+    if (!top || !isCategory(top.category) || top.confidence < 0.4) {
+      return null;
+    }
+    return {
+      handoff_entry_id: entry.entry_id,
+      transferred: [
+        {
+          category: top.category,
+          summary: truncate(
+            `LLM-classified handoff ${entry.source_agent_id} -> ${entry.target_agent_id}: ${top.category} (confidence ${top.confidence.toFixed(2)})`,
+            SUMMARY_MAX_CHARS
+          ),
+          size_hint: "minimal"
+        }
+      ],
+      withheld: [],
+      source: "llm-assist",
+      confidence: 0.6
+    };
+  } catch {
+    return null;
+  }
+}
+function sourceDetails(audit) {
+  return audit.details;
+}
+function optString2(details, key) {
+  if (!details) return null;
+  const value = details[key];
+  if (typeof value !== "string" || value.length === 0) return null;
+  return value;
+}
+function isCategory(value) {
+  return CATEGORY_VALUES.includes(value);
+}
+function truncate(s, cap) {
+  return s.length <= cap ? s : `${s.slice(0, cap - 3)}...`;
+}
+function parseExplicitContextItems(raw) {
+  if (raw === null || raw === void 0) return [];
+  if (Array.isArray(raw)) {
+    const out = [];
+    for (const entry of raw) {
+      if (typeof entry === "string") {
+        out.push({
+          category: "other",
+          summary: truncate(entry, SUMMARY_MAX_CHARS),
+          size_hint: "minimal"
+        });
+        continue;
+      }
+      if (entry && typeof entry === "object") {
+        const obj = entry;
+        const category = isCategoryValue(obj["category"]) ? obj["category"] : "other";
+        const summary = typeof obj["summary"] === "string" ? truncate(obj["summary"], SUMMARY_MAX_CHARS) : "(unspecified)";
+        const sizeHint = isSizeHintValue(obj["size_hint"]) ? obj["size_hint"] : "minimal";
+        out.push({ category, summary, size_hint: sizeHint });
+      }
+    }
+    return out;
+  }
+  if (typeof raw === "object" && raw !== null) {
+    const out = [];
+    for (const [k, v] of Object.entries(raw)) {
+      const category = isCategoryValue(k) ? k : "other";
+      if (Array.isArray(v)) {
+        for (const item of v) {
+          if (typeof item === "string") {
+            out.push({
+              category,
+              summary: truncate(item, SUMMARY_MAX_CHARS),
+              size_hint: "minimal"
+            });
+          }
+        }
+      }
+    }
+    return out;
+  }
+  return [];
+}
+function isCategoryValue(v) {
+  return typeof v === "string" && CATEGORY_VALUES.includes(v);
+}
+function isSizeHintValue(v) {
+  return typeof v === "string" && (v === "minimal" || v === "small" || v === "medium" || v === "large");
+}
+function categoryFromPolicyRuleId(ruleId) {
+  const lower = ruleId.toLowerCase();
+  if (lower.includes("credential") || lower.includes("broker_secret")) {
+    return "credentials";
+  }
+  if (lower.includes("memory") || lower.includes("state_read")) {
+    return "memory";
+  }
+  if (lower.includes("plan")) {
+    return "plans";
+  }
+  if (lower.includes("export") || lower.includes("output")) {
+    return "outputs";
+  }
+  if (lower.includes("audit")) {
+    return "audit-refs";
+  }
+  return "other";
+}
+var SUMMARY_MAX_CHARS, CATEGORY_VALUES, CONTEXT_TRANSFER_AUDIT_OPS;
+var init_context_transfer_extractor = __esm({
+  "src/coordination/context-transfer-extractor.ts"() {
+    SUMMARY_MAX_CHARS = 240;
+    CATEGORY_VALUES = [
+      "memory",
+      "credentials",
+      "plans",
+      "outputs",
+      "audit-refs",
+      "other"
+    ];
+    CONTEXT_TRANSFER_AUDIT_OPS = {
+      DECODED: "operator_handoff_context_transfer_decoded"
     };
   }
 });
+function groupHandoffsIntoWorkflows(handoffs, opts) {
+  if (handoffs.length === 0) return [];
+  const now = opts?.now ?? /* @__PURE__ */ new Date();
+  const linkedGroups = /* @__PURE__ */ new Map();
+  const unlinked = [];
+  for (const h of handoffs) {
+    if (h.workflow_link !== null && h.workflow_link.length > 0) {
+      let bucket = linkedGroups.get(h.workflow_link);
+      if (!bucket) {
+        bucket = [];
+        linkedGroups.set(h.workflow_link, bucket);
+      }
+      bucket.push(h);
+    } else {
+      unlinked.push(h);
+    }
+  }
+  const sortedUnlinked = [...unlinked].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const heuristicChains = [];
+  for (const h of sortedUnlinked) {
+    const joinedIdx = findExtendableChain(heuristicChains, h);
+    if (joinedIdx !== null) {
+      heuristicChains[joinedIdx].push(h);
+    } else {
+      heuristicChains.push([h]);
+    }
+  }
+  const workflows = [];
+  for (const members of linkedGroups.values()) {
+    workflows.push(materialize(members, now));
+  }
+  for (const members of heuristicChains) {
+    workflows.push(materialize(members, now));
+  }
+  workflows.sort(
+    (a, b) => a.last_activity_at < b.last_activity_at ? 1 : -1
+  );
+  return workflows;
+}
+function determineWorkflowState(members, now) {
+  if (members.length === 0) return "unknown";
+  const sorted = [...members].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const last = sorted[sorted.length - 1];
+  const root = sorted[0];
+  const lastMs = Date.parse(last.observed_at);
+  if (!Number.isFinite(lastMs)) return "unknown";
+  if (last.target_agent_id === OPERATOR_PSEUDO_AGENT) {
+    return "completed";
+  }
+  if (sorted.length > CYCLE_COMPLETION_MIN_HOPS && last.target_agent_id === root.source_agent_id) {
+    return "completed";
+  }
+  const ageMs = now.getTime() - lastMs;
+  if (ageMs > STALL_THRESHOLD_MS) {
+    return "stalled";
+  }
+  return "in_progress";
+}
+function workflowIdFromRoot(rootEntryId) {
+  return crypto.createHash("sha256").update(`workflow:${rootEntryId}`).digest("hex").slice(0, 32);
+}
+function findExtendableChain(chains, h) {
+  const hMs = Date.parse(h.observed_at);
+  if (!Number.isFinite(hMs)) return null;
+  let bestIdx = null;
+  let bestGapMs = Number.POSITIVE_INFINITY;
+  for (let i = 0; i < chains.length; i += 1) {
+    const chain = chains[i];
+    const last = chain[chain.length - 1];
+    const lastMs = Date.parse(last.observed_at);
+    if (!Number.isFinite(lastMs)) continue;
+    const gapMs = Math.abs(hMs - lastMs);
+    if (gapMs > HEURISTIC_WINDOW_MS) continue;
+    if (!sharesAgent(last, h)) continue;
+    if (gapMs < bestGapMs) {
+      bestGapMs = gapMs;
+      bestIdx = i;
+    }
+  }
+  return bestIdx;
+}
+function sharesAgent(a, b) {
+  return a.source_agent_id === b.source_agent_id || a.source_agent_id === b.target_agent_id || a.target_agent_id === b.source_agent_id || a.target_agent_id === b.target_agent_id;
+}
+function materialize(members, now) {
+  const sorted = [...members].sort(
+    (a, b) => a.observed_at < b.observed_at ? -1 : 1
+  );
+  const root = sorted[0];
+  const last = sorted[sorted.length - 1];
+  const involved = /* @__PURE__ */ new Set();
+  for (const h of sorted) {
+    if (h.source_agent_id) involved.add(h.source_agent_id);
+    if (h.target_agent_id) involved.add(h.target_agent_id);
+  }
+  return {
+    workflow_id: workflowIdFromRoot(root.entry_id),
+    root_handoff: root,
+    member_handoffs: sorted,
+    state: determineWorkflowState(sorted, now),
+    started_at: root.observed_at,
+    last_activity_at: last.observed_at,
+    involved_agents: [...involved].sort()
+  };
+}
+var HEURISTIC_WINDOW_MS, STALL_THRESHOLD_MS, CYCLE_COMPLETION_MIN_HOPS;
+var init_workflow_grouper = __esm({
+  "src/coordination/workflow-grouper.ts"() {
+    init_handoff_log();
+    HEURISTIC_WINDOW_MS = 5 * 60 * 1e3;
+    STALL_THRESHOLD_MS = 2 * 60 * 60 * 1e3;
+    CYCLE_COMPLETION_MIN_HOPS = 2;
+  }
+});
 
 // src/coordination/handoff-routes.ts
 function writeJSON6(res, status, payload) {
@@ -17653,6 +18068,101 @@ function matchEntryRoute2(path) {
   if (rest.includes("/")) return null;
   return { entryId: decodeURIComponent(rest) };
 }
+function matchWorkflowRoute(path) {
+  const prefix = `${COORDINATION_WORKFLOWS_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest === "stream") return null;
+  if (rest.includes("/")) return null;
+  return { workflowId: decodeURIComponent(rest) };
+}
+async function computeWorkflowsAndTrackTransitions(deps) {
+  const handoffs = await deps.handoffLog.query({ limit: 500 });
+  const workflows = groupHandoffsIntoWorkflows(handoffs, {
+    ...deps.now !== void 0 ? { now: deps.now() } : {}
+  });
+  const transitions = deps.workflowStateTracker ? deps.workflowStateTracker.observe(workflows) : [];
+  for (const change of transitions) {
+    deps.auditLog.append(
+      "l2",
+      COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_STATE_CHANGED,
+      deps.operatorId,
+      {
+        fortress_id: deps.handoffLog.getFortressId(),
+        workflow_id: change.workflow_id,
+        previous_state: change.previous_state,
+        new_state: change.new_state
+      }
+    );
+  }
+  return { workflows, transitions };
+}
+function filterWorkflowList(workflows, opts) {
+  let filtered = workflows;
+  if (opts.state) {
+    filtered = filtered.filter((w) => w.state === opts.state);
+  }
+  if (opts.agentId) {
+    filtered = filtered.filter((w) => w.involved_agents.includes(opts.agentId));
+  }
+  if (opts.since) {
+    filtered = filtered.filter((w) => w.last_activity_at >= opts.since);
+  }
+  return filtered.slice(0, opts.limit);
+}
+function isWorkflowState(value) {
+  return value === "in_progress" || value === "completed" || value === "stalled" || value === "unknown";
+}
+async function handleWorkflowStream(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await computeWorkflowsAndTrackTransitions(deps);
+  res.write(
+    `event: workflow_snapshot
+data: ${JSON.stringify({ workflows: initial.workflows })}
+
+`
+  );
+  if (initial.transitions.length > 0) {
+    res.write(
+      `event: workflow_state_changed
+data: ${JSON.stringify({ transitions: initial.transitions })}
+
+`
+    );
+  }
+  const unsubscribe = deps.events.subscribe(() => {
+    void (async () => {
+      try {
+        const tick = await computeWorkflowsAndTrackTransitions(deps);
+        res.write(
+          `event: workflow_snapshot
+data: ${JSON.stringify({ workflows: tick.workflows })}
+
+`
+        );
+        if (tick.transitions.length > 0) {
+          res.write(
+            `event: workflow_state_changed
+data: ${JSON.stringify({ transitions: tick.transitions })}
+
+`
+          );
+        }
+      } catch {
+      }
+    })();
+  });
+  const cleanup = () => {
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
 async function handleStream3(deps, res) {
   res.writeHead(200, {
     "Content-Type": "text/event-stream",
@@ -17736,6 +18246,67 @@ async function handleCoordinationRoute(deps, req, res) {
       writeJSON6(res, 200, { ok: true, data: { entries } });
       return true;
     }
+    if (method === "GET" && path === `${COORDINATION_WORKFLOWS_PREFIX}/stream`) {
+      await handleWorkflowStream(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === COORDINATION_WORKFLOWS_PREFIX) {
+      const limit = parseLimit4(
+        url.searchParams.get("limit"),
+        COORDINATION_LIST_DEFAULT_LIMIT,
+        COORDINATION_LIST_MAX_LIMIT
+      );
+      const rawState = url.searchParams.get("state");
+      const state = rawState && isWorkflowState(rawState) ? rawState : void 0;
+      const since = url.searchParams.get("since") ?? void 0;
+      const agentId = url.searchParams.get("agent_id") ?? void 0;
+      const computed = await computeWorkflowsAndTrackTransitions(deps);
+      const filtered = filterWorkflowList(computed.workflows, {
+        ...state !== void 0 ? { state } : {},
+        ...agentId !== void 0 ? { agentId } : {},
+        ...since !== void 0 ? { since } : {},
+        limit
+      });
+      deps.auditLog.append(
+        "l2",
+        COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_VIEW_OPENED,
+        deps.operatorId,
+        {
+          fortress_id: deps.handoffLog.getFortressId(),
+          result_count: filtered.length,
+          ...state !== void 0 ? { state } : {},
+          ...agentId !== void 0 ? { agent_id: agentId } : {},
+          ...since !== void 0 ? { since } : {}
+        }
+      );
+      writeJSON6(res, 200, { ok: true, data: { workflows: filtered } });
+      return true;
+    }
+    const workflowMatch = matchWorkflowRoute(path);
+    if (method === "GET" && workflowMatch) {
+      const computed = await computeWorkflowsAndTrackTransitions(deps);
+      const wf = computed.workflows.find(
+        (w) => w.workflow_id === workflowMatch.workflowId
+      );
+      if (!wf) {
+        writeJSON6(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      deps.auditLog.append(
+        "l2",
+        COORDINATION_VIEW_AUDIT_OPS.WORKFLOW_DRILLED,
+        deps.operatorId,
+        {
+          fortress_id: deps.handoffLog.getFortressId(),
+          workflow_id: wf.workflow_id,
+          state: wf.state,
+          member_count: wf.member_handoffs.length,
+          involved_agent_count: wf.involved_agents.length
+        }
+      );
+      writeJSON6(res, 200, { ok: true, data: { workflow: wf } });
+      return true;
+    }
     const entryMatch = matchEntryRoute2(path);
     if (method === "GET" && entryMatch) {
       const detail = await deps.handoffLog.getEntry(entryMatch.entryId);
@@ -17755,7 +18326,29 @@ async function handleCoordinationRoute(deps, req, res) {
           target_agent_id: detail.entry.target_agent_id
         }
       );
-      writeJSON6(res, 200, { ok: true, data: detail });
+      let breakdown = null;
+      try {
+        breakdown = await extractContextTransferBreakdown(
+          detail,
+          deps.contextTransfer ?? {}
+        );
+        deps.auditLog.append(
+          "l2",
+          CONTEXT_TRANSFER_AUDIT_OPS.DECODED,
+          deps.operatorId,
+          {
+            fortress_id: deps.handoffLog.getFortressId(),
+            entry_id: detail.entry.entry_id,
+            extractor_path: breakdown.source,
+            confidence: breakdown.confidence,
+            transferred_count: breakdown.transferred.length,
+            withheld_count: breakdown.withheld.length
+          }
+        );
+      } catch {
+      }
+      const responseData = breakdown !== null ? { ...detail, context_transfer_breakdown: breakdown } : detail;
+      writeJSON6(res, 200, { ok: true, data: responseData });
       return true;
     }
     writeJSON6(res, 404, { ok: false, error: "not_found", path });
@@ -17766,13 +18359,16 @@ async function handleCoordinationRoute(deps, req, res) {
     return true;
   }
 }
-var COORDINATION_API_PREFIX, COORDINATION_HANDOFFS_PREFIX, COORDINATION_LIST_DEFAULT_LIMIT, COORDINATION_LIST_MAX_LIMIT, HandoffEventBridge;
+var COORDINATION_API_PREFIX, COORDINATION_HANDOFFS_PREFIX, COORDINATION_WORKFLOWS_PREFIX, COORDINATION_LIST_DEFAULT_LIMIT, COORDINATION_LIST_MAX_LIMIT, HandoffEventBridge;
 var init_handoff_routes = __esm({
   "src/coordination/handoff-routes.ts"() {
     init_auth_middleware();
     init_handoff_log();
+    init_context_transfer_extractor();
+    init_workflow_grouper();
     COORDINATION_API_PREFIX = "/api/coordination";
     COORDINATION_HANDOFFS_PREFIX = "/api/coordination/handoffs";
+    COORDINATION_WORKFLOWS_PREFIX = "/api/coordination/workflows";
     COORDINATION_LIST_DEFAULT_LIMIT = 50;
     COORDINATION_LIST_MAX_LIMIT = 500;
     HandoffEventBridge = class {
@@ -17891,6 +18487,8 @@ var init_dashboard = __esm({
        */
       handoffLog = null;
       handoffEventBridge = null;
+      handoffContextTransfer = null;
+      workflowStateTracker = null;
       handoffAuditLog = null;
       handoffOperatorId = null;
       constructor(config) {
@@ -17971,6 +18569,8 @@ var init_dashboard = __esm({
         this.handoffEventBridge = opts.eventBridge ?? null;
         this.handoffAuditLog = opts.auditLog ?? null;
         this.handoffOperatorId = opts.operatorId ?? null;
+        this.handoffContextTransfer = opts.contextTransfer ?? null;
+        this.workflowStateTracker = opts.workflowStateTracker ?? null;
       }
       /**
        * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
@@ -18028,7 +18628,9 @@ var init_dashboard = __esm({
             handoffLog: this.handoffLog,
             auditLog: this.handoffAuditLog,
             operatorId: this.handoffOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
-            events: this.handoffEventBridge
+            events: this.handoffEventBridge,
+            ...this.handoffContextTransfer !== null ? { contextTransfer: this.handoffContextTransfer } : {},
+            ...this.workflowStateTracker !== null ? { workflowStateTracker: this.workflowStateTracker } : {}
           },
           req,
           res
@@ -22312,46 +22914,346 @@ var init_sentinel_dispatcher = __esm({
   }
 });
 
-// src/anomaly-detection/types.ts
-var init_types4 = __esm({
-  "src/anomaly-detection/types.ts"() {
-  }
-});
-var ANOMALY_AUDIT_OPS, DEFAULT_TICK_INTERVAL_MS2, AnomalyPipelineDispatcher;
-var init_anomaly_pipeline = __esm({
-  "src/anomaly-detection/anomaly-pipeline.ts"() {
-    init_types4();
-    ANOMALY_AUDIT_OPS = {
-      DETECTOR_REGISTERED: "anomaly_detector_registered",
-      DETECTOR_UNREGISTERED: "anomaly_detector_unregistered",
-      FINDING_EMITTED: "anomaly_finding_emitted",
-      EVALUATION_FAILED: "anomaly_evaluation_failed",
-      TRAINING_COMPLETED: "anomaly_training_completed",
-      TRAINING_FAILED: "anomaly_training_failed"
-    };
-    DEFAULT_TICK_INTERVAL_MS2 = 6e4;
-    AnomalyPipelineDispatcher = class {
-      findingStore;
-      auditLog;
+// src/anomaly-detection/classifier-state-store.ts
+function stateKey(classifierId, agentId) {
+  return `${ANOMALY_CLASSIFIER_STATE_KEY_PREFIX}${classifierId}.${agentId}`;
+}
+function aadFor(classifierId, agentId) {
+  return `${classifierId}|${agentId}`;
+}
+var ANOMALY_CLASSIFIER_STATE_NAMESPACE, ANOMALY_CLASSIFIER_STATE_KEY_PREFIX, HKDF_INFO3, MAX_STATE_BYTES, ClassifierStateStore;
+var init_classifier_state_store = __esm({
+  "src/anomaly-detection/classifier-state-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    ANOMALY_CLASSIFIER_STATE_NAMESPACE = "_anomaly_classifier_state";
+    ANOMALY_CLASSIFIER_STATE_KEY_PREFIX = "state.";
+    HKDF_INFO3 = "l2-anomaly-classifier-state-v1";
+    MAX_STATE_BYTES = 256 * 1024;
+    ClassifierStateStore = class {
       storage;
-      masterKey;
+      encryptionKey;
       fortressId;
-      identityId;
       now;
-      tickIntervalMs;
-      detectors = /* @__PURE__ */ new Map();
-      listeners = /* @__PURE__ */ new Set();
-      tickTimer = null;
-      tickInFlight = false;
-      constructor(deps) {
-        this.findingStore = deps.findingStore;
-        this.auditLog = deps.auditLog;
-        this.storage = deps.storage;
-        this.masterKey = deps.masterKey;
-        this.fortressId = deps.fortressId;
-        this.identityId = deps.identityId;
-        this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
-        this.tickIntervalMs = deps.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS2;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
+        this.fortressId = opts.fortressId;
+        this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      async saveState(classifierId, agentId, state) {
+        const persisted = {
+          version: 1,
+          classifier_id: classifierId,
+          agent_id: agentId,
+          fortress_id: this.fortressId,
+          saved_at: this.now().toISOString(),
+          state
+        };
+        const aadString = aadFor(classifierId, agentId);
+        const aad = stringToBytes(aadString);
+        const plaintext = stringToBytes(JSON.stringify(persisted));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          ANOMALY_CLASSIFIER_STATE_NAMESPACE,
+          stateKey(classifierId, agentId),
+          stringToBytes(JSON.stringify(envelope))
+        );
+      }
+      async loadState(classifierId, agentId) {
+        const key = stateKey(classifierId, agentId);
+        let raw;
+        try {
+          raw = await this.storage.read(
+            ANOMALY_CLASSIFIER_STATE_NAMESPACE,
+            key
+          );
+        } catch {
+          return null;
+        }
+        if (!raw) return null;
+        if (raw.length > MAX_STATE_BYTES) return null;
+        try {
+          const aad = stringToBytes(aadFor(classifierId, agentId));
+          const envelope = JSON.parse(bytesToString(raw));
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const persisted = JSON.parse(
+            bytesToString(plaintext)
+          );
+          if (persisted.version !== 1) return null;
+          if (persisted.classifier_id !== classifierId) return null;
+          if (persisted.agent_id !== agentId) return null;
+          if (persisted.fortress_id !== this.fortressId) return null;
+          return persisted.state;
+        } catch {
+          return null;
+        }
+      }
+      /** Delete a single classifier-agent state record. */
+      async deleteState(classifierId, agentId) {
+        const key = stateKey(classifierId, agentId);
+        const existed = await this.storage.exists(
+          ANOMALY_CLASSIFIER_STATE_NAMESPACE,
+          key
+        );
+        if (!existed) return false;
+        try {
+          await this.storage.delete(ANOMALY_CLASSIFIER_STATE_NAMESPACE, key);
+        } catch {
+          return false;
+        }
+        return true;
+      }
+      /**
+       * List the (classifier_id, agent_id) tuples currently persisted.
+       * Returns the agent ids for one classifier when classifierId is
+       * given.
+       */
+      async listAgents(classifierId) {
+        const metas = await this.storage.list(
+          ANOMALY_CLASSIFIER_STATE_NAMESPACE,
+          ANOMALY_CLASSIFIER_STATE_KEY_PREFIX
+        );
+        const prefix = `${ANOMALY_CLASSIFIER_STATE_KEY_PREFIX}${classifierId}.`;
+        const out = [];
+        for (const meta of metas) {
+          if (!meta.key.startsWith(prefix)) continue;
+          out.push(meta.key.slice(prefix.length));
+        }
+        return out;
+      }
+    };
+  }
+});
+
+// src/anomaly-detection/classifiers/cusum.ts
+var CUSUM_CLASSIFIER_ID;
+var init_cusum = __esm({
+  "src/anomaly-detection/classifiers/cusum.ts"() {
+    init_classifier_state_store();
+    CUSUM_CLASSIFIER_ID = "cusum";
+  }
+});
+
+// src/anomaly-detection/classifiers/psi.ts
+var PSI_CLASSIFIER_ID;
+var init_psi = __esm({
+  "src/anomaly-detection/classifiers/psi.ts"() {
+    init_classifier_state_store();
+    PSI_CLASSIFIER_ID = "psi";
+  }
+});
+
+// src/anomaly-detection/types.ts
+function severityFromAnomalyScore(score) {
+  if (!Number.isFinite(score)) return null;
+  if (score < 1) return null;
+  if (score < 3) return "info";
+  if (score < 6) return "warn";
+  return "alert";
+}
+function buildAnomalyFinding(detector, classifier, vector, prediction, severity) {
+  const summary = formatAnomalySummary(
+    detector,
+    classifier,
+    vector,
+    prediction,
+    severity
+  );
+  return {
+    finding_id: "",
+    sentinel_id: `${ANOMALY_SENTINEL_ID_PREFIX}${detector.detectorId}`,
+    severity,
+    summary,
+    details: {
+      detector_id: detector.detectorId,
+      classifier_id: classifier.classifierId,
+      anomaly_score: prediction.anomaly_score,
+      window_label: vector.window_label,
+      observed_features: vector.features,
+      feature_contributions: prediction.feature_contributions,
+      explanation: prediction.explanation
+    },
+    observed_at: vector.observed_at,
+    agent_id: vector.agent_id,
+    evidence_audit_ids: [],
+    fortress_id: ""
+  };
+}
+function formatAnomalySummary(detector, classifier, vector, prediction, severity) {
+  const top = prediction.explanation.slice(0, 3).join("; ");
+  return `${detector.detectorId}/${classifier.classifierId} ${severity}: agent ${vector.agent_id} drifted ${prediction.anomaly_score.toFixed(2)} sigma from baseline. Top contributors: ${top || "(none)"}.`;
+}
+var AnomalyDetector, ANOMALY_SENTINEL_ID_PREFIX;
+var init_types4 = __esm({
+  "src/anomaly-detection/types.ts"() {
+    AnomalyDetector = class {
+      /**
+       * Additional classifiers attached post-construction. Keyed by
+       * classifierId so subscribe/unsubscribe is idempotent. Primary
+       * `classifier` is NOT stored here.
+       */
+      additionalClassifiers = /* @__PURE__ */ new Map();
+      /**
+       * Attach an additional classifier. Idempotent: a second call with
+       * the same classifierId returns false. The primary classifier
+       * cannot be re-attached as additional (returns false). The
+       * dispatcher emits ANOMALY_CLASSIFIER_SUBSCRIBED on success.
+       */
+      addClassifier(classifier) {
+        if (classifier.classifierId === this.classifier.classifierId) return false;
+        if (this.additionalClassifiers.has(classifier.classifierId)) return false;
+        this.additionalClassifiers.set(classifier.classifierId, classifier);
+        return true;
+      }
+      /**
+       * Detach an additional classifier by id. Cannot remove the primary
+       * (returns false). Returns true when an existing additional
+       * classifier was removed. The dispatcher emits
+       * ANOMALY_CLASSIFIER_UNSUBSCRIBED on success.
+       */
+      removeClassifier(classifierId) {
+        if (classifierId === this.classifier.classifierId) return false;
+        return this.additionalClassifiers.delete(classifierId);
+      }
+      /** List every classifier id attached: primary first, then additionals. */
+      listClassifierIds() {
+        return [
+          this.classifier.classifierId,
+          ...this.additionalClassifiers.keys()
+        ];
+      }
+      /**
+       * Return every attached classifier: primary first, then additionals
+       * in insertion order. Used by evaluate() and the dispatcher's train
+       * + audit emission.
+       */
+      getAllClassifiers() {
+        return [this.classifier, ...this.additionalClassifiers.values()];
+      }
+      /**
+       * Bind the detector to a fortress context. Default stores it on
+       * `this`; subclasses with priming logic override.
+       */
+      async subscribe(context) {
+        this.context = context;
+      }
+      async unsubscribe() {
+        this.context = void 0;
+        this.additionalClassifiers.clear();
+      }
+      /**
+       * One evaluation pass. Default impl: extract -> for each classifier
+       * attached, predict (drift against that classifier's prior
+       * baseline) -> observe (only when the prediction is in-baseline,
+       * so outliers do not contaminate the rolling baseline and pull
+       * future predictions toward themselves) -> emit findings above
+       * threshold. Multi-classifier evaluation is per-classifier: each
+       * decides independently whether to absorb or emit. Subclasses with
+       * custom routing override.
+       *
+       * Predict-then-observe (with conditional observe) is the standard
+       * online anomaly-detection pattern. Chi-1 spawn prompt called for
+       * observe-then-predict; CTO call: changed to predict-then-observe
+       * because observe-then-predict measures the sample against itself
+       * after one-sample contamination, which is structurally incorrect
+       * for drift detection. Chi-2 preserves that invariant on a per-
+       * classifier basis (each classifier's observe is conditional on its
+       * own predict result).
+       */
+      async evaluate() {
+        const ctx = this.requireContext();
+        const vectors = await this.featureExtract(ctx);
+        const findings = [];
+        const classifiers = this.getAllClassifiers();
+        for (const vector of vectors) {
+          for (const classifier of classifiers) {
+            const prediction = await classifier.predict(vector);
+            if (!prediction.baseline_ready) {
+              await classifier.observe(vector);
+              continue;
+            }
+            const severity = severityFromAnomalyScore(prediction.anomaly_score);
+            if (severity === null) {
+              await classifier.observe(vector);
+              continue;
+            }
+            findings.push(
+              buildAnomalyFinding(this, classifier, vector, prediction, severity)
+            );
+          }
+        }
+        return findings;
+      }
+      context;
+      requireContext() {
+        if (!this.context) {
+          throw new Error(
+            `anomaly-detector ${this.detectorId}: evaluate() called before subscribe()`
+          );
+        }
+        return this.context;
+      }
+    };
+    ANOMALY_SENTINEL_ID_PREFIX = "anomaly:";
+  }
+});
+function classifierSpecificAuditOp(classifierId) {
+  if (classifierId === null) return null;
+  if (classifierId === CUSUM_CLASSIFIER_ID) {
+    return ANOMALY_AUDIT_OPS.CUSUM_DRIFT_DETECTED;
+  }
+  if (classifierId === PSI_CLASSIFIER_ID) {
+    return ANOMALY_AUDIT_OPS.PSI_DISTRIBUTION_SHIFT_DETECTED;
+  }
+  return null;
+}
+var ANOMALY_AUDIT_OPS, DEFAULT_TICK_INTERVAL_MS2, AnomalyPipelineDispatcher;
+var init_anomaly_pipeline = __esm({
+  "src/anomaly-detection/anomaly-pipeline.ts"() {
+    init_cusum();
+    init_psi();
+    init_types4();
+    ANOMALY_AUDIT_OPS = {
+      DETECTOR_REGISTERED: "anomaly_detector_registered",
+      DETECTOR_UNREGISTERED: "anomaly_detector_unregistered",
+      FINDING_EMITTED: "anomaly_finding_emitted",
+      EVALUATION_FAILED: "anomaly_evaluation_failed",
+      TRAINING_COMPLETED: "anomaly_training_completed",
+      TRAINING_FAILED: "anomaly_training_failed",
+      /** Chi-2: a classifier was attached to an existing detector. */
+      CLASSIFIER_SUBSCRIBED: "anomaly_classifier_subscribed",
+      /** Chi-2: a classifier was detached from an existing detector. */
+      CLASSIFIER_UNSUBSCRIBED: "anomaly_classifier_unsubscribed",
+      /** Chi-2: CUSUM-flagged mean-shift drift on a per-agent feature. */
+      CUSUM_DRIFT_DETECTED: "anomaly_cusum_drift_detected",
+      /** Chi-2: PSI-flagged distribution shift on a per-agent feature. */
+      PSI_DISTRIBUTION_SHIFT_DETECTED: "anomaly_psi_distribution_shift_detected"
+    };
+    DEFAULT_TICK_INTERVAL_MS2 = 6e4;
+    AnomalyPipelineDispatcher = class {
+      findingStore;
+      auditLog;
+      storage;
+      masterKey;
+      fortressId;
+      identityId;
+      now;
+      tickIntervalMs;
+      detectors = /* @__PURE__ */ new Map();
+      listeners = /* @__PURE__ */ new Set();
+      tickTimer = null;
+      tickInFlight = false;
+      constructor(deps) {
+        this.findingStore = deps.findingStore;
+        this.auditLog = deps.auditLog;
+        this.storage = deps.storage;
+        this.masterKey = deps.masterKey;
+        this.fortressId = deps.fortressId;
+        this.identityId = deps.identityId;
+        this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+        this.tickIntervalMs = deps.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS2;
       }
       onEvent(listener) {
         this.listeners.add(listener);
@@ -22418,34 +23320,37 @@ var init_anomaly_pipeline = __esm({
                 const stamped = await this.routeFinding(detectorId, raw);
                 findings.push(stamped);
               }
-              try {
-                const trainingResult = await detector.classifier.train();
-                this.auditLog.append(
-                  "l2",
-                  ANOMALY_AUDIT_OPS.TRAINING_COMPLETED,
-                  this.identityId,
-                  {
-                    detector_id: detectorId,
-                    classifier_id: detector.classifier.classifierId,
-                    trained_at: trainingResult.trained_at,
-                    sample_count: trainingResult.sample_count,
-                    agent_count: trainingResult.agent_count,
-                    fortress_id: this.fortressId
-                  }
-                );
-              } catch (trainErr) {
-                const message = trainErr instanceof Error ? trainErr.message : String(trainErr);
-                this.auditLog.append(
-                  "l2",
-                  ANOMALY_AUDIT_OPS.TRAINING_FAILED,
-                  this.identityId,
-                  {
-                    detector_id: detectorId,
-                    error_message: message,
-                    fortress_id: this.fortressId
-                  },
-                  "failure"
-                );
+              for (const classifier of detector.getAllClassifiers()) {
+                try {
+                  const trainingResult = await classifier.train();
+                  this.auditLog.append(
+                    "l2",
+                    ANOMALY_AUDIT_OPS.TRAINING_COMPLETED,
+                    this.identityId,
+                    {
+                      detector_id: detectorId,
+                      classifier_id: classifier.classifierId,
+                      trained_at: trainingResult.trained_at,
+                      sample_count: trainingResult.sample_count,
+                      agent_count: trainingResult.agent_count,
+                      fortress_id: this.fortressId
+                    }
+                  );
+                } catch (trainErr) {
+                  const message = trainErr instanceof Error ? trainErr.message : String(trainErr);
+                  this.auditLog.append(
+                    "l2",
+                    ANOMALY_AUDIT_OPS.TRAINING_FAILED,
+                    this.identityId,
+                    {
+                      detector_id: detectorId,
+                      classifier_id: classifier.classifierId,
+                      error_message: message,
+                      fortress_id: this.fortressId
+                    },
+                    "failure"
+                  );
+                }
               }
             } catch (err) {
               const message = err instanceof Error ? err.message : String(err);
@@ -22508,6 +23413,7 @@ var init_anomaly_pipeline = __esm({
           observed_at: raw.observed_at || this.now().toISOString()
         };
         await this.findingStore.saveFinding(stamped);
+        const classifierId = stamped.details["classifier_id"] ?? null;
         this.auditLog.append(
           "l2",
           ANOMALY_AUDIT_OPS.FINDING_EMITTED,
@@ -22517,13 +23423,79 @@ var init_anomaly_pipeline = __esm({
             finding_id: stamped.finding_id,
             severity: stamped.severity,
             anomaly_score: stamped.details["anomaly_score"] ?? null,
+            ...classifierId !== null ? { classifier_id: classifierId } : {},
             ...stamped.agent_id !== void 0 ? { agent_id: stamped.agent_id } : {},
             fortress_id: this.fortressId
           }
         );
+        const specificOp = classifierSpecificAuditOp(classifierId);
+        if (specificOp !== null) {
+          this.auditLog.append("l2", specificOp, this.identityId, {
+            detector_id: detectorId,
+            finding_id: stamped.finding_id,
+            severity: stamped.severity,
+            anomaly_score: stamped.details["anomaly_score"] ?? null,
+            ...stamped.agent_id !== void 0 ? { agent_id: stamped.agent_id } : {},
+            fortress_id: this.fortressId
+          });
+        }
         this.emit({ type: "finding", finding: stamped });
         return stamped;
       }
+      /**
+       * Chi-2: attach an additional classifier to an already-registered
+       * detector. Emits ANOMALY_CLASSIFIER_SUBSCRIBED on success. The
+       * factory is called with the fortress AnomalyContext so the
+       * classifier can build its own state-store binding. Idempotent: a
+       * second call with the same classifierId returns false.
+       */
+      async addClassifierToDetector(detectorId, factory) {
+        const detector = this.detectors.get(detectorId);
+        if (!detector) return false;
+        const context = {
+          fortressId: this.fortressId,
+          auditLog: this.auditLog,
+          storage: this.storage,
+          masterKey: this.masterKey,
+          now: this.now
+        };
+        const classifier = factory(context);
+        const added = detector.addClassifier(classifier);
+        if (!added) return false;
+        this.auditLog.append(
+          "l2",
+          ANOMALY_AUDIT_OPS.CLASSIFIER_SUBSCRIBED,
+          this.identityId,
+          {
+            detector_id: detectorId,
+            classifier_id: classifier.classifierId,
+            fortress_id: this.fortressId
+          }
+        );
+        return true;
+      }
+      /**
+       * Chi-2: detach an additional classifier from an already-registered
+       * detector. Emits ANOMALY_CLASSIFIER_UNSUBSCRIBED on success. The
+       * primary classifier cannot be detached (returns false).
+       */
+      async removeClassifierFromDetector(detectorId, classifierId) {
+        const detector = this.detectors.get(detectorId);
+        if (!detector) return false;
+        const removed = detector.removeClassifier(classifierId);
+        if (!removed) return false;
+        this.auditLog.append(
+          "l2",
+          ANOMALY_AUDIT_OPS.CLASSIFIER_UNSUBSCRIBED,
+          this.identityId,
+          {
+            detector_id: detectorId,
+            classifier_id: classifierId,
+            fortress_id: this.fortressId
+          }
+        );
+        return true;
+      }
       emit(event) {
         for (const listener of this.listeners) {
           try {
@@ -22536,6 +23508,75 @@ var init_anomaly_pipeline = __esm({
   }
 });
 
+// src/coordination/workflow-state-tracker.ts
+var WorkflowStateTracker;
+var init_workflow_state_tracker = __esm({
+  "src/coordination/workflow-state-tracker.ts"() {
+    WorkflowStateTracker = class {
+      states = /* @__PURE__ */ new Map();
+      now;
+      constructor(opts) {
+        this.now = opts?.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      /**
+       * Diff the supplied workflow list against the last-observed states.
+       * Returns the set of transitions detected this call; the tracker
+       * mutates its internal map to reflect the new states.
+       *
+       * Transitions emitted:
+       *   - First observation of a workflow (`previous_state` is the
+       *     sentinel `unobserved`). Lets the route handler audit-emit
+       *     the initial state so the operator sees workflows as they
+       *     surface, not only when they change.
+       *   - Subsequent observation where `previous_state !== new_state`.
+       */
+      observe(workflows) {
+        const out = [];
+        const observedAt = this.now().toISOString();
+        for (const wf of workflows) {
+          const prior = this.states.get(wf.workflow_id);
+          if (prior === void 0) {
+            out.push({
+              workflow_id: wf.workflow_id,
+              previous_state: "unobserved",
+              new_state: wf.state,
+              observed_at: observedAt
+            });
+            this.states.set(wf.workflow_id, wf.state);
+            continue;
+          }
+          if (prior !== wf.state) {
+            out.push({
+              workflow_id: wf.workflow_id,
+              previous_state: prior,
+              new_state: wf.state,
+              observed_at: observedAt
+            });
+            this.states.set(wf.workflow_id, wf.state);
+          }
+        }
+        return out;
+      }
+      /**
+       * Drop a workflow's recorded state. Surfaced for tests + future
+       * "operator dismissed this workflow" affordance; not currently
+       * called by the production wiring.
+       */
+      forget(workflowId) {
+        this.states.delete(workflowId);
+      }
+      /** Reset the tracker. Tests use this between runs. */
+      reset() {
+        this.states.clear();
+      }
+      /** Read-only view of the current snapshot. Useful for diagnostics. */
+      snapshot() {
+        return new Map(this.states);
+      }
+    };
+  }
+});
+
 // src/sentinel/sentinel.ts
 var Sentinel;
 var init_sentinel = __esm({
@@ -38247,7 +39288,7 @@ ${runningLines.join("\n")}`;
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
-var OPERATOR_CHAT_NAMESPACE, HKDF_INFO3, OperatorChatStore;
+var OPERATOR_CHAT_NAMESPACE, HKDF_INFO4, OperatorChatStore;
 var init_operator_chat_store = __esm({
   "src/chat/operator-chat-store.ts"() {
     init_encryption();
@@ -38255,13 +39296,13 @@ var init_operator_chat_store = __esm({
     init_encoding();
     init_operator_chat_types();
     OPERATOR_CHAT_NAMESPACE = "_chat";
-    HKDF_INFO3 = "operator-chat-store-v1";
+    HKDF_INFO4 = "operator-chat-store-v1";
     OperatorChatStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
       }
       /**
        * Load a thread. Returns null if no record exists or if the on-disk
@@ -38357,7 +39398,7 @@ function lastTurnId(bundle) {
   }
   return max;
 }
-var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO4, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
+var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO5, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
 var init_concierge_memory_store = __esm({
   "src/chat/concierge-memory-store.ts"() {
     init_encryption();
@@ -38365,7 +39406,7 @@ var init_concierge_memory_store = __esm({
     init_encoding();
     CONCIERGE_MEMORY_NAMESPACE = "_chat";
     CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-    HKDF_INFO4 = "concierge-memory-store-v1";
+    HKDF_INFO5 = "concierge-memory-store-v1";
     DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
     MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
     ConciergeMemoryStore = class {
@@ -38376,7 +39417,7 @@ var init_concierge_memory_store = __esm({
       locks;
       constructor(opts) {
         this.storage = opts.storage;
-        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO4);
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO5);
         this.fortressId = opts.fortressId;
         this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
         this.locks = /* @__PURE__ */ new Map();
@@ -39025,7 +40066,7 @@ var init_defaults = __esm({
 });
 
 // src/intelligence/policy-store.ts
-var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO5, IntelligenceConfigStore;
+var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO6, IntelligenceConfigStore;
 var init_policy_store = __esm({
   "src/intelligence/policy-store.ts"() {
     init_encryption();
@@ -39034,13 +40075,13 @@ var init_policy_store = __esm({
     init_defaults();
     INTELLIGENCE_NAMESPACE = "_intelligence";
     SUBSTRATE_CONFIG_KEY = "substrate-config";
-    HKDF_INFO5 = "intelligence-substrate-config";
+    HKDF_INFO6 = "intelligence-substrate-config";
     IntelligenceConfigStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO5);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO6);
       }
       /**
        * Load the operator's substrate config from disk. Returns the config
@@ -39833,17 +40874,152 @@ ${redactedItems.map((r) => `- ${r.redacted}`).join("\n")}`,
   }
 });
 
-// src/intelligence/substrates/hybrid/per-surface-router.ts
-function resolveHybridChoice(rules, surface) {
-  if (!rules) return null;
-  return rules.perSurface[surface] ?? null;
+// src/query-anonymity/header-strip.ts
+function stripHeaders(headers) {
+  const stripped = {};
+  const removed = [];
+  for (const [name, value] of Object.entries(headers)) {
+    const lower = name.toLowerCase();
+    if (REQUIRED_HEADER_SET.has(lower)) {
+      stripped[name] = value;
+      continue;
+    }
+    const reason = STRIP_REASON_BY_NAME.get(lower);
+    if (reason !== void 0) {
+      removed.push({ name, reason });
+      continue;
+    }
+    stripped[name] = value;
+  }
+  return { stripped, removed };
 }
-function validateHybridRules(rules) {
-  const surfaces = [
-    "concierge",
-    "direct-agent-gate-advisor",
-    "sentinel-scoring",
-    "gate-explanation",
+function defeatUndiciDefaultsInto(headers) {
+  if (headers["user-agent"] === void 0 && headers["User-Agent"] === void 0) {
+    headers["User-Agent"] = "";
+  }
+  if (headers["accept-language"] === void 0 && headers["Accept-Language"] === void 0) {
+    headers["Accept-Language"] = "";
+  }
+  return headers;
+}
+function createAnonymizedFetch(baseFetch, onAudit) {
+  const wrapped = async (input, init) => {
+    const headers = normalizeHeadersInit(init?.headers);
+    const result = stripHeaders(headers);
+    defeatUndiciDefaultsInto(result.stripped);
+    const preservedRequired = Object.keys(result.stripped).filter(
+      (k) => REQUIRED_HEADER_SET.has(k.toLowerCase())
+    );
+    const url = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+    const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+    if (onAudit) {
+      onAudit({
+        url,
+        method,
+        stripped_count: result.removed.length,
+        removed: result.removed,
+        required_preserved: preservedRequired
+      });
+    }
+    return baseFetch(input, { ...init, headers: result.stripped });
+  };
+  return wrapped;
+}
+function normalizeHeadersInit(raw) {
+  if (raw === void 0) return {};
+  if (typeof Headers !== "undefined" && raw instanceof Headers) {
+    const out = {};
+    raw.forEach((value, key) => {
+      out[key] = value;
+    });
+    return out;
+  }
+  if (Array.isArray(raw)) {
+    const out = {};
+    for (const [k, v] of raw) {
+      if (k !== void 0 && v !== void 0) out[k] = v;
+    }
+    return out;
+  }
+  return { ...raw };
+}
+var QUERY_ANONYMITY_AUDIT_OPS, CANONICAL_STRIP_LIST, REQUIRED_HEADERS, REQUIRED_HEADER_SET, STRIP_REASON_BY_NAME;
+var init_header_strip = __esm({
+  "src/query-anonymity/header-strip.ts"() {
+    QUERY_ANONYMITY_AUDIT_OPS = {
+      HEADERS_STRIPPED: "query_anonymity_headers_stripped"
+    };
+    CANONICAL_STRIP_LIST = [
+      // Browser / runtime fingerprinting.
+      { name: "user-agent", reason: "user-agent" },
+      { name: "sec-ch-ua", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-mobile", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-platform", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-platform-version", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-arch", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-bitness", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-model", reason: "fingerprintable-extension" },
+      { name: "sec-ch-ua-full-version-list", reason: "fingerprintable-extension" },
+      // Locale fingerprint.
+      { name: "accept-language", reason: "locale-fingerprint" },
+      // Request-origin leak.
+      { name: "referer", reason: "leaking-network-info" },
+      { name: "referrer-policy", reason: "leaking-network-info" },
+      { name: "origin", reason: "leaking-network-info" },
+      // Forwarded-by / IP-derived network info.
+      { name: "via", reason: "leaking-network-info" },
+      { name: "forwarded", reason: "leaking-network-info" },
+      { name: "x-forwarded-for", reason: "leaking-network-info" },
+      { name: "x-real-ip", reason: "leaking-network-info" },
+      { name: "x-client-ip", reason: "leaking-network-info" },
+      // DNT / GPC are technically anti-tracking signals but they
+      // themselves form a fingerprint (operators who set DNT=1 are a
+      // smaller subset). Strip to keep the substrate ignorant of
+      // operator preferences.
+      { name: "dnt", reason: "unnecessary-metadata" },
+      { name: "sec-gpc", reason: "unnecessary-metadata" }
+    ];
+    REQUIRED_HEADERS = [
+      "authorization",
+      "content-type",
+      "content-length",
+      "host",
+      "accept",
+      "x-api-key",
+      // Anthropic API auth
+      "anthropic-version",
+      // Anthropic API contract version
+      "anthropic-beta",
+      // optional Anthropic beta opt-in
+      "openai-organization",
+      // optional OpenAI org id
+      "x-stainless-package-version",
+      // allowed for Anthropic + OpenAI SDK contract compat
+      "x-goog-api-key",
+      // Google AI Studio
+      "x-goog-user-project"
+      // Google AI Studio
+    ];
+    REQUIRED_HEADER_SET = new Set(
+      REQUIRED_HEADERS.map((h) => h.toLowerCase())
+    );
+    STRIP_REASON_BY_NAME = new Map(
+      CANONICAL_STRIP_LIST.map((h) => [h.name.toLowerCase(), h.reason])
+    );
+  }
+});
+
+// src/intelligence/substrates/hybrid/per-surface-router.ts
+function resolveHybridChoice(rules, surface) {
+  if (!rules) return null;
+  return rules.perSurface[surface] ?? null;
+}
+function validateHybridRules(rules) {
+  const surfaces = [
+    "concierge",
+    "direct-agent-gate-advisor",
+    "sentinel-scoring",
+    "gate-explanation",
     "privacy-filter-tier-2",
     "template-suggestion"
   ];
@@ -39954,6 +41130,7 @@ var init_selector = __esm({
     init_local();
     init_venice();
     init_frontier();
+    init_header_strip();
     init_per_surface_router();
     DISABLED_CAPABILITY = {
       summarize: false,
@@ -39988,7 +41165,21 @@ var init_selector = __esm({
         this.auditLog = cfg.auditLog;
         this.identityId = cfg.identityId;
         this.redactor = cfg.redactor ?? IDENTITY_REDACTOR;
-        this.fetchImpl = cfg.fetchImpl;
+        const baseFetch = cfg.fetchImpl ?? globalThis.fetch;
+        this.fetchImpl = createAnonymizedFetch(baseFetch, (event) => {
+          this.auditLog.append(
+            "l2",
+            QUERY_ANONYMITY_AUDIT_OPS.HEADERS_STRIPPED,
+            this.identityId,
+            {
+              url: event.url,
+              method: event.method,
+              stripped_count: event.stripped_count,
+              removed: event.removed,
+              required_preserved: event.required_preserved
+            }
+          );
+        });
         this.config = buildDefaultConfig();
       }
       /**
@@ -40705,6 +41896,247 @@ var init_constants5 = __esm({
     ];
   }
 });
+async function issueDidWeb(opts) {
+  if (!opts.authority_host || !HOST_RE.test(opts.authority_host)) {
+    throw new Error(
+      `did-web: authority_host '${opts.authority_host}' is not a valid DNS host`
+    );
+  }
+  if (!FORTRESS_LABEL_RE.test(opts.fortress_id)) {
+    throw new Error(
+      `did-web: fortress_id '${opts.fortress_id}' is not a valid label`
+    );
+  }
+  if (opts.agent_label !== void 0 && !AGENT_LABEL_RE.test(opts.agent_label)) {
+    throw new Error(
+      `did-web: agent_label '${opts.agent_label}' is not a valid label`
+    );
+  }
+  if (opts.public_key.length !== 32) {
+    throw new Error(
+      `did-web: public_key must be exactly 32 bytes (Ed25519), got ${opts.public_key.length}`
+    );
+  }
+  const did = buildDid(opts);
+  const verificationMethodId = `${did}#key-1`;
+  const verificationMethod = {
+    id: verificationMethodId,
+    type: "JsonWebKey2020",
+    controller: did,
+    publicKeyJwk: {
+      kty: "OKP",
+      crv: "Ed25519",
+      x: toBase64url(opts.public_key)
+    }
+  };
+  const didDocument = {
+    "@context": [...DID_CONTEXT],
+    id: did,
+    verificationMethod: [verificationMethod],
+    authentication: [verificationMethodId],
+    assertionMethod: [verificationMethodId]
+  };
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  return {
+    did,
+    did_document: didDocument,
+    public_key: opts.public_key,
+    created_at: now.toISOString(),
+    authority_host: opts.authority_host,
+    fortress_id: opts.fortress_id,
+    ...opts.agent_label !== void 0 ? { agent_label: opts.agent_label } : {}
+  };
+}
+function publishDidWebDocument(identifier, opts = {}) {
+  const path = opts.publish_path ?? canonicalPublishPath(identifier);
+  const artifact = canonicalSerializeDidDocument(identifier.did_document);
+  const digest = sha256.sha256(stringToBytes(artifact));
+  const url = `https://${identifier.authority_host}${path}`;
+  return {
+    url,
+    publish_path: path,
+    artifact,
+    sha256: hashToString(digest)
+  };
+}
+async function resolveDidWeb(did, opts) {
+  const parsed = parseDidWeb(did);
+  const url = didToUrl(parsed);
+  if (!opts.allowed_hosts.includes(parsed.authority_host)) {
+    return {
+      ok: false,
+      failure: "host_not_allowed",
+      message: `did-web: authority_host '${parsed.authority_host}' is not in the operator's allowed_hosts allowlist; resolution refused (no-outbound-by-default)`,
+      url
+    };
+  }
+  const timeoutMs = opts.timeout_ms ?? DEFAULT_TIMEOUT_MS4;
+  const fetcher = opts.fetcher ?? defaultFetcher;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  try {
+    response = await fetcher(url, { signal: controller.signal });
+  } catch (err) {
+    clearTimeout(timer);
+    const message = err instanceof Error ? err.message : String(err);
+    if (controller.signal.aborted) {
+      return {
+        ok: false,
+        failure: "timeout",
+        message: `did-web: resolution exceeded ${timeoutMs}ms`,
+        url
+      };
+    }
+    return {
+      ok: false,
+      failure: "fetch_failed",
+      message: `did-web: fetch error: ${message}`,
+      url
+    };
+  }
+  clearTimeout(timer);
+  if (response.status === 404) {
+    return {
+      ok: false,
+      failure: "not_found",
+      message: `did-web: 404 from authority host`,
+      url
+    };
+  }
+  if (!response.ok) {
+    return {
+      ok: false,
+      failure: "fetch_failed",
+      message: `did-web: authority host returned ${response.status}`,
+      url
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      failure: "invalid_json",
+      message: `did-web: invalid JSON: ${message}`,
+      url
+    };
+  }
+  if (!isDidDocument(body, did)) {
+    return {
+      ok: false,
+      failure: "invalid_json",
+      message: `did-web: response body is not a valid DID Document for ${did}`,
+      url
+    };
+  }
+  if (opts.expected_public_key !== void 0) {
+    const expectedX = toBase64url(opts.expected_public_key);
+    const actualX = body.verificationMethod[0]?.publicKeyJwk.x;
+    if (actualX !== expectedX) {
+      return {
+        ok: false,
+        failure: "signature_mismatch",
+        message: `did-web: verificationMethod public key does not match expected key`,
+        url
+      };
+    }
+  }
+  return { ok: true, did_document: body, url };
+}
+function parseDidWeb(did) {
+  if (!did.startsWith("did:web:")) {
+    throw new Error(`did-web: '${did}' is not a did:web identifier`);
+  }
+  const rest = did.slice("did:web:".length);
+  const segments = rest.split(":");
+  const authorityHost = segments[0];
+  if (!HOST_RE.test(authorityHost)) {
+    throw new Error(`did-web: '${authorityHost}' is not a valid DNS host`);
+  }
+  const parsed = { authority_host: authorityHost };
+  if (segments.length === 1) return parsed;
+  if (segments.length === 5 && segments[1] === "fortress" && segments[3] === "agent") {
+    parsed.fortress_id = segments[2];
+    parsed.agent_label = segments[4];
+    return parsed;
+  }
+  throw new Error(
+    `did-web: '${did}' does not match the supported shapes (bare did:web:<host> or did:web:<host>:fortress:<fid>:agent:<alabel>)`
+  );
+}
+function didToUrl(parsed) {
+  if (parsed.fortress_id === void 0 || parsed.agent_label === void 0) {
+    return `https://${parsed.authority_host}/.well-known/did.json`;
+  }
+  return `https://${parsed.authority_host}/fortress/${parsed.fortress_id}/agent/${parsed.agent_label}/did.json`;
+}
+function buildDid(opts) {
+  if (opts.agent_label === void 0) {
+    return `did:web:${opts.authority_host}`;
+  }
+  return `did:web:${opts.authority_host}:fortress:${opts.fortress_id}:agent:${opts.agent_label}`;
+}
+function canonicalPublishPath(identifier) {
+  if (identifier.agent_label === void 0) {
+    return "/.well-known/did.json";
+  }
+  return `/fortress/${identifier.fortress_id}/agent/${identifier.agent_label}/did.json`;
+}
+function canonicalSerializeDidDocument(doc) {
+  return JSON.stringify(
+    {
+      "@context": doc["@context"],
+      id: doc.id,
+      verificationMethod: doc.verificationMethod,
+      authentication: doc.authentication,
+      assertionMethod: doc.assertionMethod
+    },
+    null,
+    2
+  );
+}
+function isDidDocument(value, expectedDid) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (v["id"] !== expectedDid) return false;
+  if (!Array.isArray(v["@context"])) return false;
+  const vm = v["verificationMethod"];
+  if (!Array.isArray(vm) || vm.length === 0) return false;
+  const first = vm[0];
+  if (!first || typeof first["id"] !== "string") return false;
+  const jwk = first["publicKeyJwk"];
+  if (!jwk || jwk["kty"] !== "OKP" || jwk["crv"] !== "Ed25519") return false;
+  if (typeof jwk["x"] !== "string") return false;
+  if (!Array.isArray(v["authentication"])) return false;
+  if (!Array.isArray(v["assertionMethod"])) return false;
+  return true;
+}
+async function defaultFetcher(url, init) {
+  const response = await fetch(url, init);
+  return {
+    ok: response.ok,
+    status: response.status,
+    json: () => response.json()
+  };
+}
+var DID_CONTEXT, DEFAULT_TIMEOUT_MS4, HOST_RE, FORTRESS_LABEL_RE, AGENT_LABEL_RE;
+var init_did_web = __esm({
+  "src/recognition/did-web.ts"() {
+    init_encoding();
+    init_hashing();
+    DID_CONTEXT = [
+      "https://www.w3.org/ns/did/v1",
+      "https://w3id.org/security/suites/jws-2020/v1"
+    ];
+    DEFAULT_TIMEOUT_MS4 = 5e3;
+    HOST_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
+    FORTRESS_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+    AGENT_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+  }
+});
 
 // src/contracts/v1.1/exit-bundle-manifest.ts
 var EXIT_BUNDLE_PATH_PATTERN, EXIT_BUNDLE_PATH_MAX_BYTES;
@@ -41408,6 +42840,7 @@ async function exportExitBundle(opts) {
       "placeholder_vault_metadata"
     )
   );
+  const didWebBinding = validateExportDidWeb(opts.didWeb);
   const body = {
     manifest_version: EXIT_BUNDLE_MANIFEST_VERSION,
     exported_at: (/* @__PURE__ */ new Date()).toISOString(),
@@ -41415,7 +42848,8 @@ async function exportExitBundle(opts) {
       identity_id: identity.identity_id,
       fortress_id: identity.did,
       fortress_master_pubkey: identity.public_key,
-      did: identity.did
+      did: identity.did,
+      ...didWebBinding !== void 0 ? { did_web: didWebBinding } : {}
     },
     source_sanctuary_version: opts.config?.version ?? SANCTUARY_VERSION,
     artifacts,
@@ -41437,6 +42871,18 @@ async function exportExitBundle(opts) {
   };
   const manifestBytes = jsonBytes(manifest);
   await promises.writeFile(path.join(bundleDir, "manifest.json"), manifestBytes, { mode: 384 });
+  if (didWebBinding !== void 0) {
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.EXPORT_INCLUDED,
+      identity.identity_id,
+      {
+        approval_id: exportApprovalAuditId,
+        identifier: didWebBinding.identifier,
+        authority_host: didWebBinding.authority_host
+      }
+    );
+  }
   await opts.auditLog.flush();
   return {
     bundle_dir: bundleDir,
@@ -41448,6 +42894,30 @@ async function exportExitBundle(opts) {
     ]
   };
 }
+function validateExportDidWeb(binding) {
+  if (binding === void 0) return void 0;
+  if (!binding.identifier || typeof binding.identifier !== "string") {
+    throw new Error(
+      "exit-bundle: did_web.identifier must be a non-empty did:web URI"
+    );
+  }
+  if (!binding.authority_host || typeof binding.authority_host !== "string") {
+    throw new Error(
+      "exit-bundle: did_web.authority_host must be a non-empty DNS host"
+    );
+  }
+  const parsed = parseDidWeb(binding.identifier);
+  if (parsed.authority_host.toLowerCase() !== binding.authority_host.toLowerCase()) {
+    throw new Error(
+      `exit-bundle: did_web.identifier authority host '${parsed.authority_host}' does not match did_web.authority_host '${binding.authority_host}'`
+    );
+  }
+  return {
+    identifier: binding.identifier,
+    authority_host: binding.authority_host,
+    ...binding.published_at !== void 0 ? { published_at: binding.published_at } : {}
+  };
+}
 function publicKeysFromIdentityArtifact(identityArtifact) {
   const pubkey = fromBase64url(identityArtifact.bundle.publicKey);
   return {
@@ -41662,6 +43132,87 @@ async function importExitBundle(opts) {
     };
   }
   const manifest = await readManifest(opts.bundleDir);
+  const importWarnings = [];
+  const manifestDidWeb = manifest.body.identity_binding.did_web;
+  if (manifestDidWeb !== void 0 && !opts.skipDidWebVerify) {
+    const expectedPublicKey = fromBase64url(
+      manifest.body.identity_binding.fortress_master_pubkey
+    );
+    const resolveOpts = {
+      allowed_hosts: opts.didWebAllowedHosts ?? [],
+      expected_public_key: expectedPublicKey,
+      ...opts.didWebFetcher !== void 0 ? { fetcher: opts.didWebFetcher } : {},
+      ...opts.didWebTimeoutMs !== void 0 ? { timeout_ms: opts.didWebTimeoutMs } : {}
+    };
+    const resolution = await resolveDidWeb(
+      manifestDidWeb.identifier,
+      resolveOpts
+    );
+    const authorityHost = manifestDidWeb.authority_host;
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.AUTHORITY_HOST,
+      manifest.body.identity_binding.identity_id,
+      { authority_host: authorityHost, identifier: manifestDidWeb.identifier }
+    );
+    if (resolution.ok) {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "success",
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+    } else if (resolution.failure === "signature_mismatch") {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "mismatch",
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+      await opts.auditLog.flush();
+      throw new ExitBundleImportError(
+        "did_web_mismatch",
+        `did:web cross-check failed: the DID Document at ${resolution.url} resolved successfully, but the verificationMethod public key did not match the manifest's claimed fortress_master_pubkey. The bundle's claimed origin (${manifestDidWeb.identifier}) is inconsistent with the published DID Document. To proceed anyway with the manifest signature alone, re-run import with --skip-did-web-verify.`
+      );
+    } else {
+      opts.auditLog.append(
+        "l1",
+        EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+        manifest.body.identity_binding.identity_id,
+        {
+          outcome: "resolution_failure",
+          failure: resolution.failure,
+          identifier: manifestDidWeb.identifier,
+          authority_host: authorityHost,
+          resolved_url: resolution.url
+        }
+      );
+      importWarnings.push(
+        `did:web resolution failed (${resolution.failure}): ${resolution.message}. Import proceeded with manifest-signature verification alone; recognition-layer cross-check was skipped. Re-run with --did-web-allowed-host=<host> to enable resolution, or --skip-did-web-verify to skip deliberately.`
+      );
+    }
+  } else if (manifestDidWeb !== void 0 && opts.skipDidWebVerify) {
+    opts.auditLog.append(
+      "l1",
+      EXIT_BUNDLE_DID_WEB_AUDIT_OPS.IMPORT_VERIFIED,
+      manifest.body.identity_binding.identity_id,
+      {
+        outcome: "skipped",
+        identifier: manifestDidWeb.identifier,
+        authority_host: manifestDidWeb.authority_host
+      }
+    );
+  }
   const identityArtifact = await loadExitArtifact(
     opts.bundleDir,
     manifest,
@@ -41726,7 +43277,7 @@ async function importExitBundle(opts) {
         unverifiable_attestations: verification.reputation?.unverifiable_attestations ?? 0
       },
       staged_artifacts: [],
-      warnings: verification.warnings,
+      warnings: [...verification.warnings, ...importWarnings],
       unsupported_artifacts: verification.unsupported_artifacts
     };
   }
@@ -41893,7 +43444,7 @@ async function importExitBundle(opts) {
     state: stateResult,
     reputation: reputationResult,
     staged_artifacts: stagedArtifacts,
-    warnings: verification.warnings,
+    warnings: [...verification.warnings, ...importWarnings],
     unsupported_artifacts: verification.unsupported_artifacts
   };
 }
@@ -41915,12 +43466,13 @@ function exitBundleManifestShape() {
     ]
   };
 }
-var ARTIFACT_DIR, EXIT_IMPORT_NAMESPACE, EXIT_PUBLIC_IDENTITIES_NAMESPACE, EXIT_AUDIT_RECEIPTS_NAMESPACE, EXIT_POLICY_SETS_NAMESPACE, EXIT_COMMITMENTS_NAMESPACE, EXIT_PLACEHOLDER_METADATA_NAMESPACE, PRIVACY_PLACEHOLDER_NAMESPACE, ExitBundleImportError;
+var ARTIFACT_DIR, EXIT_BUNDLE_DID_WEB_AUDIT_OPS, EXIT_IMPORT_NAMESPACE, EXIT_PUBLIC_IDENTITIES_NAMESPACE, EXIT_AUDIT_RECEIPTS_NAMESPACE, EXIT_POLICY_SETS_NAMESPACE, EXIT_COMMITMENTS_NAMESPACE, EXIT_PLACEHOLDER_METADATA_NAMESPACE, PRIVACY_PLACEHOLDER_NAMESPACE, ExitBundleImportError;
 var init_bundle = __esm({
   "src/exit/bundle.ts"() {
     init_state_store();
     init_config();
     init_constants5();
+    init_did_web();
     init_canonical_json();
     init_hashing();
     init_encoding();
@@ -41930,6 +43482,11 @@ var init_bundle = __esm({
     init_reputation_store();
     init_verifier2();
     ARTIFACT_DIR = "artifacts";
+    EXIT_BUNDLE_DID_WEB_AUDIT_OPS = {
+      EXPORT_INCLUDED: "exit_bundle_did_web_export_included",
+      IMPORT_VERIFIED: "exit_bundle_did_web_import_verified",
+      AUTHORITY_HOST: "exit_bundle_did_web_authority_host"
+    };
     EXIT_IMPORT_NAMESPACE = "_exit_imports";
     EXIT_PUBLIC_IDENTITIES_NAMESPACE = "_exit_public_identities";
     EXIT_AUDIT_RECEIPTS_NAMESPACE = "_exit_audit_receipts";
@@ -42148,6 +43705,26 @@ ${policyErr.message}
         }
         throw policyErr;
       }
+      const includeDidWebFlag = flagValue(argv, "--include-did-web");
+      const includeDidWebDisabled = includeDidWebFlag === "false";
+      const didWebIdentifier = flagValue(argv, "--did-web");
+      const didWebAuthorityHost = flagValue(argv, "--did-web-authority-host");
+      const didWebPublishedAt = flagValue(argv, "--did-web-published-at");
+      let exportDidWeb;
+      if (!includeDidWebDisabled && didWebIdentifier !== void 0) {
+        if (didWebAuthorityHost === void 0) {
+          write(
+            err,
+            "Error: --did-web requires --did-web-authority-host=<host>\n"
+          );
+          return 2;
+        }
+        exportDidWeb = {
+          identifier: didWebIdentifier,
+          authority_host: didWebAuthorityHost,
+          ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
+        };
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -42159,7 +43736,8 @@ ${policyErr.message}
         config,
         stateStoragePath: ctx.stateStoragePath,
         stateNamespaces: repeatedFlagValues(argv, "--state-namespace"),
-        keySource: ctx.keySource
+        keySource: ctx.keySource,
+        ...exportDidWeb !== void 0 ? { didWeb: exportDidWeb } : {}
       });
       if (json) write(out, JSON.stringify(result, null, 2) + "\n");
       else {
@@ -42237,6 +43815,11 @@ ${policyErr.message}
         write(err, "--conflict must be skip, overwrite, or version\n");
         return 2;
       }
+      const didWebAllowedHosts = repeatedFlagValues(
+        argv,
+        "--did-web-allowed-host"
+      );
+      const skipDidWebVerify = hasFlag(argv, "--skip-did-web-verify");
       let result;
       try {
         result = await importExitBundle({
@@ -42252,7 +43835,9 @@ ${policyErr.message}
           conflictResolution: conflict,
           sourcePassphrase: flagValue(argv, "--source-passphrase"),
           sourceRecoveryKey: flagValue(argv, "--source-recovery-key"),
-          destinationSignerIdentityId: flagValue(argv, "--destination-identity-id")
+          destinationSignerIdentityId: flagValue(argv, "--destination-identity-id"),
+          ...didWebAllowedHosts.length > 0 ? { didWebAllowedHosts } : {},
+          skipDidWebVerify
         });
       } catch (e) {
         if (e instanceof InvalidExitBundleError) {
@@ -43037,12 +44622,14 @@ ${err.message}
     fortressId: fortressIdForAggregator
   });
   const handoffEventBridge = new HandoffEventBridge();
+  const workflowStateTracker = new WorkflowStateTracker();
   if (dashboard) {
     dashboard.setHandoffLog({
       handoffLog,
       eventBridge: handoffEventBridge,
       auditLog,
-      operatorId: aggregatorIdentityId
+      operatorId: aggregatorIdentityId,
+      workflowStateTracker
     });
   }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
@@ -43244,6 +44831,7 @@ var init_src = __esm({
     init_anomaly_pipeline();
     init_handoff_log();
     init_handoff_routes();
+    init_workflow_state_tracker();
     init_sentinels();
     init_subscription_store();
     init_tools4();
@@ -47350,7 +48938,7 @@ async function probeTenantDashboard(tenant, options = {}) {
   if (!rt) {
     return { running: false, status: null, reason: "no runtime.json" };
   }
-  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS4;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS5;
   return await new Promise((resolve8) => {
     const req = http.get(
       {
@@ -47386,10 +48974,10 @@ async function probeTenantDashboard(tenant, options = {}) {
     });
   });
 }
-var DEFAULT_TIMEOUT_MS4;
+var DEFAULT_TIMEOUT_MS5;
 var init_health = __esm({
   "src/cli/agents/health.ts"() {
-    DEFAULT_TIMEOUT_MS4 = 500;
+    DEFAULT_TIMEOUT_MS5 = 500;
   }
 });
 function resolveCtx(args) {
@@ -48640,108 +50228,6 @@ var init_sentinel2 = __esm({
     init_sentinels();
   }
 });
-async function issueDidWeb(opts) {
-  if (!opts.authority_host || !HOST_RE.test(opts.authority_host)) {
-    throw new Error(
-      `did-web: authority_host '${opts.authority_host}' is not a valid DNS host`
-    );
-  }
-  if (!FORTRESS_LABEL_RE.test(opts.fortress_id)) {
-    throw new Error(
-      `did-web: fortress_id '${opts.fortress_id}' is not a valid label`
-    );
-  }
-  if (opts.agent_label !== void 0 && !AGENT_LABEL_RE.test(opts.agent_label)) {
-    throw new Error(
-      `did-web: agent_label '${opts.agent_label}' is not a valid label`
-    );
-  }
-  if (opts.public_key.length !== 32) {
-    throw new Error(
-      `did-web: public_key must be exactly 32 bytes (Ed25519), got ${opts.public_key.length}`
-    );
-  }
-  const did = buildDid(opts);
-  const verificationMethodId = `${did}#key-1`;
-  const verificationMethod = {
-    id: verificationMethodId,
-    type: "JsonWebKey2020",
-    controller: did,
-    publicKeyJwk: {
-      kty: "OKP",
-      crv: "Ed25519",
-      x: toBase64url(opts.public_key)
-    }
-  };
-  const didDocument = {
-    "@context": [...DID_CONTEXT],
-    id: did,
-    verificationMethod: [verificationMethod],
-    authentication: [verificationMethodId],
-    assertionMethod: [verificationMethodId]
-  };
-  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
-  return {
-    did,
-    did_document: didDocument,
-    public_key: opts.public_key,
-    created_at: now.toISOString(),
-    authority_host: opts.authority_host,
-    fortress_id: opts.fortress_id,
-    ...opts.agent_label !== void 0 ? { agent_label: opts.agent_label } : {}
-  };
-}
-function publishDidWebDocument(identifier, opts = {}) {
-  const path = opts.publish_path ?? canonicalPublishPath(identifier);
-  const artifact = canonicalSerializeDidDocument(identifier.did_document);
-  const digest = sha256.sha256(stringToBytes(artifact));
-  const url = `https://${identifier.authority_host}${path}`;
-  return {
-    url,
-    publish_path: path,
-    artifact,
-    sha256: hashToString(digest)
-  };
-}
-function buildDid(opts) {
-  if (opts.agent_label === void 0) {
-    return `did:web:${opts.authority_host}`;
-  }
-  return `did:web:${opts.authority_host}:fortress:${opts.fortress_id}:agent:${opts.agent_label}`;
-}
-function canonicalPublishPath(identifier) {
-  if (identifier.agent_label === void 0) {
-    return "/.well-known/did.json";
-  }
-  return `/fortress/${identifier.fortress_id}/agent/${identifier.agent_label}/did.json`;
-}
-function canonicalSerializeDidDocument(doc) {
-  return JSON.stringify(
-    {
-      "@context": doc["@context"],
-      id: doc.id,
-      verificationMethod: doc.verificationMethod,
-      authentication: doc.authentication,
-      assertionMethod: doc.assertionMethod
-    },
-    null,
-    2
-  );
-}
-var DID_CONTEXT, HOST_RE, FORTRESS_LABEL_RE, AGENT_LABEL_RE;
-var init_did_web = __esm({
-  "src/recognition/did-web.ts"() {
-    init_encoding();
-    init_hashing();
-    DID_CONTEXT = [
-      "https://www.w3.org/ns/did/v1",
-      "https://w3id.org/security/suites/jws-2020/v1"
-    ];
-    HOST_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
-    FORTRESS_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
-    AGENT_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
-  }
-});
 
 // src/cli/did-web.ts
 var did_web_exports = {};
@@ -49000,6 +50486,689 @@ var init_did_web2 = __esm({
   }
 });
 
+// src/anomaly-detection/classifiers/rolling-baseline.ts
+var ROLLING_BASELINE_CLASSIFIER_ID, DEFAULT_MIN_SAMPLES_FOR_PREDICTION, STDDEV_FLOOR, RollingBaselineClassifier;
+var init_rolling_baseline = __esm({
+  "src/anomaly-detection/classifiers/rolling-baseline.ts"() {
+    ROLLING_BASELINE_CLASSIFIER_ID = "rolling-baseline";
+    DEFAULT_MIN_SAMPLES_FOR_PREDICTION = 7;
+    STDDEV_FLOOR = 0.5;
+    RollingBaselineClassifier = class {
+      classifierId = ROLLING_BASELINE_CLASSIFIER_ID;
+      stateStore;
+      minSamplesForPrediction;
+      /** In-memory cache of per-agent state; loaded lazily on first touch. */
+      cache = /* @__PURE__ */ new Map();
+      /** Agents whose in-memory state has been mutated since last train(). */
+      dirty = /* @__PURE__ */ new Set();
+      constructor(opts) {
+        this.stateStore = opts.stateStore;
+        this.minSamplesForPrediction = opts.minSamplesForPrediction ?? DEFAULT_MIN_SAMPLES_FOR_PREDICTION;
+      }
+      async observe(vector) {
+        const state = await this.loadOrInit(vector.agent_id);
+        for (const [featureName, observed] of Object.entries(vector.features)) {
+          if (!Number.isFinite(observed)) continue;
+          const welford = state.features[featureName] ?? {
+            n: 0,
+            mean: 0,
+            m2: 0
+          };
+          const nextN = welford.n + 1;
+          const delta = observed - welford.mean;
+          const nextMean = welford.mean + delta / nextN;
+          const delta2 = observed - nextMean;
+          const nextM2 = welford.m2 + delta * delta2;
+          state.features[featureName] = { n: nextN, mean: nextMean, m2: nextM2 };
+        }
+        state.observation_count += 1;
+        state.last_observed_at = vector.observed_at;
+        this.dirty.add(vector.agent_id);
+      }
+      async predict(vector) {
+        const state = await this.loadOrInit(vector.agent_id);
+        if (state.observation_count < this.minSamplesForPrediction) {
+          return {
+            anomaly_score: 0,
+            explanation: [],
+            feature_contributions: [],
+            baseline_ready: false
+          };
+        }
+        const contributions = [];
+        let sumSquaredZ = 0;
+        for (const [featureName, observed] of Object.entries(vector.features)) {
+          if (!Number.isFinite(observed)) continue;
+          const welford = state.features[featureName];
+          if (!welford || welford.n < 2) continue;
+          const variance = welford.m2 / (welford.n - 1);
+          const stddev = Math.max(Math.sqrt(variance), STDDEV_FLOOR);
+          const z = (observed - welford.mean) / stddev;
+          sumSquaredZ += z * z;
+          contributions.push({
+            feature_name: featureName,
+            observed,
+            baseline_mean: welford.mean,
+            baseline_stddev: stddev,
+            z_score: z
+          });
+        }
+        contributions.sort(
+          (a, b) => Math.abs(b.z_score) - Math.abs(a.z_score)
+        );
+        const anomalyScore = Math.sqrt(sumSquaredZ);
+        const explanation = contributions.map(
+          (c) => `${c.feature_name} ${c.observed.toFixed(2)} vs baseline ${c.baseline_mean.toFixed(2)}+/-${c.baseline_stddev.toFixed(2)} (z=${c.z_score.toFixed(2)})`
+        );
+        return {
+          anomaly_score: anomalyScore,
+          explanation,
+          feature_contributions: contributions,
+          baseline_ready: true
+        };
+      }
+      async train() {
+        const dirtyAgents = [...this.dirty];
+        for (const agentId of dirtyAgents) {
+          const state = this.cache.get(agentId);
+          if (!state) continue;
+          await this.stateStore.saveState(this.classifierId, agentId, state);
+          this.dirty.delete(agentId);
+        }
+        let sampleCount = 0;
+        for (const state of this.cache.values()) {
+          sampleCount += state.observation_count;
+        }
+        return {
+          trained_at: (/* @__PURE__ */ new Date()).toISOString(),
+          sample_count: sampleCount,
+          agent_count: this.cache.size
+        };
+      }
+      /** Test helper: read the in-memory state for an agent. */
+      getAgentState(agentId) {
+        return this.cache.get(agentId);
+      }
+      async loadOrInit(agentId) {
+        const cached = this.cache.get(agentId);
+        if (cached) return cached;
+        const persisted = await this.stateStore.loadState(
+          this.classifierId,
+          agentId
+        );
+        const state = persisted ?? {
+          observation_count: 0,
+          last_observed_at: null,
+          features: {}
+        };
+        this.cache.set(agentId, state);
+        return state;
+      }
+    };
+  }
+});
+
+// src/anomaly-detection/feature-extractors/per-agent-activity.ts
+function emptyBucket() {
+  return {
+    tool_call_count: 0,
+    egress_call_count: 0,
+    credential_use_count: 0,
+    audit_event_count: 0,
+    recent_receipt_count: 0
+  };
+}
+function bucketToFeatures(bucket) {
+  return {
+    tool_call_count: bucket.tool_call_count,
+    egress_call_count: bucket.egress_call_count,
+    credential_use_count: bucket.credential_use_count,
+    audit_event_count: bucket.audit_event_count,
+    recent_receipt_count: bucket.recent_receipt_count
+  };
+}
+function classifyEntry(entry, bucket) {
+  bucket.audit_event_count += 1;
+  bucket.tool_call_count += 1;
+  if (entry.operation.startsWith("proxy_call:")) {
+    bucket.egress_call_count += 1;
+  }
+  if (entry.operation.startsWith("broker_secret_") || entry.operation.startsWith("broker_token_")) {
+    bucket.credential_use_count += 1;
+  }
+  if (entry.operation.startsWith("composition_receipt_") || entry.operation === "reputation_record" || entry.operation === "reputation_query" || entry.operation === "reputation_publish") {
+    bucket.recent_receipt_count += 1;
+  }
+}
+async function extractPerAgentActivity(context) {
+  const now = context.now();
+  const sinceIso = new Date(now.getTime() - WINDOW_MS2).toISOString();
+  const result = await context.auditLog.query({
+    since: sinceIso,
+    limit: QUERY_LIMIT6
+  });
+  const buckets = /* @__PURE__ */ new Map();
+  for (const entry of result.entries) {
+    const agentId = entry.identity_id && entry.identity_id.length > 0 ? entry.identity_id : SYSTEM_AGENT_BUCKET;
+    let bucket = buckets.get(agentId);
+    if (!bucket) {
+      bucket = emptyBucket();
+      buckets.set(agentId, bucket);
+    }
+    classifyEntry(entry, bucket);
+  }
+  const observedAt = now.toISOString();
+  const vectors = [];
+  for (const [agentId, bucket] of buckets.entries()) {
+    vectors.push({
+      agent_id: agentId,
+      observed_at: observedAt,
+      features: bucketToFeatures(bucket),
+      window_label: PER_AGENT_ACTIVITY_WINDOW_LABEL
+    });
+  }
+  vectors.sort((a, b) => a.agent_id < b.agent_id ? -1 : 1);
+  return vectors;
+}
+var PER_AGENT_ACTIVITY_EXTRACTOR_ID, WINDOW_MS2, QUERY_LIMIT6, SYSTEM_AGENT_BUCKET, PER_AGENT_ACTIVITY_WINDOW_LABEL;
+var init_per_agent_activity = __esm({
+  "src/anomaly-detection/feature-extractors/per-agent-activity.ts"() {
+    PER_AGENT_ACTIVITY_EXTRACTOR_ID = "per-agent-activity";
+    WINDOW_MS2 = 24 * 60 * 60 * 1e3;
+    QUERY_LIMIT6 = 1e4;
+    SYSTEM_AGENT_BUCKET = "system";
+    PER_AGENT_ACTIVITY_WINDOW_LABEL = "24h_rolling";
+  }
+});
+
+// src/anomaly-detection/detectors/per-agent-activity-detector.ts
+var PER_AGENT_ACTIVITY_DETECTOR_ID, PerAgentActivityDetector, PendingClassifier;
+var init_per_agent_activity_detector = __esm({
+  "src/anomaly-detection/detectors/per-agent-activity-detector.ts"() {
+    init_types4();
+    init_rolling_baseline();
+    init_classifier_state_store();
+    init_per_agent_activity();
+    PER_AGENT_ACTIVITY_DETECTOR_ID = PER_AGENT_ACTIVITY_EXTRACTOR_ID;
+    PerAgentActivityDetector = class extends AnomalyDetector {
+      detectorId = PER_AGENT_ACTIVITY_DETECTOR_ID;
+      description = "Per-agent statistical drift detector: tool-call count, egress volume, credential-use rate, audit-event count, recent-receipt count over a 24h rolling window. Compared against a per-agent rolling baseline (Welford running mean + variance).";
+      classifier;
+      explicitClassifier;
+      minSamplesForPrediction;
+      constructor(opts) {
+        super();
+        this.explicitClassifier = opts?.classifier !== void 0;
+        if (opts?.classifier) {
+          this.classifier = opts.classifier;
+        } else {
+          this.classifier = new PendingClassifier();
+        }
+        this.minSamplesForPrediction = opts?.minSamplesForPrediction;
+      }
+      async subscribe(context) {
+        await super.subscribe(context);
+        if (this.explicitClassifier) return;
+        const stateStore = new ClassifierStateStore({
+          storage: context.storage,
+          masterKey: context.masterKey,
+          fortressId: context.fortressId,
+          now: context.now
+        });
+        const realClassifier = new RollingBaselineClassifier({
+          stateStore,
+          ...this.minSamplesForPrediction !== void 0 ? { minSamplesForPrediction: this.minSamplesForPrediction } : {}
+        });
+        this.classifier = realClassifier;
+      }
+      async featureExtract(context) {
+        return extractPerAgentActivity(context);
+      }
+    };
+    PendingClassifier = class {
+      classifierId = "pending";
+      async observe() {
+        throw new Error(
+          "anomaly-detector: classifier accessed before subscribe()"
+        );
+      }
+      async predict() {
+        throw new Error(
+          "anomaly-detector: classifier accessed before subscribe()"
+        );
+      }
+      async train() {
+        throw new Error(
+          "anomaly-detector: classifier accessed before subscribe()"
+        );
+      }
+    };
+  }
+});
+
+// src/anomaly-detection/anomaly-catalog.ts
+function findCatalogEntry(detectorId, classifierId) {
+  return ANOMALY_CATALOG.find(
+    (e) => e.detectorId === detectorId && e.classifierId === classifierId
+  );
+}
+var ANOMALY_CATALOG;
+var init_anomaly_catalog = __esm({
+  "src/anomaly-detection/anomaly-catalog.ts"() {
+    init_per_agent_activity_detector();
+    init_rolling_baseline();
+    ANOMALY_CATALOG = [
+      {
+        detectorId: PER_AGENT_ACTIVITY_DETECTOR_ID,
+        classifierId: ROLLING_BASELINE_CLASSIFIER_ID,
+        description: "Per-agent statistical drift detector: tool-call count, egress volume, credential-use rate, audit-event count, recent-receipt count over a 24h rolling window. Welford running mean + variance baseline per agent.",
+        factory: () => new PerAgentActivityDetector()
+      }
+    ];
+  }
+});
+function anomalySubscriptionsPath(storagePath) {
+  return path.join(storagePath, "anomaly-subscriptions.json");
+}
+async function loadAnomalySubscriptions(storagePath) {
+  const filePath = anomalySubscriptionsPath(storagePath);
+  try {
+    const raw = await promises.readFile(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== FILE_VERSION2) return [];
+    if (!Array.isArray(parsed.subscribed)) return [];
+    return parsed.subscribed.filter(
+      (t) => t !== null && typeof t === "object" && typeof t.detector_id === "string" && typeof t.classifier_id === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+async function saveAnomalySubscriptions(storagePath, subscriptions) {
+  const filePath = anomalySubscriptionsPath(storagePath);
+  await promises.mkdir(path.dirname(filePath), { recursive: true });
+  const payload = {
+    version: FILE_VERSION2,
+    // Deduplicate.
+    subscribed: dedupe(subscriptions)
+  };
+  await promises.writeFile(filePath, JSON.stringify(payload, null, 2), {
+    mode: 384
+  });
+}
+function dedupe(items) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const item of items) {
+    const key = `${item.detector_id}|${item.classifier_id}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(item);
+  }
+  return out;
+}
+var FILE_VERSION2;
+var init_anomaly_subscription_store = __esm({
+  "src/anomaly-detection/anomaly-subscription-store.ts"() {
+    FILE_VERSION2 = 1;
+  }
+});
+
+// src/cli/anomaly.ts
+var anomaly_exports = {};
+__export(anomaly_exports, {
+  runAnomalyCommand: () => runAnomalyCommand
+});
+async function runAnomalyCommand(args) {
+  const out = args.out ?? process.stdout;
+  const err = args.err ?? process.stderr;
+  const [sub, ...rest] = args.argv;
+  if (!sub || sub === "--help" || sub === "-h") {
+    printUsage8(out);
+    return 0;
+  }
+  try {
+    switch (sub) {
+      case "detectors":
+        return cmdDetectors(rest, { out });
+      case "list-subscribed":
+        return await cmdListSubscribed2({ out, args });
+      case "subscribe":
+        return await cmdSubscribe2(rest, { out, err, args });
+      case "unsubscribe":
+        return await cmdUnsubscribe2(rest, { out, err, args });
+      case "findings":
+        return await cmdFindings2(rest, { out, err, args });
+      case "classifier-state":
+        return await cmdClassifierState(rest, { out, err, args });
+      default:
+        err.write(`Unknown subcommand: ${sub}
+`);
+        printUsage8(err);
+        return 2;
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    err.write(`sanctuary anomaly: ${msg}
+`);
+    return 1;
+  }
+}
+function printUsage8(s) {
+  s.write(`Usage: sanctuary anomaly <command> [args]
+
+  detectors list                          Catalog of available
+                                          detector + classifier tuples.
+  list-subscribed                         Subscriptions on this fortress.
+  subscribe <detector-id> --classifier <id>
+                                          Opt in. Writes the
+                                          subscription file; the server
+                                          picks it up on next boot.
+  unsubscribe <detector-id> --classifier <id>
+                                          Opt out.
+  findings [opts]                         Read anomaly findings.
+    --since <iso>                           observed_at >= iso.
+    --severity <info|warn|alert>            Filter by severity.
+    --detector-id <id>                      Filter by emitting detector.
+    --agent-id <id>                         Filter by agent attribution.
+    --limit <n>                             Cap result count (default 100).
+  findings show <finding-id>              Full drift-inspector detail.
+  classifier-state <detector-id> --classifier <id>
+                                          Per-agent training state.
+`);
+}
+function flagValue4(argv, name) {
+  const i = argv.indexOf(name);
+  if (i === -1) return void 0;
+  return argv[i + 1];
+}
+function cmdDetectors(argv, ctx) {
+  const sub = argv[0];
+  if (sub !== void 0 && sub !== "list") {
+    ctx.out.write(`Unknown detectors subcommand: ${sub}
+`);
+    return 2;
+  }
+  if (ANOMALY_CATALOG.length === 0) {
+    ctx.out.write("(no detectors registered)\n");
+    return 0;
+  }
+  for (const entry of ANOMALY_CATALOG) {
+    ctx.out.write(
+      `${entry.detectorId} [classifier: ${entry.classifierId}]
+  ${entry.description}
+`
+    );
+  }
+  return 0;
+}
+async function cmdListSubscribed2(ctx) {
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const subscribed = await loadAnomalySubscriptions(storagePath);
+  if (subscribed.length === 0) {
+    ctx.out.write("(no subscriptions)\n");
+    return 0;
+  }
+  for (const t of subscribed) {
+    ctx.out.write(`${t.detector_id} [classifier: ${t.classifier_id}]
+`);
+  }
+  return 0;
+}
+async function cmdSubscribe2(argv, ctx) {
+  const detectorId = argv[0];
+  const classifierId = flagValue4(argv, "--classifier");
+  if (!detectorId) {
+    ctx.err.write("subscribe requires a detector-id\n");
+    return 2;
+  }
+  if (!classifierId) {
+    ctx.err.write("subscribe requires --classifier <id>\n");
+    return 2;
+  }
+  const entry = findCatalogEntry(detectorId, classifierId);
+  if (!entry) {
+    ctx.err.write(
+      `Unknown detector/classifier pair: ${detectorId} / ${classifierId}
+`
+    );
+    return 2;
+  }
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const subscribed = await loadAnomalySubscriptions(storagePath);
+  const exists = subscribed.some(
+    (t) => t.detector_id === detectorId && t.classifier_id === classifierId
+  );
+  if (exists) {
+    ctx.out.write(
+      `Already subscribed: ${detectorId} [classifier: ${classifierId}]
+`
+    );
+    return 0;
+  }
+  subscribed.push({ detector_id: detectorId, classifier_id: classifierId });
+  await saveAnomalySubscriptions(storagePath, subscribed);
+  ctx.out.write(
+    `Subscribed: ${detectorId} [classifier: ${classifierId}]
+Restart Sanctuary or wait for the next dispatcher tick.
+`
+  );
+  return 0;
+}
+async function cmdUnsubscribe2(argv, ctx) {
+  const detectorId = argv[0];
+  const classifierId = flagValue4(argv, "--classifier");
+  if (!detectorId) {
+    ctx.err.write("unsubscribe requires a detector-id\n");
+    return 2;
+  }
+  if (!classifierId) {
+    ctx.err.write("unsubscribe requires --classifier <id>\n");
+    return 2;
+  }
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const subscribed = await loadAnomalySubscriptions(storagePath);
+  const filtered = subscribed.filter(
+    (t) => !(t.detector_id === detectorId && t.classifier_id === classifierId)
+  );
+  if (filtered.length === subscribed.length) {
+    ctx.out.write(
+      `Not subscribed: ${detectorId} [classifier: ${classifierId}]
+`
+    );
+    return 0;
+  }
+  await saveAnomalySubscriptions(storagePath, filtered);
+  ctx.out.write(
+    `Unsubscribed: ${detectorId} [classifier: ${classifierId}]
+`
+  );
+  return 0;
+}
+async function cmdFindings2(argv, ctx) {
+  if (argv[0] === "show") {
+    return await cmdFindingsShow(argv.slice(1), ctx);
+  }
+  const filters = parseFindingFilters2(argv);
+  const masterKey = await deriveFortressMasterKey(ctx);
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  const fortressId = fortressIdFromStoragePath(storagePath);
+  const store = new SentinelFindingStore({
+    storage,
+    masterKey,
+    fortressId
+  });
+  const filterSentinelId = filters.detectorId !== void 0 ? `${ANOMALY_SENTINEL_ID_PREFIX}${filters.detectorId}` : void 0;
+  const allFindings = await store.listFindings({
+    limit: filters.limit ?? 100,
+    ...filters.since !== void 0 ? { since: filters.since } : {},
+    ...filters.severity !== void 0 ? { severity: filters.severity } : {},
+    ...filterSentinelId !== void 0 ? { sentinelId: filterSentinelId } : {},
+    ...filters.agentId !== void 0 ? { agentId: filters.agentId } : {}
+  });
+  const anomalyFindings = filterSentinelId !== void 0 ? allFindings : allFindings.filter(
+    (f) => f.sentinel_id.startsWith(ANOMALY_SENTINEL_ID_PREFIX)
+  );
+  if (anomalyFindings.length === 0) {
+    ctx.out.write("(no findings)\n");
+    return 0;
+  }
+  for (const finding of anomalyFindings) {
+    const detectorId = finding.details["detector_id"] ?? "";
+    const score = finding.details["anomaly_score"];
+    const scoreStr = typeof score === "number" ? ` score=${score.toFixed(2)}` : "";
+    ctx.out.write(
+      `[${finding.observed_at}] ${finding.severity.toUpperCase()} ${detectorId}${finding.agent_id ? ` (agent ${finding.agent_id})` : ""}${scoreStr}: ${finding.summary}
+`
+    );
+  }
+  return 0;
+}
+async function cmdFindingsShow(argv, ctx) {
+  const findingId = argv[0];
+  if (!findingId) {
+    ctx.err.write("findings show requires a finding-id\n");
+    return 2;
+  }
+  const masterKey = await deriveFortressMasterKey(ctx);
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  const fortressId = fortressIdFromStoragePath(storagePath);
+  const store = new SentinelFindingStore({ storage, masterKey, fortressId });
+  const finding = await store.loadFinding(findingId);
+  if (!finding) {
+    ctx.err.write(`Finding not found: ${findingId}
+`);
+    return 1;
+  }
+  if (!finding.sentinel_id.startsWith(ANOMALY_SENTINEL_ID_PREFIX)) {
+    ctx.err.write(
+      `Finding ${findingId} is not an anomaly finding; try sanctuary sentinel findings.
+`
+    );
+    return 1;
+  }
+  ctx.out.write(JSON.stringify(finding, null, 2) + "\n");
+  return 0;
+}
+async function cmdClassifierState(argv, ctx) {
+  const detectorId = argv[0];
+  const classifierId = flagValue4(argv, "--classifier");
+  if (!detectorId) {
+    ctx.err.write("classifier-state requires a detector-id\n");
+    return 2;
+  }
+  if (!classifierId) {
+    ctx.err.write("classifier-state requires --classifier <id>\n");
+    return 2;
+  }
+  const entry = findCatalogEntry(detectorId, classifierId);
+  if (!entry) {
+    ctx.err.write(
+      `Unknown detector/classifier pair: ${detectorId} / ${classifierId}
+`
+    );
+    return 2;
+  }
+  const masterKey = await deriveFortressMasterKey(ctx);
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  const fortressId = fortressIdFromStoragePath(storagePath);
+  const stateStore = new ClassifierStateStore({
+    storage,
+    masterKey,
+    fortressId
+  });
+  const agentIds = await stateStore.listAgents(classifierId);
+  if (agentIds.length === 0) {
+    ctx.out.write("(no classifier state yet)\n");
+    return 0;
+  }
+  for (const agentId of agentIds) {
+    try {
+      const raw = await stateStore.loadState(classifierId, agentId);
+      if (raw === null) continue;
+      const sampleCount = typeof raw.sample_count === "number" ? raw.sample_count : "?";
+      ctx.out.write(`${agentId}: sample_count=${sampleCount}
+`);
+    } catch {
+      ctx.out.write(`${agentId}: (load failed)
+`);
+    }
+  }
+  return 0;
+}
+function parseFindingFilters2(argv) {
+  const filters = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--since" && argv[i + 1]) {
+      filters.since = argv[++i];
+    } else if (arg === "--severity" && argv[i + 1]) {
+      const next = argv[++i];
+      if (next === "info" || next === "warn" || next === "alert") {
+        filters.severity = next;
+      }
+    } else if (arg === "--detector-id" && argv[i + 1]) {
+      filters.detectorId = argv[++i];
+    } else if (arg === "--agent-id" && argv[i + 1]) {
+      filters.agentId = argv[++i];
+    } else if (arg === "--limit" && argv[i + 1]) {
+      const n = Number.parseInt(argv[++i], 10);
+      if (!Number.isNaN(n) && n > 0) filters.limit = n;
+    }
+  }
+  return filters;
+}
+async function resolveStoragePath3(args) {
+  if (args.storagePath) return args.storagePath;
+  const config = await loadConfig();
+  return config.storage_path;
+}
+async function deriveFortressMasterKey(ctx) {
+  const storagePath = await resolveStoragePath3(ctx.args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  let passphrase = ctx.args.passphrase ?? process.env["SANCTUARY_PASSPHRASE"];
+  if (!passphrase) {
+    const resolved = await getOrCreatePassphrase();
+    passphrase = resolved.value;
+  }
+  let existingParams;
+  try {
+    const raw = await storage.read("_meta", "key-params");
+    if (raw) existingParams = JSON.parse(bytesToString(raw));
+  } catch {
+  }
+  const { key: masterKey, params } = await deriveMasterKey(
+    passphrase,
+    existingParams
+  );
+  if (!existingParams) {
+    await storage.write(
+      "_meta",
+      "key-params",
+      stringToBytes(JSON.stringify(params))
+    );
+  }
+  return masterKey;
+}
+var init_anomaly = __esm({
+  "src/cli/anomaly.ts"() {
+    init_config();
+    init_filesystem();
+    init_key_derivation();
+    init_encoding();
+    init_passphrase();
+    init_wiring();
+    init_sentinel_finding_store();
+    init_anomaly_catalog();
+    init_anomaly_subscription_store();
+    init_classifier_state_store();
+    init_types4();
+  }
+});
+
 // src/mcp/broker-server.ts
 var broker_server_exports = {};
 __export(broker_server_exports, {
@@ -49869,6 +52038,11 @@ async function main() {
     const code = await runDidWebCommand2({ argv: args.slice(1) });
     process.exit(code);
   }
+  if (args[0] === "anomaly") {
+    const { runAnomalyCommand: runAnomalyCommand2 } = await Promise.resolve().then(() => (init_anomaly(), anomaly_exports));
+    const code = await runAnomalyCommand2({ argv: args.slice(1) });
+    process.exit(code);
+  }
   if (args[0] === "broker-server") {
     const { openBroker: openBroker2 } = await Promise.resolve().then(() => (init_open(), open_exports));
     const { createBrokerMcpServer: createBrokerMcpServer2 } = await Promise.resolve().then(() => (init_broker_server(), broker_server_exports));