@sanctuary-framework/mcp-server 1.2.13 → 1.2.15

package/dist/index.cjs

@@ -17449,6 +17449,535 @@ async function handleCoordinationRoute(deps, req, res) {
   }
 }
 
+// src/honeypot/types.ts
+var FILESYSTEM_OPS = [
+  "read",
+  "write",
+  "delete",
+  "list"
+];
+var HONEYPOT_AUDIT_OPS = {
+  DRAFTED: "honeypot_drafted",
+  COMPILED: "honeypot_compiled",
+  DEPLOYED: "honeypot_deployed",
+  TRIGGERED: "honeypot_triggered",
+  UNDEPLOYED: "honeypot_undeployed",
+  LOADED: "honeypot_loaded"
+};
+var HONEYPOT_SENTINEL_ID_PREFIX = "honeypot:";
+function honeypotSentinelId(trapId) {
+  return `${HONEYPOT_SENTINEL_ID_PREFIX}${trapId}`;
+}
+var COMPILE_SURFACE = "template-suggestion";
+var COMPILE_MAX_TOKENS = 800;
+var DEFAULT_SEVERITY = "alert";
+var COMPILE_PROMPT = `You are compiling a Sanctuary honeypot from an operator's plain-English description.
+Return STRICT JSON with the following shape (no markdown, no commentary):
+{
+  "trap_class": "http_endpoint" | "filesystem",
+  "path_pattern": "string (glob with * or **)",
+  "method": "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "ANY",
+  "ops": ["read", "write", "delete", "list"],
+  "expected_caller_types": ["wrapped_agent" | "operator" | "external"],
+  "finding_severity": "warn" | "alert",
+  "explanation_paragraph": "one-sentence operator-friendly explanation"
+}
+Default trap_class to "http_endpoint" unless the operator clearly describes filesystem access (file reads/writes, directory access, path-on-disk monitoring). The "method" field applies only to http_endpoint traps; the "ops" field applies only to filesystem traps. Match the operator's stated severity if they gave one; otherwise default to "alert". If method is unspecified for http_endpoint, return "ANY". If ops is unspecified for filesystem, return ["read","write","delete","list"]. If caller-type is unspecified, return ["wrapped_agent"]. Keep the explanation_paragraph under 200 characters.`;
+async function compileHoneypot(draft, opts) {
+  const now = opts?.now ?? (() => /* @__PURE__ */ new Date());
+  const trapIdFactory = opts?.trapIdFactory ?? (() => crypto.randomUUID());
+  const warnings = [];
+  let trigger = null;
+  let trapClass = "http_endpoint";
+  let severity = DEFAULT_SEVERITY;
+  let explanation = "";
+  let source = "heuristic";
+  if (opts?.selector) {
+    try {
+      const handle = await opts.selector.getSubstrate(COMPILE_SURFACE);
+      if (handle.capability.summarize) {
+        const response = await opts.selector.invokeSummarize(
+          COMPILE_SURFACE,
+          {
+            kind: "summarize",
+            context: COMPILE_PROMPT,
+            query: draft.english_text,
+            maxTokens: COMPILE_MAX_TOKENS
+          }
+        );
+        if (response.body.kind === "summarize" && !response.failureClass) {
+          const parsed = tryParseLlmResponse(response.body.text);
+          if (parsed.ok) {
+            trigger = parsed.trigger;
+            trapClass = parsed.trapClass;
+            severity = parsed.severity;
+            explanation = parsed.explanation;
+            source = "llm";
+          } else {
+            warnings.push(
+              `LLM response failed validation (${parsed.failure}); falling back to heuristic compile`
+            );
+          }
+        } else {
+          warnings.push(
+            `LLM compile failed (${response.failureClass ?? "non_summarize_body"}); falling back to heuristic compile`
+          );
+        }
+      } else {
+        warnings.push(
+          "Substrate at template-suggestion surface does not support summarize; falling back to heuristic compile"
+        );
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      warnings.push(
+        `LLM compile threw (${message}); falling back to heuristic compile`
+      );
+    }
+  }
+  if (trigger === null) {
+    const heuristic = heuristicCompile(draft.english_text);
+    trigger = heuristic.trigger;
+    trapClass = heuristic.trapClass;
+    if (heuristic.severity) severity = heuristic.severity;
+    explanation = heuristic.explanation;
+    if (heuristic.warning) warnings.push(heuristic.warning);
+  }
+  const spec = {
+    trap_id: trapIdFactory(),
+    trap_class: trapClass,
+    trigger,
+    finding_severity: severity,
+    english_text: draft.english_text,
+    explanation_paragraph: explanation,
+    compiled_at: now().toISOString()
+  };
+  return { spec, source, warnings };
+}
+function tryParseLlmResponse(text) {
+  let body;
+  try {
+    const stripped = text.replace(/^```(?:json)?\s*|\s*```$/g, "").trim();
+    body = JSON.parse(stripped);
+  } catch {
+    return { ok: false, failure: "invalid_json" };
+  }
+  if (!body || typeof body !== "object") {
+    return { ok: false, failure: "invalid_json" };
+  }
+  const obj = body;
+  const pathPattern = obj["path_pattern"];
+  if (typeof pathPattern !== "string" || pathPattern.length === 0) {
+    return { ok: false, failure: "missing_path_pattern" };
+  }
+  const callerTypes = Array.isArray(obj["expected_caller_types"]) ? obj["expected_caller_types"].filter(
+    (v) => typeof v === "string" && v.length > 0
+  ) : ["wrapped_agent"];
+  if (callerTypes.length === 0) {
+    return { ok: false, failure: "invalid_caller_types" };
+  }
+  const severityRaw = obj["finding_severity"];
+  const severity = severityRaw === "warn" ? "warn" : severityRaw === "alert" ? "alert" : DEFAULT_SEVERITY;
+  const explanationRaw = obj["explanation_paragraph"];
+  const explanation = typeof explanationRaw === "string" && explanationRaw.length > 0 ? explanationRaw : "Honeypot compiled from operator draft via LLM-assisted compile path.";
+  const trapClassRaw = obj["trap_class"];
+  const trapClass = trapClassRaw === "filesystem" ? "filesystem" : "http_endpoint";
+  if (trapClass === "filesystem") {
+    const opsParsed = parseFilesystemOps(obj["ops"]);
+    if (opsParsed === null) {
+      return { ok: false, failure: "invalid_filesystem_ops" };
+    }
+    const trigger2 = {
+      kind: "filesystem",
+      path_pattern: pathPattern,
+      ops: opsParsed,
+      expected_caller_types: callerTypes
+    };
+    return { ok: true, trapClass, trigger: trigger2, severity, explanation };
+  }
+  const method = typeof obj["method"] === "string" ? obj["method"] : "ANY";
+  const trigger = {
+    kind: "http_endpoint",
+    path_pattern: pathPattern,
+    ...method !== "ANY" ? { method: method.toUpperCase() } : {},
+    expected_caller_types: callerTypes
+  };
+  return { ok: true, trapClass, trigger, severity, explanation };
+}
+function parseFilesystemOps(raw) {
+  if (raw === void 0 || raw === null) {
+    return [...FILESYSTEM_OPS];
+  }
+  if (!Array.isArray(raw)) return null;
+  if (raw.length === 0) return [...FILESYSTEM_OPS];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string") return null;
+    if (!FILESYSTEM_OPS.includes(entry)) return null;
+    if (!out.includes(entry)) out.push(entry);
+  }
+  return out;
+}
+var HEURISTIC_PATH_PATTERNS = [
+  /honeypot\s+(?:at|on)\s+([\/][\w\/\-:*\.]+)/i,
+  /trap\s+(?:at|on|for)\s+([\/][\w\/\-:*\.]+)/i,
+  /deploy\s+(?:at|on)\s+([\/][\w\/\-:*\.]+)/i,
+  /catch\s+(?:requests?\s+to|callers?\s+at)\s+([\/][\w\/\-:*\.]+)/i,
+  /watch\s+(?:for\s+)?(?:requests?\s+(?:to|on))\s+([\/][\w\/\-:*\.]+)/i,
+  /([\/][\w\/\-:*\.]+)\s+(?:endpoint|path|route)/i
+];
+var SEVERITY_HINTS = [
+  { phrase: /\b(?:warn|warning|low\s+severity)\b/i, severity: "warn" },
+  { phrase: /\b(?:alert|critical|high\s+severity)\b/i, severity: "alert" }
+];
+var FILESYSTEM_CLASS_HINTS = [
+  /\bfilesystem\b/i,
+  /\bfile[-\s]?system\b/i,
+  /\bfile\s+(?:read|write|delete|list|access|trap|honeypot)/i,
+  /\b(?:read|write|delete|list)\s+file/i,
+  /\bdirectory\b/i,
+  /\bon[-\s]?disk\b/i,
+  /\bpath\s+on\s+disk\b/i
+];
+var FILESYSTEM_OP_HINTS = [
+  { phrase: /\b(?:read|reads|reading|access(?:es|ed)?)\b/i, op: "read" },
+  { phrase: /\b(?:write|writes|writing|modif(?:y|ies|ied)|edit)/i, op: "write" },
+  { phrase: /\b(?:delete|deletes|deletion|remove|removal|unlink)/i, op: "delete" },
+  { phrase: /\b(?:list|listing|enumerate|enumeration|directory\s+listing)/i, op: "list" }
+];
+function heuristicCompile(english) {
+  let pathPattern = null;
+  for (const re of HEURISTIC_PATH_PATTERNS) {
+    const match = english.match(re);
+    if (match && match[1]) {
+      pathPattern = match[1];
+      break;
+    }
+  }
+  const fallbackUsed = pathPattern === null;
+  if (pathPattern === null) {
+    pathPattern = "/honeypot-stub";
+  }
+  let severity;
+  for (const hint of SEVERITY_HINTS) {
+    if (hint.phrase.test(english)) {
+      severity = hint.severity;
+      break;
+    }
+  }
+  const isFilesystem = FILESYSTEM_CLASS_HINTS.some((re) => re.test(english));
+  if (isFilesystem) {
+    const ops = [];
+    for (const hint of FILESYSTEM_OP_HINTS) {
+      if (hint.phrase.test(english) && !ops.includes(hint.op)) {
+        ops.push(hint.op);
+      }
+    }
+    const resolvedOps = ops.length > 0 ? ops : [...FILESYSTEM_OPS];
+    const trigger2 = {
+      kind: "filesystem",
+      path_pattern: pathPattern,
+      ops: resolvedOps,
+      expected_caller_types: ["wrapped_agent"]
+    };
+    const opsRendered = resolvedOps.join(",");
+    const explanation2 = fallbackUsed ? `Filesystem honeypot compiled from operator draft via heuristic fallback; the English description did not yield a clear path pattern, so the trap is stubbed at ${pathPattern} (ops=${opsRendered}). Operator should edit the path_pattern before deploy.` : `Filesystem honeypot compiled from operator draft via heuristic compile; trap fires on ${opsRendered} operations against ${pathPattern}.`;
+    return {
+      trapClass: "filesystem",
+      trigger: trigger2,
+      ...severity !== void 0 ? { severity } : {},
+      explanation: explanation2,
+      ...fallbackUsed ? {
+        warning: "heuristic compile could not extract a path pattern from the filesystem draft; trap is stubbed at /honeypot-stub. Either rewrite the draft (e.g., 'filesystem honeypot at /etc/secrets for reads') or edit the spec's path_pattern before deploying"
+      } : {}
+    };
+  }
+  const trigger = {
+    kind: "http_endpoint",
+    path_pattern: pathPattern,
+    expected_caller_types: ["wrapped_agent"]
+  };
+  const explanation = fallbackUsed ? `Honeypot compiled from operator draft via heuristic fallback; the English description did not yield a clear path pattern, so the trap is stubbed at ${pathPattern}. Operator should edit the path_pattern before deploy.` : `Honeypot compiled from operator draft via heuristic compile; trap fires on requests to ${pathPattern}.`;
+  return {
+    trapClass: "http_endpoint",
+    trigger,
+    ...severity !== void 0 ? { severity } : {},
+    explanation,
+    ...fallbackUsed ? {
+      warning: "heuristic compile could not extract a path pattern from the draft; trap is stubbed at /honeypot-stub. Either rewrite the draft (e.g., 'honeypot at /admin/secrets') or edit the spec's path_pattern before deploying"
+    } : {}
+  };
+}
+function hashOfEnglishDraft(text) {
+  return crypto.createHash("sha256").update(text, "utf8").digest("hex").slice(0, 32);
+}
+
+// src/honeypot/runtime-trap-handler.ts
+var HONEYPOT_API_PREFIX = "/api/honeypot";
+async function handleHoneypotTriggerIfMatch(deps, req, res) {
+  const url = req.url ?? "/";
+  const path = url.split("?")[0] ?? "/";
+  const method = (req.method ?? "GET").toUpperCase();
+  if (path.startsWith(HONEYPOT_API_PREFIX)) return false;
+  if (path.startsWith("/api/sentinels")) return false;
+  if (path.startsWith("/api/coordination")) return false;
+  const match = deps.registry.findMatching({ path, method });
+  if (!match) return false;
+  const now = (deps.now ?? (() => /* @__PURE__ */ new Date()))();
+  const callerIdentity = extractCallerIdentity(req);
+  const payloadHash = await safeReadAndHashBody(req);
+  const findingId = crypto.randomUUID();
+  const finding = {
+    finding_id: findingId,
+    sentinel_id: honeypotSentinelId(match.trap_id),
+    severity: match.finding_severity,
+    summary: buildSummary(match, callerIdentity, path, method),
+    details: {
+      trap_id: match.trap_id,
+      trap_class: match.trap_class,
+      path_matched: path,
+      method,
+      caller_identity: callerIdentity,
+      payload_hash: payloadHash
+    },
+    observed_at: now.toISOString(),
+    evidence_audit_ids: [],
+    fortress_id: deps.fortressId
+  };
+  await deps.findingStore.saveFinding(finding).catch(() => void 0);
+  deps.auditLog.append(
+    "l2",
+    HONEYPOT_AUDIT_OPS.TRIGGERED,
+    deps.operatorId,
+    {
+      trap_id: match.trap_id,
+      trap_class: match.trap_class,
+      path_matched: path,
+      method,
+      caller_identity: callerIdentity,
+      payload_hash: payloadHash,
+      finding_id: findingId,
+      severity: match.finding_severity
+    }
+  );
+  res.writeHead(404, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: "not_found", path }));
+  return true;
+}
+function buildSummary(spec, callerIdentity, path, method) {
+  return `honeypot ${spec.trap_id} triggered: ${method} ${path} from ${callerIdentity} (severity ${spec.finding_severity}, pattern ${spec.trigger.path_pattern})`;
+}
+function extractCallerIdentity(req) {
+  const headers = req.headers;
+  const agent = headers["x-sanctuary-agent"];
+  if (typeof agent === "string" && agent.length > 0) return `agent:${agent}`;
+  const xff = headers["x-forwarded-for"];
+  if (typeof xff === "string" && xff.length > 0) {
+    const first = xff.split(",")[0]?.trim();
+    if (first) return `ip:${first}`;
+  }
+  const ip = req.socket.remoteAddress;
+  return ip ? `ip:${ip}` : "ip:unknown";
+}
+async function safeReadAndHashBody(req) {
+  const MAX_BYTES = 64 * 1024;
+  try {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buf.length;
+      if (total > MAX_BYTES) {
+        return "unhashed";
+      }
+      chunks.push(buf);
+    }
+    if (chunks.length === 0) return "empty";
+    const body = Buffer.concat(chunks);
+    return crypto.createHash("sha256").update(body).digest("hex").slice(0, 32);
+  } catch {
+    return "unhashed";
+  }
+}
+function writeJSON7(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+async function readJSONBody4(req) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  if (chunks.length === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function matchTrapIdRoute(path) {
+  const prefix = `${HONEYPOT_API_PREFIX}/traps/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  return { trapId: decodeURIComponent(rest) };
+}
+async function handleHoneypotRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== HONEYPOT_API_PREFIX && !path.startsWith(`${HONEYPOT_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "POST" && path === `${HONEYPOT_API_PREFIX}/compile`) {
+      const body = await readJSONBody4(req);
+      const englishText = body && typeof body === "object" && typeof body["english_text"] === "string" ? body["english_text"] : "";
+      if (englishText.length === 0) {
+        writeJSON7(res, 400, {
+          ok: false,
+          error: "english_text required"
+        });
+        return true;
+      }
+      const draft = {
+        english_text: englishText,
+        operator_id: deps.operatorId,
+        observed_at: (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()
+      };
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.DRAFTED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        english_hash: hashOfEnglishDraft(englishText)
+      });
+      const result = await compileHoneypot(draft, {
+        ...deps.selector !== void 0 ? { selector: deps.selector } : {},
+        ...deps.now !== void 0 ? { now: deps.now } : {}
+      });
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.COMPILED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        trap_id: result.spec.trap_id,
+        source: result.source,
+        warning_count: result.warnings.length
+      });
+      writeJSON7(res, 200, {
+        ok: true,
+        data: { spec: result.spec, source: result.source, warnings: result.warnings }
+      });
+      return true;
+    }
+    if (method === "POST" && path === `${HONEYPOT_API_PREFIX}/deploy`) {
+      const body = await readJSONBody4(req);
+      const spec = body && typeof body === "object" && body["spec"] ? body["spec"] : null;
+      if (!spec || typeof spec.trap_id !== "string" || spec.trap_id.length === 0) {
+        writeJSON7(res, 400, { ok: false, error: "spec.trap_id required" });
+        return true;
+      }
+      const isNew = deps.registry.deploy(spec);
+      let persistError = null;
+      if (deps.store) {
+        try {
+          await deps.store.save(spec);
+        } catch (err) {
+          persistError = err instanceof Error ? err.message : String(err);
+        }
+      }
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.DEPLOYED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        trap_id: spec.trap_id,
+        trap_class: spec.trap_class,
+        path_pattern: spec.trigger.path_pattern,
+        was_new: isNew,
+        ...persistError !== null ? { persist_error: persistError, persisted: false } : deps.store ? { persisted: true } : {}
+      });
+      writeJSON7(res, 200, {
+        ok: true,
+        data: {
+          trap_id: spec.trap_id,
+          was_new: isNew,
+          ...deps.store ? { persisted: persistError === null } : {},
+          ...persistError !== null ? { persist_error: persistError } : {}
+        }
+      });
+      return true;
+    }
+    if (method === "GET" && path === `${HONEYPOT_API_PREFIX}/traps`) {
+      const traps = deps.registry.list();
+      writeJSON7(res, 200, { ok: true, data: { traps } });
+      return true;
+    }
+    const trapMatch = matchTrapIdRoute(path);
+    if (method === "DELETE" && trapMatch) {
+      const removed = deps.registry.undeploy(trapMatch.trapId);
+      let persistError = null;
+      if (deps.store) {
+        try {
+          await deps.store.delete(trapMatch.trapId);
+        } catch (err) {
+          persistError = err instanceof Error ? err.message : String(err);
+        }
+      }
+      if (removed) {
+        deps.auditLog.append(
+          "l2",
+          HONEYPOT_AUDIT_OPS.UNDEPLOYED,
+          deps.operatorId,
+          {
+            fortress_id: deps.fortressId,
+            trap_id: trapMatch.trapId,
+            ...persistError !== null ? { persist_error: persistError, persisted: false } : deps.store ? { persisted: true } : {}
+          }
+        );
+      }
+      writeJSON7(res, removed ? 200 : 404, {
+        ok: removed,
+        data: {
+          trap_id: trapMatch.trapId,
+          removed,
+          ...deps.store ? { persisted: persistError === null } : {},
+          ...persistError !== null ? { persist_error: persistError } : {}
+        }
+      });
+      return true;
+    }
+    if (method === "GET" && path === `${HONEYPOT_API_PREFIX}/findings`) {
+      const since = url.searchParams.get("since") ?? void 0;
+      const severityRaw = url.searchParams.get("severity") ?? void 0;
+      const severity = isValidSeverity(severityRaw) ? severityRaw : void 0;
+      const limit = parseLimit5(url.searchParams.get("limit"), 50, 500);
+      const all = await deps.findingStore.listFindings({
+        ...since !== void 0 ? { since } : {},
+        ...severity !== void 0 ? { severity } : {},
+        limit: 500
+      });
+      const honeypotFindings = all.filter(
+        (f) => f.sentinel_id.startsWith(HONEYPOT_SENTINEL_ID_PREFIX)
+      );
+      writeJSON7(res, 200, {
+        ok: true,
+        data: { findings: honeypotFindings.slice(0, limit) }
+      });
+      return true;
+    }
+    writeJSON7(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON7(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+function isValidSeverity(value) {
+  return value === "info" || value === "warn" || value === "alert";
+}
+function parseLimit5(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+  return Math.min(parsed, max);
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -17541,6 +18070,22 @@ var DashboardApprovalChannel = class {
   workflowStateTracker = null;
   handoffAuditLog = null;
   handoffOperatorId = null;
+  // v1.3 WP-V1.3-5 Pi-1 Honeypot Authoring: per-fortress trap registry
+  // + finding store + audit log + operator id. Front-of-dispatch hook
+  // consults the registry on every request; management routes at
+  // /api/honeypot/* go through the dispatch path.
+  honeypotRegistry = null;
+  honeypotFindingStore = null;
+  honeypotAuditLog = null;
+  honeypotOperatorId = null;
+  honeypotFortressId = null;
+  honeypotSelector = null;
+  // Pi-2: encrypted at-rest persistence for deployed honeypot traps.
+  // When present, the management API's deploy + undeploy handlers
+  // write through to the store; on fortress boot the host code calls
+  // `store.loadAll()` and re-deploys the persisted specs into the
+  // in-memory registry before this dashboard begins serving.
+  honeypotStore = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -17622,6 +18167,30 @@ var DashboardApprovalChannel = class {
     this.handoffContextTransfer = opts.contextTransfer ?? null;
     this.workflowStateTracker = opts.workflowStateTracker ?? null;
   }
+  /**
+   * v1.3 WP-V1.3-5 Pi-1 Honeypot Authoring: bind the per-fortress
+   * trap registry + finding store + audit log + operator id. Once
+   * set, two surfaces activate:
+   *   1. Front-of-dispatch trap-trigger hook: every request runs
+   *      through `handleHoneypotTriggerIfMatch` BEFORE legacy/v1.1/
+   *      sentinel/coordination routing. Matching traps return 404
+   *      and the request never reaches the regular dispatcher.
+   *   2. Management API at /api/honeypot/* routes through
+   *      `handleHoneypotRoute`.
+   *
+   * The optional `selector` opt wires the LLM compile path; absent
+   * selector forces the heuristic compile path (which still produces
+   * a usable TrapSpec with warnings).
+   */
+  setHoneypotRegistry(opts) {
+    this.honeypotRegistry = opts.registry;
+    this.honeypotFindingStore = opts.findingStore ?? null;
+    this.honeypotAuditLog = opts.auditLog ?? null;
+    this.honeypotOperatorId = opts.operatorId ?? null;
+    this.honeypotFortressId = opts.fortressId ?? null;
+    this.honeypotSelector = opts.selector ?? null;
+    this.honeypotStore = opts.store ?? null;
+  }
   /**
    * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
    * before the legacy approval route table. Returns true when served.
@@ -17686,6 +18255,57 @@ var DashboardApprovalChannel = class {
       res
     );
   }
+  /**
+   * v1.3 WP-V1.3-5 Pi-1 dispatch entry point. Routes
+   * `/api/honeypot/*` requests through the honeypot management
+   * router when a registry has been bound. Returns true when served.
+   */
+  async dispatchHoneypot(req, res) {
+    if (!this.honeypotRegistry || !this.honeypotFindingStore || !this.honeypotAuditLog) {
+      return false;
+    }
+    return handleHoneypotRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        registry: this.honeypotRegistry,
+        findingStore: this.honeypotFindingStore,
+        auditLog: this.honeypotAuditLog,
+        operatorId: this.honeypotOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
+        fortressId: this.honeypotFortressId ?? "fortress_default",
+        ...this.honeypotSelector !== null ? { selector: this.honeypotSelector } : {},
+        ...this.honeypotStore !== null ? { store: this.honeypotStore } : {}
+      },
+      req,
+      res
+    );
+  }
+  /**
+   * v1.3 WP-V1.3-5 Pi-1 front-of-dispatch trap-trigger hook. Examines
+   * every request BEFORE legacy/v1.1/sentinel/coordination routing.
+   * Returns true when a deployed trap matched the request and the
+   * handler emitted the audit event + sentinel finding + plausible
+   * 404 response. Returns false when no trap matched; caller
+   * continues with normal routing.
+   */
+  async dispatchHoneypotTrap(req, res) {
+    if (!this.honeypotRegistry || !this.honeypotFindingStore || !this.honeypotAuditLog) {
+      return false;
+    }
+    return handleHoneypotTriggerIfMatch(
+      {
+        registry: this.honeypotRegistry,
+        findingStore: this.honeypotFindingStore,
+        auditLog: this.honeypotAuditLog,
+        operatorId: this.honeypotOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
+        fortressId: this.honeypotFortressId ?? "fortress_default"
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -18061,6 +18681,40 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.honeypotRegistry) {
+      this.dispatchHoneypotTrap(req, res).then((handled) => {
+        if (handled) return;
+        this.continueHandleRequest(req, res, url, method, origin, selfOrigin);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
+    this.continueHandleRequest(req, res, url, method, origin, selfOrigin);
+  }
+  /**
+   * v1.3 WP-V1.3-5 Pi-1: post-honeypot-trap request continuation. The
+   * front-of-dispatch trap-trigger hook may short-circuit a request;
+   * when it does not, this method runs the original dispatch ladder.
+   * Pulled out as a helper so the trap-hook + non-trap paths share
+   * one code path through every downstream dispatcher.
+   */
+  continueHandleRequest(req, res, url, method, _origin, _selfOrigin) {
+    if (this.honeypotRegistry && url.pathname.startsWith(HONEYPOT_API_PREFIX)) {
+      this.dispatchHoneypot(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
       this.dispatchApprovalInbox(req, res).then((handled) => {
         if (handled) return;
@@ -22277,6 +22931,187 @@ var WorkflowStateTracker = class {
   }
 };
 
+// src/honeypot/trap-registry.ts
+var TrapRegistry = class {
+  traps = /* @__PURE__ */ new Map();
+  /**
+   * Deploy a trap. Idempotent on `trap_id`: re-deploying replaces the
+   * previous spec for that id. Returns true on first deploy, false on
+   * re-deploy (so callers can branch audit emission).
+   */
+  deploy(spec) {
+    const isNew = !this.traps.has(spec.trap_id);
+    this.traps.set(spec.trap_id, spec);
+    return isNew;
+  }
+  /**
+   * Undeploy by trap_id. Returns true when a trap was removed, false
+   * when no trap had that id (idempotent).
+   */
+  undeploy(trapId) {
+    return this.traps.delete(trapId);
+  }
+  /** List deployed traps. Returns a fresh array; mutation is safe. */
+  list() {
+    return [...this.traps.values()];
+  }
+  /** Look up a single trap by id. */
+  get(trapId) {
+    return this.traps.get(trapId);
+  }
+  /**
+   * Find the first trap matching the request. Iteration order is
+   * insertion order; operators who deploy multiple overlapping traps
+   * see the earliest-deployed one fire. Tests cover this contract.
+   */
+  findMatching(input) {
+    for (const spec of this.traps.values()) {
+      if (matchesTrap(spec, input)) return spec;
+    }
+    return void 0;
+  }
+  /** Drop every trap. Tests use this between runs; not surfaced via API. */
+  clear() {
+    this.traps.clear();
+  }
+};
+function matchesTrap(spec, input) {
+  if (spec.trigger.kind !== "http_endpoint") return false;
+  const trigger = spec.trigger;
+  if (trigger.method && trigger.method.toUpperCase() !== input.method.toUpperCase()) {
+    return false;
+  }
+  const re = compileGlob(trigger.path_pattern);
+  return re.test(input.path);
+}
+function compileGlob(pattern) {
+  let out = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "*" && pattern[i + 1] === "*") {
+      out += ".*";
+      i += 2;
+      continue;
+    }
+    if (ch === "*") {
+      out += "[^/]*";
+      i += 1;
+      continue;
+    }
+    if ("\\^$.|?+()[]{}".includes(ch)) {
+      out += `\\${ch}`;
+    } else {
+      out += ch;
+    }
+    i += 1;
+  }
+  return new RegExp(`^${out}$`);
+}
+
+// src/honeypot/trap-store.ts
+init_encryption();
+init_encoding();
+var TRAP_STORE_NAMESPACE = "_honeypot_traps";
+var TRAP_STORE_KEY_PREFIX = "trap.";
+var HKDF_INFO3 = "l2-honeypot-trap-v1";
+var MAX_TRAP_BYTES = 64 * 1024;
+var TrapStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
+    this.fortressId = opts.fortressId;
+  }
+  /** Persist (or overwrite) one trap. Returns the trap_id on success. */
+  async save(spec) {
+    const persisted = { version: 1, spec };
+    const aad = stringToBytes(spec.trap_id);
+    const plaintext = stringToBytes(JSON.stringify(persisted));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      TRAP_STORE_NAMESPACE,
+      trapKey(spec.trap_id),
+      stringToBytes(JSON.stringify(envelope))
+    );
+    return spec.trap_id;
+  }
+  /**
+   * Remove one trap by id. Returns true when a record was removed,
+   * false when no record existed (idempotent).
+   */
+  async delete(trapId) {
+    try {
+      const raw = await this.storage.read(
+        TRAP_STORE_NAMESPACE,
+        trapKey(trapId)
+      );
+      if (!raw) return false;
+      await this.storage.delete(TRAP_STORE_NAMESPACE, trapKey(trapId));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Load every persisted trap. Used at boot to repopulate the
+   * in-memory TrapRegistry. Corrupted records are silently skipped
+   * so one malformed entry never blocks the rest of the fortress's
+   * traps from rehydrating.
+   *
+   * Returns the specs sorted by `compiled_at` ascending so the
+   * in-memory registry's insertion order matches the original
+   * deploy order (relevant for Pi-1's "first-deployed wins on
+   * overlapping match" contract).
+   */
+  async loadAll() {
+    const metas = await this.storage.list(
+      TRAP_STORE_NAMESPACE,
+      TRAP_STORE_KEY_PREFIX
+    );
+    const out = [];
+    for (const meta of metas) {
+      const trapId = stripKeyPrefix3(meta.key);
+      if (trapId === null) continue;
+      const raw = await this.storage.read(TRAP_STORE_NAMESPACE, meta.key);
+      if (!raw) continue;
+      if (raw.length > MAX_TRAP_BYTES) continue;
+      const spec = this.decode(trapId, raw);
+      if (spec !== null) out.push(spec);
+    }
+    out.sort(
+      (a, b) => a.compiled_at < b.compiled_at ? -1 : a.compiled_at > b.compiled_at ? 1 : 0
+    );
+    return out;
+  }
+  /** Read-only fortress-id getter. */
+  getFortressId() {
+    return this.fortressId;
+  }
+  decode(trapId, raw) {
+    try {
+      const aad = stringToBytes(trapId);
+      const envelope = JSON.parse(bytesToString(raw));
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const persisted = JSON.parse(bytesToString(plaintext));
+      if (persisted.version !== 1) return null;
+      if (persisted.spec.trap_id !== trapId) return null;
+      return persisted.spec;
+    } catch {
+      return null;
+    }
+  }
+};
+function trapKey(trapId) {
+  return `${TRAP_STORE_KEY_PREFIX}${trapId}`;
+}
+function stripKeyPrefix3(key) {
+  if (!key.startsWith(TRAP_STORE_KEY_PREFIX)) return null;
+  return key.slice(TRAP_STORE_KEY_PREFIX.length);
+}
+
 // src/sentinel/sentinel.ts
 var Sentinel = class {
   /**
@@ -37434,7 +38269,7 @@ function hashOf(input) {
 init_encryption();
 init_encoding();
 var OPERATOR_CHAT_NAMESPACE = "_chat";
-var HKDF_INFO3 = "operator-chat-store-v1";
+var HKDF_INFO4 = "operator-chat-store-v1";
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
@@ -37443,7 +38278,7 @@ var OperatorChatStore = class {
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
   }
   /**
    * Load a thread. Returns null if no record exists or if the on-disk
@@ -37527,7 +38362,7 @@ init_encryption();
 init_encoding();
 var CONCIERGE_MEMORY_NAMESPACE = "_chat";
 var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-var HKDF_INFO4 = "concierge-memory-store-v1";
+var HKDF_INFO5 = "concierge-memory-store-v1";
 var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
 var MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
 var ConciergeMemoryStore = class {
@@ -37538,7 +38373,7 @@ var ConciergeMemoryStore = class {
   locks;
   constructor(opts) {
     this.storage = opts.storage;
-    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO4);
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO5);
     this.fortressId = opts.fortressId;
     this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
     this.locks = /* @__PURE__ */ new Map();
@@ -37664,7 +38499,7 @@ var ConciergeMemoryStore = class {
     );
     const summaries = [];
     for (const meta of entries) {
-      const threadId = stripKeyPrefix3(meta.key);
+      const threadId = stripKeyPrefix4(meta.key);
       if (threadId === null) continue;
       const bundle = await this.loadBundle(threadId);
       if (!bundle || bundle.turns.length === 0) continue;
@@ -37717,7 +38552,7 @@ var ConciergeMemoryStore = class {
     );
     let pruned = 0;
     for (const meta of entries) {
-      const threadId = stripKeyPrefix3(meta.key);
+      const threadId = stripKeyPrefix4(meta.key);
       if (threadId === null) continue;
       pruned += await this.withLock(threadId, async () => {
         const bundle = await this.loadBundle(threadId);
@@ -37801,7 +38636,7 @@ var ConciergeMemoryStore = class {
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix3(key) {
+function stripKeyPrefix4(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -38174,13 +39009,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO5 = "intelligence-substrate-config";
+var HKDF_INFO6 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO5);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO6);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -40228,6 +41063,55 @@ async function defaultFetcher(url, init) {
     json: () => response.json()
   };
 }
+var FORTRESS_DID_WEB_REGISTRY_PATH = "recognition/did-web.json";
+async function loadFortressDidWebRecord(storagePath) {
+  const persistPath = path.join(storagePath, FORTRESS_DID_WEB_REGISTRY_PATH);
+  let raw;
+  try {
+    raw = await promises.readFile(persistPath, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return null;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    throw new Error(
+      `did-web: fortress-config record at ${persistPath} is not valid JSON: ${message}`
+    );
+  }
+  if (!isFortressDidWebRecord(parsed)) {
+    throw new Error(
+      `did-web: fortress-config record at ${persistPath} is malformed (expected version: 1 with identifier.did + identifier.authority_host)`
+    );
+  }
+  return parsed;
+}
+function isFortressDidWebRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (v["version"] !== 1) return false;
+  const id = v["identifier"];
+  if (!id || typeof id !== "object") return false;
+  if (typeof id["did"] !== "string" || !id["did"].startsWith("did:web:")) {
+    return false;
+  }
+  if (typeof id["authority_host"] !== "string") return false;
+  if (typeof id["fortress_id"] !== "string") return false;
+  if (typeof id["created_at"] !== "string") return false;
+  if (!id["did_document"] || typeof id["did_document"] !== "object") {
+    return false;
+  }
+  const artifact = v["artifact"];
+  if (!artifact || typeof artifact !== "object") return false;
+  if (typeof artifact["url"] !== "string") return false;
+  if (typeof artifact["publish_path"] !== "string") return false;
+  if (typeof artifact["sha256"] !== "string") return false;
+  return true;
+}
 
 // src/exit/bundle.ts
 init_hashing();
@@ -41676,9 +42560,31 @@ Options:
   --accept-unverifiable-attestations
                                     On import: accept reputation attestations whose
                                     signer DID is not in the bundle (Tier 1 confirmation)
+  --did-web <identifier>            Embed a specific did:web identifier in the export
+                                    manifest. Requires --did-web-authority-host.
+                                    Overrides fortress-config auto-inclusion.
+  --did-web-authority-host <host>   Authority host for --did-web (required with it).
+  --did-web-published-at <iso8601>  Operator's claimed publication time for the DID
+                                    Document (optional; ISO 8601).
+  --no-did-web                      Explicit opt-out: skip did:web inclusion even if
+                                    a fortress-config record exists. (Alias for
+                                    --include-did-web=false.)
+  --did-web-allowed-host <host>     On import: host allowed for outbound did:web
+                                    resolution; repeatable. Empty means refuse to
+                                    resolve (no-outbound-by-default).
+  --skip-did-web-verify             On import: skip did:web resolution entirely.
   --json
   --yes, -y                         Explicit non-interactive Tier 1 approval
   --help, -h
+
+did:web auto-inclusion (build 3):
+  Running "sanctuary did-web issue --authority-host <host>" registers the
+  operator's did:web identifier at <storage>/recognition/did-web.json.
+  Subsequent "sanctuary exit export" runs auto-include this identifier in
+  the manifest's identity_binding without requiring any --did-web flag.
+  Per-fortress isolation is structural: the record lives under the
+  fortress's storage_path, so different fortresses carry different
+  registered identifiers.
 `);
 }
 async function runExitCommand(args) {
@@ -41777,12 +42683,15 @@ ${policyErr.message}
         throw policyErr;
       }
       const includeDidWebFlag = flagValue(argv, "--include-did-web");
-      const includeDidWebDisabled = includeDidWebFlag === "false";
+      const explicitOptOut = hasFlag(argv, "--no-did-web") || includeDidWebFlag === "false";
       const didWebIdentifier = flagValue(argv, "--did-web");
       const didWebAuthorityHost = flagValue(argv, "--did-web-authority-host");
       const didWebPublishedAt = flagValue(argv, "--did-web-published-at");
       let exportDidWeb;
-      if (!includeDidWebDisabled && didWebIdentifier !== void 0) {
+      let didWebSource;
+      if (explicitOptOut) {
+        didWebSource = "opted-out";
+      } else if (didWebIdentifier !== void 0) {
         if (didWebAuthorityHost === void 0) {
           write(
             err,
@@ -41795,6 +42704,19 @@ ${policyErr.message}
           authority_host: didWebAuthorityHost,
           ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
         };
+        didWebSource = "cli-override";
+      } else {
+        const record = await loadFortressDidWebRecord(ctx.storagePath);
+        if (record !== null) {
+          exportDidWeb = {
+            identifier: record.identifier.did,
+            authority_host: record.identifier.authority_host,
+            ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
+          };
+          didWebSource = "fortress-config";
+        } else {
+          didWebSource = "no-record";
+        }
       }
       const result = await exportExitBundle({
         bundleDir: outDir,
@@ -41810,12 +42732,42 @@ ${policyErr.message}
         keySource: ctx.keySource,
         ...exportDidWeb !== void 0 ? { didWeb: exportDidWeb } : {}
       });
-      if (json) write(out, JSON.stringify(result, null, 2) + "\n");
-      else {
+      if (json) {
+        write(
+          out,
+          JSON.stringify(
+            { ...result, did_web_source: didWebSource },
+            null,
+            2
+          ) + "\n"
+        );
+      } else {
         write(out, `exported: ${result.bundle_dir}
 `);
         write(out, `manifest_hash: ${result.manifest_hash}
 `);
+        if (didWebSource === "fortress-config" && exportDidWeb) {
+          write(
+            out,
+            `did:web: auto-included from fortress config (${exportDidWeb.identifier})
+`
+          );
+        } else if (didWebSource === "cli-override" && exportDidWeb) {
+          write(
+            out,
+            `did:web: included via CLI override (${exportDidWeb.identifier})
+`
+          );
+        } else if (didWebSource === "opted-out") {
+          write(out, `did:web: skipped (operator opt-out via --no-did-web)
+`);
+        } else if (didWebSource === "no-record") {
+          write(
+            out,
+            `did:web: not included (no fortress config; run "sanctuary did-web issue" to register)
+`
+          );
+        }
         for (const item of result.unsupported_artifacts) {
           write(out, `unsupported: ${item}
 `);
@@ -42472,6 +43424,7 @@ ${err.message}
   await baseline.load();
   let approvalChannel;
   let dashboard;
+  let intelligenceSelector;
   if (config.dashboard.enabled) {
     let authToken = config.dashboard.auth_token;
     if (authToken === "auto") {
@@ -42498,7 +43451,6 @@ ${err.message}
       profileStore
     });
     const embeddedHubIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
-    let intelligenceSelector;
     try {
       intelligenceSelector = new SubstrateSelector({
         storage,
@@ -42655,6 +43607,44 @@ ${err.message}
       workflowStateTracker
     });
   }
+  const honeypotRegistry = new TrapRegistry();
+  const honeypotStore = new TrapStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
+  try {
+    const persistedSpecs = await honeypotStore.loadAll();
+    for (const spec of persistedSpecs) {
+      honeypotRegistry.deploy(spec);
+    }
+    if (persistedSpecs.length > 0) {
+      auditLog.append(
+        "l2",
+        HONEYPOT_AUDIT_OPS.LOADED,
+        aggregatorIdentityId,
+        {
+          fortress_id: fortressIdForAggregator,
+          trap_count: persistedSpecs.length
+        }
+      );
+    }
+  } catch (err) {
+    console.error(
+      `  Note: honeypot trap store unavailable (${err.message}). Deployed traps from prior runs will not be restored; re-deploy via the management API.`
+    );
+  }
+  if (dashboard) {
+    dashboard.setHoneypotRegistry({
+      registry: honeypotRegistry,
+      findingStore: sentinelFindingStore,
+      auditLog,
+      operatorId: aggregatorIdentityId,
+      fortressId: fortressIdForAggregator,
+      ...intelligenceSelector ? { selector: intelligenceSelector } : {},
+      store: honeypotStore
+    });
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,