@sanctuary-framework/mcp-server 1.2.14 → 1.2.15

package/dist/cli.cjs

@@ -18388,6 +18388,552 @@ var init_handoff_routes = __esm({
     };
   }
 });
+
+// src/honeypot/types.ts
+function honeypotSentinelId(trapId) {
+  return `${HONEYPOT_SENTINEL_ID_PREFIX}${trapId}`;
+}
+var FILESYSTEM_OPS, HONEYPOT_AUDIT_OPS, HONEYPOT_SENTINEL_ID_PREFIX;
+var init_types3 = __esm({
+  "src/honeypot/types.ts"() {
+    FILESYSTEM_OPS = [
+      "read",
+      "write",
+      "delete",
+      "list"
+    ];
+    HONEYPOT_AUDIT_OPS = {
+      DRAFTED: "honeypot_drafted",
+      COMPILED: "honeypot_compiled",
+      DEPLOYED: "honeypot_deployed",
+      TRIGGERED: "honeypot_triggered",
+      UNDEPLOYED: "honeypot_undeployed",
+      LOADED: "honeypot_loaded"
+    };
+    HONEYPOT_SENTINEL_ID_PREFIX = "honeypot:";
+  }
+});
+async function compileHoneypot(draft, opts) {
+  const now = opts?.now ?? (() => /* @__PURE__ */ new Date());
+  const trapIdFactory = opts?.trapIdFactory ?? (() => crypto.randomUUID());
+  const warnings = [];
+  let trigger = null;
+  let trapClass = "http_endpoint";
+  let severity = DEFAULT_SEVERITY;
+  let explanation = "";
+  let source = "heuristic";
+  if (opts?.selector) {
+    try {
+      const handle = await opts.selector.getSubstrate(COMPILE_SURFACE);
+      if (handle.capability.summarize) {
+        const response = await opts.selector.invokeSummarize(
+          COMPILE_SURFACE,
+          {
+            kind: "summarize",
+            context: COMPILE_PROMPT,
+            query: draft.english_text,
+            maxTokens: COMPILE_MAX_TOKENS
+          }
+        );
+        if (response.body.kind === "summarize" && !response.failureClass) {
+          const parsed = tryParseLlmResponse(response.body.text);
+          if (parsed.ok) {
+            trigger = parsed.trigger;
+            trapClass = parsed.trapClass;
+            severity = parsed.severity;
+            explanation = parsed.explanation;
+            source = "llm";
+          } else {
+            warnings.push(
+              `LLM response failed validation (${parsed.failure}); falling back to heuristic compile`
+            );
+          }
+        } else {
+          warnings.push(
+            `LLM compile failed (${response.failureClass ?? "non_summarize_body"}); falling back to heuristic compile`
+          );
+        }
+      } else {
+        warnings.push(
+          "Substrate at template-suggestion surface does not support summarize; falling back to heuristic compile"
+        );
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      warnings.push(
+        `LLM compile threw (${message}); falling back to heuristic compile`
+      );
+    }
+  }
+  if (trigger === null) {
+    const heuristic = heuristicCompile(draft.english_text);
+    trigger = heuristic.trigger;
+    trapClass = heuristic.trapClass;
+    if (heuristic.severity) severity = heuristic.severity;
+    explanation = heuristic.explanation;
+    if (heuristic.warning) warnings.push(heuristic.warning);
+  }
+  const spec = {
+    trap_id: trapIdFactory(),
+    trap_class: trapClass,
+    trigger,
+    finding_severity: severity,
+    english_text: draft.english_text,
+    explanation_paragraph: explanation,
+    compiled_at: now().toISOString()
+  };
+  return { spec, source, warnings };
+}
+function tryParseLlmResponse(text) {
+  let body;
+  try {
+    const stripped = text.replace(/^```(?:json)?\s*|\s*```$/g, "").trim();
+    body = JSON.parse(stripped);
+  } catch {
+    return { ok: false, failure: "invalid_json" };
+  }
+  if (!body || typeof body !== "object") {
+    return { ok: false, failure: "invalid_json" };
+  }
+  const obj = body;
+  const pathPattern = obj["path_pattern"];
+  if (typeof pathPattern !== "string" || pathPattern.length === 0) {
+    return { ok: false, failure: "missing_path_pattern" };
+  }
+  const callerTypes = Array.isArray(obj["expected_caller_types"]) ? obj["expected_caller_types"].filter(
+    (v) => typeof v === "string" && v.length > 0
+  ) : ["wrapped_agent"];
+  if (callerTypes.length === 0) {
+    return { ok: false, failure: "invalid_caller_types" };
+  }
+  const severityRaw = obj["finding_severity"];
+  const severity = severityRaw === "warn" ? "warn" : severityRaw === "alert" ? "alert" : DEFAULT_SEVERITY;
+  const explanationRaw = obj["explanation_paragraph"];
+  const explanation = typeof explanationRaw === "string" && explanationRaw.length > 0 ? explanationRaw : "Honeypot compiled from operator draft via LLM-assisted compile path.";
+  const trapClassRaw = obj["trap_class"];
+  const trapClass = trapClassRaw === "filesystem" ? "filesystem" : "http_endpoint";
+  if (trapClass === "filesystem") {
+    const opsParsed = parseFilesystemOps(obj["ops"]);
+    if (opsParsed === null) {
+      return { ok: false, failure: "invalid_filesystem_ops" };
+    }
+    const trigger2 = {
+      kind: "filesystem",
+      path_pattern: pathPattern,
+      ops: opsParsed,
+      expected_caller_types: callerTypes
+    };
+    return { ok: true, trapClass, trigger: trigger2, severity, explanation };
+  }
+  const method = typeof obj["method"] === "string" ? obj["method"] : "ANY";
+  const trigger = {
+    kind: "http_endpoint",
+    path_pattern: pathPattern,
+    ...method !== "ANY" ? { method: method.toUpperCase() } : {},
+    expected_caller_types: callerTypes
+  };
+  return { ok: true, trapClass, trigger, severity, explanation };
+}
+function parseFilesystemOps(raw) {
+  if (raw === void 0 || raw === null) {
+    return [...FILESYSTEM_OPS];
+  }
+  if (!Array.isArray(raw)) return null;
+  if (raw.length === 0) return [...FILESYSTEM_OPS];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string") return null;
+    if (!FILESYSTEM_OPS.includes(entry)) return null;
+    if (!out.includes(entry)) out.push(entry);
+  }
+  return out;
+}
+function heuristicCompile(english) {
+  let pathPattern = null;
+  for (const re of HEURISTIC_PATH_PATTERNS) {
+    const match = english.match(re);
+    if (match && match[1]) {
+      pathPattern = match[1];
+      break;
+    }
+  }
+  const fallbackUsed = pathPattern === null;
+  if (pathPattern === null) {
+    pathPattern = "/honeypot-stub";
+  }
+  let severity;
+  for (const hint of SEVERITY_HINTS) {
+    if (hint.phrase.test(english)) {
+      severity = hint.severity;
+      break;
+    }
+  }
+  const isFilesystem = FILESYSTEM_CLASS_HINTS.some((re) => re.test(english));
+  if (isFilesystem) {
+    const ops = [];
+    for (const hint of FILESYSTEM_OP_HINTS) {
+      if (hint.phrase.test(english) && !ops.includes(hint.op)) {
+        ops.push(hint.op);
+      }
+    }
+    const resolvedOps = ops.length > 0 ? ops : [...FILESYSTEM_OPS];
+    const trigger2 = {
+      kind: "filesystem",
+      path_pattern: pathPattern,
+      ops: resolvedOps,
+      expected_caller_types: ["wrapped_agent"]
+    };
+    const opsRendered = resolvedOps.join(",");
+    const explanation2 = fallbackUsed ? `Filesystem honeypot compiled from operator draft via heuristic fallback; the English description did not yield a clear path pattern, so the trap is stubbed at ${pathPattern} (ops=${opsRendered}). Operator should edit the path_pattern before deploy.` : `Filesystem honeypot compiled from operator draft via heuristic compile; trap fires on ${opsRendered} operations against ${pathPattern}.`;
+    return {
+      trapClass: "filesystem",
+      trigger: trigger2,
+      ...severity !== void 0 ? { severity } : {},
+      explanation: explanation2,
+      ...fallbackUsed ? {
+        warning: "heuristic compile could not extract a path pattern from the filesystem draft; trap is stubbed at /honeypot-stub. Either rewrite the draft (e.g., 'filesystem honeypot at /etc/secrets for reads') or edit the spec's path_pattern before deploying"
+      } : {}
+    };
+  }
+  const trigger = {
+    kind: "http_endpoint",
+    path_pattern: pathPattern,
+    expected_caller_types: ["wrapped_agent"]
+  };
+  const explanation = fallbackUsed ? `Honeypot compiled from operator draft via heuristic fallback; the English description did not yield a clear path pattern, so the trap is stubbed at ${pathPattern}. Operator should edit the path_pattern before deploy.` : `Honeypot compiled from operator draft via heuristic compile; trap fires on requests to ${pathPattern}.`;
+  return {
+    trapClass: "http_endpoint",
+    trigger,
+    ...severity !== void 0 ? { severity } : {},
+    explanation,
+    ...fallbackUsed ? {
+      warning: "heuristic compile could not extract a path pattern from the draft; trap is stubbed at /honeypot-stub. Either rewrite the draft (e.g., 'honeypot at /admin/secrets') or edit the spec's path_pattern before deploying"
+    } : {}
+  };
+}
+function hashOfEnglishDraft(text) {
+  return crypto.createHash("sha256").update(text, "utf8").digest("hex").slice(0, 32);
+}
+var COMPILE_SURFACE, COMPILE_MAX_TOKENS, DEFAULT_SEVERITY, COMPILE_PROMPT, HEURISTIC_PATH_PATTERNS, SEVERITY_HINTS, FILESYSTEM_CLASS_HINTS, FILESYSTEM_OP_HINTS;
+var init_honeypot_compiler = __esm({
+  "src/honeypot/honeypot-compiler.ts"() {
+    init_types3();
+    COMPILE_SURFACE = "template-suggestion";
+    COMPILE_MAX_TOKENS = 800;
+    DEFAULT_SEVERITY = "alert";
+    COMPILE_PROMPT = `You are compiling a Sanctuary honeypot from an operator's plain-English description.
+Return STRICT JSON with the following shape (no markdown, no commentary):
+{
+  "trap_class": "http_endpoint" | "filesystem",
+  "path_pattern": "string (glob with * or **)",
+  "method": "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "ANY",
+  "ops": ["read", "write", "delete", "list"],
+  "expected_caller_types": ["wrapped_agent" | "operator" | "external"],
+  "finding_severity": "warn" | "alert",
+  "explanation_paragraph": "one-sentence operator-friendly explanation"
+}
+Default trap_class to "http_endpoint" unless the operator clearly describes filesystem access (file reads/writes, directory access, path-on-disk monitoring). The "method" field applies only to http_endpoint traps; the "ops" field applies only to filesystem traps. Match the operator's stated severity if they gave one; otherwise default to "alert". If method is unspecified for http_endpoint, return "ANY". If ops is unspecified for filesystem, return ["read","write","delete","list"]. If caller-type is unspecified, return ["wrapped_agent"]. Keep the explanation_paragraph under 200 characters.`;
+    HEURISTIC_PATH_PATTERNS = [
+      /honeypot\s+(?:at|on)\s+([\/][\w\/\-:*\.]+)/i,
+      /trap\s+(?:at|on|for)\s+([\/][\w\/\-:*\.]+)/i,
+      /deploy\s+(?:at|on)\s+([\/][\w\/\-:*\.]+)/i,
+      /catch\s+(?:requests?\s+to|callers?\s+at)\s+([\/][\w\/\-:*\.]+)/i,
+      /watch\s+(?:for\s+)?(?:requests?\s+(?:to|on))\s+([\/][\w\/\-:*\.]+)/i,
+      /([\/][\w\/\-:*\.]+)\s+(?:endpoint|path|route)/i
+    ];
+    SEVERITY_HINTS = [
+      { phrase: /\b(?:warn|warning|low\s+severity)\b/i, severity: "warn" },
+      { phrase: /\b(?:alert|critical|high\s+severity)\b/i, severity: "alert" }
+    ];
+    FILESYSTEM_CLASS_HINTS = [
+      /\bfilesystem\b/i,
+      /\bfile[-\s]?system\b/i,
+      /\bfile\s+(?:read|write|delete|list|access|trap|honeypot)/i,
+      /\b(?:read|write|delete|list)\s+file/i,
+      /\bdirectory\b/i,
+      /\bon[-\s]?disk\b/i,
+      /\bpath\s+on\s+disk\b/i
+    ];
+    FILESYSTEM_OP_HINTS = [
+      { phrase: /\b(?:read|reads|reading|access(?:es|ed)?)\b/i, op: "read" },
+      { phrase: /\b(?:write|writes|writing|modif(?:y|ies|ied)|edit)/i, op: "write" },
+      { phrase: /\b(?:delete|deletes|deletion|remove|removal|unlink)/i, op: "delete" },
+      { phrase: /\b(?:list|listing|enumerate|enumeration|directory\s+listing)/i, op: "list" }
+    ];
+  }
+});
+async function handleHoneypotTriggerIfMatch(deps, req, res) {
+  const url = req.url ?? "/";
+  const path = url.split("?")[0] ?? "/";
+  const method = (req.method ?? "GET").toUpperCase();
+  if (path.startsWith(HONEYPOT_API_PREFIX)) return false;
+  if (path.startsWith("/api/sentinels")) return false;
+  if (path.startsWith("/api/coordination")) return false;
+  const match = deps.registry.findMatching({ path, method });
+  if (!match) return false;
+  const now = (deps.now ?? (() => /* @__PURE__ */ new Date()))();
+  const callerIdentity = extractCallerIdentity(req);
+  const payloadHash = await safeReadAndHashBody(req);
+  const findingId = crypto.randomUUID();
+  const finding = {
+    finding_id: findingId,
+    sentinel_id: honeypotSentinelId(match.trap_id),
+    severity: match.finding_severity,
+    summary: buildSummary(match, callerIdentity, path, method),
+    details: {
+      trap_id: match.trap_id,
+      trap_class: match.trap_class,
+      path_matched: path,
+      method,
+      caller_identity: callerIdentity,
+      payload_hash: payloadHash
+    },
+    observed_at: now.toISOString(),
+    evidence_audit_ids: [],
+    fortress_id: deps.fortressId
+  };
+  await deps.findingStore.saveFinding(finding).catch(() => void 0);
+  deps.auditLog.append(
+    "l2",
+    HONEYPOT_AUDIT_OPS.TRIGGERED,
+    deps.operatorId,
+    {
+      trap_id: match.trap_id,
+      trap_class: match.trap_class,
+      path_matched: path,
+      method,
+      caller_identity: callerIdentity,
+      payload_hash: payloadHash,
+      finding_id: findingId,
+      severity: match.finding_severity
+    }
+  );
+  res.writeHead(404, { "Content-Type": "application/json" });
+  res.end(JSON.stringify({ error: "not_found", path }));
+  return true;
+}
+function buildSummary(spec, callerIdentity, path, method) {
+  return `honeypot ${spec.trap_id} triggered: ${method} ${path} from ${callerIdentity} (severity ${spec.finding_severity}, pattern ${spec.trigger.path_pattern})`;
+}
+function extractCallerIdentity(req) {
+  const headers = req.headers;
+  const agent = headers["x-sanctuary-agent"];
+  if (typeof agent === "string" && agent.length > 0) return `agent:${agent}`;
+  const xff = headers["x-forwarded-for"];
+  if (typeof xff === "string" && xff.length > 0) {
+    const first = xff.split(",")[0]?.trim();
+    if (first) return `ip:${first}`;
+  }
+  const ip = req.socket.remoteAddress;
+  return ip ? `ip:${ip}` : "ip:unknown";
+}
+async function safeReadAndHashBody(req) {
+  const MAX_BYTES = 64 * 1024;
+  try {
+    const chunks = [];
+    let total = 0;
+    for await (const chunk of req) {
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buf.length;
+      if (total > MAX_BYTES) {
+        return "unhashed";
+      }
+      chunks.push(buf);
+    }
+    if (chunks.length === 0) return "empty";
+    const body = Buffer.concat(chunks);
+    return crypto.createHash("sha256").update(body).digest("hex").slice(0, 32);
+  } catch {
+    return "unhashed";
+  }
+}
+function writeJSON7(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+async function readJSONBody4(req) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  if (chunks.length === 0) return void 0;
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function matchTrapIdRoute(path) {
+  const prefix = `${HONEYPOT_API_PREFIX}/traps/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  return { trapId: decodeURIComponent(rest) };
+}
+async function handleHoneypotRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== HONEYPOT_API_PREFIX && !path.startsWith(`${HONEYPOT_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "POST" && path === `${HONEYPOT_API_PREFIX}/compile`) {
+      const body = await readJSONBody4(req);
+      const englishText = body && typeof body === "object" && typeof body["english_text"] === "string" ? body["english_text"] : "";
+      if (englishText.length === 0) {
+        writeJSON7(res, 400, {
+          ok: false,
+          error: "english_text required"
+        });
+        return true;
+      }
+      const draft = {
+        english_text: englishText,
+        operator_id: deps.operatorId,
+        observed_at: (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()
+      };
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.DRAFTED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        english_hash: hashOfEnglishDraft(englishText)
+      });
+      const result = await compileHoneypot(draft, {
+        ...deps.selector !== void 0 ? { selector: deps.selector } : {},
+        ...deps.now !== void 0 ? { now: deps.now } : {}
+      });
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.COMPILED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        trap_id: result.spec.trap_id,
+        source: result.source,
+        warning_count: result.warnings.length
+      });
+      writeJSON7(res, 200, {
+        ok: true,
+        data: { spec: result.spec, source: result.source, warnings: result.warnings }
+      });
+      return true;
+    }
+    if (method === "POST" && path === `${HONEYPOT_API_PREFIX}/deploy`) {
+      const body = await readJSONBody4(req);
+      const spec = body && typeof body === "object" && body["spec"] ? body["spec"] : null;
+      if (!spec || typeof spec.trap_id !== "string" || spec.trap_id.length === 0) {
+        writeJSON7(res, 400, { ok: false, error: "spec.trap_id required" });
+        return true;
+      }
+      const isNew = deps.registry.deploy(spec);
+      let persistError = null;
+      if (deps.store) {
+        try {
+          await deps.store.save(spec);
+        } catch (err) {
+          persistError = err instanceof Error ? err.message : String(err);
+        }
+      }
+      deps.auditLog.append("l2", HONEYPOT_AUDIT_OPS.DEPLOYED, deps.operatorId, {
+        fortress_id: deps.fortressId,
+        trap_id: spec.trap_id,
+        trap_class: spec.trap_class,
+        path_pattern: spec.trigger.path_pattern,
+        was_new: isNew,
+        ...persistError !== null ? { persist_error: persistError, persisted: false } : deps.store ? { persisted: true } : {}
+      });
+      writeJSON7(res, 200, {
+        ok: true,
+        data: {
+          trap_id: spec.trap_id,
+          was_new: isNew,
+          ...deps.store ? { persisted: persistError === null } : {},
+          ...persistError !== null ? { persist_error: persistError } : {}
+        }
+      });
+      return true;
+    }
+    if (method === "GET" && path === `${HONEYPOT_API_PREFIX}/traps`) {
+      const traps = deps.registry.list();
+      writeJSON7(res, 200, { ok: true, data: { traps } });
+      return true;
+    }
+    const trapMatch = matchTrapIdRoute(path);
+    if (method === "DELETE" && trapMatch) {
+      const removed = deps.registry.undeploy(trapMatch.trapId);
+      let persistError = null;
+      if (deps.store) {
+        try {
+          await deps.store.delete(trapMatch.trapId);
+        } catch (err) {
+          persistError = err instanceof Error ? err.message : String(err);
+        }
+      }
+      if (removed) {
+        deps.auditLog.append(
+          "l2",
+          HONEYPOT_AUDIT_OPS.UNDEPLOYED,
+          deps.operatorId,
+          {
+            fortress_id: deps.fortressId,
+            trap_id: trapMatch.trapId,
+            ...persistError !== null ? { persist_error: persistError, persisted: false } : deps.store ? { persisted: true } : {}
+          }
+        );
+      }
+      writeJSON7(res, removed ? 200 : 404, {
+        ok: removed,
+        data: {
+          trap_id: trapMatch.trapId,
+          removed,
+          ...deps.store ? { persisted: persistError === null } : {},
+          ...persistError !== null ? { persist_error: persistError } : {}
+        }
+      });
+      return true;
+    }
+    if (method === "GET" && path === `${HONEYPOT_API_PREFIX}/findings`) {
+      const since = url.searchParams.get("since") ?? void 0;
+      const severityRaw = url.searchParams.get("severity") ?? void 0;
+      const severity = isValidSeverity(severityRaw) ? severityRaw : void 0;
+      const limit = parseLimit5(url.searchParams.get("limit"), 50, 500);
+      const all = await deps.findingStore.listFindings({
+        ...since !== void 0 ? { since } : {},
+        ...severity !== void 0 ? { severity } : {},
+        limit: 500
+      });
+      const honeypotFindings = all.filter(
+        (f) => f.sentinel_id.startsWith(HONEYPOT_SENTINEL_ID_PREFIX)
+      );
+      writeJSON7(res, 200, {
+        ok: true,
+        data: { findings: honeypotFindings.slice(0, limit) }
+      });
+      return true;
+    }
+    writeJSON7(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON7(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+function isValidSeverity(value) {
+  return value === "info" || value === "warn" || value === "alert";
+}
+function parseLimit5(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+  return Math.min(parsed, max);
+}
+var HONEYPOT_API_PREFIX;
+var init_runtime_trap_handler = __esm({
+  "src/honeypot/runtime-trap-handler.ts"() {
+    init_auth_middleware();
+    init_types3();
+    init_honeypot_compiler();
+    HONEYPOT_API_PREFIX = "/api/honeypot";
+  }
+});
 function isDashboardViewRoute(method, path) {
   if (method !== "GET") return false;
   return path === "/" || path === "/dashboard" || path === "/v1.0" || path === "/fortress" || path === "/events";
@@ -18404,6 +18950,7 @@ var init_dashboard = __esm({
     init_approval_aggregator_routes();
     init_sentinel_routes();
     init_handoff_routes();
+    init_runtime_trap_handler();
     SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
     SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
     MAX_SESSIONS = 1e3;
@@ -18491,6 +19038,22 @@ var init_dashboard = __esm({
       workflowStateTracker = null;
       handoffAuditLog = null;
       handoffOperatorId = null;
+      // v1.3 WP-V1.3-5 Pi-1 Honeypot Authoring: per-fortress trap registry
+      // + finding store + audit log + operator id. Front-of-dispatch hook
+      // consults the registry on every request; management routes at
+      // /api/honeypot/* go through the dispatch path.
+      honeypotRegistry = null;
+      honeypotFindingStore = null;
+      honeypotAuditLog = null;
+      honeypotOperatorId = null;
+      honeypotFortressId = null;
+      honeypotSelector = null;
+      // Pi-2: encrypted at-rest persistence for deployed honeypot traps.
+      // When present, the management API's deploy + undeploy handlers
+      // write through to the store; on fortress boot the host code calls
+      // `store.loadAll()` and re-deploys the persisted specs into the
+      // in-memory registry before this dashboard begins serving.
+      honeypotStore = null;
       constructor(config) {
         this.config = config;
         this.authToken = config.auth_token;
@@ -18572,6 +19135,30 @@ var init_dashboard = __esm({
         this.handoffContextTransfer = opts.contextTransfer ?? null;
         this.workflowStateTracker = opts.workflowStateTracker ?? null;
       }
+      /**
+       * v1.3 WP-V1.3-5 Pi-1 Honeypot Authoring: bind the per-fortress
+       * trap registry + finding store + audit log + operator id. Once
+       * set, two surfaces activate:
+       *   1. Front-of-dispatch trap-trigger hook: every request runs
+       *      through `handleHoneypotTriggerIfMatch` BEFORE legacy/v1.1/
+       *      sentinel/coordination routing. Matching traps return 404
+       *      and the request never reaches the regular dispatcher.
+       *   2. Management API at /api/honeypot/* routes through
+       *      `handleHoneypotRoute`.
+       *
+       * The optional `selector` opt wires the LLM compile path; absent
+       * selector forces the heuristic compile path (which still produces
+       * a usable TrapSpec with warnings).
+       */
+      setHoneypotRegistry(opts) {
+        this.honeypotRegistry = opts.registry;
+        this.honeypotFindingStore = opts.findingStore ?? null;
+        this.honeypotAuditLog = opts.auditLog ?? null;
+        this.honeypotOperatorId = opts.operatorId ?? null;
+        this.honeypotFortressId = opts.fortressId ?? null;
+        this.honeypotSelector = opts.selector ?? null;
+        this.honeypotStore = opts.store ?? null;
+      }
       /**
        * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
        * before the legacy approval route table. Returns true when served.
@@ -18636,6 +19223,57 @@ var init_dashboard = __esm({
           res
         );
       }
+      /**
+       * v1.3 WP-V1.3-5 Pi-1 dispatch entry point. Routes
+       * `/api/honeypot/*` requests through the honeypot management
+       * router when a registry has been bound. Returns true when served.
+       */
+      async dispatchHoneypot(req, res) {
+        if (!this.honeypotRegistry || !this.honeypotFindingStore || !this.honeypotAuditLog) {
+          return false;
+        }
+        return handleHoneypotRoute(
+          {
+            authConfig: {
+              loopbackAutoAuth: this._autoAuthLocalhost,
+              ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+            },
+            registry: this.honeypotRegistry,
+            findingStore: this.honeypotFindingStore,
+            auditLog: this.honeypotAuditLog,
+            operatorId: this.honeypotOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
+            fortressId: this.honeypotFortressId ?? "fortress_default",
+            ...this.honeypotSelector !== null ? { selector: this.honeypotSelector } : {},
+            ...this.honeypotStore !== null ? { store: this.honeypotStore } : {}
+          },
+          req,
+          res
+        );
+      }
+      /**
+       * v1.3 WP-V1.3-5 Pi-1 front-of-dispatch trap-trigger hook. Examines
+       * every request BEFORE legacy/v1.1/sentinel/coordination routing.
+       * Returns true when a deployed trap matched the request and the
+       * handler emitted the audit event + sentinel finding + plausible
+       * 404 response. Returns false when no trap matched; caller
+       * continues with normal routing.
+       */
+      async dispatchHoneypotTrap(req, res) {
+        if (!this.honeypotRegistry || !this.honeypotFindingStore || !this.honeypotAuditLog) {
+          return false;
+        }
+        return handleHoneypotTriggerIfMatch(
+          {
+            registry: this.honeypotRegistry,
+            findingStore: this.honeypotFindingStore,
+            auditLog: this.honeypotAuditLog,
+            operatorId: this.honeypotOperatorId ?? this.identityManager?.getPrimaryIdentityId() ?? "operator_dashboard",
+            fortressId: this.honeypotFortressId ?? "fortress_default"
+          },
+          req,
+          res
+        );
+      }
       /**
        * v1.1 dispatch entry point. Called from `handleRequest` before the
        * legacy route table. Returns true when the request was served by v1.1
@@ -19011,6 +19649,40 @@ var init_dashboard = __esm({
           res.end();
           return;
         }
+        if (this.honeypotRegistry) {
+          this.dispatchHoneypotTrap(req, res).then((handled) => {
+            if (handled) return;
+            this.continueHandleRequest(req, res, url, method, origin, selfOrigin);
+          }).catch(() => {
+            if (!res.headersSent) {
+              res.writeHead(500, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ error: "Internal server error" }));
+            }
+          });
+          return;
+        }
+        this.continueHandleRequest(req, res, url, method, origin, selfOrigin);
+      }
+      /**
+       * v1.3 WP-V1.3-5 Pi-1: post-honeypot-trap request continuation. The
+       * front-of-dispatch trap-trigger hook may short-circuit a request;
+       * when it does not, this method runs the original dispatch ladder.
+       * Pulled out as a helper so the trap-hook + non-trap paths share
+       * one code path through every downstream dispatcher.
+       */
+      continueHandleRequest(req, res, url, method, _origin, _selfOrigin) {
+        if (this.honeypotRegistry && url.pathname.startsWith(HONEYPOT_API_PREFIX)) {
+          this.dispatchHoneypot(req, res).then((handled) => {
+            if (handled) return;
+            this.handleLegacyRequest(req, res, url, method);
+          }).catch(() => {
+            if (!res.headersSent) {
+              res.writeHead(500, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ error: "Internal server error" }));
+            }
+          });
+          return;
+        }
         if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
           this.dispatchApprovalInbox(req, res).then((handled) => {
             if (handled) return;
@@ -22443,7 +23115,7 @@ function proxyServerFromAuditEntry(entry) {
   return server;
 }
 var SENTINEL_SUMMARY_MAX_CHARS, SENTINEL_AUDIT_OPS, SENTINEL_OBSERVED_AUDIT_OPS;
-var init_types3 = __esm({
+var init_types4 = __esm({
   "src/sentinel/types.ts"() {
     SENTINEL_SUMMARY_MAX_CHARS = 240;
     SENTINEL_AUDIT_OPS = {
@@ -22477,7 +23149,7 @@ var init_sentinel_finding_store = __esm({
     init_encryption();
     init_key_derivation();
     init_encoding();
-    init_types3();
+    init_types4();
     SENTINEL_FINDING_NAMESPACE = "_sentinel_findings";
     SENTINEL_FINDING_KEY_PREFIX = "finding.";
     HKDF_INFO2 = "l2-sentinel-finding-v1";
@@ -22720,7 +23392,7 @@ var init_sentinel_registry = __esm({
 var DEFAULT_TICK_INTERVAL_MS, SentinelDispatcher;
 var init_sentinel_dispatcher = __esm({
   "src/sentinel/sentinel-dispatcher.ts"() {
-    init_types3();
+    init_types4();
     DEFAULT_TICK_INTERVAL_MS = 6e4;
     SentinelDispatcher = class {
       registry;
@@ -23086,7 +23758,7 @@ function formatAnomalySummary(detector, classifier, vector, prediction, severity
   return `${detector.detectorId}/${classifier.classifierId} ${severity}: agent ${vector.agent_id} drifted ${prediction.anomaly_score.toFixed(2)} sigma from baseline. Top contributors: ${top || "(none)"}.`;
 }
 var AnomalyDetector, ANOMALY_SENTINEL_ID_PREFIX;
-var init_types4 = __esm({
+var init_types5 = __esm({
   "src/anomaly-detection/types.ts"() {
     AnomalyDetector = class {
       /**
@@ -23214,7 +23886,7 @@ var init_anomaly_pipeline = __esm({
   "src/anomaly-detection/anomaly-pipeline.ts"() {
     init_cusum();
     init_psi();
-    init_types4();
+    init_types5();
     ANOMALY_AUDIT_OPS = {
       DETECTOR_REGISTERED: "anomaly_detector_registered",
       DETECTOR_UNREGISTERED: "anomaly_detector_unregistered",
@@ -23577,6 +24249,198 @@ var init_workflow_state_tracker = __esm({
   }
 });
 
+// src/honeypot/trap-registry.ts
+function matchesTrap(spec, input) {
+  if (spec.trigger.kind !== "http_endpoint") return false;
+  const trigger = spec.trigger;
+  if (trigger.method && trigger.method.toUpperCase() !== input.method.toUpperCase()) {
+    return false;
+  }
+  const re = compileGlob(trigger.path_pattern);
+  return re.test(input.path);
+}
+function compileGlob(pattern) {
+  let out = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "*" && pattern[i + 1] === "*") {
+      out += ".*";
+      i += 2;
+      continue;
+    }
+    if (ch === "*") {
+      out += "[^/]*";
+      i += 1;
+      continue;
+    }
+    if ("\\^$.|?+()[]{}".includes(ch)) {
+      out += `\\${ch}`;
+    } else {
+      out += ch;
+    }
+    i += 1;
+  }
+  return new RegExp(`^${out}$`);
+}
+var TrapRegistry;
+var init_trap_registry = __esm({
+  "src/honeypot/trap-registry.ts"() {
+    TrapRegistry = class {
+      traps = /* @__PURE__ */ new Map();
+      /**
+       * Deploy a trap. Idempotent on `trap_id`: re-deploying replaces the
+       * previous spec for that id. Returns true on first deploy, false on
+       * re-deploy (so callers can branch audit emission).
+       */
+      deploy(spec) {
+        const isNew = !this.traps.has(spec.trap_id);
+        this.traps.set(spec.trap_id, spec);
+        return isNew;
+      }
+      /**
+       * Undeploy by trap_id. Returns true when a trap was removed, false
+       * when no trap had that id (idempotent).
+       */
+      undeploy(trapId) {
+        return this.traps.delete(trapId);
+      }
+      /** List deployed traps. Returns a fresh array; mutation is safe. */
+      list() {
+        return [...this.traps.values()];
+      }
+      /** Look up a single trap by id. */
+      get(trapId) {
+        return this.traps.get(trapId);
+      }
+      /**
+       * Find the first trap matching the request. Iteration order is
+       * insertion order; operators who deploy multiple overlapping traps
+       * see the earliest-deployed one fire. Tests cover this contract.
+       */
+      findMatching(input) {
+        for (const spec of this.traps.values()) {
+          if (matchesTrap(spec, input)) return spec;
+        }
+        return void 0;
+      }
+      /** Drop every trap. Tests use this between runs; not surfaced via API. */
+      clear() {
+        this.traps.clear();
+      }
+    };
+  }
+});
+
+// src/honeypot/trap-store.ts
+function trapKey(trapId) {
+  return `${TRAP_STORE_KEY_PREFIX}${trapId}`;
+}
+function stripKeyPrefix3(key) {
+  if (!key.startsWith(TRAP_STORE_KEY_PREFIX)) return null;
+  return key.slice(TRAP_STORE_KEY_PREFIX.length);
+}
+var TRAP_STORE_NAMESPACE, TRAP_STORE_KEY_PREFIX, HKDF_INFO4, MAX_TRAP_BYTES, TrapStore;
+var init_trap_store = __esm({
+  "src/honeypot/trap-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    TRAP_STORE_NAMESPACE = "_honeypot_traps";
+    TRAP_STORE_KEY_PREFIX = "trap.";
+    HKDF_INFO4 = "l2-honeypot-trap-v1";
+    MAX_TRAP_BYTES = 64 * 1024;
+    TrapStore = class {
+      storage;
+      encryptionKey;
+      fortressId;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO4);
+        this.fortressId = opts.fortressId;
+      }
+      /** Persist (or overwrite) one trap. Returns the trap_id on success. */
+      async save(spec) {
+        const persisted = { version: 1, spec };
+        const aad = stringToBytes(spec.trap_id);
+        const plaintext = stringToBytes(JSON.stringify(persisted));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          TRAP_STORE_NAMESPACE,
+          trapKey(spec.trap_id),
+          stringToBytes(JSON.stringify(envelope))
+        );
+        return spec.trap_id;
+      }
+      /**
+       * Remove one trap by id. Returns true when a record was removed,
+       * false when no record existed (idempotent).
+       */
+      async delete(trapId) {
+        try {
+          const raw = await this.storage.read(
+            TRAP_STORE_NAMESPACE,
+            trapKey(trapId)
+          );
+          if (!raw) return false;
+          await this.storage.delete(TRAP_STORE_NAMESPACE, trapKey(trapId));
+          return true;
+        } catch {
+          return false;
+        }
+      }
+      /**
+       * Load every persisted trap. Used at boot to repopulate the
+       * in-memory TrapRegistry. Corrupted records are silently skipped
+       * so one malformed entry never blocks the rest of the fortress's
+       * traps from rehydrating.
+       *
+       * Returns the specs sorted by `compiled_at` ascending so the
+       * in-memory registry's insertion order matches the original
+       * deploy order (relevant for Pi-1's "first-deployed wins on
+       * overlapping match" contract).
+       */
+      async loadAll() {
+        const metas = await this.storage.list(
+          TRAP_STORE_NAMESPACE,
+          TRAP_STORE_KEY_PREFIX
+        );
+        const out = [];
+        for (const meta of metas) {
+          const trapId = stripKeyPrefix3(meta.key);
+          if (trapId === null) continue;
+          const raw = await this.storage.read(TRAP_STORE_NAMESPACE, meta.key);
+          if (!raw) continue;
+          if (raw.length > MAX_TRAP_BYTES) continue;
+          const spec = this.decode(trapId, raw);
+          if (spec !== null) out.push(spec);
+        }
+        out.sort(
+          (a, b) => a.compiled_at < b.compiled_at ? -1 : a.compiled_at > b.compiled_at ? 1 : 0
+        );
+        return out;
+      }
+      /** Read-only fortress-id getter. */
+      getFortressId() {
+        return this.fortressId;
+      }
+      decode(trapId, raw) {
+        try {
+          const aad = stringToBytes(trapId);
+          const envelope = JSON.parse(bytesToString(raw));
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const persisted = JSON.parse(bytesToString(plaintext));
+          if (persisted.version !== 1) return null;
+          if (persisted.spec.trap_id !== trapId) return null;
+          return persisted.spec;
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+});
+
 // src/sentinel/sentinel.ts
 var Sentinel;
 var init_sentinel = __esm({
@@ -23617,7 +24481,7 @@ var EGRESS_VOLUME_SENTINEL_ID, WARN_SIGMA, ALERT_SIGMA, BASELINE_WINDOWS, QUERY_
 var init_egress_volume_watcher = __esm({
   "src/sentinel/sentinels/egress-volume-watcher.ts"() {
     init_sentinel();
-    init_types3();
+    init_types4();
     EGRESS_VOLUME_SENTINEL_ID = "egress-volume";
     WARN_SIGMA = 3;
     ALERT_SIGMA = 6;
@@ -36521,7 +37385,7 @@ var init_recovery_key_disclosure = __esm({
 });
 
 // src/hub/types.ts
-var init_types5 = __esm({
+var init_types6 = __esm({
   "src/hub/types.ts"() {
   }
 });
@@ -37560,7 +38424,7 @@ var init_hub = __esm({
   "src/hub/index.ts"() {
     init_constants3();
     init_errors4();
-    init_types5();
+    init_types6();
     init_agent_registry();
     init_inbox_store();
     init_inbox_aggregator();
@@ -39288,7 +40152,7 @@ ${runningLines.join("\n")}`;
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
-var OPERATOR_CHAT_NAMESPACE, HKDF_INFO4, OperatorChatStore;
+var OPERATOR_CHAT_NAMESPACE, HKDF_INFO5, OperatorChatStore;
 var init_operator_chat_store = __esm({
   "src/chat/operator-chat-store.ts"() {
     init_encryption();
@@ -39296,13 +40160,13 @@ var init_operator_chat_store = __esm({
     init_encoding();
     init_operator_chat_types();
     OPERATOR_CHAT_NAMESPACE = "_chat";
-    HKDF_INFO4 = "operator-chat-store-v1";
+    HKDF_INFO5 = "operator-chat-store-v1";
     OperatorChatStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO5);
       }
       /**
        * Load a thread. Returns null if no record exists or if the on-disk
@@ -39387,7 +40251,7 @@ var init_operator_chat_store = __esm({
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix3(key) {
+function stripKeyPrefix4(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -39398,7 +40262,7 @@ function lastTurnId(bundle) {
   }
   return max;
 }
-var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO5, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
+var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO6, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
 var init_concierge_memory_store = __esm({
   "src/chat/concierge-memory-store.ts"() {
     init_encryption();
@@ -39406,7 +40270,7 @@ var init_concierge_memory_store = __esm({
     init_encoding();
     CONCIERGE_MEMORY_NAMESPACE = "_chat";
     CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-    HKDF_INFO5 = "concierge-memory-store-v1";
+    HKDF_INFO6 = "concierge-memory-store-v1";
     DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
     MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
     ConciergeMemoryStore = class {
@@ -39417,7 +40281,7 @@ var init_concierge_memory_store = __esm({
       locks;
       constructor(opts) {
         this.storage = opts.storage;
-        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO5);
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO6);
         this.fortressId = opts.fortressId;
         this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
         this.locks = /* @__PURE__ */ new Map();
@@ -39543,7 +40407,7 @@ var init_concierge_memory_store = __esm({
         );
         const summaries = [];
         for (const meta of entries) {
-          const threadId = stripKeyPrefix3(meta.key);
+          const threadId = stripKeyPrefix4(meta.key);
           if (threadId === null) continue;
           const bundle = await this.loadBundle(threadId);
           if (!bundle || bundle.turns.length === 0) continue;
@@ -39596,7 +40460,7 @@ var init_concierge_memory_store = __esm({
         );
         let pruned = 0;
         for (const meta of entries) {
-          const threadId = stripKeyPrefix3(meta.key);
+          const threadId = stripKeyPrefix4(meta.key);
           if (threadId === null) continue;
           pruned += await this.withLock(threadId, async () => {
             const bundle = await this.loadBundle(threadId);
@@ -40066,7 +40930,7 @@ var init_defaults = __esm({
 });
 
 // src/intelligence/policy-store.ts
-var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO6, IntelligenceConfigStore;
+var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO7, IntelligenceConfigStore;
 var init_policy_store = __esm({
   "src/intelligence/policy-store.ts"() {
     init_encryption();
@@ -40075,13 +40939,13 @@ var init_policy_store = __esm({
     init_defaults();
     INTELLIGENCE_NAMESPACE = "_intelligence";
     SUBSTRATE_CONFIG_KEY = "substrate-config";
-    HKDF_INFO6 = "intelligence-substrate-config";
+    HKDF_INFO7 = "intelligence-substrate-config";
     IntelligenceConfigStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO6);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO7);
       }
       /**
        * Load the operator's substrate config from disk. Returns the config
@@ -41874,8 +42738,60 @@ var init_model_provenance = __esm({
 });
 
 // src/storage/memory.ts
+var MemoryStorage;
 var init_memory = __esm({
   "src/storage/memory.ts"() {
+    MemoryStorage = class {
+      store = /* @__PURE__ */ new Map();
+      storageKey(namespace, key) {
+        return `${namespace}/${key}`;
+      }
+      async write(namespace, key, data) {
+        this.store.set(this.storageKey(namespace, key), {
+          data: new Uint8Array(data),
+          // Copy to prevent external mutation
+          modified_at: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+      async read(namespace, key) {
+        const entry = this.store.get(this.storageKey(namespace, key));
+        if (!entry) return null;
+        return new Uint8Array(entry.data);
+      }
+      async delete(namespace, key, _secureOverwrite) {
+        return this.store.delete(this.storageKey(namespace, key));
+      }
+      async list(namespace, prefix) {
+        const entries = [];
+        const nsPrefix = `${namespace}/`;
+        for (const [storeKey, entry] of this.store) {
+          if (!storeKey.startsWith(nsPrefix)) continue;
+          const key = storeKey.slice(nsPrefix.length);
+          if (prefix && !key.startsWith(prefix)) continue;
+          entries.push({
+            key,
+            namespace,
+            size_bytes: entry.data.length,
+            modified_at: entry.modified_at
+          });
+        }
+        return entries.sort((a, b) => a.key.localeCompare(b.key));
+      }
+      async exists(namespace, key) {
+        return this.store.has(this.storageKey(namespace, key));
+      }
+      async totalSize() {
+        let total = 0;
+        for (const entry of this.store.values()) {
+          total += entry.data.length;
+        }
+        return total;
+      }
+      /** Clear all stored data (useful in tests) */
+      clear() {
+        this.store.clear();
+      }
+    };
   }
 });
 
@@ -42122,7 +43038,55 @@ async function defaultFetcher(url, init) {
     json: () => response.json()
   };
 }
-var DID_CONTEXT, DEFAULT_TIMEOUT_MS4, HOST_RE, FORTRESS_LABEL_RE, AGENT_LABEL_RE;
+async function loadFortressDidWebRecord(storagePath) {
+  const persistPath = path.join(storagePath, FORTRESS_DID_WEB_REGISTRY_PATH);
+  let raw;
+  try {
+    raw = await promises.readFile(persistPath, "utf-8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return null;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    throw new Error(
+      `did-web: fortress-config record at ${persistPath} is not valid JSON: ${message}`
+    );
+  }
+  if (!isFortressDidWebRecord(parsed)) {
+    throw new Error(
+      `did-web: fortress-config record at ${persistPath} is malformed (expected version: 1 with identifier.did + identifier.authority_host)`
+    );
+  }
+  return parsed;
+}
+function isFortressDidWebRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (v["version"] !== 1) return false;
+  const id = v["identifier"];
+  if (!id || typeof id !== "object") return false;
+  if (typeof id["did"] !== "string" || !id["did"].startsWith("did:web:")) {
+    return false;
+  }
+  if (typeof id["authority_host"] !== "string") return false;
+  if (typeof id["fortress_id"] !== "string") return false;
+  if (typeof id["created_at"] !== "string") return false;
+  if (!id["did_document"] || typeof id["did_document"] !== "object") {
+    return false;
+  }
+  const artifact = v["artifact"];
+  if (!artifact || typeof artifact !== "object") return false;
+  if (typeof artifact["url"] !== "string") return false;
+  if (typeof artifact["publish_path"] !== "string") return false;
+  if (typeof artifact["sha256"] !== "string") return false;
+  return true;
+}
+var DID_CONTEXT, DEFAULT_TIMEOUT_MS4, HOST_RE, FORTRESS_LABEL_RE, AGENT_LABEL_RE, FORTRESS_DID_WEB_REGISTRY_PATH;
 var init_did_web = __esm({
   "src/recognition/did-web.ts"() {
     init_encoding();
@@ -42135,6 +43099,7 @@ var init_did_web = __esm({
     HOST_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/i;
     FORTRESS_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
     AGENT_LABEL_RE = /^[a-zA-Z0-9_-]{1,64}$/;
+    FORTRESS_DID_WEB_REGISTRY_PATH = "recognition/did-web.json";
   }
 });
 
@@ -43605,9 +44570,31 @@ Options:
   --accept-unverifiable-attestations
                                     On import: accept reputation attestations whose
                                     signer DID is not in the bundle (Tier 1 confirmation)
+  --did-web <identifier>            Embed a specific did:web identifier in the export
+                                    manifest. Requires --did-web-authority-host.
+                                    Overrides fortress-config auto-inclusion.
+  --did-web-authority-host <host>   Authority host for --did-web (required with it).
+  --did-web-published-at <iso8601>  Operator's claimed publication time for the DID
+                                    Document (optional; ISO 8601).
+  --no-did-web                      Explicit opt-out: skip did:web inclusion even if
+                                    a fortress-config record exists. (Alias for
+                                    --include-did-web=false.)
+  --did-web-allowed-host <host>     On import: host allowed for outbound did:web
+                                    resolution; repeatable. Empty means refuse to
+                                    resolve (no-outbound-by-default).
+  --skip-did-web-verify             On import: skip did:web resolution entirely.
   --json
   --yes, -y                         Explicit non-interactive Tier 1 approval
   --help, -h
+
+did:web auto-inclusion (build 3):
+  Running "sanctuary did-web issue --authority-host <host>" registers the
+  operator's did:web identifier at <storage>/recognition/did-web.json.
+  Subsequent "sanctuary exit export" runs auto-include this identifier in
+  the manifest's identity_binding without requiring any --did-web flag.
+  Per-fortress isolation is structural: the record lives under the
+  fortress's storage_path, so different fortresses carry different
+  registered identifiers.
 `);
 }
 async function runExitCommand(args) {
@@ -43706,12 +44693,15 @@ ${policyErr.message}
         throw policyErr;
       }
       const includeDidWebFlag = flagValue(argv, "--include-did-web");
-      const includeDidWebDisabled = includeDidWebFlag === "false";
+      const explicitOptOut = hasFlag(argv, "--no-did-web") || includeDidWebFlag === "false";
       const didWebIdentifier = flagValue(argv, "--did-web");
       const didWebAuthorityHost = flagValue(argv, "--did-web-authority-host");
       const didWebPublishedAt = flagValue(argv, "--did-web-published-at");
       let exportDidWeb;
-      if (!includeDidWebDisabled && didWebIdentifier !== void 0) {
+      let didWebSource;
+      if (explicitOptOut) {
+        didWebSource = "opted-out";
+      } else if (didWebIdentifier !== void 0) {
         if (didWebAuthorityHost === void 0) {
           write(
             err,
@@ -43724,6 +44714,19 @@ ${policyErr.message}
           authority_host: didWebAuthorityHost,
           ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
         };
+        didWebSource = "cli-override";
+      } else {
+        const record = await loadFortressDidWebRecord(ctx.storagePath);
+        if (record !== null) {
+          exportDidWeb = {
+            identifier: record.identifier.did,
+            authority_host: record.identifier.authority_host,
+            ...didWebPublishedAt !== void 0 ? { published_at: didWebPublishedAt } : {}
+          };
+          didWebSource = "fortress-config";
+        } else {
+          didWebSource = "no-record";
+        }
       }
       const result = await exportExitBundle({
         bundleDir: outDir,
@@ -43739,12 +44742,42 @@ ${policyErr.message}
         keySource: ctx.keySource,
         ...exportDidWeb !== void 0 ? { didWeb: exportDidWeb } : {}
       });
-      if (json) write(out, JSON.stringify(result, null, 2) + "\n");
-      else {
+      if (json) {
+        write(
+          out,
+          JSON.stringify(
+            { ...result, did_web_source: didWebSource },
+            null,
+            2
+          ) + "\n"
+        );
+      } else {
         write(out, `exported: ${result.bundle_dir}
 `);
         write(out, `manifest_hash: ${result.manifest_hash}
 `);
+        if (didWebSource === "fortress-config" && exportDidWeb) {
+          write(
+            out,
+            `did:web: auto-included from fortress config (${exportDidWeb.identifier})
+`
+          );
+        } else if (didWebSource === "cli-override" && exportDidWeb) {
+          write(
+            out,
+            `did:web: included via CLI override (${exportDidWeb.identifier})
+`
+          );
+        } else if (didWebSource === "opted-out") {
+          write(out, `did:web: skipped (operator opt-out via --no-did-web)
+`);
+        } else if (didWebSource === "no-record") {
+          write(
+            out,
+            `did:web: not included (no fortress config; run "sanctuary did-web issue" to register)
+`
+          );
+        }
         for (const item of result.unsupported_artifacts) {
           write(out, `unsupported: ${item}
 `);
@@ -43895,6 +44928,7 @@ var init_cli = __esm({
     init_encoding();
     init_bundle();
     init_verifier2();
+    init_did_web();
   }
 });
 
@@ -44449,6 +45483,7 @@ ${err.message}
   await baseline.load();
   let approvalChannel;
   let dashboard;
+  let intelligenceSelector;
   if (config.dashboard.enabled) {
     let authToken = config.dashboard.auth_token;
     if (authToken === "auto") {
@@ -44475,7 +45510,6 @@ ${err.message}
       profileStore
     });
     const embeddedHubIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
-    let intelligenceSelector;
     try {
       intelligenceSelector = new SubstrateSelector({
         storage,
@@ -44632,6 +45666,44 @@ ${err.message}
       workflowStateTracker
     });
   }
+  const honeypotRegistry = new TrapRegistry();
+  const honeypotStore = new TrapStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
+  try {
+    const persistedSpecs = await honeypotStore.loadAll();
+    for (const spec of persistedSpecs) {
+      honeypotRegistry.deploy(spec);
+    }
+    if (persistedSpecs.length > 0) {
+      auditLog.append(
+        "l2",
+        HONEYPOT_AUDIT_OPS.LOADED,
+        aggregatorIdentityId,
+        {
+          fortress_id: fortressIdForAggregator,
+          trap_count: persistedSpecs.length
+        }
+      );
+    }
+  } catch (err) {
+    console.error(
+      `  Note: honeypot trap store unavailable (${err.message}). Deployed traps from prior runs will not be restored; re-deploy via the management API.`
+    );
+  }
+  if (dashboard) {
+    dashboard.setHoneypotRegistry({
+      registry: honeypotRegistry,
+      findingStore: sentinelFindingStore,
+      auditLog,
+      operatorId: aggregatorIdentityId,
+      fortressId: fortressIdForAggregator,
+      ...intelligenceSelector ? { selector: intelligenceSelector } : {},
+      store: honeypotStore
+    });
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -44832,6 +45904,9 @@ var init_src = __esm({
     init_handoff_log();
     init_handoff_routes();
     init_workflow_state_tracker();
+    init_trap_registry();
+    init_trap_store();
+    init_types3();
     init_sentinels();
     init_subscription_store();
     init_tools4();
@@ -50271,6 +51346,14 @@ Options:
   --json                    Output as JSON.
   --help, -h                Show this help.
 
+Fortress-config auto-inclusion (build 3): "issue" persists the record
+at <storage>/recognition/did-web.json. This file IS the fortress's
+registered did:web identifier. Subsequent "sanctuary exit export"
+runs auto-include it in the manifest without any --did-web flag.
+Per-fortress isolation is structural (different storage paths carry
+different records). Use "sanctuary exit export --no-did-web" to
+opt out for a specific export without removing the registration.
+
 Castle-walking note: did:web resolution is outbound HTTPS by design.
 This CLI never opens an outbound socket. The opt-in surface is your
 choice to run "did-web issue" with --authority-host; the resulting
@@ -50405,7 +51488,7 @@ async function cmdIssue(argv, out, err, env) {
     write3(out, JSON.stringify(record, null, 2) + "\n");
     return 0;
   }
-  write3(out, `did:web identifier issued.
+  write3(out, `did:web identifier issued and registered on this fortress.
 `);
   write3(out, `  DID:            ${identifier.did}
 `);
@@ -50427,6 +51510,13 @@ Next step: publish the DID Document to your HTTPS host.
   const artifactPath = path.join(persistDir, "did.json");
   await promises.writeFile(artifactPath, artifact.artifact, { mode: 420 });
   write3(out, `
+Auto-inclusion: subsequent "sanctuary exit export" runs will
+`);
+  write3(out, `auto-include this identifier in the bundle manifest. Pass
+`);
+  write3(out, `"--no-did-web" to opt out for a specific export.
+`);
+  write3(out, `
 Castle-walking note: this CLI never opens an outbound socket.
 `);
   write3(out, `Publishing the DID Document is your operation; serve the artifact
@@ -50461,7 +51551,7 @@ Run "sanctuary did-web issue --authority-host <host>" to issue one.
     return 0;
   }
   const parsed = JSON.parse(bytes.toString("utf-8"));
-  write3(out, `did:web identifier on this fortress:
+  write3(out, `did:web identifier registered on this fortress:
 `);
   write3(out, `  DID:            ${parsed.identifier.did}
 `);
@@ -50472,6 +51562,13 @@ Run "sanctuary did-web issue --authority-host <host>" to issue one.
   write3(out, `  Publish URL:    ${parsed.artifact.url}
 `);
   write3(out, `  SHA-256:        ${parsed.artifact.sha256}
+`);
+  write3(out, `
+Auto-inclusion: subsequent "sanctuary exit export" runs auto-include
+`);
+  write3(out, `this identifier in the bundle manifest without --did-web. Pass
+`);
+  write3(out, `"--no-did-web" to opt out for a specific export.
 `);
   return 0;
 }
@@ -50685,7 +51782,7 @@ var init_per_agent_activity = __esm({
 var PER_AGENT_ACTIVITY_DETECTOR_ID, PerAgentActivityDetector, PendingClassifier;
 var init_per_agent_activity_detector = __esm({
   "src/anomaly-detection/detectors/per-agent-activity-detector.ts"() {
-    init_types4();
+    init_types5();
     init_rolling_baseline();
     init_classifier_state_store();
     init_per_agent_activity();
@@ -51165,7 +52262,1064 @@ var init_anomaly = __esm({
     init_anomaly_catalog();
     init_anomaly_subscription_store();
     init_classifier_state_store();
-    init_types4();
+    init_types5();
+  }
+});
+function computeDraftId(draft) {
+  return crypto.createHash("sha256").update(`${draft.english_text}|${draft.observed_at}|${draft.operator_id}`).digest("hex");
+}
+function compileDeterministic(text) {
+  const normalized = text.trim().toLowerCase();
+  const requireMatch = normalized.match(
+    /^(always\s+)?require approval (?:for|on) ([a-z][a-z0-9_]*)\.?$/
+  );
+  if (requireMatch) {
+    const op = requireMatch[2];
+    return {
+      rule: { kind: "tier1_add_operation", operation: op },
+      explanation: `Adds "${op}" to the Tier 1 always-approve list. Every call to ${op} will require explicit human approval before it executes.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  const noAgentMatch = normalized.match(
+    /^no agent should ([a-z][a-z0-9_]*)\.?$/
+  );
+  if (noAgentMatch) {
+    const op = noAgentMatch[1];
+    return {
+      rule: { kind: "tier1_add_operation", operation: op },
+      explanation: `Adds "${op}" to the Tier 1 always-approve list. The operator must approve every ${op} call before it executes.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  const allowMatch = normalized.match(
+    /^(?:allow ([a-z][a-z0-9_]*) without approval|auto-allow ([a-z][a-z0-9_]*))\.?$/
+  );
+  if (allowMatch) {
+    const op = allowMatch[1] ?? allowMatch[2];
+    return {
+      rule: { kind: "tier3_add_operation", operation: op },
+      explanation: `Adds "${op}" to the Tier 3 always-allow list. Calls to ${op} will be audit-logged but never block on approval.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  const removeMatch = normalized.match(
+    /^(?:remove ([a-z][a-z0-9_]*) from approval list|stop requiring approval for ([a-z][a-z0-9_]*))\.?$/
+  );
+  if (removeMatch) {
+    const op = removeMatch[1] ?? removeMatch[2];
+    return {
+      rule: { kind: "tier1_remove_operation", operation: op },
+      explanation: `Removes "${op}" from the Tier 1 always-approve list. Future calls will fall through to Tier 2 anomaly evaluation or Tier 3 if explicitly listed.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  const tier2Multiplier = normalized.match(
+    /^set anomaly frequency multiplier to (\d+(?:\.\d+)?)\.?$/
+  );
+  if (tier2Multiplier) {
+    const value = Number.parseFloat(tier2Multiplier[1]);
+    return {
+      rule: {
+        kind: "tier2_set_field",
+        tier2_update: { field: "frequency_spike_multiplier", value }
+      },
+      explanation: `Sets the Tier 2 anomaly frequency multiplier to ${value}. Tool calls that exceed the rolling baseline by more than this multiple will fire an anomaly evaluation.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  const tier2MaxSigns = normalized.match(
+    /^set max signs per minute to (\d+)\.?$/
+  );
+  if (tier2MaxSigns) {
+    const value = Number.parseInt(tier2MaxSigns[1], 10);
+    return {
+      rule: {
+        kind: "tier2_set_field",
+        tier2_update: { field: "max_signs_per_minute", value }
+      },
+      explanation: `Caps Tier 2 signing operations at ${value} per minute. Crossing the cap fires an anomaly evaluation.`,
+      confidence: "high",
+      warnings: []
+    };
+  }
+  return null;
+}
+function parseLlmOutput(text) {
+  let parsed;
+  try {
+    const stripped = text.replace(/^```(?:json)?\n?/, "").replace(/\n?```$/, "").trim();
+    parsed = JSON.parse(stripped);
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return { ok: false, reason: "top-level is not an object" };
+  }
+  const obj = parsed;
+  const ruleObj = obj["rule"];
+  if (!ruleObj || typeof ruleObj !== "object") {
+    return { ok: false, reason: "missing or non-object rule" };
+  }
+  const rule = ruleObj;
+  const kindRaw = rule["kind"];
+  if (typeof kindRaw !== "string" || !isValidKind(kindRaw)) {
+    return { ok: false, reason: `invalid rule.kind: ${String(kindRaw)}` };
+  }
+  const compiledRule = { kind: kindRaw };
+  if (typeof rule["operation"] === "string") {
+    compiledRule.operation = rule["operation"];
+  }
+  const tier2 = rule["tier2_update"];
+  if (tier2 && typeof tier2 === "object") {
+    const fld = tier2["field"];
+    const val = tier2["value"];
+    if (typeof fld === "string" && (typeof val === "number" || typeof val === "string")) {
+      compiledRule.tier2_update = {
+        field: fld,
+        value: val
+      };
+    }
+  }
+  if (kindRaw === "tier1_add_operation" || kindRaw === "tier1_remove_operation" || kindRaw === "tier3_add_operation" || kindRaw === "tier3_remove_operation") {
+    if (typeof compiledRule.operation !== "string" || compiledRule.operation.length === 0) {
+      return { ok: false, reason: `${kindRaw} requires operation` };
+    }
+  }
+  if (kindRaw === "tier2_set_field" && compiledRule.tier2_update === void 0) {
+    return { ok: false, reason: "tier2_set_field requires tier2_update" };
+  }
+  const explanation = typeof obj["explanation"] === "string" ? obj["explanation"] : "";
+  if (!explanation) return { ok: false, reason: "missing explanation" };
+  let confidence = "medium";
+  const confRaw = obj["confidence"];
+  if (confRaw === "high" || confRaw === "medium" || confRaw === "low") {
+    confidence = confRaw;
+  }
+  const warnings = [];
+  const warnRaw = obj["warnings"];
+  if (Array.isArray(warnRaw)) {
+    for (const w of warnRaw) {
+      if (typeof w === "string") warnings.push(w);
+    }
+  }
+  return { ok: true, rule: compiledRule, explanation, confidence, warnings };
+}
+function isValidKind(s) {
+  return s === "tier1_add_operation" || s === "tier1_remove_operation" || s === "tier3_add_operation" || s === "tier3_remove_operation" || s === "tier2_set_field";
+}
+function buildLlmPromptContext() {
+  return [
+    "You compile a Sanctuary operator's plain-English policy statement into a structured rule.",
+    "Output strictly a JSON object with these fields:",
+    '  "rule": { "kind": "<one of tier1_add_operation | tier1_remove_operation | tier3_add_operation | tier3_remove_operation | tier2_set_field>", "operation": "<snake_case>"? , "tier2_update": { "field": "<keyof Tier2Config>", "value": <number|string> }? }',
+    '  "explanation": "<operator-facing prose paragraph>"',
+    '  "confidence": "high" | "medium" | "low"',
+    '  "warnings": [ "<short warning string>" ]',
+    "Do NOT include any text outside the JSON. Do NOT activate the rule; this is a draft for operator review."
+  ].join("\n");
+}
+function buildLlmPromptQuery(englishText) {
+  return `Compile this operator policy statement: ${englishText}`;
+}
+var ENGLISH_POLICY_AUDIT_OPS, ENGLISH_POLICY_MAX_TEXT_CHARS, EnglishPolicyCompiler;
+var init_english_policy_compiler = __esm({
+  "src/policy-engine/english-policy-compiler.ts"() {
+    ENGLISH_POLICY_AUDIT_OPS = {
+      DRAFTED: "english_policy_drafted",
+      COMPILED: "english_policy_compiled",
+      COMPILE_FAILED: "english_policy_compile_failed"
+    };
+    ENGLISH_POLICY_MAX_TEXT_CHARS = 2e3;
+    EnglishPolicyCompiler = class {
+      auditLog;
+      fortressId;
+      selector;
+      now;
+      constructor(deps) {
+        this.auditLog = deps.auditLog;
+        this.fortressId = deps.fortressId;
+        this.selector = deps.selector ?? null;
+        this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      async compile(draft) {
+        const draftId = computeDraftId(draft);
+        this.auditLog.append(
+          "l2",
+          ENGLISH_POLICY_AUDIT_OPS.DRAFTED,
+          draft.operator_id,
+          {
+            draft_id: draftId,
+            text_length: draft.english_text.length,
+            fortress_id: this.fortressId
+          }
+        );
+        if (draft.english_text.length === 0) {
+          return this.buildLowConfidence(
+            draft,
+            draftId,
+            "Operator provided empty text.",
+            "deterministic",
+            ["empty input"]
+          );
+        }
+        if (draft.english_text.length > ENGLISH_POLICY_MAX_TEXT_CHARS) {
+          return this.buildLowConfidence(
+            draft,
+            draftId,
+            `Operator text exceeded ${ENGLISH_POLICY_MAX_TEXT_CHARS} chars; refusing to compile to avoid prompt blowback.`,
+            "deterministic",
+            [`text exceeds ${ENGLISH_POLICY_MAX_TEXT_CHARS} chars`]
+          );
+        }
+        const deterministic = compileDeterministic(draft.english_text);
+        if (deterministic !== null) {
+          const compiled = this.buildCompiled(
+            draft,
+            draftId,
+            deterministic.rule,
+            deterministic.explanation,
+            deterministic.confidence,
+            deterministic.warnings,
+            "deterministic"
+          );
+          this.auditCompiled(compiled);
+          return compiled;
+        }
+        if (this.selector === null) {
+          const low = this.buildLowConfidence(
+            draft,
+            draftId,
+            "No deterministic match; LLM-assist disabled.",
+            "deterministic",
+            ["no deterministic match", "LLM-assist disabled"]
+          );
+          this.auditCompileFailed(low, "no_llm_substrate");
+          return low;
+        }
+        try {
+          const resp = await this.selector.invokeSummarize("gate-explanation", {
+            kind: "summarize",
+            context: buildLlmPromptContext(),
+            query: buildLlmPromptQuery(draft.english_text),
+            maxTokens: 600
+          });
+          if (resp.failureClass) {
+            const low = this.buildLowConfidence(
+              draft,
+              draftId,
+              `LLM substrate failure: ${resp.failureClass}`,
+              resp.servedBy,
+              [`substrate failure: ${resp.failureClass}`]
+            );
+            this.auditCompileFailed(low, "substrate_failure");
+            return low;
+          }
+          if (resp.body.kind !== "summarize") {
+            const low = this.buildLowConfidence(
+              draft,
+              draftId,
+              "LLM substrate returned a non-summarize response.",
+              resp.servedBy,
+              [`unexpected body kind: ${resp.body.kind}`]
+            );
+            this.auditCompileFailed(low, "unexpected_body");
+            return low;
+          }
+          const parsed = parseLlmOutput(resp.body.text);
+          if (!parsed.ok) {
+            const low = this.buildLowConfidence(
+              draft,
+              draftId,
+              `LLM output failed schema validation: ${parsed.reason}.`,
+              resp.servedBy,
+              [`schema validation failed: ${parsed.reason}`]
+            );
+            this.auditCompileFailed(low, "schema_validation_failed");
+            return low;
+          }
+          const compiled = this.buildCompiled(
+            draft,
+            draftId,
+            parsed.rule,
+            parsed.explanation,
+            parsed.confidence,
+            parsed.warnings,
+            resp.servedBy
+          );
+          this.auditCompiled(compiled);
+          return compiled;
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          const low = this.buildLowConfidence(
+            draft,
+            draftId,
+            `LLM-assist threw: ${msg}`,
+            "unknown",
+            [msg]
+          );
+          this.auditCompileFailed(low, "llm_threw");
+          return low;
+        }
+      }
+      // ── helpers ────────────────────────────────────────────────────────
+      buildCompiled(draft, draftId, rule, explanation, confidence, warnings, substrateUsed) {
+        return {
+          draft_id: draftId,
+          english_text: draft.english_text,
+          compiled_rule: rule,
+          explanation_paragraph: explanation,
+          compile_confidence: confidence,
+          compile_warnings: warnings,
+          substrate_used: substrateUsed,
+          compiled_at: this.now().toISOString(),
+          operator_id: draft.operator_id,
+          fortress_id: this.fortressId
+        };
+      }
+      buildLowConfidence(draft, draftId, explanation, substrateUsed, warnings) {
+        return this.buildCompiled(
+          draft,
+          draftId,
+          // Placeholder rule; operator inspects the draft + decides whether
+          // to discard or re-author. Xi-2's activation flow refuses to
+          // activate compile_confidence "low" without explicit operator
+          // override.
+          { kind: "tier1_add_operation", operation: "__low_confidence_placeholder__" },
+          explanation,
+          "low",
+          warnings,
+          substrateUsed
+        );
+      }
+      auditCompiled(compiled) {
+        this.auditLog.append(
+          "l2",
+          ENGLISH_POLICY_AUDIT_OPS.COMPILED,
+          compiled.operator_id,
+          {
+            draft_id: compiled.draft_id,
+            compile_confidence: compiled.compile_confidence,
+            rule_kind: compiled.compiled_rule.kind,
+            warnings_count: compiled.compile_warnings.length,
+            substrate_used: compiled.substrate_used,
+            fortress_id: compiled.fortress_id
+          }
+        );
+      }
+      auditCompileFailed(compiled, reason) {
+        this.auditLog.append(
+          "l2",
+          ENGLISH_POLICY_AUDIT_OPS.COMPILE_FAILED,
+          compiled.operator_id,
+          {
+            draft_id: compiled.draft_id,
+            reason,
+            warnings: compiled.compile_warnings,
+            fortress_id: compiled.fortress_id
+          },
+          "failure"
+        );
+      }
+    };
+  }
+});
+
+// src/cli/policy.ts
+var policy_exports = {};
+__export(policy_exports, {
+  formatCompiledHumanReadable: () => formatCompiledHumanReadable,
+  runPolicyCommand: () => runPolicyCommand
+});
+async function runPolicyCommand(args) {
+  const out = args.out ?? process.stdout;
+  const err = args.err ?? process.stderr;
+  const [sub, ...rest] = args.argv;
+  if (!sub || sub === "--help" || sub === "-h") {
+    printUsage9(out);
+    return 0;
+  }
+  try {
+    switch (sub) {
+      case "compile":
+        return await cmdCompile(rest, { out, err });
+      case "drafts":
+        return await cmdDrafts(rest, { out, err });
+      default:
+        err.write(`Unknown subcommand: ${sub}
+`);
+        printUsage9(err);
+        return 2;
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    err.write(`sanctuary policy: ${msg}
+`);
+    return 1;
+  }
+}
+function printUsage9(s) {
+  s.write(`Usage: sanctuary policy <command> [args]
+
+  compile "<English text>"        Compile an operator policy statement
+                                  to a structured rule + explanation.
+                                  CLI mode runs deterministic matcher
+                                  only; LLM-assist is server-only.
+  drafts list                     Placeholder for Xi-2 persistence.
+  drafts show <draft_id>          Placeholder for Xi-2 persistence.
+
+Xi-1 ships review-only; activation (Xi-2) is a separate flow.
+
+`);
+}
+async function cmdCompile(argv, ctx) {
+  const englishText = argv[0];
+  if (!englishText) {
+    ctx.err.write("compile requires the English text as a single argument:\n");
+    ctx.err.write('  sanctuary policy compile "always require approval for state_export"\n');
+    return 2;
+  }
+  const storage = new MemoryStorage();
+  const masterKey = generateRandomKey();
+  const auditLog = new AuditLog(storage, masterKey);
+  const compiler = new EnglishPolicyCompiler({
+    auditLog,
+    fortressId: "cli-local",
+    selector: null
+  });
+  const compiled = await compiler.compile({
+    english_text: englishText,
+    observed_at: (/* @__PURE__ */ new Date()).toISOString(),
+    operator_id: "cli-operator"
+  });
+  ctx.out.write(formatCompiledHumanReadable(compiled) + "\n");
+  return 0;
+}
+async function cmdDrafts(argv, ctx) {
+  const [sub, ...rest] = argv;
+  if (sub === "list" || sub === void 0) {
+    ctx.out.write(
+      "(no local drafts persisted in CLI mode; drafts live in the running server's in-memory store)\n"
+    );
+    ctx.out.write(
+      'Use "sanctuary policy compile \\"<text>\\"" to preview a compile result locally,\n'
+    );
+    ctx.out.write(
+      "or POST to /api/policy/compile on the running fortress for the full surface.\n"
+    );
+    return 0;
+  }
+  if (sub === "show") {
+    const draftId = rest[0];
+    if (!draftId) {
+      ctx.err.write("drafts show requires a draft_id\n");
+      return 2;
+    }
+    ctx.out.write(
+      `(CLI does not yet persist drafts; show ${draftId} via GET /api/policy/drafts/${draftId} on the running fortress)
+`
+    );
+    return 0;
+  }
+  ctx.err.write(`Unknown drafts subcommand: ${sub}
+`);
+  return 2;
+}
+function formatCompiledHumanReadable(c) {
+  const lines = [];
+  lines.push(`draft_id: ${c.draft_id}`);
+  lines.push(`compile_confidence: ${c.compile_confidence}`);
+  lines.push(`substrate_used: ${c.substrate_used}`);
+  lines.push(`compiled_at: ${c.compiled_at}`);
+  lines.push(``);
+  lines.push(`english_text:`);
+  lines.push(`  ${c.english_text}`);
+  lines.push(``);
+  lines.push(`compiled_rule:`);
+  lines.push(`  kind: ${c.compiled_rule.kind}`);
+  if (c.compiled_rule.operation !== void 0) {
+    lines.push(`  operation: ${c.compiled_rule.operation}`);
+  }
+  if (c.compiled_rule.tier2_update !== void 0) {
+    lines.push(`  tier2_update.field: ${c.compiled_rule.tier2_update.field}`);
+    lines.push(`  tier2_update.value: ${String(c.compiled_rule.tier2_update.value)}`);
+  }
+  lines.push(``);
+  lines.push(`explanation:`);
+  lines.push(`  ${c.explanation_paragraph}`);
+  if (c.compile_warnings.length > 0) {
+    lines.push(``);
+    lines.push(`warnings:`);
+    for (const w of c.compile_warnings) lines.push(`  - ${w}`);
+  }
+  return lines.join("\n");
+}
+var init_policy2 = __esm({
+  "src/cli/policy.ts"() {
+    init_audit_log();
+    init_memory();
+    init_random();
+    init_english_policy_compiler();
+  }
+});
+
+// src/auto-trigger/types.ts
+function defaultRuleConfig(ruleId, ruleType, fortressId, now = () => /* @__PURE__ */ new Date()) {
+  return {
+    rule_id: ruleId,
+    rule_type: ruleType,
+    fortress_id: fortressId,
+    current_rung: 1,
+    threshold_overrides: {},
+    cancel_window_seconds: DEFAULT_CANCEL_WINDOW_SECONDS,
+    history: [],
+    updated_at: now().toISOString()
+  };
+}
+function appendHistory(history, entry) {
+  const next = [...history, entry];
+  if (next.length <= MAX_HISTORY_PER_RULE) return next;
+  return next.slice(next.length - MAX_HISTORY_PER_RULE);
+}
+var DEFAULT_CANCEL_WINDOW_SECONDS, MAX_HISTORY_PER_RULE, AutoTriggerError;
+var init_types7 = __esm({
+  "src/auto-trigger/types.ts"() {
+    DEFAULT_CANCEL_WINDOW_SECONDS = 60;
+    MAX_HISTORY_PER_RULE = 200;
+    AutoTriggerError = class extends Error {
+      constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "AutoTriggerError";
+      }
+      code;
+    };
+  }
+});
+
+// src/auto-trigger/threshold-config-store.ts
+function ruleStorageKey(ruleId) {
+  return `${AUTO_TRIGGER_RULE_KEY_PREFIX}${ruleId}`;
+}
+function aadFor2(ruleId, fortressId) {
+  return `${ruleId}|${fortressId}`;
+}
+var AUTO_TRIGGER_RULES_NAMESPACE, AUTO_TRIGGER_RULE_KEY_PREFIX, HKDF_INFO8, MAX_RULE_BYTES, ThresholdConfigStore;
+var init_threshold_config_store = __esm({
+  "src/auto-trigger/threshold-config-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    init_types7();
+    AUTO_TRIGGER_RULES_NAMESPACE = "_auto_trigger_rules";
+    AUTO_TRIGGER_RULE_KEY_PREFIX = "rule.";
+    HKDF_INFO8 = "l2-auto-trigger-rules-v1";
+    MAX_RULE_BYTES = 256 * 1024;
+    ThresholdConfigStore = class {
+      storage;
+      encryptionKey;
+      fortressId;
+      now;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO8);
+        this.fortressId = opts.fortressId;
+        this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      /** Read a rule config. Returns null when absent. */
+      async get(ruleId) {
+        const key = ruleStorageKey(ruleId);
+        let raw;
+        try {
+          raw = await this.storage.read(AUTO_TRIGGER_RULES_NAMESPACE, key);
+        } catch {
+          return null;
+        }
+        if (!raw) return null;
+        if (raw.length > MAX_RULE_BYTES) return null;
+        try {
+          const aad = stringToBytes(aadFor2(ruleId, this.fortressId));
+          const envelope = JSON.parse(bytesToString(raw));
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const persisted = JSON.parse(
+            bytesToString(plaintext)
+          );
+          if (persisted.version !== 1) return null;
+          if (persisted.rule_id !== ruleId) return null;
+          if (persisted.fortress_id !== this.fortressId) return null;
+          return persisted.config;
+        } catch {
+          return null;
+        }
+      }
+      /**
+       * Read a rule config, creating a fresh Rung-1 default if absent. The
+       * default is persisted on first access so the dispatcher sees a
+       * consistent shape on subsequent reads.
+       */
+      async getOrInit(ruleId, ruleType) {
+        const existing = await this.get(ruleId);
+        if (existing) return existing;
+        const fresh = defaultRuleConfig(
+          ruleId,
+          ruleType,
+          this.fortressId,
+          this.now
+        );
+        await this.set(fresh);
+        return fresh;
+      }
+      /** Persist a rule config. AAD-binds to (rule_id, fortress_id). */
+      async set(config) {
+        if (config.fortress_id !== this.fortressId) {
+          throw new Error(
+            `ThresholdConfigStore: fortress_id mismatch (got ${config.fortress_id}, store bound to ${this.fortressId})`
+          );
+        }
+        const persisted = {
+          version: 1,
+          rule_id: config.rule_id,
+          fortress_id: this.fortressId,
+          saved_at: this.now().toISOString(),
+          config: {
+            ...config,
+            updated_at: this.now().toISOString()
+          }
+        };
+        const aad = stringToBytes(aadFor2(config.rule_id, this.fortressId));
+        const plaintext = stringToBytes(JSON.stringify(persisted));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          AUTO_TRIGGER_RULES_NAMESPACE,
+          ruleStorageKey(config.rule_id),
+          stringToBytes(JSON.stringify(envelope))
+        );
+      }
+      /** Promote a rule one rung up. Throws on ceiling (rung 3). */
+      async promote(ruleId, ruleType) {
+        const config = await this.getOrInit(ruleId, ruleType);
+        if (config.current_rung >= 3) {
+          throw new AutoTriggerError(
+            `rule ${ruleId} already at rung 3 (ceiling)`,
+            "rung_ceiling"
+          );
+        }
+        const next = {
+          ...config,
+          current_rung: config.current_rung + 1,
+          last_promoted_at: this.now().toISOString()
+        };
+        await this.set(next);
+        return next;
+      }
+      /** Demote a rule one rung down. Throws on floor (rung 1). */
+      async demote(ruleId, ruleType) {
+        const config = await this.getOrInit(ruleId, ruleType);
+        if (config.current_rung <= 1) {
+          throw new AutoTriggerError(
+            `rule ${ruleId} already at rung 1 (floor)`,
+            "rung_floor"
+          );
+        }
+        const next = {
+          ...config,
+          current_rung: config.current_rung - 1,
+          last_demoted_at: this.now().toISOString()
+        };
+        await this.set(next);
+        return next;
+      }
+      /** Patch the threshold overrides + optional cancel-window. */
+      async updateConfig(ruleId, ruleType, patch) {
+        const config = await this.getOrInit(ruleId, ruleType);
+        const next = {
+          ...config,
+          threshold_overrides: patch.threshold_overrides ?? config.threshold_overrides,
+          cancel_window_seconds: patch.cancel_window_seconds ?? config.cancel_window_seconds
+        };
+        await this.set(next);
+        return next;
+      }
+      /**
+       * Append an action history entry. Bounded ring buffer (max 200 per
+       * rule); oldest entries drop.
+       */
+      async recordAction(ruleId, ruleType, entry) {
+        const config = await this.getOrInit(ruleId, ruleType);
+        const next = {
+          ...config,
+          history: appendHistory(config.history, entry)
+        };
+        await this.set(next);
+        return next;
+      }
+      /**
+       * Update the outcome of a specific pending history entry (e.g. when a
+       * cancel-window expires or the operator cancels). Identified by
+       * finding_id. No-op when the entry is absent. Returns the updated
+       * config; the matched entry's outcome is replaced.
+       */
+      async updateActionOutcome(ruleId, ruleType, findingId, outcome) {
+        const config = await this.getOrInit(ruleId, ruleType);
+        const idx = config.history.findIndex((h) => h.finding_id === findingId);
+        if (idx < 0) return config;
+        const updatedHistory = [...config.history];
+        updatedHistory[idx] = { ...updatedHistory[idx], outcome };
+        const next = { ...config, history: updatedHistory };
+        await this.set(next);
+        return next;
+      }
+      /** Delete a rule config (and its history) by id. */
+      async delete(ruleId) {
+        const key = ruleStorageKey(ruleId);
+        const exists = await this.storage.exists(
+          AUTO_TRIGGER_RULES_NAMESPACE,
+          key
+        );
+        if (!exists) return false;
+        try {
+          await this.storage.delete(AUTO_TRIGGER_RULES_NAMESPACE, key);
+        } catch {
+          return false;
+        }
+        return true;
+      }
+      /** Enumerate every rule id persisted for this fortress. */
+      async listRuleIds() {
+        const metas = await this.storage.list(
+          AUTO_TRIGGER_RULES_NAMESPACE,
+          AUTO_TRIGGER_RULE_KEY_PREFIX
+        );
+        const out = [];
+        for (const meta of metas) {
+          if (!meta.key.startsWith(AUTO_TRIGGER_RULE_KEY_PREFIX)) continue;
+          out.push(meta.key.slice(AUTO_TRIGGER_RULE_KEY_PREFIX.length));
+        }
+        return out;
+      }
+    };
+  }
+});
+
+// src/cli/auto-trigger.ts
+var auto_trigger_exports = {};
+__export(auto_trigger_exports, {
+  runAutoTriggerCommand: () => runAutoTriggerCommand
+});
+async function runAutoTriggerCommand(args) {
+  const out = args.out ?? process.stdout;
+  const err = args.err ?? process.stderr;
+  const [sub, ...rest] = args.argv;
+  if (!sub || sub === "--help" || sub === "-h") {
+    printUsage10(out);
+    return 0;
+  }
+  try {
+    switch (sub) {
+      case "rules":
+        return await cmdRules(rest, { out, err, args });
+      case "cancel":
+        return await cmdCancel(rest, { out, err });
+      default:
+        err.write(`Unknown subcommand: ${sub}
+`);
+        printUsage10(err);
+        return 2;
+    }
+  } catch (cause) {
+    const msg = cause instanceof Error ? cause.message : String(cause);
+    err.write(`sanctuary auto-trigger: ${msg}
+`);
+    return 1;
+  }
+}
+function printUsage10(s) {
+  s.write(`Usage: sanctuary auto-trigger <command> [args]
+
+  rules list                                List rules + current rungs.
+  rules show <rule_id>                      Full detail + history.
+  rules promote <rule_id> --rule-type <t>   Rung N -> N+1.
+  rules demote <rule_id> --rule-type <t>    Rung N -> N-1.
+  rules set-threshold <rule_id> --rule-type <t>
+    [--warn-sigma <n>] [--alert-sigma <n>]
+    [--cancel-window <s>]                   Update overrides + window.
+  cancel <finding_id>                       Cancel a pending rung-2
+                                            action (HTTP-delegated to
+                                            the local dashboard).
+
+Rule types: sentinel | anomaly | honeypot
+
+Env (for cancel): SANCTUARY_DASHBOARD_URL, SANCTUARY_DASHBOARD_AUTH_TOKEN
+`);
+}
+async function cmdRules(argv, ctx) {
+  const sub = argv[0];
+  if (!sub) {
+    ctx.err.write("rules subcommand required\n");
+    return 2;
+  }
+  switch (sub) {
+    case "list":
+      return await cmdRulesList(ctx);
+    case "show":
+      return await cmdRulesShow(argv.slice(1), ctx);
+    case "promote":
+      return await cmdRulesPromote(argv.slice(1), ctx);
+    case "demote":
+      return await cmdRulesDemote(argv.slice(1), ctx);
+    case "set-threshold":
+      return await cmdRulesSetThreshold(argv.slice(1), ctx);
+    default:
+      ctx.err.write(`Unknown rules subcommand: ${sub}
+`);
+      return 2;
+  }
+}
+async function cmdRulesList(ctx) {
+  const { store } = await openStore(ctx.args);
+  const ids = await store.listRuleIds();
+  if (ids.length === 0) {
+    ctx.out.write("(no rules configured; defaults are Rung 1 / no overrides)\n");
+    return 0;
+  }
+  for (const id of ids) {
+    const config = await store.get(id);
+    if (!config) continue;
+    const overrides = Object.keys(config.threshold_overrides).length === 0 ? "defaults" : JSON.stringify(config.threshold_overrides);
+    ctx.out.write(
+      `${id} [type: ${config.rule_type}] rung=${config.current_rung} cancel-window=${config.cancel_window_seconds}s overrides=${overrides}
+`
+    );
+  }
+  return 0;
+}
+async function cmdRulesShow(argv, ctx) {
+  const ruleId = argv[0];
+  if (!ruleId) {
+    ctx.err.write("show requires a rule_id\n");
+    return 2;
+  }
+  const { store } = await openStore(ctx.args);
+  const config = await store.get(ruleId);
+  if (!config) {
+    ctx.err.write(`rule not found: ${ruleId}
+`);
+    return 1;
+  }
+  ctx.out.write(JSON.stringify(config, null, 2) + "\n");
+  return 0;
+}
+async function cmdRulesPromote(argv, ctx) {
+  const ruleId = argv[0];
+  const ruleType = parseRuleType(flagValue5(argv, "--rule-type"));
+  if (!ruleId) {
+    ctx.err.write("promote requires a rule_id\n");
+    return 2;
+  }
+  if (!ruleType) {
+    ctx.err.write(
+      "promote requires --rule-type (sentinel|anomaly|honeypot)\n"
+    );
+    return 2;
+  }
+  const { store } = await openStore(ctx.args);
+  try {
+    const after = await store.promote(ruleId, ruleType);
+    ctx.out.write(`Promoted ${ruleId} -> rung ${after.current_rung}
+`);
+    return 0;
+  } catch (err) {
+    if (err instanceof AutoTriggerError) {
+      ctx.err.write(`${err.code}: ${err.message}
+`);
+      return 1;
+    }
+    throw err;
+  }
+}
+async function cmdRulesDemote(argv, ctx) {
+  const ruleId = argv[0];
+  const ruleType = parseRuleType(flagValue5(argv, "--rule-type"));
+  if (!ruleId) {
+    ctx.err.write("demote requires a rule_id\n");
+    return 2;
+  }
+  if (!ruleType) {
+    ctx.err.write(
+      "demote requires --rule-type (sentinel|anomaly|honeypot)\n"
+    );
+    return 2;
+  }
+  const { store } = await openStore(ctx.args);
+  try {
+    const after = await store.demote(ruleId, ruleType);
+    ctx.out.write(`Demoted ${ruleId} -> rung ${after.current_rung}
+`);
+    return 0;
+  } catch (err) {
+    if (err instanceof AutoTriggerError) {
+      ctx.err.write(`${err.code}: ${err.message}
+`);
+      return 1;
+    }
+    throw err;
+  }
+}
+async function cmdRulesSetThreshold(argv, ctx) {
+  const ruleId = argv[0];
+  const ruleType = parseRuleType(flagValue5(argv, "--rule-type"));
+  if (!ruleId) {
+    ctx.err.write("set-threshold requires a rule_id\n");
+    return 2;
+  }
+  if (!ruleType) {
+    ctx.err.write(
+      "set-threshold requires --rule-type (sentinel|anomaly|honeypot)\n"
+    );
+    return 2;
+  }
+  const warnSigma = parseNumberFlag(argv, "--warn-sigma");
+  const alertSigma = parseNumberFlag(argv, "--alert-sigma");
+  const cancelWindow = parseNumberFlag(argv, "--cancel-window");
+  const overrides = {};
+  if (warnSigma !== void 0) overrides.warn_sigma = warnSigma;
+  if (alertSigma !== void 0) overrides.alert_sigma = alertSigma;
+  if (Object.keys(overrides).length === 0 && cancelWindow === void 0) {
+    ctx.err.write(
+      "set-threshold requires at least one of --warn-sigma, --alert-sigma, --cancel-window\n"
+    );
+    return 2;
+  }
+  const { store } = await openStore(ctx.args);
+  const patch = {};
+  if (Object.keys(overrides).length > 0) patch.threshold_overrides = overrides;
+  if (cancelWindow !== void 0) patch.cancel_window_seconds = cancelWindow;
+  const after = await store.updateConfig(ruleId, ruleType, patch);
+  ctx.out.write(
+    `Updated ${ruleId}: overrides=${JSON.stringify(after.threshold_overrides)} cancel-window=${after.cancel_window_seconds}s
+`
+  );
+  return 0;
+}
+async function cmdCancel(argv, ctx) {
+  const findingId = argv[0];
+  if (!findingId) {
+    ctx.err.write("cancel requires a finding_id\n");
+    return 2;
+  }
+  const baseUrl = process.env["SANCTUARY_DASHBOARD_URL"] ?? "http://127.0.0.1:3501";
+  const token = process.env["SANCTUARY_DASHBOARD_AUTH_TOKEN"];
+  const headers = {
+    "Content-Type": "application/json"
+  };
+  if (token) headers["Authorization"] = `Bearer ${token}`;
+  let res;
+  try {
+    res = await fetch(`${baseUrl}/api/auto-trigger/cancel/${encodeURIComponent(findingId)}`, {
+      method: "POST",
+      headers
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    ctx.err.write(`cancel: cannot reach dashboard at ${baseUrl}: ${msg}
+`);
+    return 1;
+  }
+  if (res.status === 200) {
+    ctx.out.write(`Canceled pending action: ${findingId}
+`);
+    return 0;
+  }
+  if (res.status === 404) {
+    ctx.err.write(
+      `No pending action for ${findingId} (window may have expired)
+`
+    );
+    return 1;
+  }
+  if (res.status === 401) {
+    ctx.err.write(
+      `cancel: unauthorized (set SANCTUARY_DASHBOARD_AUTH_TOKEN)
+`
+    );
+    return 1;
+  }
+  ctx.err.write(`cancel: HTTP ${res.status}
+`);
+  return 1;
+}
+function flagValue5(argv, name) {
+  const i = argv.indexOf(name);
+  if (i === -1) return void 0;
+  return argv[i + 1];
+}
+function parseNumberFlag(argv, name) {
+  const raw = flagValue5(argv, name);
+  if (raw === void 0) return void 0;
+  const n = Number.parseFloat(raw);
+  if (Number.isNaN(n)) return void 0;
+  return n;
+}
+function parseRuleType(raw) {
+  if (raw === "sentinel" || raw === "anomaly" || raw === "honeypot") return raw;
+  return null;
+}
+async function resolveStoragePath4(args) {
+  if (args.storagePath) return args.storagePath;
+  const config = await loadConfig();
+  return config.storage_path;
+}
+async function openStore(args) {
+  const storagePath = await resolveStoragePath4(args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  let passphrase = args.passphrase ?? process.env["SANCTUARY_PASSPHRASE"];
+  if (!passphrase) {
+    const resolved = await getOrCreatePassphrase();
+    passphrase = resolved.value;
+  }
+  let existingParams;
+  try {
+    const raw = await storage.read("_meta", "key-params");
+    if (raw) existingParams = JSON.parse(bytesToString(raw));
+  } catch {
+  }
+  const { key: masterKey, params } = await deriveMasterKey(
+    passphrase,
+    existingParams
+  );
+  if (!existingParams) {
+    await storage.write(
+      "_meta",
+      "key-params",
+      stringToBytes(JSON.stringify(params))
+    );
+  }
+  const fortressId = fortressIdFromStoragePath(storagePath);
+  const store = new ThresholdConfigStore({
+    storage,
+    masterKey,
+    fortressId
+  });
+  return { store };
+}
+var init_auto_trigger = __esm({
+  "src/cli/auto-trigger.ts"() {
+    init_config();
+    init_filesystem();
+    init_key_derivation();
+    init_encoding();
+    init_passphrase();
+    init_wiring();
+    init_threshold_config_store();
+    init_types7();
   }
 });
 
@@ -52043,6 +54197,16 @@ async function main() {
     const code = await runAnomalyCommand2({ argv: args.slice(1) });
     process.exit(code);
   }
+  if (args[0] === "policy") {
+    const { runPolicyCommand: runPolicyCommand2 } = await Promise.resolve().then(() => (init_policy2(), policy_exports));
+    const code = await runPolicyCommand2({ argv: args.slice(1) });
+    process.exit(code);
+  }
+  if (args[0] === "auto-trigger") {
+    const { runAutoTriggerCommand: runAutoTriggerCommand2 } = await Promise.resolve().then(() => (init_auto_trigger(), auto_trigger_exports));
+    const code = await runAutoTriggerCommand2({ argv: args.slice(1) });
+    process.exit(code);
+  }
   if (args[0] === "broker-server") {
     const { openBroker: openBroker2 } = await Promise.resolve().then(() => (init_open(), open_exports));
     const { createBrokerMcpServer: createBrokerMcpServer2 } = await Promise.resolve().then(() => (init_broker_server(), broker_server_exports));