@sanctuary-framework/mcp-server 1.2.2 → 1.2.4

package/dist/cli.cjs

@@ -4428,13 +4428,23 @@ function parseScalar(value) {
   return value.replace(/^["']|["']$/g, "");
 }
 function validatePolicy(raw) {
+  if (!("tier1_always_approve" in raw)) {
+    throw new Error(
+      "Policy file must include 'tier1_always_approve' as an explicit list (use [] for empty). Remove specific entries instead of removing the whole key."
+    );
+  }
+  if (!("approval_channel" in raw)) {
+    throw new Error(
+      "Policy file must include 'approval_channel' as an explicit object (use {} for defaults). Remove specific entries instead of removing the whole key."
+    );
+  }
   const userTier3 = raw.tier3_always_allow ?? [];
   const mergedTier3 = [
     .../* @__PURE__ */ new Set([...userTier3, ...DEFAULT_POLICY.tier3_always_allow])
   ];
   return {
     version: raw.version ?? 1,
-    tier1_always_approve: raw.tier1_always_approve ?? DEFAULT_POLICY.tier1_always_approve,
+    tier1_always_approve: raw.tier1_always_approve,
     tier2_anomaly: {
       ...DEFAULT_TIER2,
       ...raw.tier2_anomaly ?? {}
@@ -4455,6 +4465,11 @@ function generateDefaultPolicyYaml() {
 # This file controls what your agent can do without asking.
 # Edit this file directly. Your agent cannot modify it.
 # Changes take effect on server restart.
+#
+# Required keys (must be present; use [] or {} for empty):
+#   tier1_always_approve, approval_channel
+# Optional keys (omit to use defaults; new defaults merge automatically):
+#   tier2_anomaly, tier3_always_allow
 
 version: 1
 
@@ -4561,21 +4576,39 @@ approval_channel:
 }
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = path.join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await promises.readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await promises.writeFile(policyPath, defaultYaml, "utf-8");
+        await promises.chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await promises.readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await promises.writeFile(policyPath, defaultYaml, "utf-8");
-      await promises.chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
-var DEFAULT_TIER2, DEFAULT_CHANNEL, DEFAULT_POLICY;
+var DEFAULT_TIER2, DEFAULT_CHANNEL, DEFAULT_POLICY, MalformedPrincipalPolicyError;
 var init_loader = __esm({
   "src/principal-policy/loader.ts"() {
     DEFAULT_TIER2 = {
@@ -4708,6 +4741,20 @@ var init_loader = __esm({
       ],
       approval_channel: DEFAULT_CHANNEL
     };
+    MalformedPrincipalPolicyError = class extends Error {
+      constructor(policyPath, reason) {
+        super(
+          `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+        );
+        this.policyPath = policyPath;
+        this.reason = reason;
+        this.name = "MalformedPrincipalPolicyError";
+      }
+      policyPath;
+      reason;
+    };
   }
 });
 
@@ -4927,7 +4974,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 var init_types = __esm({
   "src/shr/types.ts"() {
@@ -11574,6 +11621,7 @@ __export(passphrase_exports, {
   getOrCreatePassphrase: () => getOrCreatePassphrase,
   isOsKeyringLocation: () => isOsKeyringLocation,
   keychainServiceFor: () => keychainServiceFor,
+  legacyKeychainServiceFor: () => legacyKeychainServiceFor,
   persistUserProvidedPassphrase: () => persistUserProvidedPassphrase,
   readStoredPassphrase: () => readStoredPassphrase
 });
@@ -11587,16 +11635,29 @@ async function getOrCreatePassphrase(opts = {}) {
   const plat = opts.platformOverride ?? os.platform();
   const exec2 = opts.exec ?? defaultExec;
   const derive = opts.deriveMachineKey ?? deriveMachineKey;
+  const legacyService = legacyKeychainServiceFor(storagePath, home);
   if (plat === "darwin") {
     const fromKc = await readFromKeychain(exec2, service);
     if (fromKc) {
       return { value: fromKc, source: "keychain", location: OS_KEYRING_LOCATION_MACOS };
     }
+    if (legacyService !== service) {
+      const fromLegacy = await readFromKeychain(exec2, legacyService);
+      if (fromLegacy) {
+        return { value: fromLegacy, source: "keychain", location: OS_KEYRING_LOCATION_MACOS };
+      }
+    }
   } else if (plat === "linux") {
     const fromSs = await readFromSecretService(exec2, service);
     if (fromSs) {
       return { value: fromSs, source: "keychain", location: OS_KEYRING_LOCATION_LINUX };
     }
+    if (legacyService !== service) {
+      const fromLegacy = await readFromSecretService(exec2, legacyService);
+      if (fromLegacy) {
+        return { value: fromLegacy, source: "keychain", location: OS_KEYRING_LOCATION_LINUX };
+      }
+    }
   }
   const fallback = fallbackFilePath(home, storagePath);
   const fromFile = await readFromFallbackFile(fallback, home, derive);
@@ -11629,6 +11690,7 @@ async function readStoredPassphrase(opts = {}) {
   const home = opts.home ?? os.homedir();
   const storagePath = opts.storagePath ?? resolveStoragePath(process.env, home);
   const service = keychainServiceFor(storagePath, home);
+  const legacyService = legacyKeychainServiceFor(storagePath, home);
   const plat = opts.platformOverride ?? os.platform();
   const exec2 = opts.exec ?? defaultExec;
   const derive = opts.deriveMachineKey ?? deriveMachineKey;
@@ -11637,11 +11699,23 @@ async function readStoredPassphrase(opts = {}) {
     if (fromKc) {
       return { value: fromKc, source: "keychain", location: OS_KEYRING_LOCATION_MACOS };
     }
+    if (legacyService !== service) {
+      const fromLegacy = await readFromKeychain(exec2, legacyService);
+      if (fromLegacy) {
+        return { value: fromLegacy, source: "keychain", location: OS_KEYRING_LOCATION_MACOS };
+      }
+    }
   } else if (plat === "linux") {
     const fromSs = await readFromSecretService(exec2, service);
     if (fromSs) {
       return { value: fromSs, source: "keychain", location: OS_KEYRING_LOCATION_LINUX };
     }
+    if (legacyService !== service) {
+      const fromLegacy = await readFromSecretService(exec2, legacyService);
+      if (fromLegacy) {
+        return { value: fromLegacy, source: "keychain", location: OS_KEYRING_LOCATION_LINUX };
+      }
+    }
   }
   const fallback = fallbackFilePath(home, storagePath);
   const fromFile = await readFromFallbackFile(fallback, home, derive);
@@ -11722,9 +11796,18 @@ async function writeToKeychain(value, exec2, service = KEYCHAIN_SERVICE_DEFAULT)
   }
 }
 function keychainServiceFor(storagePath, home = os.homedir()) {
-  const defaultPath = path.join(home, DEFAULT_STORAGE_DIR);
-  if (storagePath === defaultPath) return KEYCHAIN_SERVICE_DEFAULT;
-  const digest = sha256.sha256(Buffer.from(storagePath, "utf-8"));
+  const defaultPath = path.resolve(path.join(home, DEFAULT_STORAGE_DIR));
+  const canonicalStorage = path.resolve(storagePath);
+  if (canonicalStorage === defaultPath) return KEYCHAIN_SERVICE_DEFAULT;
+  const digest = sha256.sha256(Buffer.from(canonicalStorage, "utf-8"));
+  const suffix = Buffer.from(digest).toString("hex").slice(0, 16);
+  return `${KEYCHAIN_SERVICE_DEFAULT}-${suffix}`;
+}
+function legacyKeychainServiceFor(storagePath, home = os.homedir()) {
+  const defaultPath = path.resolve(path.join(home, DEFAULT_STORAGE_DIR));
+  const canonicalStorage = path.resolve(storagePath);
+  if (canonicalStorage === defaultPath) return KEYCHAIN_SERVICE_DEFAULT;
+  const digest = sha256.sha256(Buffer.from(canonicalStorage, "utf-8"));
   const suffix = Buffer.from(digest).toString("hex").slice(0, 12);
   return `${KEYCHAIN_SERVICE_DEFAULT}-${suffix}`;
 }
@@ -11811,7 +11894,7 @@ function deriveMachineKey(home) {
   return hkdf.hkdf(sha256.sha256, material, void 0, "sanctuary-passphrase-v1", 32);
 }
 async function defaultExec(cmd, args, input) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     const child = child_process.spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -11822,7 +11905,7 @@ async function defaultExec(cmd, args, input) {
       stderr += d.toString();
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve6({ stdout, stderr, code }));
+    child.on("close", (code) => resolve8({ stdout, stderr, code }));
     if (input !== void 0) {
       child.stdin.write(input);
     }
@@ -12016,7 +12099,7 @@ async function discoverTenants(options = {}) {
   for (const child of children) {
     const childPath = path.join(root, child);
     if (child.startsWith(".")) continue;
-    if (child === "state" || child === "backup" || child === "config") continue;
+    if (child === "state" || child === "backup" || child === "config" || child === "default") continue;
     const s = await promises.stat(childPath).catch(() => null);
     if (!s || !s.isDirectory()) continue;
     const desc = await describeTenant(child, childPath, home);
@@ -12028,6 +12111,17 @@ async function discoverTenants(options = {}) {
     const desc = await describeTenant(path.basename(extra), extra, home);
     if (desc) tenants.push(desc);
   }
+  const seen = /* @__PURE__ */ new Map();
+  for (const t of tenants) {
+    seen.set(t.name, (seen.get(t.name) ?? 0) + 1);
+  }
+  for (const [name, count] of seen) {
+    if (count > 1) {
+      console.error(
+        `[sanctuary] warning: ${count} tenants share the name "${name}". Use --tenant with a unique name or storage path to disambiguate.`
+      );
+    }
+  }
   tenants.sort((a, b) => {
     if (a.name === "default") return -1;
     if (b.name === "default") return 1;
@@ -12379,7 +12473,7 @@ var init_auth_middleware = __esm({
 });
 
 // src/hub/constants.ts
-var HUB_API_PREFIX, HUB_ROUTES, HUB_FORTRESS_AGENT_ID_SENTINEL, HUB_INBOX_ACTIONS, HUB_AGENT_CONTROL_ACTIONS, HUB_TIER_1_AGENT_CONTROL_ACTIONS, HUB_ACTIVITY_DEFAULT_LIMIT, HUB_ACTIVITY_MAX_LIMIT, HUB_INBOX_DEFAULT_LIMIT, HUB_INBOX_MAX_LIMIT, HUB_AGENTS_DEFAULT_LIMIT, HUB_AGENTS_MAX_LIMIT, HUB_MAX_REQUEST_BODY_BYTES, HUB_CHAT_MESSAGE_MAX_CHARS, HUB_INBOX_TEMPLATE_NAMESPACES, HUB_ACTIVITY_TEMPLATE_NAMESPACES;
+var HUB_API_PREFIX, HUB_ROUTES, HUB_FORTRESS_AGENT_ID_SENTINEL, HUB_INBOX_ACTIONS, HUB_AGENT_CONTROL_ACTIONS, HUB_TIER_1_AGENT_CONTROL_ACTIONS, HUB_ACTIVITY_DEFAULT_LIMIT, HUB_ACTIVITY_MAX_LIMIT, HUB_CHAT_THREADS_DEFAULT_LIMIT, HUB_CHAT_THREADS_MAX_LIMIT, HUB_CHAT_TURNS_DEFAULT_LIMIT, HUB_CHAT_TURNS_MAX_LIMIT, HUB_INBOX_DEFAULT_LIMIT, HUB_INBOX_MAX_LIMIT, HUB_AGENTS_DEFAULT_LIMIT, HUB_AGENTS_MAX_LIMIT, HUB_MAX_REQUEST_BODY_BYTES, HUB_CHAT_MESSAGE_MAX_CHARS, HUB_INBOX_TEMPLATE_NAMESPACES, HUB_ACTIVITY_TEMPLATE_NAMESPACES;
 var init_constants3 = __esm({
   "src/hub/constants.ts"() {
     HUB_API_PREFIX = "/api/hub";
@@ -12407,6 +12501,16 @@ var init_constants3 = __esm({
        */
       CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
       CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+      /**
+       * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+       * scrollback, and operator-initiated thread delete. Distinct from the
+       * v1.2 `/history` route, which surfaces the active in-session thread
+       * shape; the new routes target persisted multi-thread memory used by
+       * v1.3 conversational sovereignty depth.
+       */
+      CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+      CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+      CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
       /**
        * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
        * recent activity feed, pending Tier 1 approvals routed through this
@@ -12430,6 +12534,10 @@ var init_constants3 = __esm({
     ];
     HUB_ACTIVITY_DEFAULT_LIMIT = 50;
     HUB_ACTIVITY_MAX_LIMIT = 500;
+    HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+    HUB_CHAT_THREADS_MAX_LIMIT = 500;
+    HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+    HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
     HUB_INBOX_DEFAULT_LIMIT = 100;
     HUB_INBOX_MAX_LIMIT = 500;
     HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -12612,6 +12720,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -12795,6 +12920,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -16826,6 +16992,8 @@ var init_intelligence_api_router = __esm({
         this.code = code;
         this.name = "IntelligenceRouterError";
       }
+      statusCode;
+      code;
     };
   }
 });
@@ -16915,6 +17083,168 @@ var init_dispatch = __esm({
     init_intelligence_api_router();
   }
 });
+
+// src/principal-policy/approval-aggregator-routes.ts
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+var APPROVAL_INBOX_API_PREFIX, APPROVAL_INBOX_OPERATOR_DEFAULT, APPROVAL_INBOX_DEFAULT_LIMIT, APPROVAL_INBOX_MAX_LIMIT;
+var init_approval_aggregator_routes = __esm({
+  "src/principal-policy/approval-aggregator-routes.ts"() {
+    init_auth_middleware();
+    APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+    APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+    APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+    APPROVAL_INBOX_MAX_LIMIT = 200;
+  }
+});
 function isDashboardViewRoute(method, path) {
   if (method !== "GET") return false;
   return path === "/" || path === "/dashboard" || path === "/v1.0" || path === "/fortress" || path === "/events";
@@ -16928,6 +17258,7 @@ var init_dashboard = __esm({
     init_fortress_view();
     init_system_prompt_generator();
     init_dispatch();
+    init_approval_aggregator_routes();
     SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
     SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
     MAX_SESSIONS = 1e3;
@@ -16987,6 +17318,14 @@ var init_dashboard = __esm({
        * regardless. Default route flip is deferred to v1.2.
        */
       v11Bindings = null;
+      /**
+       * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+       * additively at `/api/approval-inbox/*` when set. Legacy approval
+       * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+       * aggregator is a passive subscriber to the gate; the routes here are
+       * the operator-facing query / decision surface.
+       */
+      approvalAggregator = null;
       constructor(config) {
         this.config = config;
         this.authToken = config.auth_token;
@@ -17037,6 +17376,34 @@ var init_dashboard = __esm({
       setV11Bindings(bindings) {
         this.v11Bindings = bindings;
       }
+      /**
+       * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+       * aggregator. Once set, requests to `/api/approval-inbox/*` route
+       * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+       * tests + during shutdown).
+       */
+      setApprovalAggregator(aggregator) {
+        this.approvalAggregator = aggregator;
+      }
+      /**
+       * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+       * before the legacy approval route table. Returns true when served.
+       */
+      async dispatchApprovalInbox(req, res) {
+        if (!this.approvalAggregator) return false;
+        return handleApprovalInboxRoute(
+          {
+            authConfig: {
+              loopbackAutoAuth: this._autoAuthLocalhost,
+              ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+            },
+            aggregator: this.approvalAggregator,
+            operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+          },
+          req,
+          res
+        );
+      }
       /**
        * v1.1 dispatch entry point. Called from `handleRequest` before the
        * legacy route table. Returns true when the request was served by v1.1
@@ -17102,7 +17469,7 @@ var init_dashboard = __esm({
           server = http.createServer(handler);
         }
         this.httpServer = server;
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve8, reject) => {
           const protocol = this.useTLS ? "https" : "http";
           const baseUrl = `${protocol}://${this.config.host}:${this.config.port}`;
           server.listen(this.config.port, this.config.host, () => {
@@ -17127,7 +17494,7 @@ var init_dashboard = __esm({
             if (shouldAutoOpen) {
               this.openInBrowser(sessionUrl);
             }
-            resolve6();
+            resolve8();
           });
           server.on("error", (err) => {
             if (err.code === "EADDRINUSE") {
@@ -17173,8 +17540,8 @@ var init_dashboard = __esm({
         }
         this.rateLimits.clear();
         if (this.httpServer) {
-          return new Promise((resolve6) => {
-            this.httpServer.close(() => resolve6());
+          return new Promise((resolve8) => {
+            this.httpServer.close(() => resolve8());
           });
         }
       }
@@ -17188,7 +17555,7 @@ var init_dashboard = __esm({
           `[Sanctuary] Approval required: ${request.operation} (Tier ${request.tier}) \u2014 open dashboard to respond
 `
         );
-        return new Promise((resolve6) => {
+        return new Promise((resolve8) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             const response = {
@@ -17202,12 +17569,12 @@ var init_dashboard = __esm({
               decision: response.decision,
               decided_by: "timeout"
             });
-            resolve6(response);
+            resolve8(response);
           }, this.config.timeout_seconds * 1e3);
           const pending = {
             id,
             request,
-            resolve: resolve6,
+            resolve: resolve8,
             timer,
             created_at: (/* @__PURE__ */ new Date()).toISOString()
           };
@@ -17412,6 +17779,18 @@ var init_dashboard = __esm({
           res.end();
           return;
         }
+        if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+          this.dispatchApprovalInbox(req, res).then((handled) => {
+            if (handled) return;
+            this.handleLegacyRequest(req, res, url, method);
+          }).catch(() => {
+            if (!res.headersSent) {
+              res.writeHead(500, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ error: "Internal server error" }));
+            }
+          });
+          return;
+        }
         if (this.v11Bindings) {
           this.dispatchV11(req, res, url, method).then((handled) => {
             if (handled) return;
@@ -18073,7 +18452,7 @@ var init_webhook = __esm({
        * Start the callback listener server.
        */
       async start() {
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve8, reject) => {
           this.callbackServer = http.createServer(
             (req, res) => this.handleCallback(req, res)
           );
@@ -18088,7 +18467,7 @@ var init_webhook = __esm({
 
 `
               );
-              resolve6();
+              resolve8();
             }
           );
           this.callbackServer.on("error", reject);
@@ -18108,8 +18487,8 @@ var init_webhook = __esm({
         }
         this.pending.clear();
         if (this.callbackServer) {
-          return new Promise((resolve6) => {
-            this.callbackServer.close(() => resolve6());
+          return new Promise((resolve8) => {
+            this.callbackServer.close(() => resolve8());
           });
         }
       }
@@ -18122,7 +18501,7 @@ var init_webhook = __esm({
           `[Sanctuary] Webhook approval sent: ${request.operation} (Tier ${request.tier}) \u2014 awaiting callback
 `
         );
-        return new Promise((resolve6) => {
+        return new Promise((resolve8) => {
           const timer = setTimeout(() => {
             this.pending.delete(id);
             const response = {
@@ -18131,12 +18510,12 @@ var init_webhook = __esm({
               decided_at: (/* @__PURE__ */ new Date()).toISOString(),
               decided_by: "timeout"
             };
-            resolve6(response);
+            resolve8(response);
           }, this.config.timeout_seconds * 1e3);
           const pending = {
             id,
             request,
-            resolve: resolve6,
+            resolve: resolve8,
             timer,
             created_at: (/* @__PURE__ */ new Date()).toISOString()
           };
@@ -19429,12 +19808,25 @@ var init_injection_detector = __esm({
   }
 });
 
+// src/principal-policy/deny-vocabulary.ts
+var AGENT_VISIBLE_DENY_REASONS;
+var init_deny_vocabulary = __esm({
+  "src/principal-policy/deny-vocabulary.ts"() {
+    AGENT_VISIBLE_DENY_REASONS = {
+      REQUIRES_APPROVAL: "operation requires operator approval",
+      NOT_PERMITTED: "operation not permitted",
+      REQUIRES_OPERATOR: "operation requires operator action"
+    };
+  }
+});
+
 // src/principal-policy/gate.ts
 var ApprovalGate;
 var init_gate = __esm({
   "src/principal-policy/gate.ts"() {
     init_loader();
     init_injection_detector();
+    init_deny_vocabulary();
     ApprovalGate = class {
       policy;
       baseline;
@@ -19442,14 +19834,25 @@ var init_gate = __esm({
       auditLog;
       injectionDetector;
       onInjectionAlert;
+      onApprovalEvent;
       proxyTierResolver;
-      constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+      constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
         this.policy = policy;
         this.baseline = baseline;
         this.channel = channel;
         this.auditLog = auditLog;
         this.injectionDetector = injectionDetector ?? new InjectionDetector();
         this.onInjectionAlert = onInjectionAlert;
+        this.onApprovalEvent = onApprovalEvent;
+      }
+      /**
+       * Set the approval-event callback after construction. Used by the
+       * Upsilon-1 wire-up when the aggregator is constructed alongside the
+       * gate. The aggregator subscribes through this setter rather than the
+       * constructor so existing call sites continue to work unchanged.
+       */
+      setApprovalEventCallback(cb) {
+        this.onApprovalEvent = cb;
       }
       /**
        * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -19486,10 +19889,16 @@ var init_gate = __esm({
             });
           }
           if (injectionResult.recommendation === "block") {
+            this.auditLog.append("l2", `gate_injection_block:${operation}`, "system", {
+              tier: 1,
+              operation,
+              injection_confidence: injectionResult.confidence,
+              signal_count: injectionResult.signals.length
+            });
             return {
               allowed: false,
               tier: 1,
-              reason: `Blocked: prompt injection detected in "${operation}" (confidence: ${(injectionResult.confidence * 100).toFixed(0)}%)`,
+              reason: AGENT_VISIBLE_DENY_REASONS.NOT_PERMITTED,
               approval_required: false
             };
           }
@@ -19566,7 +19975,7 @@ var init_gate = __esm({
         this.auditLog.append("l2", `gate_unclassified:${operation}`, "system", {
           tier: 1,
           operation,
-          warning: "Operation is not classified in any policy tier \u2014 defaulting to Tier 1 (require approval)"
+          warning: "Operation is not classified in any policy tier, defaulting to Tier 1 (require approval)"
         });
         return this.requestApproval(
           operation,
@@ -19677,25 +20086,109 @@ var init_gate = __esm({
       }
       /**
        * Request approval from the human principal.
+       *
+       * Fail-closed contract (full-sweep #49): if the channel throws (network
+       * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+       * failure, etc.), the gate denies the operation and audit-logs the cause.
+       * Channel-internal timeouts already resolve with decision: "deny" per
+       * SEC-002; this catch covers the remaining "channel raised" path so an
+       * unhandled rejection cannot turn into an indeterminate state at the gate.
        */
       async requestApproval(operation, tier, reason, context) {
+        const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
         const request = {
           operation,
           tier,
           reason,
           context,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          timestamp: requestTimestamp
         };
-        const response = await this.channel.requestApproval(request);
+        const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+        if (this.onApprovalEvent) {
+          try {
+            this.onApprovalEvent({
+              phase: "requested",
+              operation,
+              tier,
+              reason,
+              context,
+              request_timestamp: requestTimestamp,
+              correlation_id: correlationId
+            });
+          } catch {
+          }
+        }
+        let response;
+        try {
+          response = await this.channel.requestApproval(request);
+        } catch (err) {
+          const errMessage = err instanceof Error ? err.message : String(err);
+          const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+          this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+            tier,
+            reason,
+            decided_by: "channel_failure",
+            channel_error: errMessage
+          });
+          if (this.onApprovalEvent) {
+            try {
+              this.onApprovalEvent({
+                phase: "resolved",
+                operation,
+                tier,
+                reason,
+                context,
+                request_timestamp: requestTimestamp,
+                resolution: {
+                  decision: "deny",
+                  decided_at: decidedAt,
+                  decided_by: "channel_failure"
+                },
+                correlation_id: correlationId
+              });
+            } catch {
+            }
+          }
+          return {
+            allowed: false,
+            tier,
+            reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+            approval_required: true,
+            approval_response: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            }
+          };
+        }
         this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
           tier,
           reason,
           decided_by: response.decided_by
         });
+        if (this.onApprovalEvent) {
+          try {
+            this.onApprovalEvent({
+              phase: "resolved",
+              operation,
+              tier,
+              reason,
+              context,
+              request_timestamp: requestTimestamp,
+              resolution: {
+                decision: response.decision,
+                decided_at: response.decided_at,
+                decided_by: response.decided_by
+              },
+              correlation_id: correlationId
+            });
+          } catch {
+          }
+        }
         return {
           allowed: response.decision === "approve",
           tier,
-          reason: response.decision === "approve" ? `Approved by ${response.decided_by}` : `Tier ${tier} operation requires approval`,
+          reason: response.decision === "approve" ? `Approved by ${response.decided_by}` : AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
           approval_required: true,
           approval_response: response
         };
@@ -19726,6 +20219,356 @@ var init_gate = __esm({
     };
   }
 });
+var APPROVAL_AGGREGATOR_NAMESPACE, APPROVAL_AGGREGATOR_HKDF_INFO, APPROVAL_AGGREGATOR_AUDIT_OPS, DEFAULT_PENDING_TTL_MS, DEFAULT_MAX_LIST_LIMIT, DEFAULT_LIST_PAGE_SIZE, ApprovalAggregator;
+var init_approval_aggregator = __esm({
+  "src/principal-policy/approval-aggregator.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+    APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+    APPROVAL_AGGREGATOR_AUDIT_OPS = {
+      AGGREGATED: "cross_harness_approval_aggregated",
+      RESOLVED: "cross_harness_approval_resolved",
+      DEDUPED: "cross_harness_approval_deduped"
+    };
+    DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+    DEFAULT_MAX_LIST_LIMIT = 200;
+    DEFAULT_LIST_PAGE_SIZE = 50;
+    ApprovalAggregator = class {
+      storage;
+      encryptionKey;
+      auditLog;
+      identityId;
+      fortressId;
+      pendingTtlMs;
+      maxListLimit;
+      now;
+      resolveSourceContext;
+      resolveHubInboxItemId;
+      /** Cached entries by `aggregator_id`. */
+      entries = /* @__PURE__ */ new Map();
+      /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+      dedupIndex = /* @__PURE__ */ new Map();
+      /** Correlation index: gate `correlation_id` -> aggregator_id. */
+      correlationIndex = /* @__PURE__ */ new Map();
+      /** Original request payloads kept in-memory for `getFullPayload()`. */
+      fullPayloads = /* @__PURE__ */ new Map();
+      /** Has the aggregator hydrated persisted entries on this process? */
+      hydrated = false;
+      /** Active SSE listeners. */
+      listeners = /* @__PURE__ */ new Set();
+      constructor(deps) {
+        this.storage = deps.storage;
+        this.encryptionKey = derivePurposeKey(
+          deps.masterKey,
+          APPROVAL_AGGREGATOR_HKDF_INFO
+        );
+        this.auditLog = deps.auditLog;
+        this.identityId = deps.identityId;
+        this.fortressId = deps.fortressId;
+        this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+        this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+        this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+        this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+          source_harness: this.fortressId,
+          source_agent_id: this.fortressId
+        }));
+        this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+      }
+      /**
+       * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+       * use this to forward aggregator emissions to the dashboard.
+       */
+      onEvent(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+      }
+      /**
+       * Ingest a gate event. Returns the aggregator entry on first sight,
+       * `null` when deduped. Resolution events update the existing record;
+       * unmatched resolutions are dropped silently (caller's gate emitted a
+       * resolved-without-requested pair, which the aggregator does not invent
+       * a record for).
+       */
+      async ingest(event) {
+        await this.hydrate();
+        if (event.phase === "requested") {
+          return this.ingestRequested(event);
+        }
+        if (event.phase === "resolved") {
+          return this.ingestResolved(event);
+        }
+        return null;
+      }
+      /**
+       * List pending or recently resolved entries. Pending entries past TTL
+       * are lazily transitioned to `expired` and persisted before the list
+       * snapshot is returned.
+       */
+      async list(opts) {
+        await this.hydrate();
+        await this.expireStale();
+        const limit = Math.min(
+          opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+          this.maxListLimit
+        );
+        const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+        const matching = [];
+        for (const entry of this.entries.values()) {
+          if (opts?.status && entry.status !== opts.status) continue;
+          if (Date.parse(entry.created_at) < sinceMs) continue;
+          matching.push(entry);
+        }
+        matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+        return matching.slice(0, limit);
+      }
+      /**
+       * Return the original (unhashed) request payload for the entry. Returns
+       * `null` when the entry is unknown or the payload was evicted (e.g. the
+       * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+       */
+      async getFullPayload(aggregatorId) {
+        await this.hydrate();
+        if (!this.entries.has(aggregatorId)) return null;
+        return this.fullPayloads.get(aggregatorId) ?? null;
+      }
+      /**
+       * Resolve an entry. Used by both:
+       *   1. The gate wire-up on channel-decision return.
+       *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+       *
+       * Idempotent: resolving an already-resolved entry is a no-op (the record
+       * keeps its first decision and the audit log is not double-fired).
+       * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+       * routes return 404.
+       */
+      async resolve(aggregatorId, decision, operatorId) {
+        await this.hydrate();
+        const entry = this.entries.get(aggregatorId);
+        if (!entry) {
+          throw new Error("approval-aggregator: not_found");
+        }
+        if (entry.status !== "pending") {
+          return entry;
+        }
+        entry.status = decision;
+        entry.resolved_at = this.now().toISOString();
+        entry.resolved_by = operatorId;
+        await this.persist(entry);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+          this.identityId,
+          {
+            aggregator_id: entry.aggregator_id,
+            source_harness: entry.source_harness,
+            source_agent_id: entry.source_agent_id,
+            audit_log_entry_id: entry.audit_log_entry_id,
+            policy_rule_id: entry.policy_rule_id,
+            decision,
+            decided_by: operatorId,
+            decided_at: entry.resolved_at
+          }
+        );
+        this.emit({ type: "resolved", entry: { ...entry } });
+        return entry;
+      }
+      // ── Internal: ingest paths ─────────────────────────────────────────────
+      async ingestRequested(event) {
+        const ctx = this.resolveSourceContext(event);
+        const auditId = this.auditEntryIdForEvent(event);
+        const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+        const existing = this.dedupIndex.get(dedupKey);
+        if (existing) {
+          const existingEntry = this.entries.get(existing);
+          if (existingEntry) {
+            this.correlationIndex.set(event.correlation_id, existing);
+            this.auditLog.append(
+              "l2",
+              APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+              this.identityId,
+              {
+                aggregator_id: existing,
+                source_harness: ctx.source_harness,
+                source_agent_id: ctx.source_agent_id,
+                audit_log_entry_id: auditId,
+                policy_rule_id: this.derivePolicyRuleId(event),
+                correlation_id: event.correlation_id
+              }
+            );
+            this.emit({ type: "deduped", entry: { ...existingEntry } });
+            return null;
+          }
+        }
+        const id = crypto.randomUUID();
+        const now = this.now();
+        const expires = new Date(now.getTime() + this.pendingTtlMs);
+        const hubInboxId = this.resolveHubInboxItemId(event);
+        const entry = {
+          aggregator_id: id,
+          source_harness: ctx.source_harness,
+          source_agent_id: ctx.source_agent_id,
+          audit_log_entry_id: auditId,
+          policy_rule_id: this.derivePolicyRuleId(event),
+          action_summary: this.deriveActionSummary(event),
+          request_payload_hash: this.hashPayload(event.context),
+          status: "pending",
+          created_at: now.toISOString(),
+          expires_at: expires.toISOString(),
+          ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+        };
+        this.entries.set(id, entry);
+        this.dedupIndex.set(dedupKey, id);
+        this.correlationIndex.set(event.correlation_id, id);
+        this.fullPayloads.set(id, event.context);
+        await this.persist(entry);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+          this.identityId,
+          {
+            aggregator_id: id,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: entry.policy_rule_id,
+            ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+          }
+        );
+        this.emit({ type: "aggregated", entry: { ...entry } });
+        return entry;
+      }
+      async ingestResolved(event) {
+        const id = this.correlationIndex.get(event.correlation_id);
+        if (!id) return null;
+        const entry = this.entries.get(id);
+        if (!entry) return null;
+        if (entry.status !== "pending") return entry;
+        if (!event.resolution) return entry;
+        const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+        const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+        entry.status = status;
+        entry.resolved_at = event.resolution.decided_at;
+        entry.resolved_by = event.resolution.decided_by;
+        await this.persist(entry);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+          this.identityId,
+          {
+            aggregator_id: id,
+            source_harness: entry.source_harness,
+            source_agent_id: entry.source_agent_id,
+            audit_log_entry_id: entry.audit_log_entry_id,
+            policy_rule_id: entry.policy_rule_id,
+            decision: status,
+            decided_by: entry.resolved_by,
+            decided_at: entry.resolved_at,
+            fail_closed: failClosed
+          }
+        );
+        this.emit({ type: "resolved", entry: { ...entry } });
+        return entry;
+      }
+      // ── Internal: helpers ──────────────────────────────────────────────────
+      /**
+       * Audit-log entry id for the dedup tuple. The audit log itself does not
+       * surface a stable per-entry id (counter-prefixed keys are internal); the
+       * aggregator uses the request timestamp + operation, which together pin
+       * the audit entry the gate appended on the same call.
+       */
+      auditEntryIdForEvent(event) {
+        return `${event.request_timestamp}:${event.operation}`;
+      }
+      derivePolicyRuleId(event) {
+        return `tier${event.tier}:${event.operation}`;
+      }
+      deriveActionSummary(event) {
+        return `${event.operation} (tier ${event.tier})`;
+      }
+      /**
+       * Canonical SHA-256 of the request context. Sorted-keys serialization so
+       * identical payloads always hash the same, even when key insertion order
+       * varies. Defends against payload-replay smuggling (the aggregator can
+       * tell the same payload was seen twice without storing it cleartext).
+       */
+      hashPayload(payload) {
+        const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+        return crypto.createHash("sha256").update(canonical).digest("hex");
+      }
+      emit(event) {
+        for (const listener of this.listeners) {
+          try {
+            listener(event);
+          } catch {
+          }
+        }
+      }
+      async expireStale() {
+        const nowMs = this.now().getTime();
+        for (const entry of this.entries.values()) {
+          if (entry.status !== "pending") continue;
+          if (Date.parse(entry.expires_at) > nowMs) continue;
+          entry.status = "expired";
+          entry.resolved_at = this.now().toISOString();
+          entry.resolved_by = "system_ttl";
+          await this.persist(entry);
+          this.auditLog.append(
+            "l2",
+            APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+            this.identityId,
+            {
+              aggregator_id: entry.aggregator_id,
+              source_harness: entry.source_harness,
+              source_agent_id: entry.source_agent_id,
+              audit_log_entry_id: entry.audit_log_entry_id,
+              policy_rule_id: entry.policy_rule_id,
+              decision: "expired",
+              decided_by: "system_ttl",
+              decided_at: entry.resolved_at
+            }
+          );
+          this.emit({ type: "resolved", entry: { ...entry } });
+        }
+      }
+      async persist(entry) {
+        const serialized = stringToBytes(JSON.stringify(entry));
+        const encrypted = encrypt(serialized, this.encryptionKey);
+        await this.storage.write(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          entry.aggregator_id,
+          stringToBytes(JSON.stringify(encrypted))
+        );
+      }
+      async hydrate() {
+        if (this.hydrated) return;
+        this.hydrated = true;
+        try {
+          const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+          for (const meta of metas) {
+            const raw = await this.storage.read(
+              APPROVAL_AGGREGATOR_NAMESPACE,
+              meta.key
+            );
+            if (!raw) continue;
+            try {
+              const encrypted = JSON.parse(bytesToString(raw));
+              const decrypted = decrypt(encrypted, this.encryptionKey);
+              const entry = JSON.parse(bytesToString(decrypted));
+              this.entries.set(entry.aggregator_id, entry);
+              const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+              this.dedupIndex.set(dedupKey, entry.aggregator_id);
+            } catch {
+            }
+          }
+        } catch {
+          this.hydrated = false;
+        }
+      }
+    };
+  }
+});
 
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
@@ -20284,7 +21127,11 @@ var init_tools5 = __esm({
 
 // src/handshake/protocol.ts
 function generateNonce() {
-  return toBase64url(randomBytes(32));
+  const nonce = randomBytes(32);
+  if (!nonce || nonce.length !== 32) {
+    throw new Error("Nonce generation failed: randomBytes returned unexpected length");
+  }
+  return toBase64url(nonce);
 }
 function initiateHandshake(ourSHR) {
   const nonce = generateNonce();
@@ -20395,6 +21242,18 @@ function completeHandshake(response, session, identityManager, masterKey, identi
   return { completion, result };
 }
 function verifyCompletion(completion, session) {
+  if (completion.protocol_version !== "1.0") {
+    return {
+      counterparty_id: "unknown",
+      counterparty_shr: session.our_shr,
+      verified: false,
+      sovereignty_level: "unverified",
+      trust_tier: "unverified",
+      completed_at: completion.completed_at,
+      expires_at: (/* @__PURE__ */ new Date()).toISOString(),
+      errors: [`Unsupported protocol version: ${completion.protocol_version}`]
+    };
+  }
   const errors = [];
   if (!session.their_shr) {
     return {
@@ -22627,6 +23486,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = path.join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await promises.rm(markerPath, { force: true });
+    await promises.rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -22651,7 +23516,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await promises.writeFile(consumedPath, "", "utf-8");
   await promises.rm(markerPath, { force: true });
+  await promises.rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -22681,6 +23548,9 @@ Inspect the file and either correct the JSON or delete it manually before re-run
         this.cause = cause;
         this.name = "ResetHistoryMalformedError";
       }
+      markerPath;
+      lineNumber;
+      cause;
     };
   }
 });
@@ -24839,7 +25709,7 @@ async function runOpenAIPrivacyFilter(text, config) {
   return parsed;
 }
 function runCommand(command, input, timeoutMs) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     const child = child_process.spawn(command, [], {
       stdio: ["pipe", "pipe", "pipe"],
       shell: false
@@ -24870,7 +25740,7 @@ function runCommand(command, input, timeoutMs) {
         ));
         return;
       }
-      resolve6(stdout);
+      resolve8(stdout);
     });
     child.stdin.end(input);
   });
@@ -26746,13 +27616,13 @@ var init_proxy_router = __esm({
        * Call an upstream tool with a timeout.
        */
       async callWithTimeout(serverName, toolName, args, timeoutMs) {
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve8, reject) => {
           const timer = setTimeout(() => {
             reject(new Error(`Upstream tool call timed out after ${timeoutMs}ms`));
           }, timeoutMs);
           this.clientManager.callTool(serverName, toolName, args).then((result) => {
             clearTimeout(timer);
-            resolve6(result);
+            resolve8(result);
           }).catch((err) => {
             clearTimeout(timer);
             reject(err);
@@ -31931,6 +32801,36 @@ var init_hub_service = __esm({
         const chat = this.requireOperatorChat();
         return chat.getConciergeHistory();
       }
+      // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+      /**
+       * Whether the operator-chat service has the WP-V1.3-9 memory store
+       * wired. Routes use this to 503 cleanly when the foundation memory
+       * surface is unavailable on a given fortress.
+       */
+      hasConciergeMemory() {
+        return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+      }
+      async listConciergeMemoryThreads(opts) {
+        const chat = this.requireOperatorChat();
+        if (!chat.hasConciergeMemory()) {
+          throw new HubCapabilityError("concierge_memory_not_wired");
+        }
+        return chat.listConciergeMemoryThreads(opts);
+      }
+      async readConciergeMemoryThread(threadId, opts) {
+        const chat = this.requireOperatorChat();
+        if (!chat.hasConciergeMemory()) {
+          throw new HubCapabilityError("concierge_memory_not_wired");
+        }
+        return chat.readConciergeMemoryThread(threadId, opts);
+      }
+      async deleteConciergeMemoryThread(threadId) {
+        const chat = this.requireOperatorChat();
+        if (!chat.hasConciergeMemory()) {
+          throw new HubCapabilityError("concierge_memory_not_wired");
+        }
+        return chat.deleteConciergeMemoryThread(threadId);
+      }
       /**
        * Open the click-to-inspect/approve panel for a wrapped agent. The
        * panel surfaces recent activity routed through this agent, pending
@@ -32069,7 +32969,20 @@ var init_operator_chat_audit_events = __esm({
        * affordance now opens an inspect/approve panel (recent activity +
        * pending approvals + policy summary) instead of a chat session.
        */
-      AGENT_INSPECT_PANEL_OPENED: "agent_inspect_panel_opened"
+      AGENT_INSPECT_PANEL_OPENED: "agent_inspect_panel_opened",
+      /**
+       * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+       * when the operator hits the list-threads or read-thread route. Body
+       * carries the thread_id (or `*` for the list endpoint) and a count;
+       * raw turn content never crosses the audit surface.
+       */
+      CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+      /**
+       * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+       * successful thread removal. Body carries thread_id + turn_count of
+       * the deleted bundle.
+       */
+      CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
     };
   }
 });
@@ -32088,7 +33001,7 @@ function makeEventId(prefix) {
 function hashOf(input) {
   return hashToString(sha256.sha256(stringToBytes(input)));
 }
-var DEFAULT_CONCIERGE_MAX_TOKENS, OperatorChatService;
+var DEFAULT_CONCIERGE_MAX_TOKENS, SANCTUARY_DOMAIN_REFERENCE, OperatorChatService;
 var init_operator_chat_service = __esm({
   "src/chat/operator-chat-service.ts"() {
     init_hashing();
@@ -32096,6 +33009,33 @@ var init_operator_chat_service = __esm({
     init_operator_chat_audit_events();
     init_operator_chat_types();
     DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+    SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
+1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
+2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
+3. Charter (Cooperative MCP): the sovereignty surface for compliant agents. Policy gates, approval tiers, audit logging, and encrypted state all live here.
+4. Heralds: Concordia receipts and Verascore reputation. Cross-fortress accountability after an action completes.
+
+Five channel templates (canonical names):
+- request-approve-act: agent proposes an action, operator approves or denies before execution.
+- read-then-report: agent reads outputs from a data source and reports summaries to the operator.
+- scheduled-digest: agent runs on a schedule and delivers a periodic digest.
+- plan-draft-only: agent drafts plans; operator reviews before any execution step.
+- fortress-relay: agent relays messages between fortresses under operator-scoped policy.
+
+Four canonical policy slots:
+- memory: governs what the agent may persist and retrieve from encrypted state.
+- credentials: governs access to secrets, API keys, and tokens held in the broker.
+- plans: governs the agent's ability to create, modify, or execute plans.
+- outputs: governs what the agent may emit to external surfaces (files, APIs, messages).
+
+Key concepts:
+- Fortress: the operator-owned sovereignty harness. All state is encrypted at rest under the cocoon.
+- Cocoon: master-key-wrapped storage derived from the operator's passphrase via Argon2id.
+- Identity: Ed25519 keypair with a DID, owned by the operator. Private keys never leave the cocoon.
+- Audit log: append-only encrypted blobs, sequential, recording every gate decision and tool call.
+- Wrapped agent: any agent runtime that connects to Sanctuary as an MCP client. Tier A (native), Tier B (adapter-wrapped), Tier C (escape hatch).
+
+Note: this is a static reference block (v1.2.x). Dynamic context injection (live template list, policy schema) ships in v1.3.`;
     OperatorChatService = class {
       store;
       auditLog;
@@ -32104,6 +33044,14 @@ var init_operator_chat_service = __esm({
       contextProviders;
       piiFilter;
       conciergeMaxTokens;
+      memory;
+      /**
+       * In-memory thread_id assigned to the active concierge session.
+       * The first sendConcierge call after construction allocates a fresh
+       * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+       * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+       */
+      activeMemoryThreadId;
       constructor(deps) {
         this.store = deps.store;
         this.auditLog = deps.auditLog;
@@ -32114,6 +33062,7 @@ var init_operator_chat_service = __esm({
         }
         if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
         this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+        if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
       }
       // ── Concierge ─────────────────────────────────────────────────────────
       /**
@@ -32144,6 +33093,11 @@ var init_operator_chat_service = __esm({
           CONCIERGE_THREAD_KEY,
           operatorMessage
         );
+        if (this.memory) {
+          const threadId = this.ensureActiveMemoryThread();
+          await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+          });
+        }
         const start = Date.now();
         let conciergeBody;
         let servedBy = "disabled";
@@ -32199,6 +33153,11 @@ var init_operator_chat_service = __esm({
           CONCIERGE_THREAD_KEY,
           responseMessage
         );
+        if (this.memory) {
+          const threadId = this.ensureActiveMemoryThread();
+          await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
+          });
+        }
         const payload = {
           version: "1.2",
           event_id: makeEventId("conc"),
@@ -32231,6 +33190,105 @@ var init_operator_chat_service = __esm({
         );
         return thread ? thread.messages : [];
       }
+      // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+      /**
+       * Whether the foundation memory store is wired. Routes use this to
+       * 503 cleanly when called against an unwired service.
+       */
+      hasConciergeMemory() {
+        return this.memory !== void 0;
+      }
+      /**
+       * List concierge memory threads, newest-first. Emits the
+       * `operator_concierge_history_read` audit event with `thread_id="*"`.
+       */
+      async listConciergeMemoryThreads(opts) {
+        if (!this.memory) {
+          throw new Error("concierge memory store not configured");
+        }
+        const summaries = await this.memory.listThreads(opts);
+        const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-hist"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_history_read",
+          surface: "concierge",
+          thread_id: "*",
+          turn_count: totalTurns
+        };
+        this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+        return summaries;
+      }
+      /**
+       * Read a concierge memory thread, oldest turn first. Emits the
+       * `operator_concierge_history_read` audit event with the named
+       * thread_id and the count of turns surfaced.
+       */
+      async readConciergeMemoryThread(threadId, opts) {
+        if (!this.memory) {
+          throw new Error("concierge memory store not configured");
+        }
+        const turns = await this.memory.readThread(threadId, opts);
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-hist"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_history_read",
+          surface: "concierge",
+          thread_id: threadId,
+          turn_count: turns.length
+        };
+        this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+        return turns;
+      }
+      /**
+       * Delete a concierge memory thread. Emits
+       * `operator_concierge_thread_deleted` only when a bundle was actually
+       * removed; absent threads return false without an audit event.
+       */
+      async deleteConciergeMemoryThread(threadId) {
+        if (!this.memory) {
+          throw new Error("concierge memory store not configured");
+        }
+        const turnsBefore = await this.memory.readThread(threadId);
+        if (turnsBefore.length === 0) {
+          return await this.memory.deleteThread(threadId);
+        }
+        const removed = await this.memory.deleteThread(threadId);
+        if (!removed) return false;
+        if (this.activeMemoryThreadId === threadId) {
+          this.activeMemoryThreadId = void 0;
+        }
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-del"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_thread_deleted",
+          surface: "concierge",
+          thread_id: threadId,
+          turn_count: turnsBefore.length
+        };
+        this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+        return true;
+      }
+      /**
+       * Reset the active session memory thread. Subsequent sendConcierge
+       * calls allocate a fresh thread_id. Surfaced for tests + future "new
+       * conversation" affordance; not currently called by the dashboard.
+       */
+      resetConciergeMemoryThread() {
+        this.activeMemoryThreadId = void 0;
+      }
+      ensureActiveMemoryThread() {
+        if (!this.activeMemoryThreadId) {
+          this.activeMemoryThreadId = crypto.randomUUID();
+        }
+        return this.activeMemoryThreadId;
+      }
       /**
        * Stitch fortress state into a single context blob the substrate
        * folds into its summarization prompt.
@@ -32240,6 +33298,9 @@ var init_operator_chat_service = __esm({
        * than nested structures. Format:
        *
        *   ```
+       *   ## Sanctuary reference
+       *   <static domain reference block>
+       *
        *   ## Recent activity
        *   <recentActivity output>
        *
@@ -32251,15 +33312,28 @@ var init_operator_chat_service = __esm({
        *   ```
        */
       async assembleConciergeContext() {
+        const ref = `## Sanctuary reference
+${SANCTUARY_DOMAIN_REFERENCE}`;
         if (!this.contextProviders) {
-          return "## Recent activity\n(no providers wired)\n\n## Wrapped agents\n(no providers wired)\n\n## Open inbox\n(no providers wired)";
+          return `${ref}
+
+## Recent activity
+(no providers wired)
+
+## Wrapped agents
+(no providers wired)
+
+## Open inbox
+(no providers wired)`;
         }
         const [activity, agents, inbox] = await Promise.all([
           this.contextProviders.recentActivity(),
           this.contextProviders.agentInventory(),
           this.contextProviders.openInbox()
         ]);
-        return `## Recent activity
+        return `${ref}
+
+## Recent activity
 ${activity}
 
 ## Wrapped agents
@@ -32381,11 +33455,250 @@ var init_operator_chat_store = __esm({
   }
 });
 
+// src/chat/concierge-memory-store.ts
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO2, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES2, ConciergeMemoryStore;
+var init_concierge_memory_store = __esm({
+  "src/chat/concierge-memory-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    CONCIERGE_MEMORY_NAMESPACE = "_chat";
+    CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+    HKDF_INFO2 = "concierge-memory-store-v1";
+    DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+    MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+    ConciergeMemoryStore = class {
+      storage;
+      encryptionKey;
+      fortressId;
+      retentionDays;
+      locks;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+        this.fortressId = opts.fortressId;
+        this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+        this.locks = /* @__PURE__ */ new Map();
+      }
+      /**
+       * Append a turn to the named thread, creating the bundle if no record
+       * exists. Returns the persisted turn (with assigned turn_id +
+       * retention_until). Per-thread serialisation guarantees turn_id
+       * monotonicity even under concurrent callers.
+       */
+      async appendTurn(threadId, role, content) {
+        return this.withLock(threadId, async () => {
+          const bundle = await this.loadBundle(threadId) ?? null;
+          const now = /* @__PURE__ */ new Date();
+          const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+          const retentionUntil = new Date(now.getTime() + retentionMs);
+          const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+          const turn = {
+            thread_id: threadId,
+            fortress_id: this.fortressId,
+            turn_id: nextTurnId,
+            role,
+            content,
+            created_at: now.toISOString(),
+            retention_until: retentionUntil.toISOString()
+          };
+          const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+            version: 1,
+            thread_id: threadId,
+            fortress_id: this.fortressId,
+            created_at: now.toISOString(),
+            turns: [turn]
+          };
+          await this.saveBundle(next);
+          return turn;
+        });
+      }
+      /**
+       * Read turns from a thread, oldest-first. Returns an empty array if
+       * the thread does not exist or its bundle is corrupt. Does not emit
+       * audit events; the caller (HTTP route handler) owns audit semantics.
+       */
+      async readThread(threadId, opts) {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return [];
+        let turns = bundle.turns;
+        if (opts?.sinceTurnId !== void 0) {
+          const cutoff = opts.sinceTurnId;
+          turns = turns.filter((t) => t.turn_id > cutoff);
+        }
+        if (opts?.limit !== void 0) {
+          turns = turns.slice(0, opts.limit);
+        }
+        return turns;
+      }
+      /**
+       * Enumerate concierge threads in this fortress with summary metadata.
+       * Sorted newest-first by last_turn_at.
+       */
+      async listThreads(opts) {
+        const entries = await this.storage.list(
+          CONCIERGE_MEMORY_NAMESPACE,
+          CONCIERGE_MEMORY_KEY_PREFIX
+        );
+        const summaries = [];
+        for (const meta of entries) {
+          const threadId = stripKeyPrefix(meta.key);
+          if (threadId === null) continue;
+          const bundle = await this.loadBundle(threadId);
+          if (!bundle || bundle.turns.length === 0) continue;
+          const last = bundle.turns[bundle.turns.length - 1];
+          summaries.push({
+            thread_id: bundle.thread_id,
+            created_at: bundle.created_at,
+            last_turn_at: last ? last.created_at : bundle.created_at,
+            turn_count: bundle.turns.length
+          });
+        }
+        summaries.sort(
+          (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+        );
+        if (opts?.limit !== void 0) {
+          return summaries.slice(0, opts.limit);
+        }
+        return summaries;
+      }
+      /**
+       * Delete a thread's bundle. Returns true if the bundle existed and
+       * was removed; false if no bundle was present. Audit emission is the
+       * caller's responsibility.
+       */
+      async deleteThread(threadId) {
+        const key = bundleKey(threadId);
+        return this.withLock(threadId, async () => {
+          const existed = await this.storage.exists(
+            CONCIERGE_MEMORY_NAMESPACE,
+            key
+          );
+          if (!existed) return false;
+          try {
+            await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+          } catch {
+            return false;
+          }
+          return true;
+        });
+      }
+      /**
+       * Drop expired turns across all threads. Threads emptied by pruning
+       * are removed entirely. Returns the count of turns pruned.
+       */
+      async pruneExpired(now) {
+        const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+        const entries = await this.storage.list(
+          CONCIERGE_MEMORY_NAMESPACE,
+          CONCIERGE_MEMORY_KEY_PREFIX
+        );
+        let pruned = 0;
+        for (const meta of entries) {
+          const threadId = stripKeyPrefix(meta.key);
+          if (threadId === null) continue;
+          pruned += await this.withLock(threadId, async () => {
+            const bundle = await this.loadBundle(threadId);
+            if (!bundle) return 0;
+            const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+            const dropped = bundle.turns.length - kept.length;
+            if (dropped === 0) return 0;
+            if (kept.length === 0) {
+              await this.storage.delete(
+                CONCIERGE_MEMORY_NAMESPACE,
+                bundleKey(threadId)
+              );
+            } else {
+              await this.saveBundle({ ...bundle, turns: kept });
+            }
+            return dropped;
+          });
+        }
+        return { pruned };
+      }
+      // ── internals ────────────────────────────────────────────────────────
+      async loadBundle(threadId) {
+        const key = bundleKey(threadId);
+        let raw;
+        try {
+          raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+        } catch {
+          return null;
+        }
+        if (!raw) return null;
+        if (raw.length > MAX_BUNDLE_BYTES2) return null;
+        try {
+          const envelope = JSON.parse(bytesToString(raw));
+          const aad = stringToBytes(threadId);
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const parsed = JSON.parse(
+            bytesToString(plaintext)
+          );
+          if (parsed.version !== 1) return null;
+          if (parsed.thread_id !== threadId) return null;
+          return parsed;
+        } catch {
+          return null;
+        }
+      }
+      async saveBundle(bundle) {
+        const key = bundleKey(bundle.thread_id);
+        const aad = stringToBytes(bundle.thread_id);
+        const plaintext = stringToBytes(JSON.stringify(bundle));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          CONCIERGE_MEMORY_NAMESPACE,
+          key,
+          stringToBytes(JSON.stringify(envelope))
+        );
+      }
+      /**
+       * Run `task` while holding the per-thread async lock. Lock is released
+       * once the task settles (success or failure). Generic helper so
+       * appendTurn / deleteThread / pruneExpired share serialisation.
+       */
+      async withLock(threadId, task) {
+        const previous = this.locks.get(threadId) ?? Promise.resolve();
+        let release;
+        const next = new Promise((resolve8) => {
+          release = resolve8;
+        });
+        const chained = previous.then(() => next);
+        this.locks.set(threadId, chained);
+        try {
+          await previous;
+          return await task();
+        } finally {
+          release();
+          if (this.locks.get(threadId) === chained) {
+            this.locks.delete(threadId);
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/chat/operator-chat-index.ts
 var init_operator_chat_index = __esm({
   "src/chat/operator-chat-index.ts"() {
     init_operator_chat_service();
     init_operator_chat_store();
+    init_concierge_memory_store();
     init_operator_chat_audit_events();
     init_operator_chat_types();
   }
@@ -32399,6 +33712,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -32409,7 +33730,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -32644,7 +33966,7 @@ var init_defaults = __esm({
 });
 
 // src/intelligence/policy-store.ts
-var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO2, IntelligenceConfigStore;
+var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO3, IntelligenceConfigStore;
 var init_policy_store = __esm({
   "src/intelligence/policy-store.ts"() {
     init_encryption();
@@ -32653,13 +33975,13 @@ var init_policy_store = __esm({
     init_defaults();
     INTELLIGENCE_NAMESPACE = "_intelligence";
     SUBSTRATE_CONFIG_KEY = "substrate-config";
-    HKDF_INFO2 = "intelligence-substrate-config";
+    HKDF_INFO3 = "intelligence-substrate-config";
     IntelligenceConfigStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
       }
       /**
        * Load the operator's substrate config from disk. Returns the config
@@ -34681,7 +36003,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -34690,6 +36014,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -34709,7 +36043,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 var InvalidExitBundleError, PRIVATE_MATERIAL_KEYS;
@@ -35291,6 +36625,9 @@ async function importExitBundle(opts) {
     reputationArtifact?.json ?? null,
     manifest
   );
+  if (!conflicts.public_identity_exists && identityArtifact?.json && opts.identityManager.getPrimaryIdentityId() !== null && opts.identityManager.getPrimaryIdentityId() !== identityArtifact.json.bundle.identity_id) {
+    conflicts.public_identity_exists = true;
+  }
   if (!opts.activate) {
     return {
       verified: true,
@@ -35317,7 +36654,7 @@ async function importExitBundle(opts) {
   if (conflicts.public_identity_exists && !opts.forceRebind) {
     throw new ExitBundleImportError(
       "IDENTITY_OVERWRITE_REFUSED",
-      "Importing this bundle would overwrite an existing fortress public identity. Pass forceRebind: true (CLI: --force-rebind) to confirm explicit replacement."
+      "Importing this exit bundle would overwrite an existing fortress public identity (either the same identity already imported, or a different identity is currently active). Pass forceRebind: true (CLI: --force-rebind) to confirm explicit replacement."
     );
   }
   if (conflicts.public_identity_exists && opts.forceRebind && identityArtifact) {
@@ -35674,7 +37011,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -35707,6 +37056,26 @@ async function runExitCommand(args) {
         write(err, "Usage: sanctuary exit import <dir> [--activate]\n");
         return 2;
       }
+      const bundleRoot = path.resolve(dir);
+      try {
+        await promises.access(bundleRoot);
+      } catch {
+        write(err, `Error: bundle directory not found: ${bundleRoot}
+`);
+        return 1;
+      }
+      const manifestPath = path.join(bundleRoot, "manifest.json");
+      try {
+        const raw = await promises.readFile(manifestPath, "utf8");
+        JSON.parse(raw);
+      } catch {
+        write(
+          err,
+          `Error: bundle manifest missing or malformed at ${manifestPath}
+`
+        );
+        return 1;
+      }
       const activate = hasFlag(argv, "--activate");
       const forceRebind = hasFlag(argv, "--force-rebind");
       const acceptUnverifiableAttestations = hasFlag(
@@ -35880,11 +37249,11 @@ async function startDashboardServer(options) {
       }
     }
   });
-  await new Promise((resolve6, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
     server.listen(port, host, () => {
       server.off("error", reject);
-      resolve6();
+      resolve8();
     });
   });
   const actualPort = (() => {
@@ -35897,8 +37266,8 @@ async function startDashboardServer(options) {
     url,
     port: actualPort,
     host,
-    stop: () => new Promise((resolve6, reject) => {
-      server.close((err) => err ? reject(err) : resolve6());
+    stop: () => new Promise((resolve8, reject) => {
+      server.close((err) => err ? reject(err) : resolve8());
     }),
     publish,
     publishActivity: (entry) => publish({ type: "activity", data: entry }),
@@ -36354,7 +37723,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -36452,6 +37833,21 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
     });
   } : void 0;
   const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -36571,7 +37967,7 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
       clientManager.configure(enabledServers).catch((err) => {
         console.error(`[Sanctuary] Failed to configure upstream servers: ${err instanceof Error ? err.message : "unknown error"}`);
       });
-      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
+      await new Promise((resolve8) => setTimeout(resolve8, 2e3));
       const proxiedTools = proxyRouter.getProxiedTools();
       if (proxiedTools.length > 0) {
         allTools.push(...proxiedTools);
@@ -36642,6 +38038,7 @@ var init_src = __esm({
     init_dashboard();
     init_webhook();
     init_gate();
+    init_approval_aggregator();
     init_tools4();
     init_router();
     init_router();
@@ -37410,8 +38807,8 @@ async function runWrap(options, deps = {}) {
     passphraseValue = process.env.SANCTUARY_PASSPHRASE;
   } else {
     try {
-      const resolve6 = deps.resolvePassphrase ?? (() => getOrCreatePassphrase({ storagePath }));
-      const resolved = await resolve6();
+      const resolve8 = deps.resolvePassphrase ?? (() => getOrCreatePassphrase({ storagePath }));
+      const resolved = await resolve8();
       passphraseLocation = resolved.location;
       passphraseSource = resolved.source;
       passphraseValue = resolved.value;
@@ -37766,12 +39163,12 @@ async function defaultOpenBrowser(url) {
     cmd = "xdg-open";
     args = [url];
   }
-  await new Promise((resolve6) => {
+  await new Promise((resolve8) => {
     const child = child_process.spawn(cmd, args, { stdio: "ignore", detached: true });
-    child.on("error", () => resolve6());
+    child.on("error", () => resolve8());
     child.on("spawn", () => {
       child.unref();
-      resolve6();
+      resolve8();
     });
   });
 }
@@ -38740,32 +40137,32 @@ endstream`;
         const offsets = new Array(totalObjects + 1).fill(0);
         const chunks = [];
         let bytePos = 0;
-        const write2 = (s) => {
+        const write3 = (s) => {
           const buf = Buffer.from(s, "latin1");
           chunks.push(buf);
           bytePos += buf.length;
         };
-        write2("%PDF-1.4\n%\xE2\xE3\xCF\xD3\n");
+        write3("%PDF-1.4\n%\xE2\xE3\xCF\xD3\n");
         for (let i = 1; i <= totalObjects; i++) {
           offsets[i] = bytePos;
-          write2(`${i} 0 obj
+          write3(`${i} 0 obj
 ${objectBodies[i]}
 endobj
 `);
         }
         const xrefPos = bytePos;
-        write2(`xref
+        write3(`xref
 0 ${totalObjects + 1}
 `);
-        write2("0000000000 65535 f \n");
+        write3("0000000000 65535 f \n");
         for (let i = 1; i <= totalObjects; i++) {
-          write2(`${offsets[i].toString().padStart(10, "0")} 00000 n 
+          write3(`${offsets[i].toString().padStart(10, "0")} 00000 n 
 `);
         }
-        write2(`trailer
+        write3(`trailer
 << /Size ${totalObjects + 1} /Root 1 0 R >>
 `);
-        write2(`startxref
+        write3(`startxref
 ${xrefPos}
 %%EOF
 `);
@@ -39100,7 +40497,7 @@ var init_backend_interface = __esm({
   }
 });
 async function runSecurity(args, input) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     const child = child_process.spawn(SECURITY_BIN, args, { stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -39122,7 +40519,7 @@ async function runSecurity(args, input) {
       reject(err);
     });
     child.on("close", (code) => {
-      resolve6({ stdout, stderr, code: code ?? -1 });
+      resolve8({ stdout, stderr, code: code ?? -1 });
     });
     if (input !== void 0) {
       child.stdin.write(input);
@@ -40198,7 +41595,7 @@ async function readValue(stdin, prompt2) {
   return await readFirstLine(stdin);
 }
 async function readFirstLine(stdin) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve8, reject) => {
     const rl = readline.createInterface({ input: stdin });
     let resolved = false;
     const finish = (value) => {
@@ -40209,7 +41606,7 @@ async function readFirstLine(stdin) {
         rl.close();
       } catch {
       }
-      resolve6(value);
+      resolve8(value);
     };
     const deadline = setTimeout(() => {
       finish("");
@@ -40228,7 +41625,7 @@ async function promptSilently(stdin, prompt2) {
   process.stderr.write(`${prompt2}: `);
   stdin.setRawMode?.(true);
   stdin.resume();
-  return await new Promise((resolve6) => {
+  return await new Promise((resolve8) => {
     let buf = "";
     const onData = (chunk) => {
       const s = chunk.toString("utf8");
@@ -40238,7 +41635,7 @@ async function promptSilently(stdin, prompt2) {
           stdin.pause();
           stdin.off("data", onData);
           process.stderr.write("\n");
-          resolve6(buf);
+          resolve8(buf);
           return;
         }
         if (ch === "") {
@@ -40505,13 +41902,179 @@ var init_cli4 = __esm({
     init_discovery();
   }
 });
+
+// src/cli/identity.ts
+var identity_exports2 = {};
+__export(identity_exports2, {
+  runIdentityCommand: () => runIdentityCommand
+});
+function write2(stream, text) {
+  stream.write(text);
+}
+function flagValue2(argv, name) {
+  const index = argv.indexOf(name);
+  if (index === -1) return void 0;
+  return argv[index + 1];
+}
+function hasFlag2(argv, name) {
+  return argv.includes(name);
+}
+function printUsage3(out) {
+  write2(
+    out,
+    `Usage: sanctuary identity <command> [options]
+
+Commands:
+  show           Print the active identity (DID, identity_id, public key).
+
+Options:
+  --fortress <path>   Override the storage path.
+  --passphrase <val>  Passphrase for master-key derivation.
+  --json              Output as JSON.
+  --help, -h          Show this help.
+
+Environment variables:
+  SANCTUARY_PASSPHRASE    Key derivation passphrase.
+  SANCTUARY_STORAGE_PATH  State directory (default: ~/.sanctuary).
+  SANCTUARY_FORTRESS_PATH Operator-friendly alias for STORAGE_PATH.
+  SANCTUARY_RECOVERY_KEY  Recovery key (alternative to passphrase).
+
+Identity data is encrypted at rest. A passphrase or recovery key is
+required to decrypt and display identity information.
+`
+  );
+}
+async function runIdentityCommand(args) {
+  const argv = args.argv;
+  const out = args.out ?? process.stdout;
+  const err = args.err ?? process.stderr;
+  const env = args.env ?? process.env;
+  if (argv.length === 0 || hasFlag2(argv, "--help") || hasFlag2(argv, "-h")) {
+    printUsage3(out);
+    return 0;
+  }
+  const command = argv[0];
+  if (command === "show") {
+    return await cmdShow(argv.slice(1), out, err, env);
+  }
+  write2(err, `Unknown identity command: ${command}
+`);
+  write2(err, `Run "sanctuary identity --help" for usage.
+`);
+  return 2;
+}
+async function cmdShow(argv, out, err, env) {
+  const json = hasFlag2(argv, "--json");
+  const fortressFlag = flagValue2(argv, "--fortress");
+  if (fortressFlag) {
+    process.env.SANCTUARY_STORAGE_PATH = fortressFlag;
+  }
+  const passphrase = flagValue2(argv, "--passphrase") ?? env.SANCTUARY_PASSPHRASE;
+  const recoveryKey = env.SANCTUARY_RECOVERY_KEY;
+  if (!passphrase && !recoveryKey) {
+    write2(
+      err,
+      "Error: sanctuary identity show requires SANCTUARY_PASSPHRASE, --passphrase, or SANCTUARY_RECOVERY_KEY.\n"
+    );
+    return 1;
+  }
+  try {
+    const config = await loadConfig();
+    await promises.mkdir(config.storage_path, { recursive: true, mode: 448 });
+    const stateStoragePath = path.join(config.storage_path, "state");
+    const storage = new FilesystemStorage(stateStoragePath);
+    let masterKey;
+    if (passphrase) {
+      let existingParams;
+      const raw = await storage.read("_meta", "key-params");
+      if (raw)
+        existingParams = JSON.parse(bytesToString(raw));
+      const derived = await deriveMasterKey(passphrase, existingParams);
+      masterKey = derived.key;
+    } else {
+      masterKey = fromBase64url(recoveryKey);
+      if (masterKey.length !== 32) {
+        write2(err, "Error: SANCTUARY_RECOVERY_KEY must decode to 32 bytes.\n");
+        return 1;
+      }
+    }
+    const identityManager = new IdentityManager(storage, masterKey);
+    const loadResult = await identityManager.load();
+    if (loadResult.loaded === 0) {
+      write2(
+        err,
+        loadResult.total > 0 ? "Error: identity files found but none could be decrypted. Wrong passphrase?\n" : "No identities found in this fortress.\n"
+      );
+      return 1;
+    }
+    const primary = identityManager.getDefault();
+    if (!primary) {
+      write2(err, "No primary identity set.\n");
+      return 1;
+    }
+    if (json) {
+      write2(
+        out,
+        JSON.stringify(
+          {
+            identity_id: primary.identity_id,
+            did: primary.did,
+            public_key: primary.public_key,
+            label: primary.label,
+            key_type: primary.key_type,
+            created_at: primary.created_at,
+            storage_path: config.storage_path,
+            total_identities: loadResult.loaded
+          },
+          null,
+          2
+        ) + "\n"
+      );
+    } else {
+      write2(out, `identity_id:      ${primary.identity_id}
+`);
+      write2(out, `did:              ${primary.did}
+`);
+      write2(out, `public_key:       ${primary.public_key}
+`);
+      write2(out, `label:            ${primary.label}
+`);
+      write2(out, `key_type:         ${primary.key_type}
+`);
+      write2(out, `created_at:       ${primary.created_at}
+`);
+      write2(out, `storage_path:     ${config.storage_path}
+`);
+      write2(out, `total_identities: ${loadResult.loaded}
+`);
+    }
+    return 0;
+  } catch (error) {
+    write2(
+      err,
+      error instanceof Error ? `Error: ${error.message}
+` : `Error: ${String(error)}
+`
+    );
+    return 1;
+  }
+}
+var init_identity2 = __esm({
+  "src/cli/identity.ts"() {
+    init_filesystem();
+    init_tools();
+    init_key_derivation();
+    init_encoding();
+    init_config();
+  }
+});
 async function probeTenantDashboard(tenant, options = {}) {
   const rt = tenant.runtime;
   if (!rt) {
     return { running: false, status: null, reason: "no runtime.json" };
   }
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS4;
-  return await new Promise((resolve6) => {
+  return await new Promise((resolve8) => {
     const req = http.get(
       {
         host: rt.dashboard_host,
@@ -40523,9 +42086,9 @@ async function probeTenantDashboard(tenant, options = {}) {
         res.resume();
         const status = res.statusCode ?? 0;
         if (status > 0 && status < 500) {
-          resolve6({ running: true, status, reason: null });
+          resolve8({ running: true, status, reason: null });
         } else {
-          resolve6({
+          resolve8({
             running: false,
             status,
             reason: `dashboard returned ${status}`
@@ -40535,10 +42098,10 @@ async function probeTenantDashboard(tenant, options = {}) {
     );
     req.on("timeout", () => {
       req.destroy();
-      resolve6({ running: false, status: null, reason: "timeout" });
+      resolve8({ running: false, status: null, reason: "timeout" });
     });
     req.on("error", (err) => {
-      resolve6({
+      resolve8({
         running: false,
         status: null,
         reason: err.code ?? err.message
@@ -40570,10 +42133,17 @@ function resolveCtx(args) {
   };
 }
 async function runAgentsCommand(args) {
+  const fortressIdx = args.argv.indexOf("--fortress");
+  if (fortressIdx !== -1 && args.argv[fortressIdx + 1]) {
+    args = { ...args, root: args.argv[fortressIdx + 1] };
+    const filtered = [...args.argv];
+    filtered.splice(fortressIdx, 2);
+    args = { ...args, argv: filtered };
+  }
   const ctx = resolveCtx(args);
   const [sub, ...rest] = args.argv;
   if (!sub || sub === "--help" || sub === "-h" || sub === "help") {
-    printUsage3(ctx.out);
+    printUsage4(ctx.out);
     return 0;
   }
   try {
@@ -40581,13 +42151,13 @@ async function runAgentsCommand(args) {
       case "list":
         return await cmdList3(rest, ctx);
       case "show":
-        return await cmdShow(rest, ctx);
+        return await cmdShow2(rest, ctx);
       case "status":
         return await cmdStatus(rest, ctx);
       default:
         ctx.err.write(`Unknown subcommand: ${sub}
 `);
-        printUsage3(ctx.err);
+        printUsage4(ctx.err);
         return 2;
     }
   } catch (e) {
@@ -40597,13 +42167,17 @@ async function runAgentsCommand(args) {
     return 1;
   }
 }
-function printUsage3(s) {
+function printUsage4(s) {
   s.write(`Usage: sanctuary agents <command> [flags]
 
   list [--json]                 List every tenant visible on this host.
   show <tenant> [--json]        Show details for one tenant.
   status [--json]               One-line-per-tenant running/stopped summary.
 
+Options:
+  --fortress <path>             Scope discovery to a specific storage path
+                                instead of scanning ~/.sanctuary.
+
 Tenants are discovered by scanning ~/.sanctuary and any storage paths in
 SANCTUARY_AGENTS_EXTRA_PATHS or ~/.sanctuary/agents-extra.json. Tenant
 creation is done via \`sanctuary wrap\` with SANCTUARY_STORAGE_PATH set.
@@ -40687,7 +42261,7 @@ async function cmdList3(argv, ctx) {
   }
   return 0;
 }
-async function cmdShow(argv, ctx) {
+async function cmdShow2(argv, ctx) {
   const positional = argv.find((a) => !a.startsWith("--"));
   if (!positional) {
     ctx.err.write("Missing tenant. Usage: sanctuary agents show <tenant>\n");
@@ -40828,7 +42402,8 @@ var init_agents = __esm({
 // src/cli/reset-passphrase.ts
 var reset_passphrase_exports = {};
 __export(reset_passphrase_exports, {
-  runResetPassphraseCommand: () => runResetPassphraseCommand
+  runResetPassphraseCommand: () => runResetPassphraseCommand,
+  zeroizeBuffers: () => zeroizeBuffers
 });
 async function runResetPassphraseCommand(args) {
   const out = args.out ?? process.stdout;
@@ -40838,10 +42413,10 @@ async function runResetPassphraseCommand(args) {
   const plat = args.platformOverride ?? process.platform;
   const parsed = parseArgs2(args.argv);
   if (parsed.help) {
-    printUsage4(out);
+    printUsage5(out);
     return 0;
   }
-  const storagePath = parsed.storage ?? args.storagePath ?? resolveStoragePath(process.env, home);
+  const storagePath = parsed.storage ?? parsed.fortress ?? args.storagePath ?? resolveStoragePath(process.env, home);
   out.write(banner(storagePath));
   const runtimeFile = path.join(storagePath, "runtime.json");
   if (await fileExists4(runtimeFile)) {
@@ -40856,34 +42431,42 @@ Then re-run this command.
     return 1;
   }
   const lines = new LineReader(stdin);
+  let code = 1;
+  let nukeSucceeded = false;
   try {
     const availability = await surveyAvailableModes(storagePath);
     const mode = parsed.mode ?? await selectMode(lines, out, err, availability);
     if (!mode) {
       err.write("Aborted: no recovery mode selected.\n");
-      return 1;
-    }
-    if (mode === "shares") {
-      return await runSharesPath(out, err, availability);
-    }
-    if (mode === "guardian") {
-      return await runGuardianPath(out, err, availability);
+      code = 1;
+    } else if (mode === "shares") {
+      code = await runSharesPath(out, err, availability);
+    } else if (mode === "guardian") {
+      code = await runGuardianPath(out, err, availability);
+    } else {
+      code = await runNukePath({
+        out,
+        err,
+        lines,
+        storagePath,
+        home,
+        plat,
+        exec: args.exec ?? defaultExec2
+      });
+      nukeSucceeded = mode === "nuke" && code === 0;
     }
-    return await runNukePath({
-      out,
-      err,
-      lines,
-      storagePath,
-      home,
-      plat,
-      exec: args.exec ?? defaultExec2
-    });
   } finally {
+    zeroizeBuffers(args.keyMaterialToZeroize);
     lines.close();
   }
+  if (parsed.exitOnCompletion && nukeSucceeded) {
+    const doExit = args.exitProcess ?? ((c) => process.exit(c));
+    doExit(0);
+  }
+  return code;
 }
 function parseArgs2(argv) {
-  const out = { help: false };
+  const out = { exitOnCompletion: false, help: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--help" || a === "-h") {
@@ -40898,13 +42481,17 @@ function parseArgs2(argv) {
       out.mode = v;
     } else if (a === "--storage" && argv[i + 1]) {
       out.storage = argv[++i];
+    } else if (a === "--fortress" && argv[i + 1]) {
+      out.fortress = argv[++i];
+    } else if (a === "--exit-on-completion") {
+      out.exitOnCompletion = true;
     } else if (a && a.startsWith("--")) {
       throw new Error(`Unknown flag: ${a}`);
     }
   }
   return out;
 }
-function printUsage4(out) {
+function printUsage5(out) {
   out.write(`
 Usage: sanctuary reset-passphrase [options]
 
@@ -40927,9 +42514,19 @@ Recover a fortress whose passphrase has been lost or corrupted. Three modes:
 
 Options:
   --mode <shares|guardian|nuke>   Pick a path non-interactively.
-  --storage <path>                Override the resolved storage path.
-                                  Defaults to SANCTUARY_STORAGE_PATH or
-                                  ~/.sanctuary.
+  --fortress <path>               Override the fortress storage path.
+                                  Consistent with "sanctuary wrap --fortress".
+  --storage <path>                Alias for --fortress.
+  --exit-on-completion            After a successful nuke, call process.exit(0)
+                                  immediately so the post-wipe heap is reaped
+                                  by the OS without re-entering the shell. Use
+                                  on extreme-threat-model deployments where an
+                                  attacker-on-host with heap-dump access could
+                                  recover residual passphrase or key bytes
+                                  between the wipe and the next operator
+                                  command. JS strings cannot be explicitly
+                                  zeroed; this flag is the supported way to
+                                  bound the heap-dump window.
   --help, -h                      Show this help.
 
 Without --mode, the command surveys which paths are operationally available
@@ -41199,8 +42796,18 @@ async function prompt(lines, err, question) {
   err.write(question);
   return await lines.next();
 }
+function zeroizeBuffers(buffers) {
+  if (!buffers) return;
+  for (const b of buffers) {
+    if (!b) continue;
+    try {
+      b.fill(0);
+    } catch {
+    }
+  }
+}
 async function defaultExec2(cmd, args) {
-  return await new Promise((resolve6, reject) => {
+  return await new Promise((resolve8, reject) => {
     const child = child_process.spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -41211,7 +42818,7 @@ async function defaultExec2(cmd, args) {
       stderr += d.toString();
     });
     child.on("error", reject);
-    child.on("close", (code) => resolve6({ stdout, stderr, code }));
+    child.on("close", (code) => resolve8({ stdout, stderr, code }));
   });
 }
 var LineReader;
@@ -41247,8 +42854,8 @@ var init_reset_passphrase = __esm({
           return Promise.resolve(this.queue.shift());
         }
         if (this.closed) return Promise.resolve("");
-        return new Promise((resolve6) => {
-          this.waiters.push(resolve6);
+        return new Promise((resolve8) => {
+          this.waiters.push(resolve8);
         });
       }
       close() {
@@ -41647,11 +43254,11 @@ async function startMultiDashboardServer(options = {}) {
       }
     }
   });
-  await new Promise((resolve6, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
     server.listen(port, host, () => {
       server.off("error", reject);
-      resolve6();
+      resolve8();
     });
   });
   const addr = server.address();
@@ -41660,8 +43267,8 @@ async function startMultiDashboardServer(options = {}) {
     url: `http://${host}:${actualPort}`,
     port: actualPort,
     host,
-    stop: () => new Promise((resolve6, reject) => {
-      server.close((err) => err ? reject(err) : resolve6());
+    stop: () => new Promise((resolve8, reject) => {
+      server.close((err) => err ? reject(err) : resolve8());
     })
   };
 }
@@ -41879,7 +43486,19 @@ Refusing to start the dashboard while the reset-history marker is unreadable.`
     }
     throw err;
   }
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   const dashboardPort = options.port ?? config.dashboard.port;
@@ -42061,7 +43680,7 @@ function formatUpdateMessage(current, latest) {
   return `[Sanctuary] Update available: ${current} \u2192 ${latest}. Run: npx @sanctuary-framework/mcp-server@latest`;
 }
 function fetchLatestVersion(currentVersion) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve8) => {
     const req = https.get(
       REGISTRY_URL,
       {
@@ -42071,7 +43690,7 @@ function fetchLatestVersion(currentVersion) {
       (res) => {
         if (res.statusCode !== 200) {
           res.resume();
-          resolve6(null);
+          resolve8(null);
           return;
         }
         let data = "";
@@ -42080,7 +43699,7 @@ function fetchLatestVersion(currentVersion) {
           data += chunk;
           if (data.length > 32768) {
             res.destroy();
-            resolve6(null);
+            resolve8(null);
           }
         });
         res.on("end", () => {
@@ -42088,20 +43707,20 @@ function fetchLatestVersion(currentVersion) {
             const json = JSON.parse(data);
             const latest = json.version;
             if (typeof latest === "string" && isNewerVersion(currentVersion, latest)) {
-              resolve6(latest);
+              resolve8(latest);
             } else {
-              resolve6(null);
+              resolve8(null);
             }
           } catch {
-            resolve6(null);
+            resolve8(null);
           }
         });
       }
     );
-    req.on("error", () => resolve6(null));
+    req.on("error", () => resolve8(null));
     req.on("timeout", () => {
       req.destroy();
-      resolve6(null);
+      resolve8(null);
     });
   });
 }
@@ -42179,6 +43798,11 @@ async function main() {
     const code = await runTemplateCommand2({ argv: args.slice(1) });
     process.exit(code);
   }
+  if (args[0] === "identity") {
+    const { runIdentityCommand: runIdentityCommand2 } = await Promise.resolve().then(() => (init_identity2(), identity_exports2));
+    const code = await runIdentityCommand2({ argv: args.slice(1) });
+    process.exit(code);
+  }
   if (args[0] === "agents") {
     const { runAgentsCommand: runAgentsCommand2 } = await Promise.resolve().then(() => (init_agents(), agents_exports));
     const code = await runAgentsCommand2({ argv: args.slice(1) });
@@ -42400,6 +44024,9 @@ Subcommands:
                        Use "sanctuary dashboard --help" for options.
                        Pass --multi to render the multi-tenant overview.
 
+  identity             Inspect the active identity (DID, public key).
+                       Use "sanctuary identity --help" for options.
+
   template             Manage policy templates (list, init).
                        Use "sanctuary template --help" for options.