@sanctuary-framework/mcp-server 1.2.2 → 1.2.4

package/dist/index.js

@@ -3,7 +3,7 @@ import { gcm } from '@noble/ciphers/aes.js';
 import { sha256 } from '@noble/hashes/sha256';
 import { hmac } from '@noble/hashes/hmac';
 import { RistrettoPoint, ed25519 } from '@noble/curves/ed25519';
-import { readFile, mkdir, writeFile, stat, unlink, readdir, chmod, lstat, realpath, rm, access, constants } from 'fs/promises';
+import { readFile, mkdir, writeFile, stat, unlink, readdir, chmod, lstat, access, realpath, rm, constants } from 'fs/promises';
 import { join, resolve, dirname, sep, basename } from 'path';
 import os, { platform, homedir } from 'os';
 import { createRequire } from 'module';
@@ -4436,13 +4436,23 @@ function parseScalar(value) {
   return value.replace(/^["']|["']$/g, "");
 }
 function validatePolicy(raw) {
+  if (!("tier1_always_approve" in raw)) {
+    throw new Error(
+      "Policy file must include 'tier1_always_approve' as an explicit list (use [] for empty). Remove specific entries instead of removing the whole key."
+    );
+  }
+  if (!("approval_channel" in raw)) {
+    throw new Error(
+      "Policy file must include 'approval_channel' as an explicit object (use {} for defaults). Remove specific entries instead of removing the whole key."
+    );
+  }
   const userTier3 = raw.tier3_always_allow ?? [];
   const mergedTier3 = [
     .../* @__PURE__ */ new Set([...userTier3, ...DEFAULT_POLICY.tier3_always_allow])
   ];
   return {
     version: raw.version ?? 1,
-    tier1_always_approve: raw.tier1_always_approve ?? DEFAULT_POLICY.tier1_always_approve,
+    tier1_always_approve: raw.tier1_always_approve,
     tier2_anomaly: {
       ...DEFAULT_TIER2,
       ...raw.tier2_anomaly ?? {}
@@ -4463,6 +4473,11 @@ function generateDefaultPolicyYaml() {
 # This file controls what your agent can do without asking.
 # Edit this file directly. Your agent cannot modify it.
 # Changes take effect on server restart.
+#
+# Required keys (must be present; use [] or {} for empty):
+#   tier1_always_approve, approval_channel
+# Optional keys (omit to use defaults; new defaults merge automatically):
+#   tier2_anomaly, tier3_always_allow
 
 version: 1
 
@@ -4567,20 +4582,52 @@ approval_channel:
   timeout_seconds: 300
 `;
 }
+var MalformedPrincipalPolicyError = class extends Error {
+  constructor(policyPath, reason) {
+    super(
+      `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+    );
+    this.policyPath = policyPath;
+    this.reason = reason;
+    this.name = "MalformedPrincipalPolicyError";
+  }
+  policyPath;
+  reason;
+};
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await writeFile(policyPath, defaultYaml, "utf-8");
+        await chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await writeFile(policyPath, defaultYaml, "utf-8");
-      await chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
 
@@ -4807,7 +4854,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 
 // src/shr/generator.ts
@@ -11113,10 +11160,11 @@ function initTemplate(params) {
 var DEFAULT_STORAGE_DIR = ".sanctuary";
 var KEYCHAIN_SERVICE_DEFAULT = "sanctuary-passphrase";
 function keychainServiceFor(storagePath, home = homedir()) {
-  const defaultPath = join(home, DEFAULT_STORAGE_DIR);
-  if (storagePath === defaultPath) return KEYCHAIN_SERVICE_DEFAULT;
-  const digest = sha256(Buffer.from(storagePath, "utf-8"));
-  const suffix = Buffer.from(digest).toString("hex").slice(0, 12);
+  const defaultPath = resolve(join(home, DEFAULT_STORAGE_DIR));
+  const canonicalStorage = resolve(storagePath);
+  if (canonicalStorage === defaultPath) return KEYCHAIN_SERVICE_DEFAULT;
+  const digest = sha256(Buffer.from(canonicalStorage, "utf-8"));
+  const suffix = Buffer.from(digest).toString("hex").slice(0, 16);
   return `${KEYCHAIN_SERVICE_DEFAULT}-${suffix}`;
 }
 var RUNTIME_FILE_NAME = "runtime.json";
@@ -11257,7 +11305,7 @@ async function discoverTenants(options = {}) {
   for (const child of children) {
     const childPath = join(root, child);
     if (child.startsWith(".")) continue;
-    if (child === "state" || child === "backup" || child === "config") continue;
+    if (child === "state" || child === "backup" || child === "config" || child === "default") continue;
     const s = await stat(childPath).catch(() => null);
     if (!s || !s.isDirectory()) continue;
     const desc = await describeTenant(child, childPath, home);
@@ -11269,6 +11317,17 @@ async function discoverTenants(options = {}) {
     const desc = await describeTenant(basename(extra), extra, home);
     if (desc) tenants.push(desc);
   }
+  const seen = /* @__PURE__ */ new Map();
+  for (const t of tenants) {
+    seen.set(t.name, (seen.get(t.name) ?? 0) + 1);
+  }
+  for (const [name, count] of seen) {
+    if (count > 1) {
+      console.error(
+        `[sanctuary] warning: ${count} tenants share the name "${name}". Use --tenant with a unique name or storage path to disambiguate.`
+      );
+    }
+  }
   tenants.sort((a, b) => {
     if (a.name === "default") return -1;
     if (b.name === "default") return 1;
@@ -11617,6 +11676,16 @@ var HUB_ROUTES = {
    */
   CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
   CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+  /**
+   * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+   * scrollback, and operator-initiated thread delete. Distinct from the
+   * v1.2 `/history` route, which surfaces the active in-session thread
+   * shape; the new routes target persisted multi-thread memory used by
+   * v1.3 conversational sovereignty depth.
+   */
+  CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+  CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+  CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
   /**
    * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
    * recent activity feed, pending Tier 1 approvals routed through this
@@ -11640,6 +11709,10 @@ var HUB_TIER_1_AGENT_CONTROL_ACTIONS = [
 ];
 var HUB_ACTIVITY_DEFAULT_LIMIT = 50;
 var HUB_ACTIVITY_MAX_LIMIT = 500;
+var HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+var HUB_CHAT_THREADS_MAX_LIMIT = 500;
+var HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+var HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
 var HUB_INBOX_DEFAULT_LIMIT = 100;
 var HUB_INBOX_MAX_LIMIT = 500;
 var HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -11811,6 +11884,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -11994,6 +12084,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -15637,6 +15768,8 @@ var IntelligenceRouterError = class extends Error {
     this.code = code;
     this.name = "IntelligenceRouterError";
   }
+  statusCode;
+  code;
 };
 function writeJSON3(res, status, payload) {
   res.writeHead(status, {
@@ -16041,6 +16174,162 @@ async function dispatchV11Request(inputs, req, res, url, method) {
   return false;
 }
 
+// src/principal-policy/approval-aggregator-routes.ts
+var APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+var APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+var APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+var APPROVAL_INBOX_MAX_LIMIT = 200;
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16105,6 +16394,14 @@ var DashboardApprovalChannel = class {
    * regardless. Default route flip is deferred to v1.2.
    */
   v11Bindings = null;
+  /**
+   * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+   * additively at `/api/approval-inbox/*` when set. Legacy approval
+   * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+   * aggregator is a passive subscriber to the gate; the routes here are
+   * the operator-facing query / decision surface.
+   */
+  approvalAggregator = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16155,6 +16452,34 @@ var DashboardApprovalChannel = class {
   setV11Bindings(bindings) {
     this.v11Bindings = bindings;
   }
+  /**
+   * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+   * aggregator. Once set, requests to `/api/approval-inbox/*` route
+   * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+   * tests + during shutdown).
+   */
+  setApprovalAggregator(aggregator) {
+    this.approvalAggregator = aggregator;
+  }
+  /**
+   * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+   * before the legacy approval route table. Returns true when served.
+   */
+  async dispatchApprovalInbox(req, res) {
+    if (!this.approvalAggregator) return false;
+    return handleApprovalInboxRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        aggregator: this.approvalAggregator,
+        operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16220,7 +16545,7 @@ var DashboardApprovalChannel = class {
       server = createServer$2(handler);
     }
     this.httpServer = server;
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const protocol = this.useTLS ? "https" : "http";
       const baseUrl = `${protocol}://${this.config.host}:${this.config.port}`;
       server.listen(this.config.port, this.config.host, () => {
@@ -16245,7 +16570,7 @@ var DashboardApprovalChannel = class {
         if (shouldAutoOpen) {
           this.openInBrowser(sessionUrl);
         }
-        resolve4();
+        resolve6();
       });
       server.on("error", (err) => {
         if (err.code === "EADDRINUSE") {
@@ -16291,8 +16616,8 @@ var DashboardApprovalChannel = class {
     }
     this.rateLimits.clear();
     if (this.httpServer) {
-      return new Promise((resolve4) => {
-        this.httpServer.close(() => resolve4());
+      return new Promise((resolve6) => {
+        this.httpServer.close(() => resolve6());
       });
     }
   }
@@ -16306,7 +16631,7 @@ var DashboardApprovalChannel = class {
       `[Sanctuary] Approval required: ${request.operation} (Tier ${request.tier}) \u2014 open dashboard to respond
 `
     );
-    return new Promise((resolve4) => {
+    return new Promise((resolve6) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         const response = {
@@ -16320,12 +16645,12 @@ var DashboardApprovalChannel = class {
           decision: response.decision,
           decided_by: "timeout"
         });
-        resolve4(response);
+        resolve6(response);
       }, this.config.timeout_seconds * 1e3);
       const pending = {
         id,
         request,
-        resolve: resolve4,
+        resolve: resolve6,
         timer,
         created_at: (/* @__PURE__ */ new Date()).toISOString()
       };
@@ -16530,6 +16855,18 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+      this.dispatchApprovalInbox(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -17186,7 +17523,7 @@ var WebhookApprovalChannel = class {
    * Start the callback listener server.
    */
   async start() {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       this.callbackServer = createServer$2(
         (req, res) => this.handleCallback(req, res)
       );
@@ -17201,7 +17538,7 @@ var WebhookApprovalChannel = class {
 
 `
           );
-          resolve4();
+          resolve6();
         }
       );
       this.callbackServer.on("error", reject);
@@ -17221,8 +17558,8 @@ var WebhookApprovalChannel = class {
     }
     this.pending.clear();
     if (this.callbackServer) {
-      return new Promise((resolve4) => {
-        this.callbackServer.close(() => resolve4());
+      return new Promise((resolve6) => {
+        this.callbackServer.close(() => resolve6());
       });
     }
   }
@@ -17235,7 +17572,7 @@ var WebhookApprovalChannel = class {
       `[Sanctuary] Webhook approval sent: ${request.operation} (Tier ${request.tier}) \u2014 awaiting callback
 `
     );
-    return new Promise((resolve4) => {
+    return new Promise((resolve6) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         const response = {
@@ -17244,12 +17581,12 @@ var WebhookApprovalChannel = class {
           decided_at: (/* @__PURE__ */ new Date()).toISOString(),
           decided_by: "timeout"
         };
-        resolve4(response);
+        resolve6(response);
       }, this.config.timeout_seconds * 1e3);
       const pending = {
         id,
         request,
-        resolve: resolve4,
+        resolve: resolve6,
         timer,
         created_at: (/* @__PURE__ */ new Date()).toISOString()
       };
@@ -18535,6 +18872,11 @@ var InjectionDetector = class {
   }
 };
 
+// src/principal-policy/deny-vocabulary.ts
+var AGENT_VISIBLE_DENY_REASONS = {
+  REQUIRES_APPROVAL: "operation requires operator approval",
+  NOT_PERMITTED: "operation not permitted"};
+
 // src/principal-policy/gate.ts
 var ApprovalGate = class {
   policy;
@@ -18543,14 +18885,25 @@ var ApprovalGate = class {
   auditLog;
   injectionDetector;
   onInjectionAlert;
+  onApprovalEvent;
   proxyTierResolver;
-  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
     this.policy = policy;
     this.baseline = baseline;
     this.channel = channel;
     this.auditLog = auditLog;
     this.injectionDetector = injectionDetector ?? new InjectionDetector();
     this.onInjectionAlert = onInjectionAlert;
+    this.onApprovalEvent = onApprovalEvent;
+  }
+  /**
+   * Set the approval-event callback after construction. Used by the
+   * Upsilon-1 wire-up when the aggregator is constructed alongside the
+   * gate. The aggregator subscribes through this setter rather than the
+   * constructor so existing call sites continue to work unchanged.
+   */
+  setApprovalEventCallback(cb) {
+    this.onApprovalEvent = cb;
   }
   /**
    * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -18587,10 +18940,16 @@ var ApprovalGate = class {
         });
       }
       if (injectionResult.recommendation === "block") {
+        this.auditLog.append("l2", `gate_injection_block:${operation}`, "system", {
+          tier: 1,
+          operation,
+          injection_confidence: injectionResult.confidence,
+          signal_count: injectionResult.signals.length
+        });
         return {
           allowed: false,
           tier: 1,
-          reason: `Blocked: prompt injection detected in "${operation}" (confidence: ${(injectionResult.confidence * 100).toFixed(0)}%)`,
+          reason: AGENT_VISIBLE_DENY_REASONS.NOT_PERMITTED,
           approval_required: false
         };
       }
@@ -18667,7 +19026,7 @@ var ApprovalGate = class {
     this.auditLog.append("l2", `gate_unclassified:${operation}`, "system", {
       tier: 1,
       operation,
-      warning: "Operation is not classified in any policy tier \u2014 defaulting to Tier 1 (require approval)"
+      warning: "Operation is not classified in any policy tier, defaulting to Tier 1 (require approval)"
     });
     return this.requestApproval(
       operation,
@@ -18778,25 +19137,109 @@ var ApprovalGate = class {
   }
   /**
    * Request approval from the human principal.
+   *
+   * Fail-closed contract (full-sweep #49): if the channel throws (network
+   * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+   * failure, etc.), the gate denies the operation and audit-logs the cause.
+   * Channel-internal timeouts already resolve with decision: "deny" per
+   * SEC-002; this catch covers the remaining "channel raised" path so an
+   * unhandled rejection cannot turn into an indeterminate state at the gate.
    */
   async requestApproval(operation, tier, reason, context) {
+    const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
     const request = {
       operation,
       tier,
       reason,
       context,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: requestTimestamp
     };
-    const response = await this.channel.requestApproval(request);
+    const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "requested",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
+    let response;
+    try {
+      response = await this.channel.requestApproval(request);
+    } catch (err) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+      const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+        tier,
+        reason,
+        decided_by: "channel_failure",
+        channel_error: errMessage
+      });
+      if (this.onApprovalEvent) {
+        try {
+          this.onApprovalEvent({
+            phase: "resolved",
+            operation,
+            tier,
+            reason,
+            context,
+            request_timestamp: requestTimestamp,
+            resolution: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            },
+            correlation_id: correlationId
+          });
+        } catch {
+        }
+      }
+      return {
+        allowed: false,
+        tier,
+        reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+        approval_required: true,
+        approval_response: {
+          decision: "deny",
+          decided_at: decidedAt,
+          decided_by: "channel_failure"
+        }
+      };
+    }
     this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
       tier,
       reason,
       decided_by: response.decided_by
     });
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "resolved",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          resolution: {
+            decision: response.decision,
+            decided_at: response.decided_at,
+            decided_by: response.decided_by
+          },
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
     return {
       allowed: response.decision === "approve",
       tier,
-      reason: response.decision === "approve" ? `Approved by ${response.decided_by}` : `Tier ${tier} operation requires approval`,
+      reason: response.decision === "approve" ? `Approved by ${response.decided_by}` : AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
       approval_required: true,
       approval_response: response
     };
@@ -18826,6 +19269,352 @@ var ApprovalGate = class {
   }
 };
 
+// src/principal-policy/approval-aggregator.ts
+init_encryption();
+init_encoding();
+var APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+var APPROVAL_AGGREGATOR_AUDIT_OPS = {
+  AGGREGATED: "cross_harness_approval_aggregated",
+  RESOLVED: "cross_harness_approval_resolved",
+  DEDUPED: "cross_harness_approval_deduped"
+};
+var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_LIST_LIMIT = 200;
+var DEFAULT_LIST_PAGE_SIZE = 50;
+var ApprovalAggregator = class {
+  storage;
+  encryptionKey;
+  auditLog;
+  identityId;
+  fortressId;
+  pendingTtlMs;
+  maxListLimit;
+  now;
+  resolveSourceContext;
+  resolveHubInboxItemId;
+  /** Cached entries by `aggregator_id`. */
+  entries = /* @__PURE__ */ new Map();
+  /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+  dedupIndex = /* @__PURE__ */ new Map();
+  /** Correlation index: gate `correlation_id` -> aggregator_id. */
+  correlationIndex = /* @__PURE__ */ new Map();
+  /** Original request payloads kept in-memory for `getFullPayload()`. */
+  fullPayloads = /* @__PURE__ */ new Map();
+  /** Has the aggregator hydrated persisted entries on this process? */
+  hydrated = false;
+  /** Active SSE listeners. */
+  listeners = /* @__PURE__ */ new Set();
+  constructor(deps) {
+    this.storage = deps.storage;
+    this.encryptionKey = derivePurposeKey(
+      deps.masterKey,
+      APPROVAL_AGGREGATOR_HKDF_INFO
+    );
+    this.auditLog = deps.auditLog;
+    this.identityId = deps.identityId;
+    this.fortressId = deps.fortressId;
+    this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+      source_harness: this.fortressId,
+      source_agent_id: this.fortressId
+    }));
+    this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+  }
+  /**
+   * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+   * use this to forward aggregator emissions to the dashboard.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Ingest a gate event. Returns the aggregator entry on first sight,
+   * `null` when deduped. Resolution events update the existing record;
+   * unmatched resolutions are dropped silently (caller's gate emitted a
+   * resolved-without-requested pair, which the aggregator does not invent
+   * a record for).
+   */
+  async ingest(event) {
+    await this.hydrate();
+    if (event.phase === "requested") {
+      return this.ingestRequested(event);
+    }
+    if (event.phase === "resolved") {
+      return this.ingestResolved(event);
+    }
+    return null;
+  }
+  /**
+   * List pending or recently resolved entries. Pending entries past TTL
+   * are lazily transitioned to `expired` and persisted before the list
+   * snapshot is returned.
+   */
+  async list(opts) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (opts?.status && entry.status !== opts.status) continue;
+      if (Date.parse(entry.created_at) < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return matching.slice(0, limit);
+  }
+  /**
+   * Return the original (unhashed) request payload for the entry. Returns
+   * `null` when the entry is unknown or the payload was evicted (e.g. the
+   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   */
+  async getFullPayload(aggregatorId) {
+    await this.hydrate();
+    if (!this.entries.has(aggregatorId)) return null;
+    return this.fullPayloads.get(aggregatorId) ?? null;
+  }
+  /**
+   * Resolve an entry. Used by both:
+   *   1. The gate wire-up on channel-decision return.
+   *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+   *
+   * Idempotent: resolving an already-resolved entry is a no-op (the record
+   * keeps its first decision and the audit log is not double-fired).
+   * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+   * routes return 404.
+   */
+  async resolve(aggregatorId, decision, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      throw new Error("approval-aggregator: not_found");
+    }
+    if (entry.status !== "pending") {
+      return entry;
+    }
+    entry.status = decision;
+    entry.resolved_at = this.now().toISOString();
+    entry.resolved_by = operatorId;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: entry.aggregator_id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision,
+        decided_by: operatorId,
+        decided_at: entry.resolved_at
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: ingest paths ─────────────────────────────────────────────
+  async ingestRequested(event) {
+    const ctx = this.resolveSourceContext(event);
+    const auditId = this.auditEntryIdForEvent(event);
+    const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+    const existing = this.dedupIndex.get(dedupKey);
+    if (existing) {
+      const existingEntry = this.entries.get(existing);
+      if (existingEntry) {
+        this.correlationIndex.set(event.correlation_id, existing);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+          this.identityId,
+          {
+            aggregator_id: existing,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: this.derivePolicyRuleId(event),
+            correlation_id: event.correlation_id
+          }
+        );
+        this.emit({ type: "deduped", entry: { ...existingEntry } });
+        return null;
+      }
+    }
+    const id = randomUUID();
+    const now = this.now();
+    const expires = new Date(now.getTime() + this.pendingTtlMs);
+    const hubInboxId = this.resolveHubInboxItemId(event);
+    const entry = {
+      aggregator_id: id,
+      source_harness: ctx.source_harness,
+      source_agent_id: ctx.source_agent_id,
+      audit_log_entry_id: auditId,
+      policy_rule_id: this.derivePolicyRuleId(event),
+      action_summary: this.deriveActionSummary(event),
+      request_payload_hash: this.hashPayload(event.context),
+      status: "pending",
+      created_at: now.toISOString(),
+      expires_at: expires.toISOString(),
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+    };
+    this.entries.set(id, entry);
+    this.dedupIndex.set(dedupKey, id);
+    this.correlationIndex.set(event.correlation_id, id);
+    this.fullPayloads.set(id, event.context);
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: ctx.source_harness,
+        source_agent_id: ctx.source_agent_id,
+        audit_log_entry_id: auditId,
+        policy_rule_id: entry.policy_rule_id,
+        ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      }
+    );
+    this.emit({ type: "aggregated", entry: { ...entry } });
+    return entry;
+  }
+  async ingestResolved(event) {
+    const id = this.correlationIndex.get(event.correlation_id);
+    if (!id) return null;
+    const entry = this.entries.get(id);
+    if (!entry) return null;
+    if (entry.status !== "pending") return entry;
+    if (!event.resolution) return entry;
+    const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+    const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+    entry.status = status;
+    entry.resolved_at = event.resolution.decided_at;
+    entry.resolved_by = event.resolution.decided_by;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision: status,
+        decided_by: entry.resolved_by,
+        decided_at: entry.resolved_at,
+        fail_closed: failClosed
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: helpers ──────────────────────────────────────────────────
+  /**
+   * Audit-log entry id for the dedup tuple. The audit log itself does not
+   * surface a stable per-entry id (counter-prefixed keys are internal); the
+   * aggregator uses the request timestamp + operation, which together pin
+   * the audit entry the gate appended on the same call.
+   */
+  auditEntryIdForEvent(event) {
+    return `${event.request_timestamp}:${event.operation}`;
+  }
+  derivePolicyRuleId(event) {
+    return `tier${event.tier}:${event.operation}`;
+  }
+  deriveActionSummary(event) {
+    return `${event.operation} (tier ${event.tier})`;
+  }
+  /**
+   * Canonical SHA-256 of the request context. Sorted-keys serialization so
+   * identical payloads always hash the same, even when key insertion order
+   * varies. Defends against payload-replay smuggling (the aggregator can
+   * tell the same payload was seen twice without storing it cleartext).
+   */
+  hashPayload(payload) {
+    const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+    return createHash("sha256").update(canonical).digest("hex");
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  async expireStale() {
+    const nowMs = this.now().getTime();
+    for (const entry of this.entries.values()) {
+      if (entry.status !== "pending") continue;
+      if (Date.parse(entry.expires_at) > nowMs) continue;
+      entry.status = "expired";
+      entry.resolved_at = this.now().toISOString();
+      entry.resolved_by = "system_ttl";
+      await this.persist(entry);
+      this.auditLog.append(
+        "l2",
+        APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+        this.identityId,
+        {
+          aggregator_id: entry.aggregator_id,
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          audit_log_entry_id: entry.audit_log_entry_id,
+          policy_rule_id: entry.policy_rule_id,
+          decision: "expired",
+          decided_by: "system_ttl",
+          decided_at: entry.resolved_at
+        }
+      );
+      this.emit({ type: "resolved", entry: { ...entry } });
+    }
+  }
+  async persist(entry) {
+    const serialized = stringToBytes(JSON.stringify(entry));
+    const encrypted = encrypt(serialized, this.encryptionKey);
+    await this.storage.write(
+      APPROVAL_AGGREGATOR_NAMESPACE,
+      entry.aggregator_id,
+      stringToBytes(JSON.stringify(encrypted))
+    );
+  }
+  async hydrate() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    try {
+      const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+      for (const meta of metas) {
+        const raw = await this.storage.read(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          meta.key
+        );
+        if (!raw) continue;
+        try {
+          const encrypted = JSON.parse(bytesToString(raw));
+          const decrypted = decrypt(encrypted, this.encryptionKey);
+          const entry = JSON.parse(bytesToString(decrypted));
+          this.entries.set(entry.aggregator_id, entry);
+          const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+          this.dedupIndex.set(dedupKey, entry.aggregator_id);
+        } catch {
+        }
+      }
+    } catch {
+      this.hydrated = false;
+    }
+  }
+};
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -19366,7 +20155,11 @@ init_identity();
 init_encoding();
 init_random();
 function generateNonce() {
-  return toBase64url(randomBytes(32));
+  const nonce = randomBytes(32);
+  if (!nonce || nonce.length !== 32) {
+    throw new Error("Nonce generation failed: randomBytes returned unexpected length");
+  }
+  return toBase64url(nonce);
 }
 function initiateHandshake(ourSHR) {
   const nonce = generateNonce();
@@ -19477,6 +20270,18 @@ function completeHandshake(response, session, identityManager, masterKey, identi
   return { completion, result };
 }
 function verifyCompletion(completion, session) {
+  if (completion.protocol_version !== "1.0") {
+    return {
+      counterparty_id: "unknown",
+      counterparty_shr: session.our_shr,
+      verified: false,
+      sovereignty_level: "unverified",
+      trust_tier: "unverified",
+      completed_at: completion.completed_at,
+      expires_at: (/* @__PURE__ */ new Date()).toISOString(),
+      errors: [`Unsupported protocol version: ${completion.protocol_version}`]
+    };
+  }
   const errors = [];
   if (!session.their_shr) {
     return {
@@ -21578,6 +22383,9 @@ Inspect the file and either correct the JSON or delete it manually before re-run
     this.cause = cause;
     this.name = "ResetHistoryMalformedError";
   }
+  markerPath;
+  lineNumber;
+  cause;
 };
 function parseResetHistory(content, markerPath) {
   const markerHash = hashToString(stringToBytes(content));
@@ -21659,6 +22467,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await rm(markerPath, { force: true });
+    await rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -21683,7 +22497,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await writeFile(consumedPath, "", "utf-8");
   await rm(markerPath, { force: true });
+  await rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -23819,7 +24635,7 @@ async function runOpenAIPrivacyFilter(text, config) {
   return parsed;
 }
 function runCommand(command, input, timeoutMs) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve6, reject) => {
     const child = spawn(command, [], {
       stdio: ["pipe", "pipe", "pipe"],
       shell: false
@@ -23850,7 +24666,7 @@ function runCommand(command, input, timeoutMs) {
         ));
         return;
       }
-      resolve4(stdout);
+      resolve6(stdout);
     });
     child.stdin.end(input);
   });
@@ -25671,13 +26487,13 @@ var ProxyRouter = class {
    * Call an upstream tool with a timeout.
    */
   async callWithTimeout(serverName, toolName, args, timeoutMs) {
-    return new Promise((resolve4, reject) => {
+    return new Promise((resolve6, reject) => {
       const timer = setTimeout(() => {
         reject(new Error(`Upstream tool call timed out after ${timeoutMs}ms`));
       }, timeoutMs);
       this.clientManager.callTool(serverName, toolName, args).then((result) => {
         clearTimeout(timer);
-        resolve4(result);
+        resolve6(result);
       }).catch((err) => {
         clearTimeout(timer);
         reject(err);
@@ -30629,6 +31445,36 @@ var HubService = class {
     const chat = this.requireOperatorChat();
     return chat.getConciergeHistory();
   }
+  // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+  /**
+   * Whether the operator-chat service has the WP-V1.3-9 memory store
+   * wired. Routes use this to 503 cleanly when the foundation memory
+   * surface is unavailable on a given fortress.
+   */
+  hasConciergeMemory() {
+    return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+  }
+  async listConciergeMemoryThreads(opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.listConciergeMemoryThreads(opts);
+  }
+  async readConciergeMemoryThread(threadId, opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.readConciergeMemoryThread(threadId, opts);
+  }
+  async deleteConciergeMemoryThread(threadId) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.deleteConciergeMemoryThread(threadId);
+  }
   /**
    * Open the click-to-inspect/approve panel for a wrapped agent. The
    * panel surfaces recent activity routed through this agent, pending
@@ -30716,7 +31562,21 @@ init_encoding();
 
 // src/chat/operator-chat-audit-events.ts
 var OPERATOR_CHAT_OPS = {
-  CONCIERGE_CHAT: "operator_concierge_chat"};
+  CONCIERGE_CHAT: "operator_concierge_chat",
+  /**
+   * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+   * when the operator hits the list-threads or read-thread route. Body
+   * carries the thread_id (or `*` for the list endpoint) and a count;
+   * raw turn content never crosses the audit surface.
+   */
+  CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+  /**
+   * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+   * successful thread removal. Body carries thread_id + turn_count of
+   * the deleted bundle.
+   */
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
+};
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
@@ -30724,6 +31584,33 @@ var CONCIERGE_THREAD_KEY = "_fortress";
 
 // src/chat/operator-chat-service.ts
 var DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+var SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
+1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
+2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
+3. Charter (Cooperative MCP): the sovereignty surface for compliant agents. Policy gates, approval tiers, audit logging, and encrypted state all live here.
+4. Heralds: Concordia receipts and Verascore reputation. Cross-fortress accountability after an action completes.
+
+Five channel templates (canonical names):
+- request-approve-act: agent proposes an action, operator approves or denies before execution.
+- read-then-report: agent reads outputs from a data source and reports summaries to the operator.
+- scheduled-digest: agent runs on a schedule and delivers a periodic digest.
+- plan-draft-only: agent drafts plans; operator reviews before any execution step.
+- fortress-relay: agent relays messages between fortresses under operator-scoped policy.
+
+Four canonical policy slots:
+- memory: governs what the agent may persist and retrieve from encrypted state.
+- credentials: governs access to secrets, API keys, and tokens held in the broker.
+- plans: governs the agent's ability to create, modify, or execute plans.
+- outputs: governs what the agent may emit to external surfaces (files, APIs, messages).
+
+Key concepts:
+- Fortress: the operator-owned sovereignty harness. All state is encrypted at rest under the cocoon.
+- Cocoon: master-key-wrapped storage derived from the operator's passphrase via Argon2id.
+- Identity: Ed25519 keypair with a DID, owned by the operator. Private keys never leave the cocoon.
+- Audit log: append-only encrypted blobs, sequential, recording every gate decision and tool call.
+- Wrapped agent: any agent runtime that connects to Sanctuary as an MCP client. Tier A (native), Tier B (adapter-wrapped), Tier C (escape hatch).
+
+Note: this is a static reference block (v1.2.x). Dynamic context injection (live template list, policy schema) ships in v1.3.`;
 var OperatorChatService = class {
   store;
   auditLog;
@@ -30732,6 +31619,14 @@ var OperatorChatService = class {
   contextProviders;
   piiFilter;
   conciergeMaxTokens;
+  memory;
+  /**
+   * In-memory thread_id assigned to the active concierge session.
+   * The first sendConcierge call after construction allocates a fresh
+   * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+   * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+   */
+  activeMemoryThreadId;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -30742,6 +31637,7 @@ var OperatorChatService = class {
     }
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+    if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -30772,6 +31668,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+      });
+    }
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -30827,6 +31728,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
+      });
+    }
     const payload = {
       version: "1.2",
       event_id: makeEventId("conc"),
@@ -30859,6 +31765,105 @@ var OperatorChatService = class {
     );
     return thread ? thread.messages : [];
   }
+  // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+  /**
+   * Whether the foundation memory store is wired. Routes use this to
+   * 503 cleanly when called against an unwired service.
+   */
+  hasConciergeMemory() {
+    return this.memory !== void 0;
+  }
+  /**
+   * List concierge memory threads, newest-first. Emits the
+   * `operator_concierge_history_read` audit event with `thread_id="*"`.
+   */
+  async listConciergeMemoryThreads(opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const summaries = await this.memory.listThreads(opts);
+    const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: "*",
+      turn_count: totalTurns
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return summaries;
+  }
+  /**
+   * Read a concierge memory thread, oldest turn first. Emits the
+   * `operator_concierge_history_read` audit event with the named
+   * thread_id and the count of turns surfaced.
+   */
+  async readConciergeMemoryThread(threadId, opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turns = await this.memory.readThread(threadId, opts);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turns.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return turns;
+  }
+  /**
+   * Delete a concierge memory thread. Emits
+   * `operator_concierge_thread_deleted` only when a bundle was actually
+   * removed; absent threads return false without an audit event.
+   */
+  async deleteConciergeMemoryThread(threadId) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turnsBefore = await this.memory.readThread(threadId);
+    if (turnsBefore.length === 0) {
+      return await this.memory.deleteThread(threadId);
+    }
+    const removed = await this.memory.deleteThread(threadId);
+    if (!removed) return false;
+    if (this.activeMemoryThreadId === threadId) {
+      this.activeMemoryThreadId = void 0;
+    }
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-del"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_thread_deleted",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turnsBefore.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+    return true;
+  }
+  /**
+   * Reset the active session memory thread. Subsequent sendConcierge
+   * calls allocate a fresh thread_id. Surfaced for tests + future "new
+   * conversation" affordance; not currently called by the dashboard.
+   */
+  resetConciergeMemoryThread() {
+    this.activeMemoryThreadId = void 0;
+  }
+  ensureActiveMemoryThread() {
+    if (!this.activeMemoryThreadId) {
+      this.activeMemoryThreadId = randomUUID();
+    }
+    return this.activeMemoryThreadId;
+  }
   /**
    * Stitch fortress state into a single context blob the substrate
    * folds into its summarization prompt.
@@ -30868,6 +31873,9 @@ var OperatorChatService = class {
    * than nested structures. Format:
    *
    *   ```
+   *   ## Sanctuary reference
+   *   <static domain reference block>
+   *
    *   ## Recent activity
    *   <recentActivity output>
    *
@@ -30879,15 +31887,28 @@ var OperatorChatService = class {
    *   ```
    */
   async assembleConciergeContext() {
+    const ref = `## Sanctuary reference
+${SANCTUARY_DOMAIN_REFERENCE}`;
     if (!this.contextProviders) {
-      return "## Recent activity\n(no providers wired)\n\n## Wrapped agents\n(no providers wired)\n\n## Open inbox\n(no providers wired)";
+      return `${ref}
+
+## Recent activity
+(no providers wired)
+
+## Wrapped agents
+(no providers wired)
+
+## Open inbox
+(no providers wired)`;
     }
     const [activity, agents, inbox] = await Promise.all([
       this.contextProviders.recentActivity(),
       this.contextProviders.agentInventory(),
       this.contextProviders.openInbox()
     ]);
-    return `## Recent activity
+    return `${ref}
+
+## Recent activity
 ${activity}
 
 ## Wrapped agents
@@ -31006,6 +32027,238 @@ var OperatorChatStore = class {
   }
 };
 
+// src/chat/concierge-memory-store.ts
+init_encryption();
+init_encoding();
+var CONCIERGE_MEMORY_NAMESPACE = "_chat";
+var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+var HKDF_INFO2 = "concierge-memory-store-v1";
+var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var ConciergeMemoryStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  locks;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+    this.locks = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Append a turn to the named thread, creating the bundle if no record
+   * exists. Returns the persisted turn (with assigned turn_id +
+   * retention_until). Per-thread serialisation guarantees turn_id
+   * monotonicity even under concurrent callers.
+   */
+  async appendTurn(threadId, role, content) {
+    return this.withLock(threadId, async () => {
+      const bundle = await this.loadBundle(threadId) ?? null;
+      const now = /* @__PURE__ */ new Date();
+      const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+      const retentionUntil = new Date(now.getTime() + retentionMs);
+      const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+      const turn = {
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        turn_id: nextTurnId,
+        role,
+        content,
+        created_at: now.toISOString(),
+        retention_until: retentionUntil.toISOString()
+      };
+      const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+        version: 1,
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        created_at: now.toISOString(),
+        turns: [turn]
+      };
+      await this.saveBundle(next);
+      return turn;
+    });
+  }
+  /**
+   * Read turns from a thread, oldest-first. Returns an empty array if
+   * the thread does not exist or its bundle is corrupt. Does not emit
+   * audit events; the caller (HTTP route handler) owns audit semantics.
+   */
+  async readThread(threadId, opts) {
+    const bundle = await this.loadBundle(threadId);
+    if (!bundle) return [];
+    let turns = bundle.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return turns;
+  }
+  /**
+   * Enumerate concierge threads in this fortress with summary metadata.
+   * Sorted newest-first by last_turn_at.
+   */
+  async listThreads(opts) {
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    const summaries = [];
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      const bundle = await this.loadBundle(threadId);
+      if (!bundle || bundle.turns.length === 0) continue;
+      const last = bundle.turns[bundle.turns.length - 1];
+      summaries.push({
+        thread_id: bundle.thread_id,
+        created_at: bundle.created_at,
+        last_turn_at: last ? last.created_at : bundle.created_at,
+        turn_count: bundle.turns.length
+      });
+    }
+    summaries.sort(
+      (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+    );
+    if (opts?.limit !== void 0) {
+      return summaries.slice(0, opts.limit);
+    }
+    return summaries;
+  }
+  /**
+   * Delete a thread's bundle. Returns true if the bundle existed and
+   * was removed; false if no bundle was present. Audit emission is the
+   * caller's responsibility.
+   */
+  async deleteThread(threadId) {
+    const key = bundleKey(threadId);
+    return this.withLock(threadId, async () => {
+      const existed = await this.storage.exists(
+        CONCIERGE_MEMORY_NAMESPACE,
+        key
+      );
+      if (!existed) return false;
+      try {
+        await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+      } catch {
+        return false;
+      }
+      return true;
+    });
+  }
+  /**
+   * Drop expired turns across all threads. Threads emptied by pruning
+   * are removed entirely. Returns the count of turns pruned.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      pruned += await this.withLock(threadId, async () => {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return 0;
+        const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+        const dropped = bundle.turns.length - kept.length;
+        if (dropped === 0) return 0;
+        if (kept.length === 0) {
+          await this.storage.delete(
+            CONCIERGE_MEMORY_NAMESPACE,
+            bundleKey(threadId)
+          );
+        } else {
+          await this.saveBundle({ ...bundle, turns: kept });
+        }
+        return dropped;
+      });
+    }
+    return { pruned };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  async loadBundle(threadId) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(threadId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.thread_id !== threadId) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async saveBundle(bundle) {
+    const key = bundleKey(bundle.thread_id);
+    const aad = stringToBytes(bundle.thread_id);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      CONCIERGE_MEMORY_NAMESPACE,
+      key,
+      stringToBytes(JSON.stringify(envelope))
+    );
+  }
+  /**
+   * Run `task` while holding the per-thread async lock. Lock is released
+   * once the task settles (success or failure). Generic helper so
+   * appendTurn / deleteThread / pruneExpired share serialisation.
+   */
+  async withLock(threadId, task) {
+    const previous = this.locks.get(threadId) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve6) => {
+      release = resolve6;
+    });
+    const chained = previous.then(() => next);
+    this.locks.set(threadId, chained);
+    try {
+      await previous;
+      return await task();
+    } finally {
+      release();
+      if (this.locks.get(threadId) === chained) {
+        this.locks.delete(threadId);
+      }
+    }
+  }
+};
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+
 // src/dashboard/v1_1/wiring.ts
 var CapabilityErrorAgentController = class {
   fail(action) {
@@ -31044,6 +32297,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -31054,7 +32315,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -31246,13 +32508,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO2 = "intelligence-substrate-config";
+var HKDF_INFO3 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -33391,7 +34653,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -33400,6 +34664,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -33419,7 +34693,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 
@@ -33992,6 +35266,9 @@ async function importExitBundle(opts) {
     reputationArtifact?.json ?? null,
     manifest
   );
+  if (!conflicts.public_identity_exists && identityArtifact?.json && opts.identityManager.getPrimaryIdentityId() !== null && opts.identityManager.getPrimaryIdentityId() !== identityArtifact.json.bundle.identity_id) {
+    conflicts.public_identity_exists = true;
+  }
   if (!opts.activate) {
     return {
       verified: true,
@@ -34018,7 +35295,7 @@ async function importExitBundle(opts) {
   if (conflicts.public_identity_exists && !opts.forceRebind) {
     throw new ExitBundleImportError(
       "IDENTITY_OVERWRITE_REFUSED",
-      "Importing this bundle would overwrite an existing fortress public identity. Pass forceRebind: true (CLI: --force-rebind) to confirm explicit replacement."
+      "Importing this exit bundle would overwrite an existing fortress public identity (either the same identity already imported, or a different identity is currently active). Pass forceRebind: true (CLI: --force-rebind) to confirm explicit replacement."
     );
   }
   if (conflicts.public_identity_exists && opts.forceRebind && identityArtifact) {
@@ -34343,7 +35620,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -34376,6 +35665,26 @@ async function runExitCommand(args) {
         write(err, "Usage: sanctuary exit import <dir> [--activate]\n");
         return 2;
       }
+      const bundleRoot = resolve(dir);
+      try {
+        await access(bundleRoot);
+      } catch {
+        write(err, `Error: bundle directory not found: ${bundleRoot}
+`);
+        return 1;
+      }
+      const manifestPath = join(bundleRoot, "manifest.json");
+      try {
+        const raw = await readFile(manifestPath, "utf8");
+        JSON.parse(raw);
+      } catch {
+        write(
+          err,
+          `Error: bundle manifest missing or malformed at ${manifestPath}
+`
+        );
+        return 1;
+      }
       const activate = hasFlag(argv, "--activate");
       const forceRebind = hasFlag(argv, "--force-rebind");
       const acceptUnverifiableAttestations = hasFlag(
@@ -34516,11 +35825,11 @@ async function startDashboardServer(options) {
       }
     }
   });
-  await new Promise((resolve4, reject) => {
+  await new Promise((resolve6, reject) => {
     server.once("error", reject);
     server.listen(port, host, () => {
       server.off("error", reject);
-      resolve4();
+      resolve6();
     });
   });
   const actualPort = (() => {
@@ -34533,8 +35842,8 @@ async function startDashboardServer(options) {
     url,
     port: actualPort,
     host,
-    stop: () => new Promise((resolve4, reject) => {
-      server.close((err) => err ? reject(err) : resolve4());
+    stop: () => new Promise((resolve6, reject) => {
+      server.close((err) => err ? reject(err) : resolve6());
     }),
     publish,
     publishActivity: (entry) => publish({ type: "activity", data: entry }),
@@ -34975,7 +36284,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -35073,6 +36394,21 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
     });
   } : void 0;
   const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -35192,7 +36528,7 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
       clientManager.configure(enabledServers).catch((err) => {
         console.error(`[Sanctuary] Failed to configure upstream servers: ${err instanceof Error ? err.message : "unknown error"}`);
       });
-      await new Promise((resolve4) => setTimeout(resolve4, 2e3));
+      await new Promise((resolve6) => setTimeout(resolve6, 2e3));
       const proxiedTools = proxyRouter.getProxiedTools();
       if (proxiedTools.length > 0) {
         allTools.push(...proxiedTools);
@@ -35248,6 +36584,6 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   };
 }
 
-export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
+export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MalformedPrincipalPolicyError, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map