@sanctuary-framework/mcp-server 1.2.3 → 1.2.4

package/dist/index.cjs

@@ -4589,20 +4589,52 @@ approval_channel:
   timeout_seconds: 300
 `;
 }
+var MalformedPrincipalPolicyError = class extends Error {
+  constructor(policyPath, reason) {
+    super(
+      `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+    );
+    this.policyPath = policyPath;
+    this.reason = reason;
+    this.name = "MalformedPrincipalPolicyError";
+  }
+  policyPath;
+  reason;
+};
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = path.join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await promises.readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await promises.writeFile(policyPath, defaultYaml, "utf-8");
+        await promises.chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await promises.readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await promises.writeFile(policyPath, defaultYaml, "utf-8");
-      await promises.chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
 
@@ -4829,7 +4861,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 
 // src/shr/generator.ts
@@ -11651,6 +11683,16 @@ var HUB_ROUTES = {
    */
   CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
   CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+  /**
+   * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+   * scrollback, and operator-initiated thread delete. Distinct from the
+   * v1.2 `/history` route, which surfaces the active in-session thread
+   * shape; the new routes target persisted multi-thread memory used by
+   * v1.3 conversational sovereignty depth.
+   */
+  CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+  CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+  CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
   /**
    * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
    * recent activity feed, pending Tier 1 approvals routed through this
@@ -11674,6 +11716,10 @@ var HUB_TIER_1_AGENT_CONTROL_ACTIONS = [
 ];
 var HUB_ACTIVITY_DEFAULT_LIMIT = 50;
 var HUB_ACTIVITY_MAX_LIMIT = 500;
+var HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+var HUB_CHAT_THREADS_MAX_LIMIT = 500;
+var HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+var HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
 var HUB_INBOX_DEFAULT_LIMIT = 100;
 var HUB_INBOX_MAX_LIMIT = 500;
 var HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -11845,6 +11891,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -12028,6 +12091,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -16077,6 +16181,162 @@ async function dispatchV11Request(inputs, req, res, url, method) {
   return false;
 }
 
+// src/principal-policy/approval-aggregator-routes.ts
+var APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+var APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+var APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+var APPROVAL_INBOX_MAX_LIMIT = 200;
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16141,6 +16401,14 @@ var DashboardApprovalChannel = class {
    * regardless. Default route flip is deferred to v1.2.
    */
   v11Bindings = null;
+  /**
+   * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+   * additively at `/api/approval-inbox/*` when set. Legacy approval
+   * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+   * aggregator is a passive subscriber to the gate; the routes here are
+   * the operator-facing query / decision surface.
+   */
+  approvalAggregator = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16191,6 +16459,34 @@ var DashboardApprovalChannel = class {
   setV11Bindings(bindings) {
     this.v11Bindings = bindings;
   }
+  /**
+   * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+   * aggregator. Once set, requests to `/api/approval-inbox/*` route
+   * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+   * tests + during shutdown).
+   */
+  setApprovalAggregator(aggregator) {
+    this.approvalAggregator = aggregator;
+  }
+  /**
+   * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+   * before the legacy approval route table. Returns true when served.
+   */
+  async dispatchApprovalInbox(req, res) {
+    if (!this.approvalAggregator) return false;
+    return handleApprovalInboxRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        aggregator: this.approvalAggregator,
+        operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16566,6 +16862,18 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+      this.dispatchApprovalInbox(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -18584,14 +18892,25 @@ var ApprovalGate = class {
   auditLog;
   injectionDetector;
   onInjectionAlert;
+  onApprovalEvent;
   proxyTierResolver;
-  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
     this.policy = policy;
     this.baseline = baseline;
     this.channel = channel;
     this.auditLog = auditLog;
     this.injectionDetector = injectionDetector ?? new InjectionDetector();
     this.onInjectionAlert = onInjectionAlert;
+    this.onApprovalEvent = onApprovalEvent;
+  }
+  /**
+   * Set the approval-event callback after construction. Used by the
+   * Upsilon-1 wire-up when the aggregator is constructed alongside the
+   * gate. The aggregator subscribes through this setter rather than the
+   * constructor so existing call sites continue to work unchanged.
+   */
+  setApprovalEventCallback(cb) {
+    this.onApprovalEvent = cb;
   }
   /**
    * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -18825,21 +19144,105 @@ var ApprovalGate = class {
   }
   /**
    * Request approval from the human principal.
+   *
+   * Fail-closed contract (full-sweep #49): if the channel throws (network
+   * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+   * failure, etc.), the gate denies the operation and audit-logs the cause.
+   * Channel-internal timeouts already resolve with decision: "deny" per
+   * SEC-002; this catch covers the remaining "channel raised" path so an
+   * unhandled rejection cannot turn into an indeterminate state at the gate.
    */
   async requestApproval(operation, tier, reason, context) {
+    const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
     const request = {
       operation,
       tier,
       reason,
       context,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: requestTimestamp
     };
-    const response = await this.channel.requestApproval(request);
+    const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "requested",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
+    let response;
+    try {
+      response = await this.channel.requestApproval(request);
+    } catch (err) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+      const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+        tier,
+        reason,
+        decided_by: "channel_failure",
+        channel_error: errMessage
+      });
+      if (this.onApprovalEvent) {
+        try {
+          this.onApprovalEvent({
+            phase: "resolved",
+            operation,
+            tier,
+            reason,
+            context,
+            request_timestamp: requestTimestamp,
+            resolution: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            },
+            correlation_id: correlationId
+          });
+        } catch {
+        }
+      }
+      return {
+        allowed: false,
+        tier,
+        reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+        approval_required: true,
+        approval_response: {
+          decision: "deny",
+          decided_at: decidedAt,
+          decided_by: "channel_failure"
+        }
+      };
+    }
     this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
       tier,
       reason,
       decided_by: response.decided_by
     });
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "resolved",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          resolution: {
+            decision: response.decision,
+            decided_at: response.decided_at,
+            decided_by: response.decided_by
+          },
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
     return {
       allowed: response.decision === "approve",
       tier,
@@ -18873,6 +19276,352 @@ var ApprovalGate = class {
   }
 };
 
+// src/principal-policy/approval-aggregator.ts
+init_encryption();
+init_encoding();
+var APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+var APPROVAL_AGGREGATOR_AUDIT_OPS = {
+  AGGREGATED: "cross_harness_approval_aggregated",
+  RESOLVED: "cross_harness_approval_resolved",
+  DEDUPED: "cross_harness_approval_deduped"
+};
+var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_LIST_LIMIT = 200;
+var DEFAULT_LIST_PAGE_SIZE = 50;
+var ApprovalAggregator = class {
+  storage;
+  encryptionKey;
+  auditLog;
+  identityId;
+  fortressId;
+  pendingTtlMs;
+  maxListLimit;
+  now;
+  resolveSourceContext;
+  resolveHubInboxItemId;
+  /** Cached entries by `aggregator_id`. */
+  entries = /* @__PURE__ */ new Map();
+  /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+  dedupIndex = /* @__PURE__ */ new Map();
+  /** Correlation index: gate `correlation_id` -> aggregator_id. */
+  correlationIndex = /* @__PURE__ */ new Map();
+  /** Original request payloads kept in-memory for `getFullPayload()`. */
+  fullPayloads = /* @__PURE__ */ new Map();
+  /** Has the aggregator hydrated persisted entries on this process? */
+  hydrated = false;
+  /** Active SSE listeners. */
+  listeners = /* @__PURE__ */ new Set();
+  constructor(deps) {
+    this.storage = deps.storage;
+    this.encryptionKey = derivePurposeKey(
+      deps.masterKey,
+      APPROVAL_AGGREGATOR_HKDF_INFO
+    );
+    this.auditLog = deps.auditLog;
+    this.identityId = deps.identityId;
+    this.fortressId = deps.fortressId;
+    this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+      source_harness: this.fortressId,
+      source_agent_id: this.fortressId
+    }));
+    this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+  }
+  /**
+   * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+   * use this to forward aggregator emissions to the dashboard.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Ingest a gate event. Returns the aggregator entry on first sight,
+   * `null` when deduped. Resolution events update the existing record;
+   * unmatched resolutions are dropped silently (caller's gate emitted a
+   * resolved-without-requested pair, which the aggregator does not invent
+   * a record for).
+   */
+  async ingest(event) {
+    await this.hydrate();
+    if (event.phase === "requested") {
+      return this.ingestRequested(event);
+    }
+    if (event.phase === "resolved") {
+      return this.ingestResolved(event);
+    }
+    return null;
+  }
+  /**
+   * List pending or recently resolved entries. Pending entries past TTL
+   * are lazily transitioned to `expired` and persisted before the list
+   * snapshot is returned.
+   */
+  async list(opts) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (opts?.status && entry.status !== opts.status) continue;
+      if (Date.parse(entry.created_at) < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return matching.slice(0, limit);
+  }
+  /**
+   * Return the original (unhashed) request payload for the entry. Returns
+   * `null` when the entry is unknown or the payload was evicted (e.g. the
+   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   */
+  async getFullPayload(aggregatorId) {
+    await this.hydrate();
+    if (!this.entries.has(aggregatorId)) return null;
+    return this.fullPayloads.get(aggregatorId) ?? null;
+  }
+  /**
+   * Resolve an entry. Used by both:
+   *   1. The gate wire-up on channel-decision return.
+   *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+   *
+   * Idempotent: resolving an already-resolved entry is a no-op (the record
+   * keeps its first decision and the audit log is not double-fired).
+   * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+   * routes return 404.
+   */
+  async resolve(aggregatorId, decision, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      throw new Error("approval-aggregator: not_found");
+    }
+    if (entry.status !== "pending") {
+      return entry;
+    }
+    entry.status = decision;
+    entry.resolved_at = this.now().toISOString();
+    entry.resolved_by = operatorId;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: entry.aggregator_id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision,
+        decided_by: operatorId,
+        decided_at: entry.resolved_at
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: ingest paths ─────────────────────────────────────────────
+  async ingestRequested(event) {
+    const ctx = this.resolveSourceContext(event);
+    const auditId = this.auditEntryIdForEvent(event);
+    const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+    const existing = this.dedupIndex.get(dedupKey);
+    if (existing) {
+      const existingEntry = this.entries.get(existing);
+      if (existingEntry) {
+        this.correlationIndex.set(event.correlation_id, existing);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+          this.identityId,
+          {
+            aggregator_id: existing,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: this.derivePolicyRuleId(event),
+            correlation_id: event.correlation_id
+          }
+        );
+        this.emit({ type: "deduped", entry: { ...existingEntry } });
+        return null;
+      }
+    }
+    const id = crypto.randomUUID();
+    const now = this.now();
+    const expires = new Date(now.getTime() + this.pendingTtlMs);
+    const hubInboxId = this.resolveHubInboxItemId(event);
+    const entry = {
+      aggregator_id: id,
+      source_harness: ctx.source_harness,
+      source_agent_id: ctx.source_agent_id,
+      audit_log_entry_id: auditId,
+      policy_rule_id: this.derivePolicyRuleId(event),
+      action_summary: this.deriveActionSummary(event),
+      request_payload_hash: this.hashPayload(event.context),
+      status: "pending",
+      created_at: now.toISOString(),
+      expires_at: expires.toISOString(),
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+    };
+    this.entries.set(id, entry);
+    this.dedupIndex.set(dedupKey, id);
+    this.correlationIndex.set(event.correlation_id, id);
+    this.fullPayloads.set(id, event.context);
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: ctx.source_harness,
+        source_agent_id: ctx.source_agent_id,
+        audit_log_entry_id: auditId,
+        policy_rule_id: entry.policy_rule_id,
+        ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      }
+    );
+    this.emit({ type: "aggregated", entry: { ...entry } });
+    return entry;
+  }
+  async ingestResolved(event) {
+    const id = this.correlationIndex.get(event.correlation_id);
+    if (!id) return null;
+    const entry = this.entries.get(id);
+    if (!entry) return null;
+    if (entry.status !== "pending") return entry;
+    if (!event.resolution) return entry;
+    const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+    const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+    entry.status = status;
+    entry.resolved_at = event.resolution.decided_at;
+    entry.resolved_by = event.resolution.decided_by;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision: status,
+        decided_by: entry.resolved_by,
+        decided_at: entry.resolved_at,
+        fail_closed: failClosed
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: helpers ──────────────────────────────────────────────────
+  /**
+   * Audit-log entry id for the dedup tuple. The audit log itself does not
+   * surface a stable per-entry id (counter-prefixed keys are internal); the
+   * aggregator uses the request timestamp + operation, which together pin
+   * the audit entry the gate appended on the same call.
+   */
+  auditEntryIdForEvent(event) {
+    return `${event.request_timestamp}:${event.operation}`;
+  }
+  derivePolicyRuleId(event) {
+    return `tier${event.tier}:${event.operation}`;
+  }
+  deriveActionSummary(event) {
+    return `${event.operation} (tier ${event.tier})`;
+  }
+  /**
+   * Canonical SHA-256 of the request context. Sorted-keys serialization so
+   * identical payloads always hash the same, even when key insertion order
+   * varies. Defends against payload-replay smuggling (the aggregator can
+   * tell the same payload was seen twice without storing it cleartext).
+   */
+  hashPayload(payload) {
+    const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+    return crypto.createHash("sha256").update(canonical).digest("hex");
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  async expireStale() {
+    const nowMs = this.now().getTime();
+    for (const entry of this.entries.values()) {
+      if (entry.status !== "pending") continue;
+      if (Date.parse(entry.expires_at) > nowMs) continue;
+      entry.status = "expired";
+      entry.resolved_at = this.now().toISOString();
+      entry.resolved_by = "system_ttl";
+      await this.persist(entry);
+      this.auditLog.append(
+        "l2",
+        APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+        this.identityId,
+        {
+          aggregator_id: entry.aggregator_id,
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          audit_log_entry_id: entry.audit_log_entry_id,
+          policy_rule_id: entry.policy_rule_id,
+          decision: "expired",
+          decided_by: "system_ttl",
+          decided_at: entry.resolved_at
+        }
+      );
+      this.emit({ type: "resolved", entry: { ...entry } });
+    }
+  }
+  async persist(entry) {
+    const serialized = stringToBytes(JSON.stringify(entry));
+    const encrypted = encrypt(serialized, this.encryptionKey);
+    await this.storage.write(
+      APPROVAL_AGGREGATOR_NAMESPACE,
+      entry.aggregator_id,
+      stringToBytes(JSON.stringify(encrypted))
+    );
+  }
+  async hydrate() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    try {
+      const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+      for (const meta of metas) {
+        const raw = await this.storage.read(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          meta.key
+        );
+        if (!raw) continue;
+        try {
+          const encrypted = JSON.parse(bytesToString(raw));
+          const decrypted = decrypt(encrypted, this.encryptionKey);
+          const entry = JSON.parse(bytesToString(decrypted));
+          this.entries.set(entry.aggregator_id, entry);
+          const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+          this.dedupIndex.set(dedupKey, entry.aggregator_id);
+        } catch {
+        }
+      }
+    } catch {
+      this.hydrated = false;
+    }
+  }
+};
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -21725,6 +22474,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = path.join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await promises.rm(markerPath, { force: true });
+    await promises.rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -21749,7 +22504,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await promises.writeFile(consumedPath, "", "utf-8");
   await promises.rm(markerPath, { force: true });
+  await promises.rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -30695,6 +31452,36 @@ var HubService = class {
     const chat = this.requireOperatorChat();
     return chat.getConciergeHistory();
   }
+  // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+  /**
+   * Whether the operator-chat service has the WP-V1.3-9 memory store
+   * wired. Routes use this to 503 cleanly when the foundation memory
+   * surface is unavailable on a given fortress.
+   */
+  hasConciergeMemory() {
+    return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+  }
+  async listConciergeMemoryThreads(opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.listConciergeMemoryThreads(opts);
+  }
+  async readConciergeMemoryThread(threadId, opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.readConciergeMemoryThread(threadId, opts);
+  }
+  async deleteConciergeMemoryThread(threadId) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.deleteConciergeMemoryThread(threadId);
+  }
   /**
    * Open the click-to-inspect/approve panel for a wrapped agent. The
    * panel surfaces recent activity routed through this agent, pending
@@ -30782,7 +31569,21 @@ init_encoding();
 
 // src/chat/operator-chat-audit-events.ts
 var OPERATOR_CHAT_OPS = {
-  CONCIERGE_CHAT: "operator_concierge_chat"};
+  CONCIERGE_CHAT: "operator_concierge_chat",
+  /**
+   * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+   * when the operator hits the list-threads or read-thread route. Body
+   * carries the thread_id (or `*` for the list endpoint) and a count;
+   * raw turn content never crosses the audit surface.
+   */
+  CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+  /**
+   * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+   * successful thread removal. Body carries thread_id + turn_count of
+   * the deleted bundle.
+   */
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
+};
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
@@ -30825,6 +31626,14 @@ var OperatorChatService = class {
   contextProviders;
   piiFilter;
   conciergeMaxTokens;
+  memory;
+  /**
+   * In-memory thread_id assigned to the active concierge session.
+   * The first sendConcierge call after construction allocates a fresh
+   * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+   * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+   */
+  activeMemoryThreadId;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -30835,6 +31644,7 @@ var OperatorChatService = class {
     }
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+    if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -30865,6 +31675,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+      });
+    }
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -30920,6 +31735,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
+      });
+    }
     const payload = {
       version: "1.2",
       event_id: makeEventId("conc"),
@@ -30952,6 +31772,105 @@ var OperatorChatService = class {
     );
     return thread ? thread.messages : [];
   }
+  // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+  /**
+   * Whether the foundation memory store is wired. Routes use this to
+   * 503 cleanly when called against an unwired service.
+   */
+  hasConciergeMemory() {
+    return this.memory !== void 0;
+  }
+  /**
+   * List concierge memory threads, newest-first. Emits the
+   * `operator_concierge_history_read` audit event with `thread_id="*"`.
+   */
+  async listConciergeMemoryThreads(opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const summaries = await this.memory.listThreads(opts);
+    const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: "*",
+      turn_count: totalTurns
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return summaries;
+  }
+  /**
+   * Read a concierge memory thread, oldest turn first. Emits the
+   * `operator_concierge_history_read` audit event with the named
+   * thread_id and the count of turns surfaced.
+   */
+  async readConciergeMemoryThread(threadId, opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turns = await this.memory.readThread(threadId, opts);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turns.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return turns;
+  }
+  /**
+   * Delete a concierge memory thread. Emits
+   * `operator_concierge_thread_deleted` only when a bundle was actually
+   * removed; absent threads return false without an audit event.
+   */
+  async deleteConciergeMemoryThread(threadId) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turnsBefore = await this.memory.readThread(threadId);
+    if (turnsBefore.length === 0) {
+      return await this.memory.deleteThread(threadId);
+    }
+    const removed = await this.memory.deleteThread(threadId);
+    if (!removed) return false;
+    if (this.activeMemoryThreadId === threadId) {
+      this.activeMemoryThreadId = void 0;
+    }
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-del"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_thread_deleted",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turnsBefore.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+    return true;
+  }
+  /**
+   * Reset the active session memory thread. Subsequent sendConcierge
+   * calls allocate a fresh thread_id. Surfaced for tests + future "new
+   * conversation" affordance; not currently called by the dashboard.
+   */
+  resetConciergeMemoryThread() {
+    this.activeMemoryThreadId = void 0;
+  }
+  ensureActiveMemoryThread() {
+    if (!this.activeMemoryThreadId) {
+      this.activeMemoryThreadId = crypto.randomUUID();
+    }
+    return this.activeMemoryThreadId;
+  }
   /**
    * Stitch fortress state into a single context blob the substrate
    * folds into its summarization prompt.
@@ -31115,6 +32034,238 @@ var OperatorChatStore = class {
   }
 };
 
+// src/chat/concierge-memory-store.ts
+init_encryption();
+init_encoding();
+var CONCIERGE_MEMORY_NAMESPACE = "_chat";
+var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+var HKDF_INFO2 = "concierge-memory-store-v1";
+var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var ConciergeMemoryStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  locks;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+    this.locks = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Append a turn to the named thread, creating the bundle if no record
+   * exists. Returns the persisted turn (with assigned turn_id +
+   * retention_until). Per-thread serialisation guarantees turn_id
+   * monotonicity even under concurrent callers.
+   */
+  async appendTurn(threadId, role, content) {
+    return this.withLock(threadId, async () => {
+      const bundle = await this.loadBundle(threadId) ?? null;
+      const now = /* @__PURE__ */ new Date();
+      const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+      const retentionUntil = new Date(now.getTime() + retentionMs);
+      const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+      const turn = {
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        turn_id: nextTurnId,
+        role,
+        content,
+        created_at: now.toISOString(),
+        retention_until: retentionUntil.toISOString()
+      };
+      const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+        version: 1,
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        created_at: now.toISOString(),
+        turns: [turn]
+      };
+      await this.saveBundle(next);
+      return turn;
+    });
+  }
+  /**
+   * Read turns from a thread, oldest-first. Returns an empty array if
+   * the thread does not exist or its bundle is corrupt. Does not emit
+   * audit events; the caller (HTTP route handler) owns audit semantics.
+   */
+  async readThread(threadId, opts) {
+    const bundle = await this.loadBundle(threadId);
+    if (!bundle) return [];
+    let turns = bundle.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return turns;
+  }
+  /**
+   * Enumerate concierge threads in this fortress with summary metadata.
+   * Sorted newest-first by last_turn_at.
+   */
+  async listThreads(opts) {
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    const summaries = [];
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      const bundle = await this.loadBundle(threadId);
+      if (!bundle || bundle.turns.length === 0) continue;
+      const last = bundle.turns[bundle.turns.length - 1];
+      summaries.push({
+        thread_id: bundle.thread_id,
+        created_at: bundle.created_at,
+        last_turn_at: last ? last.created_at : bundle.created_at,
+        turn_count: bundle.turns.length
+      });
+    }
+    summaries.sort(
+      (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+    );
+    if (opts?.limit !== void 0) {
+      return summaries.slice(0, opts.limit);
+    }
+    return summaries;
+  }
+  /**
+   * Delete a thread's bundle. Returns true if the bundle existed and
+   * was removed; false if no bundle was present. Audit emission is the
+   * caller's responsibility.
+   */
+  async deleteThread(threadId) {
+    const key = bundleKey(threadId);
+    return this.withLock(threadId, async () => {
+      const existed = await this.storage.exists(
+        CONCIERGE_MEMORY_NAMESPACE,
+        key
+      );
+      if (!existed) return false;
+      try {
+        await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+      } catch {
+        return false;
+      }
+      return true;
+    });
+  }
+  /**
+   * Drop expired turns across all threads. Threads emptied by pruning
+   * are removed entirely. Returns the count of turns pruned.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      pruned += await this.withLock(threadId, async () => {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return 0;
+        const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+        const dropped = bundle.turns.length - kept.length;
+        if (dropped === 0) return 0;
+        if (kept.length === 0) {
+          await this.storage.delete(
+            CONCIERGE_MEMORY_NAMESPACE,
+            bundleKey(threadId)
+          );
+        } else {
+          await this.saveBundle({ ...bundle, turns: kept });
+        }
+        return dropped;
+      });
+    }
+    return { pruned };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  async loadBundle(threadId) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(threadId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.thread_id !== threadId) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async saveBundle(bundle) {
+    const key = bundleKey(bundle.thread_id);
+    const aad = stringToBytes(bundle.thread_id);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      CONCIERGE_MEMORY_NAMESPACE,
+      key,
+      stringToBytes(JSON.stringify(envelope))
+    );
+  }
+  /**
+   * Run `task` while holding the per-thread async lock. Lock is released
+   * once the task settles (success or failure). Generic helper so
+   * appendTurn / deleteThread / pruneExpired share serialisation.
+   */
+  async withLock(threadId, task) {
+    const previous = this.locks.get(threadId) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve6) => {
+      release = resolve6;
+    });
+    const chained = previous.then(() => next);
+    this.locks.set(threadId, chained);
+    try {
+      await previous;
+      return await task();
+    } finally {
+      release();
+      if (this.locks.get(threadId) === chained) {
+        this.locks.delete(threadId);
+      }
+    }
+  }
+};
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+
 // src/dashboard/v1_1/wiring.ts
 var CapabilityErrorAgentController = class {
   fail(action) {
@@ -31153,6 +32304,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -31163,7 +32322,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -31355,13 +32515,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO2 = "intelligence-substrate-config";
+var HKDF_INFO3 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -33500,7 +34660,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -33509,6 +34671,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -33528,7 +34700,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 
@@ -34455,7 +35627,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -35107,7 +36291,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -35205,6 +36401,21 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
     });
   } : void 0;
   const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -35399,6 +36610,7 @@ exports.HERO_COPY = HERO_COPY;
 exports.InMemoryModelProvenanceStore = InMemoryModelProvenanceStore;
 exports.InjectionDetector = InjectionDetector;
 exports.MODEL_PRESETS = MODEL_PRESETS;
+exports.MalformedPrincipalPolicyError = MalformedPrincipalPolicyError;
 exports.MemoryStorage = MemoryStorage;
 exports.PolicyStore = PolicyStore;
 exports.ProxyRouter = ProxyRouter;