@sanctuary-framework/mcp-server 1.2.3 → 1.2.4

package/dist/index.js

@@ -4582,20 +4582,52 @@ approval_channel:
   timeout_seconds: 300
 `;
 }
+var MalformedPrincipalPolicyError = class extends Error {
+  constructor(policyPath, reason) {
+    super(
+      `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+    );
+    this.policyPath = policyPath;
+    this.reason = reason;
+    this.name = "MalformedPrincipalPolicyError";
+  }
+  policyPath;
+  reason;
+};
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await writeFile(policyPath, defaultYaml, "utf-8");
+        await chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await writeFile(policyPath, defaultYaml, "utf-8");
-      await chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
 
@@ -4822,7 +4854,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 
 // src/shr/generator.ts
@@ -11644,6 +11676,16 @@ var HUB_ROUTES = {
    */
   CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
   CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+  /**
+   * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+   * scrollback, and operator-initiated thread delete. Distinct from the
+   * v1.2 `/history` route, which surfaces the active in-session thread
+   * shape; the new routes target persisted multi-thread memory used by
+   * v1.3 conversational sovereignty depth.
+   */
+  CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+  CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+  CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
   /**
    * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
    * recent activity feed, pending Tier 1 approvals routed through this
@@ -11667,6 +11709,10 @@ var HUB_TIER_1_AGENT_CONTROL_ACTIONS = [
 ];
 var HUB_ACTIVITY_DEFAULT_LIMIT = 50;
 var HUB_ACTIVITY_MAX_LIMIT = 500;
+var HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+var HUB_CHAT_THREADS_MAX_LIMIT = 500;
+var HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+var HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
 var HUB_INBOX_DEFAULT_LIMIT = 100;
 var HUB_INBOX_MAX_LIMIT = 500;
 var HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -11838,6 +11884,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -12021,6 +12084,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -16070,6 +16174,162 @@ async function dispatchV11Request(inputs, req, res, url, method) {
   return false;
 }
 
+// src/principal-policy/approval-aggregator-routes.ts
+var APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+var APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+var APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+var APPROVAL_INBOX_MAX_LIMIT = 200;
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16134,6 +16394,14 @@ var DashboardApprovalChannel = class {
    * regardless. Default route flip is deferred to v1.2.
    */
   v11Bindings = null;
+  /**
+   * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+   * additively at `/api/approval-inbox/*` when set. Legacy approval
+   * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+   * aggregator is a passive subscriber to the gate; the routes here are
+   * the operator-facing query / decision surface.
+   */
+  approvalAggregator = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16184,6 +16452,34 @@ var DashboardApprovalChannel = class {
   setV11Bindings(bindings) {
     this.v11Bindings = bindings;
   }
+  /**
+   * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+   * aggregator. Once set, requests to `/api/approval-inbox/*` route
+   * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+   * tests + during shutdown).
+   */
+  setApprovalAggregator(aggregator) {
+    this.approvalAggregator = aggregator;
+  }
+  /**
+   * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+   * before the legacy approval route table. Returns true when served.
+   */
+  async dispatchApprovalInbox(req, res) {
+    if (!this.approvalAggregator) return false;
+    return handleApprovalInboxRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        aggregator: this.approvalAggregator,
+        operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16559,6 +16855,18 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+      this.dispatchApprovalInbox(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -18577,14 +18885,25 @@ var ApprovalGate = class {
   auditLog;
   injectionDetector;
   onInjectionAlert;
+  onApprovalEvent;
   proxyTierResolver;
-  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
     this.policy = policy;
     this.baseline = baseline;
     this.channel = channel;
     this.auditLog = auditLog;
     this.injectionDetector = injectionDetector ?? new InjectionDetector();
     this.onInjectionAlert = onInjectionAlert;
+    this.onApprovalEvent = onApprovalEvent;
+  }
+  /**
+   * Set the approval-event callback after construction. Used by the
+   * Upsilon-1 wire-up when the aggregator is constructed alongside the
+   * gate. The aggregator subscribes through this setter rather than the
+   * constructor so existing call sites continue to work unchanged.
+   */
+  setApprovalEventCallback(cb) {
+    this.onApprovalEvent = cb;
   }
   /**
    * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -18818,21 +19137,105 @@ var ApprovalGate = class {
   }
   /**
    * Request approval from the human principal.
+   *
+   * Fail-closed contract (full-sweep #49): if the channel throws (network
+   * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+   * failure, etc.), the gate denies the operation and audit-logs the cause.
+   * Channel-internal timeouts already resolve with decision: "deny" per
+   * SEC-002; this catch covers the remaining "channel raised" path so an
+   * unhandled rejection cannot turn into an indeterminate state at the gate.
    */
   async requestApproval(operation, tier, reason, context) {
+    const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
     const request = {
       operation,
       tier,
       reason,
       context,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: requestTimestamp
     };
-    const response = await this.channel.requestApproval(request);
+    const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "requested",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
+    let response;
+    try {
+      response = await this.channel.requestApproval(request);
+    } catch (err) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+      const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+        tier,
+        reason,
+        decided_by: "channel_failure",
+        channel_error: errMessage
+      });
+      if (this.onApprovalEvent) {
+        try {
+          this.onApprovalEvent({
+            phase: "resolved",
+            operation,
+            tier,
+            reason,
+            context,
+            request_timestamp: requestTimestamp,
+            resolution: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            },
+            correlation_id: correlationId
+          });
+        } catch {
+        }
+      }
+      return {
+        allowed: false,
+        tier,
+        reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+        approval_required: true,
+        approval_response: {
+          decision: "deny",
+          decided_at: decidedAt,
+          decided_by: "channel_failure"
+        }
+      };
+    }
     this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
       tier,
       reason,
       decided_by: response.decided_by
     });
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "resolved",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          resolution: {
+            decision: response.decision,
+            decided_at: response.decided_at,
+            decided_by: response.decided_by
+          },
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
     return {
       allowed: response.decision === "approve",
       tier,
@@ -18866,6 +19269,352 @@ var ApprovalGate = class {
   }
 };
 
+// src/principal-policy/approval-aggregator.ts
+init_encryption();
+init_encoding();
+var APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+var APPROVAL_AGGREGATOR_AUDIT_OPS = {
+  AGGREGATED: "cross_harness_approval_aggregated",
+  RESOLVED: "cross_harness_approval_resolved",
+  DEDUPED: "cross_harness_approval_deduped"
+};
+var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_LIST_LIMIT = 200;
+var DEFAULT_LIST_PAGE_SIZE = 50;
+var ApprovalAggregator = class {
+  storage;
+  encryptionKey;
+  auditLog;
+  identityId;
+  fortressId;
+  pendingTtlMs;
+  maxListLimit;
+  now;
+  resolveSourceContext;
+  resolveHubInboxItemId;
+  /** Cached entries by `aggregator_id`. */
+  entries = /* @__PURE__ */ new Map();
+  /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+  dedupIndex = /* @__PURE__ */ new Map();
+  /** Correlation index: gate `correlation_id` -> aggregator_id. */
+  correlationIndex = /* @__PURE__ */ new Map();
+  /** Original request payloads kept in-memory for `getFullPayload()`. */
+  fullPayloads = /* @__PURE__ */ new Map();
+  /** Has the aggregator hydrated persisted entries on this process? */
+  hydrated = false;
+  /** Active SSE listeners. */
+  listeners = /* @__PURE__ */ new Set();
+  constructor(deps) {
+    this.storage = deps.storage;
+    this.encryptionKey = derivePurposeKey(
+      deps.masterKey,
+      APPROVAL_AGGREGATOR_HKDF_INFO
+    );
+    this.auditLog = deps.auditLog;
+    this.identityId = deps.identityId;
+    this.fortressId = deps.fortressId;
+    this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+      source_harness: this.fortressId,
+      source_agent_id: this.fortressId
+    }));
+    this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+  }
+  /**
+   * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+   * use this to forward aggregator emissions to the dashboard.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Ingest a gate event. Returns the aggregator entry on first sight,
+   * `null` when deduped. Resolution events update the existing record;
+   * unmatched resolutions are dropped silently (caller's gate emitted a
+   * resolved-without-requested pair, which the aggregator does not invent
+   * a record for).
+   */
+  async ingest(event) {
+    await this.hydrate();
+    if (event.phase === "requested") {
+      return this.ingestRequested(event);
+    }
+    if (event.phase === "resolved") {
+      return this.ingestResolved(event);
+    }
+    return null;
+  }
+  /**
+   * List pending or recently resolved entries. Pending entries past TTL
+   * are lazily transitioned to `expired` and persisted before the list
+   * snapshot is returned.
+   */
+  async list(opts) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (opts?.status && entry.status !== opts.status) continue;
+      if (Date.parse(entry.created_at) < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return matching.slice(0, limit);
+  }
+  /**
+   * Return the original (unhashed) request payload for the entry. Returns
+   * `null` when the entry is unknown or the payload was evicted (e.g. the
+   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   */
+  async getFullPayload(aggregatorId) {
+    await this.hydrate();
+    if (!this.entries.has(aggregatorId)) return null;
+    return this.fullPayloads.get(aggregatorId) ?? null;
+  }
+  /**
+   * Resolve an entry. Used by both:
+   *   1. The gate wire-up on channel-decision return.
+   *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+   *
+   * Idempotent: resolving an already-resolved entry is a no-op (the record
+   * keeps its first decision and the audit log is not double-fired).
+   * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+   * routes return 404.
+   */
+  async resolve(aggregatorId, decision, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      throw new Error("approval-aggregator: not_found");
+    }
+    if (entry.status !== "pending") {
+      return entry;
+    }
+    entry.status = decision;
+    entry.resolved_at = this.now().toISOString();
+    entry.resolved_by = operatorId;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: entry.aggregator_id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision,
+        decided_by: operatorId,
+        decided_at: entry.resolved_at
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: ingest paths ─────────────────────────────────────────────
+  async ingestRequested(event) {
+    const ctx = this.resolveSourceContext(event);
+    const auditId = this.auditEntryIdForEvent(event);
+    const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+    const existing = this.dedupIndex.get(dedupKey);
+    if (existing) {
+      const existingEntry = this.entries.get(existing);
+      if (existingEntry) {
+        this.correlationIndex.set(event.correlation_id, existing);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+          this.identityId,
+          {
+            aggregator_id: existing,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: this.derivePolicyRuleId(event),
+            correlation_id: event.correlation_id
+          }
+        );
+        this.emit({ type: "deduped", entry: { ...existingEntry } });
+        return null;
+      }
+    }
+    const id = randomUUID();
+    const now = this.now();
+    const expires = new Date(now.getTime() + this.pendingTtlMs);
+    const hubInboxId = this.resolveHubInboxItemId(event);
+    const entry = {
+      aggregator_id: id,
+      source_harness: ctx.source_harness,
+      source_agent_id: ctx.source_agent_id,
+      audit_log_entry_id: auditId,
+      policy_rule_id: this.derivePolicyRuleId(event),
+      action_summary: this.deriveActionSummary(event),
+      request_payload_hash: this.hashPayload(event.context),
+      status: "pending",
+      created_at: now.toISOString(),
+      expires_at: expires.toISOString(),
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+    };
+    this.entries.set(id, entry);
+    this.dedupIndex.set(dedupKey, id);
+    this.correlationIndex.set(event.correlation_id, id);
+    this.fullPayloads.set(id, event.context);
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: ctx.source_harness,
+        source_agent_id: ctx.source_agent_id,
+        audit_log_entry_id: auditId,
+        policy_rule_id: entry.policy_rule_id,
+        ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      }
+    );
+    this.emit({ type: "aggregated", entry: { ...entry } });
+    return entry;
+  }
+  async ingestResolved(event) {
+    const id = this.correlationIndex.get(event.correlation_id);
+    if (!id) return null;
+    const entry = this.entries.get(id);
+    if (!entry) return null;
+    if (entry.status !== "pending") return entry;
+    if (!event.resolution) return entry;
+    const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+    const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+    entry.status = status;
+    entry.resolved_at = event.resolution.decided_at;
+    entry.resolved_by = event.resolution.decided_by;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision: status,
+        decided_by: entry.resolved_by,
+        decided_at: entry.resolved_at,
+        fail_closed: failClosed
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: helpers ──────────────────────────────────────────────────
+  /**
+   * Audit-log entry id for the dedup tuple. The audit log itself does not
+   * surface a stable per-entry id (counter-prefixed keys are internal); the
+   * aggregator uses the request timestamp + operation, which together pin
+   * the audit entry the gate appended on the same call.
+   */
+  auditEntryIdForEvent(event) {
+    return `${event.request_timestamp}:${event.operation}`;
+  }
+  derivePolicyRuleId(event) {
+    return `tier${event.tier}:${event.operation}`;
+  }
+  deriveActionSummary(event) {
+    return `${event.operation} (tier ${event.tier})`;
+  }
+  /**
+   * Canonical SHA-256 of the request context. Sorted-keys serialization so
+   * identical payloads always hash the same, even when key insertion order
+   * varies. Defends against payload-replay smuggling (the aggregator can
+   * tell the same payload was seen twice without storing it cleartext).
+   */
+  hashPayload(payload) {
+    const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+    return createHash("sha256").update(canonical).digest("hex");
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  async expireStale() {
+    const nowMs = this.now().getTime();
+    for (const entry of this.entries.values()) {
+      if (entry.status !== "pending") continue;
+      if (Date.parse(entry.expires_at) > nowMs) continue;
+      entry.status = "expired";
+      entry.resolved_at = this.now().toISOString();
+      entry.resolved_by = "system_ttl";
+      await this.persist(entry);
+      this.auditLog.append(
+        "l2",
+        APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+        this.identityId,
+        {
+          aggregator_id: entry.aggregator_id,
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          audit_log_entry_id: entry.audit_log_entry_id,
+          policy_rule_id: entry.policy_rule_id,
+          decision: "expired",
+          decided_by: "system_ttl",
+          decided_at: entry.resolved_at
+        }
+      );
+      this.emit({ type: "resolved", entry: { ...entry } });
+    }
+  }
+  async persist(entry) {
+    const serialized = stringToBytes(JSON.stringify(entry));
+    const encrypted = encrypt(serialized, this.encryptionKey);
+    await this.storage.write(
+      APPROVAL_AGGREGATOR_NAMESPACE,
+      entry.aggregator_id,
+      stringToBytes(JSON.stringify(encrypted))
+    );
+  }
+  async hydrate() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    try {
+      const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+      for (const meta of metas) {
+        const raw = await this.storage.read(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          meta.key
+        );
+        if (!raw) continue;
+        try {
+          const encrypted = JSON.parse(bytesToString(raw));
+          const decrypted = decrypt(encrypted, this.encryptionKey);
+          const entry = JSON.parse(bytesToString(decrypted));
+          this.entries.set(entry.aggregator_id, entry);
+          const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+          this.dedupIndex.set(dedupKey, entry.aggregator_id);
+        } catch {
+        }
+      }
+    } catch {
+      this.hydrated = false;
+    }
+  }
+};
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -21718,6 +22467,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await rm(markerPath, { force: true });
+    await rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -21742,7 +22497,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await writeFile(consumedPath, "", "utf-8");
   await rm(markerPath, { force: true });
+  await rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -30688,6 +31445,36 @@ var HubService = class {
     const chat = this.requireOperatorChat();
     return chat.getConciergeHistory();
   }
+  // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+  /**
+   * Whether the operator-chat service has the WP-V1.3-9 memory store
+   * wired. Routes use this to 503 cleanly when the foundation memory
+   * surface is unavailable on a given fortress.
+   */
+  hasConciergeMemory() {
+    return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+  }
+  async listConciergeMemoryThreads(opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.listConciergeMemoryThreads(opts);
+  }
+  async readConciergeMemoryThread(threadId, opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.readConciergeMemoryThread(threadId, opts);
+  }
+  async deleteConciergeMemoryThread(threadId) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.deleteConciergeMemoryThread(threadId);
+  }
   /**
    * Open the click-to-inspect/approve panel for a wrapped agent. The
    * panel surfaces recent activity routed through this agent, pending
@@ -30775,7 +31562,21 @@ init_encoding();
 
 // src/chat/operator-chat-audit-events.ts
 var OPERATOR_CHAT_OPS = {
-  CONCIERGE_CHAT: "operator_concierge_chat"};
+  CONCIERGE_CHAT: "operator_concierge_chat",
+  /**
+   * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+   * when the operator hits the list-threads or read-thread route. Body
+   * carries the thread_id (or `*` for the list endpoint) and a count;
+   * raw turn content never crosses the audit surface.
+   */
+  CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+  /**
+   * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+   * successful thread removal. Body carries thread_id + turn_count of
+   * the deleted bundle.
+   */
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
+};
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
@@ -30818,6 +31619,14 @@ var OperatorChatService = class {
   contextProviders;
   piiFilter;
   conciergeMaxTokens;
+  memory;
+  /**
+   * In-memory thread_id assigned to the active concierge session.
+   * The first sendConcierge call after construction allocates a fresh
+   * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+   * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+   */
+  activeMemoryThreadId;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -30828,6 +31637,7 @@ var OperatorChatService = class {
     }
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+    if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -30858,6 +31668,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+      });
+    }
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -30913,6 +31728,11 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
+      });
+    }
     const payload = {
       version: "1.2",
       event_id: makeEventId("conc"),
@@ -30945,6 +31765,105 @@ var OperatorChatService = class {
     );
     return thread ? thread.messages : [];
   }
+  // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+  /**
+   * Whether the foundation memory store is wired. Routes use this to
+   * 503 cleanly when called against an unwired service.
+   */
+  hasConciergeMemory() {
+    return this.memory !== void 0;
+  }
+  /**
+   * List concierge memory threads, newest-first. Emits the
+   * `operator_concierge_history_read` audit event with `thread_id="*"`.
+   */
+  async listConciergeMemoryThreads(opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const summaries = await this.memory.listThreads(opts);
+    const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: "*",
+      turn_count: totalTurns
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return summaries;
+  }
+  /**
+   * Read a concierge memory thread, oldest turn first. Emits the
+   * `operator_concierge_history_read` audit event with the named
+   * thread_id and the count of turns surfaced.
+   */
+  async readConciergeMemoryThread(threadId, opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turns = await this.memory.readThread(threadId, opts);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turns.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return turns;
+  }
+  /**
+   * Delete a concierge memory thread. Emits
+   * `operator_concierge_thread_deleted` only when a bundle was actually
+   * removed; absent threads return false without an audit event.
+   */
+  async deleteConciergeMemoryThread(threadId) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turnsBefore = await this.memory.readThread(threadId);
+    if (turnsBefore.length === 0) {
+      return await this.memory.deleteThread(threadId);
+    }
+    const removed = await this.memory.deleteThread(threadId);
+    if (!removed) return false;
+    if (this.activeMemoryThreadId === threadId) {
+      this.activeMemoryThreadId = void 0;
+    }
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-del"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_thread_deleted",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turnsBefore.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+    return true;
+  }
+  /**
+   * Reset the active session memory thread. Subsequent sendConcierge
+   * calls allocate a fresh thread_id. Surfaced for tests + future "new
+   * conversation" affordance; not currently called by the dashboard.
+   */
+  resetConciergeMemoryThread() {
+    this.activeMemoryThreadId = void 0;
+  }
+  ensureActiveMemoryThread() {
+    if (!this.activeMemoryThreadId) {
+      this.activeMemoryThreadId = randomUUID();
+    }
+    return this.activeMemoryThreadId;
+  }
   /**
    * Stitch fortress state into a single context blob the substrate
    * folds into its summarization prompt.
@@ -31108,6 +32027,238 @@ var OperatorChatStore = class {
   }
 };
 
+// src/chat/concierge-memory-store.ts
+init_encryption();
+init_encoding();
+var CONCIERGE_MEMORY_NAMESPACE = "_chat";
+var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+var HKDF_INFO2 = "concierge-memory-store-v1";
+var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var ConciergeMemoryStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  locks;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+    this.locks = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Append a turn to the named thread, creating the bundle if no record
+   * exists. Returns the persisted turn (with assigned turn_id +
+   * retention_until). Per-thread serialisation guarantees turn_id
+   * monotonicity even under concurrent callers.
+   */
+  async appendTurn(threadId, role, content) {
+    return this.withLock(threadId, async () => {
+      const bundle = await this.loadBundle(threadId) ?? null;
+      const now = /* @__PURE__ */ new Date();
+      const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+      const retentionUntil = new Date(now.getTime() + retentionMs);
+      const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+      const turn = {
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        turn_id: nextTurnId,
+        role,
+        content,
+        created_at: now.toISOString(),
+        retention_until: retentionUntil.toISOString()
+      };
+      const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+        version: 1,
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        created_at: now.toISOString(),
+        turns: [turn]
+      };
+      await this.saveBundle(next);
+      return turn;
+    });
+  }
+  /**
+   * Read turns from a thread, oldest-first. Returns an empty array if
+   * the thread does not exist or its bundle is corrupt. Does not emit
+   * audit events; the caller (HTTP route handler) owns audit semantics.
+   */
+  async readThread(threadId, opts) {
+    const bundle = await this.loadBundle(threadId);
+    if (!bundle) return [];
+    let turns = bundle.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return turns;
+  }
+  /**
+   * Enumerate concierge threads in this fortress with summary metadata.
+   * Sorted newest-first by last_turn_at.
+   */
+  async listThreads(opts) {
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    const summaries = [];
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      const bundle = await this.loadBundle(threadId);
+      if (!bundle || bundle.turns.length === 0) continue;
+      const last = bundle.turns[bundle.turns.length - 1];
+      summaries.push({
+        thread_id: bundle.thread_id,
+        created_at: bundle.created_at,
+        last_turn_at: last ? last.created_at : bundle.created_at,
+        turn_count: bundle.turns.length
+      });
+    }
+    summaries.sort(
+      (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+    );
+    if (opts?.limit !== void 0) {
+      return summaries.slice(0, opts.limit);
+    }
+    return summaries;
+  }
+  /**
+   * Delete a thread's bundle. Returns true if the bundle existed and
+   * was removed; false if no bundle was present. Audit emission is the
+   * caller's responsibility.
+   */
+  async deleteThread(threadId) {
+    const key = bundleKey(threadId);
+    return this.withLock(threadId, async () => {
+      const existed = await this.storage.exists(
+        CONCIERGE_MEMORY_NAMESPACE,
+        key
+      );
+      if (!existed) return false;
+      try {
+        await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+      } catch {
+        return false;
+      }
+      return true;
+    });
+  }
+  /**
+   * Drop expired turns across all threads. Threads emptied by pruning
+   * are removed entirely. Returns the count of turns pruned.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      pruned += await this.withLock(threadId, async () => {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return 0;
+        const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+        const dropped = bundle.turns.length - kept.length;
+        if (dropped === 0) return 0;
+        if (kept.length === 0) {
+          await this.storage.delete(
+            CONCIERGE_MEMORY_NAMESPACE,
+            bundleKey(threadId)
+          );
+        } else {
+          await this.saveBundle({ ...bundle, turns: kept });
+        }
+        return dropped;
+      });
+    }
+    return { pruned };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  async loadBundle(threadId) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(threadId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.thread_id !== threadId) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async saveBundle(bundle) {
+    const key = bundleKey(bundle.thread_id);
+    const aad = stringToBytes(bundle.thread_id);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      CONCIERGE_MEMORY_NAMESPACE,
+      key,
+      stringToBytes(JSON.stringify(envelope))
+    );
+  }
+  /**
+   * Run `task` while holding the per-thread async lock. Lock is released
+   * once the task settles (success or failure). Generic helper so
+   * appendTurn / deleteThread / pruneExpired share serialisation.
+   */
+  async withLock(threadId, task) {
+    const previous = this.locks.get(threadId) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve6) => {
+      release = resolve6;
+    });
+    const chained = previous.then(() => next);
+    this.locks.set(threadId, chained);
+    try {
+      await previous;
+      return await task();
+    } finally {
+      release();
+      if (this.locks.get(threadId) === chained) {
+        this.locks.delete(threadId);
+      }
+    }
+  }
+};
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+
 // src/dashboard/v1_1/wiring.ts
 var CapabilityErrorAgentController = class {
   fail(action) {
@@ -31146,6 +32297,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -31156,7 +32315,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -31348,13 +32508,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO2 = "intelligence-substrate-config";
+var HKDF_INFO3 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -33493,7 +34653,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -33502,6 +34664,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -33521,7 +34693,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 
@@ -34448,7 +35620,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -35100,7 +36284,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -35198,6 +36394,21 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
     });
   } : void 0;
   const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -35373,6 +36584,6 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   };
 }
 
-export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
+export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MalformedPrincipalPolicyError, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map