@sanctuary-framework/mcp-server 1.2.3 → 1.2.5

package/dist/index.cjs

@@ -4261,6 +4261,10 @@ var DEFAULT_CHANNEL = {
   // SEC-002: auto_deny is not configurable. Timeout always denies.
   // Field omitted intentionally — all channels hardcode deny on timeout.
 };
+var DEFAULT_APPROVAL_REDIRECT = {
+  enabled: false,
+  mode: "replace"
+};
 var DEFAULT_POLICY = {
   version: 1,
   tier1_always_approve: [
@@ -4334,6 +4338,7 @@ var DEFAULT_POLICY = {
     "handshake_status",
     "handshake_exchange",
     "handshake_verify_attestation",
+    "handshake_abort",
     "reputation_query_weighted",
     "federation_peers",
     "federation_trust_evaluate",
@@ -4375,7 +4380,8 @@ var DEFAULT_POLICY = {
     "compliance_eu_ai_act_annex_iii_classify"
     // Read-only; rule-based Annex III classifier
   ],
-  approval_channel: DEFAULT_CHANNEL
+  approval_channel: DEFAULT_CHANNEL,
+  approval_redirect: DEFAULT_APPROVAL_REDIRECT
 };
 function extractOperationName(toolName) {
   if (toolName.startsWith("proxy/")) {
@@ -4472,9 +4478,35 @@ function validatePolicy(raw) {
       };
       delete merged.auto_deny;
       return merged;
-    })()
+    })(),
+    approval_redirect: parseApprovalRedirect(raw.approval_redirect)
   };
 }
+function parseApprovalRedirect(raw) {
+  if (raw === void 0 || raw === null) {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  if (typeof raw !== "object") {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  const obj = raw;
+  const enabled = typeof obj.enabled === "boolean" ? obj.enabled : DEFAULT_APPROVAL_REDIRECT.enabled;
+  const modeRaw = obj.mode;
+  let mode = DEFAULT_APPROVAL_REDIRECT.mode;
+  if (modeRaw !== void 0) {
+    if (modeRaw !== "replace" && modeRaw !== "notify") {
+      throw new Error(
+        `approval_redirect.mode must be "replace" or "notify" (got ${JSON.stringify(modeRaw)})`
+      );
+    }
+    mode = modeRaw;
+  }
+  const result = { enabled, mode };
+  if (obj.per_agent !== void 0 && typeof obj.per_agent === "object" && obj.per_agent !== null) {
+    result.per_agent = obj.per_agent;
+  }
+  return result;
+}
 function generateDefaultPolicyYaml() {
   return `# Sanctuary Principal Policy v1
 # This file controls what your agent can do without asking.
@@ -4553,6 +4585,7 @@ tier3_always_allow:
   - handshake_status
   - handshake_exchange
   - handshake_verify_attestation
+  - handshake_abort
   - reputation_query_weighted
   - federation_peers
   - federation_trust_evaluate
@@ -4587,22 +4620,69 @@ tier3_always_allow:
 approval_channel:
   type: stderr
   timeout_seconds: 300
+
+# \u2500\u2500\u2500 Approval Redirect (v1.3 WP-V1.3-10 Upsilon-2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Cross-harness approval-inbox redirect. When enabled, Tier 1/2 approvals
+# resolve via the unified approval inbox at /api/approval-inbox/* instead
+# of (or in addition to) the configured approval_channel above.
+#
+# mode:
+#   replace: bypass the approval_channel entirely; the gate awaits a
+#            decision from the inbox (default once enabled).
+#   notify:  fire BOTH the approval_channel and the inbox; first decision
+#            wins. Right shape for harnesses that cannot fully suppress
+#            their local approval prompt (e.g. Mastra-class).
+approval_redirect:
+  enabled: false
+  mode: replace
 `;
 }
+var MalformedPrincipalPolicyError = class extends Error {
+  constructor(policyPath, reason) {
+    super(
+      `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+    );
+    this.policyPath = policyPath;
+    this.reason = reason;
+    this.name = "MalformedPrincipalPolicyError";
+  }
+  policyPath;
+  reason;
+};
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = path.join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await promises.readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await promises.writeFile(policyPath, defaultYaml, "utf-8");
+        await promises.chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await promises.readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await promises.writeFile(policyPath, defaultYaml, "utf-8");
-      await promises.chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
 
@@ -4829,7 +4909,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 
 // src/shr/generator.ts
@@ -11651,6 +11731,16 @@ var HUB_ROUTES = {
    */
   CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
   CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+  /**
+   * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+   * scrollback, and operator-initiated thread delete. Distinct from the
+   * v1.2 `/history` route, which surfaces the active in-session thread
+   * shape; the new routes target persisted multi-thread memory used by
+   * v1.3 conversational sovereignty depth.
+   */
+  CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+  CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+  CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
   /**
    * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
    * recent activity feed, pending Tier 1 approvals routed through this
@@ -11674,6 +11764,10 @@ var HUB_TIER_1_AGENT_CONTROL_ACTIONS = [
 ];
 var HUB_ACTIVITY_DEFAULT_LIMIT = 50;
 var HUB_ACTIVITY_MAX_LIMIT = 500;
+var HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+var HUB_CHAT_THREADS_MAX_LIMIT = 500;
+var HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+var HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
 var HUB_INBOX_DEFAULT_LIMIT = 100;
 var HUB_INBOX_MAX_LIMIT = 500;
 var HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -11845,6 +11939,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -12028,6 +12139,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -16077,6 +16229,162 @@ async function dispatchV11Request(inputs, req, res, url, method) {
   return false;
 }
 
+// src/principal-policy/approval-aggregator-routes.ts
+var APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+var APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+var APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+var APPROVAL_INBOX_MAX_LIMIT = 200;
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16141,6 +16449,14 @@ var DashboardApprovalChannel = class {
    * regardless. Default route flip is deferred to v1.2.
    */
   v11Bindings = null;
+  /**
+   * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+   * additively at `/api/approval-inbox/*` when set. Legacy approval
+   * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+   * aggregator is a passive subscriber to the gate; the routes here are
+   * the operator-facing query / decision surface.
+   */
+  approvalAggregator = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16191,6 +16507,34 @@ var DashboardApprovalChannel = class {
   setV11Bindings(bindings) {
     this.v11Bindings = bindings;
   }
+  /**
+   * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+   * aggregator. Once set, requests to `/api/approval-inbox/*` route
+   * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+   * tests + during shutdown).
+   */
+  setApprovalAggregator(aggregator) {
+    this.approvalAggregator = aggregator;
+  }
+  /**
+   * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+   * before the legacy approval route table. Returns true when served.
+   */
+  async dispatchApprovalInbox(req, res) {
+    if (!this.approvalAggregator) return false;
+    return handleApprovalInboxRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        aggregator: this.approvalAggregator,
+        operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16566,6 +16910,18 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+      this.dispatchApprovalInbox(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -18584,14 +18940,25 @@ var ApprovalGate = class {
   auditLog;
   injectionDetector;
   onInjectionAlert;
+  onApprovalEvent;
   proxyTierResolver;
-  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
     this.policy = policy;
     this.baseline = baseline;
     this.channel = channel;
     this.auditLog = auditLog;
     this.injectionDetector = injectionDetector ?? new InjectionDetector();
     this.onInjectionAlert = onInjectionAlert;
+    this.onApprovalEvent = onApprovalEvent;
+  }
+  /**
+   * Set the approval-event callback after construction. Used by the
+   * Upsilon-1 wire-up when the aggregator is constructed alongside the
+   * gate. The aggregator subscribes through this setter rather than the
+   * constructor so existing call sites continue to work unchanged.
+   */
+  setApprovalEventCallback(cb) {
+    this.onApprovalEvent = cb;
   }
   /**
    * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -18825,21 +19192,105 @@ var ApprovalGate = class {
   }
   /**
    * Request approval from the human principal.
+   *
+   * Fail-closed contract (full-sweep #49): if the channel throws (network
+   * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+   * failure, etc.), the gate denies the operation and audit-logs the cause.
+   * Channel-internal timeouts already resolve with decision: "deny" per
+   * SEC-002; this catch covers the remaining "channel raised" path so an
+   * unhandled rejection cannot turn into an indeterminate state at the gate.
    */
   async requestApproval(operation, tier, reason, context) {
+    const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
     const request = {
       operation,
       tier,
       reason,
       context,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: requestTimestamp
     };
-    const response = await this.channel.requestApproval(request);
+    const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "requested",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
+    let response;
+    try {
+      response = await this.channel.requestApproval(request);
+    } catch (err) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+      const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+        tier,
+        reason,
+        decided_by: "channel_failure",
+        channel_error: errMessage
+      });
+      if (this.onApprovalEvent) {
+        try {
+          this.onApprovalEvent({
+            phase: "resolved",
+            operation,
+            tier,
+            reason,
+            context,
+            request_timestamp: requestTimestamp,
+            resolution: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            },
+            correlation_id: correlationId
+          });
+        } catch {
+        }
+      }
+      return {
+        allowed: false,
+        tier,
+        reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+        approval_required: true,
+        approval_response: {
+          decision: "deny",
+          decided_at: decidedAt,
+          decided_by: "channel_failure"
+        }
+      };
+    }
     this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
       tier,
       reason,
       decided_by: response.decided_by
     });
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "resolved",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          resolution: {
+            decision: response.decision,
+            decided_at: response.decided_at,
+            decided_by: response.decided_by
+          },
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
     return {
       allowed: response.decision === "approve",
       tier,
@@ -18873,50 +19324,559 @@ var ApprovalGate = class {
   }
 };
 
-// src/principal-policy/tools.ts
-function createPrincipalPolicyTools(policy, baseline, auditLog) {
-  return [
-    {
-      name: "principal_policy_view",
-      description: "View the current Principal Policy \u2014 the human-controlled rules governing what operations require approval. Read-only.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          include_defaults: {
-            type: "boolean",
-            description: "Include tier3_always_allow list (can be long)",
-            default: false
-          }
-        }
-      },
-      handler: async (args) => {
-        const includeDefaults = args.include_defaults ?? false;
-        const view = {
-          version: policy.version,
-          tier1_always_approve: policy.tier1_always_approve,
-          tier2_anomaly: policy.tier2_anomaly,
-          approval_channel: {
-            type: policy.approval_channel.type,
-            timeout_seconds: policy.approval_channel.timeout_seconds,
-            auto_deny: true
-            // SEC-002: hardcoded, not configurable
-          }
-        };
-        if (includeDefaults) {
-          view.tier3_always_allow = policy.tier3_always_allow;
-        } else {
-          view.tier3_always_allow_count = policy.tier3_always_allow.length;
-          view.note = "Pass include_defaults: true to see the full tier3_always_allow list";
-        }
-        auditLog.append("l2", "principal_policy_view", "system", {
-          include_defaults: includeDefaults
-        });
-        return toolResult(view);
-      }
-    },
-    {
-      name: "principal_baseline_view",
-      description: "View the current behavioral baseline \u2014 the session profile used for anomaly detection. Shows known namespaces, counterparties, and tool call counts. Read-only.",
+// src/principal-policy/approval-aggregator.ts
+init_encryption();
+init_encoding();
+var APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+var APPROVAL_AGGREGATOR_AUDIT_OPS = {
+  AGGREGATED: "cross_harness_approval_aggregated",
+  RESOLVED: "cross_harness_approval_resolved",
+  DEDUPED: "cross_harness_approval_deduped"
+};
+var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_LIST_LIMIT = 200;
+var DEFAULT_LIST_PAGE_SIZE = 50;
+var ApprovalAggregator = class {
+  storage;
+  encryptionKey;
+  auditLog;
+  identityId;
+  fortressId;
+  pendingTtlMs;
+  maxListLimit;
+  now;
+  resolveSourceContext;
+  resolveHubInboxItemId;
+  /** Cached entries by `aggregator_id`. */
+  entries = /* @__PURE__ */ new Map();
+  /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+  dedupIndex = /* @__PURE__ */ new Map();
+  /** Correlation index: gate `correlation_id` -> aggregator_id. */
+  correlationIndex = /* @__PURE__ */ new Map();
+  /** Original request payloads kept in-memory for `getFullPayload()`. */
+  fullPayloads = /* @__PURE__ */ new Map();
+  /** Has the aggregator hydrated persisted entries on this process? */
+  hydrated = false;
+  /** Active SSE listeners. */
+  listeners = /* @__PURE__ */ new Set();
+  constructor(deps) {
+    this.storage = deps.storage;
+    this.encryptionKey = derivePurposeKey(
+      deps.masterKey,
+      APPROVAL_AGGREGATOR_HKDF_INFO
+    );
+    this.auditLog = deps.auditLog;
+    this.identityId = deps.identityId;
+    this.fortressId = deps.fortressId;
+    this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+      source_harness: this.fortressId,
+      source_agent_id: this.fortressId
+    }));
+    this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+  }
+  /**
+   * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+   * use this to forward aggregator emissions to the dashboard.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Ingest a gate event. Returns the aggregator entry on first sight,
+   * `null` when deduped. Resolution events update the existing record;
+   * unmatched resolutions are dropped silently (caller's gate emitted a
+   * resolved-without-requested pair, which the aggregator does not invent
+   * a record for).
+   */
+  async ingest(event) {
+    await this.hydrate();
+    if (event.phase === "requested") {
+      return this.ingestRequested(event);
+    }
+    if (event.phase === "resolved") {
+      return this.ingestResolved(event);
+    }
+    return null;
+  }
+  /**
+   * List pending or recently resolved entries. Pending entries past TTL
+   * are lazily transitioned to `expired` and persisted before the list
+   * snapshot is returned.
+   */
+  async list(opts) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (opts?.status && entry.status !== opts.status) continue;
+      if (Date.parse(entry.created_at) < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return matching.slice(0, limit);
+  }
+  /**
+   * Return the original (unhashed) request payload for the entry. Returns
+   * `null` when the entry is unknown or the payload was evicted (e.g. the
+   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   */
+  async getFullPayload(aggregatorId) {
+    await this.hydrate();
+    if (!this.entries.has(aggregatorId)) return null;
+    return this.fullPayloads.get(aggregatorId) ?? null;
+  }
+  /**
+   * Resolve an entry. Used by both:
+   *   1. The gate wire-up on channel-decision return.
+   *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+   *
+   * Idempotent: resolving an already-resolved entry is a no-op (the record
+   * keeps its first decision and the audit log is not double-fired).
+   * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+   * routes return 404.
+   */
+  async resolve(aggregatorId, decision, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      throw new Error("approval-aggregator: not_found");
+    }
+    if (entry.status !== "pending") {
+      return entry;
+    }
+    entry.status = decision;
+    entry.resolved_at = this.now().toISOString();
+    entry.resolved_by = operatorId;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: entry.aggregator_id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision,
+        decided_by: operatorId,
+        decided_at: entry.resolved_at
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: ingest paths ─────────────────────────────────────────────
+  async ingestRequested(event) {
+    const ctx = this.resolveSourceContext(event);
+    const auditId = this.auditEntryIdForEvent(event);
+    const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+    const existing = this.dedupIndex.get(dedupKey);
+    if (existing) {
+      const existingEntry = this.entries.get(existing);
+      if (existingEntry) {
+        this.correlationIndex.set(event.correlation_id, existing);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+          this.identityId,
+          {
+            aggregator_id: existing,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: this.derivePolicyRuleId(event),
+            correlation_id: event.correlation_id
+          }
+        );
+        this.emit({ type: "deduped", entry: { ...existingEntry } });
+        return null;
+      }
+    }
+    const id = crypto.randomUUID();
+    const now = this.now();
+    const expires = new Date(now.getTime() + this.pendingTtlMs);
+    const hubInboxId = this.resolveHubInboxItemId(event);
+    const entry = {
+      aggregator_id: id,
+      source_harness: ctx.source_harness,
+      source_agent_id: ctx.source_agent_id,
+      audit_log_entry_id: auditId,
+      policy_rule_id: this.derivePolicyRuleId(event),
+      action_summary: this.deriveActionSummary(event),
+      request_payload_hash: this.hashPayload(event.context),
+      status: "pending",
+      created_at: now.toISOString(),
+      expires_at: expires.toISOString(),
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+    };
+    this.entries.set(id, entry);
+    this.dedupIndex.set(dedupKey, id);
+    this.correlationIndex.set(event.correlation_id, id);
+    this.fullPayloads.set(id, event.context);
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: ctx.source_harness,
+        source_agent_id: ctx.source_agent_id,
+        audit_log_entry_id: auditId,
+        policy_rule_id: entry.policy_rule_id,
+        ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      }
+    );
+    this.emit({ type: "aggregated", entry: { ...entry } });
+    return entry;
+  }
+  async ingestResolved(event) {
+    const id = this.correlationIndex.get(event.correlation_id);
+    if (!id) return null;
+    const entry = this.entries.get(id);
+    if (!entry) return null;
+    if (entry.status !== "pending") return entry;
+    if (!event.resolution) return entry;
+    const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+    const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+    entry.status = status;
+    entry.resolved_at = event.resolution.decided_at;
+    entry.resolved_by = event.resolution.decided_by;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision: status,
+        decided_by: entry.resolved_by,
+        decided_at: entry.resolved_at,
+        fail_closed: failClosed
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: helpers ──────────────────────────────────────────────────
+  /**
+   * Audit-log entry id for the dedup tuple. The audit log itself does not
+   * surface a stable per-entry id (counter-prefixed keys are internal); the
+   * aggregator uses the request timestamp + operation, which together pin
+   * the audit entry the gate appended on the same call.
+   */
+  auditEntryIdForEvent(event) {
+    return `${event.request_timestamp}:${event.operation}`;
+  }
+  derivePolicyRuleId(event) {
+    return `tier${event.tier}:${event.operation}`;
+  }
+  deriveActionSummary(event) {
+    return `${event.operation} (tier ${event.tier})`;
+  }
+  /**
+   * Canonical SHA-256 of the request context. Sorted-keys serialization so
+   * identical payloads always hash the same, even when key insertion order
+   * varies. Defends against payload-replay smuggling (the aggregator can
+   * tell the same payload was seen twice without storing it cleartext).
+   */
+  hashPayload(payload) {
+    const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+    return crypto.createHash("sha256").update(canonical).digest("hex");
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  async expireStale() {
+    const nowMs = this.now().getTime();
+    for (const entry of this.entries.values()) {
+      if (entry.status !== "pending") continue;
+      if (Date.parse(entry.expires_at) > nowMs) continue;
+      entry.status = "expired";
+      entry.resolved_at = this.now().toISOString();
+      entry.resolved_by = "system_ttl";
+      await this.persist(entry);
+      this.auditLog.append(
+        "l2",
+        APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+        this.identityId,
+        {
+          aggregator_id: entry.aggregator_id,
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          audit_log_entry_id: entry.audit_log_entry_id,
+          policy_rule_id: entry.policy_rule_id,
+          decision: "expired",
+          decided_by: "system_ttl",
+          decided_at: entry.resolved_at
+        }
+      );
+      this.emit({ type: "resolved", entry: { ...entry } });
+    }
+  }
+  async persist(entry) {
+    const serialized = stringToBytes(JSON.stringify(entry));
+    const encrypted = encrypt(serialized, this.encryptionKey);
+    await this.storage.write(
+      APPROVAL_AGGREGATOR_NAMESPACE,
+      entry.aggregator_id,
+      stringToBytes(JSON.stringify(encrypted))
+    );
+  }
+  async hydrate() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    try {
+      const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+      for (const meta of metas) {
+        const raw = await this.storage.read(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          meta.key
+        );
+        if (!raw) continue;
+        try {
+          const encrypted = JSON.parse(bytesToString(raw));
+          const decrypted = decrypt(encrypted, this.encryptionKey);
+          const entry = JSON.parse(bytesToString(decrypted));
+          this.entries.set(entry.aggregator_id, entry);
+          const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+          this.dedupIndex.set(dedupKey, entry.aggregator_id);
+        } catch {
+        }
+      }
+    } catch {
+      this.hydrated = false;
+    }
+  }
+};
+
+// src/principal-policy/channels/aggregator-backed-channel.ts
+var DEFAULT_REPLACE_MODE_TIMEOUT_MS = 5 * 60 * 1e3;
+function auditEntryIdFor(request) {
+  return `${request.timestamp}:${request.operation}`;
+}
+function statusToDecision(entry) {
+  switch (entry.status) {
+    case "approved":
+      return {
+        decision: "approve",
+        decided_by: "human"
+      };
+    case "denied":
+      return {
+        decision: "deny",
+        decided_by: "human"
+      };
+    case "timeout":
+    case "expired":
+      return {
+        decision: "deny",
+        decided_by: "timeout"
+      };
+    default:
+      return null;
+  }
+}
+var AggregatorBackedChannel = class {
+  underlying;
+  aggregator;
+  resolveRedirect;
+  replaceModeTimeoutMs;
+  now;
+  constructor(opts) {
+    this.underlying = opts.underlying;
+    this.aggregator = opts.aggregator;
+    this.resolveRedirect = opts.resolveRedirect;
+    this.replaceModeTimeoutMs = opts.replaceModeTimeoutMs ?? DEFAULT_REPLACE_MODE_TIMEOUT_MS;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /** Expose underlying for tests / wire-up reuse. */
+  getUnderlying() {
+    return this.underlying;
+  }
+  async requestApproval(request) {
+    const cfg = this.resolveRedirect(request);
+    if (!cfg.enabled) {
+      return this.underlying.requestApproval(request);
+    }
+    if (cfg.mode === "replace") {
+      return this.awaitAggregatorDecision(request);
+    }
+    return this.notifyMode(request);
+  }
+  /**
+   * `replace` mode. Subscribe to the aggregator's event stream BEFORE
+   * checking already-stored entries (avoids a race where the entry resolves
+   * between list and subscribe). Match incoming events to this request by
+   * audit_entry_id. Time out after `replaceModeTimeoutMs` to honor SEC-002.
+   */
+  async awaitAggregatorDecision(request) {
+    const auditId = auditEntryIdFor(request);
+    return new Promise((resolveOuter) => {
+      let settled = false;
+      let unsubscribe = null;
+      let timeoutHandle = null;
+      const settle = (response) => {
+        if (settled) return;
+        settled = true;
+        if (timeoutHandle) clearTimeout(timeoutHandle);
+        if (unsubscribe) {
+          try {
+            unsubscribe();
+          } catch {
+          }
+        }
+        resolveOuter(response);
+      };
+      const onEvent = (emit) => {
+        if (emit.type !== "resolved") return;
+        if (emit.entry.audit_log_entry_id !== auditId) return;
+        const mapped = statusToDecision(emit.entry);
+        if (!mapped) return;
+        settle({
+          decision: mapped.decision,
+          decided_at: emit.entry.resolved_at ?? this.now().toISOString(),
+          decided_by: mapped.decided_by
+        });
+      };
+      try {
+        unsubscribe = this.aggregator.onEvent(onEvent);
+      } catch (err) {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "channel_failure"
+        });
+        throw err instanceof Error ? err : new Error(String(err));
+      }
+      void this.aggregator.list({ limit: 200 }).then((entries) => {
+        for (const entry of entries) {
+          if (entry.audit_log_entry_id !== auditId) continue;
+          const mapped = statusToDecision(entry);
+          if (!mapped) return;
+          settle({
+            decision: mapped.decision,
+            decided_at: entry.resolved_at ?? this.now().toISOString(),
+            decided_by: mapped.decided_by
+          });
+          return;
+        }
+      }).catch(() => {
+      });
+      timeoutHandle = setTimeout(() => {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "timeout"
+        });
+      }, this.replaceModeTimeoutMs);
+    });
+  }
+  /**
+   * `notify` mode. Fire the underlying channel and listen on the
+   * aggregator simultaneously; whichever resolves first wins. Both
+   * paths produce identical `ApprovalResponse` shapes; the gate's
+   * downstream audit logging is unchanged.
+   *
+   * On underlying-channel failure, fall through to the aggregator wait
+   * (still bounded by `replaceModeTimeoutMs`). Operator can still
+   * resolve from the inbox even if the dashboard/webhook is down.
+   */
+  async notifyMode(request) {
+    const aggregatorPromise = this.awaitAggregatorDecision(request);
+    let underlyingPromise;
+    try {
+      underlyingPromise = this.underlying.requestApproval(request);
+    } catch (err) {
+      const response = await aggregatorPromise;
+      return response;
+    }
+    return Promise.race([
+      aggregatorPromise,
+      underlyingPromise.catch(
+        () => new Promise(() => {
+        })
+      )
+    ]);
+  }
+};
+function makeRedirectResolverFromPolicySupplier(supplier) {
+  return (_request) => {
+    const cfg = supplier().approval_redirect;
+    if (!cfg || cfg.enabled !== true) {
+      return { enabled: false, mode: "replace" };
+    }
+    return {
+      enabled: true,
+      mode: cfg.mode === "notify" ? "notify" : "replace"
+    };
+  };
+}
+
+// src/principal-policy/tools.ts
+function createPrincipalPolicyTools(policy, baseline, auditLog) {
+  return [
+    {
+      name: "principal_policy_view",
+      description: "View the current Principal Policy \u2014 the human-controlled rules governing what operations require approval. Read-only.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          include_defaults: {
+            type: "boolean",
+            description: "Include tier3_always_allow list (can be long)",
+            default: false
+          }
+        }
+      },
+      handler: async (args) => {
+        const includeDefaults = args.include_defaults ?? false;
+        const view = {
+          version: policy.version,
+          tier1_always_approve: policy.tier1_always_approve,
+          tier2_anomaly: policy.tier2_anomaly,
+          approval_channel: {
+            type: policy.approval_channel.type,
+            timeout_seconds: policy.approval_channel.timeout_seconds,
+            auto_deny: true
+            // SEC-002: hardcoded, not configurable
+          }
+        };
+        if (includeDefaults) {
+          view.tier3_always_allow = policy.tier3_always_allow;
+        } else {
+          view.tier3_always_allow_count = policy.tier3_always_allow.length;
+          view.note = "Pass include_defaults: true to see the full tier3_always_allow list";
+        }
+        auditLog.append("l2", "principal_policy_view", "system", {
+          include_defaults: includeDefaults
+        });
+        return toolResult(view);
+      }
+    },
+    {
+      name: "principal_baseline_view",
+      description: "View the current behavioral baseline \u2014 the session profile used for anomaly detection. Shows known namespaces, counterparties, and tool call counts. Read-only.",
       inputSchema: {
         type: "object",
         properties: {}
@@ -19743,6 +20703,71 @@ function verifyAttestation(attestation, now) {
   };
 }
 
+// src/handshake/audit.ts
+var HANDSHAKE_LIFECYCLE_OPS = {
+  INITIATED: "handshake_initiated",
+  COMPLETED: "handshake_completed",
+  FAILED: "handshake_failed",
+  ABORTED: "handshake_aborted"
+};
+function auditHandshakeInitiated(auditLog, ctx) {
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.INITIATED,
+    ctx.identity_id,
+    detailsFromContext(ctx),
+    "success"
+  );
+}
+function auditHandshakeCompleted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  if (ctx.trust_tier !== void 0) {
+    details.trust_tier = ctx.trust_tier;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.COMPLETED,
+    ctx.identity_id,
+    details,
+    "success"
+  );
+}
+function auditHandshakeFailed(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  if (ctx.error !== void 0) {
+    details.error = ctx.error;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.FAILED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function auditHandshakeAborted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.ABORTED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function detailsFromContext(ctx) {
+  const details = {
+    session_id: ctx.session_id,
+    role: ctx.role
+  };
+  if (ctx.counterparty_id !== void 0) {
+    details.counterparty_id = ctx.counterparty_id;
+  }
+  return details;
+}
+
 // src/handshake/tools.ts
 function createHandshakeTools(config, identityManager, masterKey, auditLog, options) {
   const autoPublishHandshakes = options?.autoPublishHandshakes ?? false;
@@ -19776,6 +20801,11 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const { challenge, session } = initiateHandshake(shr);
         sessions.set(session.session_id, session);
         auditLog.append("l4", "handshake_initiate", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: session.session_id,
+          role: "initiator",
+          identity_id: shr.body.instance_id
+        });
         return toolResult({
           session_id: session.session_id,
           challenge,
@@ -19815,10 +20845,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         );
         if ("error" in result) {
           auditLog.append("l4", "handshake_respond", shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: "unknown",
+            role: "responder",
+            identity_id: shr.body.instance_id,
+            reason: classifyRespondFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         sessions.set(result.session.session_id, result.session);
         auditLog.append("l4", "handshake_respond", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: result.session.session_id,
+          role: "responder",
+          identity_id: shr.body.instance_id,
+          counterparty_id: challenge.shr.body.instance_id
+        });
         let autoPublishResult;
         if (autoPublishHandshakes) {
           autoPublishResult = { attempted: true };
@@ -19926,9 +20969,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const response = args.response;
         const session = sessions.get(sessionId);
         if (!session) {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: "unknown",
+            reason: "session_unknown",
+            error: `No handshake session found: ${sessionId}`
+          });
           return toolResult({ error: `No handshake session found: ${sessionId}` });
         }
         if (session.state !== "initiated") {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: "session_state_mismatch",
+            error: `Session is in state '${session.state}', expected 'initiated'`
+          });
           return toolResult({
             error: `Session is in state '${session.state}', expected 'initiated'`
           });
@@ -19942,6 +20999,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         if ("error" in result) {
           session.state = "failed";
           auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: classifyCompleteFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         session.state = "completed";
@@ -19950,6 +21014,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         session.result = result.result;
         handshakeResults.set(result.result.counterparty_id, result.result);
         auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id);
+        auditHandshakeCompleted(auditLog, {
+          session_id: sessionId,
+          role: "initiator",
+          identity_id: session.our_shr.body.instance_id,
+          counterparty_id: result.result.counterparty_id,
+          trust_tier: result.result.trust_tier
+        });
         return toolResult({
           completion: result.completion,
           result: result.result,
@@ -19997,6 +21068,24 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
             void 0,
             result.verified ? "success" : "failure"
           );
+          if (result.verified) {
+            auditHandshakeCompleted(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              trust_tier: result.trust_tier
+            });
+          } else {
+            auditHandshakeFailed(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              reason: classifyCompleteFailure(result.errors.join("; ")),
+              error: result.errors.join("; ")
+            });
+          }
           return toolResult({ result });
         }
         return toolResult({
@@ -20104,10 +21193,74 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
           _content_trust: "external"
         });
       }
+    },
+    {
+      name: "handshake_abort",
+      description: "Abort an in-flight handshake session. Drops the session record and appends a session-lifecycle audit entry (handshake_aborted) so the operator can distinguish operator-cancelled, timed-out, and dropped sessions from sessions that simply fell off the protocol path.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          session_id: {
+            type: "string",
+            description: "Session ID returned from handshake_initiate / handshake_respond."
+          },
+          reason: {
+            type: "string",
+            enum: [
+              "operator_cancelled",
+              "session_timeout",
+              "transport_dropped",
+              "shutdown",
+              "other"
+            ],
+            description: "Why the session is being aborted. Defaults to 'operator_cancelled'."
+          }
+        },
+        required: ["session_id"]
+      },
+      handler: async (args) => {
+        const sessionId = args.session_id;
+        const reason = args.reason ?? "operator_cancelled";
+        const session = sessions.get(sessionId);
+        if (!session) {
+          return toolResult({ error: `No handshake session found: ${sessionId}` });
+        }
+        if (session.state === "completed") {
+          return toolResult({
+            error: `Session ${sessionId} already completed; abort is only valid for in-flight sessions`
+          });
+        }
+        sessions.delete(sessionId);
+        auditHandshakeAborted(auditLog, {
+          session_id: sessionId,
+          role: session.role,
+          identity_id: session.our_shr.body.instance_id,
+          ...session.their_shr ? { counterparty_id: session.their_shr.body.instance_id } : {},
+          reason
+        });
+        return toolResult({
+          aborted: true,
+          session_id: sessionId,
+          reason
+        });
+      }
     }
   ];
   return { tools, handshakeResults };
 }
+function classifyRespondFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed")) return "shr_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
+function classifyCompleteFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed") || error.includes("SHR")) return "shr_invalid";
+  if (error.includes("nonce signature is invalid")) return "nonce_signature_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
 
 // src/federation/registry.ts
 var DEFAULT_CAPABILITIES = {
@@ -21725,6 +22878,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = path.join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await promises.rm(markerPath, { force: true });
+    await promises.rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -21749,7 +22908,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await promises.writeFile(consumedPath, "", "utf-8");
   await promises.rm(markerPath, { force: true });
+  await promises.rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -30693,7 +31854,37 @@ var HubService = class {
    */
   async getConciergeHistory() {
     const chat = this.requireOperatorChat();
-    return chat.getConciergeHistory();
+    return chat.getConciergeHistory();
+  }
+  // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+  /**
+   * Whether the operator-chat service has the WP-V1.3-9 memory store
+   * wired. Routes use this to 503 cleanly when the foundation memory
+   * surface is unavailable on a given fortress.
+   */
+  hasConciergeMemory() {
+    return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+  }
+  async listConciergeMemoryThreads(opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.listConciergeMemoryThreads(opts);
+  }
+  async readConciergeMemoryThread(threadId, opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.readConciergeMemoryThread(threadId, opts);
+  }
+  async deleteConciergeMemoryThread(threadId) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.deleteConciergeMemoryThread(threadId);
   }
   /**
    * Open the click-to-inspect/approve panel for a wrapped agent. The
@@ -30782,7 +31973,28 @@ init_encoding();
 
 // src/chat/operator-chat-audit-events.ts
 var OPERATOR_CHAT_OPS = {
-  CONCIERGE_CHAT: "operator_concierge_chat"};
+  CONCIERGE_CHAT: "operator_concierge_chat",
+  /**
+   * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+   * when the operator hits the list-threads or read-thread route. Body
+   * carries the thread_id (or `*` for the list endpoint) and a count;
+   * raw turn content never crosses the audit surface.
+   */
+  CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+  /**
+   * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+   * successful thread removal. Body carries thread_id + turn_count of
+   * the deleted bundle.
+   */
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted",
+  /**
+   * Concierge memory fold-read failed (WP-V1.3-9 Tau-2). Emitted when
+   * the multi-turn coherence fold cannot load the active thread's prior
+   * turns; the concierge degrades to single-turn after emitting. Body
+   * carries thread_id + a stable failure_reason enum.
+   */
+  CONCIERGE_MEMORY_READ_FAILED: "operator_concierge_memory_read_failed"
+};
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
@@ -30790,6 +32002,13 @@ var CONCIERGE_THREAD_KEY = "_fortress";
 
 // src/chat/operator-chat-service.ts
 var DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+var DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
+var DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
+var DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function approxTokenLen(text) {
+  return Math.ceil(text.length / 4);
+}
 var SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
 1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
 2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
@@ -30825,6 +32044,27 @@ var OperatorChatService = class {
   contextProviders;
   piiFilter;
   conciergeMaxTokens;
+  memory;
+  historyWindowTurns;
+  historyFreshnessMs;
+  historyTokenBudget;
+  sessionTtlMs;
+  clock;
+  /**
+   * In-memory thread_id assigned to the active concierge session.
+   * The first sendConcierge call after construction allocates a fresh
+   * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+   * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+   */
+  activeMemoryThreadId;
+  /**
+   * Wall-clock ms of the most recent sendConcierge that touched the
+   * active session thread. Drives the WP-V1.3-9 Tau-2 session-TTL
+   * check: a fresh sendConcierge after `sessionTtlMs` of quiet
+   * allocates a new thread_id even though the prior one is still
+   * readable from the memory store.
+   */
+  lastInteractionAt;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -30835,6 +32075,12 @@ var OperatorChatService = class {
     }
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+    if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
+    this.historyWindowTurns = deps.conciergeHistoryWindowTurns !== void 0 && deps.conciergeHistoryWindowTurns > 0 ? deps.conciergeHistoryWindowTurns : DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS;
+    this.historyFreshnessMs = deps.conciergeHistoryFreshnessMs !== void 0 && deps.conciergeHistoryFreshnessMs > 0 ? deps.conciergeHistoryFreshnessMs : DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS;
+    this.historyTokenBudget = deps.conciergeHistoryTokenBudget !== void 0 && deps.conciergeHistoryTokenBudget > 0 ? deps.conciergeHistoryTokenBudget : DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET;
+    this.sessionTtlMs = deps.conciergeSessionTtlMs !== void 0 && deps.conciergeSessionTtlMs > 0 ? deps.conciergeSessionTtlMs : DEFAULT_CONCIERGE_SESSION_TTL_MS;
+    this.clock = deps.conciergeClock ?? (() => Date.now());
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -30853,6 +32099,10 @@ var OperatorChatService = class {
       throw new Error("concierge query must not be empty");
     }
     const filterResult = this.piiFilter ? this.piiFilter.filter(trimmed) : { filtered: trimmed, redactions: 0 };
+    const nowMs = this.clock();
+    if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
+      this.activeMemoryThreadId = void 0;
+    }
     const operatorMessage = {
       message_id: crypto.randomUUID(),
       surface: "concierge",
@@ -30865,6 +32115,30 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    let priorTurns = [];
+    let memoryReadFailureReason = null;
+    let activeThreadIdForRound;
+    if (this.memory) {
+      activeThreadIdForRound = this.ensureActiveMemoryThread();
+      const result = await this.memory.readThreadStrict(activeThreadIdForRound).catch(() => ({ ok: false, reason: "io_failed" }));
+      if (result.ok) {
+        const cutoff = nowMs - this.historyFreshnessMs;
+        const fresh = result.turns.filter((t) => {
+          const ts = Date.parse(t.created_at);
+          return Number.isFinite(ts) && ts >= cutoff;
+        });
+        const recent = fresh.length > this.historyWindowTurns ? fresh.slice(fresh.length - this.historyWindowTurns) : fresh;
+        priorTurns = recent;
+      } else {
+        memoryReadFailureReason = result.reason;
+        this.emitMemoryReadFailed(activeThreadIdForRound, result.reason);
+      }
+    }
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+      });
+    }
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -30881,7 +32155,7 @@ var OperatorChatService = class {
           conciergeBody = "Concierge unavailable. The chosen substrate does not support summarization. Pick a different substrate in the Policy center.";
           outcome = "substrate_disabled";
         } else {
-          const context = await this.assembleConciergeContext();
+          const context = await this.assembleConciergeContext(priorTurns);
           const response = await this.substrateSelector.invokeSummarize(
             "concierge",
             {
@@ -30920,6 +32194,15 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    let assistantTurnId;
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      const persisted = await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => void 0);
+      if (persisted) assistantTurnId = persisted.turn_id;
+    }
+    if (this.memory && activeThreadIdForRound) {
+      this.lastInteractionAt = nowMs;
+    }
     const payload = {
       version: "1.2",
       event_id: makeEventId("conc"),
@@ -30931,7 +32214,12 @@ var OperatorChatService = class {
       response_hash: outcome === "ok" ? hashOf(conciergeBody) : null,
       substrate: servedBy,
       latency_ms: latencyMs,
-      outcome
+      outcome,
+      ...activeThreadIdForRound !== void 0 ? { thread_id: activeThreadIdForRound } : {},
+      ...assistantTurnId !== void 0 ? { turn_index: assistantTurnId } : {},
+      ...this.memory ? {
+        prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
+      } : {}
     };
     this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
     return {
@@ -30941,6 +32229,25 @@ var OperatorChatService = class {
       outcome
     };
   }
+  /**
+   * Emit the WP-V1.3-9 Tau-2 graceful-degradation audit event. Pulled
+   * out of `sendConcierge` so the read-fold path stays readable. Emits
+   * with `result: "failure"` since the concierge fell back to
+   * single-turn mode for this round-trip.
+   */
+  emitMemoryReadFailed(threadId, reason) {
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-memfail"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_memory_read_failed",
+      surface: "concierge",
+      thread_id: threadId,
+      failure_reason: reason
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_MEMORY_READ_FAILED, payload, "failure");
+  }
   /**
    * Read the persisted concierge thread, oldest message first. Returns
    * an empty array when no thread exists yet.
@@ -30952,6 +32259,105 @@ var OperatorChatService = class {
     );
     return thread ? thread.messages : [];
   }
+  // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+  /**
+   * Whether the foundation memory store is wired. Routes use this to
+   * 503 cleanly when called against an unwired service.
+   */
+  hasConciergeMemory() {
+    return this.memory !== void 0;
+  }
+  /**
+   * List concierge memory threads, newest-first. Emits the
+   * `operator_concierge_history_read` audit event with `thread_id="*"`.
+   */
+  async listConciergeMemoryThreads(opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const summaries = await this.memory.listThreads(opts);
+    const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: "*",
+      turn_count: totalTurns
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return summaries;
+  }
+  /**
+   * Read a concierge memory thread, oldest turn first. Emits the
+   * `operator_concierge_history_read` audit event with the named
+   * thread_id and the count of turns surfaced.
+   */
+  async readConciergeMemoryThread(threadId, opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turns = await this.memory.readThread(threadId, opts);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turns.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return turns;
+  }
+  /**
+   * Delete a concierge memory thread. Emits
+   * `operator_concierge_thread_deleted` only when a bundle was actually
+   * removed; absent threads return false without an audit event.
+   */
+  async deleteConciergeMemoryThread(threadId) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turnsBefore = await this.memory.readThread(threadId);
+    if (turnsBefore.length === 0) {
+      return await this.memory.deleteThread(threadId);
+    }
+    const removed = await this.memory.deleteThread(threadId);
+    if (!removed) return false;
+    if (this.activeMemoryThreadId === threadId) {
+      this.activeMemoryThreadId = void 0;
+    }
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-del"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_thread_deleted",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turnsBefore.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+    return true;
+  }
+  /**
+   * Reset the active session memory thread. Subsequent sendConcierge
+   * calls allocate a fresh thread_id. Surfaced for tests + future "new
+   * conversation" affordance; not currently called by the dashboard.
+   */
+  resetConciergeMemoryThread() {
+    this.activeMemoryThreadId = void 0;
+  }
+  ensureActiveMemoryThread() {
+    if (!this.activeMemoryThreadId) {
+      this.activeMemoryThreadId = crypto.randomUUID();
+    }
+    return this.activeMemoryThreadId;
+  }
   /**
    * Stitch fortress state into a single context blob the substrate
    * folds into its summarization prompt.
@@ -30964,6 +32370,11 @@ var OperatorChatService = class {
    *   ## Sanctuary reference
    *   <static domain reference block>
    *
+   *   ## Prior conversation             ← WP-V1.3-9 Tau-2, when present
+   *   OPERATOR: ...
+   *   CONCIERGE: ...
+   *   ---
+   *
    *   ## Recent activity
    *   <recentActivity output>
    *
@@ -30973,37 +32384,69 @@ var OperatorChatService = class {
    *   ## Open inbox
    *   <openInbox output>
    *   ```
+   *
+   * The substrate selector ships a `context: string` shape (not a
+   * messages array), so multi-turn coherence is folded as a structured
+   * prior-conversation section with explicit OPERATOR / CONCIERGE
+   * boundaries. Coordinator-CTO guidance: prefer messages-array shape
+   * if available; the v1.2 selector does not expose one, so structured
+   * serialization is the canonical path for v1.3.
    */
-  async assembleConciergeContext() {
+  async assembleConciergeContext(priorTurns = []) {
     const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
+    const priorSection = this.formatPriorTurnsSection(priorTurns);
     if (!this.contextProviders) {
-      return `${ref}
-
-## Recent activity
-(no providers wired)
-
-## Wrapped agents
-(no providers wired)
-
-## Open inbox
-(no providers wired)`;
+      return [
+        ref,
+        ...priorSection ? [priorSection] : [],
+        "## Recent activity\n(no providers wired)",
+        "## Wrapped agents\n(no providers wired)",
+        "## Open inbox\n(no providers wired)"
+      ].join("\n\n");
     }
     const [activity, agents, inbox] = await Promise.all([
       this.contextProviders.recentActivity(),
       this.contextProviders.agentInventory(),
       this.contextProviders.openInbox()
     ]);
-    return `${ref}
-
-## Recent activity
-${activity}
-
-## Wrapped agents
-${agents}
-
-## Open inbox
-${inbox}`;
+    return [
+      ref,
+      ...priorSection ? [priorSection] : [],
+      `## Recent activity
+${activity}`,
+      `## Wrapped agents
+${agents}`,
+      `## Open inbox
+${inbox}`
+    ].join("\n\n");
+  }
+  /**
+   * Render the prior-conversation section with token-budget enforcement
+   * (WP-V1.3-9 Tau-2). Drops oldest turns first when the rendered
+   * section exceeds `historyTokenBudget`. Returns an empty string when
+   * the input is empty or when the budget excludes every turn.
+   */
+  formatPriorTurnsSection(turns) {
+    if (turns.length === 0) return "";
+    const HEADER = "## Prior conversation";
+    const lines = turns.map(formatPriorTurnLine);
+    const headerTokens = approxTokenLen(`${HEADER}
+`);
+    const sepTokens = approxTokenLen("\n");
+    let runningTokens = headerTokens;
+    let runningLines = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      const tokens = approxTokenLen(line) + (runningLines.length > 0 ? sepTokens : 0);
+      if (runningTokens + tokens > this.historyTokenBudget) break;
+      runningTokens += tokens;
+      runningLines.push(line);
+    }
+    if (runningLines.length === 0) return "";
+    runningLines = runningLines.reverse();
+    return `${HEADER}
+${runningLines.join("\n")}`;
   }
   // ── audit helpers ────────────────────────────────────────────────────
   emit(operation, payload, result) {
@@ -31019,6 +32462,10 @@ ${inbox}`;
 function makeEventId(prefix) {
   return `${prefix}-${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
 }
+function formatPriorTurnLine(turn) {
+  const label = turn.role === "user" ? "OPERATOR" : "CONCIERGE";
+  return `${label}: ${turn.content}`;
+}
 function hashOf(input) {
   return hashToString(sha256.sha256(stringToBytes(input)));
 }
@@ -31115,6 +32562,297 @@ var OperatorChatStore = class {
   }
 };
 
+// src/chat/concierge-memory-store.ts
+init_encryption();
+init_encoding();
+var CONCIERGE_MEMORY_NAMESPACE = "_chat";
+var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+var HKDF_INFO2 = "concierge-memory-store-v1";
+var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var ConciergeMemoryStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  locks;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+    this.locks = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Append a turn to the named thread, creating the bundle if no record
+   * exists. Returns the persisted turn (with assigned turn_id +
+   * retention_until). Per-thread serialisation guarantees turn_id
+   * monotonicity even under concurrent callers.
+   */
+  async appendTurn(threadId, role, content) {
+    return this.withLock(threadId, async () => {
+      const bundle = await this.loadBundle(threadId) ?? null;
+      const now = /* @__PURE__ */ new Date();
+      const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+      const retentionUntil = new Date(now.getTime() + retentionMs);
+      const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+      const turn = {
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        turn_id: nextTurnId,
+        role,
+        content,
+        created_at: now.toISOString(),
+        retention_until: retentionUntil.toISOString()
+      };
+      const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+        version: 1,
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        created_at: now.toISOString(),
+        turns: [turn]
+      };
+      await this.saveBundle(next);
+      return turn;
+    });
+  }
+  /**
+   * Read turns from a thread, oldest-first. Returns an empty array if
+   * the thread does not exist or its bundle is corrupt. Does not emit
+   * audit events; the caller (HTTP route handler) owns audit semantics.
+   */
+  async readThread(threadId, opts) {
+    const bundle = await this.loadBundle(threadId);
+    if (!bundle) return [];
+    let turns = bundle.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return turns;
+  }
+  /**
+   * Read turns with explicit failure surfacing (WP-V1.3-9 Tau-2). Where
+   * `readThread` collapses every failure mode to an empty array, this
+   * variant returns a discriminated result so the multi-turn fold path
+   * can degrade cleanly + emit `operator_concierge_memory_read_failed`
+   * with a concrete cause.
+   *
+   * - No bundle on disk → `{ ok: true, turns: [] }` (a fresh thread).
+   * - Bundle present, decode + decrypt + schema check pass → ok with turns.
+   * - Bundle present, oversize → `{ ok: false, reason: "oversize_bundle" }`.
+   * - Bundle present, decryption fails → `{ ok: false, reason: "decrypt_failed" }`.
+   * - Bundle present, schema mismatch (version / thread_id) → `schema_mismatch`.
+   * - Storage IO error → `io_failed`.
+   */
+  async readThreadStrict(threadId, opts) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return { ok: false, reason: "io_failed" };
+    }
+    if (!raw) return { ok: true, turns: [] };
+    if (raw.length > MAX_BUNDLE_BYTES2) {
+      return { ok: false, reason: "oversize_bundle" };
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(bytesToString(raw));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let plaintext;
+    try {
+      const aad = stringToBytes(threadId);
+      plaintext = decrypt(envelope, this.encryptionKey, aad);
+    } catch {
+      return { ok: false, reason: "decrypt_failed" };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(bytesToString(plaintext));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    if (parsed.version !== 1) return { ok: false, reason: "schema_mismatch" };
+    if (parsed.thread_id !== threadId) {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let turns = parsed.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return { ok: true, turns };
+  }
+  /**
+   * Enumerate concierge threads in this fortress with summary metadata.
+   * Sorted newest-first by last_turn_at.
+   */
+  async listThreads(opts) {
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    const summaries = [];
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      const bundle = await this.loadBundle(threadId);
+      if (!bundle || bundle.turns.length === 0) continue;
+      const last = bundle.turns[bundle.turns.length - 1];
+      summaries.push({
+        thread_id: bundle.thread_id,
+        created_at: bundle.created_at,
+        last_turn_at: last ? last.created_at : bundle.created_at,
+        turn_count: bundle.turns.length
+      });
+    }
+    summaries.sort(
+      (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+    );
+    if (opts?.limit !== void 0) {
+      return summaries.slice(0, opts.limit);
+    }
+    return summaries;
+  }
+  /**
+   * Delete a thread's bundle. Returns true if the bundle existed and
+   * was removed; false if no bundle was present. Audit emission is the
+   * caller's responsibility.
+   */
+  async deleteThread(threadId) {
+    const key = bundleKey(threadId);
+    return this.withLock(threadId, async () => {
+      const existed = await this.storage.exists(
+        CONCIERGE_MEMORY_NAMESPACE,
+        key
+      );
+      if (!existed) return false;
+      try {
+        await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+      } catch {
+        return false;
+      }
+      return true;
+    });
+  }
+  /**
+   * Drop expired turns across all threads. Threads emptied by pruning
+   * are removed entirely. Returns the count of turns pruned.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      pruned += await this.withLock(threadId, async () => {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return 0;
+        const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+        const dropped = bundle.turns.length - kept.length;
+        if (dropped === 0) return 0;
+        if (kept.length === 0) {
+          await this.storage.delete(
+            CONCIERGE_MEMORY_NAMESPACE,
+            bundleKey(threadId)
+          );
+        } else {
+          await this.saveBundle({ ...bundle, turns: kept });
+        }
+        return dropped;
+      });
+    }
+    return { pruned };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  async loadBundle(threadId) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(threadId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.thread_id !== threadId) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async saveBundle(bundle) {
+    const key = bundleKey(bundle.thread_id);
+    const aad = stringToBytes(bundle.thread_id);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      CONCIERGE_MEMORY_NAMESPACE,
+      key,
+      stringToBytes(JSON.stringify(envelope))
+    );
+  }
+  /**
+   * Run `task` while holding the per-thread async lock. Lock is released
+   * once the task settles (success or failure). Generic helper so
+   * appendTurn / deleteThread / pruneExpired share serialisation.
+   */
+  async withLock(threadId, task) {
+    const previous = this.locks.get(threadId) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve6) => {
+      release = resolve6;
+    });
+    const chained = previous.then(() => next);
+    this.locks.set(threadId, chained);
+    try {
+      await previous;
+      return await task();
+    } finally {
+      release();
+      if (this.locks.get(threadId) === chained) {
+        this.locks.delete(threadId);
+      }
+    }
+  }
+};
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+
 // src/dashboard/v1_1/wiring.ts
 var CapabilityErrorAgentController = class {
   fail(action) {
@@ -31153,6 +32891,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -31163,7 +32909,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -31355,13 +33102,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO2 = "intelligence-substrate-config";
+var HKDF_INFO3 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -33500,7 +35247,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -33509,6 +35258,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -33528,7 +35287,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 
@@ -33918,7 +35677,7 @@ async function resolveSourceMasterKey(encryptedState, opts) {
   }
   return null;
 }
-async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId) {
+async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId, importedRekeyEntries) {
   const destinationSigner = opts.destinationSignerIdentityId ? opts.identityManager.get(opts.destinationSignerIdentityId) : opts.identityManager.getDefault();
   if (!destinationSigner) {
     return {
@@ -33980,8 +35739,9 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         }
       }
     }
+    let plaintext;
     try {
-      const plaintext = decrypt(
+      plaintext = decrypt(
         item.entry.payload,
         deriveNamespaceKey(sourceMasterKey, item.namespace)
       );
@@ -33990,28 +35750,30 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         skipped++;
         continue;
       }
-      await stateStore.write(
-        item.namespace,
-        item.key,
-        bytesToString(plaintext),
-        destinationSigner.identity_id,
-        destinationSigner.encrypted_private_key,
-        identityEncryptionKey,
-        {
-          content_type: item.entry.metadata.content_type,
-          ttl_seconds: item.entry.metadata.ttl_seconds,
-          tags: [
-            ...item.entry.metadata.tags ?? [],
-            "exit-import",
-            `source:${item.entry.kid}`
-          ]
-        }
-      );
-      imported++;
     } catch {
       skippedInvalidSig++;
       skipped++;
+      continue;
     }
+    await stateStore.write(
+      item.namespace,
+      item.key,
+      bytesToString(plaintext),
+      destinationSigner.identity_id,
+      destinationSigner.encrypted_private_key,
+      identityEncryptionKey,
+      {
+        content_type: item.entry.metadata.content_type,
+        ttl_seconds: item.entry.metadata.ttl_seconds,
+        tags: [
+          ...item.entry.metadata.tags ?? [],
+          "exit-import",
+          `source:${item.entry.kid}`
+        ]
+      }
+    );
+    imported++;
+    importedRekeyEntries?.push({ namespace: item.namespace, key: item.key });
   }
   return {
     status: "rekeyed",
@@ -34022,6 +35784,23 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
     conflicts
   };
 }
+async function cleanupStagedPaths(storage, staged) {
+  let removed = 0;
+  const failed = [];
+  for (const loc of staged) {
+    try {
+      const ok = await storage.delete(loc.namespace, loc.key);
+      if (ok) {
+        removed++;
+      } else {
+        failed.push(loc);
+      }
+    } catch {
+      failed.push(loc);
+    }
+  }
+  return { removed, failed };
+}
 async function stageArtifact(storage, namespace, key, value) {
   await storage.write(namespace, key, jsonBytes(value));
 }
@@ -34146,6 +35925,8 @@ async function importExitBundle(opts) {
   }
   const importId = importIdForManifest(manifest);
   const stagedArtifacts = [];
+  const stagedLocations = [];
+  const importedRekeyEntries = [];
   if (identityArtifact) {
     await stageArtifact(
       opts.storage,
@@ -34154,10 +35935,15 @@ async function importExitBundle(opts) {
       identityArtifact.json
     );
     stagedArtifacts.push("public_identity");
+    stagedLocations.push({
+      namespace: EXIT_PUBLIC_IDENTITIES_NAMESPACE,
+      key: identityArtifact.json.bundle.identity_id
+    });
   }
   if (policySet) {
     await stageArtifact(opts.storage, EXIT_POLICY_SETS_NAMESPACE, importId, policySet.json);
     stagedArtifacts.push("policy_set");
+    stagedLocations.push({ namespace: EXIT_POLICY_SETS_NAMESPACE, key: importId });
   }
   if (auditReceipts) {
     await stageArtifact(
@@ -34167,10 +35953,12 @@ async function importExitBundle(opts) {
       auditReceipts.json
     );
     stagedArtifacts.push("audit_receipts");
+    stagedLocations.push({ namespace: EXIT_AUDIT_RECEIPTS_NAMESPACE, key: importId });
   }
   if (commitments) {
     await stageArtifact(opts.storage, EXIT_COMMITMENTS_NAMESPACE, importId, commitments.json);
     stagedArtifacts.push("commitments");
+    stagedLocations.push({ namespace: EXIT_COMMITMENTS_NAMESPACE, key: importId });
   }
   if (placeholderMetadata) {
     await stageArtifact(
@@ -34180,12 +35968,17 @@ async function importExitBundle(opts) {
       placeholderMetadata.json
     );
     stagedArtifacts.push("placeholder_vault_metadata");
+    stagedLocations.push({
+      namespace: EXIT_PLACEHOLDER_METADATA_NAMESPACE,
+      key: importId
+    });
   }
   await stageArtifact(opts.storage, EXIT_IMPORT_NAMESPACE, importId, {
     manifest: manifest.body,
     verified_at: verification.verified_at,
     activated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
+  stagedLocations.push({ namespace: EXIT_IMPORT_NAMESPACE, key: importId });
   const publicKeys = identityArtifact ? publicKeysFromIdentityArtifact(identityArtifact.json) : { byIdentityId: /* @__PURE__ */ new Map(), byDid: /* @__PURE__ */ new Map() };
   let reputationResult = {
     imported_attestations: 0,
@@ -34210,26 +36003,57 @@ async function importExitBundle(opts) {
     encryptedState?.json ?? null,
     opts
   );
-  const stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
-    encryptedState.json,
-    opts,
-    sourceMasterKey,
-    publicKeys.byIdentityId
-  ) : {
-    status: "staged_requires_source_key",
-    imported_keys: 0,
-    skipped_keys: encryptedState.json.entries.length,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: conflicts.state_conflicts.length
-  } : {
-    status: "not_requested",
-    imported_keys: 0,
-    skipped_keys: 0,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: 0
-  };
+  let stateResult;
+  try {
+    stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
+      encryptedState.json,
+      opts,
+      sourceMasterKey,
+      publicKeys.byIdentityId,
+      importedRekeyEntries
+    ) : {
+      status: "staged_requires_source_key",
+      imported_keys: 0,
+      skipped_keys: encryptedState.json.entries.length,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: conflicts.state_conflicts.length
+    } : {
+      status: "not_requested",
+      imported_keys: 0,
+      skipped_keys: 0,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: 0
+    };
+  } catch (err) {
+    const toCleanup = [
+      ...importedRekeyEntries,
+      ...stagedLocations
+    ];
+    const cleanup = await cleanupStagedPaths(opts.storage, toCleanup);
+    opts.auditLog.append(
+      "l1",
+      "exit_bundle_rekey_failed_cleanup",
+      manifest.body.identity_binding.identity_id,
+      {
+        import_id: importId,
+        manifest_version: manifest.body.manifest_version,
+        rekey_entries_removed: importedRekeyEntries.length,
+        staged_artifacts_removed: stagedLocations.length,
+        removed_total: cleanup.removed,
+        cleanup_failed_count: cleanup.failed.length,
+        original_error: err instanceof Error ? err.message : String(err)
+      },
+      "failure"
+    );
+    await opts.auditLog.flush();
+    const originalMessage = err instanceof Error ? err.message : String(err);
+    throw new ExitBundleImportError(
+      "REKEY_FAILED_AND_CLEANED",
+      `Exit-bundle re-key failed: ${originalMessage}. Cleanup removed ${cleanup.removed} of ${toCleanup.length} staged paths (${importedRekeyEntries.length} re-keyed entries plus ${stagedLocations.length} staged artifacts; ${cleanup.failed.length} cleanup deletes failed).`
+    );
+  }
   opts.auditLog.append("l1", "exit_bundle_import_activate", manifest.body.identity_binding.identity_id, {
     import_id: importId,
     manifest_version: manifest.body.manifest_version,
@@ -34455,7 +36279,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -35107,7 +36943,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -35204,7 +37052,35 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
       timestamp: alert.timestamp
     });
   } : void 0;
-  const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  const wrappedApprovalChannel = new AggregatorBackedChannel({
+    underlying: approvalChannel,
+    aggregator: approvalAggregator,
+    resolveRedirect: makeRedirectResolverFromPolicySupplier(() => policy),
+    replaceModeTimeoutMs: policy.approval_channel.timeout_seconds * 1e3
+  });
+  const gate = new ApprovalGate(
+    policy,
+    baseline,
+    wrappedApprovalChannel,
+    auditLog,
+    injectionDetector,
+    onInjectionAlert
+  );
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -35399,6 +37275,7 @@ exports.HERO_COPY = HERO_COPY;
 exports.InMemoryModelProvenanceStore = InMemoryModelProvenanceStore;
 exports.InjectionDetector = InjectionDetector;
 exports.MODEL_PRESETS = MODEL_PRESETS;
+exports.MalformedPrincipalPolicyError = MalformedPrincipalPolicyError;
 exports.MemoryStorage = MemoryStorage;
 exports.PolicyStore = PolicyStore;
 exports.ProxyRouter = ProxyRouter;