@sanctuary-framework/mcp-server 1.2.3 → 1.2.5

package/dist/index.js

@@ -4254,6 +4254,10 @@ var DEFAULT_CHANNEL = {
   // SEC-002: auto_deny is not configurable. Timeout always denies.
   // Field omitted intentionally — all channels hardcode deny on timeout.
 };
+var DEFAULT_APPROVAL_REDIRECT = {
+  enabled: false,
+  mode: "replace"
+};
 var DEFAULT_POLICY = {
   version: 1,
   tier1_always_approve: [
@@ -4327,6 +4331,7 @@ var DEFAULT_POLICY = {
     "handshake_status",
     "handshake_exchange",
     "handshake_verify_attestation",
+    "handshake_abort",
     "reputation_query_weighted",
     "federation_peers",
     "federation_trust_evaluate",
@@ -4368,7 +4373,8 @@ var DEFAULT_POLICY = {
     "compliance_eu_ai_act_annex_iii_classify"
     // Read-only; rule-based Annex III classifier
   ],
-  approval_channel: DEFAULT_CHANNEL
+  approval_channel: DEFAULT_CHANNEL,
+  approval_redirect: DEFAULT_APPROVAL_REDIRECT
 };
 function extractOperationName(toolName) {
   if (toolName.startsWith("proxy/")) {
@@ -4465,9 +4471,35 @@ function validatePolicy(raw) {
       };
       delete merged.auto_deny;
       return merged;
-    })()
+    })(),
+    approval_redirect: parseApprovalRedirect(raw.approval_redirect)
   };
 }
+function parseApprovalRedirect(raw) {
+  if (raw === void 0 || raw === null) {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  if (typeof raw !== "object") {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  const obj = raw;
+  const enabled = typeof obj.enabled === "boolean" ? obj.enabled : DEFAULT_APPROVAL_REDIRECT.enabled;
+  const modeRaw = obj.mode;
+  let mode = DEFAULT_APPROVAL_REDIRECT.mode;
+  if (modeRaw !== void 0) {
+    if (modeRaw !== "replace" && modeRaw !== "notify") {
+      throw new Error(
+        `approval_redirect.mode must be "replace" or "notify" (got ${JSON.stringify(modeRaw)})`
+      );
+    }
+    mode = modeRaw;
+  }
+  const result = { enabled, mode };
+  if (obj.per_agent !== void 0 && typeof obj.per_agent === "object" && obj.per_agent !== null) {
+    result.per_agent = obj.per_agent;
+  }
+  return result;
+}
 function generateDefaultPolicyYaml() {
   return `# Sanctuary Principal Policy v1
 # This file controls what your agent can do without asking.
@@ -4546,6 +4578,7 @@ tier3_always_allow:
   - handshake_status
   - handshake_exchange
   - handshake_verify_attestation
+  - handshake_abort
   - reputation_query_weighted
   - federation_peers
   - federation_trust_evaluate
@@ -4580,22 +4613,69 @@ tier3_always_allow:
 approval_channel:
   type: stderr
   timeout_seconds: 300
+
+# \u2500\u2500\u2500 Approval Redirect (v1.3 WP-V1.3-10 Upsilon-2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Cross-harness approval-inbox redirect. When enabled, Tier 1/2 approvals
+# resolve via the unified approval inbox at /api/approval-inbox/* instead
+# of (or in addition to) the configured approval_channel above.
+#
+# mode:
+#   replace: bypass the approval_channel entirely; the gate awaits a
+#            decision from the inbox (default once enabled).
+#   notify:  fire BOTH the approval_channel and the inbox; first decision
+#            wins. Right shape for harnesses that cannot fully suppress
+#            their local approval prompt (e.g. Mastra-class).
+approval_redirect:
+  enabled: false
+  mode: replace
 `;
 }
+var MalformedPrincipalPolicyError = class extends Error {
+  constructor(policyPath, reason) {
+    super(
+      `Principal policy at ${policyPath} is malformed and cannot be loaded.
+Reason: ${reason}
+Sanctuary refuses to substitute a default policy when an existing file is present, to avoid silently overriding operator intent. Fix the file or delete it to regenerate the default.`
+    );
+    this.policyPath = policyPath;
+    this.reason = reason;
+    this.name = "MalformedPrincipalPolicyError";
+  }
+  policyPath;
+  reason;
+};
 async function loadPrincipalPolicy(storagePath) {
   const policyPath = join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") {
+      const defaultYaml = generateDefaultPolicyYaml();
+      try {
+        await writeFile(policyPath, defaultYaml, "utf-8");
+        await chmod(policyPath, 384);
+      } catch (writeErr) {
+        console.warn(
+          `Sanctuary: could not write default principal policy to ${policyPath}: ${writeErr.message}. Continuing with in-memory default.`
+        );
+      }
+      return Object.freeze({ ...DEFAULT_POLICY });
+    }
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      `read failed: ${err.message}`
+    );
+  }
   try {
-    const content = await readFile(policyPath, "utf-8");
     const policy = parsePolicy(content);
     return Object.freeze(policy);
-  } catch {
-    const defaultYaml = generateDefaultPolicyYaml();
-    try {
-      await writeFile(policyPath, defaultYaml, "utf-8");
-      await chmod(policyPath, 384);
-    } catch {
-    }
-    return Object.freeze({ ...DEFAULT_POLICY });
+  } catch (parseErr) {
+    throw new MalformedPrincipalPolicyError(
+      policyPath,
+      parseErr.message
+    );
   }
 }
 
@@ -4822,7 +4902,7 @@ function deepSortKeys(obj) {
   return sorted;
 }
 function canonicalizeForSigning(body) {
-  return JSON.stringify(deepSortKeys(body));
+  return JSON.stringify(deepSortKeys(body)).normalize("NFC");
 }
 
 // src/shr/generator.ts
@@ -11644,6 +11724,16 @@ var HUB_ROUTES = {
    */
   CHAT_CONCIERGE_SEND: "/api/hub/chat/concierge",
   CHAT_CONCIERGE_HISTORY: "/api/hub/chat/concierge/history",
+  /**
+   * Concierge memory thread routes (WP-V1.3-9 Tau-1). Thread enumeration,
+   * scrollback, and operator-initiated thread delete. Distinct from the
+   * v1.2 `/history` route, which surfaces the active in-session thread
+   * shape; the new routes target persisted multi-thread memory used by
+   * v1.3 conversational sovereignty depth.
+   */
+  CHAT_CONCIERGE_THREADS_LIST: "/api/hub/chat/concierge/threads",
+  CHAT_CONCIERGE_THREAD_READ: "/api/hub/chat/concierge/threads/:thread_id",
+  CHAT_CONCIERGE_THREAD_DELETE: "/api/hub/chat/concierge/threads/:thread_id",
   /**
    * Click-to-inspect panel (WP-V1.2 reshape). Returns the agent's
    * recent activity feed, pending Tier 1 approvals routed through this
@@ -11667,6 +11757,10 @@ var HUB_TIER_1_AGENT_CONTROL_ACTIONS = [
 ];
 var HUB_ACTIVITY_DEFAULT_LIMIT = 50;
 var HUB_ACTIVITY_MAX_LIMIT = 500;
+var HUB_CHAT_THREADS_DEFAULT_LIMIT = 50;
+var HUB_CHAT_THREADS_MAX_LIMIT = 500;
+var HUB_CHAT_TURNS_DEFAULT_LIMIT = 200;
+var HUB_CHAT_TURNS_MAX_LIMIT = 1e3;
 var HUB_INBOX_DEFAULT_LIMIT = 100;
 var HUB_INBOX_MAX_LIMIT = 500;
 var HUB_AGENTS_DEFAULT_LIMIT = 100;
@@ -11838,6 +11932,23 @@ function checkChatMessage(value) {
   }
   return trimmed;
 }
+function matchConciergeThreadRoute(path) {
+  const prefix = `${HUB_API_PREFIX}/chat/concierge/threads/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0 || rest.includes("/")) return null;
+  const decoded = decodeURIComponent(rest);
+  if (decoded.length === 0) return null;
+  return { threadId: decoded };
+}
+function parseSince(raw) {
+  if (raw === null || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    throw new HubValidationError("since must be a non-negative integer");
+  }
+  return parsed;
+}
 function matchInboxRoute(path) {
   const prefix = `${HUB_API_PREFIX}/inbox/`;
   if (!path.startsWith(prefix)) return null;
@@ -12021,6 +12132,47 @@ async function handleHubRoute(deps, req, res) {
       writeJSON2(res, 200, { ok: true, data: { messages } });
       return true;
     }
+    if (method === "GET" && path === HUB_ROUTES.CHAT_CONCIERGE_THREADS_LIST) {
+      const limit = parseLimit(
+        url.searchParams.get("limit"),
+        HUB_CHAT_THREADS_DEFAULT_LIMIT,
+        HUB_CHAT_THREADS_MAX_LIMIT
+      );
+      const threads = await deps.service.listConciergeMemoryThreads({ limit });
+      writeJSON2(res, 200, { ok: true, data: { threads } });
+      return true;
+    }
+    {
+      const threadMatch = matchConciergeThreadRoute(path);
+      if (threadMatch) {
+        if (method === "GET") {
+          const since = parseSince(url.searchParams.get("since"));
+          const limit = parseLimit(
+            url.searchParams.get("limit"),
+            HUB_CHAT_TURNS_DEFAULT_LIMIT,
+            HUB_CHAT_TURNS_MAX_LIMIT
+          );
+          const readOpts = { limit };
+          if (since !== void 0) readOpts.sinceTurnId = since;
+          const turns = await deps.service.readConciergeMemoryThread(
+            threadMatch.threadId,
+            readOpts
+          );
+          writeJSON2(res, 200, { ok: true, data: { turns } });
+          return true;
+        }
+        if (method === "DELETE") {
+          const removed = await deps.service.deleteConciergeMemoryThread(
+            threadMatch.threadId
+          );
+          writeJSON2(res, removed ? 200 : 404, {
+            ok: removed,
+            data: { thread_id: threadMatch.threadId, removed }
+          });
+          return true;
+        }
+      }
+    }
     writeJSON2(res, 404, { ok: false, error: "not_found", path });
     return true;
   } catch (err) {
@@ -16070,6 +16222,162 @@ async function dispatchV11Request(inputs, req, res, url, method) {
   return false;
 }
 
+// src/principal-policy/approval-aggregator-routes.ts
+var APPROVAL_INBOX_API_PREFIX = "/api/approval-inbox";
+var APPROVAL_INBOX_OPERATOR_DEFAULT = "operator_dashboard";
+var APPROVAL_INBOX_DEFAULT_LIMIT = 50;
+var APPROVAL_INBOX_MAX_LIMIT = 200;
+function writeJSON4(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function parseLimit2(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) {
+    return defaultValue;
+  }
+  return Math.min(parsed, max);
+}
+function isStatusFilter(value) {
+  return value === "pending" || value === "approved" || value === "denied" || value === "timeout" || value === "expired";
+}
+function matchEntryRoute(path) {
+  const prefix = `${APPROVAL_INBOX_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (rest.length === 0) return null;
+  const slash = rest.indexOf("/");
+  if (slash === -1) {
+    return { aggregatorId: decodeURIComponent(rest), action: null };
+  }
+  return {
+    aggregatorId: decodeURIComponent(rest.slice(0, slash)),
+    action: rest.slice(slash + 1)
+  };
+}
+async function handleStream2(deps, res) {
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+  const initial = await deps.aggregator.list({ status: "pending" });
+  res.write(
+    `event: approval_inbox_snapshot
+data: ${JSON.stringify({ entries: initial })}
+
+`
+  );
+  const unsubscribe = deps.aggregator.onEvent((event) => {
+    try {
+      res.write(
+        `event: approval_inbox_${event.type}
+data: ${JSON.stringify(event.entry)}
+
+`
+      );
+    } catch {
+    }
+  });
+  const keepAlive = setInterval(() => {
+    try {
+      res.write(": keepalive\n\n");
+    } catch {
+    }
+  }, 25e3);
+  const cleanup = () => {
+    clearInterval(keepAlive);
+    unsubscribe();
+  };
+  res.on("close", cleanup);
+  res.on("error", cleanup);
+}
+async function handleApprovalInboxRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== APPROVAL_INBOX_API_PREFIX && !path.startsWith(`${APPROVAL_INBOX_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  try {
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/stream`) {
+      await handleStream2(deps, res);
+      return true;
+    }
+    if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const status = statusRaw && isStatusFilter(statusRaw) ? statusRaw : "pending";
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const entries = await deps.aggregator.list({
+        status,
+        limit,
+        ...sinceTs !== void 0 ? { sinceTs } : {}
+      });
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
+    const entryMatch = matchEntryRoute(path);
+    if (entryMatch === null) {
+      writeJSON4(res, 404, { ok: false, error: "not_found", path });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
+      const entry = entries.find(
+        (e) => e.aggregator_id === entryMatch.aggregatorId
+      );
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const payload = await deps.aggregator.getFullPayload(
+        entryMatch.aggregatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, request_payload: payload } });
+      return true;
+    }
+    if (method === "POST" && (entryMatch.action === "approve" || entryMatch.action === "deny")) {
+      const decision = entryMatch.action === "approve" ? "approved" : "denied";
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      try {
+        const entry = await deps.aggregator.resolve(
+          entryMatch.aggregatorId,
+          decision,
+          operatorId
+        );
+        writeJSON4(res, 200, { ok: true, data: { entry } });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg === "approval-aggregator: not_found") {
+          writeJSON4(res, 404, { ok: false, error: "not_found" });
+        } else {
+          writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+        }
+      }
+      return true;
+    }
+    writeJSON4(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON4(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16134,6 +16442,14 @@ var DashboardApprovalChannel = class {
    * regardless. Default route flip is deferred to v1.2.
    */
   v11Bindings = null;
+  /**
+   * v1.3 WP-V1.3-10 Cross-Harness Approval Inbox aggregator. Mounted
+   * additively at `/api/approval-inbox/*` when set. Legacy approval
+   * routes at `/api/approvals/:id/(allow|deny)` continue to serve. The
+   * aggregator is a passive subscriber to the gate; the routes here are
+   * the operator-facing query / decision surface.
+   */
+  approvalAggregator = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16184,6 +16500,34 @@ var DashboardApprovalChannel = class {
   setV11Bindings(bindings) {
     this.v11Bindings = bindings;
   }
+  /**
+   * v1.3 WP-V1.3-10 Upsilon-1: bind the cross-harness approval inbox
+   * aggregator. Once set, requests to `/api/approval-inbox/*` route
+   * through `handleApprovalInboxRoute`. Pass `null` to detach (used by
+   * tests + during shutdown).
+   */
+  setApprovalAggregator(aggregator) {
+    this.approvalAggregator = aggregator;
+  }
+  /**
+   * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
+   * before the legacy approval route table. Returns true when served.
+   */
+  async dispatchApprovalInbox(req, res) {
+    if (!this.approvalAggregator) return false;
+    return handleApprovalInboxRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        aggregator: this.approvalAggregator,
+        operatorId: this.identityManager?.getPrimaryIdentityId() ?? void 0
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16559,6 +16903,18 @@ var DashboardApprovalChannel = class {
       res.end();
       return;
     }
+    if (this.approvalAggregator && url.pathname.startsWith(APPROVAL_INBOX_API_PREFIX)) {
+      this.dispatchApprovalInbox(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -18577,14 +18933,25 @@ var ApprovalGate = class {
   auditLog;
   injectionDetector;
   onInjectionAlert;
+  onApprovalEvent;
   proxyTierResolver;
-  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert) {
+  constructor(policy, baseline, channel, auditLog, injectionDetector, onInjectionAlert, onApprovalEvent) {
     this.policy = policy;
     this.baseline = baseline;
     this.channel = channel;
     this.auditLog = auditLog;
     this.injectionDetector = injectionDetector ?? new InjectionDetector();
     this.onInjectionAlert = onInjectionAlert;
+    this.onApprovalEvent = onApprovalEvent;
+  }
+  /**
+   * Set the approval-event callback after construction. Used by the
+   * Upsilon-1 wire-up when the aggregator is constructed alongside the
+   * gate. The aggregator subscribes through this setter rather than the
+   * constructor so existing call sites continue to work unchanged.
+   */
+  setApprovalEventCallback(cb) {
+    this.onApprovalEvent = cb;
   }
   /**
    * Set the proxy tier resolver. Called after the proxy router is initialized.
@@ -18818,21 +19185,105 @@ var ApprovalGate = class {
   }
   /**
    * Request approval from the human principal.
+   *
+   * Fail-closed contract (full-sweep #49): if the channel throws (network
+   * down, callback unreachable, dashboard SSE peer dropped, webhook DNS
+   * failure, etc.), the gate denies the operation and audit-logs the cause.
+   * Channel-internal timeouts already resolve with decision: "deny" per
+   * SEC-002; this catch covers the remaining "channel raised" path so an
+   * unhandled rejection cannot turn into an indeterminate state at the gate.
    */
   async requestApproval(operation, tier, reason, context) {
+    const requestTimestamp = (/* @__PURE__ */ new Date()).toISOString();
     const request = {
       operation,
       tier,
       reason,
       context,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: requestTimestamp
     };
-    const response = await this.channel.requestApproval(request);
+    const correlationId = `${requestTimestamp}:${operation}:${Math.random().toString(16).slice(2, 6)}`;
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "requested",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
+    let response;
+    try {
+      response = await this.channel.requestApproval(request);
+    } catch (err) {
+      const errMessage = err instanceof Error ? err.message : String(err);
+      const decidedAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.auditLog.append("l2", `gate_deny:${operation}`, "system", {
+        tier,
+        reason,
+        decided_by: "channel_failure",
+        channel_error: errMessage
+      });
+      if (this.onApprovalEvent) {
+        try {
+          this.onApprovalEvent({
+            phase: "resolved",
+            operation,
+            tier,
+            reason,
+            context,
+            request_timestamp: requestTimestamp,
+            resolution: {
+              decision: "deny",
+              decided_at: decidedAt,
+              decided_by: "channel_failure"
+            },
+            correlation_id: correlationId
+          });
+        } catch {
+        }
+      }
+      return {
+        allowed: false,
+        tier,
+        reason: AGENT_VISIBLE_DENY_REASONS.REQUIRES_APPROVAL,
+        approval_required: true,
+        approval_response: {
+          decision: "deny",
+          decided_at: decidedAt,
+          decided_by: "channel_failure"
+        }
+      };
+    }
     this.auditLog.append("l2", `gate_${response.decision}:${operation}`, "system", {
       tier,
       reason,
       decided_by: response.decided_by
     });
+    if (this.onApprovalEvent) {
+      try {
+        this.onApprovalEvent({
+          phase: "resolved",
+          operation,
+          tier,
+          reason,
+          context,
+          request_timestamp: requestTimestamp,
+          resolution: {
+            decision: response.decision,
+            decided_at: response.decided_at,
+            decided_by: response.decided_by
+          },
+          correlation_id: correlationId
+        });
+      } catch {
+      }
+    }
     return {
       allowed: response.decision === "approve",
       tier,
@@ -18866,50 +19317,559 @@ var ApprovalGate = class {
   }
 };
 
-// src/principal-policy/tools.ts
-function createPrincipalPolicyTools(policy, baseline, auditLog) {
-  return [
-    {
-      name: "principal_policy_view",
-      description: "View the current Principal Policy \u2014 the human-controlled rules governing what operations require approval. Read-only.",
-      inputSchema: {
-        type: "object",
-        properties: {
-          include_defaults: {
-            type: "boolean",
-            description: "Include tier3_always_allow list (can be long)",
-            default: false
-          }
-        }
-      },
-      handler: async (args) => {
-        const includeDefaults = args.include_defaults ?? false;
-        const view = {
-          version: policy.version,
-          tier1_always_approve: policy.tier1_always_approve,
-          tier2_anomaly: policy.tier2_anomaly,
-          approval_channel: {
-            type: policy.approval_channel.type,
-            timeout_seconds: policy.approval_channel.timeout_seconds,
-            auto_deny: true
-            // SEC-002: hardcoded, not configurable
-          }
-        };
-        if (includeDefaults) {
-          view.tier3_always_allow = policy.tier3_always_allow;
-        } else {
-          view.tier3_always_allow_count = policy.tier3_always_allow.length;
-          view.note = "Pass include_defaults: true to see the full tier3_always_allow list";
-        }
-        auditLog.append("l2", "principal_policy_view", "system", {
-          include_defaults: includeDefaults
-        });
-        return toolResult(view);
-      }
-    },
-    {
-      name: "principal_baseline_view",
-      description: "View the current behavioral baseline \u2014 the session profile used for anomaly detection. Shows known namespaces, counterparties, and tool call counts. Read-only.",
+// src/principal-policy/approval-aggregator.ts
+init_encryption();
+init_encoding();
+var APPROVAL_AGGREGATOR_NAMESPACE = "_approval_aggregator";
+var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
+var APPROVAL_AGGREGATOR_AUDIT_OPS = {
+  AGGREGATED: "cross_harness_approval_aggregated",
+  RESOLVED: "cross_harness_approval_resolved",
+  DEDUPED: "cross_harness_approval_deduped"
+};
+var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_MAX_LIST_LIMIT = 200;
+var DEFAULT_LIST_PAGE_SIZE = 50;
+var ApprovalAggregator = class {
+  storage;
+  encryptionKey;
+  auditLog;
+  identityId;
+  fortressId;
+  pendingTtlMs;
+  maxListLimit;
+  now;
+  resolveSourceContext;
+  resolveHubInboxItemId;
+  /** Cached entries by `aggregator_id`. */
+  entries = /* @__PURE__ */ new Map();
+  /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
+  dedupIndex = /* @__PURE__ */ new Map();
+  /** Correlation index: gate `correlation_id` -> aggregator_id. */
+  correlationIndex = /* @__PURE__ */ new Map();
+  /** Original request payloads kept in-memory for `getFullPayload()`. */
+  fullPayloads = /* @__PURE__ */ new Map();
+  /** Has the aggregator hydrated persisted entries on this process? */
+  hydrated = false;
+  /** Active SSE listeners. */
+  listeners = /* @__PURE__ */ new Set();
+  constructor(deps) {
+    this.storage = deps.storage;
+    this.encryptionKey = derivePurposeKey(
+      deps.masterKey,
+      APPROVAL_AGGREGATOR_HKDF_INFO
+    );
+    this.auditLog = deps.auditLog;
+    this.identityId = deps.identityId;
+    this.fortressId = deps.fortressId;
+    this.pendingTtlMs = deps.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxListLimit = deps.maxListLimit ?? DEFAULT_MAX_LIST_LIMIT;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.resolveSourceContext = deps.resolveSourceContext ?? ((_event) => ({
+      source_harness: this.fortressId,
+      source_agent_id: this.fortressId
+    }));
+    this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+  }
+  /**
+   * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
+   * use this to forward aggregator emissions to the dashboard.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Ingest a gate event. Returns the aggregator entry on first sight,
+   * `null` when deduped. Resolution events update the existing record;
+   * unmatched resolutions are dropped silently (caller's gate emitted a
+   * resolved-without-requested pair, which the aggregator does not invent
+   * a record for).
+   */
+  async ingest(event) {
+    await this.hydrate();
+    if (event.phase === "requested") {
+      return this.ingestRequested(event);
+    }
+    if (event.phase === "resolved") {
+      return this.ingestResolved(event);
+    }
+    return null;
+  }
+  /**
+   * List pending or recently resolved entries. Pending entries past TTL
+   * are lazily transitioned to `expired` and persisted before the list
+   * snapshot is returned.
+   */
+  async list(opts) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (opts?.status && entry.status !== opts.status) continue;
+      if (Date.parse(entry.created_at) < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => b.created_at.localeCompare(a.created_at));
+    return matching.slice(0, limit);
+  }
+  /**
+   * Return the original (unhashed) request payload for the entry. Returns
+   * `null` when the entry is unknown or the payload was evicted (e.g. the
+   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   */
+  async getFullPayload(aggregatorId) {
+    await this.hydrate();
+    if (!this.entries.has(aggregatorId)) return null;
+    return this.fullPayloads.get(aggregatorId) ?? null;
+  }
+  /**
+   * Resolve an entry. Used by both:
+   *   1. The gate wire-up on channel-decision return.
+   *   2. The HTTP `approve`/`deny` routes when an operator clicks.
+   *
+   * Idempotent: resolving an already-resolved entry is a no-op (the record
+   * keeps its first decision and the audit log is not double-fired).
+   * Unknown ids throw `Error("approval-aggregator: not_found")` so HTTP
+   * routes return 404.
+   */
+  async resolve(aggregatorId, decision, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      throw new Error("approval-aggregator: not_found");
+    }
+    if (entry.status !== "pending") {
+      return entry;
+    }
+    entry.status = decision;
+    entry.resolved_at = this.now().toISOString();
+    entry.resolved_by = operatorId;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: entry.aggregator_id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision,
+        decided_by: operatorId,
+        decided_at: entry.resolved_at
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: ingest paths ─────────────────────────────────────────────
+  async ingestRequested(event) {
+    const ctx = this.resolveSourceContext(event);
+    const auditId = this.auditEntryIdForEvent(event);
+    const dedupKey = `${ctx.source_harness}|${ctx.source_agent_id}|${auditId}`;
+    const existing = this.dedupIndex.get(dedupKey);
+    if (existing) {
+      const existingEntry = this.entries.get(existing);
+      if (existingEntry) {
+        this.correlationIndex.set(event.correlation_id, existing);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.DEDUPED,
+          this.identityId,
+          {
+            aggregator_id: existing,
+            source_harness: ctx.source_harness,
+            source_agent_id: ctx.source_agent_id,
+            audit_log_entry_id: auditId,
+            policy_rule_id: this.derivePolicyRuleId(event),
+            correlation_id: event.correlation_id
+          }
+        );
+        this.emit({ type: "deduped", entry: { ...existingEntry } });
+        return null;
+      }
+    }
+    const id = randomUUID();
+    const now = this.now();
+    const expires = new Date(now.getTime() + this.pendingTtlMs);
+    const hubInboxId = this.resolveHubInboxItemId(event);
+    const entry = {
+      aggregator_id: id,
+      source_harness: ctx.source_harness,
+      source_agent_id: ctx.source_agent_id,
+      audit_log_entry_id: auditId,
+      policy_rule_id: this.derivePolicyRuleId(event),
+      action_summary: this.deriveActionSummary(event),
+      request_payload_hash: this.hashPayload(event.context),
+      status: "pending",
+      created_at: now.toISOString(),
+      expires_at: expires.toISOString(),
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+    };
+    this.entries.set(id, entry);
+    this.dedupIndex.set(dedupKey, id);
+    this.correlationIndex.set(event.correlation_id, id);
+    this.fullPayloads.set(id, event.context);
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: ctx.source_harness,
+        source_agent_id: ctx.source_agent_id,
+        audit_log_entry_id: auditId,
+        policy_rule_id: entry.policy_rule_id,
+        ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      }
+    );
+    this.emit({ type: "aggregated", entry: { ...entry } });
+    return entry;
+  }
+  async ingestResolved(event) {
+    const id = this.correlationIndex.get(event.correlation_id);
+    if (!id) return null;
+    const entry = this.entries.get(id);
+    if (!entry) return null;
+    if (entry.status !== "pending") return entry;
+    if (!event.resolution) return entry;
+    const failClosed = event.resolution.decision === "deny" && event.resolution.decided_by === "channel_failure";
+    const status = failClosed ? "timeout" : event.resolution.decision === "approve" ? "approved" : "denied";
+    entry.status = status;
+    entry.resolved_at = event.resolution.decided_at;
+    entry.resolved_by = event.resolution.decided_by;
+    await this.persist(entry);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+      this.identityId,
+      {
+        aggregator_id: id,
+        source_harness: entry.source_harness,
+        source_agent_id: entry.source_agent_id,
+        audit_log_entry_id: entry.audit_log_entry_id,
+        policy_rule_id: entry.policy_rule_id,
+        decision: status,
+        decided_by: entry.resolved_by,
+        decided_at: entry.resolved_at,
+        fail_closed: failClosed
+      }
+    );
+    this.emit({ type: "resolved", entry: { ...entry } });
+    return entry;
+  }
+  // ── Internal: helpers ──────────────────────────────────────────────────
+  /**
+   * Audit-log entry id for the dedup tuple. The audit log itself does not
+   * surface a stable per-entry id (counter-prefixed keys are internal); the
+   * aggregator uses the request timestamp + operation, which together pin
+   * the audit entry the gate appended on the same call.
+   */
+  auditEntryIdForEvent(event) {
+    return `${event.request_timestamp}:${event.operation}`;
+  }
+  derivePolicyRuleId(event) {
+    return `tier${event.tier}:${event.operation}`;
+  }
+  deriveActionSummary(event) {
+    return `${event.operation} (tier ${event.tier})`;
+  }
+  /**
+   * Canonical SHA-256 of the request context. Sorted-keys serialization so
+   * identical payloads always hash the same, even when key insertion order
+   * varies. Defends against payload-replay smuggling (the aggregator can
+   * tell the same payload was seen twice without storing it cleartext).
+   */
+  hashPayload(payload) {
+    const canonical = JSON.stringify(payload, Object.keys(payload).sort());
+    return createHash("sha256").update(canonical).digest("hex");
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+  async expireStale() {
+    const nowMs = this.now().getTime();
+    for (const entry of this.entries.values()) {
+      if (entry.status !== "pending") continue;
+      if (Date.parse(entry.expires_at) > nowMs) continue;
+      entry.status = "expired";
+      entry.resolved_at = this.now().toISOString();
+      entry.resolved_by = "system_ttl";
+      await this.persist(entry);
+      this.auditLog.append(
+        "l2",
+        APPROVAL_AGGREGATOR_AUDIT_OPS.RESOLVED,
+        this.identityId,
+        {
+          aggregator_id: entry.aggregator_id,
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          audit_log_entry_id: entry.audit_log_entry_id,
+          policy_rule_id: entry.policy_rule_id,
+          decision: "expired",
+          decided_by: "system_ttl",
+          decided_at: entry.resolved_at
+        }
+      );
+      this.emit({ type: "resolved", entry: { ...entry } });
+    }
+  }
+  async persist(entry) {
+    const serialized = stringToBytes(JSON.stringify(entry));
+    const encrypted = encrypt(serialized, this.encryptionKey);
+    await this.storage.write(
+      APPROVAL_AGGREGATOR_NAMESPACE,
+      entry.aggregator_id,
+      stringToBytes(JSON.stringify(encrypted))
+    );
+  }
+  async hydrate() {
+    if (this.hydrated) return;
+    this.hydrated = true;
+    try {
+      const metas = await this.storage.list(APPROVAL_AGGREGATOR_NAMESPACE);
+      for (const meta of metas) {
+        const raw = await this.storage.read(
+          APPROVAL_AGGREGATOR_NAMESPACE,
+          meta.key
+        );
+        if (!raw) continue;
+        try {
+          const encrypted = JSON.parse(bytesToString(raw));
+          const decrypted = decrypt(encrypted, this.encryptionKey);
+          const entry = JSON.parse(bytesToString(decrypted));
+          this.entries.set(entry.aggregator_id, entry);
+          const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+          this.dedupIndex.set(dedupKey, entry.aggregator_id);
+        } catch {
+        }
+      }
+    } catch {
+      this.hydrated = false;
+    }
+  }
+};
+
+// src/principal-policy/channels/aggregator-backed-channel.ts
+var DEFAULT_REPLACE_MODE_TIMEOUT_MS = 5 * 60 * 1e3;
+function auditEntryIdFor(request) {
+  return `${request.timestamp}:${request.operation}`;
+}
+function statusToDecision(entry) {
+  switch (entry.status) {
+    case "approved":
+      return {
+        decision: "approve",
+        decided_by: "human"
+      };
+    case "denied":
+      return {
+        decision: "deny",
+        decided_by: "human"
+      };
+    case "timeout":
+    case "expired":
+      return {
+        decision: "deny",
+        decided_by: "timeout"
+      };
+    default:
+      return null;
+  }
+}
+var AggregatorBackedChannel = class {
+  underlying;
+  aggregator;
+  resolveRedirect;
+  replaceModeTimeoutMs;
+  now;
+  constructor(opts) {
+    this.underlying = opts.underlying;
+    this.aggregator = opts.aggregator;
+    this.resolveRedirect = opts.resolveRedirect;
+    this.replaceModeTimeoutMs = opts.replaceModeTimeoutMs ?? DEFAULT_REPLACE_MODE_TIMEOUT_MS;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /** Expose underlying for tests / wire-up reuse. */
+  getUnderlying() {
+    return this.underlying;
+  }
+  async requestApproval(request) {
+    const cfg = this.resolveRedirect(request);
+    if (!cfg.enabled) {
+      return this.underlying.requestApproval(request);
+    }
+    if (cfg.mode === "replace") {
+      return this.awaitAggregatorDecision(request);
+    }
+    return this.notifyMode(request);
+  }
+  /**
+   * `replace` mode. Subscribe to the aggregator's event stream BEFORE
+   * checking already-stored entries (avoids a race where the entry resolves
+   * between list and subscribe). Match incoming events to this request by
+   * audit_entry_id. Time out after `replaceModeTimeoutMs` to honor SEC-002.
+   */
+  async awaitAggregatorDecision(request) {
+    const auditId = auditEntryIdFor(request);
+    return new Promise((resolveOuter) => {
+      let settled = false;
+      let unsubscribe = null;
+      let timeoutHandle = null;
+      const settle = (response) => {
+        if (settled) return;
+        settled = true;
+        if (timeoutHandle) clearTimeout(timeoutHandle);
+        if (unsubscribe) {
+          try {
+            unsubscribe();
+          } catch {
+          }
+        }
+        resolveOuter(response);
+      };
+      const onEvent = (emit) => {
+        if (emit.type !== "resolved") return;
+        if (emit.entry.audit_log_entry_id !== auditId) return;
+        const mapped = statusToDecision(emit.entry);
+        if (!mapped) return;
+        settle({
+          decision: mapped.decision,
+          decided_at: emit.entry.resolved_at ?? this.now().toISOString(),
+          decided_by: mapped.decided_by
+        });
+      };
+      try {
+        unsubscribe = this.aggregator.onEvent(onEvent);
+      } catch (err) {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "channel_failure"
+        });
+        throw err instanceof Error ? err : new Error(String(err));
+      }
+      void this.aggregator.list({ limit: 200 }).then((entries) => {
+        for (const entry of entries) {
+          if (entry.audit_log_entry_id !== auditId) continue;
+          const mapped = statusToDecision(entry);
+          if (!mapped) return;
+          settle({
+            decision: mapped.decision,
+            decided_at: entry.resolved_at ?? this.now().toISOString(),
+            decided_by: mapped.decided_by
+          });
+          return;
+        }
+      }).catch(() => {
+      });
+      timeoutHandle = setTimeout(() => {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "timeout"
+        });
+      }, this.replaceModeTimeoutMs);
+    });
+  }
+  /**
+   * `notify` mode. Fire the underlying channel and listen on the
+   * aggregator simultaneously; whichever resolves first wins. Both
+   * paths produce identical `ApprovalResponse` shapes; the gate's
+   * downstream audit logging is unchanged.
+   *
+   * On underlying-channel failure, fall through to the aggregator wait
+   * (still bounded by `replaceModeTimeoutMs`). Operator can still
+   * resolve from the inbox even if the dashboard/webhook is down.
+   */
+  async notifyMode(request) {
+    const aggregatorPromise = this.awaitAggregatorDecision(request);
+    let underlyingPromise;
+    try {
+      underlyingPromise = this.underlying.requestApproval(request);
+    } catch (err) {
+      const response = await aggregatorPromise;
+      return response;
+    }
+    return Promise.race([
+      aggregatorPromise,
+      underlyingPromise.catch(
+        () => new Promise(() => {
+        })
+      )
+    ]);
+  }
+};
+function makeRedirectResolverFromPolicySupplier(supplier) {
+  return (_request) => {
+    const cfg = supplier().approval_redirect;
+    if (!cfg || cfg.enabled !== true) {
+      return { enabled: false, mode: "replace" };
+    }
+    return {
+      enabled: true,
+      mode: cfg.mode === "notify" ? "notify" : "replace"
+    };
+  };
+}
+
+// src/principal-policy/tools.ts
+function createPrincipalPolicyTools(policy, baseline, auditLog) {
+  return [
+    {
+      name: "principal_policy_view",
+      description: "View the current Principal Policy \u2014 the human-controlled rules governing what operations require approval. Read-only.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          include_defaults: {
+            type: "boolean",
+            description: "Include tier3_always_allow list (can be long)",
+            default: false
+          }
+        }
+      },
+      handler: async (args) => {
+        const includeDefaults = args.include_defaults ?? false;
+        const view = {
+          version: policy.version,
+          tier1_always_approve: policy.tier1_always_approve,
+          tier2_anomaly: policy.tier2_anomaly,
+          approval_channel: {
+            type: policy.approval_channel.type,
+            timeout_seconds: policy.approval_channel.timeout_seconds,
+            auto_deny: true
+            // SEC-002: hardcoded, not configurable
+          }
+        };
+        if (includeDefaults) {
+          view.tier3_always_allow = policy.tier3_always_allow;
+        } else {
+          view.tier3_always_allow_count = policy.tier3_always_allow.length;
+          view.note = "Pass include_defaults: true to see the full tier3_always_allow list";
+        }
+        auditLog.append("l2", "principal_policy_view", "system", {
+          include_defaults: includeDefaults
+        });
+        return toolResult(view);
+      }
+    },
+    {
+      name: "principal_baseline_view",
+      description: "View the current behavioral baseline \u2014 the session profile used for anomaly detection. Shows known namespaces, counterparties, and tool call counts. Read-only.",
       inputSchema: {
         type: "object",
         properties: {}
@@ -19736,6 +20696,71 @@ function verifyAttestation(attestation, now) {
   };
 }
 
+// src/handshake/audit.ts
+var HANDSHAKE_LIFECYCLE_OPS = {
+  INITIATED: "handshake_initiated",
+  COMPLETED: "handshake_completed",
+  FAILED: "handshake_failed",
+  ABORTED: "handshake_aborted"
+};
+function auditHandshakeInitiated(auditLog, ctx) {
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.INITIATED,
+    ctx.identity_id,
+    detailsFromContext(ctx),
+    "success"
+  );
+}
+function auditHandshakeCompleted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  if (ctx.trust_tier !== void 0) {
+    details.trust_tier = ctx.trust_tier;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.COMPLETED,
+    ctx.identity_id,
+    details,
+    "success"
+  );
+}
+function auditHandshakeFailed(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  if (ctx.error !== void 0) {
+    details.error = ctx.error;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.FAILED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function auditHandshakeAborted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.ABORTED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function detailsFromContext(ctx) {
+  const details = {
+    session_id: ctx.session_id,
+    role: ctx.role
+  };
+  if (ctx.counterparty_id !== void 0) {
+    details.counterparty_id = ctx.counterparty_id;
+  }
+  return details;
+}
+
 // src/handshake/tools.ts
 function createHandshakeTools(config, identityManager, masterKey, auditLog, options) {
   const autoPublishHandshakes = options?.autoPublishHandshakes ?? false;
@@ -19769,6 +20794,11 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const { challenge, session } = initiateHandshake(shr);
         sessions.set(session.session_id, session);
         auditLog.append("l4", "handshake_initiate", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: session.session_id,
+          role: "initiator",
+          identity_id: shr.body.instance_id
+        });
         return toolResult({
           session_id: session.session_id,
           challenge,
@@ -19808,10 +20838,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         );
         if ("error" in result) {
           auditLog.append("l4", "handshake_respond", shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: "unknown",
+            role: "responder",
+            identity_id: shr.body.instance_id,
+            reason: classifyRespondFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         sessions.set(result.session.session_id, result.session);
         auditLog.append("l4", "handshake_respond", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: result.session.session_id,
+          role: "responder",
+          identity_id: shr.body.instance_id,
+          counterparty_id: challenge.shr.body.instance_id
+        });
         let autoPublishResult;
         if (autoPublishHandshakes) {
           autoPublishResult = { attempted: true };
@@ -19919,9 +20962,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const response = args.response;
         const session = sessions.get(sessionId);
         if (!session) {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: "unknown",
+            reason: "session_unknown",
+            error: `No handshake session found: ${sessionId}`
+          });
           return toolResult({ error: `No handshake session found: ${sessionId}` });
         }
         if (session.state !== "initiated") {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: "session_state_mismatch",
+            error: `Session is in state '${session.state}', expected 'initiated'`
+          });
           return toolResult({
             error: `Session is in state '${session.state}', expected 'initiated'`
           });
@@ -19935,6 +20992,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         if ("error" in result) {
           session.state = "failed";
           auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: classifyCompleteFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         session.state = "completed";
@@ -19943,6 +21007,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         session.result = result.result;
         handshakeResults.set(result.result.counterparty_id, result.result);
         auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id);
+        auditHandshakeCompleted(auditLog, {
+          session_id: sessionId,
+          role: "initiator",
+          identity_id: session.our_shr.body.instance_id,
+          counterparty_id: result.result.counterparty_id,
+          trust_tier: result.result.trust_tier
+        });
         return toolResult({
           completion: result.completion,
           result: result.result,
@@ -19990,6 +21061,24 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
             void 0,
             result.verified ? "success" : "failure"
           );
+          if (result.verified) {
+            auditHandshakeCompleted(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              trust_tier: result.trust_tier
+            });
+          } else {
+            auditHandshakeFailed(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              reason: classifyCompleteFailure(result.errors.join("; ")),
+              error: result.errors.join("; ")
+            });
+          }
           return toolResult({ result });
         }
         return toolResult({
@@ -20097,10 +21186,74 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
           _content_trust: "external"
         });
       }
+    },
+    {
+      name: "handshake_abort",
+      description: "Abort an in-flight handshake session. Drops the session record and appends a session-lifecycle audit entry (handshake_aborted) so the operator can distinguish operator-cancelled, timed-out, and dropped sessions from sessions that simply fell off the protocol path.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          session_id: {
+            type: "string",
+            description: "Session ID returned from handshake_initiate / handshake_respond."
+          },
+          reason: {
+            type: "string",
+            enum: [
+              "operator_cancelled",
+              "session_timeout",
+              "transport_dropped",
+              "shutdown",
+              "other"
+            ],
+            description: "Why the session is being aborted. Defaults to 'operator_cancelled'."
+          }
+        },
+        required: ["session_id"]
+      },
+      handler: async (args) => {
+        const sessionId = args.session_id;
+        const reason = args.reason ?? "operator_cancelled";
+        const session = sessions.get(sessionId);
+        if (!session) {
+          return toolResult({ error: `No handshake session found: ${sessionId}` });
+        }
+        if (session.state === "completed") {
+          return toolResult({
+            error: `Session ${sessionId} already completed; abort is only valid for in-flight sessions`
+          });
+        }
+        sessions.delete(sessionId);
+        auditHandshakeAborted(auditLog, {
+          session_id: sessionId,
+          role: session.role,
+          identity_id: session.our_shr.body.instance_id,
+          ...session.their_shr ? { counterparty_id: session.their_shr.body.instance_id } : {},
+          reason
+        });
+        return toolResult({
+          aborted: true,
+          session_id: sessionId,
+          reason
+        });
+      }
     }
   ];
   return { tools, handshakeResults };
 }
+function classifyRespondFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed")) return "shr_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
+function classifyCompleteFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed") || error.includes("SHR")) return "shr_invalid";
+  if (error.includes("nonce signature is invalid")) return "nonce_signature_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
 
 // src/federation/registry.ts
 var DEFAULT_CAPABILITIES = {
@@ -21718,6 +22871,12 @@ function typed(markerPath, lineNumber, field, expected) {
 }
 async function consumeResetHistoryMarker(options) {
   const markerPath = join(options.storagePath, RESET_HISTORY_FILENAME);
+  const consumedPath = markerPath + ".consumed";
+  if (await fileExists3(consumedPath)) {
+    await rm(markerPath, { force: true });
+    await rm(consumedPath, { force: true });
+    return { emitted: 0, markerPath };
+  }
   if (!await fileExists3(markerPath)) {
     return { emitted: 0, markerPath };
   }
@@ -21742,7 +22901,9 @@ async function consumeResetHistoryMarker(options) {
     });
   }
   await options.auditLog.flush();
+  await writeFile(consumedPath, "", "utf-8");
   await rm(markerPath, { force: true });
+  await rm(consumedPath, { force: true });
   return { emitted: markers.length, markerHash, markerPath };
 }
 async function fileExists3(path) {
@@ -30686,7 +31847,37 @@ var HubService = class {
    */
   async getConciergeHistory() {
     const chat = this.requireOperatorChat();
-    return chat.getConciergeHistory();
+    return chat.getConciergeHistory();
+  }
+  // ── Concierge memory threads (WP-V1.3-9 Tau-1) ─────────────────────
+  /**
+   * Whether the operator-chat service has the WP-V1.3-9 memory store
+   * wired. Routes use this to 503 cleanly when the foundation memory
+   * surface is unavailable on a given fortress.
+   */
+  hasConciergeMemory() {
+    return Boolean(this.deps.operatorChat?.hasConciergeMemory());
+  }
+  async listConciergeMemoryThreads(opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.listConciergeMemoryThreads(opts);
+  }
+  async readConciergeMemoryThread(threadId, opts) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.readConciergeMemoryThread(threadId, opts);
+  }
+  async deleteConciergeMemoryThread(threadId) {
+    const chat = this.requireOperatorChat();
+    if (!chat.hasConciergeMemory()) {
+      throw new HubCapabilityError("concierge_memory_not_wired");
+    }
+    return chat.deleteConciergeMemoryThread(threadId);
   }
   /**
    * Open the click-to-inspect/approve panel for a wrapped agent. The
@@ -30775,7 +31966,28 @@ init_encoding();
 
 // src/chat/operator-chat-audit-events.ts
 var OPERATOR_CHAT_OPS = {
-  CONCIERGE_CHAT: "operator_concierge_chat"};
+  CONCIERGE_CHAT: "operator_concierge_chat",
+  /**
+   * Operator viewed concierge thread history (WP-V1.3-9 Tau-1). Emitted
+   * when the operator hits the list-threads or read-thread route. Body
+   * carries the thread_id (or `*` for the list endpoint) and a count;
+   * raw turn content never crosses the audit surface.
+   */
+  CONCIERGE_HISTORY_READ: "operator_concierge_history_read",
+  /**
+   * Operator deleted a concierge thread (WP-V1.3-9 Tau-1). Emitted on
+   * successful thread removal. Body carries thread_id + turn_count of
+   * the deleted bundle.
+   */
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted",
+  /**
+   * Concierge memory fold-read failed (WP-V1.3-9 Tau-2). Emitted when
+   * the multi-turn coherence fold cannot load the active thread's prior
+   * turns; the concierge degrades to single-turn after emitting. Body
+   * carries thread_id + a stable failure_reason enum.
+   */
+  CONCIERGE_MEMORY_READ_FAILED: "operator_concierge_memory_read_failed"
+};
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
@@ -30783,6 +31995,13 @@ var CONCIERGE_THREAD_KEY = "_fortress";
 
 // src/chat/operator-chat-service.ts
 var DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+var DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
+var DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
+var DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function approxTokenLen(text) {
+  return Math.ceil(text.length / 4);
+}
 var SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
 1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
 2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
@@ -30818,6 +32037,27 @@ var OperatorChatService = class {
   contextProviders;
   piiFilter;
   conciergeMaxTokens;
+  memory;
+  historyWindowTurns;
+  historyFreshnessMs;
+  historyTokenBudget;
+  sessionTtlMs;
+  clock;
+  /**
+   * In-memory thread_id assigned to the active concierge session.
+   * The first sendConcierge call after construction allocates a fresh
+   * UUID; subsequent calls reuse it so multi-turn coherence (Tau-2)
+   * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
+   */
+  activeMemoryThreadId;
+  /**
+   * Wall-clock ms of the most recent sendConcierge that touched the
+   * active session thread. Drives the WP-V1.3-9 Tau-2 session-TTL
+   * check: a fresh sendConcierge after `sessionTtlMs` of quiet
+   * allocates a new thread_id even though the prior one is still
+   * readable from the memory store.
+   */
+  lastInteractionAt;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -30828,6 +32068,12 @@ var OperatorChatService = class {
     }
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
+    if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
+    this.historyWindowTurns = deps.conciergeHistoryWindowTurns !== void 0 && deps.conciergeHistoryWindowTurns > 0 ? deps.conciergeHistoryWindowTurns : DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS;
+    this.historyFreshnessMs = deps.conciergeHistoryFreshnessMs !== void 0 && deps.conciergeHistoryFreshnessMs > 0 ? deps.conciergeHistoryFreshnessMs : DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS;
+    this.historyTokenBudget = deps.conciergeHistoryTokenBudget !== void 0 && deps.conciergeHistoryTokenBudget > 0 ? deps.conciergeHistoryTokenBudget : DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET;
+    this.sessionTtlMs = deps.conciergeSessionTtlMs !== void 0 && deps.conciergeSessionTtlMs > 0 ? deps.conciergeSessionTtlMs : DEFAULT_CONCIERGE_SESSION_TTL_MS;
+    this.clock = deps.conciergeClock ?? (() => Date.now());
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -30846,6 +32092,10 @@ var OperatorChatService = class {
       throw new Error("concierge query must not be empty");
     }
     const filterResult = this.piiFilter ? this.piiFilter.filter(trimmed) : { filtered: trimmed, redactions: 0 };
+    const nowMs = this.clock();
+    if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
+      this.activeMemoryThreadId = void 0;
+    }
     const operatorMessage = {
       message_id: randomUUID(),
       surface: "concierge",
@@ -30858,6 +32108,30 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    let priorTurns = [];
+    let memoryReadFailureReason = null;
+    let activeThreadIdForRound;
+    if (this.memory) {
+      activeThreadIdForRound = this.ensureActiveMemoryThread();
+      const result = await this.memory.readThreadStrict(activeThreadIdForRound).catch(() => ({ ok: false, reason: "io_failed" }));
+      if (result.ok) {
+        const cutoff = nowMs - this.historyFreshnessMs;
+        const fresh = result.turns.filter((t) => {
+          const ts = Date.parse(t.created_at);
+          return Number.isFinite(ts) && ts >= cutoff;
+        });
+        const recent = fresh.length > this.historyWindowTurns ? fresh.slice(fresh.length - this.historyWindowTurns) : fresh;
+        priorTurns = recent;
+      } else {
+        memoryReadFailureReason = result.reason;
+        this.emitMemoryReadFailed(activeThreadIdForRound, result.reason);
+      }
+    }
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
+      });
+    }
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -30874,7 +32148,7 @@ var OperatorChatService = class {
           conciergeBody = "Concierge unavailable. The chosen substrate does not support summarization. Pick a different substrate in the Policy center.";
           outcome = "substrate_disabled";
         } else {
-          const context = await this.assembleConciergeContext();
+          const context = await this.assembleConciergeContext(priorTurns);
           const response = await this.substrateSelector.invokeSummarize(
             "concierge",
             {
@@ -30913,6 +32187,15 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    let assistantTurnId;
+    if (this.memory) {
+      const threadId = this.ensureActiveMemoryThread();
+      const persisted = await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => void 0);
+      if (persisted) assistantTurnId = persisted.turn_id;
+    }
+    if (this.memory && activeThreadIdForRound) {
+      this.lastInteractionAt = nowMs;
+    }
     const payload = {
       version: "1.2",
       event_id: makeEventId("conc"),
@@ -30924,7 +32207,12 @@ var OperatorChatService = class {
       response_hash: outcome === "ok" ? hashOf(conciergeBody) : null,
       substrate: servedBy,
       latency_ms: latencyMs,
-      outcome
+      outcome,
+      ...activeThreadIdForRound !== void 0 ? { thread_id: activeThreadIdForRound } : {},
+      ...assistantTurnId !== void 0 ? { turn_index: assistantTurnId } : {},
+      ...this.memory ? {
+        prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
+      } : {}
     };
     this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
     return {
@@ -30934,6 +32222,25 @@ var OperatorChatService = class {
       outcome
     };
   }
+  /**
+   * Emit the WP-V1.3-9 Tau-2 graceful-degradation audit event. Pulled
+   * out of `sendConcierge` so the read-fold path stays readable. Emits
+   * with `result: "failure"` since the concierge fell back to
+   * single-turn mode for this round-trip.
+   */
+  emitMemoryReadFailed(threadId, reason) {
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-memfail"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_memory_read_failed",
+      surface: "concierge",
+      thread_id: threadId,
+      failure_reason: reason
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_MEMORY_READ_FAILED, payload, "failure");
+  }
   /**
    * Read the persisted concierge thread, oldest message first. Returns
    * an empty array when no thread exists yet.
@@ -30945,6 +32252,105 @@ var OperatorChatService = class {
     );
     return thread ? thread.messages : [];
   }
+  // ── WP-V1.3-9 Tau-1 memory accessors ─────────────────────────────────
+  /**
+   * Whether the foundation memory store is wired. Routes use this to
+   * 503 cleanly when called against an unwired service.
+   */
+  hasConciergeMemory() {
+    return this.memory !== void 0;
+  }
+  /**
+   * List concierge memory threads, newest-first. Emits the
+   * `operator_concierge_history_read` audit event with `thread_id="*"`.
+   */
+  async listConciergeMemoryThreads(opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const summaries = await this.memory.listThreads(opts);
+    const totalTurns = summaries.reduce((acc, s) => acc + s.turn_count, 0);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: "*",
+      turn_count: totalTurns
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return summaries;
+  }
+  /**
+   * Read a concierge memory thread, oldest turn first. Emits the
+   * `operator_concierge_history_read` audit event with the named
+   * thread_id and the count of turns surfaced.
+   */
+  async readConciergeMemoryThread(threadId, opts) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turns = await this.memory.readThread(threadId, opts);
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-hist"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_history_read",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turns.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ, payload, "success");
+    return turns;
+  }
+  /**
+   * Delete a concierge memory thread. Emits
+   * `operator_concierge_thread_deleted` only when a bundle was actually
+   * removed; absent threads return false without an audit event.
+   */
+  async deleteConciergeMemoryThread(threadId) {
+    if (!this.memory) {
+      throw new Error("concierge memory store not configured");
+    }
+    const turnsBefore = await this.memory.readThread(threadId);
+    if (turnsBefore.length === 0) {
+      return await this.memory.deleteThread(threadId);
+    }
+    const removed = await this.memory.deleteThread(threadId);
+    if (!removed) return false;
+    if (this.activeMemoryThreadId === threadId) {
+      this.activeMemoryThreadId = void 0;
+    }
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-del"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_thread_deleted",
+      surface: "concierge",
+      thread_id: threadId,
+      turn_count: turnsBefore.length
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED, payload, "success");
+    return true;
+  }
+  /**
+   * Reset the active session memory thread. Subsequent sendConcierge
+   * calls allocate a fresh thread_id. Surfaced for tests + future "new
+   * conversation" affordance; not currently called by the dashboard.
+   */
+  resetConciergeMemoryThread() {
+    this.activeMemoryThreadId = void 0;
+  }
+  ensureActiveMemoryThread() {
+    if (!this.activeMemoryThreadId) {
+      this.activeMemoryThreadId = randomUUID();
+    }
+    return this.activeMemoryThreadId;
+  }
   /**
    * Stitch fortress state into a single context blob the substrate
    * folds into its summarization prompt.
@@ -30957,6 +32363,11 @@ var OperatorChatService = class {
    *   ## Sanctuary reference
    *   <static domain reference block>
    *
+   *   ## Prior conversation             ← WP-V1.3-9 Tau-2, when present
+   *   OPERATOR: ...
+   *   CONCIERGE: ...
+   *   ---
+   *
    *   ## Recent activity
    *   <recentActivity output>
    *
@@ -30966,37 +32377,69 @@ var OperatorChatService = class {
    *   ## Open inbox
    *   <openInbox output>
    *   ```
+   *
+   * The substrate selector ships a `context: string` shape (not a
+   * messages array), so multi-turn coherence is folded as a structured
+   * prior-conversation section with explicit OPERATOR / CONCIERGE
+   * boundaries. Coordinator-CTO guidance: prefer messages-array shape
+   * if available; the v1.2 selector does not expose one, so structured
+   * serialization is the canonical path for v1.3.
    */
-  async assembleConciergeContext() {
+  async assembleConciergeContext(priorTurns = []) {
     const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
+    const priorSection = this.formatPriorTurnsSection(priorTurns);
     if (!this.contextProviders) {
-      return `${ref}
-
-## Recent activity
-(no providers wired)
-
-## Wrapped agents
-(no providers wired)
-
-## Open inbox
-(no providers wired)`;
+      return [
+        ref,
+        ...priorSection ? [priorSection] : [],
+        "## Recent activity\n(no providers wired)",
+        "## Wrapped agents\n(no providers wired)",
+        "## Open inbox\n(no providers wired)"
+      ].join("\n\n");
     }
     const [activity, agents, inbox] = await Promise.all([
       this.contextProviders.recentActivity(),
       this.contextProviders.agentInventory(),
       this.contextProviders.openInbox()
     ]);
-    return `${ref}
-
-## Recent activity
-${activity}
-
-## Wrapped agents
-${agents}
-
-## Open inbox
-${inbox}`;
+    return [
+      ref,
+      ...priorSection ? [priorSection] : [],
+      `## Recent activity
+${activity}`,
+      `## Wrapped agents
+${agents}`,
+      `## Open inbox
+${inbox}`
+    ].join("\n\n");
+  }
+  /**
+   * Render the prior-conversation section with token-budget enforcement
+   * (WP-V1.3-9 Tau-2). Drops oldest turns first when the rendered
+   * section exceeds `historyTokenBudget`. Returns an empty string when
+   * the input is empty or when the budget excludes every turn.
+   */
+  formatPriorTurnsSection(turns) {
+    if (turns.length === 0) return "";
+    const HEADER = "## Prior conversation";
+    const lines = turns.map(formatPriorTurnLine);
+    const headerTokens = approxTokenLen(`${HEADER}
+`);
+    const sepTokens = approxTokenLen("\n");
+    let runningTokens = headerTokens;
+    let runningLines = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      const tokens = approxTokenLen(line) + (runningLines.length > 0 ? sepTokens : 0);
+      if (runningTokens + tokens > this.historyTokenBudget) break;
+      runningTokens += tokens;
+      runningLines.push(line);
+    }
+    if (runningLines.length === 0) return "";
+    runningLines = runningLines.reverse();
+    return `${HEADER}
+${runningLines.join("\n")}`;
   }
   // ── audit helpers ────────────────────────────────────────────────────
   emit(operation, payload, result) {
@@ -31012,6 +32455,10 @@ ${inbox}`;
 function makeEventId(prefix) {
   return `${prefix}-${Date.now()}-${randomUUID().slice(0, 8)}`;
 }
+function formatPriorTurnLine(turn) {
+  const label = turn.role === "user" ? "OPERATOR" : "CONCIERGE";
+  return `${label}: ${turn.content}`;
+}
 function hashOf(input) {
   return hashToString(sha256(stringToBytes(input)));
 }
@@ -31108,6 +32555,297 @@ var OperatorChatStore = class {
   }
 };
 
+// src/chat/concierge-memory-store.ts
+init_encryption();
+init_encoding();
+var CONCIERGE_MEMORY_NAMESPACE = "_chat";
+var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
+var HKDF_INFO2 = "concierge-memory-store-v1";
+var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var ConciergeMemoryStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  locks;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
+    this.locks = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Append a turn to the named thread, creating the bundle if no record
+   * exists. Returns the persisted turn (with assigned turn_id +
+   * retention_until). Per-thread serialisation guarantees turn_id
+   * monotonicity even under concurrent callers.
+   */
+  async appendTurn(threadId, role, content) {
+    return this.withLock(threadId, async () => {
+      const bundle = await this.loadBundle(threadId) ?? null;
+      const now = /* @__PURE__ */ new Date();
+      const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+      const retentionUntil = new Date(now.getTime() + retentionMs);
+      const nextTurnId = bundle ? lastTurnId(bundle) + 1 : 1;
+      const turn = {
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        turn_id: nextTurnId,
+        role,
+        content,
+        created_at: now.toISOString(),
+        retention_until: retentionUntil.toISOString()
+      };
+      const next = bundle ? { ...bundle, turns: [...bundle.turns, turn] } : {
+        version: 1,
+        thread_id: threadId,
+        fortress_id: this.fortressId,
+        created_at: now.toISOString(),
+        turns: [turn]
+      };
+      await this.saveBundle(next);
+      return turn;
+    });
+  }
+  /**
+   * Read turns from a thread, oldest-first. Returns an empty array if
+   * the thread does not exist or its bundle is corrupt. Does not emit
+   * audit events; the caller (HTTP route handler) owns audit semantics.
+   */
+  async readThread(threadId, opts) {
+    const bundle = await this.loadBundle(threadId);
+    if (!bundle) return [];
+    let turns = bundle.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return turns;
+  }
+  /**
+   * Read turns with explicit failure surfacing (WP-V1.3-9 Tau-2). Where
+   * `readThread` collapses every failure mode to an empty array, this
+   * variant returns a discriminated result so the multi-turn fold path
+   * can degrade cleanly + emit `operator_concierge_memory_read_failed`
+   * with a concrete cause.
+   *
+   * - No bundle on disk → `{ ok: true, turns: [] }` (a fresh thread).
+   * - Bundle present, decode + decrypt + schema check pass → ok with turns.
+   * - Bundle present, oversize → `{ ok: false, reason: "oversize_bundle" }`.
+   * - Bundle present, decryption fails → `{ ok: false, reason: "decrypt_failed" }`.
+   * - Bundle present, schema mismatch (version / thread_id) → `schema_mismatch`.
+   * - Storage IO error → `io_failed`.
+   */
+  async readThreadStrict(threadId, opts) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return { ok: false, reason: "io_failed" };
+    }
+    if (!raw) return { ok: true, turns: [] };
+    if (raw.length > MAX_BUNDLE_BYTES2) {
+      return { ok: false, reason: "oversize_bundle" };
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(bytesToString(raw));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let plaintext;
+    try {
+      const aad = stringToBytes(threadId);
+      plaintext = decrypt(envelope, this.encryptionKey, aad);
+    } catch {
+      return { ok: false, reason: "decrypt_failed" };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(bytesToString(plaintext));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    if (parsed.version !== 1) return { ok: false, reason: "schema_mismatch" };
+    if (parsed.thread_id !== threadId) {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let turns = parsed.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return { ok: true, turns };
+  }
+  /**
+   * Enumerate concierge threads in this fortress with summary metadata.
+   * Sorted newest-first by last_turn_at.
+   */
+  async listThreads(opts) {
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    const summaries = [];
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      const bundle = await this.loadBundle(threadId);
+      if (!bundle || bundle.turns.length === 0) continue;
+      const last = bundle.turns[bundle.turns.length - 1];
+      summaries.push({
+        thread_id: bundle.thread_id,
+        created_at: bundle.created_at,
+        last_turn_at: last ? last.created_at : bundle.created_at,
+        turn_count: bundle.turns.length
+      });
+    }
+    summaries.sort(
+      (a, b) => a.last_turn_at < b.last_turn_at ? 1 : a.last_turn_at > b.last_turn_at ? -1 : 0
+    );
+    if (opts?.limit !== void 0) {
+      return summaries.slice(0, opts.limit);
+    }
+    return summaries;
+  }
+  /**
+   * Delete a thread's bundle. Returns true if the bundle existed and
+   * was removed; false if no bundle was present. Audit emission is the
+   * caller's responsibility.
+   */
+  async deleteThread(threadId) {
+    const key = bundleKey(threadId);
+    return this.withLock(threadId, async () => {
+      const existed = await this.storage.exists(
+        CONCIERGE_MEMORY_NAMESPACE,
+        key
+      );
+      if (!existed) return false;
+      try {
+        await this.storage.delete(CONCIERGE_MEMORY_NAMESPACE, key);
+      } catch {
+        return false;
+      }
+      return true;
+    });
+  }
+  /**
+   * Drop expired turns across all threads. Threads emptied by pruning
+   * are removed entirely. Returns the count of turns pruned.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      CONCIERGE_MEMORY_NAMESPACE,
+      CONCIERGE_MEMORY_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const threadId = stripKeyPrefix(meta.key);
+      if (threadId === null) continue;
+      pruned += await this.withLock(threadId, async () => {
+        const bundle = await this.loadBundle(threadId);
+        if (!bundle) return 0;
+        const kept = bundle.turns.filter((t) => t.retention_until > cutoff);
+        const dropped = bundle.turns.length - kept.length;
+        if (dropped === 0) return 0;
+        if (kept.length === 0) {
+          await this.storage.delete(
+            CONCIERGE_MEMORY_NAMESPACE,
+            bundleKey(threadId)
+          );
+        } else {
+          await this.saveBundle({ ...bundle, turns: kept });
+        }
+        return dropped;
+      });
+    }
+    return { pruned };
+  }
+  // ── internals ────────────────────────────────────────────────────────
+  async loadBundle(threadId) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(threadId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.thread_id !== threadId) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async saveBundle(bundle) {
+    const key = bundleKey(bundle.thread_id);
+    const aad = stringToBytes(bundle.thread_id);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      CONCIERGE_MEMORY_NAMESPACE,
+      key,
+      stringToBytes(JSON.stringify(envelope))
+    );
+  }
+  /**
+   * Run `task` while holding the per-thread async lock. Lock is released
+   * once the task settles (success or failure). Generic helper so
+   * appendTurn / deleteThread / pruneExpired share serialisation.
+   */
+  async withLock(threadId, task) {
+    const previous = this.locks.get(threadId) ?? Promise.resolve();
+    let release;
+    const next = new Promise((resolve6) => {
+      release = resolve6;
+    });
+    const chained = previous.then(() => next);
+    this.locks.set(threadId, chained);
+    try {
+      await previous;
+      return await task();
+    } finally {
+      release();
+      if (this.locks.get(threadId) === chained) {
+        this.locks.delete(threadId);
+      }
+    }
+  }
+};
+function bundleKey(threadId) {
+  return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
+  return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
+}
+function lastTurnId(bundle) {
+  let max = 0;
+  for (const t of bundle.turns) {
+    if (t.turn_id > max) max = t.turn_id;
+  }
+  return max;
+}
+
 // src/dashboard/v1_1/wiring.ts
 var CapabilityErrorAgentController = class {
   fail(action) {
@@ -31146,6 +32884,14 @@ function buildV11Bindings(inputs) {
   let operatorChatService;
   if (inputs.storage && inputs.masterKey) {
     const chatStore = new OperatorChatStore(inputs.storage, inputs.masterKey);
+    const conciergeMemory = new ConciergeMemoryStore({
+      storage: inputs.storage,
+      masterKey: inputs.masterKey,
+      fortressId: inputs.fortressId,
+      ...inputs.conciergeMemoryRetentionDays !== void 0 ? { retentionDays: inputs.conciergeMemoryRetentionDays } : {}
+    });
+    void conciergeMemory.pruneExpired().catch(() => {
+    });
     operatorChatService = new OperatorChatService({
       store: chatStore,
       auditLog: inputs.auditLog,
@@ -31156,7 +32902,8 @@ function buildV11Bindings(inputs) {
         identityId: inputs.identityId,
         registry
       }),
-      conciergePiiFilter: buildConciergePiiFilter()
+      conciergePiiFilter: buildConciergePiiFilter(),
+      conciergeMemory
     });
   }
   const hubService = new HubService({
@@ -31348,13 +33095,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO2 = "intelligence-substrate-config";
+var HKDF_INFO3 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -33493,7 +35240,9 @@ async function verifyExitBundle(bundleDir, options = {}) {
       );
     }
   }
-  const reputationFailed = reputation?.bundle_signature_valid === false || (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationBundleFailed = reputation?.bundle_signature_valid === false;
+  const reputationAttestationFailed = (reputation?.invalid_attestations ?? 0) > 0;
+  const reputationFailed = reputationBundleFailed || reputationAttestationFailed;
   const identityFailed = identity ? !identity.signature_valid : false;
   const unverifiableCount = reputation?.unverifiable_attestations ?? 0;
   const unverifiableFailed = unverifiableCount > 0 && !options.acceptUnverifiableAttestations;
@@ -33502,6 +35251,16 @@ async function verifyExitBundle(bundleDir, options = {}) {
       `${unverifiableCount} reputation attestation(s) have unknown signer public keys; pass --accept-unverifiable-attestations to import anyway`
     );
   }
+  let detailedFailureClass;
+  if (identityFailed) {
+    detailedFailureClass = "identity_signature_invalid";
+  } else if (reputationBundleFailed) {
+    detailedFailureClass = "reputation_bundle_signature_invalid";
+  } else if (reputationAttestationFailed) {
+    detailedFailureClass = "reputation_attestation_signature_invalid";
+  } else if (unverifiableFailed) {
+    detailedFailureClass = "reputation_unverifiable_attestations";
+  }
   return {
     version: "1.1",
     passed: !reputationFailed && !identityFailed && !unverifiableFailed,
@@ -33521,7 +35280,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
     identity,
     audit,
     reputation,
-    failure_class: reputationFailed || identityFailed || unverifiableFailed ? "other" : void 0
+    failure_class: detailedFailureClass
   };
 }
 
@@ -33911,7 +35670,7 @@ async function resolveSourceMasterKey(encryptedState, opts) {
   }
   return null;
 }
-async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId) {
+async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId, importedRekeyEntries) {
   const destinationSigner = opts.destinationSignerIdentityId ? opts.identityManager.get(opts.destinationSignerIdentityId) : opts.identityManager.getDefault();
   if (!destinationSigner) {
     return {
@@ -33973,8 +35732,9 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         }
       }
     }
+    let plaintext;
     try {
-      const plaintext = decrypt(
+      plaintext = decrypt(
         item.entry.payload,
         deriveNamespaceKey(sourceMasterKey, item.namespace)
       );
@@ -33983,28 +35743,30 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         skipped++;
         continue;
       }
-      await stateStore.write(
-        item.namespace,
-        item.key,
-        bytesToString(plaintext),
-        destinationSigner.identity_id,
-        destinationSigner.encrypted_private_key,
-        identityEncryptionKey,
-        {
-          content_type: item.entry.metadata.content_type,
-          ttl_seconds: item.entry.metadata.ttl_seconds,
-          tags: [
-            ...item.entry.metadata.tags ?? [],
-            "exit-import",
-            `source:${item.entry.kid}`
-          ]
-        }
-      );
-      imported++;
     } catch {
       skippedInvalidSig++;
       skipped++;
+      continue;
     }
+    await stateStore.write(
+      item.namespace,
+      item.key,
+      bytesToString(plaintext),
+      destinationSigner.identity_id,
+      destinationSigner.encrypted_private_key,
+      identityEncryptionKey,
+      {
+        content_type: item.entry.metadata.content_type,
+        ttl_seconds: item.entry.metadata.ttl_seconds,
+        tags: [
+          ...item.entry.metadata.tags ?? [],
+          "exit-import",
+          `source:${item.entry.kid}`
+        ]
+      }
+    );
+    imported++;
+    importedRekeyEntries?.push({ namespace: item.namespace, key: item.key });
   }
   return {
     status: "rekeyed",
@@ -34015,6 +35777,23 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
     conflicts
   };
 }
+async function cleanupStagedPaths(storage, staged) {
+  let removed = 0;
+  const failed = [];
+  for (const loc of staged) {
+    try {
+      const ok = await storage.delete(loc.namespace, loc.key);
+      if (ok) {
+        removed++;
+      } else {
+        failed.push(loc);
+      }
+    } catch {
+      failed.push(loc);
+    }
+  }
+  return { removed, failed };
+}
 async function stageArtifact(storage, namespace, key, value) {
   await storage.write(namespace, key, jsonBytes(value));
 }
@@ -34139,6 +35918,8 @@ async function importExitBundle(opts) {
   }
   const importId = importIdForManifest(manifest);
   const stagedArtifacts = [];
+  const stagedLocations = [];
+  const importedRekeyEntries = [];
   if (identityArtifact) {
     await stageArtifact(
       opts.storage,
@@ -34147,10 +35928,15 @@ async function importExitBundle(opts) {
       identityArtifact.json
     );
     stagedArtifacts.push("public_identity");
+    stagedLocations.push({
+      namespace: EXIT_PUBLIC_IDENTITIES_NAMESPACE,
+      key: identityArtifact.json.bundle.identity_id
+    });
   }
   if (policySet) {
     await stageArtifact(opts.storage, EXIT_POLICY_SETS_NAMESPACE, importId, policySet.json);
     stagedArtifacts.push("policy_set");
+    stagedLocations.push({ namespace: EXIT_POLICY_SETS_NAMESPACE, key: importId });
   }
   if (auditReceipts) {
     await stageArtifact(
@@ -34160,10 +35946,12 @@ async function importExitBundle(opts) {
       auditReceipts.json
     );
     stagedArtifacts.push("audit_receipts");
+    stagedLocations.push({ namespace: EXIT_AUDIT_RECEIPTS_NAMESPACE, key: importId });
   }
   if (commitments) {
     await stageArtifact(opts.storage, EXIT_COMMITMENTS_NAMESPACE, importId, commitments.json);
     stagedArtifacts.push("commitments");
+    stagedLocations.push({ namespace: EXIT_COMMITMENTS_NAMESPACE, key: importId });
   }
   if (placeholderMetadata) {
     await stageArtifact(
@@ -34173,12 +35961,17 @@ async function importExitBundle(opts) {
       placeholderMetadata.json
     );
     stagedArtifacts.push("placeholder_vault_metadata");
+    stagedLocations.push({
+      namespace: EXIT_PLACEHOLDER_METADATA_NAMESPACE,
+      key: importId
+    });
   }
   await stageArtifact(opts.storage, EXIT_IMPORT_NAMESPACE, importId, {
     manifest: manifest.body,
     verified_at: verification.verified_at,
     activated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
+  stagedLocations.push({ namespace: EXIT_IMPORT_NAMESPACE, key: importId });
   const publicKeys = identityArtifact ? publicKeysFromIdentityArtifact(identityArtifact.json) : { byIdentityId: /* @__PURE__ */ new Map(), byDid: /* @__PURE__ */ new Map() };
   let reputationResult = {
     imported_attestations: 0,
@@ -34203,26 +35996,57 @@ async function importExitBundle(opts) {
     encryptedState?.json ?? null,
     opts
   );
-  const stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
-    encryptedState.json,
-    opts,
-    sourceMasterKey,
-    publicKeys.byIdentityId
-  ) : {
-    status: "staged_requires_source_key",
-    imported_keys: 0,
-    skipped_keys: encryptedState.json.entries.length,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: conflicts.state_conflicts.length
-  } : {
-    status: "not_requested",
-    imported_keys: 0,
-    skipped_keys: 0,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: 0
-  };
+  let stateResult;
+  try {
+    stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
+      encryptedState.json,
+      opts,
+      sourceMasterKey,
+      publicKeys.byIdentityId,
+      importedRekeyEntries
+    ) : {
+      status: "staged_requires_source_key",
+      imported_keys: 0,
+      skipped_keys: encryptedState.json.entries.length,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: conflicts.state_conflicts.length
+    } : {
+      status: "not_requested",
+      imported_keys: 0,
+      skipped_keys: 0,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: 0
+    };
+  } catch (err) {
+    const toCleanup = [
+      ...importedRekeyEntries,
+      ...stagedLocations
+    ];
+    const cleanup = await cleanupStagedPaths(opts.storage, toCleanup);
+    opts.auditLog.append(
+      "l1",
+      "exit_bundle_rekey_failed_cleanup",
+      manifest.body.identity_binding.identity_id,
+      {
+        import_id: importId,
+        manifest_version: manifest.body.manifest_version,
+        rekey_entries_removed: importedRekeyEntries.length,
+        staged_artifacts_removed: stagedLocations.length,
+        removed_total: cleanup.removed,
+        cleanup_failed_count: cleanup.failed.length,
+        original_error: err instanceof Error ? err.message : String(err)
+      },
+      "failure"
+    );
+    await opts.auditLog.flush();
+    const originalMessage = err instanceof Error ? err.message : String(err);
+    throw new ExitBundleImportError(
+      "REKEY_FAILED_AND_CLEANED",
+      `Exit-bundle re-key failed: ${originalMessage}. Cleanup removed ${cleanup.removed} of ${toCleanup.length} staged paths (${importedRekeyEntries.length} re-keyed entries plus ${stagedLocations.length} staged artifacts; ${cleanup.failed.length} cleanup deletes failed).`
+    );
+  }
   opts.auditLog.append("l1", "exit_bundle_import_activate", manifest.body.identity_binding.identity_id, {
     import_id: importId,
     manifest_version: manifest.body.manifest_version,
@@ -34448,7 +36272,19 @@ async function runExitCommand(args) {
       }
       const config = await loadConfig();
       const ctx = await openExitContext(argv, env);
-      const policy = await loadPrincipalPolicy(ctx.storagePath);
+      let policy;
+      try {
+        policy = await loadPrincipalPolicy(ctx.storagePath);
+      } catch (policyErr) {
+        if (policyErr instanceof MalformedPrincipalPolicyError) {
+          write(err, `
+Sanctuary cannot proceed.
+${policyErr.message}
+`);
+          return 1;
+        }
+        throw policyErr;
+      }
       const result = await exportExitBundle({
         bundleDir: outDir,
         storage: ctx.storage,
@@ -35100,7 +36936,19 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   const profileStore = new SovereigntyProfileStore(storage, masterKey);
   await profileStore.load();
   const { tools: profileTools } = createSovereigntyProfileTools(profileStore, auditLog);
-  const policy = await loadPrincipalPolicy(config.storage_path);
+  let policy;
+  try {
+    policy = await loadPrincipalPolicy(config.storage_path);
+  } catch (err) {
+    if (err instanceof MalformedPrincipalPolicyError) {
+      console.error(`
+Sanctuary cannot start.
+${err.message}
+`);
+      process.exit(1);
+    }
+    throw err;
+  }
   const baseline = new BaselineTracker(storage, masterKey);
   await baseline.load();
   let approvalChannel;
@@ -35197,7 +37045,35 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
       timestamp: alert.timestamp
     });
   } : void 0;
-  const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
+  const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
+  const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const approvalAggregator = new ApprovalAggregator({
+    storage,
+    masterKey,
+    auditLog,
+    identityId: aggregatorIdentityId,
+    fortressId: fortressIdForAggregator
+  });
+  const wrappedApprovalChannel = new AggregatorBackedChannel({
+    underlying: approvalChannel,
+    aggregator: approvalAggregator,
+    resolveRedirect: makeRedirectResolverFromPolicySupplier(() => policy),
+    replaceModeTimeoutMs: policy.approval_channel.timeout_seconds * 1e3
+  });
+  const gate = new ApprovalGate(
+    policy,
+    baseline,
+    wrappedApprovalChannel,
+    auditLog,
+    injectionDetector,
+    onInjectionAlert
+  );
+  gate.setApprovalEventCallback((event) => {
+    void approvalAggregator.ingest(event);
+  });
+  if (dashboard) {
+    dashboard.setApprovalAggregator(approvalAggregator);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -35373,6 +37249,6 @@ Refusing to start the cocoon while the reset-history marker is unreadable.`
   };
 }
 
-export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
+export { ATTESTATION_VERSION, ApprovalGate, AuditLog, AutoApproveChannel, BaselineTracker, TEMPLATES as CONTEXT_GATE_TEMPLATES, CallbackApprovalChannel, ClientManager, CommitmentStore, ContextGateEnforcer, ContextGatePolicyStore, DashboardApprovalChannel, ExitBundleImportError, FederationRegistry, FilesystemStorage, HERO_COPY, InMemoryModelProvenanceStore, InjectionDetector, MODEL_PRESETS, MalformedPrincipalPolicyError, MemoryStorage, PolicyStore, ProxyRouter, ReputationStore, SovereigntyProfileStore, StateStore, StderrApprovalChannel, TIER_WEIGHTS, WebhookApprovalChannel, canonicalize2 as canonicalize, classifyField, completeHandshake, computeWeightedScore, createBridgeCommitment, createDefaultProfile, createPedersenCommitment, createProofOfKnowledge, createRangeProof, createSanctuaryServer, evaluateField, exitBundleManifestShape, exportExitBundle, filterContext, generateAttestation, generateSHR, generateSystemPrompt, getProtectionSnapshot, getTemplate2 as getTemplate, importExitBundle, initiateHandshake, listTemplateIds, loadConfig, loadExitArtifact, loadPrincipalPolicy, readManifest, recommendPolicy, renderDashboardHTML, resolveTier, respondToHandshake, runExitCommand, signPayload, startDashboard, startDashboardServer, tierDistribution, verifyAttestation, verifyBridgeCommitment, verifyCompletion, verifyExitBundle, verifyPedersenCommitment, verifyProofOfKnowledge, verifyRangeProof, verifySHR, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map