@sanctuary-framework/mcp-server 1.2.4 → 1.2.6

package/dist/cli.cjs

@@ -4457,9 +4457,35 @@ function validatePolicy(raw) {
       };
       delete merged.auto_deny;
       return merged;
-    })()
+    })(),
+    approval_redirect: parseApprovalRedirect(raw.approval_redirect)
   };
 }
+function parseApprovalRedirect(raw) {
+  if (raw === void 0 || raw === null) {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  if (typeof raw !== "object") {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  const obj = raw;
+  const enabled = typeof obj.enabled === "boolean" ? obj.enabled : DEFAULT_APPROVAL_REDIRECT.enabled;
+  const modeRaw = obj.mode;
+  let mode = DEFAULT_APPROVAL_REDIRECT.mode;
+  if (modeRaw !== void 0) {
+    if (modeRaw !== "replace" && modeRaw !== "notify") {
+      throw new Error(
+        `approval_redirect.mode must be "replace" or "notify" (got ${JSON.stringify(modeRaw)})`
+      );
+    }
+    mode = modeRaw;
+  }
+  const result = { enabled, mode };
+  if (obj.per_agent !== void 0 && typeof obj.per_agent === "object" && obj.per_agent !== null) {
+    result.per_agent = obj.per_agent;
+  }
+  return result;
+}
 function generateDefaultPolicyYaml() {
   return `# Sanctuary Principal Policy v1
 # This file controls what your agent can do without asking.
@@ -4538,6 +4564,7 @@ tier3_always_allow:
   - handshake_status
   - handshake_exchange
   - handshake_verify_attestation
+  - handshake_abort
   - reputation_query_weighted
   - federation_peers
   - federation_trust_evaluate
@@ -4572,6 +4599,21 @@ tier3_always_allow:
 approval_channel:
   type: stderr
   timeout_seconds: 300
+
+# \u2500\u2500\u2500 Approval Redirect (v1.3 WP-V1.3-10 Upsilon-2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Cross-harness approval-inbox redirect. When enabled, Tier 1/2 approvals
+# resolve via the unified approval inbox at /api/approval-inbox/* instead
+# of (or in addition to) the configured approval_channel above.
+#
+# mode:
+#   replace: bypass the approval_channel entirely; the gate awaits a
+#            decision from the inbox (default once enabled).
+#   notify:  fire BOTH the approval_channel and the inbox; first decision
+#            wins. Right shape for harnesses that cannot fully suppress
+#            their local approval prompt (e.g. Mastra-class).
+approval_redirect:
+  enabled: false
+  mode: replace
 `;
 }
 async function loadPrincipalPolicy(storagePath) {
@@ -4608,7 +4650,7 @@ async function loadPrincipalPolicy(storagePath) {
     );
   }
 }
-var DEFAULT_TIER2, DEFAULT_CHANNEL, DEFAULT_POLICY, MalformedPrincipalPolicyError;
+var DEFAULT_TIER2, DEFAULT_CHANNEL, DEFAULT_APPROVAL_REDIRECT, DEFAULT_POLICY, MalformedPrincipalPolicyError;
 var init_loader = __esm({
   "src/principal-policy/loader.ts"() {
     DEFAULT_TIER2 = {
@@ -4625,6 +4667,10 @@ var init_loader = __esm({
       // SEC-002: auto_deny is not configurable. Timeout always denies.
       // Field omitted intentionally — all channels hardcode deny on timeout.
     };
+    DEFAULT_APPROVAL_REDIRECT = {
+      enabled: false,
+      mode: "replace"
+    };
     DEFAULT_POLICY = {
       version: 1,
       tier1_always_approve: [
@@ -4698,6 +4744,7 @@ var init_loader = __esm({
         "handshake_status",
         "handshake_exchange",
         "handshake_verify_attestation",
+        "handshake_abort",
         "reputation_query_weighted",
         "federation_peers",
         "federation_trust_evaluate",
@@ -4739,7 +4786,8 @@ var init_loader = __esm({
         "compliance_eu_ai_act_annex_iii_classify"
         // Read-only; rule-based Annex III classifier
       ],
-      approval_channel: DEFAULT_CHANNEL
+      approval_channel: DEFAULT_CHANNEL,
+      approval_redirect: DEFAULT_APPROVAL_REDIRECT
     };
     MalformedPrincipalPolicyError = class extends Error {
       constructor(policyPath, reason) {
@@ -17170,6 +17218,27 @@ async function handleApprovalInboxRoute(deps, req, res) {
       await handleStream2(deps, res);
       return true;
     }
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/history`) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const filterStatus = statusRaw && isStatusFilter(statusRaw) && statusRaw !== "pending" ? statusRaw : void 0;
+      const entries = await deps.aggregator.getHistory(
+        {
+          limit,
+          ...filterStatus !== void 0 ? { status: filterStatus } : {},
+          ...sinceTs !== void 0 ? { sinceTs } : {}
+        },
+        operatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
     if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
       const limit = parseLimit2(
         url.searchParams.get("limit"),
@@ -17192,11 +17261,39 @@ async function handleApprovalInboxRoute(deps, req, res) {
       writeJSON4(res, 404, { ok: false, error: "not_found", path });
       return true;
     }
-    if (method === "GET" && entryMatch.action === null) {
-      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
-      const entry = entries.find(
-        (e) => e.aggregator_id === entryMatch.aggregatorId
+    if (method === "GET" && entryMatch.action === "audit-trail") {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const trail = await deps.aggregator.getAuditTrail(
+        entryMatch.aggregatorId,
+        operatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, audit_trail: trail } });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === "payload") {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const payload = await deps.aggregator.getFullPayloadWithAudit(
+        entryMatch.aggregatorId,
+        operatorId
       );
+      writeJSON4(res, 200, {
+        ok: true,
+        data: { entry, request_payload: payload }
+      });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
       if (!entry) {
         writeJSON4(res, 404, { ok: false, error: "not_found" });
         return true;
@@ -20230,7 +20327,10 @@ var init_approval_aggregator = __esm({
     APPROVAL_AGGREGATOR_AUDIT_OPS = {
       AGGREGATED: "cross_harness_approval_aggregated",
       RESOLVED: "cross_harness_approval_resolved",
-      DEDUPED: "cross_harness_approval_deduped"
+      DEDUPED: "cross_harness_approval_deduped",
+      PAYLOAD_DECRYPTED: "cross_harness_approval_payload_decrypted",
+      AUDIT_TRAIL_VIEWED: "cross_harness_approval_audit_trail_viewed",
+      REPLAYED: "cross_harness_approval_replayed"
     };
     DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
     DEFAULT_MAX_LIST_LIMIT = 200;
@@ -20246,6 +20346,8 @@ var init_approval_aggregator = __esm({
       now;
       resolveSourceContext;
       resolveHubInboxItemId;
+      payloadStore;
+      resolveEnforcementChain;
       /** Cached entries by `aggregator_id`. */
       entries = /* @__PURE__ */ new Map();
       /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
@@ -20275,6 +20377,14 @@ var init_approval_aggregator = __esm({
           source_agent_id: this.fortressId
         }));
         this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+        this.payloadStore = deps.payloadStore ?? null;
+        this.resolveEnforcementChain = deps.resolveEnforcementChain ?? ((event) => [
+          {
+            layer: "l2",
+            event: `approval_required:${event.operation}`,
+            timestamp: event.request_timestamp
+          }
+        ]);
       }
       /**
        * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
@@ -20325,13 +20435,152 @@ var init_approval_aggregator = __esm({
       }
       /**
        * Return the original (unhashed) request payload for the entry. Returns
-       * `null` when the entry is unknown or the payload was evicted (e.g. the
-       * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+       * `null` when the entry is unknown. When the in-memory payload map has
+       * been evicted (e.g. after a server restart) and a `payloadStore` was
+       * provided, the at-rest bundle is decrypted and the in-memory map is
+       * refilled. Audit emission lives on the `*WithAudit` variant; this base
+       * accessor is silent so internal callers can read without polluting the
+       * audit trail.
        */
       async getFullPayload(aggregatorId) {
         await this.hydrate();
         if (!this.entries.has(aggregatorId)) return null;
-        return this.fullPayloads.get(aggregatorId) ?? null;
+        const cached = this.fullPayloads.get(aggregatorId);
+        if (cached !== void 0) return cached;
+        if (this.payloadStore) {
+          try {
+            const restored = await this.payloadStore.loadPayload(aggregatorId);
+            if (restored !== null) {
+              this.fullPayloads.set(aggregatorId, restored);
+              return restored;
+            }
+          } catch {
+          }
+        }
+        return null;
+      }
+      /**
+       * Return the entry record for the given id, or null when unknown.
+       * Idempotent. v1.3 Upsilon-3.
+       */
+      async getEntry(aggregatorId) {
+        await this.hydrate();
+        return this.entries.get(aggregatorId) ?? null;
+      }
+      /**
+       * Audited variant of `getFullPayload`. Emits the
+       * `cross_harness_approval_payload_decrypted` audit event before
+       * returning. Used by the operator-facing /payload replay route.
+       * v1.3 Upsilon-3.
+       */
+      async getFullPayloadWithAudit(aggregatorId, operatorId) {
+        const payload = await this.getFullPayload(aggregatorId);
+        if (payload === null) return null;
+        const entry = this.entries.get(aggregatorId);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.PAYLOAD_DECRYPTED,
+          operatorId,
+          {
+            aggregator_id: aggregatorId,
+            ...entry ? {
+              source_harness: entry.source_harness,
+              source_agent_id: entry.source_agent_id,
+              entry_status: entry.status
+            } : {}
+          }
+        );
+        return payload;
+      }
+      /**
+       * Return the audit-log entries that led to and surround this approval.
+       * Best-effort matching: aggregator-side emissions (AGGREGATED, RESOLVED,
+       * DEDUPED, replay events) all carry `details.aggregator_id` and link
+       * directly. Gate-side emissions (`gate_*:operation`) do not carry the
+       * aggregator id at v1.3, so they are matched via timestamp window
+       * (entry.created_at to entry.resolved_at + 1s, or expires_at + 1s while
+       * pending) and operation suffix. Emits AUDIT_TRAIL_VIEWED on call.
+       * v1.3 Upsilon-3.
+       */
+      async getAuditTrail(aggregatorId, operatorId) {
+        await this.hydrate();
+        const entry = this.entries.get(aggregatorId);
+        if (!entry) {
+          return [];
+        }
+        const sinceMs = Date.parse(entry.created_at) - 1e3;
+        const sinceIso = new Date(sinceMs).toISOString();
+        const queried = await this.auditLog.query({ since: sinceIso, limit: 1e3 });
+        const operationPart = entry.policy_rule_id.includes(":") ? entry.policy_rule_id.slice(entry.policy_rule_id.indexOf(":") + 1) : entry.policy_rule_id;
+        const lifetimeStart = sinceMs;
+        const lifetimeEnd = entry.resolved_at ? Date.parse(entry.resolved_at) + 1e3 : Date.parse(entry.expires_at) + 1e3;
+        const matches = [];
+        for (const audit of queried.entries) {
+          const detailsId = audit.details !== void 0 ? audit.details["aggregator_id"] : void 0;
+          if (detailsId === aggregatorId) {
+            matches.push(audit);
+            continue;
+          }
+          const auditMs = Date.parse(audit.timestamp);
+          if (auditMs < lifetimeStart || auditMs > lifetimeEnd) continue;
+          if (audit.operation.endsWith(`:${operationPart}`)) {
+            matches.push(audit);
+          }
+        }
+        matches.sort(
+          (a, b) => a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0
+        );
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.AUDIT_TRAIL_VIEWED,
+          operatorId,
+          {
+            aggregator_id: aggregatorId,
+            entry_status: entry.status,
+            match_count: matches.length
+          }
+        );
+        return matches;
+      }
+      /**
+       * List historical (resolved) approvals. Excludes pending entries by
+       * design: `list()` is the pending-inbox surface and `getHistory()` is
+       * the resolved-replay surface. Emits REPLAYED on each call. v1.3
+       * Upsilon-3.
+       */
+      async getHistory(opts, operatorId) {
+        await this.hydrate();
+        await this.expireStale();
+        const limit = Math.min(
+          opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+          this.maxListLimit
+        );
+        const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+        const matching = [];
+        for (const entry of this.entries.values()) {
+          if (entry.status === "pending") continue;
+          if (opts?.status && entry.status !== opts.status) continue;
+          const stamp = Date.parse(entry.resolved_at ?? entry.created_at);
+          if (stamp < sinceMs) continue;
+          matching.push(entry);
+        }
+        matching.sort((a, b) => {
+          const aStamp = a.resolved_at ?? a.created_at;
+          const bStamp = b.resolved_at ?? b.created_at;
+          return bStamp.localeCompare(aStamp);
+        });
+        const sliced = matching.slice(0, limit);
+        this.auditLog.append(
+          "l2",
+          APPROVAL_AGGREGATOR_AUDIT_OPS.REPLAYED,
+          operatorId,
+          {
+            result_count: sliced.length,
+            ...opts?.status !== void 0 ? { status_filter: opts.status } : {},
+            ...opts?.sinceTs !== void 0 ? { since: opts.sinceTs } : {}
+          }
+        );
+        return sliced;
       }
       /**
        * Resolve an entry. Used by both:
@@ -20405,6 +20654,7 @@ var init_approval_aggregator = __esm({
         const now = this.now();
         const expires = new Date(now.getTime() + this.pendingTtlMs);
         const hubInboxId = this.resolveHubInboxItemId(event);
+        const enforcementChain = this.resolveEnforcementChain(event);
         const entry = {
           aggregator_id: id,
           source_harness: ctx.source_harness,
@@ -20416,13 +20666,20 @@ var init_approval_aggregator = __esm({
           status: "pending",
           created_at: now.toISOString(),
           expires_at: expires.toISOString(),
-          ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+          ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {},
+          ...enforcementChain.length > 0 ? { enforcement_chain: enforcementChain } : {}
         };
         this.entries.set(id, entry);
         this.dedupIndex.set(dedupKey, id);
         this.correlationIndex.set(event.correlation_id, id);
         this.fullPayloads.set(id, event.context);
         await this.persist(entry);
+        if (this.payloadStore) {
+          try {
+            await this.payloadStore.savePayload(id, event.context);
+          } catch {
+          }
+        }
         this.auditLog.append(
           "l2",
           APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
@@ -20570,6 +20827,317 @@ var init_approval_aggregator = __esm({
   }
 });
 
+// src/principal-policy/channels/aggregator-backed-channel.ts
+function auditEntryIdFor(request) {
+  return `${request.timestamp}:${request.operation}`;
+}
+function statusToDecision(entry) {
+  switch (entry.status) {
+    case "approved":
+      return {
+        decision: "approve",
+        decided_by: "human"
+      };
+    case "denied":
+      return {
+        decision: "deny",
+        decided_by: "human"
+      };
+    case "timeout":
+    case "expired":
+      return {
+        decision: "deny",
+        decided_by: "timeout"
+      };
+    default:
+      return null;
+  }
+}
+function makeRedirectResolverFromPolicySupplier(supplier) {
+  return (_request) => {
+    const cfg = supplier().approval_redirect;
+    if (!cfg || cfg.enabled !== true) {
+      return { enabled: false, mode: "replace" };
+    }
+    return {
+      enabled: true,
+      mode: cfg.mode === "notify" ? "notify" : "replace"
+    };
+  };
+}
+var DEFAULT_REPLACE_MODE_TIMEOUT_MS, AggregatorBackedChannel;
+var init_aggregator_backed_channel = __esm({
+  "src/principal-policy/channels/aggregator-backed-channel.ts"() {
+    DEFAULT_REPLACE_MODE_TIMEOUT_MS = 5 * 60 * 1e3;
+    AggregatorBackedChannel = class {
+      underlying;
+      aggregator;
+      resolveRedirect;
+      replaceModeTimeoutMs;
+      now;
+      constructor(opts) {
+        this.underlying = opts.underlying;
+        this.aggregator = opts.aggregator;
+        this.resolveRedirect = opts.resolveRedirect;
+        this.replaceModeTimeoutMs = opts.replaceModeTimeoutMs ?? DEFAULT_REPLACE_MODE_TIMEOUT_MS;
+        this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      /** Expose underlying for tests / wire-up reuse. */
+      getUnderlying() {
+        return this.underlying;
+      }
+      async requestApproval(request) {
+        const cfg = this.resolveRedirect(request);
+        if (!cfg.enabled) {
+          return this.underlying.requestApproval(request);
+        }
+        if (cfg.mode === "replace") {
+          return this.awaitAggregatorDecision(request);
+        }
+        return this.notifyMode(request);
+      }
+      /**
+       * `replace` mode. Subscribe to the aggregator's event stream BEFORE
+       * checking already-stored entries (avoids a race where the entry resolves
+       * between list and subscribe). Match incoming events to this request by
+       * audit_entry_id. Time out after `replaceModeTimeoutMs` to honor SEC-002.
+       */
+      async awaitAggregatorDecision(request) {
+        const auditId = auditEntryIdFor(request);
+        return new Promise((resolveOuter) => {
+          let settled = false;
+          let unsubscribe = null;
+          let timeoutHandle = null;
+          const settle = (response) => {
+            if (settled) return;
+            settled = true;
+            if (timeoutHandle) clearTimeout(timeoutHandle);
+            if (unsubscribe) {
+              try {
+                unsubscribe();
+              } catch {
+              }
+            }
+            resolveOuter(response);
+          };
+          const onEvent = (emit) => {
+            if (emit.type !== "resolved") return;
+            if (emit.entry.audit_log_entry_id !== auditId) return;
+            const mapped = statusToDecision(emit.entry);
+            if (!mapped) return;
+            settle({
+              decision: mapped.decision,
+              decided_at: emit.entry.resolved_at ?? this.now().toISOString(),
+              decided_by: mapped.decided_by
+            });
+          };
+          try {
+            unsubscribe = this.aggregator.onEvent(onEvent);
+          } catch (err) {
+            settle({
+              decision: "deny",
+              decided_at: this.now().toISOString(),
+              decided_by: "channel_failure"
+            });
+            throw err instanceof Error ? err : new Error(String(err));
+          }
+          void this.aggregator.list({ limit: 200 }).then((entries) => {
+            for (const entry of entries) {
+              if (entry.audit_log_entry_id !== auditId) continue;
+              const mapped = statusToDecision(entry);
+              if (!mapped) return;
+              settle({
+                decision: mapped.decision,
+                decided_at: entry.resolved_at ?? this.now().toISOString(),
+                decided_by: mapped.decided_by
+              });
+              return;
+            }
+          }).catch(() => {
+          });
+          timeoutHandle = setTimeout(() => {
+            settle({
+              decision: "deny",
+              decided_at: this.now().toISOString(),
+              decided_by: "timeout"
+            });
+          }, this.replaceModeTimeoutMs);
+        });
+      }
+      /**
+       * `notify` mode. Fire the underlying channel and listen on the
+       * aggregator simultaneously; whichever resolves first wins. Both
+       * paths produce identical `ApprovalResponse` shapes; the gate's
+       * downstream audit logging is unchanged.
+       *
+       * On underlying-channel failure, fall through to the aggregator wait
+       * (still bounded by `replaceModeTimeoutMs`). Operator can still
+       * resolve from the inbox even if the dashboard/webhook is down.
+       */
+      async notifyMode(request) {
+        const aggregatorPromise = this.awaitAggregatorDecision(request);
+        let underlyingPromise;
+        try {
+          underlyingPromise = this.underlying.requestApproval(request);
+        } catch (err) {
+          const response = await aggregatorPromise;
+          return response;
+        }
+        return Promise.race([
+          aggregatorPromise,
+          underlyingPromise.catch(
+            () => new Promise(() => {
+            })
+          )
+        ]);
+      }
+    };
+  }
+});
+
+// src/principal-policy/aggregator-store.ts
+function payloadKey(aggregatorId) {
+  return `${AGGREGATOR_PAYLOAD_KEY_PREFIX}${aggregatorId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(AGGREGATOR_PAYLOAD_KEY_PREFIX)) return null;
+  return key.slice(AGGREGATOR_PAYLOAD_KEY_PREFIX.length);
+}
+var AGGREGATOR_PAYLOAD_NAMESPACE, AGGREGATOR_PAYLOAD_KEY_PREFIX, HKDF_INFO, DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS, MAX_BUNDLE_BYTES2, AggregatorPayloadStore;
+var init_aggregator_store = __esm({
+  "src/principal-policy/aggregator-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    AGGREGATOR_PAYLOAD_NAMESPACE = "_approval_aggregator_payloads";
+    AGGREGATOR_PAYLOAD_KEY_PREFIX = "payload.";
+    HKDF_INFO = "l2-approval-aggregator-payload-v1";
+    DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS = 30;
+    MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+    AggregatorPayloadStore = class {
+      storage;
+      encryptionKey;
+      fortressId;
+      retentionDays;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO);
+        this.fortressId = opts.fortressId;
+        this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS;
+      }
+      /**
+       * Persist `payload` under the given aggregator_id. Idempotent; calling
+       * twice with the same id rewrites the bundle (retention_until is
+       * recomputed). Returns the bundle's retention_until ISO-8601 timestamp
+       * so callers can log it.
+       */
+      async savePayload(aggregatorId, payload) {
+        const now = /* @__PURE__ */ new Date();
+        const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+        const retentionUntil = new Date(now.getTime() + retentionMs);
+        const bundle = {
+          version: 1,
+          aggregator_id: aggregatorId,
+          fortress_id: this.fortressId,
+          created_at: now.toISOString(),
+          retention_until: retentionUntil.toISOString(),
+          payload
+        };
+        const aad = stringToBytes(aggregatorId);
+        const plaintext = stringToBytes(JSON.stringify(bundle));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          AGGREGATOR_PAYLOAD_NAMESPACE,
+          payloadKey(aggregatorId),
+          stringToBytes(JSON.stringify(envelope))
+        );
+        return bundle.retention_until;
+      }
+      /**
+       * Read the persisted payload for the aggregator_id. Returns null if no
+       * bundle exists, the bundle is corrupted, or AAD binding fails.
+       */
+      async loadPayload(aggregatorId) {
+        const key = payloadKey(aggregatorId);
+        let raw;
+        try {
+          raw = await this.storage.read(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+        } catch {
+          return null;
+        }
+        if (!raw) return null;
+        if (raw.length > MAX_BUNDLE_BYTES2) return null;
+        try {
+          const envelope = JSON.parse(bytesToString(raw));
+          const aad = stringToBytes(aggregatorId);
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const parsed = JSON.parse(
+            bytesToString(plaintext)
+          );
+          if (parsed.version !== 1) return null;
+          if (parsed.aggregator_id !== aggregatorId) return null;
+          return parsed.payload;
+        } catch {
+          return null;
+        }
+      }
+      /**
+       * Delete the persisted payload. Returns true when a bundle was removed,
+       * false when none existed.
+       */
+      async deletePayload(aggregatorId) {
+        const key = payloadKey(aggregatorId);
+        const existed = await this.storage.exists(
+          AGGREGATOR_PAYLOAD_NAMESPACE,
+          key
+        );
+        if (!existed) return false;
+        try {
+          await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+        } catch {
+          return false;
+        }
+        return true;
+      }
+      /**
+       * Drop expired payload bundles. Returns the count of bundles pruned.
+       * Caller wires this into the cocoon-unlock initialization path.
+       */
+      async pruneExpired(now) {
+        const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+        const entries = await this.storage.list(
+          AGGREGATOR_PAYLOAD_NAMESPACE,
+          AGGREGATOR_PAYLOAD_KEY_PREFIX
+        );
+        let pruned = 0;
+        for (const meta of entries) {
+          const aggregatorId = stripKeyPrefix(meta.key);
+          if (aggregatorId === null) continue;
+          const raw = await this.storage.read(
+            AGGREGATOR_PAYLOAD_NAMESPACE,
+            meta.key
+          );
+          if (!raw) continue;
+          try {
+            const envelope = JSON.parse(bytesToString(raw));
+            const aad = stringToBytes(aggregatorId);
+            const plaintext = decrypt(envelope, this.encryptionKey, aad);
+            const parsed = JSON.parse(
+              bytesToString(plaintext)
+            );
+            if (parsed.retention_until <= cutoff) {
+              await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, meta.key);
+              pruned += 1;
+            }
+          } catch {
+          }
+        }
+        return { pruned };
+      }
+    };
+  }
+});
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -21473,6 +22041,76 @@ var init_attestation = __esm({
   }
 });
 
+// src/handshake/audit.ts
+function auditHandshakeInitiated(auditLog, ctx) {
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.INITIATED,
+    ctx.identity_id,
+    detailsFromContext(ctx),
+    "success"
+  );
+}
+function auditHandshakeCompleted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  if (ctx.trust_tier !== void 0) {
+    details.trust_tier = ctx.trust_tier;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.COMPLETED,
+    ctx.identity_id,
+    details,
+    "success"
+  );
+}
+function auditHandshakeFailed(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  if (ctx.error !== void 0) {
+    details.error = ctx.error;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.FAILED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function auditHandshakeAborted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.ABORTED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function detailsFromContext(ctx) {
+  const details = {
+    session_id: ctx.session_id,
+    role: ctx.role
+  };
+  if (ctx.counterparty_id !== void 0) {
+    details.counterparty_id = ctx.counterparty_id;
+  }
+  return details;
+}
+var HANDSHAKE_LIFECYCLE_OPS;
+var init_audit = __esm({
+  "src/handshake/audit.ts"() {
+    HANDSHAKE_LIFECYCLE_OPS = {
+      INITIATED: "handshake_initiated",
+      COMPLETED: "handshake_completed",
+      FAILED: "handshake_failed",
+      ABORTED: "handshake_aborted"
+    };
+  }
+});
+
 // src/handshake/tools.ts
 function createHandshakeTools(config, identityManager, masterKey, auditLog, options) {
   const autoPublishHandshakes = options?.autoPublishHandshakes ?? false;
@@ -21506,6 +22144,11 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const { challenge, session } = initiateHandshake(shr);
         sessions.set(session.session_id, session);
         auditLog.append("l4", "handshake_initiate", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: session.session_id,
+          role: "initiator",
+          identity_id: shr.body.instance_id
+        });
         return toolResult({
           session_id: session.session_id,
           challenge,
@@ -21545,10 +22188,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         );
         if ("error" in result) {
           auditLog.append("l4", "handshake_respond", shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: "unknown",
+            role: "responder",
+            identity_id: shr.body.instance_id,
+            reason: classifyRespondFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         sessions.set(result.session.session_id, result.session);
         auditLog.append("l4", "handshake_respond", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: result.session.session_id,
+          role: "responder",
+          identity_id: shr.body.instance_id,
+          counterparty_id: challenge.shr.body.instance_id
+        });
         let autoPublishResult;
         if (autoPublishHandshakes) {
           autoPublishResult = { attempted: true };
@@ -21656,9 +22312,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const response = args.response;
         const session = sessions.get(sessionId);
         if (!session) {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: "unknown",
+            reason: "session_unknown",
+            error: `No handshake session found: ${sessionId}`
+          });
           return toolResult({ error: `No handshake session found: ${sessionId}` });
         }
         if (session.state !== "initiated") {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: "session_state_mismatch",
+            error: `Session is in state '${session.state}', expected 'initiated'`
+          });
           return toolResult({
             error: `Session is in state '${session.state}', expected 'initiated'`
           });
@@ -21672,6 +22342,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         if ("error" in result) {
           session.state = "failed";
           auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: classifyCompleteFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         session.state = "completed";
@@ -21680,6 +22357,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         session.result = result.result;
         handshakeResults.set(result.result.counterparty_id, result.result);
         auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id);
+        auditHandshakeCompleted(auditLog, {
+          session_id: sessionId,
+          role: "initiator",
+          identity_id: session.our_shr.body.instance_id,
+          counterparty_id: result.result.counterparty_id,
+          trust_tier: result.result.trust_tier
+        });
         return toolResult({
           completion: result.completion,
           result: result.result,
@@ -21727,6 +22411,24 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
             void 0,
             result.verified ? "success" : "failure"
           );
+          if (result.verified) {
+            auditHandshakeCompleted(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              trust_tier: result.trust_tier
+            });
+          } else {
+            auditHandshakeFailed(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              reason: classifyCompleteFailure(result.errors.join("; ")),
+              error: result.errors.join("; ")
+            });
+          }
           return toolResult({ result });
         }
         return toolResult({
@@ -21834,10 +22536,74 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
           _content_trust: "external"
         });
       }
+    },
+    {
+      name: "handshake_abort",
+      description: "Abort an in-flight handshake session. Drops the session record and appends a session-lifecycle audit entry (handshake_aborted) so the operator can distinguish operator-cancelled, timed-out, and dropped sessions from sessions that simply fell off the protocol path.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          session_id: {
+            type: "string",
+            description: "Session ID returned from handshake_initiate / handshake_respond."
+          },
+          reason: {
+            type: "string",
+            enum: [
+              "operator_cancelled",
+              "session_timeout",
+              "transport_dropped",
+              "shutdown",
+              "other"
+            ],
+            description: "Why the session is being aborted. Defaults to 'operator_cancelled'."
+          }
+        },
+        required: ["session_id"]
+      },
+      handler: async (args) => {
+        const sessionId = args.session_id;
+        const reason = args.reason ?? "operator_cancelled";
+        const session = sessions.get(sessionId);
+        if (!session) {
+          return toolResult({ error: `No handshake session found: ${sessionId}` });
+        }
+        if (session.state === "completed") {
+          return toolResult({
+            error: `Session ${sessionId} already completed; abort is only valid for in-flight sessions`
+          });
+        }
+        sessions.delete(sessionId);
+        auditHandshakeAborted(auditLog, {
+          session_id: sessionId,
+          role: session.role,
+          identity_id: session.our_shr.body.instance_id,
+          ...session.their_shr ? { counterparty_id: session.their_shr.body.instance_id } : {},
+          reason
+        });
+        return toolResult({
+          aborted: true,
+          session_id: sessionId,
+          reason
+        });
+      }
     }
   ];
   return { tools, handshakeResults };
 }
+function classifyRespondFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed")) return "shr_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
+function classifyCompleteFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed") || error.includes("SHR")) return "shr_invalid";
+  if (error.includes("nonce signature is invalid")) return "nonce_signature_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
 var init_tools6 = __esm({
   "src/handshake/tools.ts"() {
     init_router();
@@ -21847,6 +22613,7 @@ var init_tools6 = __esm({
     init_encoding();
     init_protocol();
     init_attestation();
+    init_audit();
     init_verifier();
   }
 });
@@ -32982,7 +33749,21 @@ var init_operator_chat_audit_events = __esm({
        * successful thread removal. Body carries thread_id + turn_count of
        * the deleted bundle.
        */
-      CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
+      CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted",
+      /**
+       * Concierge memory fold-read failed (WP-V1.3-9 Tau-2). Emitted when
+       * the multi-turn coherence fold cannot load the active thread's prior
+       * turns; the concierge degrades to single-turn after emitting. Body
+       * carries thread_id + a stable failure_reason enum.
+       */
+      CONCIERGE_MEMORY_READ_FAILED: "operator_concierge_memory_read_failed",
+      /**
+       * Concierge dynamic-context fetcher failed (WP-V1.3-9 Tau-3). Emitted
+       * when a category fetcher throws while assembling the dynamic context
+       * fold. The concierge omits that category and continues; the user-
+       * facing query is never broken. Body carries category + failure_reason.
+       */
+      CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed"
     };
   }
 });
@@ -32995,20 +33776,312 @@ var init_operator_chat_types = __esm({
     CONCIERGE_THREAD_KEY = "_fortress";
   }
 });
+
+// src/chat/concierge-context-router.ts
+function phrasePattern(phrase) {
+  const escaped = phrase.toLowerCase().split(/\s+/).map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("\\s+");
+  return { source: `\\b${escaped}\\b`, phrase };
+}
+function extractAgentNameHint(query) {
+  const agentPattern = /\bagent\s+["']?([A-Za-z][\w-]{0,40})["']?/i;
+  const m = query.match(agentPattern);
+  if (m && m[1]) return m[1];
+  const quoted = query.match(/["']([A-Za-z][\w-]{0,40})["']/);
+  if (quoted && quoted[1]) return quoted[1];
+  return null;
+}
+function isTrivialQuery(query) {
+  const norm = query.trim().toLowerCase();
+  if (norm.length === 0) return true;
+  if (norm.length < 8) return true;
+  return TRIVIAL_GREETINGS.has(norm);
+}
+function classifyQuery(query) {
+  const normalized = query.toLowerCase();
+  const matches = [];
+  for (const spec of CATEGORY_KEYWORDS) {
+    const matchedPhrases = [];
+    for (const pattern of spec.patterns) {
+      if (matchedPhrases.includes(pattern.phrase)) continue;
+      const re = new RegExp(pattern.source, "i");
+      if (re.test(normalized)) {
+        matchedPhrases.push(pattern.phrase);
+      }
+    }
+    if (matchedPhrases.length === 0) continue;
+    const confidence = Math.min(1, 0.4 + 0.3 * matchedPhrases.length);
+    matches.push({
+      category: spec.category,
+      confidence,
+      matched_keywords: matchedPhrases,
+      agent_name_hint: spec.category === "agent_state" || spec.category === "agent_activity" ? extractAgentNameHint(query) : null
+    });
+  }
+  matches.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    return CONTEXT_CATEGORIES.indexOf(a.category) - CONTEXT_CATEGORIES.indexOf(b.category);
+  });
+  return matches;
+}
+function approxTokenLen(text) {
+  return Math.ceil(text.length / APPROX_CHARS_PER_TOKEN);
+}
+async function runFetcher(match, fetchers) {
+  switch (match.category) {
+    case "templates":
+      return fetchers.templates();
+    case "agent_state":
+      return fetchers.agent_state(match.agent_name_hint);
+    case "agent_activity":
+      return fetchers.agent_activity(match.agent_name_hint);
+    case "audit_log":
+      return fetchers.audit_log();
+    case "sentinel_findings":
+      return fetchers.sentinel_findings();
+    case "anomaly_alerts":
+      return fetchers.anomaly_alerts();
+    case "recent_receipts":
+      return fetchers.recent_receipts();
+    case "verascore_deltas":
+      return fetchers.verascore_deltas();
+  }
+}
+function trivialMatch(category) {
+  return {
+    category,
+    confidence: 0.5,
+    matched_keywords: ["llm-assist"],
+    agent_name_hint: null
+  };
+}
+async function foldContext(query, fetchers, opts) {
+  const budget = opts?.maxTokens ?? DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET;
+  let matches = classifyQuery(query);
+  if (matches.length === 0 && !isTrivialQuery(query) && opts?.llmAssistClassify) {
+    try {
+      const picked = await opts.llmAssistClassify(query, CONTEXT_CATEGORIES);
+      if (picked !== "none" && CONTEXT_CATEGORIES.includes(picked)) {
+        matches = [trivialMatch(picked)];
+      }
+    } catch {
+    }
+  }
+  if (matches.length === 0) {
+    return { section: "", categoriesIncluded: [] };
+  }
+  const attempts = [];
+  for (const match of matches) {
+    try {
+      const text = await runFetcher(match, fetchers);
+      const trimmed = text.trim();
+      if (trimmed.length > 0) {
+        attempts.push({ category: match.category, text: trimmed });
+      }
+    } catch (err) {
+      opts?.onFetcherFailure?.(match.category, err);
+    }
+  }
+  if (attempts.length === 0) {
+    return { section: "", categoriesIncluded: [] };
+  }
+  const headerTokens = approxTokenLen(`${DYNAMIC_CONTEXT_SECTION_HEADER}
+`);
+  const sepTokens = approxTokenLen("\n\n");
+  let runningTokens = headerTokens;
+  const kept = [];
+  for (const attempt of attempts) {
+    const block = `### ${CATEGORY_LABELS[attempt.category]}
+${attempt.text}`;
+    const tokens = approxTokenLen(block) + (kept.length > 0 ? sepTokens : 0);
+    if (kept.length === 0) {
+      kept.push(attempt);
+      runningTokens += tokens;
+      continue;
+    }
+    if (runningTokens + tokens > budget) break;
+    kept.push(attempt);
+    runningTokens += tokens;
+  }
+  const blocks = kept.map(
+    (k) => `### ${CATEGORY_LABELS[k.category]}
+${k.text}`
+  );
+  const section = `${DYNAMIC_CONTEXT_SECTION_HEADER}
+${blocks.join("\n\n")}`;
+  return {
+    section,
+    categoriesIncluded: kept.map((k) => k.category)
+  };
+}
+var APPROX_CHARS_PER_TOKEN, DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET, DYNAMIC_CONTEXT_SECTION_HEADER, CONTEXT_CATEGORIES, CATEGORY_KEYWORDS, TRIVIAL_GREETINGS, CATEGORY_LABELS;
+var init_concierge_context_router = __esm({
+  "src/chat/concierge-context-router.ts"() {
+    APPROX_CHARS_PER_TOKEN = 4;
+    DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET = 2e3;
+    DYNAMIC_CONTEXT_SECTION_HEADER = "## Live fortress context";
+    CONTEXT_CATEGORIES = [
+      "templates",
+      "agent_state",
+      "agent_activity",
+      "audit_log",
+      "sentinel_findings",
+      "anomaly_alerts",
+      "recent_receipts",
+      "verascore_deltas"
+    ];
+    CATEGORY_KEYWORDS = [
+      {
+        category: "templates",
+        patterns: [
+          "templates",
+          "template",
+          "channel templates",
+          "channel template",
+          "list templates",
+          "available templates",
+          "what templates"
+        ].map(phrasePattern)
+      },
+      {
+        category: "agent_state",
+        patterns: [
+          "state",
+          "status",
+          "agent state",
+          "agent status",
+          "status of agent",
+          "status of agents",
+          "state of",
+          "doing"
+        ].map(phrasePattern)
+      },
+      {
+        category: "agent_activity",
+        patterns: [
+          "activity",
+          "agent activity",
+          "what did",
+          "recent activity"
+        ].map(phrasePattern)
+      },
+      {
+        category: "audit_log",
+        patterns: [
+          "audit log",
+          "audit",
+          "log entry",
+          "log entries",
+          "what happened",
+          "show me events",
+          "event class"
+        ].map(phrasePattern)
+      },
+      {
+        category: "sentinel_findings",
+        patterns: [
+          "sentinel",
+          "sentinels",
+          "warning",
+          "warnings",
+          "alert",
+          "alerts",
+          "whats wrong",
+          "what's wrong",
+          "findings"
+        ].map(phrasePattern)
+      },
+      {
+        category: "anomaly_alerts",
+        patterns: [
+          "anomaly",
+          "anomalies",
+          "spike",
+          "unusual",
+          "outlier"
+        ].map(phrasePattern)
+      },
+      {
+        category: "recent_receipts",
+        patterns: [
+          "receipt",
+          "receipts",
+          "concordia",
+          "commitment",
+          "commitments",
+          "chain",
+          "chains"
+        ].map(phrasePattern)
+      },
+      {
+        category: "verascore_deltas",
+        patterns: [
+          "verascore",
+          "vera score",
+          "trust score",
+          "reputation"
+        ].map(phrasePattern)
+      }
+    ];
+    TRIVIAL_GREETINGS = /* @__PURE__ */ new Set([
+      "hi",
+      "hello",
+      "hey",
+      "yo",
+      "ok",
+      "thanks",
+      "thx",
+      "thank you"
+    ]);
+    CATEGORY_LABELS = {
+      templates: "Templates",
+      agent_state: "Agent state",
+      agent_activity: "Agent activity",
+      audit_log: "Audit log",
+      sentinel_findings: "Sentinel findings",
+      anomaly_alerts: "Anomaly alerts",
+      recent_receipts: "Recent receipts",
+      verascore_deltas: "Verascore deltas"
+    };
+  }
+});
+function approxTokenLen2(text) {
+  return Math.ceil(text.length / 4);
+}
 function makeEventId(prefix) {
   return `${prefix}-${Date.now()}-${crypto.randomUUID().slice(0, 8)}`;
 }
+function classifyFetcherError(error) {
+  const msg = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  if (msg.includes("timeout") || msg.includes("timed out")) return "timeout";
+  if (msg.includes("schema") || msg.includes("invalid shape")) {
+    return "schema_mismatch";
+  }
+  if (msg.includes("io") || msg.includes("read") || msg.includes("enoent") || msg.includes("eacces")) {
+    return "io_failed";
+  }
+  return "unknown";
+}
+function formatPriorTurnLine(turn) {
+  const label = turn.role === "user" ? "OPERATOR" : "CONCIERGE";
+  return `${label}: ${turn.content}`;
+}
 function hashOf(input) {
   return hashToString(sha256.sha256(stringToBytes(input)));
 }
-var DEFAULT_CONCIERGE_MAX_TOKENS, SANCTUARY_DOMAIN_REFERENCE, OperatorChatService;
+var DEFAULT_CONCIERGE_MAX_TOKENS, DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS, DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS, DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET, DEFAULT_CONCIERGE_SESSION_TTL_MS, DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET, SANCTUARY_DOMAIN_REFERENCE, OperatorChatService;
 var init_operator_chat_service = __esm({
   "src/chat/operator-chat-service.ts"() {
     init_hashing();
     init_encoding();
     init_operator_chat_audit_events();
     init_operator_chat_types();
+    init_concierge_context_router();
     DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+    DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
+    DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
+    DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
+    DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+    DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET = 2e3;
     SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
 1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
 2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
@@ -33045,6 +34118,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
       piiFilter;
       conciergeMaxTokens;
       memory;
+      historyWindowTurns;
+      historyFreshnessMs;
+      historyTokenBudget;
+      sessionTtlMs;
+      clock;
+      contextFetchers;
+      contextLlmAssist;
+      dynamicContextBudget;
       /**
        * In-memory thread_id assigned to the active concierge session.
        * The first sendConcierge call after construction allocates a fresh
@@ -33052,6 +34133,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
        * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
        */
       activeMemoryThreadId;
+      /**
+       * Wall-clock ms of the most recent sendConcierge that touched the
+       * active session thread. Drives the WP-V1.3-9 Tau-2 session-TTL
+       * check: a fresh sendConcierge after `sessionTtlMs` of quiet
+       * allocates a new thread_id even though the prior one is still
+       * readable from the memory store.
+       */
+      lastInteractionAt;
       constructor(deps) {
         this.store = deps.store;
         this.auditLog = deps.auditLog;
@@ -33063,6 +34152,18 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
         if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
         this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
         if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
+        this.historyWindowTurns = deps.conciergeHistoryWindowTurns !== void 0 && deps.conciergeHistoryWindowTurns > 0 ? deps.conciergeHistoryWindowTurns : DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS;
+        this.historyFreshnessMs = deps.conciergeHistoryFreshnessMs !== void 0 && deps.conciergeHistoryFreshnessMs > 0 ? deps.conciergeHistoryFreshnessMs : DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS;
+        this.historyTokenBudget = deps.conciergeHistoryTokenBudget !== void 0 && deps.conciergeHistoryTokenBudget > 0 ? deps.conciergeHistoryTokenBudget : DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET;
+        this.sessionTtlMs = deps.conciergeSessionTtlMs !== void 0 && deps.conciergeSessionTtlMs > 0 ? deps.conciergeSessionTtlMs : DEFAULT_CONCIERGE_SESSION_TTL_MS;
+        this.clock = deps.conciergeClock ?? (() => Date.now());
+        if (deps.conciergeContextFetchers) {
+          this.contextFetchers = deps.conciergeContextFetchers;
+        }
+        if (deps.conciergeContextLlmAssist) {
+          this.contextLlmAssist = deps.conciergeContextLlmAssist;
+        }
+        this.dynamicContextBudget = deps.conciergeDynamicContextBudget !== void 0 && deps.conciergeDynamicContextBudget > 0 ? deps.conciergeDynamicContextBudget : DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET;
       }
       // ── Concierge ─────────────────────────────────────────────────────────
       /**
@@ -33081,6 +34182,10 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           throw new Error("concierge query must not be empty");
         }
         const filterResult = this.piiFilter ? this.piiFilter.filter(trimmed) : { filtered: trimmed, redactions: 0 };
+        const nowMs = this.clock();
+        if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
+          this.activeMemoryThreadId = void 0;
+        }
         const operatorMessage = {
           message_id: crypto.randomUUID(),
           surface: "concierge",
@@ -33093,6 +34198,25 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           CONCIERGE_THREAD_KEY,
           operatorMessage
         );
+        let priorTurns = [];
+        let memoryReadFailureReason = null;
+        let activeThreadIdForRound;
+        if (this.memory) {
+          activeThreadIdForRound = this.ensureActiveMemoryThread();
+          const result = await this.memory.readThreadStrict(activeThreadIdForRound).catch(() => ({ ok: false, reason: "io_failed" }));
+          if (result.ok) {
+            const cutoff = nowMs - this.historyFreshnessMs;
+            const fresh = result.turns.filter((t) => {
+              const ts = Date.parse(t.created_at);
+              return Number.isFinite(ts) && ts >= cutoff;
+            });
+            const recent = fresh.length > this.historyWindowTurns ? fresh.slice(fresh.length - this.historyWindowTurns) : fresh;
+            priorTurns = recent;
+          } else {
+            memoryReadFailureReason = result.reason;
+            this.emitMemoryReadFailed(activeThreadIdForRound, result.reason);
+          }
+        }
         if (this.memory) {
           const threadId = this.ensureActiveMemoryThread();
           await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
@@ -33103,6 +34227,7 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
         let servedBy = "disabled";
         let displayLabel = "Concierge: substrate not configured";
         let outcome = "substrate_disabled";
+        let dynamicCategoriesIncluded = [];
         if (!this.substrateSelector) {
           conciergeBody = "Concierge unavailable. The substrate selector is not configured for this fortress. Pick a substrate in the Policy center to enable concierge replies.";
         } else {
@@ -33114,7 +34239,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
               conciergeBody = "Concierge unavailable. The chosen substrate does not support summarization. Pick a different substrate in the Policy center.";
               outcome = "substrate_disabled";
             } else {
-              const context = await this.assembleConciergeContext();
+              const dynamicResult = await this.runDynamicContextFold(
+                filterResult.filtered
+              );
+              dynamicCategoriesIncluded = dynamicResult.categoriesIncluded;
+              const context = await this.assembleConciergeContext(
+                priorTurns,
+                dynamicResult.section
+              );
               const response = await this.substrateSelector.invokeSummarize(
                 "concierge",
                 {
@@ -33153,10 +34285,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           CONCIERGE_THREAD_KEY,
           responseMessage
         );
+        let assistantTurnId;
         if (this.memory) {
           const threadId = this.ensureActiveMemoryThread();
-          await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
-          });
+          const persisted = await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => void 0);
+          if (persisted) assistantTurnId = persisted.turn_id;
+        }
+        if (this.memory && activeThreadIdForRound) {
+          this.lastInteractionAt = nowMs;
         }
         const payload = {
           version: "1.2",
@@ -33169,7 +34305,13 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           response_hash: outcome === "ok" ? hashOf(conciergeBody) : null,
           substrate: servedBy,
           latency_ms: latencyMs,
-          outcome
+          outcome,
+          ...activeThreadIdForRound !== void 0 ? { thread_id: activeThreadIdForRound } : {},
+          ...assistantTurnId !== void 0 ? { turn_index: assistantTurnId } : {},
+          ...this.memory ? {
+            prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
+          } : {},
+          ...this.contextFetchers ? { dynamic_context_categories: [...dynamicCategoriesIncluded] } : {}
         };
         this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
         return {
@@ -33179,6 +34321,25 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           outcome
         };
       }
+      /**
+       * Emit the WP-V1.3-9 Tau-2 graceful-degradation audit event. Pulled
+       * out of `sendConcierge` so the read-fold path stays readable. Emits
+       * with `result: "failure"` since the concierge fell back to
+       * single-turn mode for this round-trip.
+       */
+      emitMemoryReadFailed(threadId, reason) {
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-memfail"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_memory_read_failed",
+          surface: "concierge",
+          thread_id: threadId,
+          failure_reason: reason
+        };
+        this.emit(OPERATOR_CHAT_OPS.CONCIERGE_MEMORY_READ_FAILED, payload, "failure");
+      }
       /**
        * Read the persisted concierge thread, oldest message first. Returns
        * an empty array when no thread exists yet.
@@ -33301,6 +34462,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
        *   ## Sanctuary reference
        *   <static domain reference block>
        *
+       *   ## Live fortress context          ← WP-V1.3-9 Tau-3, when present
+       *   ### <Category>
+       *   <fetcher payload>
+       *
+       *   ## Prior conversation             ← WP-V1.3-9 Tau-2, when present
+       *   OPERATOR: ...
+       *   CONCIERGE: ...
+       *
        *   ## Recent activity
        *   <recentActivity output>
        *
@@ -33310,37 +34479,116 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
        *   ## Open inbox
        *   <openInbox output>
        *   ```
-       */
-      async assembleConciergeContext() {
+       *
+       * The substrate selector ships a `context: string` shape (not a
+       * messages array), so multi-turn coherence is folded as a structured
+       * prior-conversation section with explicit OPERATOR / CONCIERGE
+       * boundaries. Coordinator-CTO guidance: prefer messages-array shape
+       * if available; the v1.2 selector does not expose one, so structured
+       * serialization is the canonical path for v1.3.
+       */
+      async assembleConciergeContext(priorTurns = [], dynamicSection = "") {
         const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
+        const priorSection = this.formatPriorTurnsSection(priorTurns);
         if (!this.contextProviders) {
-          return `${ref}
-
-## Recent activity
-(no providers wired)
-
-## Wrapped agents
-(no providers wired)
-
-## Open inbox
-(no providers wired)`;
+          return [
+            ref,
+            ...dynamicSection ? [dynamicSection] : [],
+            ...priorSection ? [priorSection] : [],
+            "## Recent activity\n(no providers wired)",
+            "## Wrapped agents\n(no providers wired)",
+            "## Open inbox\n(no providers wired)"
+          ].join("\n\n");
         }
         const [activity, agents, inbox] = await Promise.all([
           this.contextProviders.recentActivity(),
           this.contextProviders.agentInventory(),
           this.contextProviders.openInbox()
         ]);
-        return `${ref}
-
-## Recent activity
-${activity}
-
-## Wrapped agents
-${agents}
-
-## Open inbox
-${inbox}`;
+        return [
+          ref,
+          ...dynamicSection ? [dynamicSection] : [],
+          ...priorSection ? [priorSection] : [],
+          `## Recent activity
+${activity}`,
+          `## Wrapped agents
+${agents}`,
+          `## Open inbox
+${inbox}`
+        ].join("\n\n");
+      }
+      /**
+       * Run the WP-V1.3-9 Tau-3 dynamic-context fold for a single round-
+       * trip. Fail-soft on every axis: missing fetchers short-circuit to
+       * an empty fold, fetcher failures emit a per-category audit event
+       * and are omitted from the rendered section, an LLM-assist failure
+       * proceeds with no fold. Returns the rendered section + the list of
+       * categories whose data made it into the section (used for the
+       * round-trip audit emission).
+       */
+      async runDynamicContextFold(query) {
+        if (!this.contextFetchers) {
+          return { section: "", categoriesIncluded: [] };
+        }
+        const result = await foldContext(query, this.contextFetchers, {
+          maxTokens: this.dynamicContextBudget,
+          ...this.contextLlmAssist ? { llmAssistClassify: this.contextLlmAssist } : {},
+          onFetcherFailure: (category, error) => {
+            this.emitContextFetcherFailed(category, classifyFetcherError(error));
+          }
+        });
+        return result;
+      }
+      /**
+       * Emit the WP-V1.3-9 Tau-3 fetcher-failure audit event. Pulled out
+       * of the fold path so the dynamic-context handler stays readable.
+       * Emits with `result: "failure"` since the named category dropped
+       * from the rendered section for this round-trip.
+       */
+      emitContextFetcherFailed(category, failureReason) {
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-ctxfail"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_context_fetcher_failed",
+          surface: "concierge",
+          category,
+          failure_reason: failureReason
+        };
+        this.emit(
+          OPERATOR_CHAT_OPS.CONCIERGE_CONTEXT_FETCHER_FAILED,
+          payload,
+          "failure"
+        );
+      }
+      /**
+       * Render the prior-conversation section with token-budget enforcement
+       * (WP-V1.3-9 Tau-2). Drops oldest turns first when the rendered
+       * section exceeds `historyTokenBudget`. Returns an empty string when
+       * the input is empty or when the budget excludes every turn.
+       */
+      formatPriorTurnsSection(turns) {
+        if (turns.length === 0) return "";
+        const HEADER = "## Prior conversation";
+        const lines = turns.map(formatPriorTurnLine);
+        const headerTokens = approxTokenLen2(`${HEADER}
+`);
+        const sepTokens = approxTokenLen2("\n");
+        let runningTokens = headerTokens;
+        let runningLines = [];
+        for (let i = lines.length - 1; i >= 0; i--) {
+          const line = lines[i];
+          const tokens = approxTokenLen2(line) + (runningLines.length > 0 ? sepTokens : 0);
+          if (runningTokens + tokens > this.historyTokenBudget) break;
+          runningTokens += tokens;
+          runningLines.push(line);
+        }
+        if (runningLines.length === 0) return "";
+        runningLines = runningLines.reverse();
+        return `${HEADER}
+${runningLines.join("\n")}`;
       }
       // ── audit helpers ────────────────────────────────────────────────────
       emit(operation, payload, result) {
@@ -33360,7 +34608,7 @@ ${inbox}`;
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
-var OPERATOR_CHAT_NAMESPACE, HKDF_INFO, OperatorChatStore;
+var OPERATOR_CHAT_NAMESPACE, HKDF_INFO2, OperatorChatStore;
 var init_operator_chat_store = __esm({
   "src/chat/operator-chat-store.ts"() {
     init_encryption();
@@ -33368,13 +34616,13 @@ var init_operator_chat_store = __esm({
     init_encoding();
     init_operator_chat_types();
     OPERATOR_CHAT_NAMESPACE = "_chat";
-    HKDF_INFO = "operator-chat-store-v1";
+    HKDF_INFO2 = "operator-chat-store-v1";
     OperatorChatStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
       }
       /**
        * Load a thread. Returns null if no record exists or if the on-disk
@@ -33459,7 +34707,7 @@ var init_operator_chat_store = __esm({
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix(key) {
+function stripKeyPrefix2(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -33470,7 +34718,7 @@ function lastTurnId(bundle) {
   }
   return max;
 }
-var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO2, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES2, ConciergeMemoryStore;
+var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO3, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
 var init_concierge_memory_store = __esm({
   "src/chat/concierge-memory-store.ts"() {
     init_encryption();
@@ -33478,9 +34726,9 @@ var init_concierge_memory_store = __esm({
     init_encoding();
     CONCIERGE_MEMORY_NAMESPACE = "_chat";
     CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-    HKDF_INFO2 = "concierge-memory-store-v1";
+    HKDF_INFO3 = "concierge-memory-store-v1";
     DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
-    MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+    MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
     ConciergeMemoryStore = class {
       storage;
       encryptionKey;
@@ -33489,7 +34737,7 @@ var init_concierge_memory_store = __esm({
       locks;
       constructor(opts) {
         this.storage = opts.storage;
-        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
         this.fortressId = opts.fortressId;
         this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
         this.locks = /* @__PURE__ */ new Map();
@@ -33545,6 +34793,65 @@ var init_concierge_memory_store = __esm({
         }
         return turns;
       }
+      /**
+       * Read turns with explicit failure surfacing (WP-V1.3-9 Tau-2). Where
+       * `readThread` collapses every failure mode to an empty array, this
+       * variant returns a discriminated result so the multi-turn fold path
+       * can degrade cleanly + emit `operator_concierge_memory_read_failed`
+       * with a concrete cause.
+       *
+       * - No bundle on disk → `{ ok: true, turns: [] }` (a fresh thread).
+       * - Bundle present, decode + decrypt + schema check pass → ok with turns.
+       * - Bundle present, oversize → `{ ok: false, reason: "oversize_bundle" }`.
+       * - Bundle present, decryption fails → `{ ok: false, reason: "decrypt_failed" }`.
+       * - Bundle present, schema mismatch (version / thread_id) → `schema_mismatch`.
+       * - Storage IO error → `io_failed`.
+       */
+      async readThreadStrict(threadId, opts) {
+        const key = bundleKey(threadId);
+        let raw;
+        try {
+          raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+        } catch {
+          return { ok: false, reason: "io_failed" };
+        }
+        if (!raw) return { ok: true, turns: [] };
+        if (raw.length > MAX_BUNDLE_BYTES3) {
+          return { ok: false, reason: "oversize_bundle" };
+        }
+        let envelope;
+        try {
+          envelope = JSON.parse(bytesToString(raw));
+        } catch {
+          return { ok: false, reason: "schema_mismatch" };
+        }
+        let plaintext;
+        try {
+          const aad = stringToBytes(threadId);
+          plaintext = decrypt(envelope, this.encryptionKey, aad);
+        } catch {
+          return { ok: false, reason: "decrypt_failed" };
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(bytesToString(plaintext));
+        } catch {
+          return { ok: false, reason: "schema_mismatch" };
+        }
+        if (parsed.version !== 1) return { ok: false, reason: "schema_mismatch" };
+        if (parsed.thread_id !== threadId) {
+          return { ok: false, reason: "schema_mismatch" };
+        }
+        let turns = parsed.turns;
+        if (opts?.sinceTurnId !== void 0) {
+          const cutoff = opts.sinceTurnId;
+          turns = turns.filter((t) => t.turn_id > cutoff);
+        }
+        if (opts?.limit !== void 0) {
+          turns = turns.slice(0, opts.limit);
+        }
+        return { ok: true, turns };
+      }
       /**
        * Enumerate concierge threads in this fortress with summary metadata.
        * Sorted newest-first by last_turn_at.
@@ -33556,7 +34863,7 @@ var init_concierge_memory_store = __esm({
         );
         const summaries = [];
         for (const meta of entries) {
-          const threadId = stripKeyPrefix(meta.key);
+          const threadId = stripKeyPrefix2(meta.key);
           if (threadId === null) continue;
           const bundle = await this.loadBundle(threadId);
           if (!bundle || bundle.turns.length === 0) continue;
@@ -33609,7 +34916,7 @@ var init_concierge_memory_store = __esm({
         );
         let pruned = 0;
         for (const meta of entries) {
-          const threadId = stripKeyPrefix(meta.key);
+          const threadId = stripKeyPrefix2(meta.key);
           if (threadId === null) continue;
           pruned += await this.withLock(threadId, async () => {
             const bundle = await this.loadBundle(threadId);
@@ -33640,7 +34947,7 @@ var init_concierge_memory_store = __esm({
           return null;
         }
         if (!raw) return null;
-        if (raw.length > MAX_BUNDLE_BYTES2) return null;
+        if (raw.length > MAX_BUNDLE_BYTES3) return null;
         try {
           const envelope = JSON.parse(bytesToString(raw));
           const aad = stringToBytes(threadId);
@@ -33731,7 +35038,18 @@ function buildV11Bindings(inputs) {
         registry
       }),
       conciergePiiFilter: buildConciergePiiFilter(),
-      conciergeMemory
+      conciergeMemory,
+      conciergeContextFetchers: buildConciergeContextFetchers({
+        auditLog: inputs.auditLog,
+        identityId: inputs.identityId,
+        registry
+      }),
+      ...inputs.intelligenceSelector ? {
+        conciergeContextLlmAssist: buildConciergeContextLlmAssist({
+          selector: inputs.intelligenceSelector,
+          identityId: inputs.identityId
+        })
+      } : {}
     });
   }
   const hubService = new HubService({
@@ -33792,6 +35110,107 @@ function buildConciergeContextProviders(args) {
     }
   };
 }
+function buildConciergeContextFetchers(args) {
+  const empty = async () => "";
+  return {
+    templates: async () => {
+      const entries = listTemplates();
+      if (entries.length === 0) return "(no templates installed)";
+      const lines = entries.map((e) => {
+        const m = e.metadata;
+        return `${m.name} (tier ${m.tier}, channel ${m.channel}, target ${m.target_archetype})`;
+      });
+      return lines.join("\n");
+    },
+    agent_state: async (agentNameHint) => {
+      const records = args.registry.list({ identity_id: args.identityId });
+      if (records.length === 0) return "(no wrapped agents)";
+      const filtered = agentNameHint ? records.filter(
+        (r) => r.agent_id.toLowerCase().includes(agentNameHint.toLowerCase()) || r.harness.toLowerCase().includes(agentNameHint.toLowerCase())
+      ) : records;
+      const target = filtered.length > 0 ? filtered : records;
+      const lines = target.slice(0, 20).map((r) => {
+        const tmpl = typeof r.channel_template_id === "string" ? r.channel_template_id : "no_template";
+        return `${r.agent_id}  harness=${r.harness}  status=${r.status}  template=${tmpl}`;
+      });
+      return lines.join("\n");
+    },
+    agent_activity: async (agentNameHint) => {
+      const result = await args.auditLog.query({ limit: 50 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId
+      );
+      const filtered = agentNameHint ? owned.filter((e) => {
+        const agentId = e.details && typeof e.details["agent_id"] === "string" ? e.details["agent_id"] : "";
+        return agentId.toLowerCase().includes(agentNameHint.toLowerCase());
+      }) : owned;
+      const tail = (filtered.length > 0 ? filtered : owned).slice(-20);
+      if (tail.length === 0) return "(no activity)";
+      return tail.map((e) => {
+        const agentId = (e.details && typeof e.details["agent_id"] === "string" ? e.details["agent_id"] : null) ?? "_fortress";
+        return `${e.timestamp}  ${e.layer}.${e.operation}  agent=${agentId}  result=${e.result}`;
+      }).join("\n");
+    },
+    audit_log: async () => {
+      const result = await args.auditLog.query({ limit: 30 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId
+      );
+      if (owned.length === 0) return "(no audit log entries)";
+      return owned.slice(-30).map(
+        (e) => `${e.timestamp}  ${e.layer}.${e.operation}  result=${e.result}`
+      ).join("\n");
+    },
+    sentinel_findings: empty,
+    anomaly_alerts: empty,
+    recent_receipts: async () => {
+      const result = await args.auditLog.query({ limit: 100 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId && e.operation.startsWith("composition_")
+      );
+      if (owned.length === 0) return "(no recent composition events)";
+      return owned.slice(-15).map((e) => `${e.timestamp}  ${e.operation}  result=${e.result}`).join("\n");
+    },
+    verascore_deltas: empty
+  };
+}
+function buildConciergeContextLlmAssist(args) {
+  return async (query, categories) => {
+    const labelList = categories.map((c) => `- ${c}`).join("\n");
+    const prompt2 = `You are a router. Classify the operator's query into one of the categories below or "none".
+Reply with exactly one token: one category name or "none".
+
+Categories:
+${labelList}
+
+Query: ${query}
+
+Category:`;
+    try {
+      const handle = await args.selector.getSubstrate("concierge");
+      if (!handle.capability.summarize) return "none";
+      const response = await args.selector.invokeSummarize("concierge", {
+        kind: "summarize",
+        context: prompt2,
+        query: "Output the single category token.",
+        maxTokens: 16
+      });
+      if (response.failureClass || response.body.kind !== "summarize") {
+        return "none";
+      }
+      const raw = response.body.text.trim().toLowerCase();
+      const head = raw.split(/\s|[.,!?:;]/)[0] ?? "";
+      const normalized = head.replace(/[^a-z_]/g, "");
+      const known = categories;
+      if (known.includes(normalized)) {
+        return normalized;
+      }
+      return "none";
+    } catch {
+      return "none";
+    }
+  };
+}
 function buildConciergePiiFilter() {
   return {
     filter(input) {
@@ -33819,6 +35238,7 @@ var init_wiring = __esm({
     init_agent_registry_persistence();
     init_operator_chat_index();
     init_privacy_filter();
+    init_registry();
     CapabilityErrorAgentController = class {
       fail(action) {
         throw new HubCapabilityError(
@@ -33966,7 +35386,7 @@ var init_defaults = __esm({
 });
 
 // src/intelligence/policy-store.ts
-var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO3, IntelligenceConfigStore;
+var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO4, IntelligenceConfigStore;
 var init_policy_store = __esm({
   "src/intelligence/policy-store.ts"() {
     init_encryption();
@@ -33975,13 +35395,13 @@ var init_policy_store = __esm({
     init_defaults();
     INTELLIGENCE_NAMESPACE = "_intelligence";
     SUBSTRATE_CONFIG_KEY = "substrate-config";
-    HKDF_INFO3 = "intelligence-substrate-config";
+    HKDF_INFO4 = "intelligence-substrate-config";
     IntelligenceConfigStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
       }
       /**
        * Load the operator's substrate config from disk. Returns the config
@@ -36442,7 +37862,7 @@ async function resolveSourceMasterKey(encryptedState, opts) {
   }
   return null;
 }
-async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId) {
+async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId, importedRekeyEntries) {
   const destinationSigner = opts.destinationSignerIdentityId ? opts.identityManager.get(opts.destinationSignerIdentityId) : opts.identityManager.getDefault();
   if (!destinationSigner) {
     return {
@@ -36504,8 +37924,9 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         }
       }
     }
+    let plaintext;
     try {
-      const plaintext = decrypt(
+      plaintext = decrypt(
         item.entry.payload,
         deriveNamespaceKey(sourceMasterKey, item.namespace)
       );
@@ -36514,28 +37935,30 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         skipped++;
         continue;
       }
-      await stateStore.write(
-        item.namespace,
-        item.key,
-        bytesToString(plaintext),
-        destinationSigner.identity_id,
-        destinationSigner.encrypted_private_key,
-        identityEncryptionKey,
-        {
-          content_type: item.entry.metadata.content_type,
-          ttl_seconds: item.entry.metadata.ttl_seconds,
-          tags: [
-            ...item.entry.metadata.tags ?? [],
-            "exit-import",
-            `source:${item.entry.kid}`
-          ]
-        }
-      );
-      imported++;
     } catch {
       skippedInvalidSig++;
       skipped++;
+      continue;
     }
+    await stateStore.write(
+      item.namespace,
+      item.key,
+      bytesToString(plaintext),
+      destinationSigner.identity_id,
+      destinationSigner.encrypted_private_key,
+      identityEncryptionKey,
+      {
+        content_type: item.entry.metadata.content_type,
+        ttl_seconds: item.entry.metadata.ttl_seconds,
+        tags: [
+          ...item.entry.metadata.tags ?? [],
+          "exit-import",
+          `source:${item.entry.kid}`
+        ]
+      }
+    );
+    imported++;
+    importedRekeyEntries?.push({ namespace: item.namespace, key: item.key });
   }
   return {
     status: "rekeyed",
@@ -36546,6 +37969,23 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
     conflicts
   };
 }
+async function cleanupStagedPaths(storage, staged) {
+  let removed = 0;
+  const failed = [];
+  for (const loc of staged) {
+    try {
+      const ok2 = await storage.delete(loc.namespace, loc.key);
+      if (ok2) {
+        removed++;
+      } else {
+        failed.push(loc);
+      }
+    } catch {
+      failed.push(loc);
+    }
+  }
+  return { removed, failed };
+}
 async function stageArtifact(storage, namespace, key, value) {
   await storage.write(namespace, key, jsonBytes(value));
 }
@@ -36670,6 +38110,8 @@ async function importExitBundle(opts) {
   }
   const importId = importIdForManifest(manifest);
   const stagedArtifacts = [];
+  const stagedLocations = [];
+  const importedRekeyEntries = [];
   if (identityArtifact) {
     await stageArtifact(
       opts.storage,
@@ -36678,10 +38120,15 @@ async function importExitBundle(opts) {
       identityArtifact.json
     );
     stagedArtifacts.push("public_identity");
+    stagedLocations.push({
+      namespace: EXIT_PUBLIC_IDENTITIES_NAMESPACE,
+      key: identityArtifact.json.bundle.identity_id
+    });
   }
   if (policySet) {
     await stageArtifact(opts.storage, EXIT_POLICY_SETS_NAMESPACE, importId, policySet.json);
     stagedArtifacts.push("policy_set");
+    stagedLocations.push({ namespace: EXIT_POLICY_SETS_NAMESPACE, key: importId });
   }
   if (auditReceipts) {
     await stageArtifact(
@@ -36691,10 +38138,12 @@ async function importExitBundle(opts) {
       auditReceipts.json
     );
     stagedArtifacts.push("audit_receipts");
+    stagedLocations.push({ namespace: EXIT_AUDIT_RECEIPTS_NAMESPACE, key: importId });
   }
   if (commitments) {
     await stageArtifact(opts.storage, EXIT_COMMITMENTS_NAMESPACE, importId, commitments.json);
     stagedArtifacts.push("commitments");
+    stagedLocations.push({ namespace: EXIT_COMMITMENTS_NAMESPACE, key: importId });
   }
   if (placeholderMetadata) {
     await stageArtifact(
@@ -36704,12 +38153,17 @@ async function importExitBundle(opts) {
       placeholderMetadata.json
     );
     stagedArtifacts.push("placeholder_vault_metadata");
+    stagedLocations.push({
+      namespace: EXIT_PLACEHOLDER_METADATA_NAMESPACE,
+      key: importId
+    });
   }
   await stageArtifact(opts.storage, EXIT_IMPORT_NAMESPACE, importId, {
     manifest: manifest.body,
     verified_at: verification.verified_at,
     activated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
+  stagedLocations.push({ namespace: EXIT_IMPORT_NAMESPACE, key: importId });
   const publicKeys = identityArtifact ? publicKeysFromIdentityArtifact(identityArtifact.json) : { byIdentityId: /* @__PURE__ */ new Map(), byDid: /* @__PURE__ */ new Map() };
   let reputationResult = {
     imported_attestations: 0,
@@ -36734,26 +38188,57 @@ async function importExitBundle(opts) {
     encryptedState?.json ?? null,
     opts
   );
-  const stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
-    encryptedState.json,
-    opts,
-    sourceMasterKey,
-    publicKeys.byIdentityId
-  ) : {
-    status: "staged_requires_source_key",
-    imported_keys: 0,
-    skipped_keys: encryptedState.json.entries.length,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: conflicts.state_conflicts.length
-  } : {
-    status: "not_requested",
-    imported_keys: 0,
-    skipped_keys: 0,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: 0
-  };
+  let stateResult;
+  try {
+    stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
+      encryptedState.json,
+      opts,
+      sourceMasterKey,
+      publicKeys.byIdentityId,
+      importedRekeyEntries
+    ) : {
+      status: "staged_requires_source_key",
+      imported_keys: 0,
+      skipped_keys: encryptedState.json.entries.length,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: conflicts.state_conflicts.length
+    } : {
+      status: "not_requested",
+      imported_keys: 0,
+      skipped_keys: 0,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: 0
+    };
+  } catch (err) {
+    const toCleanup = [
+      ...importedRekeyEntries,
+      ...stagedLocations
+    ];
+    const cleanup = await cleanupStagedPaths(opts.storage, toCleanup);
+    opts.auditLog.append(
+      "l1",
+      "exit_bundle_rekey_failed_cleanup",
+      manifest.body.identity_binding.identity_id,
+      {
+        import_id: importId,
+        manifest_version: manifest.body.manifest_version,
+        rekey_entries_removed: importedRekeyEntries.length,
+        staged_artifacts_removed: stagedLocations.length,
+        removed_total: cleanup.removed,
+        cleanup_failed_count: cleanup.failed.length,
+        original_error: err instanceof Error ? err.message : String(err)
+      },
+      "failure"
+    );
+    await opts.auditLog.flush();
+    const originalMessage = err instanceof Error ? err.message : String(err);
+    throw new ExitBundleImportError(
+      "REKEY_FAILED_AND_CLEANED",
+      `Exit-bundle re-key failed: ${originalMessage}. Cleanup removed ${cleanup.removed} of ${toCleanup.length} staged paths (${importedRekeyEntries.length} re-keyed entries plus ${stagedLocations.length} staged artifacts; ${cleanup.failed.length} cleanup deletes failed).`
+    );
+  }
   opts.auditLog.append("l1", "exit_bundle_import_activate", manifest.body.identity_binding.identity_id, {
     import_id: importId,
     manifest_version: manifest.body.manifest_version,
@@ -37832,16 +39317,35 @@ ${err.message}
       timestamp: alert.timestamp
     });
   } : void 0;
-  const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
   const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
   const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const aggregatorPayloadStore = new AggregatorPayloadStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
   const approvalAggregator = new ApprovalAggregator({
     storage,
     masterKey,
     auditLog,
     identityId: aggregatorIdentityId,
-    fortressId: fortressIdForAggregator
+    fortressId: fortressIdForAggregator,
+    payloadStore: aggregatorPayloadStore
+  });
+  const wrappedApprovalChannel = new AggregatorBackedChannel({
+    underlying: approvalChannel,
+    aggregator: approvalAggregator,
+    resolveRedirect: makeRedirectResolverFromPolicySupplier(() => policy),
+    replaceModeTimeoutMs: policy.approval_channel.timeout_seconds * 1e3
   });
+  const gate = new ApprovalGate(
+    policy,
+    baseline,
+    wrappedApprovalChannel,
+    auditLog,
+    injectionDetector,
+    onInjectionAlert
+  );
   gate.setApprovalEventCallback((event) => {
     void approvalAggregator.ingest(event);
   });
@@ -38039,6 +39543,8 @@ var init_src = __esm({
     init_webhook();
     init_gate();
     init_approval_aggregator();
+    init_aggregator_backed_channel();
+    init_aggregator_store();
     init_tools4();
     init_router();
     init_router();
@@ -41003,6 +42509,22 @@ var init_broker = __esm({
       auditLog;
       issuer;
       principalIdentityId;
+      /**
+       * Per-secret-name mutex. Hardening wave 6 finding #64: two concurrent
+       * addSecret() / rotateSecret() / deleteSecret() calls on the same name
+       * MUST serialize cleanly. The keychain backend's `find-then-add` and
+       * `find-then-delete-then-add` shapes (KeychainBackend.addSecret /
+       * .rotateSecret) are not atomic against another caller racing the same
+       * service-name; without serialization the second caller can observe a
+       * stale "exists" check and either drop the new value or leave a
+       * duplicate keychain entry.
+       *
+       * Implementation: an in-memory promise chain per name. Subsequent
+       * callers `await` the chain tail and append their own work; failures
+       * propagate to the failing caller without poisoning the chain for
+       * later callers.
+       */
+      nameLocks = /* @__PURE__ */ new Map();
       constructor(opts) {
         this.backend = opts.backend;
         this.auditLog = opts.auditLog;
@@ -41013,6 +42535,40 @@ var init_broker = __esm({
           grants: opts.grants
         });
       }
+      /**
+       * Serialize `op` against any other in-flight write to the same secret
+       * `name`. Per-name fairness only, distinct names run in parallel.
+       * The current chain tail is used as the acceptance gate; we then
+       * publish a new tail that swallows the operation's outcome so a
+       * thrown error does not poison the next caller's wait.
+       */
+      async withNameLock(name, op) {
+        const previous = this.nameLocks.get(name) ?? Promise.resolve();
+        let release = () => {
+        };
+        const next = new Promise((resolve8) => {
+          release = resolve8;
+        });
+        this.nameLocks.set(name, next);
+        try {
+          await previous.catch(() => {
+          });
+          return await op();
+        } finally {
+          release();
+          if (this.nameLocks.get(name) === next) {
+            this.nameLocks.delete(name);
+          }
+        }
+      }
+      /**
+       * Diagnostic-only: visible for tests so they can assert that distinct
+       * names do not contend on a shared lock. Not part of the public broker
+       * contract; do not consume from production code.
+       */
+      __nameLockCountForTests() {
+        return this.nameLocks.size;
+      }
       /** Ensure backend is initialized and unlocked. Audits the unlock. */
       async ensureUnlocked(passphrase) {
         await this.backend.ensureInitialized(passphrase);
@@ -41025,31 +42581,37 @@ var init_broker = __esm({
         );
       }
       async addSecret(name, value) {
-        await this.backend.addSecret(name, value);
-        this.auditLog.append(
-          "l3",
-          BROKER_OPS.SECRET_ADDED,
-          this.principalIdentityId,
-          { secret: name }
-        );
+        await this.withNameLock(name, async () => {
+          await this.backend.addSecret(name, value);
+          this.auditLog.append(
+            "l3",
+            BROKER_OPS.SECRET_ADDED,
+            this.principalIdentityId,
+            { secret: name }
+          );
+        });
       }
       async rotateSecret(name, newValue) {
-        await this.backend.rotateSecret(name, newValue);
-        this.auditLog.append(
-          "l3",
-          BROKER_OPS.SECRET_ROTATED,
-          this.principalIdentityId,
-          { secret: name }
-        );
+        await this.withNameLock(name, async () => {
+          await this.backend.rotateSecret(name, newValue);
+          this.auditLog.append(
+            "l3",
+            BROKER_OPS.SECRET_ROTATED,
+            this.principalIdentityId,
+            { secret: name }
+          );
+        });
       }
       async deleteSecret(name) {
-        await this.backend.deleteSecret(name);
-        this.auditLog.append(
-          "l3",
-          BROKER_OPS.SECRET_DELETED,
-          this.principalIdentityId,
-          { secret: name }
-        );
+        await this.withNameLock(name, async () => {
+          await this.backend.deleteSecret(name);
+          this.auditLog.append(
+            "l3",
+            BROKER_OPS.SECRET_DELETED,
+            this.principalIdentityId,
+            { secret: name }
+          );
+        });
       }
       async listSecretNames() {
         return this.backend.listSecretNames();
@@ -41089,6 +42651,19 @@ var init_broker = __esm({
       liveTokenCount() {
         return this.issuer.liveTokenCount();
       }
+      /**
+       * Drop expired tokens from the in-memory issuer map. Hardening wave 6
+       * finding #86: previously expiry pruning depended on opportunistic
+       * `pruneExpired()` calls; now the cocoon-unlock initialization path
+       * (openBroker -> after backend.ensureInitialized -> after Broker
+       * construction) fires this once so each cocoon-unlock cycle drops
+       * stale bindings before any operator interaction.
+       *
+       * Returns the number of tokens removed. Safe to call repeatedly; idempotent.
+       */
+      pruneExpiredTokens() {
+        return this.issuer.pruneExpired();
+      }
       /**
        * Audit query restricted to broker-scoped operations. Returns entries
        * with their timestamps, op, and result (never the secret value).
@@ -41247,6 +42822,7 @@ async function openBroker(opts = {}) {
     grants,
     principalIdentityId: opts.principalIdentityId ?? "sanctuary-broker"
   });
+  broker.pruneExpiredTokens();
   return {
     broker,
     close: async () => {
@@ -42115,8 +43691,6 @@ var init_health = __esm({
     DEFAULT_TIMEOUT_MS4 = 500;
   }
 });
-
-// src/cli/agents/cli.ts
 function resolveCtx(args) {
   const env = args.env ?? process.env;
   const discoverOpts = {
@@ -42154,6 +43728,8 @@ async function runAgentsCommand(args) {
         return await cmdShow2(rest, ctx);
       case "status":
         return await cmdStatus(rest, ctx);
+      case "config":
+        return await cmdConfig(rest, ctx);
       default:
         ctx.err.write(`Unknown subcommand: ${sub}
 `);
@@ -42169,10 +43745,18 @@ async function runAgentsCommand(args) {
 }
 function printUsage4(s) {
   s.write(`Usage: sanctuary agents <command> [flags]
+       sanctuary agent  <command> [flags]   (alias)
 
   list [--json]                 List every tenant visible on this host.
-  show <tenant> [--json]        Show details for one tenant.
+  show <tenant> [--json]        Show details for one tenant (includes
+                                approval-redirect state).
   status [--json]               One-line-per-tenant running/stopped summary.
+  config <tenant> [opts]        Write tenant principal-policy.yaml fields.
+    --approval-redirect=<bool>    Toggle cross-harness inbox redirect.
+    --approval-redirect-mode=<replace|notify>
+                                  Pick replace (bypass underlying channel)
+                                  or notify (race both paths). Default
+                                  replace when toggled on.
 
 Options:
   --fortress <path>             Scope discovery to a specific storage path
@@ -42274,6 +43858,7 @@ async function cmdShow2(argv, ctx) {
     return 1;
   }
   const probe = await ctx.probe(tenant);
+  const approvalRedirect = await readApprovalRedirectState(tenant);
   const payload = {
     name: tenant.name,
     storage_path: tenant.storage_path,
@@ -42287,7 +43872,8 @@ async function cmdShow2(argv, ctx) {
       running: probe.running,
       status: probe.status,
       reason: probe.reason
-    }
+    },
+    approval_redirect: approvalRedirect
   };
   if (hasJsonFlag(argv)) {
     ctx.out.write(JSON.stringify(payload, null, 2) + "\n");
@@ -42331,10 +43917,173 @@ async function cmdShow2(argv, ctx) {
   }
   ctx.out.write(
     `probe:             ${probe.running ? "running" : "not-running"}${probe.reason ? ` (${probe.reason})` : ""}
+`
+  );
+  ctx.out.write(
+    `approval_redirect: ${approvalRedirect.enabled ? `on (${approvalRedirect.mode})` : "off"}
 `
   );
   return 0;
 }
+async function readApprovalRedirectState(tenant) {
+  const policyPath = path.join(tenant.storage_path, "principal-policy.yaml");
+  try {
+    const content = await promises.readFile(policyPath, "utf-8");
+    const parsed = parsePolicy(content);
+    const cfg = parsed.approval_redirect;
+    if (!cfg) return { enabled: false, mode: "replace" };
+    return {
+      enabled: !!cfg.enabled,
+      mode: cfg.mode === "notify" ? "notify" : "replace"
+    };
+  } catch {
+    return { enabled: false, mode: "replace" };
+  }
+}
+function parseBoolFlag(raw) {
+  if (raw === void 0) return null;
+  const v = raw.toLowerCase();
+  if (v === "true" || v === "yes" || v === "on" || v === "1") return true;
+  if (v === "false" || v === "no" || v === "off" || v === "0") return false;
+  return null;
+}
+function findFlagValue(argv, name) {
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === name) {
+      return argv[i + 1];
+    }
+    const eq = `${name}=`;
+    if (a.startsWith(eq)) {
+      return a.slice(eq.length);
+    }
+  }
+  return void 0;
+}
+async function cmdConfig(argv, ctx) {
+  const positional = argv.find((a) => !a.startsWith("--"));
+  if (!positional) {
+    ctx.err.write(
+      "Missing tenant. Usage: sanctuary agents config <tenant> --approval-redirect=<bool>\n"
+    );
+    return 2;
+  }
+  const tenant = await findTenant(positional, ctx.discoverOpts);
+  if (!tenant) {
+    ctx.err.write(`sanctuary agents: unknown tenant "${positional}"
+`);
+    return 1;
+  }
+  const redirectFlag = parseBoolFlag(
+    findFlagValue(argv, "--approval-redirect")
+  );
+  const modeFlag = findFlagValue(argv, "--approval-redirect-mode");
+  if (redirectFlag === null && modeFlag === void 0) {
+    ctx.err.write(
+      "sanctuary agents config: nothing to do. Pass --approval-redirect=<bool> or --approval-redirect-mode=<replace|notify>.\n"
+    );
+    return 2;
+  }
+  if (modeFlag !== void 0 && modeFlag !== "replace" && modeFlag !== "notify") {
+    ctx.err.write(
+      `sanctuary agents config: --approval-redirect-mode must be "replace" or "notify" (got "${modeFlag}")
+`
+    );
+    return 2;
+  }
+  const current = await readApprovalRedirectState(tenant);
+  const next = {
+    enabled: redirectFlag !== null ? redirectFlag : current.enabled,
+    mode: modeFlag === "notify" || modeFlag === "replace" ? modeFlag : current.mode
+  };
+  await writeApprovalRedirectToPolicyFile(tenant.storage_path, next);
+  if (hasJsonFlag(argv)) {
+    ctx.out.write(
+      JSON.stringify(
+        {
+          tenant: tenant.name,
+          approval_redirect: next
+        },
+        null,
+        2
+      ) + "\n"
+    );
+  } else {
+    ctx.out.write(
+      `sanctuary agents config: tenant "${tenant.name}" approval_redirect=${next.enabled ? `on (${next.mode})` : "off"}
+`
+    );
+    ctx.out.write(
+      `  Takes effect on the next gate request for the running server.
+`
+    );
+  }
+  return 0;
+}
+async function writeApprovalRedirectToPolicyFile(storagePath, state) {
+  const policyPath = path.join(storagePath, "principal-policy.yaml");
+  let content;
+  try {
+    content = await promises.readFile(policyPath, "utf-8");
+  } catch (err) {
+    const code = err?.code;
+    if (code !== "ENOENT") throw err;
+    content = await defaultPolicyTextForBootstrap();
+  }
+  const block = renderApprovalRedirectBlock(state);
+  const updated = upsertApprovalRedirectBlock(content, block);
+  await promises.writeFile(policyPath, updated, "utf-8");
+  await promises.chmod(policyPath, 384);
+}
+function renderApprovalRedirectBlock(state) {
+  return [
+    "# Approval Redirect (v1.3 WP-V1.3-10 Upsilon-2)",
+    "approval_redirect:",
+    `  enabled: ${state.enabled ? "true" : "false"}`,
+    `  mode: ${state.mode}`
+  ].join("\n");
+}
+function upsertApprovalRedirectBlock(content, block) {
+  const lines = content.split("\n");
+  const startIdx = lines.findIndex((l) => l.startsWith("approval_redirect:"));
+  if (startIdx === -1) {
+    const trimmed = content.endsWith("\n") ? content : content + "\n";
+    return trimmed + "\n" + block + "\n";
+  }
+  let blockStart = startIdx;
+  if (blockStart > 0 && lines[blockStart - 1] !== void 0 && lines[blockStart - 1].startsWith("# Approval Redirect")) {
+    blockStart = blockStart - 1;
+  }
+  let blockEnd = startIdx + 1;
+  while (blockEnd < lines.length) {
+    const l = lines[blockEnd];
+    if (l === "") {
+      blockEnd++;
+      continue;
+    }
+    if (/^[A-Za-z0-9#]/.test(l)) {
+      break;
+    }
+    blockEnd++;
+  }
+  const before = lines.slice(0, blockStart);
+  const after = lines.slice(blockEnd);
+  const replaced = [...before, ...block.split("\n"), ...after].join("\n");
+  return replaced.endsWith("\n") ? replaced : replaced + "\n";
+}
+async function defaultPolicyTextForBootstrap() {
+  return [
+    "version: 1",
+    "tier1_always_approve:",
+    "  - state_export",
+    "  - state_import",
+    "  - state_delete",
+    "approval_channel:",
+    "  type: stderr",
+    "  timeout_seconds: 300",
+    ""
+  ].join("\n");
+}
 async function cmdStatus(argv, ctx) {
   const tenants = await discoverTenants(ctx.discoverOpts);
   const probes = await Promise.all(tenants.map((t) => ctx.probe(t)));
@@ -42375,6 +44124,7 @@ var init_cli5 = __esm({
   "src/cli/agents/cli.ts"() {
     init_discovery();
     init_health();
+    init_loader();
   }
 });
 
@@ -43803,7 +45553,7 @@ async function main() {
     const code = await runIdentityCommand2({ argv: args.slice(1) });
     process.exit(code);
   }
-  if (args[0] === "agents") {
+  if (args[0] === "agents" || args[0] === "agent") {
     const { runAgentsCommand: runAgentsCommand2 } = await Promise.resolve().then(() => (init_agents(), agents_exports));
     const code = await runAgentsCommand2({ argv: args.slice(1) });
     process.exit(code);