@sanctuary-framework/mcp-server 1.2.4 → 1.2.6

package/dist/index.js

@@ -4254,6 +4254,10 @@ var DEFAULT_CHANNEL = {
   // SEC-002: auto_deny is not configurable. Timeout always denies.
   // Field omitted intentionally — all channels hardcode deny on timeout.
 };
+var DEFAULT_APPROVAL_REDIRECT = {
+  enabled: false,
+  mode: "replace"
+};
 var DEFAULT_POLICY = {
   version: 1,
   tier1_always_approve: [
@@ -4327,6 +4331,7 @@ var DEFAULT_POLICY = {
     "handshake_status",
     "handshake_exchange",
     "handshake_verify_attestation",
+    "handshake_abort",
     "reputation_query_weighted",
     "federation_peers",
     "federation_trust_evaluate",
@@ -4368,7 +4373,8 @@ var DEFAULT_POLICY = {
     "compliance_eu_ai_act_annex_iii_classify"
     // Read-only; rule-based Annex III classifier
   ],
-  approval_channel: DEFAULT_CHANNEL
+  approval_channel: DEFAULT_CHANNEL,
+  approval_redirect: DEFAULT_APPROVAL_REDIRECT
 };
 function extractOperationName(toolName) {
   if (toolName.startsWith("proxy/")) {
@@ -4465,9 +4471,35 @@ function validatePolicy(raw) {
       };
       delete merged.auto_deny;
       return merged;
-    })()
+    })(),
+    approval_redirect: parseApprovalRedirect(raw.approval_redirect)
   };
 }
+function parseApprovalRedirect(raw) {
+  if (raw === void 0 || raw === null) {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  if (typeof raw !== "object") {
+    return { ...DEFAULT_APPROVAL_REDIRECT };
+  }
+  const obj = raw;
+  const enabled = typeof obj.enabled === "boolean" ? obj.enabled : DEFAULT_APPROVAL_REDIRECT.enabled;
+  const modeRaw = obj.mode;
+  let mode = DEFAULT_APPROVAL_REDIRECT.mode;
+  if (modeRaw !== void 0) {
+    if (modeRaw !== "replace" && modeRaw !== "notify") {
+      throw new Error(
+        `approval_redirect.mode must be "replace" or "notify" (got ${JSON.stringify(modeRaw)})`
+      );
+    }
+    mode = modeRaw;
+  }
+  const result = { enabled, mode };
+  if (obj.per_agent !== void 0 && typeof obj.per_agent === "object" && obj.per_agent !== null) {
+    result.per_agent = obj.per_agent;
+  }
+  return result;
+}
 function generateDefaultPolicyYaml() {
   return `# Sanctuary Principal Policy v1
 # This file controls what your agent can do without asking.
@@ -4546,6 +4578,7 @@ tier3_always_allow:
   - handshake_status
   - handshake_exchange
   - handshake_verify_attestation
+  - handshake_abort
   - reputation_query_weighted
   - federation_peers
   - federation_trust_evaluate
@@ -4580,6 +4613,21 @@ tier3_always_allow:
 approval_channel:
   type: stderr
   timeout_seconds: 300
+
+# \u2500\u2500\u2500 Approval Redirect (v1.3 WP-V1.3-10 Upsilon-2) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+# Cross-harness approval-inbox redirect. When enabled, Tier 1/2 approvals
+# resolve via the unified approval inbox at /api/approval-inbox/* instead
+# of (or in addition to) the configured approval_channel above.
+#
+# mode:
+#   replace: bypass the approval_channel entirely; the gate awaits a
+#            decision from the inbox (default once enabled).
+#   notify:  fire BOTH the approval_channel and the inbox; first decision
+#            wins. Right shape for harnesses that cannot fully suppress
+#            their local approval prompt (e.g. Mastra-class).
+approval_redirect:
+  enabled: false
+  mode: replace
 `;
 }
 var MalformedPrincipalPolicyError = class extends Error {
@@ -16264,6 +16312,27 @@ async function handleApprovalInboxRoute(deps, req, res) {
       await handleStream2(deps, res);
       return true;
     }
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/history`) {
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const statusRaw = url.searchParams.get("status");
+      const sinceTs = url.searchParams.get("since") ?? void 0;
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const filterStatus = statusRaw && isStatusFilter(statusRaw) && statusRaw !== "pending" ? statusRaw : void 0;
+      const entries = await deps.aggregator.getHistory(
+        {
+          limit,
+          ...filterStatus !== void 0 ? { status: filterStatus } : {},
+          ...sinceTs !== void 0 ? { sinceTs } : {}
+        },
+        operatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entries } });
+      return true;
+    }
     if (method === "GET" && path === APPROVAL_INBOX_API_PREFIX) {
       const limit = parseLimit2(
         url.searchParams.get("limit"),
@@ -16286,11 +16355,39 @@ async function handleApprovalInboxRoute(deps, req, res) {
       writeJSON4(res, 404, { ok: false, error: "not_found", path });
       return true;
     }
-    if (method === "GET" && entryMatch.action === null) {
-      const entries = await deps.aggregator.list({ limit: APPROVAL_INBOX_MAX_LIMIT });
-      const entry = entries.find(
-        (e) => e.aggregator_id === entryMatch.aggregatorId
+    if (method === "GET" && entryMatch.action === "audit-trail") {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const trail = await deps.aggregator.getAuditTrail(
+        entryMatch.aggregatorId,
+        operatorId
+      );
+      writeJSON4(res, 200, { ok: true, data: { entry, audit_trail: trail } });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === "payload") {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
+      if (!entry) {
+        writeJSON4(res, 404, { ok: false, error: "not_found" });
+        return true;
+      }
+      const operatorId = deps.operatorId ?? APPROVAL_INBOX_OPERATOR_DEFAULT;
+      const payload = await deps.aggregator.getFullPayloadWithAudit(
+        entryMatch.aggregatorId,
+        operatorId
       );
+      writeJSON4(res, 200, {
+        ok: true,
+        data: { entry, request_payload: payload }
+      });
+      return true;
+    }
+    if (method === "GET" && entryMatch.action === null) {
+      const entry = await deps.aggregator.getEntry(entryMatch.aggregatorId);
       if (!entry) {
         writeJSON4(res, 404, { ok: false, error: "not_found" });
         return true;
@@ -19277,7 +19374,10 @@ var APPROVAL_AGGREGATOR_HKDF_INFO = "l2-approval-aggregator-v1";
 var APPROVAL_AGGREGATOR_AUDIT_OPS = {
   AGGREGATED: "cross_harness_approval_aggregated",
   RESOLVED: "cross_harness_approval_resolved",
-  DEDUPED: "cross_harness_approval_deduped"
+  DEDUPED: "cross_harness_approval_deduped",
+  PAYLOAD_DECRYPTED: "cross_harness_approval_payload_decrypted",
+  AUDIT_TRAIL_VIEWED: "cross_harness_approval_audit_trail_viewed",
+  REPLAYED: "cross_harness_approval_replayed"
 };
 var DEFAULT_PENDING_TTL_MS = 5 * 60 * 1e3;
 var DEFAULT_MAX_LIST_LIMIT = 200;
@@ -19293,6 +19393,8 @@ var ApprovalAggregator = class {
   now;
   resolveSourceContext;
   resolveHubInboxItemId;
+  payloadStore;
+  resolveEnforcementChain;
   /** Cached entries by `aggregator_id`. */
   entries = /* @__PURE__ */ new Map();
   /** Dedup index: `${harness}|${agent}|${audit_id}` -> aggregator_id. */
@@ -19322,6 +19424,14 @@ var ApprovalAggregator = class {
       source_agent_id: this.fortressId
     }));
     this.resolveHubInboxItemId = deps.resolveHubInboxItemId ?? ((_event) => void 0);
+    this.payloadStore = deps.payloadStore ?? null;
+    this.resolveEnforcementChain = deps.resolveEnforcementChain ?? ((event) => [
+      {
+        layer: "l2",
+        event: `approval_required:${event.operation}`,
+        timestamp: event.request_timestamp
+      }
+    ]);
   }
   /**
    * Subscribe an event listener. Returns an unsubscribe fn. SSE handlers
@@ -19372,13 +19482,152 @@ var ApprovalAggregator = class {
   }
   /**
    * Return the original (unhashed) request payload for the entry. Returns
-   * `null` when the entry is unknown or the payload was evicted (e.g. the
-   * process restarted; payloads are in-memory only at v1.3 Upsilon-1).
+   * `null` when the entry is unknown. When the in-memory payload map has
+   * been evicted (e.g. after a server restart) and a `payloadStore` was
+   * provided, the at-rest bundle is decrypted and the in-memory map is
+   * refilled. Audit emission lives on the `*WithAudit` variant; this base
+   * accessor is silent so internal callers can read without polluting the
+   * audit trail.
    */
   async getFullPayload(aggregatorId) {
     await this.hydrate();
     if (!this.entries.has(aggregatorId)) return null;
-    return this.fullPayloads.get(aggregatorId) ?? null;
+    const cached = this.fullPayloads.get(aggregatorId);
+    if (cached !== void 0) return cached;
+    if (this.payloadStore) {
+      try {
+        const restored = await this.payloadStore.loadPayload(aggregatorId);
+        if (restored !== null) {
+          this.fullPayloads.set(aggregatorId, restored);
+          return restored;
+        }
+      } catch {
+      }
+    }
+    return null;
+  }
+  /**
+   * Return the entry record for the given id, or null when unknown.
+   * Idempotent. v1.3 Upsilon-3.
+   */
+  async getEntry(aggregatorId) {
+    await this.hydrate();
+    return this.entries.get(aggregatorId) ?? null;
+  }
+  /**
+   * Audited variant of `getFullPayload`. Emits the
+   * `cross_harness_approval_payload_decrypted` audit event before
+   * returning. Used by the operator-facing /payload replay route.
+   * v1.3 Upsilon-3.
+   */
+  async getFullPayloadWithAudit(aggregatorId, operatorId) {
+    const payload = await this.getFullPayload(aggregatorId);
+    if (payload === null) return null;
+    const entry = this.entries.get(aggregatorId);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.PAYLOAD_DECRYPTED,
+      operatorId,
+      {
+        aggregator_id: aggregatorId,
+        ...entry ? {
+          source_harness: entry.source_harness,
+          source_agent_id: entry.source_agent_id,
+          entry_status: entry.status
+        } : {}
+      }
+    );
+    return payload;
+  }
+  /**
+   * Return the audit-log entries that led to and surround this approval.
+   * Best-effort matching: aggregator-side emissions (AGGREGATED, RESOLVED,
+   * DEDUPED, replay events) all carry `details.aggregator_id` and link
+   * directly. Gate-side emissions (`gate_*:operation`) do not carry the
+   * aggregator id at v1.3, so they are matched via timestamp window
+   * (entry.created_at to entry.resolved_at + 1s, or expires_at + 1s while
+   * pending) and operation suffix. Emits AUDIT_TRAIL_VIEWED on call.
+   * v1.3 Upsilon-3.
+   */
+  async getAuditTrail(aggregatorId, operatorId) {
+    await this.hydrate();
+    const entry = this.entries.get(aggregatorId);
+    if (!entry) {
+      return [];
+    }
+    const sinceMs = Date.parse(entry.created_at) - 1e3;
+    const sinceIso = new Date(sinceMs).toISOString();
+    const queried = await this.auditLog.query({ since: sinceIso, limit: 1e3 });
+    const operationPart = entry.policy_rule_id.includes(":") ? entry.policy_rule_id.slice(entry.policy_rule_id.indexOf(":") + 1) : entry.policy_rule_id;
+    const lifetimeStart = sinceMs;
+    const lifetimeEnd = entry.resolved_at ? Date.parse(entry.resolved_at) + 1e3 : Date.parse(entry.expires_at) + 1e3;
+    const matches = [];
+    for (const audit of queried.entries) {
+      const detailsId = audit.details !== void 0 ? audit.details["aggregator_id"] : void 0;
+      if (detailsId === aggregatorId) {
+        matches.push(audit);
+        continue;
+      }
+      const auditMs = Date.parse(audit.timestamp);
+      if (auditMs < lifetimeStart || auditMs > lifetimeEnd) continue;
+      if (audit.operation.endsWith(`:${operationPart}`)) {
+        matches.push(audit);
+      }
+    }
+    matches.sort(
+      (a, b) => a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0
+    );
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.AUDIT_TRAIL_VIEWED,
+      operatorId,
+      {
+        aggregator_id: aggregatorId,
+        entry_status: entry.status,
+        match_count: matches.length
+      }
+    );
+    return matches;
+  }
+  /**
+   * List historical (resolved) approvals. Excludes pending entries by
+   * design: `list()` is the pending-inbox surface and `getHistory()` is
+   * the resolved-replay surface. Emits REPLAYED on each call. v1.3
+   * Upsilon-3.
+   */
+  async getHistory(opts, operatorId) {
+    await this.hydrate();
+    await this.expireStale();
+    const limit = Math.min(
+      opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+      this.maxListLimit
+    );
+    const sinceMs = opts?.sinceTs ? Date.parse(opts.sinceTs) : Number.NEGATIVE_INFINITY;
+    const matching = [];
+    for (const entry of this.entries.values()) {
+      if (entry.status === "pending") continue;
+      if (opts?.status && entry.status !== opts.status) continue;
+      const stamp = Date.parse(entry.resolved_at ?? entry.created_at);
+      if (stamp < sinceMs) continue;
+      matching.push(entry);
+    }
+    matching.sort((a, b) => {
+      const aStamp = a.resolved_at ?? a.created_at;
+      const bStamp = b.resolved_at ?? b.created_at;
+      return bStamp.localeCompare(aStamp);
+    });
+    const sliced = matching.slice(0, limit);
+    this.auditLog.append(
+      "l2",
+      APPROVAL_AGGREGATOR_AUDIT_OPS.REPLAYED,
+      operatorId,
+      {
+        result_count: sliced.length,
+        ...opts?.status !== void 0 ? { status_filter: opts.status } : {},
+        ...opts?.sinceTs !== void 0 ? { since: opts.sinceTs } : {}
+      }
+    );
+    return sliced;
   }
   /**
    * Resolve an entry. Used by both:
@@ -19452,6 +19701,7 @@ var ApprovalAggregator = class {
     const now = this.now();
     const expires = new Date(now.getTime() + this.pendingTtlMs);
     const hubInboxId = this.resolveHubInboxItemId(event);
+    const enforcementChain = this.resolveEnforcementChain(event);
     const entry = {
       aggregator_id: id,
       source_harness: ctx.source_harness,
@@ -19463,13 +19713,20 @@ var ApprovalAggregator = class {
       status: "pending",
       created_at: now.toISOString(),
       expires_at: expires.toISOString(),
-      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {}
+      ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {},
+      ...enforcementChain.length > 0 ? { enforcement_chain: enforcementChain } : {}
     };
     this.entries.set(id, entry);
     this.dedupIndex.set(dedupKey, id);
     this.correlationIndex.set(event.correlation_id, id);
     this.fullPayloads.set(id, event.context);
     await this.persist(entry);
+    if (this.payloadStore) {
+      try {
+        await this.payloadStore.savePayload(id, event.context);
+      } catch {
+      }
+    }
     this.auditLog.append(
       "l2",
       APPROVAL_AGGREGATOR_AUDIT_OPS.AGGREGATED,
@@ -19615,6 +19872,306 @@ var ApprovalAggregator = class {
   }
 };
 
+// src/principal-policy/channels/aggregator-backed-channel.ts
+var DEFAULT_REPLACE_MODE_TIMEOUT_MS = 5 * 60 * 1e3;
+function auditEntryIdFor(request) {
+  return `${request.timestamp}:${request.operation}`;
+}
+function statusToDecision(entry) {
+  switch (entry.status) {
+    case "approved":
+      return {
+        decision: "approve",
+        decided_by: "human"
+      };
+    case "denied":
+      return {
+        decision: "deny",
+        decided_by: "human"
+      };
+    case "timeout":
+    case "expired":
+      return {
+        decision: "deny",
+        decided_by: "timeout"
+      };
+    default:
+      return null;
+  }
+}
+var AggregatorBackedChannel = class {
+  underlying;
+  aggregator;
+  resolveRedirect;
+  replaceModeTimeoutMs;
+  now;
+  constructor(opts) {
+    this.underlying = opts.underlying;
+    this.aggregator = opts.aggregator;
+    this.resolveRedirect = opts.resolveRedirect;
+    this.replaceModeTimeoutMs = opts.replaceModeTimeoutMs ?? DEFAULT_REPLACE_MODE_TIMEOUT_MS;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /** Expose underlying for tests / wire-up reuse. */
+  getUnderlying() {
+    return this.underlying;
+  }
+  async requestApproval(request) {
+    const cfg = this.resolveRedirect(request);
+    if (!cfg.enabled) {
+      return this.underlying.requestApproval(request);
+    }
+    if (cfg.mode === "replace") {
+      return this.awaitAggregatorDecision(request);
+    }
+    return this.notifyMode(request);
+  }
+  /**
+   * `replace` mode. Subscribe to the aggregator's event stream BEFORE
+   * checking already-stored entries (avoids a race where the entry resolves
+   * between list and subscribe). Match incoming events to this request by
+   * audit_entry_id. Time out after `replaceModeTimeoutMs` to honor SEC-002.
+   */
+  async awaitAggregatorDecision(request) {
+    const auditId = auditEntryIdFor(request);
+    return new Promise((resolveOuter) => {
+      let settled = false;
+      let unsubscribe = null;
+      let timeoutHandle = null;
+      const settle = (response) => {
+        if (settled) return;
+        settled = true;
+        if (timeoutHandle) clearTimeout(timeoutHandle);
+        if (unsubscribe) {
+          try {
+            unsubscribe();
+          } catch {
+          }
+        }
+        resolveOuter(response);
+      };
+      const onEvent = (emit) => {
+        if (emit.type !== "resolved") return;
+        if (emit.entry.audit_log_entry_id !== auditId) return;
+        const mapped = statusToDecision(emit.entry);
+        if (!mapped) return;
+        settle({
+          decision: mapped.decision,
+          decided_at: emit.entry.resolved_at ?? this.now().toISOString(),
+          decided_by: mapped.decided_by
+        });
+      };
+      try {
+        unsubscribe = this.aggregator.onEvent(onEvent);
+      } catch (err) {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "channel_failure"
+        });
+        throw err instanceof Error ? err : new Error(String(err));
+      }
+      void this.aggregator.list({ limit: 200 }).then((entries) => {
+        for (const entry of entries) {
+          if (entry.audit_log_entry_id !== auditId) continue;
+          const mapped = statusToDecision(entry);
+          if (!mapped) return;
+          settle({
+            decision: mapped.decision,
+            decided_at: entry.resolved_at ?? this.now().toISOString(),
+            decided_by: mapped.decided_by
+          });
+          return;
+        }
+      }).catch(() => {
+      });
+      timeoutHandle = setTimeout(() => {
+        settle({
+          decision: "deny",
+          decided_at: this.now().toISOString(),
+          decided_by: "timeout"
+        });
+      }, this.replaceModeTimeoutMs);
+    });
+  }
+  /**
+   * `notify` mode. Fire the underlying channel and listen on the
+   * aggregator simultaneously; whichever resolves first wins. Both
+   * paths produce identical `ApprovalResponse` shapes; the gate's
+   * downstream audit logging is unchanged.
+   *
+   * On underlying-channel failure, fall through to the aggregator wait
+   * (still bounded by `replaceModeTimeoutMs`). Operator can still
+   * resolve from the inbox even if the dashboard/webhook is down.
+   */
+  async notifyMode(request) {
+    const aggregatorPromise = this.awaitAggregatorDecision(request);
+    let underlyingPromise;
+    try {
+      underlyingPromise = this.underlying.requestApproval(request);
+    } catch (err) {
+      const response = await aggregatorPromise;
+      return response;
+    }
+    return Promise.race([
+      aggregatorPromise,
+      underlyingPromise.catch(
+        () => new Promise(() => {
+        })
+      )
+    ]);
+  }
+};
+function makeRedirectResolverFromPolicySupplier(supplier) {
+  return (_request) => {
+    const cfg = supplier().approval_redirect;
+    if (!cfg || cfg.enabled !== true) {
+      return { enabled: false, mode: "replace" };
+    }
+    return {
+      enabled: true,
+      mode: cfg.mode === "notify" ? "notify" : "replace"
+    };
+  };
+}
+
+// src/principal-policy/aggregator-store.ts
+init_encryption();
+init_encoding();
+var AGGREGATOR_PAYLOAD_NAMESPACE = "_approval_aggregator_payloads";
+var AGGREGATOR_PAYLOAD_KEY_PREFIX = "payload.";
+var HKDF_INFO = "l2-approval-aggregator-payload-v1";
+var DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS = 30;
+var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var AggregatorPayloadStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS;
+  }
+  /**
+   * Persist `payload` under the given aggregator_id. Idempotent; calling
+   * twice with the same id rewrites the bundle (retention_until is
+   * recomputed). Returns the bundle's retention_until ISO-8601 timestamp
+   * so callers can log it.
+   */
+  async savePayload(aggregatorId, payload) {
+    const now = /* @__PURE__ */ new Date();
+    const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+    const retentionUntil = new Date(now.getTime() + retentionMs);
+    const bundle = {
+      version: 1,
+      aggregator_id: aggregatorId,
+      fortress_id: this.fortressId,
+      created_at: now.toISOString(),
+      retention_until: retentionUntil.toISOString(),
+      payload
+    };
+    const aad = stringToBytes(aggregatorId);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      payloadKey(aggregatorId),
+      stringToBytes(JSON.stringify(envelope))
+    );
+    return bundle.retention_until;
+  }
+  /**
+   * Read the persisted payload for the aggregator_id. Returns null if no
+   * bundle exists, the bundle is corrupted, or AAD binding fails.
+   */
+  async loadPayload(aggregatorId) {
+    const key = payloadKey(aggregatorId);
+    let raw;
+    try {
+      raw = await this.storage.read(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(aggregatorId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.aggregator_id !== aggregatorId) return null;
+      return parsed.payload;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Delete the persisted payload. Returns true when a bundle was removed,
+   * false when none existed.
+   */
+  async deletePayload(aggregatorId) {
+    const key = payloadKey(aggregatorId);
+    const existed = await this.storage.exists(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      key
+    );
+    if (!existed) return false;
+    try {
+      await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+    } catch {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Drop expired payload bundles. Returns the count of bundles pruned.
+   * Caller wires this into the cocoon-unlock initialization path.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      AGGREGATOR_PAYLOAD_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const aggregatorId = stripKeyPrefix(meta.key);
+      if (aggregatorId === null) continue;
+      const raw = await this.storage.read(
+        AGGREGATOR_PAYLOAD_NAMESPACE,
+        meta.key
+      );
+      if (!raw) continue;
+      try {
+        const envelope = JSON.parse(bytesToString(raw));
+        const aad = stringToBytes(aggregatorId);
+        const plaintext = decrypt(envelope, this.encryptionKey, aad);
+        const parsed = JSON.parse(
+          bytesToString(plaintext)
+        );
+        if (parsed.retention_until <= cutoff) {
+          await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, meta.key);
+          pruned += 1;
+        }
+      } catch {
+      }
+    }
+    return { pruned };
+  }
+};
+function payloadKey(aggregatorId) {
+  return `${AGGREGATOR_PAYLOAD_KEY_PREFIX}${aggregatorId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(AGGREGATOR_PAYLOAD_KEY_PREFIX)) return null;
+  return key.slice(AGGREGATOR_PAYLOAD_KEY_PREFIX.length);
+}
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -20485,16 +21042,81 @@ function verifyAttestation(attestation, now) {
   };
 }
 
-// src/handshake/tools.ts
-function createHandshakeTools(config, identityManager, masterKey, auditLog, options) {
-  const autoPublishHandshakes = options?.autoPublishHandshakes ?? false;
-  const verascoreUrl = options?.verascoreUrl ?? "https://verascore.ai";
-  const identityEncKey = derivePurposeKey(masterKey, "identity-encryption");
-  const sessions = /* @__PURE__ */ new Map();
-  const handshakeResults = /* @__PURE__ */ new Map();
-  const shrOpts = {
-    config,
-    identityManager,
+// src/handshake/audit.ts
+var HANDSHAKE_LIFECYCLE_OPS = {
+  INITIATED: "handshake_initiated",
+  COMPLETED: "handshake_completed",
+  FAILED: "handshake_failed",
+  ABORTED: "handshake_aborted"
+};
+function auditHandshakeInitiated(auditLog, ctx) {
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.INITIATED,
+    ctx.identity_id,
+    detailsFromContext(ctx),
+    "success"
+  );
+}
+function auditHandshakeCompleted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  if (ctx.trust_tier !== void 0) {
+    details.trust_tier = ctx.trust_tier;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.COMPLETED,
+    ctx.identity_id,
+    details,
+    "success"
+  );
+}
+function auditHandshakeFailed(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  if (ctx.error !== void 0) {
+    details.error = ctx.error;
+  }
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.FAILED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function auditHandshakeAborted(auditLog, ctx) {
+  const details = detailsFromContext(ctx);
+  details.reason = ctx.reason;
+  auditLog.append(
+    "l4",
+    HANDSHAKE_LIFECYCLE_OPS.ABORTED,
+    ctx.identity_id,
+    details,
+    "failure"
+  );
+}
+function detailsFromContext(ctx) {
+  const details = {
+    session_id: ctx.session_id,
+    role: ctx.role
+  };
+  if (ctx.counterparty_id !== void 0) {
+    details.counterparty_id = ctx.counterparty_id;
+  }
+  return details;
+}
+
+// src/handshake/tools.ts
+function createHandshakeTools(config, identityManager, masterKey, auditLog, options) {
+  const autoPublishHandshakes = options?.autoPublishHandshakes ?? false;
+  const verascoreUrl = options?.verascoreUrl ?? "https://verascore.ai";
+  const identityEncKey = derivePurposeKey(masterKey, "identity-encryption");
+  const sessions = /* @__PURE__ */ new Map();
+  const handshakeResults = /* @__PURE__ */ new Map();
+  const shrOpts = {
+    config,
+    identityManager,
     masterKey
   };
   const tools = [
@@ -20518,6 +21140,11 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const { challenge, session } = initiateHandshake(shr);
         sessions.set(session.session_id, session);
         auditLog.append("l4", "handshake_initiate", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: session.session_id,
+          role: "initiator",
+          identity_id: shr.body.instance_id
+        });
         return toolResult({
           session_id: session.session_id,
           challenge,
@@ -20557,10 +21184,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         );
         if ("error" in result) {
           auditLog.append("l4", "handshake_respond", shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: "unknown",
+            role: "responder",
+            identity_id: shr.body.instance_id,
+            reason: classifyRespondFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         sessions.set(result.session.session_id, result.session);
         auditLog.append("l4", "handshake_respond", shr.body.instance_id);
+        auditHandshakeInitiated(auditLog, {
+          session_id: result.session.session_id,
+          role: "responder",
+          identity_id: shr.body.instance_id,
+          counterparty_id: challenge.shr.body.instance_id
+        });
         let autoPublishResult;
         if (autoPublishHandshakes) {
           autoPublishResult = { attempted: true };
@@ -20668,9 +21308,23 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         const response = args.response;
         const session = sessions.get(sessionId);
         if (!session) {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: "unknown",
+            reason: "session_unknown",
+            error: `No handshake session found: ${sessionId}`
+          });
           return toolResult({ error: `No handshake session found: ${sessionId}` });
         }
         if (session.state !== "initiated") {
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: "session_state_mismatch",
+            error: `Session is in state '${session.state}', expected 'initiated'`
+          });
           return toolResult({
             error: `Session is in state '${session.state}', expected 'initiated'`
           });
@@ -20684,6 +21338,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         if ("error" in result) {
           session.state = "failed";
           auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id, void 0, "failure");
+          auditHandshakeFailed(auditLog, {
+            session_id: sessionId,
+            role: "initiator",
+            identity_id: session.our_shr.body.instance_id,
+            reason: classifyCompleteFailure(result.error),
+            error: result.error
+          });
           return toolResult({ error: result.error });
         }
         session.state = "completed";
@@ -20692,6 +21353,13 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
         session.result = result.result;
         handshakeResults.set(result.result.counterparty_id, result.result);
         auditLog.append("l4", "handshake_complete", session.our_shr.body.instance_id);
+        auditHandshakeCompleted(auditLog, {
+          session_id: sessionId,
+          role: "initiator",
+          identity_id: session.our_shr.body.instance_id,
+          counterparty_id: result.result.counterparty_id,
+          trust_tier: result.result.trust_tier
+        });
         return toolResult({
           completion: result.completion,
           result: result.result,
@@ -20739,6 +21407,24 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
             void 0,
             result.verified ? "success" : "failure"
           );
+          if (result.verified) {
+            auditHandshakeCompleted(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              trust_tier: result.trust_tier
+            });
+          } else {
+            auditHandshakeFailed(auditLog, {
+              session_id: session.session_id,
+              role: "responder",
+              identity_id: session.our_shr.body.instance_id,
+              counterparty_id: result.counterparty_id,
+              reason: classifyCompleteFailure(result.errors.join("; ")),
+              error: result.errors.join("; ")
+            });
+          }
           return toolResult({ result });
         }
         return toolResult({
@@ -20846,10 +21532,74 @@ function createHandshakeTools(config, identityManager, masterKey, auditLog, opti
           _content_trust: "external"
         });
       }
+    },
+    {
+      name: "handshake_abort",
+      description: "Abort an in-flight handshake session. Drops the session record and appends a session-lifecycle audit entry (handshake_aborted) so the operator can distinguish operator-cancelled, timed-out, and dropped sessions from sessions that simply fell off the protocol path.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          session_id: {
+            type: "string",
+            description: "Session ID returned from handshake_initiate / handshake_respond."
+          },
+          reason: {
+            type: "string",
+            enum: [
+              "operator_cancelled",
+              "session_timeout",
+              "transport_dropped",
+              "shutdown",
+              "other"
+            ],
+            description: "Why the session is being aborted. Defaults to 'operator_cancelled'."
+          }
+        },
+        required: ["session_id"]
+      },
+      handler: async (args) => {
+        const sessionId = args.session_id;
+        const reason = args.reason ?? "operator_cancelled";
+        const session = sessions.get(sessionId);
+        if (!session) {
+          return toolResult({ error: `No handshake session found: ${sessionId}` });
+        }
+        if (session.state === "completed") {
+          return toolResult({
+            error: `Session ${sessionId} already completed; abort is only valid for in-flight sessions`
+          });
+        }
+        sessions.delete(sessionId);
+        auditHandshakeAborted(auditLog, {
+          session_id: sessionId,
+          role: session.role,
+          identity_id: session.our_shr.body.instance_id,
+          ...session.their_shr ? { counterparty_id: session.their_shr.body.instance_id } : {},
+          reason
+        });
+        return toolResult({
+          aborted: true,
+          session_id: sessionId,
+          reason
+        });
+      }
     }
   ];
   return { tools, handshakeResults };
 }
+function classifyRespondFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed")) return "shr_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
+function classifyCompleteFailure(error) {
+  if (error.includes("Unsupported protocol version")) return "protocol_version_unsupported";
+  if (error.includes("SHR verification failed") || error.includes("SHR")) return "shr_invalid";
+  if (error.includes("nonce signature is invalid")) return "nonce_signature_invalid";
+  if (error.includes("No identity available")) return "no_signing_identity";
+  return "other";
+}
 
 // src/federation/registry.ts
 var DEFAULT_CAPABILITIES = {
@@ -31575,15 +32325,300 @@ var OPERATOR_CHAT_OPS = {
    * successful thread removal. Body carries thread_id + turn_count of
    * the deleted bundle.
    */
-  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted"
+  CONCIERGE_THREAD_DELETED: "operator_concierge_thread_deleted",
+  /**
+   * Concierge memory fold-read failed (WP-V1.3-9 Tau-2). Emitted when
+   * the multi-turn coherence fold cannot load the active thread's prior
+   * turns; the concierge degrades to single-turn after emitting. Body
+   * carries thread_id + a stable failure_reason enum.
+   */
+  CONCIERGE_MEMORY_READ_FAILED: "operator_concierge_memory_read_failed",
+  /**
+   * Concierge dynamic-context fetcher failed (WP-V1.3-9 Tau-3). Emitted
+   * when a category fetcher throws while assembling the dynamic context
+   * fold. The concierge omits that category and continues; the user-
+   * facing query is never broken. Body carries category + failure_reason.
+   */
+  CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed"
 };
 
 // src/chat/operator-chat-types.ts
 var OPERATOR_CHAT_MAX_THREAD_LENGTH = 500;
 var CONCIERGE_THREAD_KEY = "_fortress";
 
+// src/chat/concierge-context-router.ts
+var APPROX_CHARS_PER_TOKEN = 4;
+var DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET = 2e3;
+var DYNAMIC_CONTEXT_SECTION_HEADER = "## Live fortress context";
+var CONTEXT_CATEGORIES = [
+  "templates",
+  "agent_state",
+  "agent_activity",
+  "audit_log",
+  "sentinel_findings",
+  "anomaly_alerts",
+  "recent_receipts",
+  "verascore_deltas"
+];
+function phrasePattern(phrase) {
+  const escaped = phrase.toLowerCase().split(/\s+/).map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("\\s+");
+  return { source: `\\b${escaped}\\b`, phrase };
+}
+var CATEGORY_KEYWORDS = [
+  {
+    category: "templates",
+    patterns: [
+      "templates",
+      "template",
+      "channel templates",
+      "channel template",
+      "list templates",
+      "available templates",
+      "what templates"
+    ].map(phrasePattern)
+  },
+  {
+    category: "agent_state",
+    patterns: [
+      "state",
+      "status",
+      "agent state",
+      "agent status",
+      "status of agent",
+      "status of agents",
+      "state of",
+      "doing"
+    ].map(phrasePattern)
+  },
+  {
+    category: "agent_activity",
+    patterns: [
+      "activity",
+      "agent activity",
+      "what did",
+      "recent activity"
+    ].map(phrasePattern)
+  },
+  {
+    category: "audit_log",
+    patterns: [
+      "audit log",
+      "audit",
+      "log entry",
+      "log entries",
+      "what happened",
+      "show me events",
+      "event class"
+    ].map(phrasePattern)
+  },
+  {
+    category: "sentinel_findings",
+    patterns: [
+      "sentinel",
+      "sentinels",
+      "warning",
+      "warnings",
+      "alert",
+      "alerts",
+      "whats wrong",
+      "what's wrong",
+      "findings"
+    ].map(phrasePattern)
+  },
+  {
+    category: "anomaly_alerts",
+    patterns: [
+      "anomaly",
+      "anomalies",
+      "spike",
+      "unusual",
+      "outlier"
+    ].map(phrasePattern)
+  },
+  {
+    category: "recent_receipts",
+    patterns: [
+      "receipt",
+      "receipts",
+      "concordia",
+      "commitment",
+      "commitments",
+      "chain",
+      "chains"
+    ].map(phrasePattern)
+  },
+  {
+    category: "verascore_deltas",
+    patterns: [
+      "verascore",
+      "vera score",
+      "trust score",
+      "reputation"
+    ].map(phrasePattern)
+  }
+];
+function extractAgentNameHint(query) {
+  const agentPattern = /\bagent\s+["']?([A-Za-z][\w-]{0,40})["']?/i;
+  const m = query.match(agentPattern);
+  if (m && m[1]) return m[1];
+  const quoted = query.match(/["']([A-Za-z][\w-]{0,40})["']/);
+  if (quoted && quoted[1]) return quoted[1];
+  return null;
+}
+var TRIVIAL_GREETINGS = /* @__PURE__ */ new Set([
+  "hi",
+  "hello",
+  "hey",
+  "yo",
+  "ok",
+  "thanks",
+  "thx",
+  "thank you"
+]);
+function isTrivialQuery(query) {
+  const norm = query.trim().toLowerCase();
+  if (norm.length === 0) return true;
+  if (norm.length < 8) return true;
+  return TRIVIAL_GREETINGS.has(norm);
+}
+function classifyQuery(query) {
+  const normalized = query.toLowerCase();
+  const matches = [];
+  for (const spec of CATEGORY_KEYWORDS) {
+    const matchedPhrases = [];
+    for (const pattern of spec.patterns) {
+      if (matchedPhrases.includes(pattern.phrase)) continue;
+      const re = new RegExp(pattern.source, "i");
+      if (re.test(normalized)) {
+        matchedPhrases.push(pattern.phrase);
+      }
+    }
+    if (matchedPhrases.length === 0) continue;
+    const confidence = Math.min(1, 0.4 + 0.3 * matchedPhrases.length);
+    matches.push({
+      category: spec.category,
+      confidence,
+      matched_keywords: matchedPhrases,
+      agent_name_hint: spec.category === "agent_state" || spec.category === "agent_activity" ? extractAgentNameHint(query) : null
+    });
+  }
+  matches.sort((a, b) => {
+    if (b.confidence !== a.confidence) return b.confidence - a.confidence;
+    return CONTEXT_CATEGORIES.indexOf(a.category) - CONTEXT_CATEGORIES.indexOf(b.category);
+  });
+  return matches;
+}
+function approxTokenLen(text) {
+  return Math.ceil(text.length / APPROX_CHARS_PER_TOKEN);
+}
+var CATEGORY_LABELS = {
+  templates: "Templates",
+  agent_state: "Agent state",
+  agent_activity: "Agent activity",
+  audit_log: "Audit log",
+  sentinel_findings: "Sentinel findings",
+  anomaly_alerts: "Anomaly alerts",
+  recent_receipts: "Recent receipts",
+  verascore_deltas: "Verascore deltas"
+};
+async function runFetcher(match, fetchers) {
+  switch (match.category) {
+    case "templates":
+      return fetchers.templates();
+    case "agent_state":
+      return fetchers.agent_state(match.agent_name_hint);
+    case "agent_activity":
+      return fetchers.agent_activity(match.agent_name_hint);
+    case "audit_log":
+      return fetchers.audit_log();
+    case "sentinel_findings":
+      return fetchers.sentinel_findings();
+    case "anomaly_alerts":
+      return fetchers.anomaly_alerts();
+    case "recent_receipts":
+      return fetchers.recent_receipts();
+    case "verascore_deltas":
+      return fetchers.verascore_deltas();
+  }
+}
+function trivialMatch(category) {
+  return {
+    category,
+    confidence: 0.5,
+    matched_keywords: ["llm-assist"],
+    agent_name_hint: null
+  };
+}
+async function foldContext(query, fetchers, opts) {
+  const budget = opts?.maxTokens ?? DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET;
+  let matches = classifyQuery(query);
+  if (matches.length === 0 && !isTrivialQuery(query) && opts?.llmAssistClassify) {
+    try {
+      const picked = await opts.llmAssistClassify(query, CONTEXT_CATEGORIES);
+      if (picked !== "none" && CONTEXT_CATEGORIES.includes(picked)) {
+        matches = [trivialMatch(picked)];
+      }
+    } catch {
+    }
+  }
+  if (matches.length === 0) {
+    return { section: "", categoriesIncluded: [] };
+  }
+  const attempts = [];
+  for (const match of matches) {
+    try {
+      const text = await runFetcher(match, fetchers);
+      const trimmed = text.trim();
+      if (trimmed.length > 0) {
+        attempts.push({ category: match.category, text: trimmed });
+      }
+    } catch (err) {
+      opts?.onFetcherFailure?.(match.category, err);
+    }
+  }
+  if (attempts.length === 0) {
+    return { section: "", categoriesIncluded: [] };
+  }
+  const headerTokens = approxTokenLen(`${DYNAMIC_CONTEXT_SECTION_HEADER}
+`);
+  const sepTokens = approxTokenLen("\n\n");
+  let runningTokens = headerTokens;
+  const kept = [];
+  for (const attempt of attempts) {
+    const block = `### ${CATEGORY_LABELS[attempt.category]}
+${attempt.text}`;
+    const tokens = approxTokenLen(block) + (kept.length > 0 ? sepTokens : 0);
+    if (kept.length === 0) {
+      kept.push(attempt);
+      runningTokens += tokens;
+      continue;
+    }
+    if (runningTokens + tokens > budget) break;
+    kept.push(attempt);
+    runningTokens += tokens;
+  }
+  const blocks = kept.map(
+    (k) => `### ${CATEGORY_LABELS[k.category]}
+${k.text}`
+  );
+  const section = `${DYNAMIC_CONTEXT_SECTION_HEADER}
+${blocks.join("\n\n")}`;
+  return {
+    section,
+    categoriesIncluded: kept.map((k) => k.category)
+  };
+}
+
 // src/chat/operator-chat-service.ts
 var DEFAULT_CONCIERGE_MAX_TOKENS = 512;
+var DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
+var DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
+var DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET = 2e3;
+function approxTokenLen2(text) {
+  return Math.ceil(text.length / 4);
+}
 var SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
 1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
 2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
@@ -31620,6 +32655,14 @@ var OperatorChatService = class {
   piiFilter;
   conciergeMaxTokens;
   memory;
+  historyWindowTurns;
+  historyFreshnessMs;
+  historyTokenBudget;
+  sessionTtlMs;
+  clock;
+  contextFetchers;
+  contextLlmAssist;
+  dynamicContextBudget;
   /**
    * In-memory thread_id assigned to the active concierge session.
    * The first sendConcierge call after construction allocates a fresh
@@ -31627,6 +32670,14 @@ var OperatorChatService = class {
    * folds the prior turns into context. Cleared by `resetConciergeMemoryThread`.
    */
   activeMemoryThreadId;
+  /**
+   * Wall-clock ms of the most recent sendConcierge that touched the
+   * active session thread. Drives the WP-V1.3-9 Tau-2 session-TTL
+   * check: a fresh sendConcierge after `sessionTtlMs` of quiet
+   * allocates a new thread_id even though the prior one is still
+   * readable from the memory store.
+   */
+  lastInteractionAt;
   constructor(deps) {
     this.store = deps.store;
     this.auditLog = deps.auditLog;
@@ -31638,6 +32689,18 @@ var OperatorChatService = class {
     if (deps.conciergePiiFilter) this.piiFilter = deps.conciergePiiFilter;
     this.conciergeMaxTokens = deps.conciergeMaxTokens ?? DEFAULT_CONCIERGE_MAX_TOKENS;
     if (deps.conciergeMemory) this.memory = deps.conciergeMemory;
+    this.historyWindowTurns = deps.conciergeHistoryWindowTurns !== void 0 && deps.conciergeHistoryWindowTurns > 0 ? deps.conciergeHistoryWindowTurns : DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS;
+    this.historyFreshnessMs = deps.conciergeHistoryFreshnessMs !== void 0 && deps.conciergeHistoryFreshnessMs > 0 ? deps.conciergeHistoryFreshnessMs : DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS;
+    this.historyTokenBudget = deps.conciergeHistoryTokenBudget !== void 0 && deps.conciergeHistoryTokenBudget > 0 ? deps.conciergeHistoryTokenBudget : DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET;
+    this.sessionTtlMs = deps.conciergeSessionTtlMs !== void 0 && deps.conciergeSessionTtlMs > 0 ? deps.conciergeSessionTtlMs : DEFAULT_CONCIERGE_SESSION_TTL_MS;
+    this.clock = deps.conciergeClock ?? (() => Date.now());
+    if (deps.conciergeContextFetchers) {
+      this.contextFetchers = deps.conciergeContextFetchers;
+    }
+    if (deps.conciergeContextLlmAssist) {
+      this.contextLlmAssist = deps.conciergeContextLlmAssist;
+    }
+    this.dynamicContextBudget = deps.conciergeDynamicContextBudget !== void 0 && deps.conciergeDynamicContextBudget > 0 ? deps.conciergeDynamicContextBudget : DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET;
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -31656,6 +32719,10 @@ var OperatorChatService = class {
       throw new Error("concierge query must not be empty");
     }
     const filterResult = this.piiFilter ? this.piiFilter.filter(trimmed) : { filtered: trimmed, redactions: 0 };
+    const nowMs = this.clock();
+    if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
+      this.activeMemoryThreadId = void 0;
+    }
     const operatorMessage = {
       message_id: randomUUID(),
       surface: "concierge",
@@ -31668,6 +32735,25 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       operatorMessage
     );
+    let priorTurns = [];
+    let memoryReadFailureReason = null;
+    let activeThreadIdForRound;
+    if (this.memory) {
+      activeThreadIdForRound = this.ensureActiveMemoryThread();
+      const result = await this.memory.readThreadStrict(activeThreadIdForRound).catch(() => ({ ok: false, reason: "io_failed" }));
+      if (result.ok) {
+        const cutoff = nowMs - this.historyFreshnessMs;
+        const fresh = result.turns.filter((t) => {
+          const ts = Date.parse(t.created_at);
+          return Number.isFinite(ts) && ts >= cutoff;
+        });
+        const recent = fresh.length > this.historyWindowTurns ? fresh.slice(fresh.length - this.historyWindowTurns) : fresh;
+        priorTurns = recent;
+      } else {
+        memoryReadFailureReason = result.reason;
+        this.emitMemoryReadFailed(activeThreadIdForRound, result.reason);
+      }
+    }
     if (this.memory) {
       const threadId = this.ensureActiveMemoryThread();
       await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
@@ -31678,6 +32764,7 @@ var OperatorChatService = class {
     let servedBy = "disabled";
     let displayLabel = "Concierge: substrate not configured";
     let outcome = "substrate_disabled";
+    let dynamicCategoriesIncluded = [];
     if (!this.substrateSelector) {
       conciergeBody = "Concierge unavailable. The substrate selector is not configured for this fortress. Pick a substrate in the Policy center to enable concierge replies.";
     } else {
@@ -31689,7 +32776,14 @@ var OperatorChatService = class {
           conciergeBody = "Concierge unavailable. The chosen substrate does not support summarization. Pick a different substrate in the Policy center.";
           outcome = "substrate_disabled";
         } else {
-          const context = await this.assembleConciergeContext();
+          const dynamicResult = await this.runDynamicContextFold(
+            filterResult.filtered
+          );
+          dynamicCategoriesIncluded = dynamicResult.categoriesIncluded;
+          const context = await this.assembleConciergeContext(
+            priorTurns,
+            dynamicResult.section
+          );
           const response = await this.substrateSelector.invokeSummarize(
             "concierge",
             {
@@ -31728,10 +32822,14 @@ var OperatorChatService = class {
       CONCIERGE_THREAD_KEY,
       responseMessage
     );
+    let assistantTurnId;
     if (this.memory) {
       const threadId = this.ensureActiveMemoryThread();
-      await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => {
-      });
+      const persisted = await this.memory.appendTurn(threadId, "assistant", conciergeBody).catch(() => void 0);
+      if (persisted) assistantTurnId = persisted.turn_id;
+    }
+    if (this.memory && activeThreadIdForRound) {
+      this.lastInteractionAt = nowMs;
     }
     const payload = {
       version: "1.2",
@@ -31744,7 +32842,13 @@ var OperatorChatService = class {
       response_hash: outcome === "ok" ? hashOf(conciergeBody) : null,
       substrate: servedBy,
       latency_ms: latencyMs,
-      outcome
+      outcome,
+      ...activeThreadIdForRound !== void 0 ? { thread_id: activeThreadIdForRound } : {},
+      ...assistantTurnId !== void 0 ? { turn_index: assistantTurnId } : {},
+      ...this.memory ? {
+        prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
+      } : {},
+      ...this.contextFetchers ? { dynamic_context_categories: [...dynamicCategoriesIncluded] } : {}
     };
     this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
     return {
@@ -31754,6 +32858,25 @@ var OperatorChatService = class {
       outcome
     };
   }
+  /**
+   * Emit the WP-V1.3-9 Tau-2 graceful-degradation audit event. Pulled
+   * out of `sendConcierge` so the read-fold path stays readable. Emits
+   * with `result: "failure"` since the concierge fell back to
+   * single-turn mode for this round-trip.
+   */
+  emitMemoryReadFailed(threadId, reason) {
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-memfail"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_memory_read_failed",
+      surface: "concierge",
+      thread_id: threadId,
+      failure_reason: reason
+    };
+    this.emit(OPERATOR_CHAT_OPS.CONCIERGE_MEMORY_READ_FAILED, payload, "failure");
+  }
   /**
    * Read the persisted concierge thread, oldest message first. Returns
    * an empty array when no thread exists yet.
@@ -31876,6 +32999,14 @@ var OperatorChatService = class {
    *   ## Sanctuary reference
    *   <static domain reference block>
    *
+   *   ## Live fortress context          ← WP-V1.3-9 Tau-3, when present
+   *   ### <Category>
+   *   <fetcher payload>
+   *
+   *   ## Prior conversation             ← WP-V1.3-9 Tau-2, when present
+   *   OPERATOR: ...
+   *   CONCIERGE: ...
+   *
    *   ## Recent activity
    *   <recentActivity output>
    *
@@ -31885,37 +33016,116 @@ var OperatorChatService = class {
    *   ## Open inbox
    *   <openInbox output>
    *   ```
-   */
-  async assembleConciergeContext() {
+   *
+   * The substrate selector ships a `context: string` shape (not a
+   * messages array), so multi-turn coherence is folded as a structured
+   * prior-conversation section with explicit OPERATOR / CONCIERGE
+   * boundaries. Coordinator-CTO guidance: prefer messages-array shape
+   * if available; the v1.2 selector does not expose one, so structured
+   * serialization is the canonical path for v1.3.
+   */
+  async assembleConciergeContext(priorTurns = [], dynamicSection = "") {
     const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
+    const priorSection = this.formatPriorTurnsSection(priorTurns);
     if (!this.contextProviders) {
-      return `${ref}
-
-## Recent activity
-(no providers wired)
-
-## Wrapped agents
-(no providers wired)
-
-## Open inbox
-(no providers wired)`;
+      return [
+        ref,
+        ...dynamicSection ? [dynamicSection] : [],
+        ...priorSection ? [priorSection] : [],
+        "## Recent activity\n(no providers wired)",
+        "## Wrapped agents\n(no providers wired)",
+        "## Open inbox\n(no providers wired)"
+      ].join("\n\n");
     }
     const [activity, agents, inbox] = await Promise.all([
       this.contextProviders.recentActivity(),
       this.contextProviders.agentInventory(),
       this.contextProviders.openInbox()
     ]);
-    return `${ref}
-
-## Recent activity
-${activity}
-
-## Wrapped agents
-${agents}
-
-## Open inbox
-${inbox}`;
+    return [
+      ref,
+      ...dynamicSection ? [dynamicSection] : [],
+      ...priorSection ? [priorSection] : [],
+      `## Recent activity
+${activity}`,
+      `## Wrapped agents
+${agents}`,
+      `## Open inbox
+${inbox}`
+    ].join("\n\n");
+  }
+  /**
+   * Run the WP-V1.3-9 Tau-3 dynamic-context fold for a single round-
+   * trip. Fail-soft on every axis: missing fetchers short-circuit to
+   * an empty fold, fetcher failures emit a per-category audit event
+   * and are omitted from the rendered section, an LLM-assist failure
+   * proceeds with no fold. Returns the rendered section + the list of
+   * categories whose data made it into the section (used for the
+   * round-trip audit emission).
+   */
+  async runDynamicContextFold(query) {
+    if (!this.contextFetchers) {
+      return { section: "", categoriesIncluded: [] };
+    }
+    const result = await foldContext(query, this.contextFetchers, {
+      maxTokens: this.dynamicContextBudget,
+      ...this.contextLlmAssist ? { llmAssistClassify: this.contextLlmAssist } : {},
+      onFetcherFailure: (category, error) => {
+        this.emitContextFetcherFailed(category, classifyFetcherError(error));
+      }
+    });
+    return result;
+  }
+  /**
+   * Emit the WP-V1.3-9 Tau-3 fetcher-failure audit event. Pulled out
+   * of the fold path so the dynamic-context handler stays readable.
+   * Emits with `result: "failure"` since the named category dropped
+   * from the rendered section for this round-trip.
+   */
+  emitContextFetcherFailed(category, failureReason) {
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-ctxfail"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_context_fetcher_failed",
+      surface: "concierge",
+      category,
+      failure_reason: failureReason
+    };
+    this.emit(
+      OPERATOR_CHAT_OPS.CONCIERGE_CONTEXT_FETCHER_FAILED,
+      payload,
+      "failure"
+    );
+  }
+  /**
+   * Render the prior-conversation section with token-budget enforcement
+   * (WP-V1.3-9 Tau-2). Drops oldest turns first when the rendered
+   * section exceeds `historyTokenBudget`. Returns an empty string when
+   * the input is empty or when the budget excludes every turn.
+   */
+  formatPriorTurnsSection(turns) {
+    if (turns.length === 0) return "";
+    const HEADER = "## Prior conversation";
+    const lines = turns.map(formatPriorTurnLine);
+    const headerTokens = approxTokenLen2(`${HEADER}
+`);
+    const sepTokens = approxTokenLen2("\n");
+    let runningTokens = headerTokens;
+    let runningLines = [];
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line = lines[i];
+      const tokens = approxTokenLen2(line) + (runningLines.length > 0 ? sepTokens : 0);
+      if (runningTokens + tokens > this.historyTokenBudget) break;
+      runningTokens += tokens;
+      runningLines.push(line);
+    }
+    if (runningLines.length === 0) return "";
+    runningLines = runningLines.reverse();
+    return `${HEADER}
+${runningLines.join("\n")}`;
   }
   // ── audit helpers ────────────────────────────────────────────────────
   emit(operation, payload, result) {
@@ -31931,6 +33141,21 @@ ${inbox}`;
 function makeEventId(prefix) {
   return `${prefix}-${Date.now()}-${randomUUID().slice(0, 8)}`;
 }
+function classifyFetcherError(error) {
+  const msg = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
+  if (msg.includes("timeout") || msg.includes("timed out")) return "timeout";
+  if (msg.includes("schema") || msg.includes("invalid shape")) {
+    return "schema_mismatch";
+  }
+  if (msg.includes("io") || msg.includes("read") || msg.includes("enoent") || msg.includes("eacces")) {
+    return "io_failed";
+  }
+  return "unknown";
+}
+function formatPriorTurnLine(turn) {
+  const label = turn.role === "user" ? "OPERATOR" : "CONCIERGE";
+  return `${label}: ${turn.content}`;
+}
 function hashOf(input) {
   return hashToString(sha256(stringToBytes(input)));
 }
@@ -31939,7 +33164,7 @@ function hashOf(input) {
 init_encryption();
 init_encoding();
 var OPERATOR_CHAT_NAMESPACE = "_chat";
-var HKDF_INFO = "operator-chat-store-v1";
+var HKDF_INFO2 = "operator-chat-store-v1";
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
@@ -31948,7 +33173,7 @@ var OperatorChatStore = class {
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
   }
   /**
    * Load a thread. Returns null if no record exists or if the on-disk
@@ -32032,9 +33257,9 @@ init_encryption();
 init_encoding();
 var CONCIERGE_MEMORY_NAMESPACE = "_chat";
 var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-var HKDF_INFO2 = "concierge-memory-store-v1";
+var HKDF_INFO3 = "concierge-memory-store-v1";
 var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
-var MAX_BUNDLE_BYTES2 = 4 * 1024 * 1024;
+var MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
 var ConciergeMemoryStore = class {
   storage;
   encryptionKey;
@@ -32043,7 +33268,7 @@ var ConciergeMemoryStore = class {
   locks;
   constructor(opts) {
     this.storage = opts.storage;
-    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
     this.fortressId = opts.fortressId;
     this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
     this.locks = /* @__PURE__ */ new Map();
@@ -32099,6 +33324,65 @@ var ConciergeMemoryStore = class {
     }
     return turns;
   }
+  /**
+   * Read turns with explicit failure surfacing (WP-V1.3-9 Tau-2). Where
+   * `readThread` collapses every failure mode to an empty array, this
+   * variant returns a discriminated result so the multi-turn fold path
+   * can degrade cleanly + emit `operator_concierge_memory_read_failed`
+   * with a concrete cause.
+   *
+   * - No bundle on disk → `{ ok: true, turns: [] }` (a fresh thread).
+   * - Bundle present, decode + decrypt + schema check pass → ok with turns.
+   * - Bundle present, oversize → `{ ok: false, reason: "oversize_bundle" }`.
+   * - Bundle present, decryption fails → `{ ok: false, reason: "decrypt_failed" }`.
+   * - Bundle present, schema mismatch (version / thread_id) → `schema_mismatch`.
+   * - Storage IO error → `io_failed`.
+   */
+  async readThreadStrict(threadId, opts) {
+    const key = bundleKey(threadId);
+    let raw;
+    try {
+      raw = await this.storage.read(CONCIERGE_MEMORY_NAMESPACE, key);
+    } catch {
+      return { ok: false, reason: "io_failed" };
+    }
+    if (!raw) return { ok: true, turns: [] };
+    if (raw.length > MAX_BUNDLE_BYTES3) {
+      return { ok: false, reason: "oversize_bundle" };
+    }
+    let envelope;
+    try {
+      envelope = JSON.parse(bytesToString(raw));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let plaintext;
+    try {
+      const aad = stringToBytes(threadId);
+      plaintext = decrypt(envelope, this.encryptionKey, aad);
+    } catch {
+      return { ok: false, reason: "decrypt_failed" };
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(bytesToString(plaintext));
+    } catch {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    if (parsed.version !== 1) return { ok: false, reason: "schema_mismatch" };
+    if (parsed.thread_id !== threadId) {
+      return { ok: false, reason: "schema_mismatch" };
+    }
+    let turns = parsed.turns;
+    if (opts?.sinceTurnId !== void 0) {
+      const cutoff = opts.sinceTurnId;
+      turns = turns.filter((t) => t.turn_id > cutoff);
+    }
+    if (opts?.limit !== void 0) {
+      turns = turns.slice(0, opts.limit);
+    }
+    return { ok: true, turns };
+  }
   /**
    * Enumerate concierge threads in this fortress with summary metadata.
    * Sorted newest-first by last_turn_at.
@@ -32110,7 +33394,7 @@ var ConciergeMemoryStore = class {
     );
     const summaries = [];
     for (const meta of entries) {
-      const threadId = stripKeyPrefix(meta.key);
+      const threadId = stripKeyPrefix2(meta.key);
       if (threadId === null) continue;
       const bundle = await this.loadBundle(threadId);
       if (!bundle || bundle.turns.length === 0) continue;
@@ -32163,7 +33447,7 @@ var ConciergeMemoryStore = class {
     );
     let pruned = 0;
     for (const meta of entries) {
-      const threadId = stripKeyPrefix(meta.key);
+      const threadId = stripKeyPrefix2(meta.key);
       if (threadId === null) continue;
       pruned += await this.withLock(threadId, async () => {
         const bundle = await this.loadBundle(threadId);
@@ -32194,7 +33478,7 @@ var ConciergeMemoryStore = class {
       return null;
     }
     if (!raw) return null;
-    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    if (raw.length > MAX_BUNDLE_BYTES3) return null;
     try {
       const envelope = JSON.parse(bytesToString(raw));
       const aad = stringToBytes(threadId);
@@ -32247,7 +33531,7 @@ var ConciergeMemoryStore = class {
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix(key) {
+function stripKeyPrefix2(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -32316,7 +33600,18 @@ function buildV11Bindings(inputs) {
         registry
       }),
       conciergePiiFilter: buildConciergePiiFilter(),
-      conciergeMemory
+      conciergeMemory,
+      conciergeContextFetchers: buildConciergeContextFetchers({
+        auditLog: inputs.auditLog,
+        identityId: inputs.identityId,
+        registry
+      }),
+      ...inputs.intelligenceSelector ? {
+        conciergeContextLlmAssist: buildConciergeContextLlmAssist({
+          selector: inputs.intelligenceSelector,
+          identityId: inputs.identityId
+        })
+      } : {}
     });
   }
   const hubService = new HubService({
@@ -32377,6 +33672,107 @@ function buildConciergeContextProviders(args) {
     }
   };
 }
+function buildConciergeContextFetchers(args) {
+  const empty = async () => "";
+  return {
+    templates: async () => {
+      const entries = listTemplates();
+      if (entries.length === 0) return "(no templates installed)";
+      const lines = entries.map((e) => {
+        const m = e.metadata;
+        return `${m.name} (tier ${m.tier}, channel ${m.channel}, target ${m.target_archetype})`;
+      });
+      return lines.join("\n");
+    },
+    agent_state: async (agentNameHint) => {
+      const records = args.registry.list({ identity_id: args.identityId });
+      if (records.length === 0) return "(no wrapped agents)";
+      const filtered = agentNameHint ? records.filter(
+        (r) => r.agent_id.toLowerCase().includes(agentNameHint.toLowerCase()) || r.harness.toLowerCase().includes(agentNameHint.toLowerCase())
+      ) : records;
+      const target = filtered.length > 0 ? filtered : records;
+      const lines = target.slice(0, 20).map((r) => {
+        const tmpl = typeof r.channel_template_id === "string" ? r.channel_template_id : "no_template";
+        return `${r.agent_id}  harness=${r.harness}  status=${r.status}  template=${tmpl}`;
+      });
+      return lines.join("\n");
+    },
+    agent_activity: async (agentNameHint) => {
+      const result = await args.auditLog.query({ limit: 50 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId
+      );
+      const filtered = agentNameHint ? owned.filter((e) => {
+        const agentId = e.details && typeof e.details["agent_id"] === "string" ? e.details["agent_id"] : "";
+        return agentId.toLowerCase().includes(agentNameHint.toLowerCase());
+      }) : owned;
+      const tail = (filtered.length > 0 ? filtered : owned).slice(-20);
+      if (tail.length === 0) return "(no activity)";
+      return tail.map((e) => {
+        const agentId = (e.details && typeof e.details["agent_id"] === "string" ? e.details["agent_id"] : null) ?? "_fortress";
+        return `${e.timestamp}  ${e.layer}.${e.operation}  agent=${agentId}  result=${e.result}`;
+      }).join("\n");
+    },
+    audit_log: async () => {
+      const result = await args.auditLog.query({ limit: 30 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId
+      );
+      if (owned.length === 0) return "(no audit log entries)";
+      return owned.slice(-30).map(
+        (e) => `${e.timestamp}  ${e.layer}.${e.operation}  result=${e.result}`
+      ).join("\n");
+    },
+    sentinel_findings: empty,
+    anomaly_alerts: empty,
+    recent_receipts: async () => {
+      const result = await args.auditLog.query({ limit: 100 });
+      const owned = result.entries.filter(
+        (e) => e.identity_id === args.identityId && e.operation.startsWith("composition_")
+      );
+      if (owned.length === 0) return "(no recent composition events)";
+      return owned.slice(-15).map((e) => `${e.timestamp}  ${e.operation}  result=${e.result}`).join("\n");
+    },
+    verascore_deltas: empty
+  };
+}
+function buildConciergeContextLlmAssist(args) {
+  return async (query, categories) => {
+    const labelList = categories.map((c) => `- ${c}`).join("\n");
+    const prompt = `You are a router. Classify the operator's query into one of the categories below or "none".
+Reply with exactly one token: one category name or "none".
+
+Categories:
+${labelList}
+
+Query: ${query}
+
+Category:`;
+    try {
+      const handle = await args.selector.getSubstrate("concierge");
+      if (!handle.capability.summarize) return "none";
+      const response = await args.selector.invokeSummarize("concierge", {
+        kind: "summarize",
+        context: prompt,
+        query: "Output the single category token.",
+        maxTokens: 16
+      });
+      if (response.failureClass || response.body.kind !== "summarize") {
+        return "none";
+      }
+      const raw = response.body.text.trim().toLowerCase();
+      const head = raw.split(/\s|[.,!?:;]/)[0] ?? "";
+      const normalized = head.replace(/[^a-z_]/g, "");
+      const known = categories;
+      if (known.includes(normalized)) {
+        return normalized;
+      }
+      return "none";
+    } catch {
+      return "none";
+    }
+  };
+}
 function buildConciergePiiFilter() {
   return {
     filter(input) {
@@ -32508,13 +33904,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO3 = "intelligence-substrate-config";
+var HKDF_INFO4 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -35083,7 +36479,7 @@ async function resolveSourceMasterKey(encryptedState, opts) {
   }
   return null;
 }
-async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId) {
+async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIdentityId, importedRekeyEntries) {
   const destinationSigner = opts.destinationSignerIdentityId ? opts.identityManager.get(opts.destinationSignerIdentityId) : opts.identityManager.getDefault();
   if (!destinationSigner) {
     return {
@@ -35145,8 +36541,9 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         }
       }
     }
+    let plaintext;
     try {
-      const plaintext = decrypt(
+      plaintext = decrypt(
         item.entry.payload,
         deriveNamespaceKey(sourceMasterKey, item.namespace)
       );
@@ -35155,28 +36552,30 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
         skipped++;
         continue;
       }
-      await stateStore.write(
-        item.namespace,
-        item.key,
-        bytesToString(plaintext),
-        destinationSigner.identity_id,
-        destinationSigner.encrypted_private_key,
-        identityEncryptionKey,
-        {
-          content_type: item.entry.metadata.content_type,
-          ttl_seconds: item.entry.metadata.ttl_seconds,
-          tags: [
-            ...item.entry.metadata.tags ?? [],
-            "exit-import",
-            `source:${item.entry.kid}`
-          ]
-        }
-      );
-      imported++;
     } catch {
       skippedInvalidSig++;
       skipped++;
+      continue;
     }
+    await stateStore.write(
+      item.namespace,
+      item.key,
+      bytesToString(plaintext),
+      destinationSigner.identity_id,
+      destinationSigner.encrypted_private_key,
+      identityEncryptionKey,
+      {
+        content_type: item.entry.metadata.content_type,
+        ttl_seconds: item.entry.metadata.ttl_seconds,
+        tags: [
+          ...item.entry.metadata.tags ?? [],
+          "exit-import",
+          `source:${item.entry.kid}`
+        ]
+      }
+    );
+    imported++;
+    importedRekeyEntries?.push({ namespace: item.namespace, key: item.key });
   }
   return {
     status: "rekeyed",
@@ -35187,6 +36586,23 @@ async function rekeyState(encryptedState, opts, sourceMasterKey, publicKeysByIde
     conflicts
   };
 }
+async function cleanupStagedPaths(storage, staged) {
+  let removed = 0;
+  const failed = [];
+  for (const loc of staged) {
+    try {
+      const ok = await storage.delete(loc.namespace, loc.key);
+      if (ok) {
+        removed++;
+      } else {
+        failed.push(loc);
+      }
+    } catch {
+      failed.push(loc);
+    }
+  }
+  return { removed, failed };
+}
 async function stageArtifact(storage, namespace, key, value) {
   await storage.write(namespace, key, jsonBytes(value));
 }
@@ -35311,6 +36727,8 @@ async function importExitBundle(opts) {
   }
   const importId = importIdForManifest(manifest);
   const stagedArtifacts = [];
+  const stagedLocations = [];
+  const importedRekeyEntries = [];
   if (identityArtifact) {
     await stageArtifact(
       opts.storage,
@@ -35319,10 +36737,15 @@ async function importExitBundle(opts) {
       identityArtifact.json
     );
     stagedArtifacts.push("public_identity");
+    stagedLocations.push({
+      namespace: EXIT_PUBLIC_IDENTITIES_NAMESPACE,
+      key: identityArtifact.json.bundle.identity_id
+    });
   }
   if (policySet) {
     await stageArtifact(opts.storage, EXIT_POLICY_SETS_NAMESPACE, importId, policySet.json);
     stagedArtifacts.push("policy_set");
+    stagedLocations.push({ namespace: EXIT_POLICY_SETS_NAMESPACE, key: importId });
   }
   if (auditReceipts) {
     await stageArtifact(
@@ -35332,10 +36755,12 @@ async function importExitBundle(opts) {
       auditReceipts.json
     );
     stagedArtifacts.push("audit_receipts");
+    stagedLocations.push({ namespace: EXIT_AUDIT_RECEIPTS_NAMESPACE, key: importId });
   }
   if (commitments) {
     await stageArtifact(opts.storage, EXIT_COMMITMENTS_NAMESPACE, importId, commitments.json);
     stagedArtifacts.push("commitments");
+    stagedLocations.push({ namespace: EXIT_COMMITMENTS_NAMESPACE, key: importId });
   }
   if (placeholderMetadata) {
     await stageArtifact(
@@ -35345,12 +36770,17 @@ async function importExitBundle(opts) {
       placeholderMetadata.json
     );
     stagedArtifacts.push("placeholder_vault_metadata");
+    stagedLocations.push({
+      namespace: EXIT_PLACEHOLDER_METADATA_NAMESPACE,
+      key: importId
+    });
   }
   await stageArtifact(opts.storage, EXIT_IMPORT_NAMESPACE, importId, {
     manifest: manifest.body,
     verified_at: verification.verified_at,
     activated_at: (/* @__PURE__ */ new Date()).toISOString()
   });
+  stagedLocations.push({ namespace: EXIT_IMPORT_NAMESPACE, key: importId });
   const publicKeys = identityArtifact ? publicKeysFromIdentityArtifact(identityArtifact.json) : { byIdentityId: /* @__PURE__ */ new Map(), byDid: /* @__PURE__ */ new Map() };
   let reputationResult = {
     imported_attestations: 0,
@@ -35375,26 +36805,57 @@ async function importExitBundle(opts) {
     encryptedState?.json ?? null,
     opts
   );
-  const stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
-    encryptedState.json,
-    opts,
-    sourceMasterKey,
-    publicKeys.byIdentityId
-  ) : {
-    status: "staged_requires_source_key",
-    imported_keys: 0,
-    skipped_keys: encryptedState.json.entries.length,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: conflicts.state_conflicts.length
-  } : {
-    status: "not_requested",
-    imported_keys: 0,
-    skipped_keys: 0,
-    skipped_invalid_sig: 0,
-    skipped_unknown_kid: 0,
-    conflicts: 0
-  };
+  let stateResult;
+  try {
+    stateResult = encryptedState && encryptedState.json.entries.length > 0 ? sourceMasterKey ? await rekeyState(
+      encryptedState.json,
+      opts,
+      sourceMasterKey,
+      publicKeys.byIdentityId,
+      importedRekeyEntries
+    ) : {
+      status: "staged_requires_source_key",
+      imported_keys: 0,
+      skipped_keys: encryptedState.json.entries.length,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: conflicts.state_conflicts.length
+    } : {
+      status: "not_requested",
+      imported_keys: 0,
+      skipped_keys: 0,
+      skipped_invalid_sig: 0,
+      skipped_unknown_kid: 0,
+      conflicts: 0
+    };
+  } catch (err) {
+    const toCleanup = [
+      ...importedRekeyEntries,
+      ...stagedLocations
+    ];
+    const cleanup = await cleanupStagedPaths(opts.storage, toCleanup);
+    opts.auditLog.append(
+      "l1",
+      "exit_bundle_rekey_failed_cleanup",
+      manifest.body.identity_binding.identity_id,
+      {
+        import_id: importId,
+        manifest_version: manifest.body.manifest_version,
+        rekey_entries_removed: importedRekeyEntries.length,
+        staged_artifacts_removed: stagedLocations.length,
+        removed_total: cleanup.removed,
+        cleanup_failed_count: cleanup.failed.length,
+        original_error: err instanceof Error ? err.message : String(err)
+      },
+      "failure"
+    );
+    await opts.auditLog.flush();
+    const originalMessage = err instanceof Error ? err.message : String(err);
+    throw new ExitBundleImportError(
+      "REKEY_FAILED_AND_CLEANED",
+      `Exit-bundle re-key failed: ${originalMessage}. Cleanup removed ${cleanup.removed} of ${toCleanup.length} staged paths (${importedRekeyEntries.length} re-keyed entries plus ${stagedLocations.length} staged artifacts; ${cleanup.failed.length} cleanup deletes failed).`
+    );
+  }
   opts.auditLog.append("l1", "exit_bundle_import_activate", manifest.body.identity_binding.identity_id, {
     import_id: importId,
     manifest_version: manifest.body.manifest_version,
@@ -36393,16 +37854,35 @@ ${err.message}
       timestamp: alert.timestamp
     });
   } : void 0;
-  const gate = new ApprovalGate(policy, baseline, approvalChannel, auditLog, injectionDetector, onInjectionAlert);
   const fortressIdForAggregator = fortressIdFromStoragePath(config.storage_path);
   const aggregatorIdentityId = identityManager.getPrimaryIdentityId() ?? `fortress:${config.storage_path}`;
+  const aggregatorPayloadStore = new AggregatorPayloadStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
   const approvalAggregator = new ApprovalAggregator({
     storage,
     masterKey,
     auditLog,
     identityId: aggregatorIdentityId,
-    fortressId: fortressIdForAggregator
+    fortressId: fortressIdForAggregator,
+    payloadStore: aggregatorPayloadStore
   });
+  const wrappedApprovalChannel = new AggregatorBackedChannel({
+    underlying: approvalChannel,
+    aggregator: approvalAggregator,
+    resolveRedirect: makeRedirectResolverFromPolicySupplier(() => policy),
+    replaceModeTimeoutMs: policy.approval_channel.timeout_seconds * 1e3
+  });
+  const gate = new ApprovalGate(
+    policy,
+    baseline,
+    wrappedApprovalChannel,
+    auditLog,
+    injectionDetector,
+    onInjectionAlert
+  );
   gate.setApprovalEventCallback((event) => {
     void approvalAggregator.ingest(event);
   });