@sanctuary-framework/mcp-server 1.2.6 → 1.2.8

package/dist/cli.js

@@ -5037,7 +5037,8 @@ var init_constants = __esm({
     RESERVED_EVENT_TYPE_PREFIXES = [
       "EXTENSION_",
       "cross_fortress_",
-      "multi_master_"
+      "multi_master_",
+      "cross_harness_approval_"
     ];
     RESERVED_EXTENSION_ENVELOPE_KEYS = [
       "cross_fortress_read_grant",
@@ -9229,9 +9230,9 @@ function fingerprintDID(did) {
   return `${raw.slice(0, 6)}\u2026${raw.slice(-6)}`;
 }
 function countInjectionsToday(audit) {
-  const startOfDay = /* @__PURE__ */ new Date();
-  startOfDay.setHours(0, 0, 0, 0);
-  const cutoff = startOfDay.getTime();
+  const startOfDay2 = /* @__PURE__ */ new Date();
+  startOfDay2.setHours(0, 0, 0, 0);
+  const cutoff = startOfDay2.getTime();
   return audit.filter((e) => {
     const ts = new Date(e.timestamp).getTime();
     if (isNaN(ts) || ts < cutoff) return false;
@@ -9240,9 +9241,9 @@ function countInjectionsToday(audit) {
   }).length;
 }
 function countProofsToday(audit) {
-  const startOfDay = /* @__PURE__ */ new Date();
-  startOfDay.setHours(0, 0, 0, 0);
-  const cutoff = startOfDay.getTime();
+  const startOfDay2 = /* @__PURE__ */ new Date();
+  startOfDay2.setHours(0, 0, 0, 0);
+  const cutoff = startOfDay2.getTime();
   return audit.filter((e) => {
     if (e.layer !== "l3") return false;
     if (!PROOF_CREATION_OPS.has(e.operation)) return false;
@@ -17211,6 +17212,24 @@ async function handleApprovalInboxRoute(deps, req, res) {
       await handleStream2(deps, res);
       return true;
     }
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/revision`) {
+      const revision = await deps.aggregator.getRevision();
+      writeJSON4(res, 200, { ok: true, data: { revision } });
+      return true;
+    }
+    if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/sync`) {
+      const sinceRaw = url.searchParams.get("since_revision");
+      const sinceParsed = sinceRaw === null ? 0 : Number.parseInt(sinceRaw, 10);
+      const sinceRevision = Number.isFinite(sinceParsed) && sinceParsed >= 0 ? sinceParsed : 0;
+      const limit = parseLimit2(
+        url.searchParams.get("limit"),
+        APPROVAL_INBOX_DEFAULT_LIMIT,
+        APPROVAL_INBOX_MAX_LIMIT
+      );
+      const delta = await deps.aggregator.getSync({ sinceRevision, limit });
+      writeJSON4(res, 200, { ok: true, data: delta });
+      return true;
+    }
     if (method === "GET" && path === `${APPROVAL_INBOX_API_PREFIX}/history`) {
       const limit = parseLimit2(
         url.searchParams.get("limit"),
@@ -17335,6 +17354,125 @@ var init_approval_aggregator_routes = __esm({
     APPROVAL_INBOX_MAX_LIMIT = 200;
   }
 });
+
+// src/sentinel/sentinel-routes.ts
+function writeJSON5(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function isSeverity(value) {
+  return value === "info" || value === "warn" || value === "alert";
+}
+function parseLimit3(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+  return Math.min(parsed, max);
+}
+function matchSubscribeRoute(path) {
+  const prefix = `${SENTINEL_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (!rest.endsWith("/subscribe")) return null;
+  const sentinelId = rest.slice(0, rest.length - "/subscribe".length);
+  if (sentinelId.length === 0) return null;
+  return { sentinelId: decodeURIComponent(sentinelId) };
+}
+async function handleSentinelRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== SENTINEL_API_PREFIX && !path.startsWith(`${SENTINEL_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  const dispatcher = deps.dispatcher;
+  const registry = dispatcher.getRegistry();
+  const findingStore = dispatcher.getFindingStore();
+  try {
+    if (method === "GET" && path === SENTINEL_API_PREFIX) {
+      const catalog = registry.listCatalog();
+      writeJSON5(res, 200, { ok: true, data: { catalog } });
+      return true;
+    }
+    if (method === "GET" && path === `${SENTINEL_API_PREFIX}/subscribed`) {
+      const subscribed = registry.listSubscribed();
+      writeJSON5(res, 200, { ok: true, data: { subscribed } });
+      return true;
+    }
+    if (method === "GET" && path === `${SENTINEL_API_PREFIX}/findings`) {
+      const limit = parseLimit3(
+        url.searchParams.get("limit"),
+        FINDINGS_DEFAULT_LIMIT,
+        FINDINGS_MAX_LIMIT
+      );
+      const since = url.searchParams.get("since") ?? void 0;
+      const severityRaw = url.searchParams.get("severity") ?? void 0;
+      const sentinelIdFilter = url.searchParams.get("sentinel_id") ?? void 0;
+      const agentIdFilter = url.searchParams.get("agent_id") ?? void 0;
+      const severity = severityRaw && isSeverity(severityRaw) ? severityRaw : void 0;
+      const findings = await findingStore.listFindings({
+        limit,
+        ...since !== void 0 ? { since } : {},
+        ...severity !== void 0 ? { severity } : {},
+        ...sentinelIdFilter !== void 0 ? { sentinelId: sentinelIdFilter } : {},
+        ...agentIdFilter !== void 0 ? { agentId: agentIdFilter } : {}
+      });
+      writeJSON5(res, 200, { ok: true, data: { findings } });
+      return true;
+    }
+    const subscribeMatch = matchSubscribeRoute(path);
+    if (subscribeMatch) {
+      if (method === "POST") {
+        try {
+          await dispatcher.subscribeSentinel(subscribeMatch.sentinelId);
+          writeJSON5(res, 200, {
+            ok: true,
+            data: { sentinel_id: subscribeMatch.sentinelId, subscribed: true }
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (msg.startsWith("sentinel-registry: unknown sentinel")) {
+            writeJSON5(res, 404, { ok: false, error: "not_found" });
+          } else {
+            writeJSON5(res, 500, { ok: false, error: "internal", detail: msg });
+          }
+        }
+        return true;
+      }
+      if (method === "DELETE") {
+        const removed = await dispatcher.unsubscribeSentinel(
+          subscribeMatch.sentinelId
+        );
+        writeJSON5(res, 200, {
+          ok: true,
+          data: { sentinel_id: subscribeMatch.sentinelId, subscribed: false, removed }
+        });
+        return true;
+      }
+    }
+    writeJSON5(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON5(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+var SENTINEL_API_PREFIX, FINDINGS_DEFAULT_LIMIT, FINDINGS_MAX_LIMIT;
+var init_sentinel_routes = __esm({
+  "src/sentinel/sentinel-routes.ts"() {
+    init_auth_middleware();
+    SENTINEL_API_PREFIX = "/api/sentinels";
+    FINDINGS_DEFAULT_LIMIT = 100;
+    FINDINGS_MAX_LIMIT = 500;
+  }
+});
 function isDashboardViewRoute(method, path) {
   if (method !== "GET") return false;
   return path === "/" || path === "/dashboard" || path === "/v1.0" || path === "/fortress" || path === "/events";
@@ -17349,6 +17487,7 @@ var init_dashboard = __esm({
     init_system_prompt_generator();
     init_dispatch();
     init_approval_aggregator_routes();
+    init_sentinel_routes();
     SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
     SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
     MAX_SESSIONS = 1e3;
@@ -17416,6 +17555,13 @@ var init_dashboard = __esm({
        * the operator-facing query / decision surface.
        */
       approvalAggregator = null;
+      /**
+       * v1.3 WP-V1.3-1 Phi-1 Sentinel dispatcher. Mounted additively at
+       * `/api/sentinels/*` when set. Sentinel surface is read-only against
+       * the audit log; subscribe/unsubscribe writes flow through the
+       * dispatcher's audited paths.
+       */
+      sentinelDispatcher = null;
       constructor(config) {
         this.config = config;
         this.authToken = config.auth_token;
@@ -17475,6 +17621,14 @@ var init_dashboard = __esm({
       setApprovalAggregator(aggregator) {
         this.approvalAggregator = aggregator;
       }
+      /**
+       * v1.3 WP-V1.3-1 Phi-1: bind the Sentinel dispatcher. Once set,
+       * requests to `/api/sentinels/*` route through `handleSentinelRoute`.
+       * Pass `null` to detach (used by tests + during shutdown).
+       */
+      setSentinelDispatcher(dispatcher) {
+        this.sentinelDispatcher = dispatcher;
+      }
       /**
        * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
        * before the legacy approval route table. Returns true when served.
@@ -17494,6 +17648,25 @@ var init_dashboard = __esm({
           res
         );
       }
+      /**
+       * v1.3 WP-V1.3-1 Phi-1 dispatch entry point. Routes `/api/sentinels/*`
+       * requests through the sentinel router when a dispatcher has been
+       * bound. Returns true when served.
+       */
+      async dispatchSentinel(req, res) {
+        if (!this.sentinelDispatcher) return false;
+        return handleSentinelRoute(
+          {
+            authConfig: {
+              loopbackAutoAuth: this._autoAuthLocalhost,
+              ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+            },
+            dispatcher: this.sentinelDispatcher
+          },
+          req,
+          res
+        );
+      }
       /**
        * v1.1 dispatch entry point. Called from `handleRequest` before the
        * legacy route table. Returns true when the request was served by v1.1
@@ -17881,6 +18054,18 @@ var init_dashboard = __esm({
           });
           return;
         }
+        if (this.sentinelDispatcher && url.pathname.startsWith(SENTINEL_API_PREFIX)) {
+          this.dispatchSentinel(req, res).then((handled) => {
+            if (handled) return;
+            this.handleLegacyRequest(req, res, url, method);
+          }).catch(() => {
+            if (!res.headersSent) {
+              res.writeHead(500, { "Content-Type": "application/json" });
+              res.end(JSON.stringify({ error: "Internal server error" }));
+            }
+          });
+          return;
+        }
         if (this.v11Bindings) {
           this.dispatchV11(req, res, url, method).then((handled) => {
             if (handled) return;
@@ -20353,6 +20538,20 @@ var init_approval_aggregator = __esm({
       hydrated = false;
       /** Active SSE listeners. */
       listeners = /* @__PURE__ */ new Set();
+      /**
+       * Monotonic revision counter, bumped on every mutation (ingest of new
+       * entry, resolve, expire, delete). Hydrated from max(last_modified_revision)
+       * across persisted entries on first read; in-memory after that. v1.3
+       * Upsilon-4.
+       */
+      currentRevision = 0;
+      /**
+       * Removal tombstones: aggregator_id -> revision at removal. Used by the
+       * sync API to surface "removed" entries to mobile consumers between
+       * polls. In-memory only; server restart clears tombstones (mobile
+       * bootstraps via `list()` on reconnect). v1.3 Upsilon-4.
+       */
+      removedTombstones = /* @__PURE__ */ new Map();
       constructor(deps) {
         this.storage = deps.storage;
         this.encryptionKey = derivePurposeKey(
@@ -20387,6 +20586,113 @@ var init_approval_aggregator = __esm({
         this.listeners.add(listener);
         return () => this.listeners.delete(listener);
       }
+      /**
+       * Current aggregator revision. v1.3 Upsilon-4. Mobile companions
+       * poll the lightweight `/revision` route to detect that something
+       * changed before fetching a full sync delta.
+       */
+      async getRevision() {
+        await this.hydrate();
+        return this.currentRevision;
+      }
+      /**
+       * Compute a delta since `sinceRevision`. v1.3 Upsilon-4. Mobile
+       * clients poll this for cheap state-sync. Behavior:
+       *  - `added`: entries whose `created_at_revision > sinceRevision`.
+       *  - `changed`: entries that existed at `sinceRevision` but had a
+       *    status transition (resolve, expire) since.
+       *  - `removed`: aggregator_ids deleted after `sinceRevision`.
+       *  - `revision`: current aggregator revision; pass this back as
+       *    `sinceRevision` on the next call.
+       *
+       * `limit` caps the total count returned across all three lists,
+       * prioritized as added -> changed -> removed (newer-state first).
+       * When more changes exist than fit, the next call with the returned
+       * revision will pick up the rest because each entry's
+       * last_modified_revision is unchanged by truncation.
+       */
+      async getSync(opts) {
+        await this.hydrate();
+        await this.expireStale();
+        const sinceRevision = opts?.sinceRevision ?? 0;
+        const cap = Math.min(
+          opts?.limit ?? DEFAULT_LIST_PAGE_SIZE,
+          this.maxListLimit
+        );
+        const added = [];
+        const changed = [];
+        for (const entry of this.entries.values()) {
+          const lastMod = entry.last_modified_revision ?? 0;
+          if (lastMod <= sinceRevision) continue;
+          const createdRev = entry.created_at_revision ?? 0;
+          if (createdRev > sinceRevision) {
+            added.push(entry);
+          } else {
+            changed.push(entry);
+          }
+        }
+        const removed = [];
+        for (const [id, rev] of this.removedTombstones) {
+          if (rev > sinceRevision) removed.push(id);
+        }
+        added.sort(
+          (a, b) => (a.last_modified_revision ?? 0) - (b.last_modified_revision ?? 0)
+        );
+        changed.sort(
+          (a, b) => (a.last_modified_revision ?? 0) - (b.last_modified_revision ?? 0)
+        );
+        let remaining = cap;
+        const addedOut = added.slice(0, Math.max(0, remaining));
+        remaining -= addedOut.length;
+        const changedOut = changed.slice(0, Math.max(0, remaining));
+        remaining -= changedOut.length;
+        const removedOut = removed.slice(0, Math.max(0, remaining));
+        return {
+          revision: this.currentRevision,
+          added: addedOut,
+          changed: changedOut,
+          removed: removedOut
+        };
+      }
+      /**
+       * Delete an entry. Drops the in-memory record, the persisted bundle,
+       * and the at-rest payload (if a payload store is wired). Records a
+       * tombstone with the new revision so sync-API consumers see a
+       * `removed` delta. Returns true when an entry was deleted, false on
+       * unknown id. v1.3 Upsilon-4. Reserved for v1.4+ retention housekeeping;
+       * Upsilon-4 ships the surface so mobile sync-API tests can exercise the
+       * removal path.
+       */
+      async deleteEntry(aggregatorId) {
+        await this.hydrate();
+        const entry = this.entries.get(aggregatorId);
+        if (!entry) return false;
+        const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
+        this.entries.delete(aggregatorId);
+        this.dedupIndex.delete(dedupKey);
+        this.fullPayloads.delete(aggregatorId);
+        for (const [corr, id] of this.correlationIndex) {
+          if (id === aggregatorId) this.correlationIndex.delete(corr);
+        }
+        try {
+          await this.storage.delete(APPROVAL_AGGREGATOR_NAMESPACE, aggregatorId);
+        } catch {
+        }
+        if (this.payloadStore) {
+          try {
+            await this.payloadStore.deletePayload(aggregatorId);
+          } catch {
+          }
+        }
+        const revision = this.nextRevision();
+        this.removedTombstones.set(aggregatorId, revision);
+        this.emit({ type: "removed", entry: { ...entry } });
+        return true;
+      }
+      nextRevision() {
+        this.currentRevision += 1;
+        return this.currentRevision;
+      }
       /**
        * Ingest a gate event. Returns the aggregator entry on first sight,
        * `null` when deduped. Resolution events update the existing record;
@@ -20597,6 +20903,7 @@ var init_approval_aggregator = __esm({
         entry.status = decision;
         entry.resolved_at = this.now().toISOString();
         entry.resolved_by = operatorId;
+        entry.last_modified_revision = this.nextRevision();
         await this.persist(entry);
         this.auditLog.append(
           "l2",
@@ -20648,6 +20955,7 @@ var init_approval_aggregator = __esm({
         const expires = new Date(now.getTime() + this.pendingTtlMs);
         const hubInboxId = this.resolveHubInboxItemId(event);
         const enforcementChain = this.resolveEnforcementChain(event);
+        const revision = this.nextRevision();
         const entry = {
           aggregator_id: id,
           source_harness: ctx.source_harness,
@@ -20659,6 +20967,8 @@ var init_approval_aggregator = __esm({
           status: "pending",
           created_at: now.toISOString(),
           expires_at: expires.toISOString(),
+          created_at_revision: revision,
+          last_modified_revision: revision,
           ...hubInboxId !== void 0 ? { hub_inbox_item_id: hubInboxId } : {},
           ...enforcementChain.length > 0 ? { enforcement_chain: enforcementChain } : {}
         };
@@ -20701,6 +21011,7 @@ var init_approval_aggregator = __esm({
         entry.status = status;
         entry.resolved_at = event.resolution.decided_at;
         entry.resolved_by = event.resolution.decided_by;
+        entry.last_modified_revision = this.nextRevision();
         await this.persist(entry);
         this.auditLog.append(
           "l2",
@@ -20763,6 +21074,7 @@ var init_approval_aggregator = __esm({
           entry.status = "expired";
           entry.resolved_at = this.now().toISOString();
           entry.resolved_by = "system_ttl";
+          entry.last_modified_revision = this.nextRevision();
           await this.persist(entry);
           this.auditLog.append(
             "l2",
@@ -20809,6 +21121,10 @@ var init_approval_aggregator = __esm({
               this.entries.set(entry.aggregator_id, entry);
               const dedupKey = `${entry.source_harness}|${entry.source_agent_id}|${entry.audit_log_entry_id}`;
               this.dedupIndex.set(dedupKey, entry.aggregator_id);
+              const lastMod = entry.last_modified_revision ?? 0;
+              if (lastMod > this.currentRevision) {
+                this.currentRevision = lastMod;
+              }
             } catch {
             }
           }
@@ -21131,6 +21447,1725 @@ var init_aggregator_store = __esm({
   }
 });
 
+// src/sentinel/types.ts
+function isProxyCallAuditEntry(entry) {
+  return entry.operation.startsWith(
+    SENTINEL_OBSERVED_AUDIT_OPS.PROXY_CALL_PREFIX
+  );
+}
+function proxyServerFromAuditEntry(entry) {
+  if (!isProxyCallAuditEntry(entry)) return null;
+  const details = entry.details;
+  if (!details) return null;
+  const server = details["server"];
+  if (typeof server !== "string" || server.length === 0) return null;
+  return server;
+}
+var SENTINEL_SUMMARY_MAX_CHARS, SENTINEL_AUDIT_OPS, SENTINEL_OBSERVED_AUDIT_OPS;
+var init_types3 = __esm({
+  "src/sentinel/types.ts"() {
+    SENTINEL_SUMMARY_MAX_CHARS = 240;
+    SENTINEL_AUDIT_OPS = {
+      SUBSCRIBED: "sentinel_subscribed",
+      UNSUBSCRIBED: "sentinel_unsubscribed",
+      FINDING_EMITTED: "sentinel_finding_emitted",
+      EVALUATION_FAILED: "sentinel_evaluation_failed"
+    };
+    SENTINEL_OBSERVED_AUDIT_OPS = {
+      /** Proxy router emits this on every outbound call (success or failure). */
+      PROXY_CALL_PREFIX: "proxy_call:"
+    };
+  }
+});
+
+// src/sentinel/sentinel-finding-store.ts
+function findingKey(findingId) {
+  return `${SENTINEL_FINDING_KEY_PREFIX}${findingId}`;
+}
+function stripKeyPrefix2(key) {
+  if (!key.startsWith(SENTINEL_FINDING_KEY_PREFIX)) return null;
+  return key.slice(SENTINEL_FINDING_KEY_PREFIX.length);
+}
+function truncateSummary(summary) {
+  if (summary.length <= SENTINEL_SUMMARY_MAX_CHARS) return summary;
+  return `${summary.slice(0, SENTINEL_SUMMARY_MAX_CHARS - 3)}...`;
+}
+var SENTINEL_FINDING_NAMESPACE, SENTINEL_FINDING_KEY_PREFIX, HKDF_INFO2, DEFAULT_SENTINEL_FINDING_RETENTION_DAYS, MAX_FINDING_BYTES, SentinelFindingStore;
+var init_sentinel_finding_store = __esm({
+  "src/sentinel/sentinel-finding-store.ts"() {
+    init_encryption();
+    init_key_derivation();
+    init_encoding();
+    init_types3();
+    SENTINEL_FINDING_NAMESPACE = "_sentinel_findings";
+    SENTINEL_FINDING_KEY_PREFIX = "finding.";
+    HKDF_INFO2 = "l2-sentinel-finding-v1";
+    DEFAULT_SENTINEL_FINDING_RETENTION_DAYS = 30;
+    MAX_FINDING_BYTES = 256 * 1024;
+    SentinelFindingStore = class {
+      storage;
+      encryptionKey;
+      fortressId;
+      retentionDays;
+      now;
+      constructor(opts) {
+        this.storage = opts.storage;
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+        this.fortressId = opts.fortressId;
+        this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_SENTINEL_FINDING_RETENTION_DAYS;
+        this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+      }
+      /**
+       * Persist a finding. Truncates the operator-visible summary to
+       * SENTINEL_SUMMARY_MAX_CHARS so the dashboard render stays bounded.
+       * Returns the retention deadline so callers can audit it.
+       */
+      async saveFinding(finding) {
+        const truncated = {
+          ...finding,
+          fortress_id: this.fortressId,
+          summary: truncateSummary(finding.summary)
+        };
+        const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+        const retentionUntil = new Date(this.now().getTime() + retentionMs);
+        const persisted = {
+          version: 1,
+          finding: truncated,
+          retention_until: retentionUntil.toISOString()
+        };
+        const aad = stringToBytes(finding.finding_id);
+        const plaintext = stringToBytes(JSON.stringify(persisted));
+        const envelope = encrypt(plaintext, this.encryptionKey, aad);
+        await this.storage.write(
+          SENTINEL_FINDING_NAMESPACE,
+          findingKey(finding.finding_id),
+          stringToBytes(JSON.stringify(envelope))
+        );
+        return persisted.retention_until;
+      }
+      /** Load a single finding by id, or null when absent / corrupted. */
+      async loadFinding(findingId) {
+        let raw;
+        try {
+          raw = await this.storage.read(
+            SENTINEL_FINDING_NAMESPACE,
+            findingKey(findingId)
+          );
+        } catch {
+          return null;
+        }
+        if (!raw) return null;
+        if (raw.length > MAX_FINDING_BYTES) return null;
+        return this.decode(findingId, raw);
+      }
+      /**
+       * List findings, newest first. Optional filters: since (ISO 8601),
+       * severity, sentinel_id, agent_id, limit. Default limit 100.
+       */
+      async listFindings(opts) {
+        const metas = await this.storage.list(
+          SENTINEL_FINDING_NAMESPACE,
+          SENTINEL_FINDING_KEY_PREFIX
+        );
+        const findings = [];
+        for (const meta of metas) {
+          const id = stripKeyPrefix2(meta.key);
+          if (id === null) continue;
+          const raw = await this.storage.read(
+            SENTINEL_FINDING_NAMESPACE,
+            meta.key
+          );
+          if (!raw) continue;
+          if (raw.length > MAX_FINDING_BYTES) continue;
+          const finding = await this.decode(id, raw);
+          if (!finding) continue;
+          if (opts?.since && finding.observed_at < opts.since) continue;
+          if (opts?.severity && finding.severity !== opts.severity) continue;
+          if (opts?.sentinelId && finding.sentinel_id !== opts.sentinelId) continue;
+          if (opts?.agentId && finding.agent_id !== opts.agentId) continue;
+          findings.push(finding);
+        }
+        findings.sort((a, b) => a.observed_at < b.observed_at ? 1 : -1);
+        const limit = opts?.limit ?? 100;
+        return findings.slice(0, limit);
+      }
+      /**
+       * Drop expired findings. Returns the count removed.
+       */
+      async pruneExpired(now) {
+        const cutoff = (now ?? this.now()).toISOString();
+        const metas = await this.storage.list(
+          SENTINEL_FINDING_NAMESPACE,
+          SENTINEL_FINDING_KEY_PREFIX
+        );
+        let pruned = 0;
+        for (const meta of metas) {
+          const id = stripKeyPrefix2(meta.key);
+          if (id === null) continue;
+          const raw = await this.storage.read(
+            SENTINEL_FINDING_NAMESPACE,
+            meta.key
+          );
+          if (!raw) continue;
+          try {
+            const aad = stringToBytes(id);
+            const envelope = JSON.parse(bytesToString(raw));
+            const plaintext = decrypt(envelope, this.encryptionKey, aad);
+            const persisted = JSON.parse(
+              bytesToString(plaintext)
+            );
+            if (persisted.retention_until <= cutoff) {
+              await this.storage.delete(SENTINEL_FINDING_NAMESPACE, meta.key);
+              pruned += 1;
+            }
+          } catch {
+          }
+        }
+        return { pruned };
+      }
+      async decode(findingId, raw) {
+        try {
+          const aad = stringToBytes(findingId);
+          const envelope = JSON.parse(bytesToString(raw));
+          const plaintext = decrypt(envelope, this.encryptionKey, aad);
+          const persisted = JSON.parse(
+            bytesToString(plaintext)
+          );
+          if (persisted.version !== 1) return null;
+          if (persisted.finding.finding_id !== findingId) return null;
+          if (persisted.finding.fortress_id !== this.fortressId) return null;
+          return persisted.finding;
+        } catch {
+          return null;
+        }
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinel-registry.ts
+var SentinelRegistry;
+var init_sentinel_registry = __esm({
+  "src/sentinel/sentinel-registry.ts"() {
+    SentinelRegistry = class {
+      catalog = /* @__PURE__ */ new Map();
+      subscribed = /* @__PURE__ */ new Map();
+      register(entry) {
+        if (this.catalog.has(entry.sentinelId)) {
+          throw new Error(
+            `sentinel-registry: ${entry.sentinelId} already registered`
+          );
+        }
+        this.catalog.set(entry.sentinelId, entry);
+      }
+      /**
+       * Available sentinels (catalog view). Operator UI lists this so the
+       * operator can pick what to subscribe to.
+       */
+      listCatalog() {
+        return [...this.catalog.values()].map((entry) => ({
+          sentinelId: entry.sentinelId,
+          description: entry.description
+        }));
+      }
+      /** Currently subscribed sentinel ids. */
+      listSubscribed() {
+        return [...this.subscribed.keys()];
+      }
+      /** Has the fortress opted into this sentinel? */
+      isSubscribed(sentinelId) {
+        return this.subscribed.has(sentinelId);
+      }
+      /**
+       * Subscribe a sentinel to a fortress context. Idempotent: a second
+       * subscribe call on an already-subscribed sentinel returns the
+       * existing instance without re-running `subscribe()`.
+       */
+      async subscribe(sentinelId, context) {
+        const existing = this.subscribed.get(sentinelId);
+        if (existing) return existing;
+        const entry = this.catalog.get(sentinelId);
+        if (!entry) {
+          throw new Error(`sentinel-registry: unknown sentinel ${sentinelId}`);
+        }
+        const instance = entry.factory();
+        await instance.subscribe(context);
+        this.subscribed.set(sentinelId, instance);
+        return instance;
+      }
+      /**
+       * Unsubscribe. Idempotent: unsubscribing an unsubscribed sentinel
+       * returns false without throwing. Returns true when an active
+       * subscription was torn down.
+       */
+      async unsubscribe(sentinelId) {
+        const instance = this.subscribed.get(sentinelId);
+        if (!instance) return false;
+        try {
+          await instance.unsubscribe();
+        } finally {
+          this.subscribed.delete(sentinelId);
+        }
+        return true;
+      }
+      /**
+       * Snapshot of subscribed sentinels for the dispatcher's tick path.
+       * Returned as an array so the dispatcher can iterate without holding
+       * the map under modification.
+       */
+      snapshotSubscribed() {
+        return [...this.subscribed.entries()].map(([sentinelId, sentinel]) => ({
+          sentinelId,
+          sentinel
+        }));
+      }
+      /**
+       * Tear down every subscription. Called by the dispatcher on
+       * fortress-shutdown. Best-effort: a failing unsubscribe does not
+       * abort the rest.
+       */
+      async unsubscribeAll() {
+        const ids = [...this.subscribed.keys()];
+        for (const id of ids) {
+          try {
+            await this.unsubscribe(id);
+          } catch {
+          }
+        }
+      }
+    };
+  }
+});
+var DEFAULT_TICK_INTERVAL_MS, SentinelDispatcher;
+var init_sentinel_dispatcher = __esm({
+  "src/sentinel/sentinel-dispatcher.ts"() {
+    init_types3();
+    DEFAULT_TICK_INTERVAL_MS = 6e4;
+    SentinelDispatcher = class {
+      registry;
+      findingStore;
+      auditLog;
+      fortressId;
+      identityId;
+      now;
+      tickIntervalMs;
+      listeners = /* @__PURE__ */ new Set();
+      tickTimer = null;
+      tickInFlight = false;
+      constructor(deps) {
+        this.registry = deps.registry;
+        this.findingStore = deps.findingStore;
+        this.auditLog = deps.auditLog;
+        this.fortressId = deps.fortressId;
+        this.identityId = deps.identityId;
+        this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+        this.tickIntervalMs = deps.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS;
+      }
+      /** Read-only view of the registry. Convenience for route handlers. */
+      getRegistry() {
+        return this.registry;
+      }
+      /** Read-only view of the finding store. Convenience for route handlers. */
+      getFindingStore() {
+        return this.findingStore;
+      }
+      /**
+       * Subscribe an in-process listener. Returns an unsubscribe fn.
+       */
+      onEvent(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+      }
+      /**
+       * Subscribe a sentinel to this fortress + emit the
+       * `sentinel_subscribed` audit event. Wraps `registry.subscribe()` so
+       * the audit emission lives at the dispatcher boundary (the
+       * fortress-aware site).
+       */
+      async subscribeSentinel(sentinelId, contextOverrides) {
+        const context = {
+          fortressId: this.fortressId,
+          auditLog: this.auditLog,
+          now: this.now,
+          ...contextOverrides ?? {}
+        };
+        const sentinel = await this.registry.subscribe(sentinelId, context);
+        this.auditLog.append(
+          "l2",
+          SENTINEL_AUDIT_OPS.SUBSCRIBED,
+          this.identityId,
+          { sentinel_id: sentinelId, fortress_id: this.fortressId }
+        );
+        return sentinel;
+      }
+      /**
+       * Unsubscribe + emit `sentinel_unsubscribed`. Returns true when an
+       * active subscription was torn down. Audit fires only on successful
+       * removal.
+       */
+      async unsubscribeSentinel(sentinelId) {
+        const removed = await this.registry.unsubscribe(sentinelId);
+        if (removed) {
+          this.auditLog.append(
+            "l2",
+            SENTINEL_AUDIT_OPS.UNSUBSCRIBED,
+            this.identityId,
+            { sentinel_id: sentinelId, fortress_id: this.fortressId }
+          );
+        }
+        return removed;
+      }
+      /**
+       * Run one evaluation pass over every subscribed sentinel. Used by
+       * the auto-tick AND by tests that want a synchronous evaluation
+       * gate. Returns the findings produced this tick (already persisted
+       * + audit-logged + emitted).
+       */
+      async tick() {
+        if (this.tickInFlight) return [];
+        this.tickInFlight = true;
+        try {
+          const subscribed = this.registry.snapshotSubscribed();
+          const findings = [];
+          for (const { sentinelId, sentinel } of subscribed) {
+            try {
+              const tickFindings = await sentinel.evaluate();
+              for (const finding of tickFindings) {
+                const stamped = await this.routeFinding(sentinelId, finding);
+                findings.push(stamped);
+              }
+            } catch (err) {
+              const errorMessage = err instanceof Error ? err.message : String(err);
+              const observedAt = this.now().toISOString();
+              this.auditLog.append(
+                "l2",
+                SENTINEL_AUDIT_OPS.EVALUATION_FAILED,
+                this.identityId,
+                {
+                  sentinel_id: sentinelId,
+                  fortress_id: this.fortressId,
+                  error_message: errorMessage
+                },
+                "failure"
+              );
+              this.emit({
+                type: "evaluation_failed",
+                sentinel_id: sentinelId,
+                error_message: errorMessage,
+                observed_at: observedAt
+              });
+            }
+          }
+          return findings;
+        } finally {
+          this.tickInFlight = false;
+        }
+      }
+      /**
+       * Start the auto-tick loop. No-op when tickIntervalMs is 0 or when
+       * already started. Tests typically leave auto-tick off and call
+       * `tick()` directly.
+       */
+      start() {
+        if (this.tickTimer !== null) return;
+        if (this.tickIntervalMs <= 0) return;
+        this.tickTimer = setInterval(() => {
+          void this.tick();
+        }, this.tickIntervalMs);
+        if (typeof this.tickTimer.unref === "function") {
+          this.tickTimer.unref();
+        }
+      }
+      /** Stop the auto-tick loop. Idempotent. */
+      stop() {
+        if (this.tickTimer === null) return;
+        clearInterval(this.tickTimer);
+        this.tickTimer = null;
+      }
+      /**
+       * Tear down every subscription + stop the tick loop. Called on
+       * fortress shutdown.
+       */
+      async dispose() {
+        this.stop();
+        await this.registry.unsubscribeAll();
+        this.listeners.clear();
+      }
+      async routeFinding(sentinelId, raw) {
+        const stamped = {
+          ...raw,
+          finding_id: raw.finding_id || randomUUID(),
+          sentinel_id: sentinelId,
+          fortress_id: this.fortressId,
+          observed_at: raw.observed_at || this.now().toISOString()
+        };
+        await this.findingStore.saveFinding(stamped);
+        this.auditLog.append(
+          "l2",
+          SENTINEL_AUDIT_OPS.FINDING_EMITTED,
+          this.identityId,
+          {
+            sentinel_id: sentinelId,
+            finding_id: stamped.finding_id,
+            severity: stamped.severity,
+            ...stamped.agent_id !== void 0 ? { agent_id: stamped.agent_id } : {},
+            evidence_audit_ids: stamped.evidence_audit_ids,
+            fortress_id: this.fortressId
+          }
+        );
+        this.emit({ type: "finding", finding: stamped });
+        return stamped;
+      }
+      emit(event) {
+        for (const listener of this.listeners) {
+          try {
+            listener(event);
+          } catch {
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinel.ts
+var Sentinel;
+var init_sentinel = __esm({
+  "src/sentinel/sentinel.ts"() {
+    Sentinel = class {
+      /**
+       * Bind the sentinel to a fortress context. Called once on
+       * subscribe. Default implementation stores the context on `this`;
+       * sentinels that need additional setup (e.g. priming a baseline
+       * cache) override.
+       */
+      async subscribe(context) {
+        this.context = context;
+      }
+      /**
+       * Tear down. Default implementation clears the context; subclasses
+       * that hold timers or external handles override.
+       */
+      async unsubscribe() {
+        this.context = void 0;
+      }
+      context;
+      /** Internal helper: assert subscribed before evaluation. */
+      requireContext() {
+        if (!this.context) {
+          throw new Error(
+            `sentinel ${this.sentinelId}: evaluate() called before subscribe()`
+          );
+        }
+        return this.context;
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinels/egress-volume-watcher.ts
+var EGRESS_VOLUME_SENTINEL_ID, WARN_SIGMA, ALERT_SIGMA, BASELINE_WINDOWS, QUERY_LIMIT, EgressVolumeWatcher;
+var init_egress_volume_watcher = __esm({
+  "src/sentinel/sentinels/egress-volume-watcher.ts"() {
+    init_sentinel();
+    init_types3();
+    EGRESS_VOLUME_SENTINEL_ID = "egress-volume";
+    WARN_SIGMA = 3;
+    ALERT_SIGMA = 6;
+    BASELINE_WINDOWS = 7;
+    QUERY_LIMIT = 1e4;
+    EgressVolumeWatcher = class extends Sentinel {
+      sentinelId = EGRESS_VOLUME_SENTINEL_ID;
+      description = "Watches outbound proxy-call volume per upstream server. Emits warn/alert when current 24h volume exceeds the rolling 7-day baseline by 3x or 6x standard deviations.";
+      /** Servers we have already produced an `info` baseline-established finding for. */
+      baselineEstablished = /* @__PURE__ */ new Set();
+      async evaluate() {
+        const ctx = this.requireContext();
+        const now = ctx.now();
+        const windowMs = 24 * 60 * 60 * 1e3;
+        const windowSpanMs = (BASELINE_WINDOWS + 1) * windowMs;
+        const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+        const queryResult = await ctx.auditLog.query({
+          since: sinceIso,
+          layer: "l2",
+          limit: QUERY_LIMIT
+        });
+        const entries = queryResult.entries.filter(isProxyCallAuditEntry);
+        const byServer = /* @__PURE__ */ new Map();
+        for (const entry of entries) {
+          const server = proxyServerFromAuditEntry(entry);
+          if (server === null) continue;
+          const auditAge = now.getTime() - new Date(entry.timestamp).getTime();
+          if (auditAge < 0) continue;
+          const windowIdx = Math.floor(auditAge / windowMs);
+          if (windowIdx > BASELINE_WINDOWS) continue;
+          let snapshot = byServer.get(server);
+          if (!snapshot) {
+            snapshot = { windows: [] };
+            for (let i = 0; i <= BASELINE_WINDOWS; i += 1) {
+              snapshot.windows.push({ count: 0, evidence_audit_ids: [] });
+            }
+            byServer.set(server, snapshot);
+          }
+          const bucket = snapshot.windows[windowIdx];
+          bucket.count += 1;
+          if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+            bucket.evidence_audit_ids.push(`${entry.timestamp}:${entry.operation}`);
+          }
+        }
+        const findings = [];
+        for (const [server, snapshot] of byServer.entries()) {
+          const finding = this.evaluateServer(server, snapshot, now);
+          if (finding) findings.push(finding);
+        }
+        return findings;
+      }
+      /** Reset baseline-established memoization. Tests use this between runs. */
+      resetBaselineMemo() {
+        this.baselineEstablished.clear();
+      }
+      evaluateServer(server, snapshot, now) {
+        const currentWindow = snapshot.windows[0];
+        const baselineWindows = snapshot.windows.slice(1);
+        const populatedBaselineWindows = baselineWindows.filter((w) => w.count > 0).length;
+        if (populatedBaselineWindows < BASELINE_WINDOWS) {
+          if (this.baselineEstablished.has(server)) return null;
+          if (populatedBaselineWindows === 0 && currentWindow.count === 0) {
+            return null;
+          }
+          return null;
+        }
+        const baselineCounts = baselineWindows.map((w) => w.count);
+        const mean = baselineCounts.reduce((sum, c) => sum + c, 0) / baselineCounts.length;
+        const variance = baselineCounts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / baselineCounts.length;
+        const stddev = Math.sqrt(variance);
+        const wasEstablished = this.baselineEstablished.has(server);
+        this.baselineEstablished.add(server);
+        if (!wasEstablished) {
+          return {
+            finding_id: "",
+            sentinel_id: this.sentinelId,
+            severity: "info",
+            summary: `egress-volume baseline established for ${server}: mean ${mean.toFixed(1)} calls/24h, stddev ${stddev.toFixed(1)} (over ${BASELINE_WINDOWS} prior days).`,
+            details: {
+              server,
+              baseline_mean: mean,
+              baseline_stddev: stddev,
+              baseline_windows: baselineCounts,
+              current_count: currentWindow.count
+            },
+            observed_at: now.toISOString(),
+            evidence_audit_ids: [],
+            fortress_id: ""
+          };
+        }
+        const warnThreshold = mean + WARN_SIGMA * stddev;
+        const alertThreshold = mean + ALERT_SIGMA * stddev;
+        if (currentWindow.count > alertThreshold) {
+          return this.buildAnomalyFinding(
+            server,
+            snapshot,
+            mean,
+            stddev,
+            now,
+            "alert",
+            ALERT_SIGMA
+          );
+        }
+        if (currentWindow.count > warnThreshold) {
+          return this.buildAnomalyFinding(
+            server,
+            snapshot,
+            mean,
+            stddev,
+            now,
+            "warn",
+            WARN_SIGMA
+          );
+        }
+        return null;
+      }
+      buildAnomalyFinding(server, snapshot, mean, stddev, now, severity, sigma) {
+        const currentWindow = snapshot.windows[0];
+        const ratio = mean === 0 ? Infinity : currentWindow.count / mean;
+        const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+        const summary = `${server} egress is ${ratioStr}: ${currentWindow.count} calls in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma threshold.`;
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary,
+          details: {
+            server,
+            current_count: currentWindow.count,
+            baseline_mean: mean,
+            baseline_stddev: stddev,
+            sigma_threshold: sigma,
+            ratio
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: currentWindow.evidence_audit_ids,
+          fortress_id: ""
+        };
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinels/cross-agent-chatter-watcher.ts
+function pairKey(sender, recipient) {
+  return `${sender}|${recipient}`;
+}
+function pairFromKey(key) {
+  const idx = key.indexOf("|");
+  return { sender: key.slice(0, idx), recipient: key.slice(idx + 1) };
+}
+function computeNewPartners(byPair) {
+  const currentBySource = /* @__PURE__ */ new Map();
+  const priorBySource = /* @__PURE__ */ new Map();
+  for (const [key, snap] of byPair.entries()) {
+    const { sender, recipient } = pairFromKey(key);
+    if (snap.windows[0] && snap.windows[0].count > 0) {
+      let recipMap = currentBySource.get(sender);
+      if (!recipMap) {
+        recipMap = /* @__PURE__ */ new Map();
+        currentBySource.set(sender, recipMap);
+      }
+      recipMap.set(recipient, snap.windows[0].evidence_audit_ids);
+    }
+    const priorTouched = snap.windows.slice(1).some((w) => w.count > 0);
+    if (priorTouched) {
+      let set = priorBySource.get(sender);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        priorBySource.set(sender, set);
+      }
+      set.add(recipient);
+    }
+  }
+  const out = /* @__PURE__ */ new Map();
+  for (const [sender, recipMap] of currentBySource.entries()) {
+    const prior = priorBySource.get(sender) ?? /* @__PURE__ */ new Set();
+    if (prior.size === 0) {
+      continue;
+    }
+    const newPartners = [];
+    const evidence = [];
+    for (const [recipient, recipEvidence] of recipMap.entries()) {
+      if (!prior.has(recipient)) {
+        newPartners.push(recipient);
+        for (const id of recipEvidence) {
+          if (evidence.length < 50) evidence.push(id);
+        }
+      }
+    }
+    if (newPartners.length === 0) continue;
+    newPartners.sort();
+    out.set(sender, {
+      partners: newPartners,
+      priorPartners: [...prior].sort(),
+      evidenceAuditIds: evidence
+    });
+  }
+  return out;
+}
+function extractInterAgentEvents(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const op = entry.operation;
+    if (op === HANDOFF_OP) {
+      const details = entry.details;
+      const sender = optionalString(details, "sender_agent_id");
+      const recipient = optionalString(details, "recipient_agent_id");
+      if (!sender || !recipient || sender === recipient) continue;
+      out.push({
+        sender,
+        recipient,
+        timestampMs: Date.parse(entry.timestamp),
+        auditId: `${entry.timestamp}:${entry.operation}`
+      });
+      continue;
+    }
+    if (CROSS_HARNESS_OPS.has(op)) {
+      const details = entry.details;
+      const sender = optionalString(details, "source_harness") ?? optionalString(details, "source_agent_id");
+      if (!sender) continue;
+      out.push({
+        sender,
+        recipient: OPERATOR_PSEUDO_AGENT,
+        timestampMs: Date.parse(entry.timestamp),
+        auditId: `${entry.timestamp}:${entry.operation}`
+      });
+    }
+  }
+  return out;
+}
+function optionalString(details, key) {
+  if (!details) return null;
+  const value = details[key];
+  if (typeof value !== "string" || value.length === 0) return null;
+  return value;
+}
+var CROSS_AGENT_CHATTER_SENTINEL_ID, WARN_SIGMA2, ALERT_SIGMA2, BASELINE_WINDOWS2, QUERY_LIMIT2, MULTI_NEW_PARTNER_ALERT_THRESHOLD, OPERATOR_PSEUDO_AGENT, HANDOFF_OP, CROSS_HARNESS_OPS, CrossAgentChatterWatcher;
+var init_cross_agent_chatter_watcher = __esm({
+  "src/sentinel/sentinels/cross-agent-chatter-watcher.ts"() {
+    init_sentinel();
+    CROSS_AGENT_CHATTER_SENTINEL_ID = "cross-agent-chatter";
+    WARN_SIGMA2 = 3;
+    ALERT_SIGMA2 = 6;
+    BASELINE_WINDOWS2 = 7;
+    QUERY_LIMIT2 = 1e4;
+    MULTI_NEW_PARTNER_ALERT_THRESHOLD = 3;
+    OPERATOR_PSEUDO_AGENT = "operator";
+    HANDOFF_OP = "v1.1_local_handoff";
+    CROSS_HARNESS_OPS = /* @__PURE__ */ new Set([
+      "cross_harness_approval_aggregated",
+      "cross_harness_approval_resolved"
+    ]);
+    CrossAgentChatterWatcher = class extends Sentinel {
+      sentinelId = CROSS_AGENT_CHATTER_SENTINEL_ID;
+      description = "Watches inter-agent communication patterns. Surfaces per-pair rate spikes (3 or 6 sigma over the rolling 7-day baseline) and new-partner appearances. Escalates to alert when one source agent picks up 3 or more new partners in 24h (lateral-movement shape).";
+      /** Pair keys we have already produced a baseline-established info finding for. */
+      baselineEstablished = /* @__PURE__ */ new Set();
+      async evaluate() {
+        const ctx = this.requireContext();
+        const now = ctx.now();
+        const windowMs = 24 * 60 * 60 * 1e3;
+        const windowSpanMs = (BASELINE_WINDOWS2 + 1) * windowMs;
+        const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+        const queryResult = await ctx.auditLog.query({
+          since: sinceIso,
+          layer: "l2",
+          limit: QUERY_LIMIT2
+        });
+        const events = extractInterAgentEvents(queryResult.entries);
+        const byPair = /* @__PURE__ */ new Map();
+        for (const event of events) {
+          const auditAgeMs = now.getTime() - event.timestampMs;
+          if (auditAgeMs < 0) continue;
+          const windowIdx = Math.floor(auditAgeMs / windowMs);
+          if (windowIdx > BASELINE_WINDOWS2) continue;
+          const key = pairKey(event.sender, event.recipient);
+          let snap = byPair.get(key);
+          if (!snap) {
+            snap = { windows: [] };
+            for (let i = 0; i <= BASELINE_WINDOWS2; i += 1) {
+              snap.windows.push({ count: 0, evidence_audit_ids: [] });
+            }
+            byPair.set(key, snap);
+          }
+          const bucket = snap.windows[windowIdx];
+          bucket.count += 1;
+          if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+            bucket.evidence_audit_ids.push(event.auditId);
+          }
+        }
+        const findings = [];
+        for (const [key, snap] of byPair.entries()) {
+          const finding = this.evaluatePair(key, snap, now);
+          if (finding) findings.push(finding);
+        }
+        const newPartnersBySource = computeNewPartners(byPair);
+        for (const [source, partners] of newPartnersBySource.entries()) {
+          const finding = this.buildNewPartnerFinding(source, partners, now);
+          if (finding) findings.push(finding);
+        }
+        return findings;
+      }
+      /** Reset baseline-established memoization. Tests use this between runs. */
+      resetBaselineMemo() {
+        this.baselineEstablished.clear();
+      }
+      evaluatePair(key, snap, now) {
+        const currentWindow = snap.windows[0];
+        const baselineWindows = snap.windows.slice(1);
+        const populated = baselineWindows.filter((w) => w.count > 0).length;
+        if (populated < BASELINE_WINDOWS2) {
+          return null;
+        }
+        const counts = baselineWindows.map((w) => w.count);
+        const mean = counts.reduce((s, c) => s + c, 0) / counts.length;
+        const variance = counts.reduce((s, c) => s + (c - mean) ** 2, 0) / counts.length;
+        const stddev = Math.sqrt(variance);
+        const wasEstablished = this.baselineEstablished.has(key);
+        this.baselineEstablished.add(key);
+        if (!wasEstablished) {
+          const pair = pairFromKey(key);
+          return {
+            finding_id: "",
+            sentinel_id: this.sentinelId,
+            severity: "info",
+            summary: `cross-agent-chatter baseline established for ${pair.sender} -> ${pair.recipient}: mean ${mean.toFixed(1)} msgs/24h, stddev ${stddev.toFixed(1)} (over ${BASELINE_WINDOWS2} prior days).`,
+            details: {
+              sender_agent_id: pair.sender,
+              recipient_agent_id: pair.recipient,
+              baseline_mean: mean,
+              baseline_stddev: stddev,
+              baseline_windows: counts,
+              current_count: currentWindow.count
+            },
+            observed_at: now.toISOString(),
+            evidence_audit_ids: [],
+            fortress_id: ""
+          };
+        }
+        const warnThreshold = mean + WARN_SIGMA2 * stddev;
+        const alertThreshold = mean + ALERT_SIGMA2 * stddev;
+        if (currentWindow.count > alertThreshold) {
+          return this.buildRateSpike(key, snap, mean, stddev, now, "alert", ALERT_SIGMA2);
+        }
+        if (currentWindow.count > warnThreshold) {
+          return this.buildRateSpike(key, snap, mean, stddev, now, "warn", WARN_SIGMA2);
+        }
+        return null;
+      }
+      buildRateSpike(key, snap, mean, stddev, now, severity, sigma) {
+        const pair = pairFromKey(key);
+        const cur = snap.windows[0];
+        const ratio = mean === 0 ? Infinity : cur.count / mean;
+        const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+        const summary = `${pair.sender} -> ${pair.recipient} chatter rate is ${ratioStr}: ${cur.count} cross-agent messages in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma threshold.`;
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary,
+          details: {
+            sender_agent_id: pair.sender,
+            recipient_agent_id: pair.recipient,
+            current_count: cur.count,
+            baseline_mean: mean,
+            baseline_stddev: stddev,
+            sigma_threshold: sigma,
+            ratio
+          },
+          observed_at: now.toISOString(),
+          agent_id: pair.sender,
+          evidence_audit_ids: cur.evidence_audit_ids,
+          fortress_id: ""
+        };
+      }
+      buildNewPartnerFinding(source, info, now) {
+        if (info.partners.length === 0) return null;
+        const severity = info.partners.length >= MULTI_NEW_PARTNER_ALERT_THRESHOLD ? "alert" : "warn";
+        const partnerList = info.partners.join(", ");
+        const baselinePartnerList = info.priorPartners.length === 0 ? "no prior partners" : info.priorPartners.join(", ");
+        const summary = severity === "alert" ? `${source} began communicating with ${info.partners.length} new partners in 24h (${partnerList}). Prior partners: ${baselinePartnerList}. Multi-new-partner pattern crossed alert threshold (>=${MULTI_NEW_PARTNER_ALERT_THRESHOLD}).` : `${source} began communicating with a new partner today: ${partnerList}. Prior partners: ${baselinePartnerList}.`;
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary,
+          details: {
+            sender_agent_id: source,
+            new_partners: info.partners,
+            prior_partners: info.priorPartners,
+            new_partner_count: info.partners.length,
+            multi_new_partner_threshold: MULTI_NEW_PARTNER_ALERT_THRESHOLD
+          },
+          observed_at: now.toISOString(),
+          agent_id: source,
+          evidence_audit_ids: info.evidenceAuditIds,
+          fortress_id: ""
+        };
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinels/credential-usage-watcher.ts
+function isCredentialAuditEntry(entry) {
+  if (entry.result !== "success") return false;
+  return entry.operation === BROKER_SECRET_READ_OP || entry.operation === BROKER_TOKEN_ISSUED_OP;
+}
+function extractAgentId(entry) {
+  const details = entry.details;
+  if (!details) return null;
+  const agent = details["agent"];
+  return typeof agent === "string" && agent.length > 0 ? agent : null;
+}
+function extractSecretId(entry) {
+  const details = entry.details;
+  if (!details) return null;
+  const secret = details["secret"];
+  return typeof secret === "string" && secret.length > 0 ? secret : null;
+}
+function enumerateUnorderedPairs(secrets) {
+  const out = /* @__PURE__ */ new Set();
+  const arr = [...secrets].sort();
+  for (let i = 0; i < arr.length; i += 1) {
+    for (let j = i + 1; j < arr.length; j += 1) {
+      out.add(`${arr[i]}\0${arr[j]}`);
+    }
+  }
+  return out;
+}
+function buildNewPairSummary(agentId, newPairs) {
+  const first = newPairs[0];
+  if (newPairs.length === 1) {
+    return `${agentId} agent used ${first[0]} and ${first[1]} together for the first time today. This combination does not appear in historical sessions.`;
+  }
+  return `${agentId} agent introduced ${newPairs.length} unfamiliar credential pairs in the last 24h. First: ${first[0]} + ${first[1]}. This pattern is new for this agent.`;
+}
+var CREDENTIAL_USAGE_SENTINEL_ID, WARN_SIGMA3, ALERT_SIGMA3, NEW_PAIR_ALERT_COUNT, BASELINE_WINDOWS3, QUERY_LIMIT3, BROKER_SECRET_READ_OP, BROKER_TOKEN_ISSUED_OP, CredentialUsageWatcher;
+var init_credential_usage_watcher = __esm({
+  "src/sentinel/sentinels/credential-usage-watcher.ts"() {
+    init_sentinel();
+    CREDENTIAL_USAGE_SENTINEL_ID = "credential-usage";
+    WARN_SIGMA3 = 3;
+    ALERT_SIGMA3 = 6;
+    NEW_PAIR_ALERT_COUNT = 3;
+    BASELINE_WINDOWS3 = 7;
+    QUERY_LIMIT3 = 2e4;
+    BROKER_SECRET_READ_OP = "broker_secret_read";
+    BROKER_TOKEN_ISSUED_OP = "broker_token_issued";
+    CredentialUsageWatcher = class extends Sentinel {
+      sentinelId = CREDENTIAL_USAGE_SENTINEL_ID;
+      description = "Watches per-agent credential reads. Emits warn/alert when a specific (agent, secret) usage rate exceeds the rolling 7-day baseline, or when an agent uses an unfamiliar combination of secrets together in one 24h window.";
+      /**
+       * Memoization of (agent, secret) pairs whose baseline has been
+       * established. Same shape Phi-1 uses to avoid re-emitting `info`
+       * findings on every tick after a baseline first establishes.
+       *
+       * Phi-2 deliberately does NOT emit `info` findings: per-pair
+       * baselines on a busy fortress would be too noisy. The memo is
+       * kept here for parity with Phi-1's reset hook so tests can clear
+       * state between runs.
+       */
+      baselineEstablished = /* @__PURE__ */ new Set();
+      /** Reset memoization. Tests use this between runs. */
+      resetBaselineMemo() {
+        this.baselineEstablished.clear();
+      }
+      async evaluate() {
+        const ctx = this.requireContext();
+        const now = ctx.now();
+        const windowMs = 24 * 60 * 60 * 1e3;
+        const windowSpanMs = (BASELINE_WINDOWS3 + 1) * windowMs;
+        const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+        const queryResult = await ctx.auditLog.query({
+          since: sinceIso,
+          layer: "l3",
+          limit: QUERY_LIMIT3
+        });
+        const entries = queryResult.entries.filter(isCredentialAuditEntry);
+        const byPair = /* @__PURE__ */ new Map();
+        const byAgent = /* @__PURE__ */ new Map();
+        for (const entry of entries) {
+          const agentId = extractAgentId(entry);
+          const secretId = extractSecretId(entry);
+          if (agentId === null || secretId === null) continue;
+          const auditAge = now.getTime() - new Date(entry.timestamp).getTime();
+          if (auditAge < 0) continue;
+          const windowIdx = Math.floor(auditAge / windowMs);
+          if (windowIdx > BASELINE_WINDOWS3) continue;
+          const pairKey2 = `${agentId}\0${secretId}`;
+          let pairSnapshot = byPair.get(pairKey2);
+          if (!pairSnapshot) {
+            pairSnapshot = {
+              windows: Array.from({ length: BASELINE_WINDOWS3 + 1 }, () => ({
+                count: 0,
+                evidence_audit_ids: []
+              }))
+            };
+            byPair.set(pairKey2, pairSnapshot);
+          }
+          const bucket = pairSnapshot.windows[windowIdx];
+          bucket.count += 1;
+          if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+            bucket.evidence_audit_ids.push(
+              `${entry.timestamp}:${entry.operation}`
+            );
+          }
+          let agentState = byAgent.get(agentId);
+          if (!agentState) {
+            agentState = {
+              currentSecrets: /* @__PURE__ */ new Set(),
+              currentEvidence: [],
+              baselineSecretsByWindow: Array.from(
+                { length: BASELINE_WINDOWS3 },
+                () => /* @__PURE__ */ new Set()
+              ),
+              baselinePopulatedWindows: 0
+            };
+            byAgent.set(agentId, agentState);
+          }
+          if (windowIdx === 0) {
+            agentState.currentSecrets.add(secretId);
+            if (agentState.currentEvidence.length < 50) {
+              agentState.currentEvidence.push(
+                `${entry.timestamp}:${entry.operation}`
+              );
+            }
+          } else {
+            const baselineIdx = windowIdx - 1;
+            agentState.baselineSecretsByWindow[baselineIdx].add(secretId);
+          }
+        }
+        const findings = [];
+        for (const [pairKey2, snapshot] of byPair.entries()) {
+          const [agentId, secretId] = pairKey2.split("\0");
+          const finding = this.evaluateRateSpike(
+            agentId,
+            secretId,
+            snapshot,
+            now
+          );
+          if (finding) findings.push(finding);
+        }
+        for (const [agentId, agentState] of byAgent.entries()) {
+          agentState.baselinePopulatedWindows = agentState.baselineSecretsByWindow.filter((s) => s.size > 0).length;
+          const finding = this.evaluateNewPairs(agentId, agentState, now);
+          if (finding) findings.push(finding);
+        }
+        return findings;
+      }
+      evaluateRateSpike(agentId, secretId, snapshot, now) {
+        const currentWindow = snapshot.windows[0];
+        const baselineWindows = snapshot.windows.slice(1);
+        const populated = baselineWindows.filter((w) => w.count > 0).length;
+        if (populated < BASELINE_WINDOWS3) {
+          return null;
+        }
+        const counts = baselineWindows.map((w) => w.count);
+        const mean = counts.reduce((sum, c) => sum + c, 0) / counts.length;
+        const variance = counts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / counts.length;
+        const stddev = Math.sqrt(variance);
+        const pairKey2 = `${agentId}\0${secretId}`;
+        this.baselineEstablished.add(pairKey2);
+        const warnThreshold = mean + WARN_SIGMA3 * stddev;
+        const alertThreshold = mean + ALERT_SIGMA3 * stddev;
+        if (currentWindow.count > alertThreshold) {
+          return this.buildRateFinding(
+            agentId,
+            secretId,
+            currentWindow,
+            mean,
+            stddev,
+            now,
+            "alert",
+            ALERT_SIGMA3
+          );
+        }
+        if (currentWindow.count > warnThreshold) {
+          return this.buildRateFinding(
+            agentId,
+            secretId,
+            currentWindow,
+            mean,
+            stddev,
+            now,
+            "warn",
+            WARN_SIGMA3
+          );
+        }
+        return null;
+      }
+      buildRateFinding(agentId, secretId, currentWindow, mean, stddev, now, severity, sigma) {
+        const ratio = mean === 0 ? Number.POSITIVE_INFINITY : currentWindow.count / mean;
+        const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+        const summary = `${agentId} agent used ${secretId} ${currentWindow.count} times in last 24h, baseline ${mean.toFixed(1)} +/- ${stddev.toFixed(1)} (${ratioStr}). Crossed +${sigma} sigma threshold.`;
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          agent_id: agentId,
+          summary,
+          details: {
+            agent_id: agentId,
+            secret_id: secretId,
+            current_count: currentWindow.count,
+            baseline_mean: mean,
+            baseline_stddev: stddev,
+            sigma_threshold: sigma,
+            ratio: Number.isFinite(ratio) ? ratio : null
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: currentWindow.evidence_audit_ids,
+          fortress_id: ""
+        };
+      }
+      evaluateNewPairs(agentId, state, now) {
+        if (state.baselinePopulatedWindows < BASELINE_WINDOWS3) {
+          return null;
+        }
+        if (state.currentSecrets.size < 2) return null;
+        const currentPairs = enumerateUnorderedPairs(state.currentSecrets);
+        const historicalPairs = /* @__PURE__ */ new Set();
+        for (const secretSet of state.baselineSecretsByWindow) {
+          for (const pair of enumerateUnorderedPairs(secretSet)) {
+            historicalPairs.add(pair);
+          }
+        }
+        const newPairs = [];
+        for (const pair of currentPairs) {
+          if (historicalPairs.has(pair)) continue;
+          const [a, b] = pair.split("\0");
+          newPairs.push([a, b]);
+        }
+        if (newPairs.length === 0) return null;
+        const severity = newPairs.length >= NEW_PAIR_ALERT_COUNT ? "alert" : "warn";
+        const summary = buildNewPairSummary(agentId, newPairs);
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          agent_id: agentId,
+          summary,
+          details: {
+            agent_id: agentId,
+            new_pairs: newPairs,
+            new_pair_count: newPairs.length,
+            historical_pair_count: historicalPairs.size,
+            current_pair_count: currentPairs.size
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: state.currentEvidence,
+          fortress_id: ""
+        };
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinels/suspicious-tool-call-detector.ts
+function countTruncatedValues(args) {
+  let n = 0;
+  for (const v of Object.values(args)) {
+    if (typeof v === "string" && v.endsWith("...")) n += 1;
+  }
+  return n;
+}
+function countUrlEncoded(value) {
+  const matches = value.match(/%[0-9a-fA-F]{2}/g);
+  return matches ? matches.length : 0;
+}
+function longestBase64Run(value) {
+  const matches = value.match(/[A-Za-z0-9+/=]{40,}/g);
+  if (!matches) return 0;
+  return matches.reduce((max, m) => m.length > max ? m.length : max, 0);
+}
+function extractArgsSummary(details) {
+  if (!details) return {};
+  const summary = details["args_summary"];
+  if (summary && typeof summary === "object" && !Array.isArray(summary)) {
+    return summary;
+  }
+  return {};
+}
+function truncateSummary2(s) {
+  return s.length > 240 ? s.slice(0, 237) + "..." : s;
+}
+var SUSPICIOUS_TOOL_CALL_SENTINEL_ID, GATE_PREFIXES, WARN_SIGMA4, ALERT_SIGMA4, BASELINE_WINDOWS4, ALERT_NOVEL_COMBINATIONS, TASK_WINDOW_MS, TRUNCATION_WARN_THRESHOLD, QUERY_LIMIT4, SIGNATURE_PATTERNS, SuspiciousToolCallDetector;
+var init_suspicious_tool_call_detector = __esm({
+  "src/sentinel/sentinels/suspicious-tool-call-detector.ts"() {
+    init_sentinel();
+    SUSPICIOUS_TOOL_CALL_SENTINEL_ID = "suspicious-tool-call";
+    GATE_PREFIXES = [
+      "gate_allow:",
+      "gate_allow_proxy:",
+      "gate_deny:",
+      "gate_unclassified:"
+    ];
+    WARN_SIGMA4 = 3;
+    ALERT_SIGMA4 = 6;
+    BASELINE_WINDOWS4 = 7;
+    ALERT_NOVEL_COMBINATIONS = 2;
+    TASK_WINDOW_MS = 60 * 60 * 1e3;
+    TRUNCATION_WARN_THRESHOLD = 5;
+    QUERY_LIMIT4 = 1e4;
+    SIGNATURE_PATTERNS = {
+      /** >=5 percent-encoded sequences in a single visible value. */
+      urlEncodedThreshold: 5,
+      /** >=40 contiguous base64 chars in a single visible value. */
+      base64MinRun: 40,
+      /** Shell metacharacter set. */
+      shellMetacharRegex: /(?:&&|\|\||;|\$\(|`|\|\s)/
+    };
+    SuspiciousToolCallDetector = class extends Sentinel {
+      sentinelId = SUSPICIOUS_TOOL_CALL_SENTINEL_ID;
+      description = "Surfaces tool calls whose argument shape, call frequency, or permission combination looks unusual for the fortress's recent history. Rule-based heuristics with optional LLM-assist on ambiguous matches.";
+      /** Servers we have already produced an `info` baseline-established finding for. */
+      baselineEstablished = /* @__PURE__ */ new Set();
+      /** Memoized known novel-combination keys (sorted-tools-csv). */
+      knownCombinations = /* @__PURE__ */ new Set();
+      /** Tasks observed where a novel combination already produced a finding. */
+      novelCombinationsReported = /* @__PURE__ */ new Set();
+      async evaluate() {
+        const ctx = this.requireContext();
+        const now = ctx.now();
+        const dayMs = 24 * 60 * 60 * 1e3;
+        const windowSpanMs = (BASELINE_WINDOWS4 + 1) * dayMs;
+        const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+        const queryResult = await ctx.auditLog.query({
+          since: sinceIso,
+          layer: "l2",
+          limit: QUERY_LIMIT4
+        });
+        const observations = [];
+        for (const entry of queryResult.entries) {
+          const obs = this.observationFromEntry(entry);
+          if (obs && obs.ts <= now.getTime()) observations.push(obs);
+        }
+        if (observations.length === 0) return [];
+        const findings = [];
+        const layerAFindings = await this.runLayerA(observations, now, ctx);
+        findings.push(...layerAFindings);
+        const layerBFindings = this.runLayerB(observations, now);
+        findings.push(...layerBFindings);
+        const layerCFindings = this.runLayerC(observations, now);
+        findings.push(...layerCFindings);
+        return findings;
+      }
+      /** Reset memoization between test runs. Mirrors Phi-1's reset hook. */
+      resetMemo() {
+        this.baselineEstablished.clear();
+        this.knownCombinations.clear();
+        this.novelCombinationsReported.clear();
+      }
+      // ── Layer A ───────────────────────────────────────────────────────
+      async runLayerA(observations, now, ctx) {
+        const dayMs = 24 * 60 * 60 * 1e3;
+        const recent = observations.filter(
+          (o) => now.getTime() - o.ts <= dayMs
+        );
+        if (recent.length === 0) return [];
+        const findings = [];
+        const historical = observations.filter(
+          (o) => now.getTime() - o.ts > dayMs
+        );
+        const perTool = /* @__PURE__ */ new Map();
+        const ensureTool = (tool) => {
+          let w = perTool.get(tool);
+          if (!w) {
+            w = {
+              windows: Array.from({ length: BASELINE_WINDOWS4 + 1 }, () => ({
+                count: 0,
+                evidenceIds: []
+              })),
+              knownSignatures: /* @__PURE__ */ new Set()
+            };
+            perTool.set(tool, w);
+          }
+          return w;
+        };
+        for (const o of historical) {
+          ensureTool(o.tool).knownSignatures.add(this.signatureOf(o.argsSummary));
+        }
+        const classify = this.classifyHandle(ctx);
+        for (const obs of recent) {
+          const matches = this.matchSignatures(obs);
+          if (matches.length === 0) continue;
+          const ambiguous = matches.every((m) => m === "base64_chunk");
+          if (ambiguous && classify) {
+            const verdict = await this.consultClassifier(classify, obs);
+            if (verdict !== "suspicious") continue;
+          }
+          findings.push(
+            this.buildLayerAFinding(obs, matches, now, classify ? "llm-assist" : "rule-based")
+          );
+        }
+        for (const obs of recent) {
+          const tool = obs.tool;
+          const sig = this.signatureOf(obs.argsSummary);
+          const known = perTool.get(tool)?.knownSignatures;
+          if (known && known.size > 0 && !known.has(sig)) {
+            findings.push(
+              this.buildNovelSignatureFinding(obs, sig, now)
+            );
+          }
+        }
+        return findings;
+      }
+      matchSignatures(obs) {
+        const out = [];
+        const truncCount = countTruncatedValues(obs.argsSummary);
+        if (truncCount >= TRUNCATION_WARN_THRESHOLD) out.push("truncation_burst");
+        let urlBlob = false;
+        let base64Blob = false;
+        let shellChars = false;
+        for (const value of Object.values(obs.argsSummary)) {
+          if (typeof value !== "string") continue;
+          if (countUrlEncoded(value) >= SIGNATURE_PATTERNS.urlEncodedThreshold) {
+            urlBlob = true;
+          }
+          if (longestBase64Run(value) >= SIGNATURE_PATTERNS.base64MinRun) {
+            base64Blob = true;
+          }
+          if (SIGNATURE_PATTERNS.shellMetacharRegex.test(value)) {
+            shellChars = true;
+          }
+        }
+        if (urlBlob) out.push("url_encoded_blob");
+        if (base64Blob) out.push("base64_chunk");
+        if (shellChars) out.push("shell_metachar");
+        return out;
+      }
+      signatureOf(argsSummary) {
+        return Object.keys(argsSummary).sort().join(",");
+      }
+      buildLayerAFinding(obs, matches, now, detectionPath) {
+        const severity = matches.includes("shell_metachar") ? "alert" : "warn";
+        const summary = `${obs.tool}: tool-call argument matches signature ${matches.join(", ")} (${detectionPath}).`;
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary: truncateSummary2(summary),
+          details: {
+            layer: "A",
+            tool: obs.tool,
+            proxy: obs.proxy,
+            signatures: matches,
+            detection_path: detectionPath
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: [`${obs.entry.timestamp}:${obs.entry.operation}`],
+          fortress_id: ""
+        };
+      }
+      buildNovelSignatureFinding(obs, signature, now) {
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity: "warn",
+          summary: truncateSummary2(
+            `${obs.tool}: novel argument-key signature observed (${signature || "<no-args>"}).`
+          ),
+          details: {
+            layer: "A",
+            tool: obs.tool,
+            proxy: obs.proxy,
+            signatures: ["novel_signature"],
+            detection_path: "rule-based",
+            novel_signature: signature
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: [`${obs.entry.timestamp}:${obs.entry.operation}`],
+          fortress_id: ""
+        };
+      }
+      // ── Layer B ───────────────────────────────────────────────────────
+      runLayerB(observations, now) {
+        const dayMs = 24 * 60 * 60 * 1e3;
+        const perTool = /* @__PURE__ */ new Map();
+        for (const obs of observations) {
+          const ageMs = now.getTime() - obs.ts;
+          if (ageMs < 0) continue;
+          const windowIdx = Math.floor(ageMs / dayMs);
+          if (windowIdx > BASELINE_WINDOWS4) continue;
+          let w = perTool.get(obs.tool);
+          if (!w) {
+            w = {
+              windows: Array.from({ length: BASELINE_WINDOWS4 + 1 }, () => ({
+                count: 0,
+                evidenceIds: []
+              })),
+              knownSignatures: /* @__PURE__ */ new Set()
+            };
+            perTool.set(obs.tool, w);
+          }
+          const bucket = w.windows[windowIdx];
+          bucket.count += 1;
+          if (windowIdx === 0 && bucket.evidenceIds.length < 50) {
+            bucket.evidenceIds.push(`${obs.entry.timestamp}:${obs.entry.operation}`);
+          }
+        }
+        const findings = [];
+        for (const [tool, w] of perTool.entries()) {
+          const f = this.evaluateToolFrequency(tool, w, now);
+          if (f) findings.push(f);
+        }
+        return findings;
+      }
+      evaluateToolFrequency(tool, w, now) {
+        const current = w.windows[0];
+        const baseline = w.windows.slice(1);
+        const populated = baseline.filter((b) => b.count > 0).length;
+        if (populated < BASELINE_WINDOWS4) {
+          this.baselineEstablished.add(tool);
+          return null;
+        }
+        const counts = baseline.map((b) => b.count);
+        const mean = counts.reduce((sum, c) => sum + c, 0) / counts.length;
+        const variance = counts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / counts.length;
+        const stddev = Math.sqrt(variance);
+        const wasEstablished = this.baselineEstablished.has(tool);
+        this.baselineEstablished.add(tool);
+        if (!wasEstablished) {
+          return {
+            finding_id: "",
+            sentinel_id: this.sentinelId,
+            severity: "info",
+            summary: truncateSummary2(
+              `${tool}: tool-call baseline established (mean ${mean.toFixed(1)} calls/24h, stddev ${stddev.toFixed(1)} over ${BASELINE_WINDOWS4} prior days).`
+            ),
+            details: {
+              layer: "B",
+              tool,
+              baseline_mean: mean,
+              baseline_stddev: stddev,
+              baseline_counts: counts,
+              current_count: current.count
+            },
+            observed_at: now.toISOString(),
+            evidence_audit_ids: [],
+            fortress_id: ""
+          };
+        }
+        const warnT = mean + WARN_SIGMA4 * stddev;
+        const alertT = mean + ALERT_SIGMA4 * stddev;
+        if (current.count > alertT) {
+          return this.buildLayerBAnomaly(
+            tool,
+            current,
+            mean,
+            stddev,
+            ALERT_SIGMA4,
+            "alert",
+            now
+          );
+        }
+        if (current.count > warnT) {
+          return this.buildLayerBAnomaly(
+            tool,
+            current,
+            mean,
+            stddev,
+            WARN_SIGMA4,
+            "warn",
+            now
+          );
+        }
+        return null;
+      }
+      buildLayerBAnomaly(tool, current, mean, stddev, sigma, severity, now) {
+        const ratio = mean === 0 ? Infinity : current.count / mean;
+        const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary: truncateSummary2(
+            `${tool}: tool-call rate is ${ratioStr}: ${current.count} calls in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma.`
+          ),
+          details: {
+            layer: "B",
+            tool,
+            current_count: current.count,
+            baseline_mean: mean,
+            baseline_stddev: stddev,
+            sigma_threshold: sigma,
+            ratio
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: current.evidenceIds,
+          fortress_id: ""
+        };
+      }
+      // ── Layer C ───────────────────────────────────────────────────────
+      runLayerC(observations, now) {
+        const dayMs = 24 * 60 * 60 * 1e3;
+        const sorted = [...observations].sort((a, b) => a.ts - b.ts);
+        const tasks = [];
+        for (const obs of sorted) {
+          const last = tasks[tasks.length - 1];
+          if (!last || obs.ts - last.startTs > TASK_WINDOW_MS) {
+            tasks.push({ startTs: obs.ts, tools: [obs.tool] });
+            continue;
+          }
+          if (!last.tools.includes(obs.tool)) last.tools.push(obs.tool);
+        }
+        const recentTaskKeys = [];
+        const findings = [];
+        for (const task of tasks) {
+          const ageMs = now.getTime() - task.startTs;
+          const key = task.tools.slice().sort().join(",");
+          if (ageMs > dayMs) {
+            this.knownCombinations.add(key);
+            continue;
+          }
+          if (task.tools.length < 2) continue;
+          if (!this.knownCombinations.has(key)) {
+            this.knownCombinations.add(key);
+            if (!this.novelCombinationsReported.has(key)) {
+              this.novelCombinationsReported.add(key);
+              recentTaskKeys.push(key);
+              findings.push(
+                this.buildLayerCFinding(task, key, "warn", now)
+              );
+            }
+          }
+        }
+        if (recentTaskKeys.length >= ALERT_NOVEL_COMBINATIONS) {
+          const aggregate = {
+            finding_id: "",
+            sentinel_id: this.sentinelId,
+            severity: "alert",
+            summary: truncateSummary2(
+              `multi-novel-combination: ${recentTaskKeys.length} novel tool-permission combinations within last 24h.`
+            ),
+            details: {
+              layer: "C",
+              novel_combinations: recentTaskKeys
+            },
+            observed_at: now.toISOString(),
+            evidence_audit_ids: [],
+            fortress_id: ""
+          };
+          findings.push(aggregate);
+        }
+        return findings;
+      }
+      buildLayerCFinding(task, key, severity, now) {
+        return {
+          finding_id: "",
+          sentinel_id: this.sentinelId,
+          severity,
+          summary: truncateSummary2(
+            `novel-permission-combination: tools=[${task.tools.join(",")}] observed in single task burst (${task.tools.length} distinct tools).`
+          ),
+          details: {
+            layer: "C",
+            combination_key: key,
+            tools: task.tools,
+            task_started_at: new Date(task.startTs).toISOString()
+          },
+          observed_at: now.toISOString(),
+          evidence_audit_ids: [],
+          fortress_id: ""
+        };
+      }
+      // ── LLM-assist ────────────────────────────────────────────────────
+      classifyHandle(ctx) {
+        const selector = ctx.substrateSelector;
+        if (!selector) return null;
+        const fn = selector.invokeClassify;
+        if (typeof fn !== "function") return null;
+        return async (items) => {
+          try {
+            const resp = await fn.call(selector, "sentinel-scoring", {
+              kind: "classify",
+              items,
+              categories: ["benign", "suspicious"]
+            });
+            if (resp.failureClass) return { kind: "failure", message: "substrate failure" };
+            if (resp.body.kind === "classify") {
+              return { kind: "classify", results: resp.body.results };
+            }
+            return { kind: "failure", message: resp.body.message };
+          } catch {
+            return null;
+          }
+        };
+      }
+      async consultClassifier(classify, obs) {
+        const item = JSON.stringify({
+          tool: obs.tool,
+          proxy: obs.proxy,
+          args_summary: obs.argsSummary
+        });
+        const result = await classify([item]);
+        if (!result || result.kind !== "classify") return "unknown";
+        const top = result.results[0];
+        if (!top) return "unknown";
+        if (top.category === "suspicious" && top.confidence >= 0.5) {
+          return "suspicious";
+        }
+        if (top.category === "benign") return "benign";
+        return "unknown";
+      }
+      // ── helpers ───────────────────────────────────────────────────────
+      observationFromEntry(entry) {
+        const op = entry.operation;
+        let tool = null;
+        let proxy = false;
+        for (const prefix of GATE_PREFIXES) {
+          if (op.startsWith(prefix)) {
+            tool = op.slice(prefix.length);
+            proxy = prefix === "gate_allow_proxy:";
+            break;
+          }
+        }
+        if (!tool) return null;
+        const ts = Date.parse(entry.timestamp);
+        if (!Number.isFinite(ts)) return null;
+        const argsSummary = extractArgsSummary(entry.details);
+        return { tool, proxy, ts, entry, argsSummary };
+      }
+    };
+  }
+});
+
+// src/sentinel/sentinels/index.ts
+var PHI1_BASELINE_CATALOG;
+var init_sentinels = __esm({
+  "src/sentinel/sentinels/index.ts"() {
+    init_egress_volume_watcher();
+    init_cross_agent_chatter_watcher();
+    init_credential_usage_watcher();
+    init_suspicious_tool_call_detector();
+    PHI1_BASELINE_CATALOG = [
+      {
+        sentinelId: EGRESS_VOLUME_SENTINEL_ID,
+        description: "Watches outbound proxy-call volume per upstream server and surfaces anomalous spikes against a rolling 7-day baseline.",
+        factory: () => new EgressVolumeWatcher()
+      },
+      {
+        sentinelId: CROSS_AGENT_CHATTER_SENTINEL_ID,
+        description: "Watches inter-agent communication patterns. Surfaces per-pair rate spikes (3 or 6 sigma over the rolling 7-day baseline) and new-partner appearances. Escalates to alert when one source agent picks up 3 or more new partners in 24h.",
+        factory: () => new CrossAgentChatterWatcher()
+      },
+      {
+        sentinelId: CREDENTIAL_USAGE_SENTINEL_ID,
+        description: "Watches per-agent credential reads. Surfaces (agent, secret) usage that exceeds a rolling 7-day baseline, and unfamiliar secret combinations the agent uses for the first time in one 24h window.",
+        factory: () => new CredentialUsageWatcher()
+      },
+      {
+        sentinelId: SUSPICIOUS_TOOL_CALL_SENTINEL_ID,
+        description: "Surfaces tool calls whose argument shape, call frequency, or permission combination looks unusual for the fortress's recent history.",
+        factory: () => new SuspiciousToolCallDetector()
+      }
+    ];
+  }
+});
+function sentinelSubscriptionsPath(storagePath) {
+  return join(storagePath, "sentinel-subscriptions.json");
+}
+async function loadSentinelSubscriptions(storagePath) {
+  const filePath = sentinelSubscriptionsPath(storagePath);
+  try {
+    const raw = await readFile(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== FILE_VERSION) return /* @__PURE__ */ new Set();
+    if (!Array.isArray(parsed.subscribed)) return /* @__PURE__ */ new Set();
+    const cleaned = parsed.subscribed.filter(
+      (id) => typeof id === "string" && id.length > 0
+    );
+    return new Set(cleaned);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function saveSentinelSubscriptions(storagePath, subscribed) {
+  const filePath = sentinelSubscriptionsPath(storagePath);
+  await mkdir(dirname(filePath), { recursive: true });
+  const payload = {
+    version: FILE_VERSION,
+    subscribed: [...new Set(subscribed)].filter((s) => s.length > 0).sort()
+  };
+  await writeFile(filePath, `${JSON.stringify(payload, null, 2)}
+`, {
+    mode: 384
+  });
+}
+var FILE_VERSION;
+var init_subscription_store = __esm({
+  "src/sentinel/subscription-store.ts"() {
+    FILE_VERSION = 1;
+  }
+});
+
 // src/principal-policy/tools.ts
 function createPrincipalPolicyTools(policy, baseline, auditLog) {
   return [
@@ -32608,7 +34643,7 @@ var init_recovery_key_disclosure = __esm({
 });
 
 // src/hub/types.ts
-var init_types3 = __esm({
+var init_types4 = __esm({
   "src/hub/types.ts"() {
   }
 });
@@ -33647,7 +35682,7 @@ var init_hub = __esm({
   "src/hub/index.ts"() {
     init_constants3();
     init_errors4();
-    init_types3();
+    init_types4();
     init_agent_registry();
     init_inbox_store();
     init_inbox_aggregator();
@@ -33756,7 +35791,17 @@ var init_operator_chat_audit_events = __esm({
        * fold. The concierge omits that category and continues; the user-
        * facing query is never broken. Body carries category + failure_reason.
        */
-      CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed"
+      CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed",
+      /**
+       * Concierge surfaced a proactive starter when a fresh conversation
+       * thread opened (WP-V1.3-9 Tau-5). Emitted once per starter, never on
+       * follow-up turns within the same thread. Body carries `thread_id`,
+       * `trigger` (stable enum), and `triggered_agents_count`. The starter
+       * text body is NOT carried; the trigger enum is sufficient for
+       * dashboard grouping and keeps fortress-internal agent ids off the
+       * audit surface.
+       */
+      CONCIERGE_PROACTIVE_SUGGESTION_OFFERED: "operator_concierge_proactive_suggestion_offered"
     };
   }
 });
@@ -33789,9 +35834,10 @@ function isTrivialQuery(query) {
   if (norm.length < 8) return true;
   return TRIVIAL_GREETINGS.has(norm);
 }
-function classifyQuery(query) {
+function classifyQuery(query, parsedGrammar) {
   const normalized = query.toLowerCase();
   const matches = [];
+  const grammarAgent = parsedGrammar && parsedGrammar.agent_names.length > 0 ? parsedGrammar.agent_names[0] ?? null : null;
   for (const spec of CATEGORY_KEYWORDS) {
     const matchedPhrases = [];
     for (const pattern of spec.patterns) {
@@ -33803,11 +35849,14 @@ function classifyQuery(query) {
     }
     if (matchedPhrases.length === 0) continue;
     const confidence = Math.min(1, 0.4 + 0.3 * matchedPhrases.length);
+    const wantsAgentHint = spec.category === "agent_state" || spec.category === "agent_activity";
+    const agent_name_hint = wantsAgentHint ? grammarAgent ?? extractAgentNameHint(query) : null;
     matches.push({
       category: spec.category,
       confidence,
       matched_keywords: matchedPhrases,
-      agent_name_hint: spec.category === "agent_state" || spec.category === "agent_activity" ? extractAgentNameHint(query) : null
+      agent_name_hint,
+      ...parsedGrammar !== void 0 ? { query_grammar: parsedGrammar } : {}
     });
   }
   matches.sort((a, b) => {
@@ -33816,45 +35865,67 @@ function classifyQuery(query) {
   });
   return matches;
 }
+function fetcherHintsFromGrammar(parsed) {
+  if (!parsed) return void 0;
+  const hasTime = parsed.time_range !== null;
+  const hasAgents = parsed.agent_names.length > 0;
+  const hasEvents = parsed.event_types.length > 0;
+  if (!hasTime && !hasAgents && !hasEvents) return void 0;
+  const hints = {};
+  if (parsed.time_range) {
+    const range = parsed.time_range;
+    hints.time_range = {
+      start: range.start,
+      end: range.end,
+      ...range.relative_label !== void 0 ? { relative_label: range.relative_label } : {}
+    };
+  }
+  if (hasAgents) hints.agent_names = parsed.agent_names;
+  if (hasEvents) hints.event_types = parsed.event_types;
+  return hints;
+}
 function approxTokenLen(text) {
   return Math.ceil(text.length / APPROX_CHARS_PER_TOKEN);
 }
-async function runFetcher(match, fetchers) {
+async function runFetcher(match, fetchers, hints) {
   switch (match.category) {
     case "templates":
-      return fetchers.templates();
+      return fetchers.templates(hints);
     case "agent_state":
-      return fetchers.agent_state(match.agent_name_hint);
+      return fetchers.agent_state(match.agent_name_hint, hints);
     case "agent_activity":
-      return fetchers.agent_activity(match.agent_name_hint);
+      return fetchers.agent_activity(match.agent_name_hint, hints);
     case "audit_log":
-      return fetchers.audit_log();
+      return fetchers.audit_log(hints);
     case "sentinel_findings":
-      return fetchers.sentinel_findings();
+      return fetchers.sentinel_findings(hints);
     case "anomaly_alerts":
-      return fetchers.anomaly_alerts();
+      return fetchers.anomaly_alerts(hints);
     case "recent_receipts":
-      return fetchers.recent_receipts();
+      return fetchers.recent_receipts(hints);
     case "verascore_deltas":
-      return fetchers.verascore_deltas();
+      return fetchers.verascore_deltas(hints);
   }
 }
-function trivialMatch(category) {
+function trivialMatch(category, parsedGrammar) {
   return {
     category,
     confidence: 0.5,
     matched_keywords: ["llm-assist"],
-    agent_name_hint: null
+    agent_name_hint: parsedGrammar && parsedGrammar.agent_names.length > 0 ? parsedGrammar.agent_names[0] ?? null : null,
+    ...parsedGrammar !== void 0 ? { query_grammar: parsedGrammar } : {}
   };
 }
 async function foldContext(query, fetchers, opts) {
   const budget = opts?.maxTokens ?? DEFAULT_DYNAMIC_CONTEXT_TOKEN_BUDGET;
-  let matches = classifyQuery(query);
+  const parsed = opts?.parsed ?? null;
+  const hints = fetcherHintsFromGrammar(parsed);
+  let matches = classifyQuery(query, parsed);
   if (matches.length === 0 && !isTrivialQuery(query) && opts?.llmAssistClassify) {
     try {
       const picked = await opts.llmAssistClassify(query, CONTEXT_CATEGORIES);
       if (picked !== "none" && CONTEXT_CATEGORIES.includes(picked)) {
-        matches = [trivialMatch(picked)];
+        matches = [trivialMatch(picked, parsed)];
       }
     } catch {
     }
@@ -33865,7 +35936,7 @@ async function foldContext(query, fetchers, opts) {
   const attempts = [];
   for (const match of matches) {
     try {
-      const text = await runFetcher(match, fetchers);
+      const text = await runFetcher(match, fetchers, hints);
       const trimmed = text.trim();
       if (trimmed.length > 0) {
         attempts.push({ category: match.category, text: trimmed });
@@ -34037,9 +36108,635 @@ var init_concierge_context_router = __esm({
     };
   }
 });
+
+// src/composition/constants.ts
+var COMPOSITION_EVENT_TYPES;
+var init_constants4 = __esm({
+  "src/composition/constants.ts"() {
+    init_constants();
+    COMPOSITION_EVENT_TYPES = [
+      "composition_receipt_packed",
+      "composition_receipt_verified",
+      "composition_mandate_verified",
+      "composition_verascore_published",
+      "composition_sidecar_spawned",
+      "composition_sidecar_crashed",
+      "composition_sidecar_recovered",
+      "composition_degraded",
+      "composition_recovered"
+    ];
+  }
+});
+
+// src/chat/concierge-query-grammar.ts
+function resolveTimeRange(query, now) {
+  const normalized = query.trim();
+  const lower = normalized.toLowerCase();
+  const fromTo = lower.match(
+    /\b(?:from|between)\s+(.+?)\s+(?:to|and|-|until)\s+([\w:.\-+t /]+)/i
+  );
+  if (fromTo) {
+    const aSlice = fromTo[1];
+    const bSlice = fromTo[2];
+    if (aSlice !== void 0 && bSlice !== void 0) {
+      const a = parseInstant(aSlice, now);
+      const b = parseInstant(bSlice, now);
+      if (a && b) {
+        const start = a.getTime() <= b.getTime() ? a : b;
+        const end = a.getTime() <= b.getTime() ? b : a;
+        return {
+          range: { start, end },
+          matchedSubstring: fromTo[0]
+        };
+      }
+    }
+  }
+  const sinceMatch = lower.match(/\bsince\s+([\w:.\-+t /]+)/i);
+  if (sinceMatch) {
+    const slice = sinceMatch[1];
+    if (slice !== void 0) {
+      const start = parseInstant(slice, now);
+      if (start) {
+        return {
+          range: { start, end: now },
+          matchedSubstring: sinceMatch[0]
+        };
+      }
+    }
+  }
+  if (/\byesterday\b/.test(lower)) {
+    const startOfToday = startOfDay(now);
+    const start = new Date(startOfToday.getTime() - MS_PER_DAY);
+    const end = new Date(startOfToday.getTime() - 1);
+    return {
+      range: { start, end, relative_label: "yesterday" },
+      matchedSubstring: "yesterday"
+    };
+  }
+  if (/\btoday\b/.test(lower)) {
+    return {
+      range: {
+        start: startOfDay(now),
+        end: now,
+        relative_label: "today"
+      },
+      matchedSubstring: "today"
+    };
+  }
+  const compactHours = lower.match(/\blast\s+(\d+)\s*h\b/i);
+  if (compactHours) {
+    const tok = compactHours[1];
+    if (tok !== void 0) {
+      const n = Number.parseInt(tok, 10);
+      if (Number.isFinite(n) && n > 0) {
+        const start = new Date(now.getTime() - n * MS_PER_HOUR);
+        return {
+          range: { start, end: now, relative_label: `last ${n}h` },
+          matchedSubstring: compactHours[0]
+        };
+      }
+    }
+  }
+  const hoursMatch = lower.match(
+    /\b(?:past|last)\s+([\w]+|\d+)\s*(?:hr\b|hrs\b|hour|hours)/i
+  );
+  if (hoursMatch) {
+    const tok = hoursMatch[1];
+    if (tok !== void 0) {
+      const n = parseCount(tok);
+      if (n !== null && n > 0) {
+        const start = new Date(now.getTime() - n * MS_PER_HOUR);
+        return {
+          range: { start, end: now, relative_label: `past ${n} hour${n === 1 ? "" : "s"}` },
+          matchedSubstring: hoursMatch[0]
+        };
+      }
+    }
+  }
+  if (/\b(?:past|last)\s+hour\b/.test(lower)) {
+    const start = new Date(now.getTime() - MS_PER_HOUR);
+    return {
+      range: { start, end: now, relative_label: "past hour" },
+      matchedSubstring: lower.match(/\b(?:past|last)\s+hour\b/i)[0]
+    };
+  }
+  const daysMatch = lower.match(
+    /\b(?:past|last)\s+([\w]+|\d+)\s*(?:d\b|day|days)/i
+  );
+  if (daysMatch) {
+    const tok = daysMatch[1];
+    if (tok !== void 0) {
+      const n = parseCount(tok);
+      if (n !== null && n > 0) {
+        const start = new Date(now.getTime() - n * MS_PER_DAY);
+        return {
+          range: { start, end: now, relative_label: `past ${n} day${n === 1 ? "" : "s"}` },
+          matchedSubstring: daysMatch[0]
+        };
+      }
+    }
+  }
+  if (/\b(?:past|last)\s+day\b/.test(lower)) {
+    const start = new Date(now.getTime() - MS_PER_DAY);
+    return {
+      range: { start, end: now, relative_label: "past day" },
+      matchedSubstring: lower.match(/\b(?:past|last)\s+day\b/i)[0]
+    };
+  }
+  if (/\bthis\s+week\b/.test(lower)) {
+    const start = startOfWeek(now);
+    return {
+      range: { start, end: now, relative_label: "this week" },
+      matchedSubstring: lower.match(/\bthis\s+week\b/i)[0]
+    };
+  }
+  if (/\b(?:past|last)\s+week\b/.test(lower)) {
+    const start = new Date(now.getTime() - 7 * MS_PER_DAY);
+    return {
+      range: { start, end: now, relative_label: "past week" },
+      matchedSubstring: lower.match(/\b(?:past|last)\s+week\b/i)[0]
+    };
+  }
+  const isoMatch = normalized.match(
+    /\b(\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?(?:Z|[+-]\d{2}:\d{2})?)?)\b/
+  );
+  if (isoMatch) {
+    const tok = isoMatch[1];
+    if (tok !== void 0) {
+      const parsed = parseInstant(tok, now);
+      if (parsed) {
+        const isDateOnly = /^\d{4}-\d{2}-\d{2}$/.test(tok);
+        if (isDateOnly) {
+          return {
+            range: {
+              start: parsed,
+              end: new Date(parsed.getTime() + MS_PER_DAY - 1)
+            },
+            matchedSubstring: tok
+          };
+        }
+        return {
+          range: {
+            start: new Date(parsed.getTime() - 30 * 60 * 1e3),
+            end: new Date(parsed.getTime() + 30 * 60 * 1e3)
+          },
+          matchedSubstring: tok
+        };
+      }
+    }
+  }
+  return null;
+}
+function parseInstant(token, now) {
+  const trimmed = token.trim().replace(/[,.!?;]+$/g, "");
+  if (!trimmed) return null;
+  const lower = trimmed.toLowerCase();
+  if (lower === "now") return now;
+  if (lower === "today") return startOfDay(now);
+  if (lower === "yesterday") {
+    return new Date(startOfDay(now).getTime() - MS_PER_DAY);
+  }
+  const isoLike = trimmed.replace(" ", "T");
+  const parsed = new Date(isoLike);
+  if (!Number.isNaN(parsed.getTime())) return parsed;
+  return null;
+}
+function parseCount(token) {
+  const lower = token.toLowerCase();
+  if (/^\d+$/.test(lower)) {
+    const n = Number.parseInt(lower, 10);
+    return Number.isFinite(n) ? n : null;
+  }
+  return NUMBER_WORDS[lower] ?? null;
+}
+function startOfDay(d) {
+  const out = new Date(d);
+  out.setHours(0, 0, 0, 0);
+  return out;
+}
+function startOfWeek(d) {
+  const out = startOfDay(d);
+  const dayOfWeek = out.getDay();
+  const offsetToMonday = (dayOfWeek + 6) % 7;
+  out.setDate(out.getDate() - offsetToMonday);
+  return out;
+}
+function listFromRegistry(registry) {
+  if (!registry) return [];
+  if (Array.isArray(registry)) return registry;
+  if (typeof registry.list === "function") {
+    return registry.list();
+  }
+  return [];
+}
+function extractAgentNames(query, registry) {
+  const records = listFromRegistry(registry);
+  if (records.length === 0) return { matched: [], flagged: false };
+  const lowerQuery = query.toLowerCase();
+  const compactQuery = lowerQuery.replace(/[\s_-]+/g, "");
+  const matched = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rec of records) {
+    const id = rec.agent_id;
+    if (!id || seen.has(id)) continue;
+    const idLower = id.toLowerCase();
+    if (idLower.length < 3) continue;
+    const idCompact = idLower.replace(/[\s_-]+/g, "");
+    const wordRe = new RegExp(
+      `\\b${idLower.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`,
+      "i"
+    );
+    if (wordRe.test(query)) {
+      matched.push(id);
+      seen.add(id);
+      continue;
+    }
+    if (idCompact.length >= 4 && compactQuery.includes(idCompact)) {
+      matched.push(id);
+      seen.add(id);
+    }
+  }
+  const agentMention = lowerQuery.match(/\bagent\s+([a-z0-9_-]{3,40})/i);
+  const flagged = matched.length === 0 && agentMention !== null && agentMention[1] !== void 0 && !records.some((r) => r.agent_id.toLowerCase() === agentMention[1]?.toLowerCase());
+  return { matched, flagged };
+}
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractEventTypes(query, enumValues) {
+  const lower = query.toLowerCase();
+  const matched = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const ev of enumValues) {
+    if (seen.has(ev)) continue;
+    const re = new RegExp(`\\b${escapeRegex(ev)}\\b`, "i");
+    if (re.test(query)) {
+      matched.push(ev);
+      seen.add(ev);
+    }
+  }
+  for (const syn of EVENT_SYNONYMS) {
+    const re = new RegExp(
+      `\\b${syn.phrase.split(/\s+/).map(escapeRegex).join("\\s+")}\\b`,
+      "i"
+    );
+    if (re.test(query)) {
+      for (const c of syn.canonical) {
+        if (seen.has(c)) continue;
+        if (!enumValues.includes(c)) continue;
+        matched.push(c);
+        seen.add(c);
+      }
+    }
+  }
+  const globMatches = lower.match(/\b([a-z_]+)_\*/g) ?? [];
+  for (const glob of globMatches) {
+    const prefix = glob.slice(0, -2);
+    for (const ev of enumValues) {
+      if (seen.has(ev)) continue;
+      if (ev.startsWith(prefix)) {
+        matched.push(ev);
+        seen.add(ev);
+      }
+    }
+  }
+  const eventNounMention = /\b(?:event|events|class|classes)\b/i.test(query) && matched.length === 0;
+  return { matched, flagged: eventNounMention };
+}
+function deriveIntentPhrase(query, stripTokens) {
+  let out = query;
+  for (const tok of stripTokens) {
+    if (!tok) continue;
+    const re = new RegExp(escapeRegex(tok), "gi");
+    out = out.replace(re, " ");
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
+function computeConfidence(parsed) {
+  const dims = [
+    { present: parsed.hasTimeMention, resolved: parsed.timeResolved },
+    { present: parsed.hasAgentMention, resolved: parsed.agentResolved },
+    { present: parsed.hasEventMention, resolved: parsed.eventResolved }
+  ];
+  const present = dims.filter((d) => d.present);
+  let base;
+  if (present.length === 0) {
+    base = parsed.intentEmpty ? 0 : 0.3;
+  } else {
+    const resolved = present.filter((d) => d.resolved).length;
+    base = resolved / present.length;
+  }
+  const adjusted = base - 0.15 * parsed.ambiguityCount;
+  if (adjusted < 0) return 0;
+  if (adjusted > 1) return 1;
+  return adjusted;
+}
+function parseQuery(query, opts) {
+  const now = opts?.now ?? /* @__PURE__ */ new Date();
+  const enumValues = opts?.eventClassEnum ?? CANONICAL_AUDIT_EVENT_CLASSES;
+  const original = query ?? "";
+  const trimmed = original.trim();
+  if (trimmed.length === 0) {
+    return {
+      time_range: null,
+      agent_names: [],
+      event_types: [],
+      intent_phrase: "",
+      ambiguity_flags: ["no_signal_extracted"],
+      parse_confidence: 0
+    };
+  }
+  const ambiguity_flags = /* @__PURE__ */ new Set();
+  const timeMatch = resolveTimeRange(trimmed, now);
+  const hasTimeMention = TIME_MENTION_PROBE.test(trimmed);
+  if (hasTimeMention && !timeMatch) {
+    ambiguity_flags.add("unknown_time_token");
+  }
+  const agentResult = extractAgentNames(trimmed, opts?.registry);
+  if (agentResult.flagged) {
+    ambiguity_flags.add("unknown_agent_token");
+  }
+  const hasAgentMention = AGENT_MENTION_PROBE.test(trimmed);
+  const eventResult = extractEventTypes(trimmed, enumValues);
+  const hasEventMention = EVENT_MENTION_PROBE.test(trimmed);
+  if (eventResult.flagged) {
+    ambiguity_flags.add("unknown_event_token");
+  }
+  const stripTokens = [];
+  if (timeMatch) stripTokens.push(timeMatch.matchedSubstring);
+  for (const name of agentResult.matched) stripTokens.push(name);
+  for (const ev of eventResult.matched) {
+    if (trimmed.toLowerCase().includes(ev.toLowerCase())) {
+      stripTokens.push(ev);
+    }
+  }
+  const intent_phrase = deriveIntentPhrase(trimmed, stripTokens);
+  const parse_confidence = computeConfidence({
+    hasTimeMention,
+    timeResolved: timeMatch !== null,
+    hasAgentMention,
+    agentResolved: agentResult.matched.length > 0,
+    hasEventMention,
+    eventResolved: eventResult.matched.length > 0,
+    intentEmpty: intent_phrase.length === 0,
+    ambiguityCount: ambiguity_flags.size
+  });
+  if (timeMatch === null && agentResult.matched.length === 0 && eventResult.matched.length === 0 && intent_phrase.length === 0) {
+    ambiguity_flags.add("no_signal_extracted");
+  }
+  return {
+    time_range: timeMatch ? timeMatch.range : null,
+    agent_names: agentResult.matched,
+    event_types: eventResult.matched,
+    intent_phrase,
+    ambiguity_flags: Array.from(ambiguity_flags),
+    parse_confidence
+  };
+}
+function isLowConfidence(parsed) {
+  return parsed.parse_confidence < LLM_ASSIST_THRESHOLD;
+}
+async function parseQueryWithLlmAssist(query, llmAssist, opts) {
+  const parsed = parseQuery(query, opts);
+  if (!llmAssist || !isLowConfidence(parsed)) return parsed;
+  let completion;
+  try {
+    completion = await llmAssist(query, parsed);
+  } catch {
+    return parsed;
+  }
+  if (!completion || typeof completion !== "object") return parsed;
+  const merged = { ...parsed };
+  if (parsed.time_range === null && completion.time_range) {
+    merged.time_range = completion.time_range;
+  }
+  if (parsed.agent_names.length === 0 && Array.isArray(completion.agent_names)) {
+    merged.agent_names = completion.agent_names.filter(
+      (s) => typeof s === "string" && s.length > 0
+    );
+  }
+  if (parsed.event_types.length === 0 && Array.isArray(completion.event_types)) {
+    const allowed = new Set(opts?.eventClassEnum ?? CANONICAL_AUDIT_EVENT_CLASSES);
+    merged.event_types = completion.event_types.filter(
+      (s) => typeof s === "string" && allowed.has(s)
+    );
+  }
+  merged.parse_confidence = Math.max(
+    parsed.parse_confidence,
+    computeConfidence({
+      hasTimeMention: TIME_MENTION_PROBE.test(query),
+      timeResolved: merged.time_range !== null,
+      hasAgentMention: AGENT_MENTION_PROBE.test(query),
+      agentResolved: merged.agent_names.length > 0,
+      hasEventMention: EVENT_MENTION_PROBE.test(query),
+      eventResolved: merged.event_types.length > 0,
+      intentEmpty: merged.intent_phrase.length === 0,
+      ambiguityCount: merged.ambiguity_flags.length
+    })
+  );
+  return merged;
+}
+function auditSafeSummary(parsed) {
+  return {
+    time_range: parsed.time_range ? {
+      start_iso: parsed.time_range.start.toISOString(),
+      end_iso: parsed.time_range.end.toISOString(),
+      ...parsed.time_range.relative_label !== void 0 ? { relative_label: parsed.time_range.relative_label } : {}
+    } : null,
+    agent_names: [...parsed.agent_names],
+    event_types: [...parsed.event_types],
+    ambiguity_flags: [...parsed.ambiguity_flags],
+    parse_confidence: parsed.parse_confidence
+  };
+}
+var CANONICAL_AUDIT_EVENT_CLASSES, EVENT_SYNONYMS, MS_PER_HOUR, MS_PER_DAY, NUMBER_WORDS, TIME_MENTION_PROBE, AGENT_MENTION_PROBE, EVENT_MENTION_PROBE, LLM_ASSIST_THRESHOLD;
+var init_concierge_query_grammar = __esm({
+  "src/chat/concierge-query-grammar.ts"() {
+    init_constants4();
+    init_operator_chat_audit_events();
+    CANONICAL_AUDIT_EVENT_CLASSES = [
+      // Lifecycle / policy
+      "policy_change",
+      "approval_request",
+      "audit_truncate",
+      "lockdown",
+      "unwrap",
+      // Exit bundle (Tier 1)
+      "exit_bundle_export",
+      "exit_bundle_import_activate",
+      "exit_bundle_rekey",
+      // Cross-harness approval aggregator
+      "cross_harness_approval_aggregated",
+      "cross_harness_approval_resolved",
+      "cross_harness_approval_deduped",
+      "cross_harness_approval_payload_decrypted",
+      "cross_harness_approval_audit_trail_viewed",
+      "cross_harness_approval_replayed",
+      // Composition (full set from constants.ts)
+      ...COMPOSITION_EVENT_TYPES,
+      // Operator chat / concierge (full set from OPERATOR_CHAT_OPS)
+      OPERATOR_CHAT_OPS.CONCIERGE_CHAT,
+      OPERATOR_CHAT_OPS.AGENT_INSPECT_PANEL_OPENED,
+      OPERATOR_CHAT_OPS.CONCIERGE_HISTORY_READ,
+      OPERATOR_CHAT_OPS.CONCIERGE_THREAD_DELETED,
+      OPERATOR_CHAT_OPS.CONCIERGE_MEMORY_READ_FAILED,
+      OPERATOR_CHAT_OPS.CONCIERGE_CONTEXT_FETCHER_FAILED,
+      // Bridge / commitment
+      "bridge_commit",
+      "bridge_verify",
+      "bridge_attest",
+      "proof_commitment",
+      "proof_reveal",
+      // Reputation
+      "reputation_export",
+      "reputation_import",
+      "reputation_publish",
+      "reputation_record",
+      "reputation_query"
+    ];
+    EVENT_SYNONYMS = [
+      { phrase: "approvals", canonical: ["approval_request", "cross_harness_approval_aggregated", "cross_harness_approval_resolved"] },
+      { phrase: "approval", canonical: ["approval_request"] },
+      { phrase: "policy changes", canonical: ["policy_change"] },
+      { phrase: "policy change", canonical: ["policy_change"] },
+      { phrase: "policy edits", canonical: ["policy_change"] },
+      { phrase: "lockdowns", canonical: ["lockdown"] },
+      { phrase: "exit bundles", canonical: ["exit_bundle_export", "exit_bundle_import_activate"] },
+      { phrase: "exit bundle", canonical: ["exit_bundle_export"] },
+      { phrase: "audit truncations", canonical: ["audit_truncate"] },
+      { phrase: "audit truncation", canonical: ["audit_truncate"] },
+      { phrase: "compositions", canonical: ["composition_receipt_packed", "composition_receipt_verified"] },
+      { phrase: "receipts", canonical: ["composition_receipt_packed", "composition_receipt_verified"] },
+      { phrase: "receipt verifications", canonical: ["composition_receipt_verified"] },
+      { phrase: "concierge chats", canonical: [OPERATOR_CHAT_OPS.CONCIERGE_CHAT] },
+      { phrase: "cross harness approvals", canonical: ["cross_harness_approval_aggregated", "cross_harness_approval_resolved"] }
+    ];
+    MS_PER_HOUR = 60 * 60 * 1e3;
+    MS_PER_DAY = 24 * MS_PER_HOUR;
+    NUMBER_WORDS = {
+      a: 1,
+      an: 1,
+      one: 1,
+      two: 2,
+      three: 3,
+      four: 4,
+      five: 5,
+      six: 6,
+      seven: 7,
+      eight: 8,
+      nine: 9,
+      ten: 10,
+      twelve: 12,
+      twentyfour: 24
+    };
+    TIME_MENTION_PROBE = /\b(yesterday|today|now|past|last|this\s+week|this\s+month|since|from|between|\d{4}-\d{2}-\d{2})\b/i;
+    AGENT_MENTION_PROBE = /\bagent[s]?\b/i;
+    EVENT_MENTION_PROBE = /\b(event|events|class|classes|approvals?|policy)\b/i;
+    LLM_ASSIST_THRESHOLD = 0.5;
+  }
+});
+
+// src/chat/agent-context-cache.ts
 function approxTokenLen2(text) {
   return Math.ceil(text.length / 4);
 }
+function formatSnapshotLine(snapshot) {
+  const flagLabel = snapshot.state_flags.join("+") || "no_flags";
+  const work = snapshot.current_work_summary ? `, last: ${snapshot.current_work_summary}` : "";
+  const verascore = snapshot.recent_verascore_delta_24h !== null ? `, verascore \u0394${snapshot.recent_verascore_delta_24h.toFixed(2)}` : "";
+  return `- ${snapshot.agent_name} (template: ${snapshot.template}): ${flagLabel}, ${snapshot.recent_audit_count_24h} audit/24h, ${snapshot.recent_concordia_receipts_count_24h} receipts${verascore}${work}`;
+}
+function urgencyRank(snapshot) {
+  for (let i = 0; i < STATE_FLAG_ORDER.length; i++) {
+    if (snapshot.state_flags.includes(STATE_FLAG_ORDER[i])) {
+      return i;
+    }
+  }
+  return STATE_FLAG_ORDER.length;
+}
+function formatCurrentAgentStateSection(snapshots, opts) {
+  if (snapshots.length === 0) return "";
+  const budget = opts?.maxTokens ?? DEFAULT_AGENT_CONTEXT_TOKEN_BUDGET;
+  const sorted = [...snapshots].sort(
+    (a, b) => urgencyRank(a) - urgencyRank(b)
+  );
+  const headerTokens = approxTokenLen2(`${SECTION_HEADER}
+`);
+  const sepTokens = approxTokenLen2("\n");
+  let runningTokens = headerTokens;
+  const kept = [];
+  for (const snap of sorted) {
+    const line = formatSnapshotLine(snap);
+    const tokens = approxTokenLen2(line) + (kept.length > 0 ? sepTokens : 0);
+    if (kept.length === 0) {
+      kept.push(line);
+      runningTokens += tokens;
+      continue;
+    }
+    if (runningTokens + tokens > budget) break;
+    kept.push(line);
+    runningTokens += tokens;
+  }
+  return `${SECTION_HEADER}
+${kept.join("\n")}`;
+}
+function generateProactiveStarter(snapshots) {
+  if (snapshots.length === 0) return null;
+  const stuck = snapshots.filter((s) => s.state_flags.includes("stuck"));
+  if (stuck.length > 0) {
+    const first = stuck[0];
+    if (first === void 0) return null;
+    const last = first.current_work_summary ? ` (last: ${first.current_work_summary})` : "";
+    return {
+      text: `Your ${first.agent_name} agent looks stuck${last}. Should I check its session state?`,
+      trigger: "stuck_agent",
+      triggered_agents_count: stuck.length
+    };
+  }
+  const pending = snapshots.filter(
+    (s) => s.state_flags.includes("has_pending_approvals")
+  );
+  if (pending.length > 0) {
+    const names = pending.slice(0, 3).map((s) => s.agent_name).join(", ");
+    return {
+      text: `You have pending approvals across ${names}. Want to walk through them?`,
+      trigger: "pending_approvals",
+      triggered_agents_count: pending.length
+    };
+  }
+  const findings = snapshots.filter(
+    (s) => s.state_flags.includes("has_open_findings")
+  );
+  if (findings.length > 0) {
+    return {
+      text: `Sentinel has open findings on ${findings.length} ${findings.length === 1 ? "agent" : "agents"}. Want a summary?`,
+      trigger: "open_findings",
+      triggered_agents_count: findings.length
+    };
+  }
+  return {
+    text: "Your fortress is quiet. Anything you'd like to inspect?",
+    trigger: "all_idle",
+    triggered_agents_count: snapshots.length
+  };
+}
+var STATE_FLAG_ORDER, SECTION_HEADER, DEFAULT_AGENT_CONTEXT_TOKEN_BUDGET;
+var init_agent_context_cache = __esm({
+  "src/chat/agent-context-cache.ts"() {
+    STATE_FLAG_ORDER = [
+      "stuck",
+      "has_pending_approvals",
+      "has_open_findings",
+      "active",
+      "idle"
+    ];
+    SECTION_HEADER = "## Current agent state";
+    DEFAULT_AGENT_CONTEXT_TOKEN_BUDGET = 400;
+  }
+});
+function approxTokenLen3(text) {
+  return Math.ceil(text.length / 4);
+}
 function makeEventId(prefix) {
   return `${prefix}-${Date.now()}-${randomUUID().slice(0, 8)}`;
 }
@@ -34061,7 +36758,7 @@ function formatPriorTurnLine(turn) {
 function hashOf(input) {
   return hashToString(sha256(stringToBytes(input)));
 }
-var DEFAULT_CONCIERGE_MAX_TOKENS, DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS, DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS, DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET, DEFAULT_CONCIERGE_SESSION_TTL_MS, DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET, SANCTUARY_DOMAIN_REFERENCE, OperatorChatService;
+var DEFAULT_CONCIERGE_MAX_TOKENS, DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS, DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS, DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET, DEFAULT_CONCIERGE_SESSION_TTL_MS, DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET, DEFAULT_CONCIERGE_AGENT_STATE_BUDGET, SANCTUARY_DOMAIN_REFERENCE, OperatorChatService;
 var init_operator_chat_service = __esm({
   "src/chat/operator-chat-service.ts"() {
     init_hashing();
@@ -34069,12 +36766,15 @@ var init_operator_chat_service = __esm({
     init_operator_chat_audit_events();
     init_operator_chat_types();
     init_concierge_context_router();
+    init_concierge_query_grammar();
+    init_agent_context_cache();
     DEFAULT_CONCIERGE_MAX_TOKENS = 512;
     DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
     DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
     DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
     DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
     DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET = 2e3;
+    DEFAULT_CONCIERGE_AGENT_STATE_BUDGET = 400;
     SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
 1. Castle Wall: OS-boundary egress filter enforced at the kernel level. Blocks unauthorized outbound calls even from prompt-injected agents.
 2. Sentinels: internal observation via process introspection. Surfaces anomalies to the operator; does not enforce.
@@ -34119,6 +36819,17 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
       contextFetchers;
       contextLlmAssist;
       dynamicContextBudget;
+      agentRegistry;
+      grammarLlmAssist;
+      agentContextCache;
+      agentStateBudget;
+      /**
+       * Per-thread guard so the proactive starter fires at most once per
+       * fresh thread. Tracks the thread_id the starter was last offered
+       * for; subsequent `getProactiveStarter()` calls within the same
+       * thread return null instead of re-emitting.
+       */
+      starterOfferedForThreadId;
       /**
        * In-memory thread_id assigned to the active concierge session.
        * The first sendConcierge call after construction allocates a fresh
@@ -34157,6 +36868,16 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           this.contextLlmAssist = deps.conciergeContextLlmAssist;
         }
         this.dynamicContextBudget = deps.conciergeDynamicContextBudget !== void 0 && deps.conciergeDynamicContextBudget > 0 ? deps.conciergeDynamicContextBudget : DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET;
+        if (deps.conciergeAgentRegistry) {
+          this.agentRegistry = deps.conciergeAgentRegistry;
+        }
+        if (deps.conciergeGrammarLlmAssist) {
+          this.grammarLlmAssist = deps.conciergeGrammarLlmAssist;
+        }
+        if (deps.conciergeAgentContextCache) {
+          this.agentContextCache = deps.conciergeAgentContextCache;
+        }
+        this.agentStateBudget = deps.conciergeAgentStateBudget !== void 0 && deps.conciergeAgentStateBudget > 0 ? deps.conciergeAgentStateBudget : DEFAULT_CONCIERGE_AGENT_STATE_BUDGET;
       }
       // ── Concierge ─────────────────────────────────────────────────────────
       /**
@@ -34178,6 +36899,7 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
         const nowMs = this.clock();
         if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
           this.activeMemoryThreadId = void 0;
+          this.starterOfferedForThreadId = void 0;
         }
         const operatorMessage = {
           message_id: randomUUID(),
@@ -34215,6 +36937,12 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           await this.memory.appendTurn(threadId, "user", trimmed).catch(() => {
           });
         }
+        const parsedGrammar = await this.runGrammarParse(filterResult.filtered);
+        const agentSnapshots = this.agentContextCache ? this.agentContextCache.read() : [];
+        const agentStateSection = this.agentContextCache ? formatCurrentAgentStateSection(agentSnapshots, {
+          maxTokens: this.agentStateBudget
+        }) : "";
+        const renderedAgentCount = agentStateSection ? agentSnapshots.length : 0;
         const start = Date.now();
         let conciergeBody;
         let servedBy = "disabled";
@@ -34233,12 +36961,14 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
               outcome = "substrate_disabled";
             } else {
               const dynamicResult = await this.runDynamicContextFold(
-                filterResult.filtered
+                filterResult.filtered,
+                parsedGrammar
               );
               dynamicCategoriesIncluded = dynamicResult.categoriesIncluded;
               const context = await this.assembleConciergeContext(
                 priorTurns,
-                dynamicResult.section
+                dynamicResult.section,
+                agentStateSection
               );
               const response = await this.substrateSelector.invokeSummarize(
                 "concierge",
@@ -34304,7 +37034,9 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
           ...this.memory ? {
             prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
           } : {},
-          ...this.contextFetchers ? { dynamic_context_categories: [...dynamicCategoriesIncluded] } : {}
+          ...this.contextFetchers ? { dynamic_context_categories: [...dynamicCategoriesIncluded] } : {},
+          parsed_grammar: auditSafeSummary(parsedGrammar),
+          ...this.agentContextCache !== void 0 ? { agent_context_snapshot_count: renderedAgentCount } : {}
         };
         this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
         return {
@@ -34415,6 +37147,7 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
         if (!removed) return false;
         if (this.activeMemoryThreadId === threadId) {
           this.activeMemoryThreadId = void 0;
+          this.starterOfferedForThreadId = void 0;
         }
         const payload = {
           version: "1.2",
@@ -34433,9 +37166,65 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
        * Reset the active session memory thread. Subsequent sendConcierge
        * calls allocate a fresh thread_id. Surfaced for tests + future "new
        * conversation" affordance; not currently called by the dashboard.
+       *
+       * Tau-5: also clears the proactive-starter guard so the next
+       * `getProactiveStarter()` call against the freshly-allocated thread
+       * is eligible to fire.
        */
       resetConciergeMemoryThread() {
         this.activeMemoryThreadId = void 0;
+        this.starterOfferedForThreadId = void 0;
+      }
+      /**
+       * WP-V1.3-9 Tau-5: surface a proactive starter for the current
+       * concierge session. Intended to be called by the dashboard UI when
+       * the operator opens the chat surface, before any operator typing.
+       *
+       * Returns null when:
+       * - No agent-context cache is wired (Tau-5 disabled).
+       * - No concierge memory store is wired (no thread_id namespace).
+       * - The cache snapshot has no signal (empty fortress).
+       * - A starter has already been offered for the active thread (the
+       *   guard ensures one starter per fresh thread).
+       *
+       * Side effects:
+       * - Allocates a fresh thread_id if none is active.
+       * - Emits the `operator_concierge_proactive_suggestion_offered`
+       *   audit event with the trigger class + triggered_agents_count.
+       * - Records the offered thread_id so the next call within the same
+       *   thread is a no-op.
+       *
+       * The returned starter's `text` is operator-visible copy; the
+       * dashboard renders it as a system-message-style starter the
+       * operator can accept (clicks/types follow-up) or dismiss (types a
+       * new query).
+       */
+      getProactiveStarter() {
+        if (!this.agentContextCache) return null;
+        if (!this.memory) return null;
+        const threadId = this.ensureActiveMemoryThread();
+        if (this.starterOfferedForThreadId === threadId) return null;
+        const snapshots = this.agentContextCache.read();
+        const starter = generateProactiveStarter(snapshots);
+        if (!starter) return null;
+        const payload = {
+          version: "1.2",
+          event_id: makeEventId("conc-starter"),
+          emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+          identity_id: this.identityId,
+          kind: "operator_concierge_proactive_suggestion_offered",
+          surface: "concierge",
+          thread_id: threadId,
+          trigger: starter.trigger,
+          triggered_agents_count: starter.triggered_agents_count
+        };
+        this.emit(
+          OPERATOR_CHAT_OPS.CONCIERGE_PROACTIVE_SUGGESTION_OFFERED,
+          payload,
+          "success"
+        );
+        this.starterOfferedForThreadId = threadId;
+        return starter;
       }
       ensureActiveMemoryThread() {
         if (!this.activeMemoryThreadId) {
@@ -34480,7 +37269,7 @@ Note: this is a static reference block (v1.2.x). Dynamic context injection (live
        * if available; the v1.2 selector does not expose one, so structured
        * serialization is the canonical path for v1.3.
        */
-      async assembleConciergeContext(priorTurns = [], dynamicSection = "") {
+      async assembleConciergeContext(priorTurns = [], dynamicSection = "", agentStateSection = "") {
         const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
         const priorSection = this.formatPriorTurnsSection(priorTurns);
@@ -34488,6 +37277,7 @@ ${SANCTUARY_DOMAIN_REFERENCE}`;
           return [
             ref,
             ...dynamicSection ? [dynamicSection] : [],
+            ...agentStateSection ? [agentStateSection] : [],
             ...priorSection ? [priorSection] : [],
             "## Recent activity\n(no providers wired)",
             "## Wrapped agents\n(no providers wired)",
@@ -34502,6 +37292,7 @@ ${SANCTUARY_DOMAIN_REFERENCE}`;
         return [
           ref,
           ...dynamicSection ? [dynamicSection] : [],
+          ...agentStateSection ? [agentStateSection] : [],
           ...priorSection ? [priorSection] : [],
           `## Recent activity
 ${activity}`,
@@ -34519,8 +37310,12 @@ ${inbox}`
        * proceeds with no fold. Returns the rendered section + the list of
        * categories whose data made it into the section (used for the
        * round-trip audit emission).
+       *
+       * Tau-4: receives the pre-parsed `ParsedQuery` and forwards it as the
+       * `parsed` opt to `foldContext`, so fetchers see the structured
+       * `FetcherHints` derived from it.
        */
-      async runDynamicContextFold(query) {
+      async runDynamicContextFold(query, parsedGrammar) {
         if (!this.contextFetchers) {
           return { section: "", categoriesIncluded: [] };
         }
@@ -34529,10 +37324,24 @@ ${inbox}`
           ...this.contextLlmAssist ? { llmAssistClassify: this.contextLlmAssist } : {},
           onFetcherFailure: (category, error) => {
             this.emitContextFetcherFailed(category, classifyFetcherError(error));
-          }
+          },
+          parsed: parsedGrammar
         });
         return result;
       }
+      /**
+       * WP-V1.3-9 Tau-4: parse the (PII-filtered) operator query into a
+       * `ParsedQuery`. Routes through the LLM-assist completion hook when
+       * configured and the rule-based parse is below
+       * `LLM_ASSIST_THRESHOLD`. Always returns a parse object (never
+       * throws) so the audit emission can carry the result unconditionally.
+       */
+      async runGrammarParse(query) {
+        return parseQueryWithLlmAssist(query, this.grammarLlmAssist, {
+          ...this.agentRegistry !== void 0 ? { registry: this.agentRegistry } : {},
+          eventClassEnum: CANONICAL_AUDIT_EVENT_CLASSES
+        });
+      }
       /**
        * Emit the WP-V1.3-9 Tau-3 fetcher-failure audit event. Pulled out
        * of the fold path so the dynamic-context handler stays readable.
@@ -34566,14 +37375,14 @@ ${inbox}`
         if (turns.length === 0) return "";
         const HEADER = "## Prior conversation";
         const lines = turns.map(formatPriorTurnLine);
-        const headerTokens = approxTokenLen2(`${HEADER}
+        const headerTokens = approxTokenLen3(`${HEADER}
 `);
-        const sepTokens = approxTokenLen2("\n");
+        const sepTokens = approxTokenLen3("\n");
         let runningTokens = headerTokens;
         let runningLines = [];
         for (let i = lines.length - 1; i >= 0; i--) {
           const line = lines[i];
-          const tokens = approxTokenLen2(line) + (runningLines.length > 0 ? sepTokens : 0);
+          const tokens = approxTokenLen3(line) + (runningLines.length > 0 ? sepTokens : 0);
           if (runningTokens + tokens > this.historyTokenBudget) break;
           runningTokens += tokens;
           runningLines.push(line);
@@ -34601,7 +37410,7 @@ ${runningLines.join("\n")}`;
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
-var OPERATOR_CHAT_NAMESPACE, HKDF_INFO2, OperatorChatStore;
+var OPERATOR_CHAT_NAMESPACE, HKDF_INFO3, OperatorChatStore;
 var init_operator_chat_store = __esm({
   "src/chat/operator-chat-store.ts"() {
     init_encryption();
@@ -34609,13 +37418,13 @@ var init_operator_chat_store = __esm({
     init_encoding();
     init_operator_chat_types();
     OPERATOR_CHAT_NAMESPACE = "_chat";
-    HKDF_INFO2 = "operator-chat-store-v1";
+    HKDF_INFO3 = "operator-chat-store-v1";
     OperatorChatStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
       }
       /**
        * Load a thread. Returns null if no record exists or if the on-disk
@@ -34700,7 +37509,7 @@ var init_operator_chat_store = __esm({
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix2(key) {
+function stripKeyPrefix3(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -34711,7 +37520,7 @@ function lastTurnId(bundle) {
   }
   return max;
 }
-var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO3, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
+var CONCIERGE_MEMORY_NAMESPACE, CONCIERGE_MEMORY_KEY_PREFIX, HKDF_INFO4, DEFAULT_CONCIERGE_RETENTION_DAYS, MAX_BUNDLE_BYTES3, ConciergeMemoryStore;
 var init_concierge_memory_store = __esm({
   "src/chat/concierge-memory-store.ts"() {
     init_encryption();
@@ -34719,7 +37528,7 @@ var init_concierge_memory_store = __esm({
     init_encoding();
     CONCIERGE_MEMORY_NAMESPACE = "_chat";
     CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-    HKDF_INFO3 = "concierge-memory-store-v1";
+    HKDF_INFO4 = "concierge-memory-store-v1";
     DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
     MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
     ConciergeMemoryStore = class {
@@ -34730,7 +37539,7 @@ var init_concierge_memory_store = __esm({
       locks;
       constructor(opts) {
         this.storage = opts.storage;
-        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
+        this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO4);
         this.fortressId = opts.fortressId;
         this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
         this.locks = /* @__PURE__ */ new Map();
@@ -34856,7 +37665,7 @@ var init_concierge_memory_store = __esm({
         );
         const summaries = [];
         for (const meta of entries) {
-          const threadId = stripKeyPrefix2(meta.key);
+          const threadId = stripKeyPrefix3(meta.key);
           if (threadId === null) continue;
           const bundle = await this.loadBundle(threadId);
           if (!bundle || bundle.turns.length === 0) continue;
@@ -34909,7 +37718,7 @@ var init_concierge_memory_store = __esm({
         );
         let pruned = 0;
         for (const meta of entries) {
-          const threadId = stripKeyPrefix2(meta.key);
+          const threadId = stripKeyPrefix3(meta.key);
           if (threadId === null) continue;
           pruned += await this.withLock(threadId, async () => {
             const bundle = await this.loadBundle(threadId);
@@ -35379,7 +38188,7 @@ var init_defaults = __esm({
 });
 
 // src/intelligence/policy-store.ts
-var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO4, IntelligenceConfigStore;
+var INTELLIGENCE_NAMESPACE, SUBSTRATE_CONFIG_KEY, HKDF_INFO5, IntelligenceConfigStore;
 var init_policy_store = __esm({
   "src/intelligence/policy-store.ts"() {
     init_encryption();
@@ -35388,13 +38197,13 @@ var init_policy_store = __esm({
     init_defaults();
     INTELLIGENCE_NAMESPACE = "_intelligence";
     SUBSTRATE_CONFIG_KEY = "substrate-config";
-    HKDF_INFO4 = "intelligence-substrate-config";
+    HKDF_INFO5 = "intelligence-substrate-config";
     IntelligenceConfigStore = class {
       storage;
       encryptionKey;
       constructor(storage, masterKey) {
         this.storage = storage;
-        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
+        this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO5);
       }
       /**
        * Load the operator's substrate config from disk. Returns the config
@@ -37044,7 +39853,7 @@ var init_memory = __esm({
 
 // src/contracts/v1.1/constants.ts
 var SIGNATURE_SCHEME_V12, EXIT_BUNDLE_MANIFEST_VERSION, EXIT_BUNDLE_ARTIFACT_KINDS;
-var init_constants4 = __esm({
+var init_constants5 = __esm({
   "src/contracts/v1.1/constants.ts"() {
     SIGNATURE_SCHEME_V12 = "ed25519-v1";
     EXIT_BUNDLE_MANIFEST_VERSION = "SANCTUARY_EXIT_BUNDLE_V1";
@@ -37462,7 +40271,7 @@ async function verifyExitBundle(bundleDir, options = {}) {
 var InvalidExitBundleError, PRIVATE_MATERIAL_KEYS;
 var init_verifier2 = __esm({
   "src/exit/verifier.ts"() {
-    init_constants4();
+    init_constants5();
     init_exit_bundle_manifest();
     init_encoding();
     init_hashing();
@@ -38274,7 +41083,7 @@ var init_bundle = __esm({
   "src/exit/bundle.ts"() {
     init_state_store();
     init_config();
-    init_constants4();
+    init_constants5();
     init_canonical_json();
     init_hashing();
     init_encoding();
@@ -39345,6 +42154,38 @@ ${err.message}
   if (dashboard) {
     dashboard.setApprovalAggregator(approvalAggregator);
   }
+  const sentinelFindingStore = new SentinelFindingStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
+  const sentinelRegistry = new SentinelRegistry();
+  for (const entry of PHI1_BASELINE_CATALOG) {
+    sentinelRegistry.register(entry);
+  }
+  const sentinelDispatcher = new SentinelDispatcher({
+    registry: sentinelRegistry,
+    findingStore: sentinelFindingStore,
+    auditLog,
+    fortressId: fortressIdForAggregator,
+    identityId: aggregatorIdentityId
+  });
+  try {
+    const persistedSubscriptions = await loadSentinelSubscriptions(
+      config.storage_path
+    );
+    for (const sentinelId of persistedSubscriptions) {
+      try {
+        await sentinelDispatcher.subscribeSentinel(sentinelId);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  sentinelDispatcher.start();
+  if (dashboard) {
+    dashboard.setSentinelDispatcher(sentinelDispatcher);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,
@@ -39538,6 +42379,11 @@ var init_src = __esm({
     init_approval_aggregator();
     init_aggregator_backed_channel();
     init_aggregator_store();
+    init_sentinel_finding_store();
+    init_sentinel_registry();
+    init_sentinel_dispatcher();
+    init_sentinels();
+    init_subscription_store();
     init_tools4();
     init_router();
     init_router();
@@ -44707,6 +47553,232 @@ var init_intelligence = __esm({
   }
 });
 
+// src/cli/sentinel.ts
+var sentinel_exports = {};
+__export(sentinel_exports, {
+  runSentinelCommand: () => runSentinelCommand
+});
+async function runSentinelCommand(args) {
+  const out = args.out ?? process.stdout;
+  const err = args.err ?? process.stderr;
+  const [sub, ...rest] = args.argv;
+  if (!sub || sub === "--help" || sub === "-h") {
+    printUsage6(out);
+    return 0;
+  }
+  try {
+    switch (sub) {
+      case "list":
+        return cmdList4(out);
+      case "list-subscribed":
+        return await cmdListSubscribed(rest, { out, err, args });
+      case "subscribe":
+        return await cmdSubscribe(rest, { out, err, args });
+      case "unsubscribe":
+        return await cmdUnsubscribe(rest, { out, err, args });
+      case "findings":
+        return await cmdFindings(rest, { out, err, args });
+      default:
+        err.write(`Unknown subcommand: ${sub}
+`);
+        printUsage6(err);
+        return 2;
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    err.write(`sanctuary sentinel: ${msg}
+`);
+    return 1;
+  }
+}
+function printUsage6(s) {
+  s.write(`Usage: sanctuary sentinel <command> [args]
+
+  list                                Show the Phi-1 catalog of available
+                                      sentinels (egress-volume only at v1.3
+                                      Phi-1; more land in Phi-2 ... Phi-5).
+  list-subscribed                     Show which sentinels this fortress has
+                                      opted into. Loads from
+                                      <storage>/sentinel-subscriptions.json.
+  subscribe <sentinel-id>             Opt in. Writes the subscription file.
+                                      The server picks it up on next boot.
+  unsubscribe <sentinel-id>           Opt out.
+  findings [opts]                     Read recent findings. Decrypts the
+                                      sentinel findings store (uses the
+                                      same passphrase as the cocoon master
+                                      key).
+    --since <iso>                       Filter observed_at >= iso.
+    --severity <info|warn|alert>        Filter by severity.
+    --sentinel-id <id>                  Filter by emitting sentinel.
+    --agent-id <id>                     Filter by agent attribution.
+    --limit <n>                         Cap result count (default 100).
+`);
+}
+function cmdList4(out) {
+  for (const entry of PHI1_BASELINE_CATALOG) {
+    out.write(`${entry.sentinelId}
+  ${entry.description}
+`);
+  }
+  if (PHI1_BASELINE_CATALOG.length === 0) {
+    out.write("(no sentinels registered)\n");
+  }
+  return 0;
+}
+async function cmdListSubscribed(argv, ctx) {
+  const storagePath = await resolveStoragePath2(ctx.args);
+  const subscribed = await loadSentinelSubscriptions(storagePath);
+  if (subscribed.size === 0) {
+    ctx.out.write("(no subscriptions)\n");
+    return 0;
+  }
+  for (const id of [...subscribed].sort()) {
+    ctx.out.write(`${id}
+`);
+  }
+  return 0;
+}
+async function cmdSubscribe(argv, ctx) {
+  const sentinelId = argv[0];
+  if (!sentinelId) {
+    ctx.err.write("subscribe requires a sentinel-id\n");
+    return 2;
+  }
+  const known = PHI1_BASELINE_CATALOG.find(
+    (entry) => entry.sentinelId === sentinelId
+  );
+  if (!known) {
+    ctx.err.write(`Unknown sentinel: ${sentinelId}
+`);
+    return 2;
+  }
+  const storagePath = await resolveStoragePath2(ctx.args);
+  const subscribed = await loadSentinelSubscriptions(storagePath);
+  if (subscribed.has(sentinelId)) {
+    ctx.out.write(`Already subscribed: ${sentinelId}
+`);
+    return 0;
+  }
+  subscribed.add(sentinelId);
+  await saveSentinelSubscriptions(storagePath, subscribed);
+  ctx.out.write(
+    `Subscribed: ${sentinelId}
+Restart Sanctuary or wait for the next dispatcher tick to begin evaluation.
+`
+  );
+  return 0;
+}
+async function cmdUnsubscribe(argv, ctx) {
+  const sentinelId = argv[0];
+  if (!sentinelId) {
+    ctx.err.write("unsubscribe requires a sentinel-id\n");
+    return 2;
+  }
+  const storagePath = await resolveStoragePath2(ctx.args);
+  const subscribed = await loadSentinelSubscriptions(storagePath);
+  if (!subscribed.has(sentinelId)) {
+    ctx.out.write(`Not subscribed: ${sentinelId}
+`);
+    return 0;
+  }
+  subscribed.delete(sentinelId);
+  await saveSentinelSubscriptions(storagePath, subscribed);
+  ctx.out.write(`Unsubscribed: ${sentinelId}
+`);
+  return 0;
+}
+async function cmdFindings(argv, ctx) {
+  const filters = parseFindingFilters(argv);
+  const storagePath = await resolveStoragePath2(ctx.args);
+  const storage = new FilesystemStorage(`${storagePath}/state`);
+  let passphrase = ctx.args.passphrase ?? process.env["SANCTUARY_PASSPHRASE"];
+  if (!passphrase) {
+    const resolved = await getOrCreatePassphrase();
+    passphrase = resolved.value;
+  }
+  let existingParams;
+  try {
+    const raw = await storage.read("_meta", "key-params");
+    if (raw) existingParams = JSON.parse(bytesToString(raw));
+  } catch {
+  }
+  const { key: masterKey, params } = await deriveMasterKey(
+    passphrase,
+    existingParams
+  );
+  if (!existingParams) {
+    await storage.write(
+      "_meta",
+      "key-params",
+      stringToBytes(JSON.stringify(params))
+    );
+  }
+  const fortressId = fortressIdFromStoragePath(storagePath);
+  const store = new SentinelFindingStore({
+    storage,
+    masterKey,
+    fortressId
+  });
+  const findings = await store.listFindings({
+    limit: filters.limit ?? 100,
+    ...filters.since !== void 0 ? { since: filters.since } : {},
+    ...filters.severity !== void 0 ? { severity: filters.severity } : {},
+    ...filters.sentinelId !== void 0 ? { sentinelId: filters.sentinelId } : {},
+    ...filters.agentId !== void 0 ? { agentId: filters.agentId } : {}
+  });
+  if (findings.length === 0) {
+    ctx.out.write("(no findings)\n");
+    return 0;
+  }
+  for (const finding of findings) {
+    ctx.out.write(
+      `[${finding.observed_at}] ${finding.severity.toUpperCase()} ${finding.sentinel_id}${finding.agent_id ? ` (agent ${finding.agent_id})` : ""}: ${finding.summary}
+`
+    );
+  }
+  return 0;
+}
+function parseFindingFilters(argv) {
+  const filters = {};
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--since" && argv[i + 1]) {
+      filters.since = argv[++i];
+    } else if (arg === "--severity" && argv[i + 1]) {
+      const next = argv[++i];
+      if (next === "info" || next === "warn" || next === "alert") {
+        filters.severity = next;
+      }
+    } else if (arg === "--sentinel-id" && argv[i + 1]) {
+      filters.sentinelId = argv[++i];
+    } else if (arg === "--agent-id" && argv[i + 1]) {
+      filters.agentId = argv[++i];
+    } else if (arg === "--limit" && argv[i + 1]) {
+      const n = Number.parseInt(argv[++i], 10);
+      if (!Number.isNaN(n) && n > 0) filters.limit = n;
+    }
+  }
+  return filters;
+}
+async function resolveStoragePath2(args) {
+  if (args.storagePath) return args.storagePath;
+  const config = await loadConfig();
+  return config.storage_path;
+}
+var init_sentinel2 = __esm({
+  "src/cli/sentinel.ts"() {
+    init_config();
+    init_filesystem();
+    init_key_derivation();
+    init_encoding();
+    init_passphrase();
+    init_wiring();
+    init_sentinel_finding_store();
+    init_subscription_store();
+    init_sentinels();
+  }
+});
+
 // src/mcp/broker-server.ts
 var broker_server_exports = {};
 __export(broker_server_exports, {
@@ -44802,7 +47874,7 @@ function createBrokerMcpServer(broker, opts) {
         case "broker/request_token": {
           const skill = requireString(args, "skill");
           const secret = requireString(args, "secret");
-          const scopeRaw = optionalString(args, "scope");
+          const scopeRaw = optionalString2(args, "scope");
           const scope = scopeRaw === "rotate" ? "rotate" : scopeRaw === "read" ? "read" : void 0;
           const ttl = optionalNumber(args, "ttl_seconds");
           const binding = await broker.issueToken({
@@ -44834,7 +47906,7 @@ function createBrokerMcpServer(broker, opts) {
           return ok({ grants });
         }
         case "broker/audit_query": {
-          const since = optionalString(args, "since");
+          const since = optionalString2(args, "since");
           const limit = optionalNumber(args, "limit");
           const summary = await broker.queryAudit({ since, limit });
           return ok(summary);
@@ -44859,7 +47931,7 @@ function requireString(args, key) {
   }
   return v;
 }
-function optionalString(args, key) {
+function optionalString2(args, key) {
   const v = args[key];
   return typeof v === "string" && v.length > 0 ? v : void 0;
 }
@@ -45566,6 +48638,11 @@ async function main() {
     const code = await runIntelligenceCommand2({ argv: args.slice(1) });
     process.exit(code);
   }
+  if (args[0] === "sentinel") {
+    const { runSentinelCommand: runSentinelCommand2 } = await Promise.resolve().then(() => (init_sentinel2(), sentinel_exports));
+    const code = await runSentinelCommand2({ argv: args.slice(1) });
+    process.exit(code);
+  }
   if (args[0] === "broker-server") {
     const { openBroker: openBroker2 } = await Promise.resolve().then(() => (init_open(), open_exports));
     const { createBrokerMcpServer: createBrokerMcpServer2 } = await Promise.resolve().then(() => (init_broker_server(), broker_server_exports));