@sanctuary-framework/mcp-server 1.2.7 → 1.2.9

package/dist/index.js

@@ -16446,6 +16446,119 @@ async function handleApprovalInboxRoute(deps, req, res) {
   }
 }
 
+// src/sentinel/sentinel-routes.ts
+var SENTINEL_API_PREFIX = "/api/sentinels";
+var FINDINGS_DEFAULT_LIMIT = 100;
+var FINDINGS_MAX_LIMIT = 500;
+function writeJSON5(res, status, payload) {
+  res.writeHead(status, {
+    "Content-Type": "application/json",
+    "Cache-Control": "no-store"
+  });
+  res.end(JSON.stringify(payload));
+}
+function isSeverity(value) {
+  return value === "info" || value === "warn" || value === "alert";
+}
+function parseLimit3(raw, defaultValue, max) {
+  if (raw === null || raw === "") return defaultValue;
+  const parsed = Number.parseInt(raw, 10);
+  if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+  return Math.min(parsed, max);
+}
+function matchSubscribeRoute(path) {
+  const prefix = `${SENTINEL_API_PREFIX}/`;
+  if (!path.startsWith(prefix)) return null;
+  const rest = path.slice(prefix.length);
+  if (!rest.endsWith("/subscribe")) return null;
+  const sentinelId = rest.slice(0, rest.length - "/subscribe".length);
+  if (sentinelId.length === 0) return null;
+  return { sentinelId: decodeURIComponent(sentinelId) };
+}
+async function handleSentinelRoute(deps, req, res) {
+  const host = req.headers.host || "localhost";
+  const url = new URL(req.url ?? "/", `http://${host}`);
+  const method = (req.method ?? "GET").toUpperCase();
+  const path = url.pathname;
+  if (path !== SENTINEL_API_PREFIX && !path.startsWith(`${SENTINEL_API_PREFIX}/`)) {
+    return false;
+  }
+  const checkAuth = authMiddleware(deps.authConfig);
+  if (!checkAuth(req, res, url)) return true;
+  const dispatcher = deps.dispatcher;
+  const registry = dispatcher.getRegistry();
+  const findingStore = dispatcher.getFindingStore();
+  try {
+    if (method === "GET" && path === SENTINEL_API_PREFIX) {
+      const catalog = registry.listCatalog();
+      writeJSON5(res, 200, { ok: true, data: { catalog } });
+      return true;
+    }
+    if (method === "GET" && path === `${SENTINEL_API_PREFIX}/subscribed`) {
+      const subscribed = registry.listSubscribed();
+      writeJSON5(res, 200, { ok: true, data: { subscribed } });
+      return true;
+    }
+    if (method === "GET" && path === `${SENTINEL_API_PREFIX}/findings`) {
+      const limit = parseLimit3(
+        url.searchParams.get("limit"),
+        FINDINGS_DEFAULT_LIMIT,
+        FINDINGS_MAX_LIMIT
+      );
+      const since = url.searchParams.get("since") ?? void 0;
+      const severityRaw = url.searchParams.get("severity") ?? void 0;
+      const sentinelIdFilter = url.searchParams.get("sentinel_id") ?? void 0;
+      const agentIdFilter = url.searchParams.get("agent_id") ?? void 0;
+      const severity = severityRaw && isSeverity(severityRaw) ? severityRaw : void 0;
+      const findings = await findingStore.listFindings({
+        limit,
+        ...since !== void 0 ? { since } : {},
+        ...severity !== void 0 ? { severity } : {},
+        ...sentinelIdFilter !== void 0 ? { sentinelId: sentinelIdFilter } : {},
+        ...agentIdFilter !== void 0 ? { agentId: agentIdFilter } : {}
+      });
+      writeJSON5(res, 200, { ok: true, data: { findings } });
+      return true;
+    }
+    const subscribeMatch = matchSubscribeRoute(path);
+    if (subscribeMatch) {
+      if (method === "POST") {
+        try {
+          await dispatcher.subscribeSentinel(subscribeMatch.sentinelId);
+          writeJSON5(res, 200, {
+            ok: true,
+            data: { sentinel_id: subscribeMatch.sentinelId, subscribed: true }
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (msg.startsWith("sentinel-registry: unknown sentinel")) {
+            writeJSON5(res, 404, { ok: false, error: "not_found" });
+          } else {
+            writeJSON5(res, 500, { ok: false, error: "internal", detail: msg });
+          }
+        }
+        return true;
+      }
+      if (method === "DELETE") {
+        const removed = await dispatcher.unsubscribeSentinel(
+          subscribeMatch.sentinelId
+        );
+        writeJSON5(res, 200, {
+          ok: true,
+          data: { sentinel_id: subscribeMatch.sentinelId, subscribed: false, removed }
+        });
+        return true;
+      }
+    }
+    writeJSON5(res, 404, { ok: false, error: "not_found", path });
+    return true;
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    writeJSON5(res, 500, { ok: false, error: "internal", detail: msg });
+    return true;
+  }
+}
+
 // src/principal-policy/dashboard.ts
 var SESSION_TTL_REMOTE_MS = 5 * 60 * 1e3;
 var SESSION_TTL_LOCAL_MS = 24 * 60 * 60 * 1e3;
@@ -16518,6 +16631,13 @@ var DashboardApprovalChannel = class {
    * the operator-facing query / decision surface.
    */
   approvalAggregator = null;
+  /**
+   * v1.3 WP-V1.3-1 Phi-1 Sentinel dispatcher. Mounted additively at
+   * `/api/sentinels/*` when set. Sentinel surface is read-only against
+   * the audit log; subscribe/unsubscribe writes flow through the
+   * dispatcher's audited paths.
+   */
+  sentinelDispatcher = null;
   constructor(config) {
     this.config = config;
     this.authToken = config.auth_token;
@@ -16577,6 +16697,14 @@ var DashboardApprovalChannel = class {
   setApprovalAggregator(aggregator) {
     this.approvalAggregator = aggregator;
   }
+  /**
+   * v1.3 WP-V1.3-1 Phi-1: bind the Sentinel dispatcher. Once set,
+   * requests to `/api/sentinels/*` route through `handleSentinelRoute`.
+   * Pass `null` to detach (used by tests + during shutdown).
+   */
+  setSentinelDispatcher(dispatcher) {
+    this.sentinelDispatcher = dispatcher;
+  }
   /**
    * v1.3 WP-V1.3-10 dispatch entry point. Called from `handleRequest`
    * before the legacy approval route table. Returns true when served.
@@ -16596,6 +16724,25 @@ var DashboardApprovalChannel = class {
       res
     );
   }
+  /**
+   * v1.3 WP-V1.3-1 Phi-1 dispatch entry point. Routes `/api/sentinels/*`
+   * requests through the sentinel router when a dispatcher has been
+   * bound. Returns true when served.
+   */
+  async dispatchSentinel(req, res) {
+    if (!this.sentinelDispatcher) return false;
+    return handleSentinelRoute(
+      {
+        authConfig: {
+          loopbackAutoAuth: this._autoAuthLocalhost,
+          ...this.authToken !== void 0 ? { authToken: this.authToken } : {}
+        },
+        dispatcher: this.sentinelDispatcher
+      },
+      req,
+      res
+    );
+  }
   /**
    * v1.1 dispatch entry point. Called from `handleRequest` before the
    * legacy route table. Returns true when the request was served by v1.1
@@ -16983,6 +17130,18 @@ var DashboardApprovalChannel = class {
       });
       return;
     }
+    if (this.sentinelDispatcher && url.pathname.startsWith(SENTINEL_API_PREFIX)) {
+      this.dispatchSentinel(req, res).then((handled) => {
+        if (handled) return;
+        this.handleLegacyRequest(req, res, url, method);
+      }).catch(() => {
+        if (!res.headersSent) {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Internal server error" }));
+        }
+      });
+      return;
+    }
     if (this.v11Bindings) {
       this.dispatchV11(req, res, url, method).then((handled) => {
         if (handled) return;
@@ -20204,122 +20363,1764 @@ var AggregatorPayloadStore = class {
     this.fortressId = opts.fortressId;
     this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_AGGREGATOR_PAYLOAD_RETENTION_DAYS;
   }
-  /**
-   * Persist `payload` under the given aggregator_id. Idempotent; calling
-   * twice with the same id rewrites the bundle (retention_until is
-   * recomputed). Returns the bundle's retention_until ISO-8601 timestamp
-   * so callers can log it.
-   */
-  async savePayload(aggregatorId, payload) {
-    const now = /* @__PURE__ */ new Date();
-    const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
-    const retentionUntil = new Date(now.getTime() + retentionMs);
-    const bundle = {
-      version: 1,
-      aggregator_id: aggregatorId,
-      fortress_id: this.fortressId,
-      created_at: now.toISOString(),
-      retention_until: retentionUntil.toISOString(),
-      payload
+  /**
+   * Persist `payload` under the given aggregator_id. Idempotent; calling
+   * twice with the same id rewrites the bundle (retention_until is
+   * recomputed). Returns the bundle's retention_until ISO-8601 timestamp
+   * so callers can log it.
+   */
+  async savePayload(aggregatorId, payload) {
+    const now = /* @__PURE__ */ new Date();
+    const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+    const retentionUntil = new Date(now.getTime() + retentionMs);
+    const bundle = {
+      version: 1,
+      aggregator_id: aggregatorId,
+      fortress_id: this.fortressId,
+      created_at: now.toISOString(),
+      retention_until: retentionUntil.toISOString(),
+      payload
+    };
+    const aad = stringToBytes(aggregatorId);
+    const plaintext = stringToBytes(JSON.stringify(bundle));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      payloadKey(aggregatorId),
+      stringToBytes(JSON.stringify(envelope))
+    );
+    return bundle.retention_until;
+  }
+  /**
+   * Read the persisted payload for the aggregator_id. Returns null if no
+   * bundle exists, the bundle is corrupted, or AAD binding fails.
+   */
+  async loadPayload(aggregatorId) {
+    const key = payloadKey(aggregatorId);
+    let raw;
+    try {
+      raw = await this.storage.read(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_BUNDLE_BYTES2) return null;
+    try {
+      const envelope = JSON.parse(bytesToString(raw));
+      const aad = stringToBytes(aggregatorId);
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const parsed = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (parsed.version !== 1) return null;
+      if (parsed.aggregator_id !== aggregatorId) return null;
+      return parsed.payload;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Delete the persisted payload. Returns true when a bundle was removed,
+   * false when none existed.
+   */
+  async deletePayload(aggregatorId) {
+    const key = payloadKey(aggregatorId);
+    const existed = await this.storage.exists(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      key
+    );
+    if (!existed) return false;
+    try {
+      await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, key);
+    } catch {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Drop expired payload bundles. Returns the count of bundles pruned.
+   * Caller wires this into the cocoon-unlock initialization path.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
+    const entries = await this.storage.list(
+      AGGREGATOR_PAYLOAD_NAMESPACE,
+      AGGREGATOR_PAYLOAD_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of entries) {
+      const aggregatorId = stripKeyPrefix(meta.key);
+      if (aggregatorId === null) continue;
+      const raw = await this.storage.read(
+        AGGREGATOR_PAYLOAD_NAMESPACE,
+        meta.key
+      );
+      if (!raw) continue;
+      try {
+        const envelope = JSON.parse(bytesToString(raw));
+        const aad = stringToBytes(aggregatorId);
+        const plaintext = decrypt(envelope, this.encryptionKey, aad);
+        const parsed = JSON.parse(
+          bytesToString(plaintext)
+        );
+        if (parsed.retention_until <= cutoff) {
+          await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, meta.key);
+          pruned += 1;
+        }
+      } catch {
+      }
+    }
+    return { pruned };
+  }
+};
+function payloadKey(aggregatorId) {
+  return `${AGGREGATOR_PAYLOAD_KEY_PREFIX}${aggregatorId}`;
+}
+function stripKeyPrefix(key) {
+  if (!key.startsWith(AGGREGATOR_PAYLOAD_KEY_PREFIX)) return null;
+  return key.slice(AGGREGATOR_PAYLOAD_KEY_PREFIX.length);
+}
+
+// src/sentinel/sentinel-finding-store.ts
+init_encryption();
+init_encoding();
+
+// src/sentinel/types.ts
+var SENTINEL_SUMMARY_MAX_CHARS = 240;
+var SENTINEL_AUDIT_OPS = {
+  SUBSCRIBED: "sentinel_subscribed",
+  UNSUBSCRIBED: "sentinel_unsubscribed",
+  FINDING_EMITTED: "sentinel_finding_emitted",
+  EVALUATION_FAILED: "sentinel_evaluation_failed"
+};
+var SENTINEL_OBSERVED_AUDIT_OPS = {
+  /** Proxy router emits this on every outbound call (success or failure). */
+  PROXY_CALL_PREFIX: "proxy_call:"
+};
+function isProxyCallAuditEntry(entry) {
+  return entry.operation.startsWith(
+    SENTINEL_OBSERVED_AUDIT_OPS.PROXY_CALL_PREFIX
+  );
+}
+function proxyServerFromAuditEntry(entry) {
+  if (!isProxyCallAuditEntry(entry)) return null;
+  const details = entry.details;
+  if (!details) return null;
+  const server = details["server"];
+  if (typeof server !== "string" || server.length === 0) return null;
+  return server;
+}
+
+// src/sentinel/sentinel-finding-store.ts
+var SENTINEL_FINDING_NAMESPACE = "_sentinel_findings";
+var SENTINEL_FINDING_KEY_PREFIX = "finding.";
+var HKDF_INFO2 = "l2-sentinel-finding-v1";
+var DEFAULT_SENTINEL_FINDING_RETENTION_DAYS = 30;
+var MAX_FINDING_BYTES = 256 * 1024;
+var SentinelFindingStore = class {
+  storage;
+  encryptionKey;
+  fortressId;
+  retentionDays;
+  now;
+  constructor(opts) {
+    this.storage = opts.storage;
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO2);
+    this.fortressId = opts.fortressId;
+    this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_SENTINEL_FINDING_RETENTION_DAYS;
+    this.now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /**
+   * Persist a finding. Truncates the operator-visible summary to
+   * SENTINEL_SUMMARY_MAX_CHARS so the dashboard render stays bounded.
+   * Returns the retention deadline so callers can audit it.
+   */
+  async saveFinding(finding) {
+    const truncated = {
+      ...finding,
+      fortress_id: this.fortressId,
+      summary: truncateSummary(finding.summary)
+    };
+    const retentionMs = this.retentionDays * 24 * 60 * 60 * 1e3;
+    const retentionUntil = new Date(this.now().getTime() + retentionMs);
+    const persisted = {
+      version: 1,
+      finding: truncated,
+      retention_until: retentionUntil.toISOString()
+    };
+    const aad = stringToBytes(finding.finding_id);
+    const plaintext = stringToBytes(JSON.stringify(persisted));
+    const envelope = encrypt(plaintext, this.encryptionKey, aad);
+    await this.storage.write(
+      SENTINEL_FINDING_NAMESPACE,
+      findingKey(finding.finding_id),
+      stringToBytes(JSON.stringify(envelope))
+    );
+    return persisted.retention_until;
+  }
+  /** Load a single finding by id, or null when absent / corrupted. */
+  async loadFinding(findingId) {
+    let raw;
+    try {
+      raw = await this.storage.read(
+        SENTINEL_FINDING_NAMESPACE,
+        findingKey(findingId)
+      );
+    } catch {
+      return null;
+    }
+    if (!raw) return null;
+    if (raw.length > MAX_FINDING_BYTES) return null;
+    return this.decode(findingId, raw);
+  }
+  /**
+   * List findings, newest first. Optional filters: since (ISO 8601),
+   * severity, sentinel_id, agent_id, limit. Default limit 100.
+   */
+  async listFindings(opts) {
+    const metas = await this.storage.list(
+      SENTINEL_FINDING_NAMESPACE,
+      SENTINEL_FINDING_KEY_PREFIX
+    );
+    const findings = [];
+    for (const meta of metas) {
+      const id = stripKeyPrefix2(meta.key);
+      if (id === null) continue;
+      const raw = await this.storage.read(
+        SENTINEL_FINDING_NAMESPACE,
+        meta.key
+      );
+      if (!raw) continue;
+      if (raw.length > MAX_FINDING_BYTES) continue;
+      const finding = await this.decode(id, raw);
+      if (!finding) continue;
+      if (opts?.since && finding.observed_at < opts.since) continue;
+      if (opts?.severity && finding.severity !== opts.severity) continue;
+      if (opts?.sentinelId && finding.sentinel_id !== opts.sentinelId) continue;
+      if (opts?.agentId && finding.agent_id !== opts.agentId) continue;
+      findings.push(finding);
+    }
+    findings.sort((a, b) => a.observed_at < b.observed_at ? 1 : -1);
+    const limit = opts?.limit ?? 100;
+    return findings.slice(0, limit);
+  }
+  /**
+   * Drop expired findings. Returns the count removed.
+   */
+  async pruneExpired(now) {
+    const cutoff = (now ?? this.now()).toISOString();
+    const metas = await this.storage.list(
+      SENTINEL_FINDING_NAMESPACE,
+      SENTINEL_FINDING_KEY_PREFIX
+    );
+    let pruned = 0;
+    for (const meta of metas) {
+      const id = stripKeyPrefix2(meta.key);
+      if (id === null) continue;
+      const raw = await this.storage.read(
+        SENTINEL_FINDING_NAMESPACE,
+        meta.key
+      );
+      if (!raw) continue;
+      try {
+        const aad = stringToBytes(id);
+        const envelope = JSON.parse(bytesToString(raw));
+        const plaintext = decrypt(envelope, this.encryptionKey, aad);
+        const persisted = JSON.parse(
+          bytesToString(plaintext)
+        );
+        if (persisted.retention_until <= cutoff) {
+          await this.storage.delete(SENTINEL_FINDING_NAMESPACE, meta.key);
+          pruned += 1;
+        }
+      } catch {
+      }
+    }
+    return { pruned };
+  }
+  async decode(findingId, raw) {
+    try {
+      const aad = stringToBytes(findingId);
+      const envelope = JSON.parse(bytesToString(raw));
+      const plaintext = decrypt(envelope, this.encryptionKey, aad);
+      const persisted = JSON.parse(
+        bytesToString(plaintext)
+      );
+      if (persisted.version !== 1) return null;
+      if (persisted.finding.finding_id !== findingId) return null;
+      if (persisted.finding.fortress_id !== this.fortressId) return null;
+      return persisted.finding;
+    } catch {
+      return null;
+    }
+  }
+};
+function findingKey(findingId) {
+  return `${SENTINEL_FINDING_KEY_PREFIX}${findingId}`;
+}
+function stripKeyPrefix2(key) {
+  if (!key.startsWith(SENTINEL_FINDING_KEY_PREFIX)) return null;
+  return key.slice(SENTINEL_FINDING_KEY_PREFIX.length);
+}
+function truncateSummary(summary) {
+  if (summary.length <= SENTINEL_SUMMARY_MAX_CHARS) return summary;
+  return `${summary.slice(0, SENTINEL_SUMMARY_MAX_CHARS - 3)}...`;
+}
+
+// src/sentinel/sentinel-registry.ts
+var SentinelRegistry = class {
+  catalog = /* @__PURE__ */ new Map();
+  subscribed = /* @__PURE__ */ new Map();
+  register(entry) {
+    if (this.catalog.has(entry.sentinelId)) {
+      throw new Error(
+        `sentinel-registry: ${entry.sentinelId} already registered`
+      );
+    }
+    this.catalog.set(entry.sentinelId, entry);
+  }
+  /**
+   * Available sentinels (catalog view). Operator UI lists this so the
+   * operator can pick what to subscribe to.
+   */
+  listCatalog() {
+    return [...this.catalog.values()].map((entry) => ({
+      sentinelId: entry.sentinelId,
+      description: entry.description
+    }));
+  }
+  /** Currently subscribed sentinel ids. */
+  listSubscribed() {
+    return [...this.subscribed.keys()];
+  }
+  /** Has the fortress opted into this sentinel? */
+  isSubscribed(sentinelId) {
+    return this.subscribed.has(sentinelId);
+  }
+  /**
+   * Subscribe a sentinel to a fortress context. Idempotent: a second
+   * subscribe call on an already-subscribed sentinel returns the
+   * existing instance without re-running `subscribe()`.
+   */
+  async subscribe(sentinelId, context) {
+    const existing = this.subscribed.get(sentinelId);
+    if (existing) return existing;
+    const entry = this.catalog.get(sentinelId);
+    if (!entry) {
+      throw new Error(`sentinel-registry: unknown sentinel ${sentinelId}`);
+    }
+    const instance = entry.factory();
+    await instance.subscribe(context);
+    this.subscribed.set(sentinelId, instance);
+    return instance;
+  }
+  /**
+   * Unsubscribe. Idempotent: unsubscribing an unsubscribed sentinel
+   * returns false without throwing. Returns true when an active
+   * subscription was torn down.
+   */
+  async unsubscribe(sentinelId) {
+    const instance = this.subscribed.get(sentinelId);
+    if (!instance) return false;
+    try {
+      await instance.unsubscribe();
+    } finally {
+      this.subscribed.delete(sentinelId);
+    }
+    return true;
+  }
+  /**
+   * Snapshot of subscribed sentinels for the dispatcher's tick path.
+   * Returned as an array so the dispatcher can iterate without holding
+   * the map under modification.
+   */
+  snapshotSubscribed() {
+    return [...this.subscribed.entries()].map(([sentinelId, sentinel]) => ({
+      sentinelId,
+      sentinel
+    }));
+  }
+  /**
+   * Tear down every subscription. Called by the dispatcher on
+   * fortress-shutdown. Best-effort: a failing unsubscribe does not
+   * abort the rest.
+   */
+  async unsubscribeAll() {
+    const ids = [...this.subscribed.keys()];
+    for (const id of ids) {
+      try {
+        await this.unsubscribe(id);
+      } catch {
+      }
+    }
+  }
+};
+var DEFAULT_TICK_INTERVAL_MS = 6e4;
+var SentinelDispatcher = class {
+  registry;
+  findingStore;
+  auditLog;
+  fortressId;
+  identityId;
+  now;
+  tickIntervalMs;
+  listeners = /* @__PURE__ */ new Set();
+  tickTimer = null;
+  tickInFlight = false;
+  constructor(deps) {
+    this.registry = deps.registry;
+    this.findingStore = deps.findingStore;
+    this.auditLog = deps.auditLog;
+    this.fortressId = deps.fortressId;
+    this.identityId = deps.identityId;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+    this.tickIntervalMs = deps.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS;
+  }
+  /** Read-only view of the registry. Convenience for route handlers. */
+  getRegistry() {
+    return this.registry;
+  }
+  /** Read-only view of the finding store. Convenience for route handlers. */
+  getFindingStore() {
+    return this.findingStore;
+  }
+  /**
+   * Subscribe an in-process listener. Returns an unsubscribe fn.
+   */
+  onEvent(listener) {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+  /**
+   * Subscribe a sentinel to this fortress + emit the
+   * `sentinel_subscribed` audit event. Wraps `registry.subscribe()` so
+   * the audit emission lives at the dispatcher boundary (the
+   * fortress-aware site).
+   */
+  async subscribeSentinel(sentinelId, contextOverrides) {
+    const context = {
+      fortressId: this.fortressId,
+      auditLog: this.auditLog,
+      now: this.now,
+      ...contextOverrides ?? {}
+    };
+    const sentinel = await this.registry.subscribe(sentinelId, context);
+    this.auditLog.append(
+      "l2",
+      SENTINEL_AUDIT_OPS.SUBSCRIBED,
+      this.identityId,
+      { sentinel_id: sentinelId, fortress_id: this.fortressId }
+    );
+    return sentinel;
+  }
+  /**
+   * Unsubscribe + emit `sentinel_unsubscribed`. Returns true when an
+   * active subscription was torn down. Audit fires only on successful
+   * removal.
+   */
+  async unsubscribeSentinel(sentinelId) {
+    const removed = await this.registry.unsubscribe(sentinelId);
+    if (removed) {
+      this.auditLog.append(
+        "l2",
+        SENTINEL_AUDIT_OPS.UNSUBSCRIBED,
+        this.identityId,
+        { sentinel_id: sentinelId, fortress_id: this.fortressId }
+      );
+    }
+    return removed;
+  }
+  /**
+   * Run one evaluation pass over every subscribed sentinel. Used by
+   * the auto-tick AND by tests that want a synchronous evaluation
+   * gate. Returns the findings produced this tick (already persisted
+   * + audit-logged + emitted).
+   */
+  async tick() {
+    if (this.tickInFlight) return [];
+    this.tickInFlight = true;
+    try {
+      const subscribed = this.registry.snapshotSubscribed();
+      const findings = [];
+      for (const { sentinelId, sentinel } of subscribed) {
+        try {
+          const tickFindings = await sentinel.evaluate();
+          for (const finding of tickFindings) {
+            const stamped = await this.routeFinding(sentinelId, finding);
+            findings.push(stamped);
+          }
+        } catch (err) {
+          const errorMessage = err instanceof Error ? err.message : String(err);
+          const observedAt = this.now().toISOString();
+          this.auditLog.append(
+            "l2",
+            SENTINEL_AUDIT_OPS.EVALUATION_FAILED,
+            this.identityId,
+            {
+              sentinel_id: sentinelId,
+              fortress_id: this.fortressId,
+              error_message: errorMessage
+            },
+            "failure"
+          );
+          this.emit({
+            type: "evaluation_failed",
+            sentinel_id: sentinelId,
+            error_message: errorMessage,
+            observed_at: observedAt
+          });
+        }
+      }
+      return findings;
+    } finally {
+      this.tickInFlight = false;
+    }
+  }
+  /**
+   * Start the auto-tick loop. No-op when tickIntervalMs is 0 or when
+   * already started. Tests typically leave auto-tick off and call
+   * `tick()` directly.
+   */
+  start() {
+    if (this.tickTimer !== null) return;
+    if (this.tickIntervalMs <= 0) return;
+    this.tickTimer = setInterval(() => {
+      void this.tick();
+    }, this.tickIntervalMs);
+    if (typeof this.tickTimer.unref === "function") {
+      this.tickTimer.unref();
+    }
+  }
+  /** Stop the auto-tick loop. Idempotent. */
+  stop() {
+    if (this.tickTimer === null) return;
+    clearInterval(this.tickTimer);
+    this.tickTimer = null;
+  }
+  /**
+   * Tear down every subscription + stop the tick loop. Called on
+   * fortress shutdown.
+   */
+  async dispose() {
+    this.stop();
+    await this.registry.unsubscribeAll();
+    this.listeners.clear();
+  }
+  async routeFinding(sentinelId, raw) {
+    const stamped = {
+      ...raw,
+      finding_id: raw.finding_id || randomUUID(),
+      sentinel_id: sentinelId,
+      fortress_id: this.fortressId,
+      observed_at: raw.observed_at || this.now().toISOString()
+    };
+    await this.findingStore.saveFinding(stamped);
+    this.auditLog.append(
+      "l2",
+      SENTINEL_AUDIT_OPS.FINDING_EMITTED,
+      this.identityId,
+      {
+        sentinel_id: sentinelId,
+        finding_id: stamped.finding_id,
+        severity: stamped.severity,
+        ...stamped.agent_id !== void 0 ? { agent_id: stamped.agent_id } : {},
+        evidence_audit_ids: stamped.evidence_audit_ids,
+        fortress_id: this.fortressId
+      }
+    );
+    this.emit({ type: "finding", finding: stamped });
+    return stamped;
+  }
+  emit(event) {
+    for (const listener of this.listeners) {
+      try {
+        listener(event);
+      } catch {
+      }
+    }
+  }
+};
+
+// src/sentinel/sentinel.ts
+var Sentinel = class {
+  /**
+   * Bind the sentinel to a fortress context. Called once on
+   * subscribe. Default implementation stores the context on `this`;
+   * sentinels that need additional setup (e.g. priming a baseline
+   * cache) override.
+   */
+  async subscribe(context) {
+    this.context = context;
+  }
+  /**
+   * Tear down. Default implementation clears the context; subclasses
+   * that hold timers or external handles override.
+   */
+  async unsubscribe() {
+    this.context = void 0;
+  }
+  context;
+  /** Internal helper: assert subscribed before evaluation. */
+  requireContext() {
+    if (!this.context) {
+      throw new Error(
+        `sentinel ${this.sentinelId}: evaluate() called before subscribe()`
+      );
+    }
+    return this.context;
+  }
+};
+
+// src/sentinel/sentinels/egress-volume-watcher.ts
+var EGRESS_VOLUME_SENTINEL_ID = "egress-volume";
+var WARN_SIGMA = 3;
+var ALERT_SIGMA = 6;
+var BASELINE_WINDOWS = 7;
+var QUERY_LIMIT = 1e4;
+var EgressVolumeWatcher = class extends Sentinel {
+  sentinelId = EGRESS_VOLUME_SENTINEL_ID;
+  description = "Watches outbound proxy-call volume per upstream server. Emits warn/alert when current 24h volume exceeds the rolling 7-day baseline by 3x or 6x standard deviations.";
+  /** Servers we have already produced an `info` baseline-established finding for. */
+  baselineEstablished = /* @__PURE__ */ new Set();
+  async evaluate() {
+    const ctx = this.requireContext();
+    const now = ctx.now();
+    const windowMs = 24 * 60 * 60 * 1e3;
+    const windowSpanMs = (BASELINE_WINDOWS + 1) * windowMs;
+    const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+    const queryResult = await ctx.auditLog.query({
+      since: sinceIso,
+      layer: "l2",
+      limit: QUERY_LIMIT
+    });
+    const entries = queryResult.entries.filter(isProxyCallAuditEntry);
+    const byServer = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      const server = proxyServerFromAuditEntry(entry);
+      if (server === null) continue;
+      const auditAge = now.getTime() - new Date(entry.timestamp).getTime();
+      if (auditAge < 0) continue;
+      const windowIdx = Math.floor(auditAge / windowMs);
+      if (windowIdx > BASELINE_WINDOWS) continue;
+      let snapshot = byServer.get(server);
+      if (!snapshot) {
+        snapshot = { windows: [] };
+        for (let i = 0; i <= BASELINE_WINDOWS; i += 1) {
+          snapshot.windows.push({ count: 0, evidence_audit_ids: [] });
+        }
+        byServer.set(server, snapshot);
+      }
+      const bucket = snapshot.windows[windowIdx];
+      bucket.count += 1;
+      if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+        bucket.evidence_audit_ids.push(`${entry.timestamp}:${entry.operation}`);
+      }
+    }
+    const findings = [];
+    for (const [server, snapshot] of byServer.entries()) {
+      const finding = this.evaluateServer(server, snapshot, now);
+      if (finding) findings.push(finding);
+    }
+    return findings;
+  }
+  /** Reset baseline-established memoization. Tests use this between runs. */
+  resetBaselineMemo() {
+    this.baselineEstablished.clear();
+  }
+  evaluateServer(server, snapshot, now) {
+    const currentWindow = snapshot.windows[0];
+    const baselineWindows = snapshot.windows.slice(1);
+    const populatedBaselineWindows = baselineWindows.filter((w) => w.count > 0).length;
+    if (populatedBaselineWindows < BASELINE_WINDOWS) {
+      if (this.baselineEstablished.has(server)) return null;
+      if (populatedBaselineWindows === 0 && currentWindow.count === 0) {
+        return null;
+      }
+      return null;
+    }
+    const baselineCounts = baselineWindows.map((w) => w.count);
+    const mean = baselineCounts.reduce((sum, c) => sum + c, 0) / baselineCounts.length;
+    const variance = baselineCounts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / baselineCounts.length;
+    const stddev = Math.sqrt(variance);
+    const wasEstablished = this.baselineEstablished.has(server);
+    this.baselineEstablished.add(server);
+    if (!wasEstablished) {
+      return {
+        finding_id: "",
+        sentinel_id: this.sentinelId,
+        severity: "info",
+        summary: `egress-volume baseline established for ${server}: mean ${mean.toFixed(1)} calls/24h, stddev ${stddev.toFixed(1)} (over ${BASELINE_WINDOWS} prior days).`,
+        details: {
+          server,
+          baseline_mean: mean,
+          baseline_stddev: stddev,
+          baseline_windows: baselineCounts,
+          current_count: currentWindow.count
+        },
+        observed_at: now.toISOString(),
+        evidence_audit_ids: [],
+        fortress_id: ""
+      };
+    }
+    const warnThreshold = mean + WARN_SIGMA * stddev;
+    const alertThreshold = mean + ALERT_SIGMA * stddev;
+    if (currentWindow.count > alertThreshold) {
+      return this.buildAnomalyFinding(
+        server,
+        snapshot,
+        mean,
+        stddev,
+        now,
+        "alert",
+        ALERT_SIGMA
+      );
+    }
+    if (currentWindow.count > warnThreshold) {
+      return this.buildAnomalyFinding(
+        server,
+        snapshot,
+        mean,
+        stddev,
+        now,
+        "warn",
+        WARN_SIGMA
+      );
+    }
+    return null;
+  }
+  buildAnomalyFinding(server, snapshot, mean, stddev, now, severity, sigma) {
+    const currentWindow = snapshot.windows[0];
+    const ratio = mean === 0 ? Infinity : currentWindow.count / mean;
+    const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+    const summary = `${server} egress is ${ratioStr}: ${currentWindow.count} calls in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma threshold.`;
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary,
+      details: {
+        server,
+        current_count: currentWindow.count,
+        baseline_mean: mean,
+        baseline_stddev: stddev,
+        sigma_threshold: sigma,
+        ratio
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: currentWindow.evidence_audit_ids,
+      fortress_id: ""
+    };
+  }
+};
+
+// src/sentinel/sentinels/cross-agent-chatter-watcher.ts
+var CROSS_AGENT_CHATTER_SENTINEL_ID = "cross-agent-chatter";
+var WARN_SIGMA2 = 3;
+var ALERT_SIGMA2 = 6;
+var BASELINE_WINDOWS2 = 7;
+var QUERY_LIMIT2 = 1e4;
+var MULTI_NEW_PARTNER_ALERT_THRESHOLD = 3;
+var OPERATOR_PSEUDO_AGENT = "operator";
+var HANDOFF_OP = "v1.1_local_handoff";
+var CROSS_HARNESS_OPS = /* @__PURE__ */ new Set([
+  "cross_harness_approval_aggregated",
+  "cross_harness_approval_resolved"
+]);
+function pairKey(sender, recipient) {
+  return `${sender}|${recipient}`;
+}
+function pairFromKey(key) {
+  const idx = key.indexOf("|");
+  return { sender: key.slice(0, idx), recipient: key.slice(idx + 1) };
+}
+var CrossAgentChatterWatcher = class extends Sentinel {
+  sentinelId = CROSS_AGENT_CHATTER_SENTINEL_ID;
+  description = "Watches inter-agent communication patterns. Surfaces per-pair rate spikes (3 or 6 sigma over the rolling 7-day baseline) and new-partner appearances. Escalates to alert when one source agent picks up 3 or more new partners in 24h (lateral-movement shape).";
+  /** Pair keys we have already produced a baseline-established info finding for. */
+  baselineEstablished = /* @__PURE__ */ new Set();
+  async evaluate() {
+    const ctx = this.requireContext();
+    const now = ctx.now();
+    const windowMs = 24 * 60 * 60 * 1e3;
+    const windowSpanMs = (BASELINE_WINDOWS2 + 1) * windowMs;
+    const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+    const queryResult = await ctx.auditLog.query({
+      since: sinceIso,
+      layer: "l2",
+      limit: QUERY_LIMIT2
+    });
+    const events = extractInterAgentEvents(queryResult.entries);
+    const byPair = /* @__PURE__ */ new Map();
+    for (const event of events) {
+      const auditAgeMs = now.getTime() - event.timestampMs;
+      if (auditAgeMs < 0) continue;
+      const windowIdx = Math.floor(auditAgeMs / windowMs);
+      if (windowIdx > BASELINE_WINDOWS2) continue;
+      const key = pairKey(event.sender, event.recipient);
+      let snap = byPair.get(key);
+      if (!snap) {
+        snap = { windows: [] };
+        for (let i = 0; i <= BASELINE_WINDOWS2; i += 1) {
+          snap.windows.push({ count: 0, evidence_audit_ids: [] });
+        }
+        byPair.set(key, snap);
+      }
+      const bucket = snap.windows[windowIdx];
+      bucket.count += 1;
+      if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+        bucket.evidence_audit_ids.push(event.auditId);
+      }
+    }
+    const findings = [];
+    for (const [key, snap] of byPair.entries()) {
+      const finding = this.evaluatePair(key, snap, now);
+      if (finding) findings.push(finding);
+    }
+    const newPartnersBySource = computeNewPartners(byPair);
+    for (const [source, partners] of newPartnersBySource.entries()) {
+      const finding = this.buildNewPartnerFinding(source, partners, now);
+      if (finding) findings.push(finding);
+    }
+    return findings;
+  }
+  /** Reset baseline-established memoization. Tests use this between runs. */
+  resetBaselineMemo() {
+    this.baselineEstablished.clear();
+  }
+  evaluatePair(key, snap, now) {
+    const currentWindow = snap.windows[0];
+    const baselineWindows = snap.windows.slice(1);
+    const populated = baselineWindows.filter((w) => w.count > 0).length;
+    if (populated < BASELINE_WINDOWS2) {
+      return null;
+    }
+    const counts = baselineWindows.map((w) => w.count);
+    const mean = counts.reduce((s, c) => s + c, 0) / counts.length;
+    const variance = counts.reduce((s, c) => s + (c - mean) ** 2, 0) / counts.length;
+    const stddev = Math.sqrt(variance);
+    const wasEstablished = this.baselineEstablished.has(key);
+    this.baselineEstablished.add(key);
+    if (!wasEstablished) {
+      const pair = pairFromKey(key);
+      return {
+        finding_id: "",
+        sentinel_id: this.sentinelId,
+        severity: "info",
+        summary: `cross-agent-chatter baseline established for ${pair.sender} -> ${pair.recipient}: mean ${mean.toFixed(1)} msgs/24h, stddev ${stddev.toFixed(1)} (over ${BASELINE_WINDOWS2} prior days).`,
+        details: {
+          sender_agent_id: pair.sender,
+          recipient_agent_id: pair.recipient,
+          baseline_mean: mean,
+          baseline_stddev: stddev,
+          baseline_windows: counts,
+          current_count: currentWindow.count
+        },
+        observed_at: now.toISOString(),
+        evidence_audit_ids: [],
+        fortress_id: ""
+      };
+    }
+    const warnThreshold = mean + WARN_SIGMA2 * stddev;
+    const alertThreshold = mean + ALERT_SIGMA2 * stddev;
+    if (currentWindow.count > alertThreshold) {
+      return this.buildRateSpike(key, snap, mean, stddev, now, "alert", ALERT_SIGMA2);
+    }
+    if (currentWindow.count > warnThreshold) {
+      return this.buildRateSpike(key, snap, mean, stddev, now, "warn", WARN_SIGMA2);
+    }
+    return null;
+  }
+  buildRateSpike(key, snap, mean, stddev, now, severity, sigma) {
+    const pair = pairFromKey(key);
+    const cur = snap.windows[0];
+    const ratio = mean === 0 ? Infinity : cur.count / mean;
+    const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+    const summary = `${pair.sender} -> ${pair.recipient} chatter rate is ${ratioStr}: ${cur.count} cross-agent messages in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma threshold.`;
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary,
+      details: {
+        sender_agent_id: pair.sender,
+        recipient_agent_id: pair.recipient,
+        current_count: cur.count,
+        baseline_mean: mean,
+        baseline_stddev: stddev,
+        sigma_threshold: sigma,
+        ratio
+      },
+      observed_at: now.toISOString(),
+      agent_id: pair.sender,
+      evidence_audit_ids: cur.evidence_audit_ids,
+      fortress_id: ""
+    };
+  }
+  buildNewPartnerFinding(source, info, now) {
+    if (info.partners.length === 0) return null;
+    const severity = info.partners.length >= MULTI_NEW_PARTNER_ALERT_THRESHOLD ? "alert" : "warn";
+    const partnerList = info.partners.join(", ");
+    const baselinePartnerList = info.priorPartners.length === 0 ? "no prior partners" : info.priorPartners.join(", ");
+    const summary = severity === "alert" ? `${source} began communicating with ${info.partners.length} new partners in 24h (${partnerList}). Prior partners: ${baselinePartnerList}. Multi-new-partner pattern crossed alert threshold (>=${MULTI_NEW_PARTNER_ALERT_THRESHOLD}).` : `${source} began communicating with a new partner today: ${partnerList}. Prior partners: ${baselinePartnerList}.`;
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary,
+      details: {
+        sender_agent_id: source,
+        new_partners: info.partners,
+        prior_partners: info.priorPartners,
+        new_partner_count: info.partners.length,
+        multi_new_partner_threshold: MULTI_NEW_PARTNER_ALERT_THRESHOLD
+      },
+      observed_at: now.toISOString(),
+      agent_id: source,
+      evidence_audit_ids: info.evidenceAuditIds,
+      fortress_id: ""
+    };
+  }
+};
+function computeNewPartners(byPair) {
+  const currentBySource = /* @__PURE__ */ new Map();
+  const priorBySource = /* @__PURE__ */ new Map();
+  for (const [key, snap] of byPair.entries()) {
+    const { sender, recipient } = pairFromKey(key);
+    if (snap.windows[0] && snap.windows[0].count > 0) {
+      let recipMap = currentBySource.get(sender);
+      if (!recipMap) {
+        recipMap = /* @__PURE__ */ new Map();
+        currentBySource.set(sender, recipMap);
+      }
+      recipMap.set(recipient, snap.windows[0].evidence_audit_ids);
+    }
+    const priorTouched = snap.windows.slice(1).some((w) => w.count > 0);
+    if (priorTouched) {
+      let set = priorBySource.get(sender);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        priorBySource.set(sender, set);
+      }
+      set.add(recipient);
+    }
+  }
+  const out = /* @__PURE__ */ new Map();
+  for (const [sender, recipMap] of currentBySource.entries()) {
+    const prior = priorBySource.get(sender) ?? /* @__PURE__ */ new Set();
+    if (prior.size === 0) {
+      continue;
+    }
+    const newPartners = [];
+    const evidence = [];
+    for (const [recipient, recipEvidence] of recipMap.entries()) {
+      if (!prior.has(recipient)) {
+        newPartners.push(recipient);
+        for (const id of recipEvidence) {
+          if (evidence.length < 50) evidence.push(id);
+        }
+      }
+    }
+    if (newPartners.length === 0) continue;
+    newPartners.sort();
+    out.set(sender, {
+      partners: newPartners,
+      priorPartners: [...prior].sort(),
+      evidenceAuditIds: evidence
+    });
+  }
+  return out;
+}
+function extractInterAgentEvents(entries) {
+  const out = [];
+  for (const entry of entries) {
+    const op = entry.operation;
+    if (op === HANDOFF_OP) {
+      const details = entry.details;
+      const sender = optionalString(details, "sender_agent_id");
+      const recipient = optionalString(details, "recipient_agent_id");
+      if (!sender || !recipient || sender === recipient) continue;
+      out.push({
+        sender,
+        recipient,
+        timestampMs: Date.parse(entry.timestamp),
+        auditId: `${entry.timestamp}:${entry.operation}`
+      });
+      continue;
+    }
+    if (CROSS_HARNESS_OPS.has(op)) {
+      const details = entry.details;
+      const sender = optionalString(details, "source_harness") ?? optionalString(details, "source_agent_id");
+      if (!sender) continue;
+      out.push({
+        sender,
+        recipient: OPERATOR_PSEUDO_AGENT,
+        timestampMs: Date.parse(entry.timestamp),
+        auditId: `${entry.timestamp}:${entry.operation}`
+      });
+    }
+  }
+  return out;
+}
+function optionalString(details, key) {
+  if (!details) return null;
+  const value = details[key];
+  if (typeof value !== "string" || value.length === 0) return null;
+  return value;
+}
+
+// src/sentinel/sentinels/credential-usage-watcher.ts
+var CREDENTIAL_USAGE_SENTINEL_ID = "credential-usage";
+var WARN_SIGMA3 = 3;
+var ALERT_SIGMA3 = 6;
+var NEW_PAIR_ALERT_COUNT = 3;
+var BASELINE_WINDOWS3 = 7;
+var QUERY_LIMIT3 = 2e4;
+var BROKER_SECRET_READ_OP = "broker_secret_read";
+var BROKER_TOKEN_ISSUED_OP = "broker_token_issued";
+var CredentialUsageWatcher = class extends Sentinel {
+  sentinelId = CREDENTIAL_USAGE_SENTINEL_ID;
+  description = "Watches per-agent credential reads. Emits warn/alert when a specific (agent, secret) usage rate exceeds the rolling 7-day baseline, or when an agent uses an unfamiliar combination of secrets together in one 24h window.";
+  /**
+   * Memoization of (agent, secret) pairs whose baseline has been
+   * established. Same shape Phi-1 uses to avoid re-emitting `info`
+   * findings on every tick after a baseline first establishes.
+   *
+   * Phi-2 deliberately does NOT emit `info` findings: per-pair
+   * baselines on a busy fortress would be too noisy. The memo is
+   * kept here for parity with Phi-1's reset hook so tests can clear
+   * state between runs.
+   */
+  baselineEstablished = /* @__PURE__ */ new Set();
+  /** Reset memoization. Tests use this between runs. */
+  resetBaselineMemo() {
+    this.baselineEstablished.clear();
+  }
+  async evaluate() {
+    const ctx = this.requireContext();
+    const now = ctx.now();
+    const windowMs = 24 * 60 * 60 * 1e3;
+    const windowSpanMs = (BASELINE_WINDOWS3 + 1) * windowMs;
+    const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+    const queryResult = await ctx.auditLog.query({
+      since: sinceIso,
+      layer: "l3",
+      limit: QUERY_LIMIT3
+    });
+    const entries = queryResult.entries.filter(isCredentialAuditEntry);
+    const byPair = /* @__PURE__ */ new Map();
+    const byAgent = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      const agentId = extractAgentId(entry);
+      const secretId = extractSecretId(entry);
+      if (agentId === null || secretId === null) continue;
+      const auditAge = now.getTime() - new Date(entry.timestamp).getTime();
+      if (auditAge < 0) continue;
+      const windowIdx = Math.floor(auditAge / windowMs);
+      if (windowIdx > BASELINE_WINDOWS3) continue;
+      const pairKey2 = `${agentId}\0${secretId}`;
+      let pairSnapshot = byPair.get(pairKey2);
+      if (!pairSnapshot) {
+        pairSnapshot = {
+          windows: Array.from({ length: BASELINE_WINDOWS3 + 1 }, () => ({
+            count: 0,
+            evidence_audit_ids: []
+          }))
+        };
+        byPair.set(pairKey2, pairSnapshot);
+      }
+      const bucket = pairSnapshot.windows[windowIdx];
+      bucket.count += 1;
+      if (windowIdx === 0 && bucket.evidence_audit_ids.length < 50) {
+        bucket.evidence_audit_ids.push(
+          `${entry.timestamp}:${entry.operation}`
+        );
+      }
+      let agentState = byAgent.get(agentId);
+      if (!agentState) {
+        agentState = {
+          currentSecrets: /* @__PURE__ */ new Set(),
+          currentEvidence: [],
+          baselineSecretsByWindow: Array.from(
+            { length: BASELINE_WINDOWS3 },
+            () => /* @__PURE__ */ new Set()
+          ),
+          baselinePopulatedWindows: 0
+        };
+        byAgent.set(agentId, agentState);
+      }
+      if (windowIdx === 0) {
+        agentState.currentSecrets.add(secretId);
+        if (agentState.currentEvidence.length < 50) {
+          agentState.currentEvidence.push(
+            `${entry.timestamp}:${entry.operation}`
+          );
+        }
+      } else {
+        const baselineIdx = windowIdx - 1;
+        agentState.baselineSecretsByWindow[baselineIdx].add(secretId);
+      }
+    }
+    const findings = [];
+    for (const [pairKey2, snapshot] of byPair.entries()) {
+      const [agentId, secretId] = pairKey2.split("\0");
+      const finding = this.evaluateRateSpike(
+        agentId,
+        secretId,
+        snapshot,
+        now
+      );
+      if (finding) findings.push(finding);
+    }
+    for (const [agentId, agentState] of byAgent.entries()) {
+      agentState.baselinePopulatedWindows = agentState.baselineSecretsByWindow.filter((s) => s.size > 0).length;
+      const finding = this.evaluateNewPairs(agentId, agentState, now);
+      if (finding) findings.push(finding);
+    }
+    return findings;
+  }
+  evaluateRateSpike(agentId, secretId, snapshot, now) {
+    const currentWindow = snapshot.windows[0];
+    const baselineWindows = snapshot.windows.slice(1);
+    const populated = baselineWindows.filter((w) => w.count > 0).length;
+    if (populated < BASELINE_WINDOWS3) {
+      return null;
+    }
+    const counts = baselineWindows.map((w) => w.count);
+    const mean = counts.reduce((sum, c) => sum + c, 0) / counts.length;
+    const variance = counts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / counts.length;
+    const stddev = Math.sqrt(variance);
+    const pairKey2 = `${agentId}\0${secretId}`;
+    this.baselineEstablished.add(pairKey2);
+    const warnThreshold = mean + WARN_SIGMA3 * stddev;
+    const alertThreshold = mean + ALERT_SIGMA3 * stddev;
+    if (currentWindow.count > alertThreshold) {
+      return this.buildRateFinding(
+        agentId,
+        secretId,
+        currentWindow,
+        mean,
+        stddev,
+        now,
+        "alert",
+        ALERT_SIGMA3
+      );
+    }
+    if (currentWindow.count > warnThreshold) {
+      return this.buildRateFinding(
+        agentId,
+        secretId,
+        currentWindow,
+        mean,
+        stddev,
+        now,
+        "warn",
+        WARN_SIGMA3
+      );
+    }
+    return null;
+  }
+  buildRateFinding(agentId, secretId, currentWindow, mean, stddev, now, severity, sigma) {
+    const ratio = mean === 0 ? Number.POSITIVE_INFINITY : currentWindow.count / mean;
+    const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+    const summary = `${agentId} agent used ${secretId} ${currentWindow.count} times in last 24h, baseline ${mean.toFixed(1)} +/- ${stddev.toFixed(1)} (${ratioStr}). Crossed +${sigma} sigma threshold.`;
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      agent_id: agentId,
+      summary,
+      details: {
+        agent_id: agentId,
+        secret_id: secretId,
+        current_count: currentWindow.count,
+        baseline_mean: mean,
+        baseline_stddev: stddev,
+        sigma_threshold: sigma,
+        ratio: Number.isFinite(ratio) ? ratio : null
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: currentWindow.evidence_audit_ids,
+      fortress_id: ""
+    };
+  }
+  evaluateNewPairs(agentId, state, now) {
+    if (state.baselinePopulatedWindows < BASELINE_WINDOWS3) {
+      return null;
+    }
+    if (state.currentSecrets.size < 2) return null;
+    const currentPairs = enumerateUnorderedPairs(state.currentSecrets);
+    const historicalPairs = /* @__PURE__ */ new Set();
+    for (const secretSet of state.baselineSecretsByWindow) {
+      for (const pair of enumerateUnorderedPairs(secretSet)) {
+        historicalPairs.add(pair);
+      }
+    }
+    const newPairs = [];
+    for (const pair of currentPairs) {
+      if (historicalPairs.has(pair)) continue;
+      const [a, b] = pair.split("\0");
+      newPairs.push([a, b]);
+    }
+    if (newPairs.length === 0) return null;
+    const severity = newPairs.length >= NEW_PAIR_ALERT_COUNT ? "alert" : "warn";
+    const summary = buildNewPairSummary(agentId, newPairs);
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      agent_id: agentId,
+      summary,
+      details: {
+        agent_id: agentId,
+        new_pairs: newPairs,
+        new_pair_count: newPairs.length,
+        historical_pair_count: historicalPairs.size,
+        current_pair_count: currentPairs.size
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: state.currentEvidence,
+      fortress_id: ""
+    };
+  }
+};
+function isCredentialAuditEntry(entry) {
+  if (entry.result !== "success") return false;
+  return entry.operation === BROKER_SECRET_READ_OP || entry.operation === BROKER_TOKEN_ISSUED_OP;
+}
+function extractAgentId(entry) {
+  const details = entry.details;
+  if (!details) return null;
+  const agent = details["agent"];
+  return typeof agent === "string" && agent.length > 0 ? agent : null;
+}
+function extractSecretId(entry) {
+  const details = entry.details;
+  if (!details) return null;
+  const secret = details["secret"];
+  return typeof secret === "string" && secret.length > 0 ? secret : null;
+}
+function enumerateUnorderedPairs(secrets) {
+  const out = /* @__PURE__ */ new Set();
+  const arr = [...secrets].sort();
+  for (let i = 0; i < arr.length; i += 1) {
+    for (let j = i + 1; j < arr.length; j += 1) {
+      out.add(`${arr[i]}\0${arr[j]}`);
+    }
+  }
+  return out;
+}
+function buildNewPairSummary(agentId, newPairs) {
+  const first = newPairs[0];
+  if (newPairs.length === 1) {
+    return `${agentId} agent used ${first[0]} and ${first[1]} together for the first time today. This combination does not appear in historical sessions.`;
+  }
+  return `${agentId} agent introduced ${newPairs.length} unfamiliar credential pairs in the last 24h. First: ${first[0]} + ${first[1]}. This pattern is new for this agent.`;
+}
+
+// src/sentinel/sentinels/suspicious-tool-call-detector.ts
+var SUSPICIOUS_TOOL_CALL_SENTINEL_ID = "suspicious-tool-call";
+var GATE_PREFIXES = [
+  "gate_allow:",
+  "gate_allow_proxy:",
+  "gate_deny:",
+  "gate_unclassified:"
+];
+var WARN_SIGMA4 = 3;
+var ALERT_SIGMA4 = 6;
+var BASELINE_WINDOWS4 = 7;
+var ALERT_NOVEL_COMBINATIONS = 2;
+var TASK_WINDOW_MS = 60 * 60 * 1e3;
+var TRUNCATION_WARN_THRESHOLD = 5;
+var QUERY_LIMIT4 = 1e4;
+var SIGNATURE_PATTERNS = {
+  /** >=5 percent-encoded sequences in a single visible value. */
+  urlEncodedThreshold: 5,
+  /** >=40 contiguous base64 chars in a single visible value. */
+  base64MinRun: 40,
+  /** Shell metacharacter set. */
+  shellMetacharRegex: /(?:&&|\|\||;|\$\(|`|\|\s)/
+};
+var SuspiciousToolCallDetector = class extends Sentinel {
+  sentinelId = SUSPICIOUS_TOOL_CALL_SENTINEL_ID;
+  description = "Surfaces tool calls whose argument shape, call frequency, or permission combination looks unusual for the fortress's recent history. Rule-based heuristics with optional LLM-assist on ambiguous matches.";
+  /** Servers we have already produced an `info` baseline-established finding for. */
+  baselineEstablished = /* @__PURE__ */ new Set();
+  /** Memoized known novel-combination keys (sorted-tools-csv). */
+  knownCombinations = /* @__PURE__ */ new Set();
+  /** Tasks observed where a novel combination already produced a finding. */
+  novelCombinationsReported = /* @__PURE__ */ new Set();
+  async evaluate() {
+    const ctx = this.requireContext();
+    const now = ctx.now();
+    const dayMs = 24 * 60 * 60 * 1e3;
+    const windowSpanMs = (BASELINE_WINDOWS4 + 1) * dayMs;
+    const sinceIso = new Date(now.getTime() - windowSpanMs).toISOString();
+    const queryResult = await ctx.auditLog.query({
+      since: sinceIso,
+      layer: "l2",
+      limit: QUERY_LIMIT4
+    });
+    const observations = [];
+    for (const entry of queryResult.entries) {
+      const obs = this.observationFromEntry(entry);
+      if (obs && obs.ts <= now.getTime()) observations.push(obs);
+    }
+    if (observations.length === 0) return [];
+    const findings = [];
+    const layerAFindings = await this.runLayerA(observations, now, ctx);
+    findings.push(...layerAFindings);
+    const layerBFindings = this.runLayerB(observations, now);
+    findings.push(...layerBFindings);
+    const layerCFindings = this.runLayerC(observations, now);
+    findings.push(...layerCFindings);
+    return findings;
+  }
+  /** Reset memoization between test runs. Mirrors Phi-1's reset hook. */
+  resetMemo() {
+    this.baselineEstablished.clear();
+    this.knownCombinations.clear();
+    this.novelCombinationsReported.clear();
+  }
+  // ── Layer A ───────────────────────────────────────────────────────
+  async runLayerA(observations, now, ctx) {
+    const dayMs = 24 * 60 * 60 * 1e3;
+    const recent = observations.filter(
+      (o) => now.getTime() - o.ts <= dayMs
+    );
+    if (recent.length === 0) return [];
+    const findings = [];
+    const historical = observations.filter(
+      (o) => now.getTime() - o.ts > dayMs
+    );
+    const perTool = /* @__PURE__ */ new Map();
+    const ensureTool = (tool) => {
+      let w = perTool.get(tool);
+      if (!w) {
+        w = {
+          windows: Array.from({ length: BASELINE_WINDOWS4 + 1 }, () => ({
+            count: 0,
+            evidenceIds: []
+          })),
+          knownSignatures: /* @__PURE__ */ new Set()
+        };
+        perTool.set(tool, w);
+      }
+      return w;
+    };
+    for (const o of historical) {
+      ensureTool(o.tool).knownSignatures.add(this.signatureOf(o.argsSummary));
+    }
+    const classify = this.classifyHandle(ctx);
+    for (const obs of recent) {
+      const matches = this.matchSignatures(obs);
+      if (matches.length === 0) continue;
+      const ambiguous = matches.every((m) => m === "base64_chunk");
+      if (ambiguous && classify) {
+        const verdict = await this.consultClassifier(classify, obs);
+        if (verdict !== "suspicious") continue;
+      }
+      findings.push(
+        this.buildLayerAFinding(obs, matches, now, classify ? "llm-assist" : "rule-based")
+      );
+    }
+    for (const obs of recent) {
+      const tool = obs.tool;
+      const sig = this.signatureOf(obs.argsSummary);
+      const known = perTool.get(tool)?.knownSignatures;
+      if (known && known.size > 0 && !known.has(sig)) {
+        findings.push(
+          this.buildNovelSignatureFinding(obs, sig, now)
+        );
+      }
+    }
+    return findings;
+  }
+  matchSignatures(obs) {
+    const out = [];
+    const truncCount = countTruncatedValues(obs.argsSummary);
+    if (truncCount >= TRUNCATION_WARN_THRESHOLD) out.push("truncation_burst");
+    let urlBlob = false;
+    let base64Blob = false;
+    let shellChars = false;
+    for (const value of Object.values(obs.argsSummary)) {
+      if (typeof value !== "string") continue;
+      if (countUrlEncoded(value) >= SIGNATURE_PATTERNS.urlEncodedThreshold) {
+        urlBlob = true;
+      }
+      if (longestBase64Run(value) >= SIGNATURE_PATTERNS.base64MinRun) {
+        base64Blob = true;
+      }
+      if (SIGNATURE_PATTERNS.shellMetacharRegex.test(value)) {
+        shellChars = true;
+      }
+    }
+    if (urlBlob) out.push("url_encoded_blob");
+    if (base64Blob) out.push("base64_chunk");
+    if (shellChars) out.push("shell_metachar");
+    return out;
+  }
+  signatureOf(argsSummary) {
+    return Object.keys(argsSummary).sort().join(",");
+  }
+  buildLayerAFinding(obs, matches, now, detectionPath) {
+    const severity = matches.includes("shell_metachar") ? "alert" : "warn";
+    const summary = `${obs.tool}: tool-call argument matches signature ${matches.join(", ")} (${detectionPath}).`;
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary: truncateSummary2(summary),
+      details: {
+        layer: "A",
+        tool: obs.tool,
+        proxy: obs.proxy,
+        signatures: matches,
+        detection_path: detectionPath
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: [`${obs.entry.timestamp}:${obs.entry.operation}`],
+      fortress_id: ""
     };
-    const aad = stringToBytes(aggregatorId);
-    const plaintext = stringToBytes(JSON.stringify(bundle));
-    const envelope = encrypt(plaintext, this.encryptionKey, aad);
-    await this.storage.write(
-      AGGREGATOR_PAYLOAD_NAMESPACE,
-      payloadKey(aggregatorId),
-      stringToBytes(JSON.stringify(envelope))
-    );
-    return bundle.retention_until;
   }
-  /**
-   * Read the persisted payload for the aggregator_id. Returns null if no
-   * bundle exists, the bundle is corrupted, or AAD binding fails.
-   */
-  async loadPayload(aggregatorId) {
-    const key = payloadKey(aggregatorId);
-    let raw;
-    try {
-      raw = await this.storage.read(AGGREGATOR_PAYLOAD_NAMESPACE, key);
-    } catch {
+  buildNovelSignatureFinding(obs, signature, now) {
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity: "warn",
+      summary: truncateSummary2(
+        `${obs.tool}: novel argument-key signature observed (${signature || "<no-args>"}).`
+      ),
+      details: {
+        layer: "A",
+        tool: obs.tool,
+        proxy: obs.proxy,
+        signatures: ["novel_signature"],
+        detection_path: "rule-based",
+        novel_signature: signature
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: [`${obs.entry.timestamp}:${obs.entry.operation}`],
+      fortress_id: ""
+    };
+  }
+  // ── Layer B ───────────────────────────────────────────────────────
+  runLayerB(observations, now) {
+    const dayMs = 24 * 60 * 60 * 1e3;
+    const perTool = /* @__PURE__ */ new Map();
+    for (const obs of observations) {
+      const ageMs = now.getTime() - obs.ts;
+      if (ageMs < 0) continue;
+      const windowIdx = Math.floor(ageMs / dayMs);
+      if (windowIdx > BASELINE_WINDOWS4) continue;
+      let w = perTool.get(obs.tool);
+      if (!w) {
+        w = {
+          windows: Array.from({ length: BASELINE_WINDOWS4 + 1 }, () => ({
+            count: 0,
+            evidenceIds: []
+          })),
+          knownSignatures: /* @__PURE__ */ new Set()
+        };
+        perTool.set(obs.tool, w);
+      }
+      const bucket = w.windows[windowIdx];
+      bucket.count += 1;
+      if (windowIdx === 0 && bucket.evidenceIds.length < 50) {
+        bucket.evidenceIds.push(`${obs.entry.timestamp}:${obs.entry.operation}`);
+      }
+    }
+    const findings = [];
+    for (const [tool, w] of perTool.entries()) {
+      const f = this.evaluateToolFrequency(tool, w, now);
+      if (f) findings.push(f);
+    }
+    return findings;
+  }
+  evaluateToolFrequency(tool, w, now) {
+    const current = w.windows[0];
+    const baseline = w.windows.slice(1);
+    const populated = baseline.filter((b) => b.count > 0).length;
+    if (populated < BASELINE_WINDOWS4) {
+      this.baselineEstablished.add(tool);
       return null;
     }
-    if (!raw) return null;
-    if (raw.length > MAX_BUNDLE_BYTES2) return null;
-    try {
-      const envelope = JSON.parse(bytesToString(raw));
-      const aad = stringToBytes(aggregatorId);
-      const plaintext = decrypt(envelope, this.encryptionKey, aad);
-      const parsed = JSON.parse(
-        bytesToString(plaintext)
+    const counts = baseline.map((b) => b.count);
+    const mean = counts.reduce((sum, c) => sum + c, 0) / counts.length;
+    const variance = counts.reduce((sum, c) => sum + (c - mean) ** 2, 0) / counts.length;
+    const stddev = Math.sqrt(variance);
+    const wasEstablished = this.baselineEstablished.has(tool);
+    this.baselineEstablished.add(tool);
+    if (!wasEstablished) {
+      return {
+        finding_id: "",
+        sentinel_id: this.sentinelId,
+        severity: "info",
+        summary: truncateSummary2(
+          `${tool}: tool-call baseline established (mean ${mean.toFixed(1)} calls/24h, stddev ${stddev.toFixed(1)} over ${BASELINE_WINDOWS4} prior days).`
+        ),
+        details: {
+          layer: "B",
+          tool,
+          baseline_mean: mean,
+          baseline_stddev: stddev,
+          baseline_counts: counts,
+          current_count: current.count
+        },
+        observed_at: now.toISOString(),
+        evidence_audit_ids: [],
+        fortress_id: ""
+      };
+    }
+    const warnT = mean + WARN_SIGMA4 * stddev;
+    const alertT = mean + ALERT_SIGMA4 * stddev;
+    if (current.count > alertT) {
+      return this.buildLayerBAnomaly(
+        tool,
+        current,
+        mean,
+        stddev,
+        ALERT_SIGMA4,
+        "alert",
+        now
+      );
+    }
+    if (current.count > warnT) {
+      return this.buildLayerBAnomaly(
+        tool,
+        current,
+        mean,
+        stddev,
+        WARN_SIGMA4,
+        "warn",
+        now
       );
-      if (parsed.version !== 1) return null;
-      if (parsed.aggregator_id !== aggregatorId) return null;
-      return parsed.payload;
-    } catch {
-      return null;
     }
+    return null;
   }
-  /**
-   * Delete the persisted payload. Returns true when a bundle was removed,
-   * false when none existed.
-   */
-  async deletePayload(aggregatorId) {
-    const key = payloadKey(aggregatorId);
-    const existed = await this.storage.exists(
-      AGGREGATOR_PAYLOAD_NAMESPACE,
-      key
-    );
-    if (!existed) return false;
-    try {
-      await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, key);
-    } catch {
-      return false;
+  buildLayerBAnomaly(tool, current, mean, stddev, sigma, severity, now) {
+    const ratio = mean === 0 ? Infinity : current.count / mean;
+    const ratioStr = Number.isFinite(ratio) ? `${ratio.toFixed(1)}x normal` : "no prior baseline";
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary: truncateSummary2(
+        `${tool}: tool-call rate is ${ratioStr}: ${current.count} calls in last 24h, baseline ${mean.toFixed(1)} (stddev ${stddev.toFixed(1)}). Crossed +${sigma} sigma.`
+      ),
+      details: {
+        layer: "B",
+        tool,
+        current_count: current.count,
+        baseline_mean: mean,
+        baseline_stddev: stddev,
+        sigma_threshold: sigma,
+        ratio
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: current.evidenceIds,
+      fortress_id: ""
+    };
+  }
+  // ── Layer C ───────────────────────────────────────────────────────
+  runLayerC(observations, now) {
+    const dayMs = 24 * 60 * 60 * 1e3;
+    const sorted = [...observations].sort((a, b) => a.ts - b.ts);
+    const tasks = [];
+    for (const obs of sorted) {
+      const last = tasks[tasks.length - 1];
+      if (!last || obs.ts - last.startTs > TASK_WINDOW_MS) {
+        tasks.push({ startTs: obs.ts, tools: [obs.tool] });
+        continue;
+      }
+      if (!last.tools.includes(obs.tool)) last.tools.push(obs.tool);
     }
-    return true;
+    const recentTaskKeys = [];
+    const findings = [];
+    for (const task of tasks) {
+      const ageMs = now.getTime() - task.startTs;
+      const key = task.tools.slice().sort().join(",");
+      if (ageMs > dayMs) {
+        this.knownCombinations.add(key);
+        continue;
+      }
+      if (task.tools.length < 2) continue;
+      if (!this.knownCombinations.has(key)) {
+        this.knownCombinations.add(key);
+        if (!this.novelCombinationsReported.has(key)) {
+          this.novelCombinationsReported.add(key);
+          recentTaskKeys.push(key);
+          findings.push(
+            this.buildLayerCFinding(task, key, "warn", now)
+          );
+        }
+      }
+    }
+    if (recentTaskKeys.length >= ALERT_NOVEL_COMBINATIONS) {
+      const aggregate = {
+        finding_id: "",
+        sentinel_id: this.sentinelId,
+        severity: "alert",
+        summary: truncateSummary2(
+          `multi-novel-combination: ${recentTaskKeys.length} novel tool-permission combinations within last 24h.`
+        ),
+        details: {
+          layer: "C",
+          novel_combinations: recentTaskKeys
+        },
+        observed_at: now.toISOString(),
+        evidence_audit_ids: [],
+        fortress_id: ""
+      };
+      findings.push(aggregate);
+    }
+    return findings;
   }
-  /**
-   * Drop expired payload bundles. Returns the count of bundles pruned.
-   * Caller wires this into the cocoon-unlock initialization path.
-   */
-  async pruneExpired(now) {
-    const cutoff = (now ?? /* @__PURE__ */ new Date()).toISOString();
-    const entries = await this.storage.list(
-      AGGREGATOR_PAYLOAD_NAMESPACE,
-      AGGREGATOR_PAYLOAD_KEY_PREFIX
-    );
-    let pruned = 0;
-    for (const meta of entries) {
-      const aggregatorId = stripKeyPrefix(meta.key);
-      if (aggregatorId === null) continue;
-      const raw = await this.storage.read(
-        AGGREGATOR_PAYLOAD_NAMESPACE,
-        meta.key
-      );
-      if (!raw) continue;
+  buildLayerCFinding(task, key, severity, now) {
+    return {
+      finding_id: "",
+      sentinel_id: this.sentinelId,
+      severity,
+      summary: truncateSummary2(
+        `novel-permission-combination: tools=[${task.tools.join(",")}] observed in single task burst (${task.tools.length} distinct tools).`
+      ),
+      details: {
+        layer: "C",
+        combination_key: key,
+        tools: task.tools,
+        task_started_at: new Date(task.startTs).toISOString()
+      },
+      observed_at: now.toISOString(),
+      evidence_audit_ids: [],
+      fortress_id: ""
+    };
+  }
+  // ── LLM-assist ────────────────────────────────────────────────────
+  classifyHandle(ctx) {
+    const selector = ctx.substrateSelector;
+    if (!selector) return null;
+    const fn = selector.invokeClassify;
+    if (typeof fn !== "function") return null;
+    return async (items) => {
       try {
-        const envelope = JSON.parse(bytesToString(raw));
-        const aad = stringToBytes(aggregatorId);
-        const plaintext = decrypt(envelope, this.encryptionKey, aad);
-        const parsed = JSON.parse(
-          bytesToString(plaintext)
-        );
-        if (parsed.retention_until <= cutoff) {
-          await this.storage.delete(AGGREGATOR_PAYLOAD_NAMESPACE, meta.key);
-          pruned += 1;
+        const resp = await fn.call(selector, "sentinel-scoring", {
+          kind: "classify",
+          items,
+          categories: ["benign", "suspicious"]
+        });
+        if (resp.failureClass) return { kind: "failure", message: "substrate failure" };
+        if (resp.body.kind === "classify") {
+          return { kind: "classify", results: resp.body.results };
         }
+        return { kind: "failure", message: resp.body.message };
       } catch {
+        return null;
+      }
+    };
+  }
+  async consultClassifier(classify, obs) {
+    const item = JSON.stringify({
+      tool: obs.tool,
+      proxy: obs.proxy,
+      args_summary: obs.argsSummary
+    });
+    const result = await classify([item]);
+    if (!result || result.kind !== "classify") return "unknown";
+    const top = result.results[0];
+    if (!top) return "unknown";
+    if (top.category === "suspicious" && top.confidence >= 0.5) {
+      return "suspicious";
+    }
+    if (top.category === "benign") return "benign";
+    return "unknown";
+  }
+  // ── helpers ───────────────────────────────────────────────────────
+  observationFromEntry(entry) {
+    const op = entry.operation;
+    let tool = null;
+    let proxy = false;
+    for (const prefix of GATE_PREFIXES) {
+      if (op.startsWith(prefix)) {
+        tool = op.slice(prefix.length);
+        proxy = prefix === "gate_allow_proxy:";
+        break;
       }
     }
-    return { pruned };
+    if (!tool) return null;
+    const ts = Date.parse(entry.timestamp);
+    if (!Number.isFinite(ts)) return null;
+    const argsSummary = extractArgsSummary(entry.details);
+    return { tool, proxy, ts, entry, argsSummary };
   }
 };
-function payloadKey(aggregatorId) {
-  return `${AGGREGATOR_PAYLOAD_KEY_PREFIX}${aggregatorId}`;
+function countTruncatedValues(args) {
+  let n = 0;
+  for (const v of Object.values(args)) {
+    if (typeof v === "string" && v.endsWith("...")) n += 1;
+  }
+  return n;
 }
-function stripKeyPrefix(key) {
-  if (!key.startsWith(AGGREGATOR_PAYLOAD_KEY_PREFIX)) return null;
-  return key.slice(AGGREGATOR_PAYLOAD_KEY_PREFIX.length);
+function countUrlEncoded(value) {
+  const matches = value.match(/%[0-9a-fA-F]{2}/g);
+  return matches ? matches.length : 0;
+}
+function longestBase64Run(value) {
+  const matches = value.match(/[A-Za-z0-9+/=]{40,}/g);
+  if (!matches) return 0;
+  return matches.reduce((max, m) => m.length > max ? m.length : max, 0);
+}
+function extractArgsSummary(details) {
+  if (!details) return {};
+  const summary = details["args_summary"];
+  if (summary && typeof summary === "object" && !Array.isArray(summary)) {
+    return summary;
+  }
+  return {};
+}
+function truncateSummary2(s) {
+  return s.length > 240 ? s.slice(0, 237) + "..." : s;
+}
+
+// src/sentinel/sentinels/index.ts
+var PHI1_BASELINE_CATALOG = [
+  {
+    sentinelId: EGRESS_VOLUME_SENTINEL_ID,
+    description: "Watches outbound proxy-call volume per upstream server and surfaces anomalous spikes against a rolling 7-day baseline.",
+    factory: () => new EgressVolumeWatcher()
+  },
+  {
+    sentinelId: CROSS_AGENT_CHATTER_SENTINEL_ID,
+    description: "Watches inter-agent communication patterns. Surfaces per-pair rate spikes (3 or 6 sigma over the rolling 7-day baseline) and new-partner appearances. Escalates to alert when one source agent picks up 3 or more new partners in 24h.",
+    factory: () => new CrossAgentChatterWatcher()
+  },
+  {
+    sentinelId: CREDENTIAL_USAGE_SENTINEL_ID,
+    description: "Watches per-agent credential reads. Surfaces (agent, secret) usage that exceeds a rolling 7-day baseline, and unfamiliar secret combinations the agent uses for the first time in one 24h window.",
+    factory: () => new CredentialUsageWatcher()
+  },
+  {
+    sentinelId: SUSPICIOUS_TOOL_CALL_SENTINEL_ID,
+    description: "Surfaces tool calls whose argument shape, call frequency, or permission combination looks unusual for the fortress's recent history.",
+    factory: () => new SuspiciousToolCallDetector()
+  }
+];
+var FILE_VERSION = 1;
+function sentinelSubscriptionsPath(storagePath) {
+  return join(storagePath, "sentinel-subscriptions.json");
+}
+async function loadSentinelSubscriptions(storagePath) {
+  const filePath = sentinelSubscriptionsPath(storagePath);
+  try {
+    const raw = await readFile(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== FILE_VERSION) return /* @__PURE__ */ new Set();
+    if (!Array.isArray(parsed.subscribed)) return /* @__PURE__ */ new Set();
+    const cleaned = parsed.subscribed.filter(
+      (id) => typeof id === "string" && id.length > 0
+    );
+    return new Set(cleaned);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
 }
 
 // src/principal-policy/tools.ts
@@ -32496,7 +34297,17 @@ var OPERATOR_CHAT_OPS = {
    * fold. The concierge omits that category and continues; the user-
    * facing query is never broken. Body carries category + failure_reason.
    */
-  CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed"
+  CONCIERGE_CONTEXT_FETCHER_FAILED: "operator_concierge_context_fetcher_failed",
+  /**
+   * Concierge surfaced a proactive starter when a fresh conversation
+   * thread opened (WP-V1.3-9 Tau-5). Emitted once per starter, never on
+   * follow-up turns within the same thread. Body carries `thread_id`,
+   * `trigger` (stable enum), and `triggered_agents_count`. The starter
+   * text body is NOT carried; the trigger enum is sufficient for
+   * dashboard grouping and keeps fortress-internal agent ids off the
+   * audit surface.
+   */
+  CONCIERGE_PROACTIVE_SUGGESTION_OFFERED: "operator_concierge_proactive_suggestion_offered"
 };
 
 // src/chat/operator-chat-types.ts
@@ -33306,6 +35117,100 @@ function auditSafeSummary(parsed) {
   };
 }
 
+// src/chat/agent-context-cache.ts
+var STATE_FLAG_ORDER = [
+  "stuck",
+  "has_pending_approvals",
+  "has_open_findings",
+  "active",
+  "idle"
+];
+var SECTION_HEADER = "## Current agent state";
+function approxTokenLen2(text) {
+  return Math.ceil(text.length / 4);
+}
+var DEFAULT_AGENT_CONTEXT_TOKEN_BUDGET = 400;
+function formatSnapshotLine(snapshot) {
+  const flagLabel = snapshot.state_flags.join("+") || "no_flags";
+  const work = snapshot.current_work_summary ? `, last: ${snapshot.current_work_summary}` : "";
+  const verascore = snapshot.recent_verascore_delta_24h !== null ? `, verascore \u0394${snapshot.recent_verascore_delta_24h.toFixed(2)}` : "";
+  return `- ${snapshot.agent_name} (template: ${snapshot.template}): ${flagLabel}, ${snapshot.recent_audit_count_24h} audit/24h, ${snapshot.recent_concordia_receipts_count_24h} receipts${verascore}${work}`;
+}
+function urgencyRank(snapshot) {
+  for (let i = 0; i < STATE_FLAG_ORDER.length; i++) {
+    if (snapshot.state_flags.includes(STATE_FLAG_ORDER[i])) {
+      return i;
+    }
+  }
+  return STATE_FLAG_ORDER.length;
+}
+function formatCurrentAgentStateSection(snapshots, opts) {
+  if (snapshots.length === 0) return "";
+  const budget = opts?.maxTokens ?? DEFAULT_AGENT_CONTEXT_TOKEN_BUDGET;
+  const sorted = [...snapshots].sort(
+    (a, b) => urgencyRank(a) - urgencyRank(b)
+  );
+  const headerTokens = approxTokenLen2(`${SECTION_HEADER}
+`);
+  const sepTokens = approxTokenLen2("\n");
+  let runningTokens = headerTokens;
+  const kept = [];
+  for (const snap of sorted) {
+    const line = formatSnapshotLine(snap);
+    const tokens = approxTokenLen2(line) + (kept.length > 0 ? sepTokens : 0);
+    if (kept.length === 0) {
+      kept.push(line);
+      runningTokens += tokens;
+      continue;
+    }
+    if (runningTokens + tokens > budget) break;
+    kept.push(line);
+    runningTokens += tokens;
+  }
+  return `${SECTION_HEADER}
+${kept.join("\n")}`;
+}
+function generateProactiveStarter(snapshots) {
+  if (snapshots.length === 0) return null;
+  const stuck = snapshots.filter((s) => s.state_flags.includes("stuck"));
+  if (stuck.length > 0) {
+    const first = stuck[0];
+    if (first === void 0) return null;
+    const last = first.current_work_summary ? ` (last: ${first.current_work_summary})` : "";
+    return {
+      text: `Your ${first.agent_name} agent looks stuck${last}. Should I check its session state?`,
+      trigger: "stuck_agent",
+      triggered_agents_count: stuck.length
+    };
+  }
+  const pending = snapshots.filter(
+    (s) => s.state_flags.includes("has_pending_approvals")
+  );
+  if (pending.length > 0) {
+    const names = pending.slice(0, 3).map((s) => s.agent_name).join(", ");
+    return {
+      text: `You have pending approvals across ${names}. Want to walk through them?`,
+      trigger: "pending_approvals",
+      triggered_agents_count: pending.length
+    };
+  }
+  const findings = snapshots.filter(
+    (s) => s.state_flags.includes("has_open_findings")
+  );
+  if (findings.length > 0) {
+    return {
+      text: `Sentinel has open findings on ${findings.length} ${findings.length === 1 ? "agent" : "agents"}. Want a summary?`,
+      trigger: "open_findings",
+      triggered_agents_count: findings.length
+    };
+  }
+  return {
+    text: "Your fortress is quiet. Anything you'd like to inspect?",
+    trigger: "all_idle",
+    triggered_agents_count: snapshots.length
+  };
+}
+
 // src/chat/operator-chat-service.ts
 var DEFAULT_CONCIERGE_MAX_TOKENS = 512;
 var DEFAULT_CONCIERGE_HISTORY_WINDOW_TURNS = 10;
@@ -33313,7 +35218,8 @@ var DEFAULT_CONCIERGE_HISTORY_FRESHNESS_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_CONCIERGE_HISTORY_TOKEN_BUDGET = 500;
 var DEFAULT_CONCIERGE_SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_CONCIERGE_DYNAMIC_CONTEXT_BUDGET = 2e3;
-function approxTokenLen2(text) {
+var DEFAULT_CONCIERGE_AGENT_STATE_BUDGET = 400;
+function approxTokenLen3(text) {
   return Math.ceil(text.length / 4);
 }
 var SANCTUARY_DOMAIN_REFERENCE = `Castle Architecture (four enforcement layers):
@@ -33362,6 +35268,15 @@ var OperatorChatService = class {
   dynamicContextBudget;
   agentRegistry;
   grammarLlmAssist;
+  agentContextCache;
+  agentStateBudget;
+  /**
+   * Per-thread guard so the proactive starter fires at most once per
+   * fresh thread. Tracks the thread_id the starter was last offered
+   * for; subsequent `getProactiveStarter()` calls within the same
+   * thread return null instead of re-emitting.
+   */
+  starterOfferedForThreadId;
   /**
    * In-memory thread_id assigned to the active concierge session.
    * The first sendConcierge call after construction allocates a fresh
@@ -33406,6 +35321,10 @@ var OperatorChatService = class {
     if (deps.conciergeGrammarLlmAssist) {
       this.grammarLlmAssist = deps.conciergeGrammarLlmAssist;
     }
+    if (deps.conciergeAgentContextCache) {
+      this.agentContextCache = deps.conciergeAgentContextCache;
+    }
+    this.agentStateBudget = deps.conciergeAgentStateBudget !== void 0 && deps.conciergeAgentStateBudget > 0 ? deps.conciergeAgentStateBudget : DEFAULT_CONCIERGE_AGENT_STATE_BUDGET;
   }
   // ── Concierge ─────────────────────────────────────────────────────────
   /**
@@ -33427,6 +35346,7 @@ var OperatorChatService = class {
     const nowMs = this.clock();
     if (this.activeMemoryThreadId && this.lastInteractionAt !== void 0 && nowMs - this.lastInteractionAt > this.sessionTtlMs) {
       this.activeMemoryThreadId = void 0;
+      this.starterOfferedForThreadId = void 0;
     }
     const operatorMessage = {
       message_id: randomUUID(),
@@ -33465,6 +35385,11 @@ var OperatorChatService = class {
       });
     }
     const parsedGrammar = await this.runGrammarParse(filterResult.filtered);
+    const agentSnapshots = this.agentContextCache ? this.agentContextCache.read() : [];
+    const agentStateSection = this.agentContextCache ? formatCurrentAgentStateSection(agentSnapshots, {
+      maxTokens: this.agentStateBudget
+    }) : "";
+    const renderedAgentCount = agentStateSection ? agentSnapshots.length : 0;
     const start = Date.now();
     let conciergeBody;
     let servedBy = "disabled";
@@ -33489,7 +35414,8 @@ var OperatorChatService = class {
           dynamicCategoriesIncluded = dynamicResult.categoriesIncluded;
           const context = await this.assembleConciergeContext(
             priorTurns,
-            dynamicResult.section
+            dynamicResult.section,
+            agentStateSection
           );
           const response = await this.substrateSelector.invokeSummarize(
             "concierge",
@@ -33556,7 +35482,8 @@ var OperatorChatService = class {
         prior_turns_folded: memoryReadFailureReason === null ? priorTurns.length : 0
       } : {},
       ...this.contextFetchers ? { dynamic_context_categories: [...dynamicCategoriesIncluded] } : {},
-      parsed_grammar: auditSafeSummary(parsedGrammar)
+      parsed_grammar: auditSafeSummary(parsedGrammar),
+      ...this.agentContextCache !== void 0 ? { agent_context_snapshot_count: renderedAgentCount } : {}
     };
     this.emit(OPERATOR_CHAT_OPS.CONCIERGE_CHAT, payload, outcome === "ok" ? "success" : "failure");
     return {
@@ -33667,6 +35594,7 @@ var OperatorChatService = class {
     if (!removed) return false;
     if (this.activeMemoryThreadId === threadId) {
       this.activeMemoryThreadId = void 0;
+      this.starterOfferedForThreadId = void 0;
     }
     const payload = {
       version: "1.2",
@@ -33685,9 +35613,65 @@ var OperatorChatService = class {
    * Reset the active session memory thread. Subsequent sendConcierge
    * calls allocate a fresh thread_id. Surfaced for tests + future "new
    * conversation" affordance; not currently called by the dashboard.
+   *
+   * Tau-5: also clears the proactive-starter guard so the next
+   * `getProactiveStarter()` call against the freshly-allocated thread
+   * is eligible to fire.
    */
   resetConciergeMemoryThread() {
     this.activeMemoryThreadId = void 0;
+    this.starterOfferedForThreadId = void 0;
+  }
+  /**
+   * WP-V1.3-9 Tau-5: surface a proactive starter for the current
+   * concierge session. Intended to be called by the dashboard UI when
+   * the operator opens the chat surface, before any operator typing.
+   *
+   * Returns null when:
+   * - No agent-context cache is wired (Tau-5 disabled).
+   * - No concierge memory store is wired (no thread_id namespace).
+   * - The cache snapshot has no signal (empty fortress).
+   * - A starter has already been offered for the active thread (the
+   *   guard ensures one starter per fresh thread).
+   *
+   * Side effects:
+   * - Allocates a fresh thread_id if none is active.
+   * - Emits the `operator_concierge_proactive_suggestion_offered`
+   *   audit event with the trigger class + triggered_agents_count.
+   * - Records the offered thread_id so the next call within the same
+   *   thread is a no-op.
+   *
+   * The returned starter's `text` is operator-visible copy; the
+   * dashboard renders it as a system-message-style starter the
+   * operator can accept (clicks/types follow-up) or dismiss (types a
+   * new query).
+   */
+  getProactiveStarter() {
+    if (!this.agentContextCache) return null;
+    if (!this.memory) return null;
+    const threadId = this.ensureActiveMemoryThread();
+    if (this.starterOfferedForThreadId === threadId) return null;
+    const snapshots = this.agentContextCache.read();
+    const starter = generateProactiveStarter(snapshots);
+    if (!starter) return null;
+    const payload = {
+      version: "1.2",
+      event_id: makeEventId("conc-starter"),
+      emitted_at: (/* @__PURE__ */ new Date()).toISOString(),
+      identity_id: this.identityId,
+      kind: "operator_concierge_proactive_suggestion_offered",
+      surface: "concierge",
+      thread_id: threadId,
+      trigger: starter.trigger,
+      triggered_agents_count: starter.triggered_agents_count
+    };
+    this.emit(
+      OPERATOR_CHAT_OPS.CONCIERGE_PROACTIVE_SUGGESTION_OFFERED,
+      payload,
+      "success"
+    );
+    this.starterOfferedForThreadId = threadId;
+    return starter;
   }
   ensureActiveMemoryThread() {
     if (!this.activeMemoryThreadId) {
@@ -33732,7 +35716,7 @@ var OperatorChatService = class {
    * if available; the v1.2 selector does not expose one, so structured
    * serialization is the canonical path for v1.3.
    */
-  async assembleConciergeContext(priorTurns = [], dynamicSection = "") {
+  async assembleConciergeContext(priorTurns = [], dynamicSection = "", agentStateSection = "") {
     const ref = `## Sanctuary reference
 ${SANCTUARY_DOMAIN_REFERENCE}`;
     const priorSection = this.formatPriorTurnsSection(priorTurns);
@@ -33740,6 +35724,7 @@ ${SANCTUARY_DOMAIN_REFERENCE}`;
       return [
         ref,
         ...dynamicSection ? [dynamicSection] : [],
+        ...agentStateSection ? [agentStateSection] : [],
         ...priorSection ? [priorSection] : [],
         "## Recent activity\n(no providers wired)",
         "## Wrapped agents\n(no providers wired)",
@@ -33754,6 +35739,7 @@ ${SANCTUARY_DOMAIN_REFERENCE}`;
     return [
       ref,
       ...dynamicSection ? [dynamicSection] : [],
+      ...agentStateSection ? [agentStateSection] : [],
       ...priorSection ? [priorSection] : [],
       `## Recent activity
 ${activity}`,
@@ -33836,14 +35822,14 @@ ${inbox}`
     if (turns.length === 0) return "";
     const HEADER = "## Prior conversation";
     const lines = turns.map(formatPriorTurnLine);
-    const headerTokens = approxTokenLen2(`${HEADER}
+    const headerTokens = approxTokenLen3(`${HEADER}
 `);
-    const sepTokens = approxTokenLen2("\n");
+    const sepTokens = approxTokenLen3("\n");
     let runningTokens = headerTokens;
     let runningLines = [];
     for (let i = lines.length - 1; i >= 0; i--) {
       const line = lines[i];
-      const tokens = approxTokenLen2(line) + (runningLines.length > 0 ? sepTokens : 0);
+      const tokens = approxTokenLen3(line) + (runningLines.length > 0 ? sepTokens : 0);
       if (runningTokens + tokens > this.historyTokenBudget) break;
       runningTokens += tokens;
       runningLines.push(line);
@@ -33890,7 +35876,7 @@ function hashOf(input) {
 init_encryption();
 init_encoding();
 var OPERATOR_CHAT_NAMESPACE = "_chat";
-var HKDF_INFO2 = "operator-chat-store-v1";
+var HKDF_INFO3 = "operator-chat-store-v1";
 function chatStorageKey(surface, threadKey) {
   return `${surface}.${threadKey}`;
 }
@@ -33899,7 +35885,7 @@ var OperatorChatStore = class {
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO2);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO3);
   }
   /**
    * Load a thread. Returns null if no record exists or if the on-disk
@@ -33983,7 +35969,7 @@ init_encryption();
 init_encoding();
 var CONCIERGE_MEMORY_NAMESPACE = "_chat";
 var CONCIERGE_MEMORY_KEY_PREFIX = "concierge_memory.";
-var HKDF_INFO3 = "concierge-memory-store-v1";
+var HKDF_INFO4 = "concierge-memory-store-v1";
 var DEFAULT_CONCIERGE_RETENTION_DAYS = 30;
 var MAX_BUNDLE_BYTES3 = 4 * 1024 * 1024;
 var ConciergeMemoryStore = class {
@@ -33994,7 +35980,7 @@ var ConciergeMemoryStore = class {
   locks;
   constructor(opts) {
     this.storage = opts.storage;
-    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO3);
+    this.encryptionKey = derivePurposeKey(opts.masterKey, HKDF_INFO4);
     this.fortressId = opts.fortressId;
     this.retentionDays = opts.retentionDays !== void 0 && opts.retentionDays > 0 ? opts.retentionDays : DEFAULT_CONCIERGE_RETENTION_DAYS;
     this.locks = /* @__PURE__ */ new Map();
@@ -34120,7 +36106,7 @@ var ConciergeMemoryStore = class {
     );
     const summaries = [];
     for (const meta of entries) {
-      const threadId = stripKeyPrefix2(meta.key);
+      const threadId = stripKeyPrefix3(meta.key);
       if (threadId === null) continue;
       const bundle = await this.loadBundle(threadId);
       if (!bundle || bundle.turns.length === 0) continue;
@@ -34173,7 +36159,7 @@ var ConciergeMemoryStore = class {
     );
     let pruned = 0;
     for (const meta of entries) {
-      const threadId = stripKeyPrefix2(meta.key);
+      const threadId = stripKeyPrefix3(meta.key);
       if (threadId === null) continue;
       pruned += await this.withLock(threadId, async () => {
         const bundle = await this.loadBundle(threadId);
@@ -34257,7 +36243,7 @@ var ConciergeMemoryStore = class {
 function bundleKey(threadId) {
   return `${CONCIERGE_MEMORY_KEY_PREFIX}${threadId}`;
 }
-function stripKeyPrefix2(key) {
+function stripKeyPrefix3(key) {
   if (!key.startsWith(CONCIERGE_MEMORY_KEY_PREFIX)) return null;
   return key.slice(CONCIERGE_MEMORY_KEY_PREFIX.length);
 }
@@ -34630,13 +36616,13 @@ init_encryption();
 init_encoding();
 var INTELLIGENCE_NAMESPACE = "_intelligence";
 var SUBSTRATE_CONFIG_KEY = "substrate-config";
-var HKDF_INFO4 = "intelligence-substrate-config";
+var HKDF_INFO5 = "intelligence-substrate-config";
 var IntelligenceConfigStore = class {
   storage;
   encryptionKey;
   constructor(storage, masterKey) {
     this.storage = storage;
-    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO4);
+    this.encryptionKey = derivePurposeKey(masterKey, HKDF_INFO5);
   }
   /**
    * Load the operator's substrate config from disk. Returns the config
@@ -38615,6 +40601,38 @@ ${err.message}
   if (dashboard) {
     dashboard.setApprovalAggregator(approvalAggregator);
   }
+  const sentinelFindingStore = new SentinelFindingStore({
+    storage,
+    masterKey,
+    fortressId: fortressIdForAggregator
+  });
+  const sentinelRegistry = new SentinelRegistry();
+  for (const entry of PHI1_BASELINE_CATALOG) {
+    sentinelRegistry.register(entry);
+  }
+  const sentinelDispatcher = new SentinelDispatcher({
+    registry: sentinelRegistry,
+    findingStore: sentinelFindingStore,
+    auditLog,
+    fortressId: fortressIdForAggregator,
+    identityId: aggregatorIdentityId
+  });
+  try {
+    const persistedSubscriptions = await loadSentinelSubscriptions(
+      config.storage_path
+    );
+    for (const sentinelId of persistedSubscriptions) {
+      try {
+        await sentinelDispatcher.subscribeSentinel(sentinelId);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  sentinelDispatcher.start();
+  if (dashboard) {
+    dashboard.setSentinelDispatcher(sentinelDispatcher);
+  }
   const policyTools = createPrincipalPolicyTools(policy, baseline, auditLog);
   const { tools: sanctuaryMetaTools } = createSanctuaryTools({
     config,