@suveren/gateway 0.25.0 → 0.26.0

package/dist/mcp-server/http.mjs

@@ -15,6 +15,7 @@ import {
   computeMetric,
   fingerprintOf,
   formatDateTime,
+  getIdentityDirectory,
   glossaryUsage,
   issuerFromPublicKeyHex,
   mandateFields,
@@ -31,7 +32,7 @@ import {
   sanitizeReport,
   suggestedFilename,
   ticketFields
-} from "./chunk-APIQIEUA.mjs";
+} from "./chunk-PU4VQEEA.mjs";
 
 // bin/http.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -153,7 +154,7 @@ import { dirname, join as join3 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
 import { spawnSync } from "child_process";
-var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod", "Team"];
 var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
 function registryKeyPath(hive) {
   const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
@@ -189,6 +190,11 @@ function validateCaFile(candidate) {
   if (!existsSync2(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
   return { ok: true, path: trimmed };
 }
+function validateTeamId(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The team id is empty." };
+  return { ok: true, id: trimmed };
+}
 function validateProxyUrl(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
@@ -362,6 +368,14 @@ function readPolicy() {
     policy.installMethod = "managed";
     locked.add("installMethod");
   }
+  if (merged.Team !== void 0) {
+    const v = validateTeamId(String(merged.Team));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Team ("${String(merged.Team)}") from ${sourceOf.Team}: ${v.error}`);
+    }
+    policy.team = v.id;
+    locked.add("team");
+  }
   cached = { policy, locked };
   return cached;
 }
@@ -860,6 +874,32 @@ var SPClient = class {
     if (!res.ok) throw new Error(`SP compat request failed: ${res.status}`);
     return res.json();
   }
+  /**
+   * WS3 defence-in-depth (work-plan "Added 2026-10-11 — an account is
+   * Personal OR in one team"): the account's active TEAM id, or null when
+   * it currently has none (Personal mode) — `GET /api/groups/me`. Used only
+   * by AttestationCache.refreshActiveWorkspace, never on the hot tool-call
+   * path (it makes a live AS call).
+   */
+  async getActiveTeamGroupId() {
+    const res = await this.fetch("/api/groups/me");
+    if (!res.ok) throw new Error(`SP groups/me request failed: ${res.status}`);
+    const data = await res.json();
+    return data.group?.id ?? null;
+  }
+  /**
+   * The account's own Personal group id — `GET /api/groups`, the entry
+   * with `isPersonal`. Same caller/purpose as {@link getActiveTeamGroupId}:
+   * together they resolve "the active workspace" (the active team if any,
+   * else Personal) without the gateway ever guessing at an id shape.
+   */
+  async getPersonalGroupId() {
+    const res = await this.fetch("/api/groups");
+    if (!res.ok) throw new Error(`SP groups request failed: ${res.status}`);
+    const data = await res.json();
+    const personal = (data.groups ?? []).find((g) => g.isPersonal);
+    return personal?.id ?? null;
+  }
   /**
    * Get all mandates for an authorization id.
    *
@@ -987,6 +1027,19 @@ var SPClient = class {
     const data = await res.json();
     return data.proposals;
   }
+  /**
+   * RJ4 — the same proposals a human just rejected, sent back for a change,
+   * or replaced with their own mandate (all three outcomes live under
+   * `status: 'rejected'`, see `ProposalOutcome`). Polled on the SAME tick as
+   * {@link getCommittedProposals} (bin/http.ts) so the outcome outbox learns
+   * about them without a second AS polling loop.
+   */
+  async getRejectedProposals() {
+    const res = await this.fetch("/api/proposals?status=rejected");
+    if (!res.ok) throw new Error(`SP rejected proposals request failed: ${res.status}`);
+    const data = await res.json();
+    return data.proposals;
+  }
   /**
    * Look up ONE proposal by id, whatever its status. `null` when the AS has no
    * such proposal (or the caller may not see it).
@@ -1052,6 +1105,48 @@ var AttestationCache = class {
    * this fact to begin with.
    */
   reapprovalNeeded = /* @__PURE__ */ new Set();
+  /**
+   * WS3 defence-in-depth (work-plan "Added 2026-10-11 — an account is
+   * Personal OR in one team"): the account's current active workspace's
+   * group id — its active team, else its Personal group. `null` = not yet
+   * known (before the first {@link refreshActiveWorkspace}, or every
+   * lookup it tried failed) — filtering is then SKIPPED rather than
+   * refusing everything, because the Authority Server itself is the
+   * fail-closed authority at ticket time (decision 6, WS2); this is a
+   * second, narrower check for a window a buggy/stale cache entry could
+   * otherwise slip through in, not a replacement for that enforcement.
+   */
+  activeWorkspaceGroupId = null;
+  /**
+   * Re-resolve {@link activeWorkspaceGroupId} from the Authority Server.
+   * Called by the resync-gates flow (http.ts's `/internal/resync-gates`),
+   * never on the hot tool-call path — it makes up to two AS calls. Leaves
+   * the previous value in place on any failure (network error, unexpected
+   * shape): losing a known-good value on a transient blip would turn this
+   * defence-in-depth check into a false refusal of every cached mandate,
+   * which is worse than leaving it momentarily stale.
+   */
+  async refreshActiveWorkspace() {
+    try {
+      const activeTeam = await this.spClient.getActiveTeamGroupId();
+      if (activeTeam) {
+        this.activeWorkspaceGroupId = activeTeam;
+        return;
+      }
+      const personalId = await this.spClient.getPersonalGroupId();
+      if (personalId) this.activeWorkspaceGroupId = personalId;
+    } catch {
+    }
+  }
+  /**
+   * True only when `groupId` is KNOWN (not undefined) and the active
+   * workspace is ALSO known (not null) and they differ. Either side
+   * unknown ⇒ false: this check only ever narrows what gets selected, it
+   * never substitutes for the Authority Server's own enforcement.
+   */
+  isForeignWorkspace(groupId) {
+    return groupId !== void 0 && this.activeWorkspaceGroupId !== null && groupId !== this.activeWorkspaceGroupId;
+  }
   /**
    * Get the SP public key, fetching from SP if not cached or expired, then —
    * when a pin exists for this exact AS URL — verifying the live key still
@@ -1100,6 +1195,10 @@ var AttestationCache = class {
   getAuthorization(path) {
     const auth = this.authorizations.get(path);
     if (!auth) return null;
+    if (this.isForeignWorkspace(auth.groupId)) {
+      this.authorizations.delete(path);
+      return null;
+    }
     const now = Math.floor(Date.now() / 1e3);
     const hasValid = auth.attestations.some((a) => a.expiresAt > now);
     if (!hasValid) {
@@ -1124,6 +1223,13 @@ var AttestationCache = class {
       );
     }
     const bounds = result.bounds ?? result.frame ?? {};
+    let groupId;
+    try {
+      const summary = await this.spClient.getAuthorizationSummary(authorizationId);
+      groupId = summary?.group_id ?? void 0;
+    } catch {
+      groupId = void 0;
+    }
     let signedCommitmentMode;
     let subjects;
     const firstBlob = result.attestations[0]?.blob;
@@ -1158,7 +1264,8 @@ var AttestationCache = class {
       deferredCommitmentDomains: result.deferred_commitment_domains ?? [],
       signedCommitmentMode,
       subjects,
-      complete: result.complete
+      complete: result.complete,
+      groupId
     };
     this.authorizations.set(auth.authorizationId, auth);
     return auth;
@@ -1170,6 +1277,10 @@ var AttestationCache = class {
     const now = Math.floor(Date.now() / 1e3);
     const results = [];
     for (const [path, auth] of this.authorizations) {
+      if (this.isForeignWorkspace(auth.groupId)) {
+        this.authorizations.delete(path);
+        continue;
+      }
       const hasValid = auth.attestations.some((a) => a.expiresAt > now);
       if (hasValid) {
         results.push(auth);
@@ -2132,6 +2243,163 @@ var PreviewLog = class {
   }
 };
 
+// src/lib/outcome-outbox.ts
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync11, unlinkSync as unlinkSync5 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname9, join as join11 } from "path";
+import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5, randomBytes as randomBytes5 } from "crypto";
+var DEFAULT_DIR8 = process.env.SUVEREN_DATA_DIR ?? join11(homedir8(), ".suveren");
+var MAX_AGE_MS3 = 7 * 24 * 60 * 60 * 1e3;
+function outcomeEntryFor(proposal, submittedHere, who, nowMs) {
+  if (!submittedHere) return null;
+  const by = proposal.approverRejectedBy ?? proposal.rejectedBy;
+  if (!by || typeof by.at !== "number") return null;
+  const decidedAt = by.at * 1e3;
+  if (nowMs - decidedAt > MAX_AGE_MS3) return null;
+  return { proposalId: proposal.id, outcome: by.outcome ?? "rejected", note: by.note, who, decidedAt };
+}
+var OutcomeOutbox = class {
+  entries = [];
+  baseDir;
+  vaultKey = null;
+  constructor(filePath) {
+    this.baseDir = filePath && filePath.endsWith(".json") ? dirname9(filePath) : filePath ?? DEFAULT_DIR8;
+    this.loadPlaintext();
+  }
+  /** Mirrors DenialLog.setVaultKey — migrates plaintext -> encrypted once, in place. */
+  setVaultKey(key) {
+    this.vaultKey = key;
+    if (existsSync11(this.encryptedFilePath)) {
+      this.loadEncrypted();
+    } else if (this.entries.length > 0) {
+      this.persistEncrypted();
+      if (existsSync11(this.plaintextFilePath)) {
+        try {
+          unlinkSync5(this.plaintextFilePath);
+        } catch {
+        }
+      }
+    }
+  }
+  /**
+   * Record a resolved outcome, UNLESS this proposal is already known here
+   * (delivered or not) — the poller rechecks the AS's rejected list on
+   * every tick, and a proposal stays in that list well past the moment this
+   * gateway first learned about it, so without this guard the same outcome
+   * would be queued again right after it was delivered.
+   */
+  recordIfNew(entry) {
+    if (this.entries.some((e) => e.proposalId === entry.proposalId)) return;
+    this.entries.push({ ...entry });
+    this.prune(Date.now());
+    this.persist();
+  }
+  /** Undelivered entries, oldest first — what the next tool reply should carry. */
+  getUndelivered() {
+    return this.entries.filter((e) => e.deliveredAt === void 0).sort((a, b) => a.decidedAt - b.decidedAt);
+  }
+  /** Mark these proposals' entries delivered (idempotent). Always persists from disk state. */
+  markDelivered(proposalIds) {
+    if (proposalIds.length === 0) return;
+    const ids = new Set(proposalIds);
+    const now = Date.now();
+    let changed = false;
+    for (const e of this.entries) {
+      if (ids.has(e.proposalId) && e.deliveredAt === void 0) {
+        e.deliveredAt = now;
+        changed = true;
+      }
+    }
+    if (changed) this.persist();
+  }
+  /** Diagnostic / tests. */
+  get size() {
+    return this.entries.length;
+  }
+  // ─── Retention ────────────────────────────────────────────────────────────
+  prune(now) {
+    const cutoff = now - MAX_AGE_MS3;
+    this.entries = this.entries.filter((e) => e.decidedAt >= cutoff);
+  }
+  // ─── Encryption (mirrors DenialLog / ExecutionLog) ─────────────────────────
+  encrypt(plaintext) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const iv = randomBytes5(12);
+    const cipher = createCipheriv5("aes-256-gcm", this.vaultKey, iv);
+    const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return { iv: iv.toString("hex"), ciphertext: enc.toString("hex"), tag: cipher.getAuthTag().toString("hex") };
+  }
+  decrypt(blob) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const decipher = createDecipheriv5("aes-256-gcm", this.vaultKey, Buffer.from(blob.iv, "hex"));
+    decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+    return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
+  }
+  get plaintextFilePath() {
+    return join11(this.baseDir, "outcome-outbox.json");
+  }
+  get encryptedFilePath() {
+    return join11(this.baseDir, "outcome-outbox.enc.json");
+  }
+  loadPlaintext() {
+    if (!existsSync11(this.plaintextFilePath)) {
+      mkdirSync9(this.baseDir, { recursive: true });
+      return;
+    }
+    try {
+      const data = JSON.parse(readFileSync12(this.plaintextFilePath, "utf-8"));
+      this.entries = data.entries ?? [];
+      this.prune(Date.now());
+    } catch {
+      console.error(`[OutcomeOutbox] Could not parse ${this.plaintextFilePath}, starting fresh`);
+      this.entries = [];
+    }
+  }
+  loadEncrypted() {
+    if (!existsSync11(this.encryptedFilePath)) return;
+    try {
+      const data = JSON.parse(readFileSync12(this.encryptedFilePath, "utf-8"));
+      const storeFile = JSON.parse(this.decrypt(data.blob));
+      this.entries = storeFile.entries ?? [];
+      this.prune(Date.now());
+    } catch (err) {
+      console.error(`[OutcomeOutbox] Could not decrypt ${this.encryptedFilePath}:`, err);
+      this.entries = [];
+    }
+  }
+  persist() {
+    if (this.vaultKey) this.persistEncrypted();
+    else this.persistPlaintext();
+  }
+  persistPlaintext() {
+    const data = { version: 1, entries: this.entries };
+    mkdirSync9(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync9(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+  persistEncrypted() {
+    const storeFile = { version: 1, entries: this.entries };
+    const data = { version: 1, blob: this.encrypt(JSON.stringify(storeFile)) };
+    mkdirSync9(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync9(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+};
+function formatOutcomeLine(e) {
+  const what = e.outcome === "change_needed" ? `SENT BACK FOR A CHANGE by ${e.who}: "${e.note ?? ""}"` : e.outcome === "replaced" ? `REPLACED by the person's own mandate` : `REJECTED by ${e.who}`;
+  return `[Suveren gateway] Since your last call: proposal ${e.proposalId} was ${what}.`;
+}
+function wrapWithOutcomeOutbox(outbox, handler) {
+  return async (...args) => {
+    const result = await handler(...args);
+    if (!outbox) return result;
+    const pending = outbox.getUndelivered();
+    if (pending.length === 0) return result;
+    if (!result || !Array.isArray(result.content)) return result;
+    outbox.markDelivered(pending.map((e) => e.proposalId));
+    const note = pending.map(formatOutcomeLine).join("\n");
+    return { ...result, content: [...result.content, { type: "text", text: note }] };
+  };
+}
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
@@ -2224,10 +2492,10 @@ var MCPGatekeeper = class {
 };
 
 // src/lib/report/report-store.ts
-import { mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync11, unlinkSync as unlinkSync5 } from "fs";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname9, join as join11 } from "path";
-import { createCipheriv as createCipheriv5, createDecipheriv as createDecipheriv5, randomBytes as randomBytes5 } from "crypto";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync10, existsSync as existsSync12, unlinkSync as unlinkSync6 } from "fs";
+import { homedir as homedir9 } from "os";
+import { dirname as dirname10, join as join12 } from "path";
+import { createCipheriv as createCipheriv6, createDecipheriv as createDecipheriv6, randomBytes as randomBytes6 } from "crypto";
 
 // src/lib/report/record-resolvers.ts
 function findById(rows, id) {
@@ -2535,29 +2803,29 @@ async function buildCoverage(caseElements, getExport, archive, referenced, windo
 }
 
 // src/lib/report/report-store.ts
-var DEFAULT_DIR8 = process.env.SUVEREN_DATA_DIR ?? join11(homedir8(), ".suveren");
+var DEFAULT_DIR9 = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
 var ReportStore = class {
   report = null;
   baseDir;
   vaultKey = null;
   constructor(filePath) {
     if (filePath && filePath.endsWith(".json")) {
-      this.baseDir = dirname9(filePath);
+      this.baseDir = dirname10(filePath);
     } else {
-      this.baseDir = filePath ?? DEFAULT_DIR8;
+      this.baseDir = filePath ?? DEFAULT_DIR9;
     }
     this.loadPlaintext();
   }
   /** Set the vault key for encryption. Triggers migration from plaintext if needed. */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync11(this.encryptedFilePath)) {
+    if (existsSync12(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.report !== null) {
       this.persistEncrypted();
-      if (existsSync11(this.plaintextFilePath)) {
+      if (existsSync12(this.plaintextFilePath)) {
         try {
-          unlinkSync5(this.plaintextFilePath);
+          unlinkSync6(this.plaintextFilePath);
         } catch {
         }
       }
@@ -2570,7 +2838,7 @@ var ReportStore = class {
    * "the report exists but is locked".
    */
   isLocked() {
-    return this.vaultKey === null && existsSync11(this.encryptedFilePath);
+    return this.vaultKey === null && existsSync12(this.encryptedFilePath);
   }
   /** The stored, already-verified report — or null if none has been saved
    *  (and the store is not locked; check `isLocked()` first). */
@@ -2604,49 +2872,49 @@ var ReportStore = class {
   // ─── Encryption helpers ─────────────────────────────────────────────────
   encrypt(plaintext) {
     if (!this.vaultKey) throw new Error("No vault key");
-    const iv = randomBytes5(12);
-    const cipher = createCipheriv5("aes-256-gcm", this.vaultKey, iv);
+    const iv = randomBytes6(12);
+    const cipher = createCipheriv6("aes-256-gcm", this.vaultKey, iv);
     const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
     return { iv: iv.toString("hex"), ciphertext: encrypted.toString("hex"), tag: tag.toString("hex") };
   }
   decrypt(blob) {
     if (!this.vaultKey) throw new Error("No vault key");
-    const decipher = createDecipheriv5("aes-256-gcm", this.vaultKey, Buffer.from(blob.iv, "hex"));
+    const decipher = createDecipheriv6("aes-256-gcm", this.vaultKey, Buffer.from(blob.iv, "hex"));
     decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
     const decrypted = Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]);
     return decrypted.toString("utf8");
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join11(this.baseDir, "report.json");
+    return join12(this.baseDir, "report.json");
   }
   get encryptedFilePath() {
-    return join11(this.baseDir, "report.enc.json");
+    return join12(this.baseDir, "report.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync11(this.plaintextFilePath)) {
-      mkdirSync9(this.baseDir, { recursive: true });
+    if (!existsSync12(this.plaintextFilePath)) {
+      mkdirSync10(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync12(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync13(this.plaintextFilePath, "utf-8");
       const parsed = JSON.parse(raw);
       this.report = parsed.report ?? null;
     } catch {
       console.error(`[ReportStore] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
       try {
-        writeFileSync9(`${this.plaintextFilePath}.corrupt-${Date.now()}`, readFileSync12(this.plaintextFilePath));
+        writeFileSync10(`${this.plaintextFilePath}.corrupt-${Date.now()}`, readFileSync13(this.plaintextFilePath));
       } catch {
       }
       this.report = null;
     }
   }
   loadEncrypted() {
-    if (!existsSync11(this.encryptedFilePath)) return;
+    if (!existsSync12(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync12(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync13(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const parsed = JSON.parse(decrypted);
@@ -2654,7 +2922,7 @@ var ReportStore = class {
     } catch (err) {
       console.error(`[ReportStore] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
       try {
-        writeFileSync9(`${this.encryptedFilePath}.corrupt-${Date.now()}`, readFileSync12(this.encryptedFilePath));
+        writeFileSync10(`${this.encryptedFilePath}.corrupt-${Date.now()}`, readFileSync13(this.encryptedFilePath));
       } catch {
       }
       this.report = null;
@@ -2669,16 +2937,16 @@ var ReportStore = class {
   }
   persistPlaintext() {
     const data = { version: 1, report: this.report };
-    mkdirSync9(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync9(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync10(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync10(this.plaintextFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
   persistEncrypted() {
     const data = {
       version: 1,
       blob: this.encrypt(JSON.stringify({ version: 1, report: this.report }))
     };
-    mkdirSync9(this.baseDir, { recursive: true, mode: 448 });
-    writeFileSync9(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+    mkdirSync10(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync10(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
   }
 };
 
@@ -2701,6 +2969,9 @@ var SharedState = class {
   proposalSubmissions;
   /** AU3 — local, content-free record of preview reads. See preview-log.ts. */
   previewLog;
+  /** RJ4 — rejection/change-needed/replaced outcomes awaiting one-time
+   *  delivery to the AI on its next tool call. See outcome-outbox.ts. */
+  outcomeOutbox;
   gatekeeper;
   /**
    * V7 — set by {@link checkAsCompat} (called once at process start, and
@@ -2735,6 +3006,7 @@ var SharedState = class {
     this.executionJournal = new ExecutionJournal(gateStorePath);
     this.proposalSubmissions = new ProposalSubmissionStore(gateStorePath);
     this.previewLog = new PreviewLog(gateStorePath);
+    this.outcomeOutbox = new OutcomeOutbox(gateStorePath);
     this.gatekeeper = new MCPGatekeeper(this.cache);
   }
   /**
@@ -2923,29 +3195,29 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync13, existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync10, renameSync as renameSync4 } from "fs";
-import { homedir as homedir9 } from "os";
-import { join as join12, dirname as dirname10 } from "path";
-var DEFAULT_DIR9 = process.env.SUVEREN_DATA_DIR ?? join12(homedir9(), ".suveren");
+import { readFileSync as readFileSync14, existsSync as existsSync13, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11, renameSync as renameSync4 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join13, dirname as dirname11 } from "path";
+var DEFAULT_DIR10 = process.env.SUVEREN_DATA_DIR ?? join13(homedir10(), ".suveren");
 var CONTEXT_MAX_BYTES = 16 * 1024;
 function contextFilePath(dataDir2) {
-  return join12(dataDir2 ?? DEFAULT_DIR9, "context.md");
+  return join13(dataDir2 ?? DEFAULT_DIR10, "context.md");
 }
 function writeContextFile(content, dataDir2) {
   const bytes = Buffer.byteLength(content, "utf-8");
   if (bytes > CONTEXT_MAX_BYTES) throw new Error(`the brief is ${bytes} bytes; the limit is ${CONTEXT_MAX_BYTES}.`);
   const filePath = contextFilePath(dataDir2);
-  mkdirSync10(dirname10(filePath), { recursive: true });
+  mkdirSync11(dirname11(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  writeFileSync10(tmpPath, content, "utf-8");
+  writeFileSync11(tmpPath, content, "utf-8");
   renameSync4(tmpPath, filePath);
 }
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir2) {
   const filePath = contextFilePath(dataDir2);
-  if (!existsSync12(filePath)) return null;
+  if (!existsSync13(filePath)) return null;
   try {
-    const content = readFileSync13(filePath, "utf-8").trim();
+    const content = readFileSync14(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -3004,6 +3276,11 @@ function asUrlChangedNotice(what) {
 
 TELL THE USER: open ${uiUrl()} and sign in again to pair with the new Authority Server.`;
 }
+function managedWrongTeamNotice(what) {
+  return `${what} Suveren gateway is LOCKED because it is set up by IT for one specific team, and the signed-in account is no longer in that team (it left, or was removed). This is NOT an ended sign-in \u2014 signing in again will be refused until the account is back in that team.
+
+TELL THE USER: ask your IT administrator, or sign in with an account that is in the team this gateway is set up for, at ${uiUrl()}. Nothing ran while unsigned.`;
+}
 function lockedNotice(action, reason = "restart") {
   const what = action ? `Cannot ${action}: the` : "The";
   switch (reason) {
@@ -3015,6 +3292,8 @@ function lockedNotice(action, reason = "restart") {
       return asTlsMismatchNotice(what);
     case "as-url-changed":
       return asUrlChangedNotice(what);
+    case "managed-wrong-team":
+      return managedWrongTeamNotice(what);
     default:
       return bootLockedNotice(what);
   }
@@ -3135,8 +3414,8 @@ function attachTicketId(tool, args, ticketId) {
 import { computeContentHash as computeContentHash2 } from "@hap/core";
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync14, existsSync as existsSync13 } from "fs";
-import { join as join13, resolve } from "path";
+import { readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { join as join14, resolve } from "path";
 var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
 function isExactSemver(value) {
   return typeof value === "string" && EXACT_SEMVER_RE.test(value);
@@ -3205,25 +3484,25 @@ function invalidManifestPreviewReason(manifest) {
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join13(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join14(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join13(dir, "index.json");
-  if (!existsSync13(indexPath)) {
+  const indexPath = join14(dir, "index.json");
+  if (!existsSync14(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync14(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync15(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join13(dir, relativePath);
+    const manifestPath = join14(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync14(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync15(manifestPath, "utf-8"));
       const pinReason = invalidNpmPinReason(manifest);
       if (pinReason) {
         console.error(`[ManifestLoader] Refusing manifest ${id} (${manifestPath}): ${pinReason}`);
@@ -5134,6 +5413,22 @@ function listIntegrationsHandler(state2, integrationManager2) {
 
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
+
+// src/lib/who-label.ts
+var UNKNOWN_DECIDER = "the person";
+async function resolveWhoLabel(archive, domainKey, userId) {
+  if (!archive) return UNKNOWN_DECIDER;
+  try {
+    const dir = await getIdentityDirectory(archive);
+    const did = dir.domainDids.get(domainKey) ?? dir.domainDids.get(userId);
+    const name = did ? dir.names.get(did) : void 0;
+    return name ?? UNKNOWN_DECIDER;
+  } catch {
+    return UNKNOWN_DECIDER;
+  }
+}
+
+// src/tools/commitments.ts
 function buildSkippedProposalNote(proposalId) {
   return `Proposal ${proposalId} was approved, but was submitted from another device/installation of this operator (or one whose local record is gone) \u2014 this gateway will not execute it. Re-run the same request here to execute it from this gateway.`;
 }
@@ -5432,11 +5727,34 @@ Result: ${JSON.stringify(match.executionResult, null, 2)}` : " The action ran; t
         }
         if (match.status === "rejected") {
           const by = match.approverRejectedBy ?? match.rejectedBy;
-          const reason = match.approverRejectedBy?.reason;
+          const outcome = by?.outcome ?? "rejected";
+          const legacyReason = match.approverRejectedBy?.reason;
+          const who = by ? await resolveWhoLabel(
+            state2.receiptArchive,
+            "domain" in by ? by.domain : by.userId,
+            by.userId
+          ) : "a person";
+          if (outcome === "change_needed") {
+            return {
+              content: [{
+                type: "text",
+                text: `Proposal ${match.id} was SENT BACK FOR A CHANGE by ${who}: "${by?.note ?? ""}". The action did not run. You may adjust it and propose again \u2014 a new proposal the person approves again. Do not resend the same values.`
+              }]
+            };
+          }
+          if (outcome === "replaced") {
+            return {
+              content: [{
+                type: "text",
+                text: `Proposal ${match.id} was REPLACED: the person signed their own version of this mandate on the mandate screen. Nothing was created from this proposal. Use the person's mandate \u2014 check list-authorizations.`
+              }]
+            };
+          }
+          const reasonSuffix = legacyReason ? `: "${legacyReason}".` : ".";
           return {
             content: [{
               type: "text",
-              text: `Proposal ${match.id} was REJECTED${by ? ` by ${by.userId}` : ""}${reason ? `: ${reason}` : "."} The action did not run and must not be retried \u2014 a decision owner declined it. Ask before proposing anything similar.`
+              text: `Proposal ${match.id} was REJECTED by ${who}${reasonSuffix} The action did not run and must not be retried. Ask the person before proposing anything similar.`
             }]
           };
         }
@@ -5585,6 +5903,7 @@ function createMcpServer(state2, integrationManager2) {
     { name: "suveren-gateway", version: "0.1.0" },
     { instructions }
   );
+  const withOutcomeOutbox = (handler) => wrapWithOutcomeOutbox(state2.outcomeOutbox, handler);
   server.registerTool(
     "list-authorizations",
     {
@@ -5593,7 +5912,7 @@ function createMcpServer(state2, integrationManager2) {
         domain: z2.string().optional().describe('Profile domain to show full details for (e.g., "charge", "deploy"). Omit for compact overview.')
       }
     },
-    listAuthorizationsHandler(state2, integrationManager2)
+    withOutcomeOutbox(listAuthorizationsHandler(state2, integrationManager2))
   );
   server.registerTool(
     "check-pending-mandates",
@@ -5603,7 +5922,7 @@ function createMcpServer(state2, integrationManager2) {
         domain: z2.string().describe(`The owner's domain (e.g., "compliance")`)
       }
     },
-    checkPendingHandler(cache)
+    withOutcomeOutbox(checkPendingHandler(cache))
   );
   server.registerTool(
     "list-integrations",
@@ -5611,7 +5930,7 @@ function createMcpServer(state2, integrationManager2) {
       description: "List all running integrations and their authorization status. Returns a compact overview \u2014 use list-authorizations(domain) for full details on a specific profile.",
       inputSchema: {}
     },
-    listIntegrationsHandler(state2, integrationManager2)
+    withOutcomeOutbox(listIntegrationsHandler(state2, integrationManager2))
   );
   server.registerTool(
     "check-pending-commitments",
@@ -5621,7 +5940,7 @@ function createMcpServer(state2, integrationManager2) {
         proposal_id: z2.string().optional().describe("Specific proposal ID to check. Omit to see all.")
       }
     },
-    checkPendingCommitmentsHandler(state2, integrationManager2)
+    withOutcomeOutbox(checkPendingCommitmentsHandler(state2, integrationManager2))
   );
   const proxiedTools = /* @__PURE__ */ new Map();
   function registerProxiedTools() {
@@ -5655,7 +5974,10 @@ function createMcpServer(state2, integrationManager2) {
             description,
             ...Object.keys(zodShape).length > 0 ? { inputSchema: zodShape } : {}
           },
-          handler
+          // Built-in tools (reports, setup) never carry the outcome line: a
+          // report's output is evidence and must not mix in a notice (nor the
+          // decider's identity); setup tools are not the working agent's.
+          integrationManager2?.isBuiltin?.(tool.integrationId) ? handler : withOutcomeOutbox(handler)
         );
         proxiedTools.set(tool.namespacedName, { tool, registered });
       } catch (err) {
@@ -5688,21 +6010,21 @@ function createMcpServer(state2, integrationManager2) {
 }
 
 // src/lib/agent-contact.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync15, renameSync as renameSync5, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname11, join as join14 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync12, readFileSync as readFileSync16, renameSync as renameSync5, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname12, join as join15 } from "path";
 var FILE = "agent-contact.json";
 var REWRITE_AFTER_MS = 6e4;
 var AgentContactStore = class {
   path;
   current;
   constructor(dataDir2) {
-    this.path = join14(dataDir2, FILE);
+    this.path = join15(dataDir2, FILE);
     this.current = this.load();
   }
   load() {
-    if (!existsSync14(this.path)) return null;
+    if (!existsSync15(this.path)) return null;
     try {
-      const v = JSON.parse(readFileSync15(this.path, "utf8"));
+      const v = JSON.parse(readFileSync16(this.path, "utf8"));
       if (typeof v.clientName !== "string" || typeof v.firstSeenAt !== "string" || typeof v.lastSeenAt !== "string") return null;
       return { clientName: v.clientName, clientVersion: v.clientVersion, firstSeenAt: v.firstSeenAt, lastSeenAt: v.lastSeenAt };
     } catch {
@@ -5725,9 +6047,9 @@ var AgentContactStore = class {
     };
     if (!due) return;
     try {
-      mkdirSync11(dirname11(this.path), { recursive: true });
+      mkdirSync12(dirname12(this.path), { recursive: true });
       const tmp = `${this.path}.tmp`;
-      writeFileSync11(tmp, JSON.stringify(this.current, null, 2));
+      writeFileSync12(tmp, JSON.stringify(this.current, null, 2));
       renameSync5(tmp, this.path);
     } catch (err) {
       console.error("[Suveren MCP] Could not save agent contact:", err);
@@ -5762,16 +6084,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync12, existsSync as existsSync15 } from "fs";
-import { homedir as homedir10 } from "os";
-import { dirname as dirname12, join as join15 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join15(homedir10(), ".suveren");
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync17, writeFileSync as writeFileSync13, existsSync as existsSync16 } from "fs";
+import { homedir as homedir11 } from "os";
+import { dirname as dirname13, join as join16 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join16(homedir11(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir2) {
     const dir = dataDir2 ?? DEFAULT_DATA_DIR;
-    this.filePath = join15(dir, "integrations.json");
+    this.filePath = join16(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -5802,12 +6124,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync15(this.filePath)) {
-      mkdirSync12(dirname12(this.filePath), { recursive: true });
+    if (!existsSync16(this.filePath)) {
+      mkdirSync13(dirname13(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync16(this.filePath, "utf-8");
+      const raw = readFileSync17(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -5836,15 +6158,15 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync12(dirname12(this.filePath), { recursive: true });
-    writeFileSync12(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync13(dirname13(this.filePath), { recursive: true });
+    writeFileSync13(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir11 } from "os";
-import { join as join16, delimiter } from "path";
-import { existsSync as existsSync16, writeFileSync as writeFileSync13, mkdirSync as mkdirSync13, readFileSync as readFileSync17, rmSync } from "fs";
+import { homedir as homedir12 } from "os";
+import { join as join17, delimiter } from "path";
+import { existsSync as existsSync17, writeFileSync as writeFileSync14, mkdirSync as mkdirSync14, readFileSync as readFileSync18, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
@@ -5974,8 +6296,8 @@ function inheritedConnectorEnv(parent, passEnv = []) {
 }
 
 // src/lib/integration-manager.ts
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join16(homedir11(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join16(DEFAULT_DATA_DIR2, "integrations");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join17(homedir12(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join17(DEFAULT_DATA_DIR2, "integrations");
 var OFFLINE_MODE = process.env.SUVEREN_OFFLINE === "1";
 var installLock = Promise.resolve();
 function withInstallLock(task) {
@@ -5983,7 +6305,7 @@ function withInstallLock(task) {
   installLock = run.then(() => void 0, () => void 0);
   return run;
 }
-var INTEGRATIONS_BIN = join16(INTEGRATIONS_DIR, "node_modules", ".bin");
+var INTEGRATIONS_BIN = join17(INTEGRATIONS_DIR, "node_modules", ".bin");
 function getIntegrationsBinDir() {
   return INTEGRATIONS_BIN;
 }
@@ -5992,12 +6314,12 @@ function buildPath() {
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync16(INTEGRATIONS_DIR)) {
-    mkdirSync13(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync17(INTEGRATIONS_DIR)) {
+    mkdirSync14(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join16(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync16(pkgPath)) {
-    writeFileSync13(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join17(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync17(pkgPath)) {
+    writeFileSync14(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -6086,19 +6408,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join16(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join16(pkgDir, "package.json");
-    if (!existsSync16(pkgDir) || !existsSync16(pkgJson)) return false;
+    const pkgDir = join17(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join17(pkgDir, "package.json");
+    if (!existsSync17(pkgDir) || !existsSync17(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync17(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync18(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync16(join16(pkgDir, target))) return false;
+        if (!existsSync17(join17(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync16(join16(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync17(join17(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -6113,9 +6435,9 @@ var IntegrationManager = class {
    */
   readInstalledVersion(npmPackage) {
     if (!this.isUsableInstall(npmPackage)) return null;
-    const pkgJson = join16(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
+    const pkgJson = join17(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"), "package.json");
     try {
-      const pkg = JSON.parse(readFileSync17(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync18(pkgJson, "utf8"));
       return typeof pkg.version === "string" ? pkg.version : null;
     } catch {
       return null;
@@ -6129,7 +6451,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync16(join16(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync17(join17(INTEGRATIONS_BIN, c)));
   }
   /**
    * The exact version THIS gateway's CURRENTLY LOADED manifest pins
@@ -6219,8 +6541,8 @@ var IntegrationManager = class {
    * nothing at all.
    */
   async installNow(npmPackage, exactVersion, cleanFirst = true) {
-    const pkgDir = join16(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (cleanFirst && existsSync16(pkgDir)) {
+    const pkgDir = join17(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (cleanFirst && existsSync17(pkgDir)) {
       console.error(`[IntegrationManager] Removing ${exactVersion ? "outdated" : "unusable"} install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -7160,28 +7482,28 @@ function agentAccess(token, opensSession) {
 }
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync18, existsSync as existsSync17 } from "fs";
-import { join as join17, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync19, existsSync as existsSync18 } from "fs";
+import { join as join18, resolve as resolve2 } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join17(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join17(dir, "index.json");
-  if (!existsSync17(indexPath)) {
+  const dir = resolve2(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join18(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join18(dir, "index.json");
+  if (!existsSync18(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync18(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync19(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join17(dir, relativePath);
+    const profilePath = join18(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync18(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync19(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName2 = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName2 && shortName2 !== profileId) {
@@ -7522,20 +7844,20 @@ async function controlPlaneMandate(dryRun, request) {
 }
 
 // src/lib/guides.ts
-import { existsSync as existsSync18, readdirSync, readFileSync as readFileSync19 } from "fs";
-import { dirname as dirname13, join as join18 } from "path";
+import { existsSync as existsSync19, readdirSync, readFileSync as readFileSync20 } from "fs";
+import { dirname as dirname14, join as join19 } from "path";
 var FILE_RE = /^(?:(\d+)-)?([a-z0-9][a-z0-9-]*)\.md$/;
 function builtinGuidesDir() {
   if (process.env.SUVEREN_BUILTIN_GUIDES_DIR) return process.env.SUVEREN_BUILTIN_GUIDES_DIR;
   let dir = import.meta.dirname ?? __dirname;
   for (let i = 0; i < 8; i++) {
-    const candidate = join18(dir, "content", "guides");
-    if (existsSync18(candidate)) return candidate;
-    const parent = dirname13(dir);
+    const candidate = join19(dir, "content", "guides");
+    if (existsSync19(candidate)) return candidate;
+    const parent = dirname14(dir);
     if (parent === dir) break;
     dir = parent;
   }
-  return join18(import.meta.dirname ?? __dirname, "content", "guides");
+  return join19(import.meta.dirname ?? __dirname, "content", "guides");
 }
 function parse(body) {
   const lines = body.split(/\r?\n/);
@@ -7546,14 +7868,14 @@ function parse(body) {
   return { title, summary };
 }
 function readDir(dir, source) {
-  if (!dir || !existsSync18(dir)) return [];
+  if (!dir || !existsSync19(dir)) return [];
   const out = [];
   for (const file of readdirSync(dir)) {
     const m = FILE_RE.exec(file);
     if (!m) continue;
     let body;
     try {
-      body = readFileSync19(join18(dir, file), "utf8");
+      body = readFileSync20(join19(dir, file), "utf8");
     } catch {
       continue;
     }
@@ -7815,7 +8137,6 @@ function resolveTargetProfile(input) {
 var CREATE_MANDATE_INPUT_SCHEMA = {
   type: "object",
   properties: {
-    team: { type: "string", description: 'Team name or id, or "personal". Omit to use the workspace of your Delegation mandate.' },
     // Short name only (e.g. "sales") — a full profile id is refused here, at input
     // validation, before the tool ever runs (DL1 Interface contract).
     profile: { type: "string", pattern: "^[a-z][a-z0-9-]*$", description: 'Profile short name, e.g. "sales" (newest version).' },
@@ -7905,7 +8226,6 @@ function setupBuiltin(deps) {
           hideUnlessAuthorized: true,
           // Shown like the mandate screen: limits and scope by the profile's own names.
           approvalView: {
-            team: { label: "Team" },
             profile: { label: "Profile", kind: "profile" },
             limits: { label: "Limits", kind: "profile-limits", profileArg: "profile" },
             scope: { label: "Scope", kind: "profile-scope", profileArg: "profile" },
@@ -7914,7 +8234,7 @@ function setupBuiltin(deps) {
             duration_hours: { label: "Valid for (hours)" },
             title: { label: "Title" }
           },
-          preview: { tool: "describe_mandate_proposal", args: { team: "team", profile: "profile", limits: "limits", scope: "scope", intent: "intent", mode: "mode", duration_hours: "duration_hours", title: "title" } }
+          preview: { tool: "describe_mandate_proposal", args: { profile: "profile", limits: "limits", scope: "scope", intent: "intent", mode: "mode", duration_hours: "duration_hours", title: "title" } }
         },
         // Internal preview tools (DL1): never listed, never callable by an
         // agent (BuiltinTool.internal — enforced in index.ts and
@@ -7987,7 +8307,7 @@ ${body}`);
       },
       {
         name: "create_mandate",
-        description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
+        description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). Always goes to the person's current workspace (their team, or Personal if they are not in one) \u2014 there is no way to name a different one. A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
         inputSchema: CREATE_MANDATE_INPUT_SCHEMA,
         validate: async (args) => {
           const fixed = delegationItselfRefusal(args);
@@ -8033,8 +8353,8 @@ ${body}`);
           }
           const { profile, shortName: targetShortName } = resolved;
           const displayName = profile.name ?? targetShortName;
-          const rawTeam = typeof args.team === "string" ? args.team.trim() : "";
-          const workspace = rawTeam && rawTeam.toLowerCase() !== "personal" ? rawTeam : "Personal";
+          const check = await controlPlaneMandate(true, mandateRequest(args));
+          const workspace = check.ok && check.groupName ? check.groupName : "Personal";
           const mode = typeof args.mode === "string" ? args.mode : "";
           const structured = {
             proposal: `New mandate \xB7 ${displayName}`,
@@ -8073,7 +8393,6 @@ ${body}`);
 }
 function mandateRequest(args) {
   return {
-    team: typeof args.team === "string" && args.team.trim() ? args.team.trim() : void 0,
     profile: args.profile,
     limits: args.limits,
     scope: args.scope,
@@ -8104,8 +8423,8 @@ function registerBuiltins(deps, factories = BUILTIN_FACTORIES) {
 import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 
 // src/lib/committed-executor.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync14, readFileSync as readFileSync20, unlinkSync as unlinkSync6, writeFileSync as writeFileSync14 } from "fs";
-import { dirname as dirname14, join as join19 } from "path";
+import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync21, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs";
+import { dirname as dirname15, join as join20 } from "path";
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -8133,7 +8452,7 @@ var ExecutorLock = class {
   path;
   held = false;
   constructor(dataDir2) {
-    this.path = join19(dataDir2, "executor.lock");
+    this.path = join20(dataDir2, "executor.lock");
   }
   /** Try to take the lock. Returns the holder's pid when someone else has it. */
   acquire() {
@@ -8141,9 +8460,9 @@ var ExecutorLock = class {
     if (current && current.pid !== process.pid && isAlive(current.pid)) {
       return { held: false, holderPid: current.pid };
     }
-    mkdirSync14(dirname14(this.path), { recursive: true, mode: 448 });
+    mkdirSync15(dirname15(this.path), { recursive: true, mode: 448 });
     const lock = { pid: process.pid, startedAt: Math.floor(Date.now() / 1e3) };
-    writeFileSync14(this.path, JSON.stringify(lock), { mode: 384 });
+    writeFileSync15(this.path, JSON.stringify(lock), { mode: 384 });
     this.held = true;
     return { held: true };
   }
@@ -8159,15 +8478,15 @@ var ExecutorLock = class {
     const current = this.read();
     if (current?.pid === process.pid) {
       try {
-        unlinkSync6(this.path);
+        unlinkSync7(this.path);
       } catch {
       }
     }
   }
   read() {
-    if (!existsSync19(this.path)) return null;
+    if (!existsSync20(this.path)) return null;
     try {
-      const parsed = JSON.parse(readFileSync20(this.path, "utf8"));
+      const parsed = JSON.parse(readFileSync21(this.path, "utf8"));
       return typeof parsed?.pid === "number" ? parsed : null;
     } catch {
       return null;
@@ -8184,20 +8503,20 @@ function isAlive(pid) {
 }
 
 // bin/http.ts
-import { homedir as homedir12 } from "os";
-import { join as join21 } from "path";
+import { homedir as homedir13 } from "os";
+import { join as join22 } from "path";
 
 // src/lib/mcp-as-tracker.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync21, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname15, join as join20 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync16, readFileSync as readFileSync22, writeFileSync as writeFileSync16 } from "fs";
+import { dirname as dirname16, join as join21 } from "path";
 function trackerPath(dataDir2) {
-  return join20(dataDir2, "mcp-as-pairing.json");
+  return join21(dataDir2, "mcp-as-pairing.json");
 }
 function readMcpPairedAsUrl(dataDir2) {
   const path = trackerPath(dataDir2);
-  if (!existsSync20(path)) return null;
+  if (!existsSync21(path)) return null;
   try {
-    const data = JSON.parse(readFileSync21(path, "utf-8"));
+    const data = JSON.parse(readFileSync22(path, "utf-8"));
     return typeof data.asUrl === "string" ? data.asUrl : null;
   } catch {
     return null;
@@ -8205,12 +8524,12 @@ function readMcpPairedAsUrl(dataDir2) {
 }
 function writeMcpPairedAsUrl(dataDir2, asUrl) {
   const path = trackerPath(dataDir2);
-  mkdirSync15(dirname15(path), { recursive: true, mode: 448 });
-  writeFileSync15(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
+  mkdirSync16(dirname16(path), { recursive: true, mode: 448 });
+  writeFileSync16(path, JSON.stringify({ asUrl }, null, 2), { encoding: "utf-8", mode: 384 });
 }
 
 // bin/http.ts
-var dataDir = process.env.SUVEREN_DATA_DIR ?? join21(homedir12(), ".suveren");
+var dataDir = process.env.SUVEREN_DATA_DIR ?? join22(homedir13(), ".suveren");
 var spUrl = resolveAsUrl(dataDir);
 validatePinTlsForUrl(resolvePinTls(dataDir), spUrl);
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
@@ -8295,7 +8614,8 @@ app.post("/internal/configure", internalOnly, (req, res) => {
     state.denialLog.setVaultKey(key);
     state.receiptArchive.setVaultKey(key);
     state.reportStore.setVaultKey(key);
-    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive + report store encryption active");
+    state.outcomeOutbox.setVaultKey(key);
+    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive + report store + outcome outbox encryption active");
   }
   if (apiKey) {
     state.spClient.setApiKey(apiKey);
@@ -8305,7 +8625,7 @@ app.post("/internal/configure", internalOnly, (req, res) => {
 });
 app.post("/internal/clear-session", internalOnly, (req, res) => {
   const reason = req.body?.reason;
-  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" ? reason : void 0;
+  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" || reason === "managed-wrong-team" ? reason : void 0;
   state.spClient.clearSession(validReason);
   console.error(`[Suveren MCP] Session cleared by control-plane (${validReason ?? "expired"})`);
   res.json({ ok: true });
@@ -8379,6 +8699,7 @@ app.post("/internal/run-committed", internalOnly, (_req, res) => {
   res.json({ ok: true });
 });
 app.post("/internal/resync-gates", internalOnly, async (_req, res) => {
+  await state.cache.refreshActiveWorkspace();
   const gates = state.gateStore.getAll();
   if (gates.length === 0) {
     res.json({ ok: true, synced: 0 });
@@ -8936,7 +9257,7 @@ app.listen(port, bindHost, () => {
     (proposal) => executeCommitted(proposal, state, integrationManager)
   );
   installCommittedExecutor(committedExecutor);
-  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join21(homedir12(), ".suveren");
+  const dataDir2 = process.env.SUVEREN_DATA_DIR ?? join22(homedir13(), ".suveren");
   const executorLock = new ExecutorLock(dataDir2);
   const lock = executorLock.acquire();
   if (!lock.held) {
@@ -8947,8 +9268,28 @@ app.listen(port, bindHost, () => {
   for (const sig of ["SIGINT", "SIGTERM", "exit"]) {
     process.once(sig, () => executorLock.release());
   }
+  async function pollRejectedOutcomes() {
+    try {
+      const rejected = await state.spClient.getRejectedProposals();
+      for (const proposal of rejected) {
+        const by = proposal.approverRejectedBy ?? proposal.rejectedBy;
+        if (!by) continue;
+        const submittedHere = state.proposalSubmissions.get(proposal.id) !== void 0;
+        if (!outcomeEntryFor(proposal, submittedHere, by.userId, Date.now())) continue;
+        const who = await resolveWhoLabel(
+          state.receiptArchive,
+          "domain" in by ? by.domain : by.userId,
+          by.userId
+        );
+        const entry = outcomeEntryFor(proposal, submittedHere, who, Date.now());
+        if (entry) state.outcomeOutbox.recordIfNew(entry);
+      }
+    } catch {
+    }
+  }
   let draining = false;
   async function executeCommittedProposals() {
+    void pollRejectedOutcomes();
     if (!executorLock.isHeld()) return;
     if (draining) return;
     draining = true;