@suveren/gateway 0.25.1 → 0.27.0

package/dist/mcp-server/http.mjs

@@ -154,7 +154,7 @@ import { dirname, join as join3 } from "path";
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
 import { spawnSync } from "child_process";
-var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod"];
+var POLICY_KEYS = ["AsUrl", "CaFile", "PinTls", "Proxy", "NoProxy", "Simulation", "InstallMethod", "Team"];
 var DEFAULT_REGISTRY_BASE_KEY = "SOFTWARE\\Policies\\Suveren\\Gateway";
 function registryKeyPath(hive) {
   const baseKey = process.env.SUVEREN_POLICY_REGISTRY_KEY || DEFAULT_REGISTRY_BASE_KEY;
@@ -190,6 +190,11 @@ function validateCaFile(candidate) {
   if (!existsSync2(trimmed)) return { ok: false, error: `No file at "${trimmed}".` };
   return { ok: true, path: trimmed };
 }
+function validateTeamId(candidate) {
+  const trimmed = candidate.trim();
+  if (!trimmed) return { ok: false, error: "The team id is empty." };
+  return { ok: true, id: trimmed };
+}
 function validateProxyUrl(candidate) {
   const trimmed = candidate.trim();
   if (!trimmed) return { ok: false, error: "The proxy URL is empty." };
@@ -363,6 +368,14 @@ function readPolicy() {
     policy.installMethod = "managed";
     locked.add("installMethod");
   }
+  if (merged.Team !== void 0) {
+    const v = validateTeamId(String(merged.Team));
+    if (!v.ok) {
+      throw new Error(`Invalid policy Team ("${String(merged.Team)}") from ${sourceOf.Team}: ${v.error}`);
+    }
+    policy.team = v.id;
+    locked.add("team");
+  }
   cached = { policy, locked };
   return cached;
 }
@@ -704,6 +717,42 @@ function describeFetchError(err) {
   return String(err);
 }
 
+// src/lib/cp-content-client.ts
+var CP_PORT2 = process.env.SUVEREN_CP_PORT ?? "3402";
+var CP_BASE2 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT2}`;
+var TIMEOUT_MS2 = 1e4;
+async function postInternal(path, body) {
+  const secret = process.env.SUVEREN_INTERNAL_SECRET ?? "";
+  if (!secret) {
+    throw new Error("No internal secret configured between the MCP server and the control plane.");
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    const res = await fetch(`${CP_BASE2}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Secret": secret },
+      body: JSON.stringify(body),
+      signal: controller.signal
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(data.error ?? `${path} failed: ${res.status}`);
+    }
+    return data;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function cpEncryptContent(toolArgs, recipientUserIds) {
+  const data = await postInternal("/internal/encrypt-content", { toolArgs, recipientUserIds });
+  return data;
+}
+async function cpDecryptContent(wire) {
+  const data = await postInternal("/internal/decrypt-content", { ciphertext: wire.ciphertext, keys: wire.keys });
+  return data.plaintext;
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -861,6 +910,32 @@ var SPClient = class {
     if (!res.ok) throw new Error(`SP compat request failed: ${res.status}`);
     return res.json();
   }
+  /**
+   * WS3 defence-in-depth (work-plan "Added 2026-10-11 — an account is
+   * Personal OR in one team"): the account's active TEAM id, or null when
+   * it currently has none (Personal mode) — `GET /api/groups/me`. Used only
+   * by AttestationCache.refreshActiveWorkspace, never on the hot tool-call
+   * path (it makes a live AS call).
+   */
+  async getActiveTeamGroupId() {
+    const res = await this.fetch("/api/groups/me");
+    if (!res.ok) throw new Error(`SP groups/me request failed: ${res.status}`);
+    const data = await res.json();
+    return data.group?.id ?? null;
+  }
+  /**
+   * The account's own Personal group id — `GET /api/groups`, the entry
+   * with `isPersonal`. Same caller/purpose as {@link getActiveTeamGroupId}:
+   * together they resolve "the active workspace" (the active team if any,
+   * else Personal) without the gateway ever guessing at an id shape.
+   */
+  async getPersonalGroupId() {
+    const res = await this.fetch("/api/groups");
+    if (!res.ok) throw new Error(`SP groups request failed: ${res.status}`);
+    const data = await res.json();
+    const personal = (data.groups ?? []).find((g) => g.isPersonal);
+    return personal?.id ?? null;
+  }
   /**
    * Get all mandates for an authorization id.
    *
@@ -905,7 +980,11 @@ var SPClient = class {
    * Errors throw SPReceiptError with the structured `errors` array in `body`.
    */
   async postReceipt(data) {
-    const body = JSON.stringify(data);
+    const { proposalContentHash, ...rest } = data;
+    const body = JSON.stringify({
+      ...rest,
+      ...proposalContentHash ? { proposal_content_hash: proposalContentHash } : {}
+    });
     const maxAttempts = data.idempotencyKey || data.proposalId ? this.receiptRetry.maxAttempts : 1;
     let lastError;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -945,8 +1024,20 @@ var SPClient = class {
   /**
    * Submit a proposal for deferred commitment review.
    * Phase 6: accepts optional pendingApprovers and createdBy for above-cap routing.
+   *
+   * PE1: toolArgs is encrypted (via the control plane's vault + the AS's
+   * registered public keys — cp-content-client.ts) before it ever reaches
+   * this method's request body; only the sealed `content` is sent, never
+   * `tool_args`. `recipientUserIds` are who besides the submitter (added by
+   * the control plane itself) must be able to read it back: the mandate
+   * owner, every pending approver (above-cap path), or every active member
+   * holding a pending domain (deferred-domain path) — decision 3 of the
+   * PE1 brief. `unreadableFor` is G4: anyone in that set with no registered
+   * end-to-end key — the proposal is still created for everyone who CAN
+   * read it; the caller reports who cannot.
    */
   async submitProposal(data) {
+    const { content, unreadableFor } = await cpEncryptContent(data.toolArgs, data.recipientUserIds);
     const res = await this.fetch("/api/proposals", {
       method: "POST",
       body: JSON.stringify({
@@ -955,7 +1046,7 @@ var SPClient = class {
         path: data.path,
         pending_domains: data.pendingDomains,
         tool: data.tool,
-        tool_args: data.toolArgs,
+        content,
         execution_context: data.executionContext,
         // Phase 6
         ...data.pendingApprovers && data.pendingApprovers.length > 0 ? { pending_approvers: data.pendingApprovers } : {},
@@ -963,11 +1054,12 @@ var SPClient = class {
       })
     });
     if (!res.ok) {
-      const body = await res.json().catch(() => ({}));
-      throw new Error(body.error ?? `SP proposal submission failed: ${res.status}`);
+      const body2 = await res.json().catch(() => ({}));
+      throw new Error(body2.error ?? `SP proposal submission failed: ${res.status}`);
     }
     void notifyControlPlane("proposal-added");
-    return res.json();
+    const body = await res.json();
+    return { proposal: body.proposal, unreadableFor };
   }
   /**
    * Phase 6: Fetch the authorization summary by its per-ceremony id.
@@ -1066,6 +1158,48 @@ var AttestationCache = class {
    * this fact to begin with.
    */
   reapprovalNeeded = /* @__PURE__ */ new Set();
+  /**
+   * WS3 defence-in-depth (work-plan "Added 2026-10-11 — an account is
+   * Personal OR in one team"): the account's current active workspace's
+   * group id — its active team, else its Personal group. `null` = not yet
+   * known (before the first {@link refreshActiveWorkspace}, or every
+   * lookup it tried failed) — filtering is then SKIPPED rather than
+   * refusing everything, because the Authority Server itself is the
+   * fail-closed authority at ticket time (decision 6, WS2); this is a
+   * second, narrower check for a window a buggy/stale cache entry could
+   * otherwise slip through in, not a replacement for that enforcement.
+   */
+  activeWorkspaceGroupId = null;
+  /**
+   * Re-resolve {@link activeWorkspaceGroupId} from the Authority Server.
+   * Called by the resync-gates flow (http.ts's `/internal/resync-gates`),
+   * never on the hot tool-call path — it makes up to two AS calls. Leaves
+   * the previous value in place on any failure (network error, unexpected
+   * shape): losing a known-good value on a transient blip would turn this
+   * defence-in-depth check into a false refusal of every cached mandate,
+   * which is worse than leaving it momentarily stale.
+   */
+  async refreshActiveWorkspace() {
+    try {
+      const activeTeam = await this.spClient.getActiveTeamGroupId();
+      if (activeTeam) {
+        this.activeWorkspaceGroupId = activeTeam;
+        return;
+      }
+      const personalId = await this.spClient.getPersonalGroupId();
+      if (personalId) this.activeWorkspaceGroupId = personalId;
+    } catch {
+    }
+  }
+  /**
+   * True only when `groupId` is KNOWN (not undefined) and the active
+   * workspace is ALSO known (not null) and they differ. Either side
+   * unknown ⇒ false: this check only ever narrows what gets selected, it
+   * never substitutes for the Authority Server's own enforcement.
+   */
+  isForeignWorkspace(groupId) {
+    return groupId !== void 0 && this.activeWorkspaceGroupId !== null && groupId !== this.activeWorkspaceGroupId;
+  }
   /**
    * Get the SP public key, fetching from SP if not cached or expired, then —
    * when a pin exists for this exact AS URL — verifying the live key still
@@ -1114,6 +1248,10 @@ var AttestationCache = class {
   getAuthorization(path) {
     const auth = this.authorizations.get(path);
     if (!auth) return null;
+    if (this.isForeignWorkspace(auth.groupId)) {
+      this.authorizations.delete(path);
+      return null;
+    }
     const now = Math.floor(Date.now() / 1e3);
     const hasValid = auth.attestations.some((a) => a.expiresAt > now);
     if (!hasValid) {
@@ -1138,6 +1276,13 @@ var AttestationCache = class {
       );
     }
     const bounds = result.bounds ?? result.frame ?? {};
+    let groupId;
+    try {
+      const summary = await this.spClient.getAuthorizationSummary(authorizationId);
+      groupId = summary?.group_id ?? void 0;
+    } catch {
+      groupId = void 0;
+    }
     let signedCommitmentMode;
     let subjects;
     const firstBlob = result.attestations[0]?.blob;
@@ -1172,7 +1317,8 @@ var AttestationCache = class {
       deferredCommitmentDomains: result.deferred_commitment_domains ?? [],
       signedCommitmentMode,
       subjects,
-      complete: result.complete
+      complete: result.complete,
+      groupId
     };
     this.authorizations.set(auth.authorizationId, auth);
     return auth;
@@ -1184,6 +1330,10 @@ var AttestationCache = class {
     const now = Math.floor(Date.now() / 1e3);
     const results = [];
     for (const [path, auth] of this.authorizations) {
+      if (this.isForeignWorkspace(auth.groupId)) {
+        this.authorizations.delete(path);
+        continue;
+      }
       const hasValid = auth.attestations.some((a) => a.expiresAt > now);
       if (hasValid) {
         results.push(auth);
@@ -3179,6 +3329,11 @@ function asUrlChangedNotice(what) {
 
 TELL THE USER: open ${uiUrl()} and sign in again to pair with the new Authority Server.`;
 }
+function managedWrongTeamNotice(what) {
+  return `${what} Suveren gateway is LOCKED because it is set up by IT for one specific team, and the signed-in account is no longer in that team (it left, or was removed). This is NOT an ended sign-in \u2014 signing in again will be refused until the account is back in that team.
+
+TELL THE USER: ask your IT administrator, or sign in with an account that is in the team this gateway is set up for, at ${uiUrl()}. Nothing ran while unsigned.`;
+}
 function lockedNotice(action, reason = "restart") {
   const what = action ? `Cannot ${action}: the` : "The";
   switch (reason) {
@@ -3190,6 +3345,8 @@ function lockedNotice(action, reason = "restart") {
       return asTlsMismatchNotice(what);
     case "as-url-changed":
       return asUrlChangedNotice(what);
+    case "managed-wrong-team":
+      return managedWrongTeamNotice(what);
     default:
       return bootLockedNotice(what);
   }
@@ -3643,6 +3800,20 @@ async function verifyTicket(cache, receipt, expected) {
   }
 }
 
+// src/lib/who-label.ts
+var UNKNOWN_DECIDER = "the person";
+async function resolveWhoLabel(archive, domainKey, userId) {
+  if (!archive) return UNKNOWN_DECIDER;
+  try {
+    const dir = await getIdentityDirectory(archive);
+    const did = dir.domainDids.get(domainKey) ?? dir.domainDids.get(userId);
+    const name = did ? dir.names.get(did) : void 0;
+    return name ?? UNKNOWN_DECIDER;
+  } catch {
+    return UNKNOWN_DECIDER;
+  }
+}
+
 // src/lib/arg-encoding.ts
 function rfc2047Encode(value) {
   if (!/[^\x00-\x7F]/.test(value)) return value;
@@ -3962,6 +4133,14 @@ async function attachImagePreview(args) {
     return args;
   }
 }
+async function unreadableForNote(unreadableFor, state2) {
+  if (unreadableFor.length === 0) return "";
+  const labels = await Promise.all(
+    unreadableFor.map((id) => resolveWhoLabel(state2.receiptArchive, id, id))
+  );
+  return `
+Note: ${labels.join(", ")} cannot read this proposal's content yet \u2014 no device of theirs has registered an end-to-end key.`;
+}
 function applyMapping(m, value, execution) {
   if (m.divisor) {
     const numValue = typeof value === "number" ? value : Number(value);
@@ -4536,14 +4715,22 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         try {
           const enrichedArgs = await attachImagePreview(args);
           const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-          const { proposal } = await state2.spClient.submitProposal({
+          let recipientUserIds = [...auth.deferredCommitmentDomains];
+          try {
+            const summary = await state2.spClient.getAuthorizationSummary(authzId);
+            if (summary?.created_by) recipientUserIds = [summary.created_by, ...recipientUserIds];
+          } catch {
+          }
+          recipientUserIds = [...new Set(recipientUserIds)];
+          const { proposal, unreadableFor } = await state2.spClient.submitProposal({
             authorizationId: authzId,
             profileId: auth.profileId,
             path: auth.path,
             pendingDomains: auth.deferredCommitmentDomains,
             tool: tool.namespacedName,
             toolArgs: enrichedArgs,
-            executionContext: wireExecCtx
+            executionContext: wireExecCtx,
+            recipientUserIds
           });
           const previewHash = await computeSubmissionPreviewHash(
             integrationManager2,
@@ -4564,7 +4751,7 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
             content: [{
               type: "text",
               text: `Awaiting commitment from domain${auth.deferredCommitmentDomains.length > 1 ? "s" : ""} "${auth.deferredCommitmentDomains.join('", "')}" for tool ${tool.originalName}.
-Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposal_id: "${proposal.id}").`
+Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposal_id: "${proposal.id}").` + await unreadableForNote(unreadableFor ?? [], state2)
             }]
           };
         } catch (err) {
@@ -4714,7 +4901,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           try {
             const enrichedArgs = await attachImagePreview(args);
             const wireExecCtx = wireExecutionContext(auth.profileId, execution);
-            const { proposal } = await state2.spClient.submitProposal({
+            const { proposal, unreadableFor } = await state2.spClient.submitProposal({
               authorizationId: authzId,
               profileId: auth.profileId,
               path: auth.path,
@@ -4722,7 +4909,8 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               tool: tool.namespacedName,
               toolArgs: enrichedArgs,
               executionContext: wireExecCtx,
-              pendingApprovers: uniqueApprovers
+              pendingApprovers: uniqueApprovers,
+              recipientUserIds: uniqueApprovers
             });
             const previewHash = await computeSubmissionPreviewHash(
               integrationManager2,
@@ -4743,7 +4931,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
               content: [{
                 type: "text",
                 text: `Action exceeds team cap. Approval required from ${uniqueApprovers.length} reviewer(s).
-Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.`
+Proposal ID: ${proposal.id}. Use check-pending-commitments to track status.` + await unreadableForNote(unreadableFor ?? [], state2)
               }]
             };
           } catch (proposalErr) {
@@ -5310,17 +5498,54 @@ function listIntegrationsHandler(state2, integrationManager2) {
 // src/tools/commitments.ts
 import { ContentBindingError as ContentBindingError2 } from "@hap/core";
 
-// src/lib/who-label.ts
-var UNKNOWN_DECIDER = "the person";
-async function resolveWhoLabel(archive, domainKey, userId) {
-  if (!archive) return UNKNOWN_DECIDER;
+// src/lib/proposal-content.ts
+import { createHash as createHash3 } from "crypto";
+import { canonicalize } from "@hap/core";
+var ProposalContentError = class extends Error {
+};
+function computeProposalContentHash(toolArgs) {
+  return `sha256:${createHash3("sha256").update(canonicalize(toolArgs)).digest("hex")}`;
+}
+async function resolveProposalToolArgs(proposal) {
+  if (proposal.toolArgs) return proposal.toolArgs;
+  if (!proposal.content) {
+    throw new ProposalContentError(`Proposal ${proposal.id} carries neither tool_args nor content \u2014 cannot execute.`);
+  }
+  let plaintext;
   try {
-    const dir = await getIdentityDirectory(archive);
-    const did = dir.domainDids.get(domainKey) ?? dir.domainDids.get(userId);
-    const name = did ? dir.names.get(did) : void 0;
-    return name ?? UNKNOWN_DECIDER;
+    plaintext = await cpDecryptContent(proposal.content);
+  } catch (err) {
+    throw new ProposalContentError(`Could not decrypt the approved content on this device: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(plaintext);
   } catch {
-    return UNKNOWN_DECIDER;
+    throw new ProposalContentError(`Proposal ${proposal.id}: decrypted content is not valid JSON.`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ProposalContentError(`Proposal ${proposal.id}: decrypted content is not a JSON object.`);
+  }
+  const toolArgs = parsed;
+  if (proposal.content.hash) {
+    const actual = computeProposalContentHash(toolArgs);
+    if (actual !== proposal.content.hash) {
+      throw new ProposalContentError(
+        `Proposal ${proposal.id}: decrypted content does not match its own fingerprint \u2014 refusing to execute.`
+      );
+    }
+  }
+  return toolArgs;
+}
+async function decryptRejectionNote(by) {
+  if (!by) return void 0;
+  if (typeof by.note === "string") return by.note;
+  if (!by.noteEncrypted) return void 0;
+  try {
+    return await cpDecryptContent(by.noteEncrypted);
+  } catch (err) {
+    console.error("[Suveren MCP] Failed to decrypt a change-needed note:", err);
+    return "(could not decrypt this note on this device)";
   }
 }
 
@@ -5332,6 +5557,7 @@ var installedExecutor = null;
 function installCommittedExecutor(executor) {
   installedExecutor = executor;
 }
+var warnedSkippedProposalIds = /* @__PURE__ */ new Set();
 function runCommitted(proposal, state2, integrationManager2) {
   return installedExecutor ? installedExecutor.execute(proposal) : executeCommitted(proposal, state2, integrationManager2);
 }
@@ -5355,15 +5581,28 @@ async function executeCommitted(proposal, state2, integrationManager2) {
   const cachedAuth = state2.cache.getAllAuthorizations().find((a) => a.authorizationId === proposal.authorizationId);
   const submitted = state2.proposalSubmissions.get(proposal.id);
   if (!submitted) {
-    console.error(
-      `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
-    );
-    return { text: buildSkippedProposalNote(proposal.id) };
+    if (!warnedSkippedProposalIds.has(proposal.id)) {
+      warnedSkippedProposalIds.add(proposal.id);
+      console.error(
+        `[Suveren MCP] Proposal ${proposal.id} is committed but has no local submission record on this gateway \u2014 leaving it for whichever gateway submitted it (this is normal for a different device of the same operator, or the AS lists a proposal we never submitted).`
+      );
+    }
+    return { text: buildSkippedProposalNote(proposal.id), skipped: true };
+  }
+  let toolArgs;
+  try {
+    toolArgs = await resolveProposalToolArgs(proposal);
+  } catch (err) {
+    const msg = err instanceof ProposalContentError ? err.message : `Could not resolve the approved content on this device: ${err instanceof Error ? err.message : String(err)}`;
+    return {
+      text: `Proposal ${proposal.id}: blocked \u2014 ${msg} The action was not executed.`,
+      isError: true
+    };
   }
   {
     const mismatches = [];
     if (submitted.tool !== proposal.tool) mismatches.push("tool");
-    if (submitted.toolArgsHash !== hashToolArgs(proposal.toolArgs)) mismatches.push("arguments");
+    if (submitted.toolArgsHash !== hashToolArgs(toolArgs)) mismatches.push("arguments");
     if (submitted.executionContextHash !== hashToolArgs(proposal.executionContext)) mismatches.push("executionContext");
     if (submitted.authorizationId !== proposal.authorizationId) mismatches.push("authorizationId");
     if (submitted.profileId !== proposal.profileId) mismatches.push("profileId");
@@ -5381,7 +5620,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     const binding = computeContentBinding(
       proposal.profileId,
       discovered,
-      proposal.toolArgs,
+      toolArgs,
       proposalActionType
     );
     const { receipt, idempotent } = await state2.spClient.postReceipt({
@@ -5395,7 +5634,12 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       executionContext: proposal.executionContext,
       amount: typeof proposal.executionContext.amount === "number" ? proposal.executionContext.amount : void 0,
       proposalId: proposal.id,
-      toolArgs: proposal.toolArgs,
+      toolArgs,
+      // PE1 — the fingerprint of what THIS gateway resolved (decrypted, or
+      // read plain on a legacy row) and is about to execute. The AS compares
+      // it against its own stored content_hash and refuses without echoing
+      // content on a mismatch.
+      proposalContentHash: computeProposalContentHash(toolArgs),
       // Deliberately NO idempotencyKey: the spec has review-mode commits carry
       // a proposalId INSTEAD of a key — the proposal's committed→executed
       // transition is their replay protection, and the AS replays the ORIGINAL
@@ -5429,7 +5673,11 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       attestations: cachedAuth?.attestations,
       // What the human actually approved, kept next to the receipt that cites
       // it — otherwise `proposalId` is a pointer to a server we may not have.
-      proposal,
+      // PE1: the archived copy carries the RESOLVED (decrypted on an
+      // encrypted row) toolArgs, never the sealed `content` — this archive
+      // is this gateway's own local evidence and has always stored it
+      // readable, same as every legacy row.
+      proposal: { ...proposal, toolArgs },
       boundContent: binding?.boundContent
     });
   } catch (err) {
@@ -5488,7 +5736,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     ticketId: receiptId,
     proposalId: proposal.id,
     tool: proposal.tool,
-    argsHash: hashToolArgs(proposal.toolArgs)
+    argsHash: hashToolArgs(toolArgs)
   });
   if (!begun.ok) {
     const prior = begun.existing;
@@ -5513,7 +5761,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       integrationManager2,
       integrationId,
       toolName,
-      proposal.toolArgs,
+      toolArgs,
       submitted.previewHash
     );
     if (changed) {
@@ -5525,7 +5773,7 @@ async function executeCommitted(proposal, state2, integrationManager2) {
     }
   }
   try {
-    let outgoingArgs = proposal.toolArgs;
+    let outgoingArgs = toolArgs;
     if (discovered && receiptId) {
       if (shouldAttachFooter()) {
         outgoingArgs = appendVerificationFooter(discovered, outgoingArgs, receiptId, cachedAuth?.subjects?.[0]);
@@ -5631,10 +5879,11 @@ Result: ${JSON.stringify(match.executionResult, null, 2)}` : " The action ran; t
             by.userId
           ) : "a person";
           if (outcome === "change_needed") {
+            const note = await decryptRejectionNote(by);
             return {
               content: [{
                 type: "text",
-                text: `Proposal ${match.id} was SENT BACK FOR A CHANGE by ${who}: "${by?.note ?? ""}". The action did not run. You may adjust it and propose again \u2014 a new proposal the person approves again. Do not resend the same values.`
+                text: `Proposal ${match.id} was SENT BACK FOR A CHANGE by ${who}: "${note ?? ""}". The action did not run. You may adjust it and propose again \u2014 a new proposal the person approves again. Do not resend the same values.`
               }]
             };
           }
@@ -7719,13 +7968,13 @@ var reportBuiltin = (deps) => ({
 });
 
 // src/lib/cp-mandate.ts
-var CP_PORT2 = process.env.SUVEREN_CP_PORT ?? "3402";
-var CP_BASE2 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT2}`;
+var CP_PORT3 = process.env.SUVEREN_CP_PORT ?? "3402";
+var CP_BASE3 = process.env.SUVEREN_CP_INTERNAL_URL ?? `http://127.0.0.1:${CP_PORT3}`;
 async function controlPlaneMandate(dryRun, request) {
   const secret = process.env.SUVEREN_INTERNAL_SECRET ?? "";
   if (!secret) return { ok: false, message: "the gateway is not fully started (no control plane connection)." };
   try {
-    const res = await fetch(`${CP_BASE2}/internal/mandate`, {
+    const res = await fetch(`${CP_BASE3}/internal/mandate`, {
       method: "POST",
       headers: { "Content-Type": "application/json", "X-Internal-Secret": secret },
       body: JSON.stringify({ dryRun, request }),
@@ -8033,7 +8282,6 @@ function resolveTargetProfile(input) {
 var CREATE_MANDATE_INPUT_SCHEMA = {
   type: "object",
   properties: {
-    team: { type: "string", description: 'Team name or id, or "personal". Omit to use the workspace of your Delegation mandate.' },
     // Short name only (e.g. "sales") — a full profile id is refused here, at input
     // validation, before the tool ever runs (DL1 Interface contract).
     profile: { type: "string", pattern: "^[a-z][a-z0-9-]*$", description: 'Profile short name, e.g. "sales" (newest version).' },
@@ -8123,7 +8371,6 @@ function setupBuiltin(deps) {
           hideUnlessAuthorized: true,
           // Shown like the mandate screen: limits and scope by the profile's own names.
           approvalView: {
-            team: { label: "Team" },
             profile: { label: "Profile", kind: "profile" },
             limits: { label: "Limits", kind: "profile-limits", profileArg: "profile" },
             scope: { label: "Scope", kind: "profile-scope", profileArg: "profile" },
@@ -8132,7 +8379,7 @@ function setupBuiltin(deps) {
             duration_hours: { label: "Valid for (hours)" },
             title: { label: "Title" }
           },
-          preview: { tool: "describe_mandate_proposal", args: { team: "team", profile: "profile", limits: "limits", scope: "scope", intent: "intent", mode: "mode", duration_hours: "duration_hours", title: "title" } }
+          preview: { tool: "describe_mandate_proposal", args: { profile: "profile", limits: "limits", scope: "scope", intent: "intent", mode: "mode", duration_hours: "duration_hours", title: "title" } }
         },
         // Internal preview tools (DL1): never listed, never callable by an
         // agent (BuiltinTool.internal — enforced in index.ts and
@@ -8205,7 +8452,7 @@ ${body}`);
       },
       {
         name: "create_mandate",
-        description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
+        description: "Propose a new mandate for the person running this gateway \u2014 the authority another tool needs (e.g. sales quotes up to a value). Always goes to the person's current workspace (their team, or Personal if they are not in one) \u2014 there is no way to name a different one. A person approves or rejects the proposal; only after approval is the mandate created, exactly as if they had signed it on the mandate screen. Checked against the profile before the proposal: unknown limits, a mode the profile does not allow, or a team where the person may not give this mandate are refused at once. Outside simulation mode, the profile and mode you may propose are themselves limited by your Delegation mandate's scope \u2014 Delegation itself can never be proposed. Create only.",
         inputSchema: CREATE_MANDATE_INPUT_SCHEMA,
         validate: async (args) => {
           const fixed = delegationItselfRefusal(args);
@@ -8251,8 +8498,8 @@ ${body}`);
           }
           const { profile, shortName: targetShortName } = resolved;
           const displayName = profile.name ?? targetShortName;
-          const rawTeam = typeof args.team === "string" ? args.team.trim() : "";
-          const workspace = rawTeam && rawTeam.toLowerCase() !== "personal" ? rawTeam : "Personal";
+          const check = await controlPlaneMandate(true, mandateRequest(args));
+          const workspace = check.ok && check.groupName ? check.groupName : "Personal";
           const mode = typeof args.mode === "string" ? args.mode : "";
           const structured = {
             proposal: `New mandate \xB7 ${displayName}`,
@@ -8291,7 +8538,6 @@ ${body}`);
 }
 function mandateRequest(args) {
   return {
-    team: typeof args.team === "string" && args.team.trim() ? args.team.trim() : void 0,
     profile: args.profile,
     limits: args.limits,
     scope: args.scope,
@@ -8324,6 +8570,10 @@ import { decodeMandateBlob as decodeMandateBlob3 } from "@hap/core";
 // src/lib/committed-executor.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync15, readFileSync as readFileSync21, unlinkSync as unlinkSync7, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname15, join as join20 } from "path";
+function describeAutoExecutionLog(proposalId, tool, result) {
+  if (result.skipped) return null;
+  return result.isError ? `[Suveren MCP] Auto-exec proposal ${proposalId}: ${result.text}` : `[Suveren MCP] Auto-executed proposal ${proposalId}: ${tool}`;
+}
 var CommittedExecutor = class {
   constructor(run) {
     this.run = run;
@@ -8524,7 +8774,7 @@ app.post("/internal/configure", internalOnly, (req, res) => {
 });
 app.post("/internal/clear-session", internalOnly, (req, res) => {
   const reason = req.body?.reason;
-  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" ? reason : void 0;
+  const validReason = reason === "as-key-mismatch" || reason === "as-tls-mismatch" || reason === "as-url-changed" || reason === "managed-wrong-team" ? reason : void 0;
   state.spClient.clearSession(validReason);
   console.error(`[Suveren MCP] Session cleared by control-plane (${validReason ?? "expired"})`);
   res.json({ ok: true });
@@ -8598,6 +8848,7 @@ app.post("/internal/run-committed", internalOnly, (_req, res) => {
   res.json({ ok: true });
 });
 app.post("/internal/resync-gates", internalOnly, async (_req, res) => {
+  await state.cache.refreshActiveWorkspace();
   const gates = state.gateStore.getAll();
   if (gates.length === 0) {
     res.json({ ok: true, synced: 0 });
@@ -9179,7 +9430,13 @@ app.listen(port, bindHost, () => {
           "domain" in by ? by.domain : by.userId,
           by.userId
         );
-        const entry = outcomeEntryFor(proposal, submittedHere, who, Date.now());
+        const note = await decryptRejectionNote(by);
+        const proposalWithDecryptedNote = {
+          ...proposal,
+          rejectedBy: proposal.rejectedBy ? { ...proposal.rejectedBy, note } : null,
+          approverRejectedBy: proposal.approverRejectedBy ? { ...proposal.approverRejectedBy, note } : void 0
+        };
+        const entry = outcomeEntryFor(proposalWithDecryptedNote, submittedHere, who, Date.now());
         if (entry) state.outcomeOutbox.recordIfNew(entry);
       }
     } catch {
@@ -9195,10 +9452,9 @@ app.listen(port, bindHost, () => {
       const committed = await state.spClient.getCommittedProposals();
       for (const proposal of committed) {
         try {
-          const { text, isError } = await committedExecutor.execute(proposal);
-          console.error(
-            isError ? `[Suveren MCP] Auto-exec proposal ${proposal.id}: ${text}` : `[Suveren MCP] Auto-executed proposal ${proposal.id}: ${proposal.tool}`
-          );
+          const result = await committedExecutor.execute(proposal);
+          const line = describeAutoExecutionLog(proposal.id, proposal.tool, result);
+          if (line) console.error(line);
         } catch (err) {
           console.error(`[Suveren MCP] Failed to execute proposal ${proposal.id}:`, err);
         }