@suveren/gateway 0.7.4 → 0.8.0

package/dist/mcp-server/http.mjs

@@ -33,6 +33,85 @@ async function notifyControlPlane(type) {
   }
 }
 
+// src/lib/client-version.ts
+import { createRequire } from "module";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var UNKNOWN = "unknown";
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function detectGatewayVersion() {
+  const override = process.env.SUVEREN_GATEWAY_VERSION;
+  if (override) return override;
+  const start = import.meta.dirname ?? process.cwd();
+  let dir = start;
+  for (let up = 0; up < 6; up++) {
+    const pkg = readJson(join(dir, "package.json"));
+    const name = pkg?.name;
+    const version = pkg?.version;
+    if (typeof version === "string" && (name === "@suveren/gateway" || name === "suveren-gateway")) {
+      return version;
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return process.env.HAP_BUILD_SHA ?? UNKNOWN;
+}
+function findPackageVersion(entry, wantName) {
+  let dir = join(entry, "..");
+  for (let up = 0; up < 6; up++) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      const pkg = readJson(candidate);
+      if (typeof pkg?.version === "string" && (pkg.name === wantName || pkg.name === "@hap/core")) {
+        return pkg.name === wantName ? pkg.version : null;
+      }
+    }
+    const parent = join(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function detectHapCoreVersion() {
+  const CORE = "@humanagencyp/hap-core";
+  let req;
+  try {
+    req = createRequire(import.meta.url);
+  } catch {
+    return UNKNOWN;
+  }
+  try {
+    const v = findPackageVersion(req.resolve(CORE), CORE);
+    if (v) return v;
+  } catch {
+  }
+  try {
+    const wrapperEntry = req.resolve("@hap/core");
+    const v = findPackageVersion(wrapperEntry, CORE);
+    if (v) return v;
+    const wrapperReq = createRequire(wrapperEntry);
+    const v2 = findPackageVersion(wrapperReq.resolve(CORE), CORE);
+    if (v2) return v2;
+  } catch {
+  }
+  return UNKNOWN;
+}
+var GATEWAY_VERSION = detectGatewayVersion();
+var HAP_CORE_VERSION = detectHapCoreVersion();
+function clientVersionHeaders() {
+  return {
+    "x-suveren-gateway-version": GATEWAY_VERSION,
+    "x-hap-core-version": HAP_CORE_VERSION
+  };
+}
+
 // src/lib/sp-client.ts
 var SPReceiptError = class extends Error {
   constructor(message, statusCode, body) {
@@ -55,6 +134,10 @@ var SPClient = class {
   sessionCookie = "";
   apiKey = "";
   receiptRetry;
+  /** The AS base URL this client talks to (for provenance records). */
+  get url() {
+    return this.baseUrl;
+  }
   setApiKey(key) {
     this.apiKey = key;
   }
@@ -78,6 +161,11 @@ var SPClient = class {
     const url = `${this.baseUrl}${path}`;
     const headers = {
       "Content-Type": "application/json",
+      // Identify the caller so the AS can answer "what is deployed against
+      // me?" and name a version in an upgrade instruction. Advisory only —
+      // never used for authorization. Sent on every call, not just receipts,
+      // so the picture is not skewed toward one endpoint.
+      ...clientVersionHeaders(),
       ...init?.headers
     };
     if (this.sessionCookie) {
@@ -374,11 +462,11 @@ var AttestationCache = class {
 };
 
 // src/lib/gate-store.ts
-import { mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2, unlinkSync } from "fs";
 import { homedir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join(homedir(), ".suveren");
+var DEFAULT_DIR = process.env.SUVEREN_DATA_DIR ?? join2(homedir(), ".suveren");
 var GateStore = class {
   entries = /* @__PURE__ */ new Map();
   baseDir;
@@ -396,11 +484,11 @@ var GateStore = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync(this.encryptedFilePath)) {
+    if (existsSync2(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.size > 0) {
       this.persistEncrypted();
-      if (existsSync(this.plaintextFilePath)) {
+      if (existsSync2(this.plaintextFilePath)) {
         try {
           unlinkSync(this.plaintextFilePath);
         } catch {
@@ -451,19 +539,19 @@ var GateStore = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join(this.baseDir, "gates.json");
+    return join2(this.baseDir, "gates.json");
   }
   get encryptedFilePath() {
-    return join(this.baseDir, "gates.enc.json");
+    return join2(this.baseDir, "gates.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync(this.plaintextFilePath)) {
+    if (!existsSync2(this.plaintextFilePath)) {
       mkdirSync(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = new Map(Object.entries(data.entries));
     } catch {
@@ -472,9 +560,9 @@ var GateStore = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync(this.encryptedFilePath)) return;
+    if (!existsSync2(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = /* @__PURE__ */ new Map();
       for (const [key, blob] of Object.entries(data.entries)) {
@@ -515,11 +603,11 @@ var GateStore = class {
 };
 
 // src/lib/execution-log.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, unlinkSync as unlinkSync2 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
-var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join2(homedir2(), ".suveren");
+var DEFAULT_DIR2 = process.env.SUVEREN_DATA_DIR ?? join3(homedir2(), ".suveren");
 var MAX_AGE_SECONDS = 31 * 24 * 60 * 60;
 var ExecutionLog = class {
   entries = [];
@@ -538,11 +626,11 @@ var ExecutionLog = class {
    */
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync2(this.encryptedFilePath)) {
+    if (existsSync3(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.entries.length > 0) {
       this.persistEncrypted();
-      if (existsSync2(this.plaintextFilePath)) {
+      if (existsSync3(this.plaintextFilePath)) {
         try {
           unlinkSync2(this.plaintextFilePath);
         } catch {
@@ -637,19 +725,19 @@ var ExecutionLog = class {
   }
   // ─── File paths ─────────────────────────────────────────────────────────
   get plaintextFilePath() {
-    return join2(this.baseDir, "execution-log.json");
+    return join3(this.baseDir, "execution-log.json");
   }
   get encryptedFilePath() {
-    return join2(this.baseDir, "execution-log.enc.json");
+    return join3(this.baseDir, "execution-log.enc.json");
   }
   // ─── Load / Persist ─────────────────────────────────────────────────────
   loadPlaintext() {
-    if (!existsSync2(this.plaintextFilePath)) {
+    if (!existsSync3(this.plaintextFilePath)) {
       mkdirSync2(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync2(this.plaintextFilePath, "utf-8");
+      const raw = readFileSync3(this.plaintextFilePath, "utf-8");
       const data = JSON.parse(raw);
       this.entries = data.entries;
       this.prune();
@@ -659,9 +747,9 @@ var ExecutionLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync2(this.encryptedFilePath)) return;
+    if (!existsSync3(this.encryptedFilePath)) return;
     try {
-      const raw = readFileSync2(this.encryptedFilePath, "utf-8");
+      const raw = readFileSync3(this.encryptedFilePath, "utf-8");
       const data = JSON.parse(raw);
       const decrypted = this.decrypt(data.blob);
       const logFile = JSON.parse(decrypted);
@@ -708,11 +796,11 @@ function windowCutoff(window, now) {
 }
 
 // src/lib/denial-log.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, unlinkSync as unlinkSync3 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, unlinkSync as unlinkSync3 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3 } from "crypto";
-var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join3(homedir3(), ".suveren");
+var DEFAULT_DIR3 = process.env.SUVEREN_DATA_DIR ?? join4(homedir3(), ".suveren");
 var MAX_RECORDS = 200;
 var MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
 var DenialLog = class {
@@ -725,11 +813,11 @@ var DenialLog = class {
   }
   setVaultKey(key) {
     this.vaultKey = key;
-    if (existsSync3(this.encryptedFilePath)) {
+    if (existsSync4(this.encryptedFilePath)) {
       this.loadEncrypted();
     } else if (this.records.length > 0) {
       this.persistEncrypted();
-      if (existsSync3(this.plaintextFilePath)) {
+      if (existsSync4(this.plaintextFilePath)) {
         try {
           unlinkSync3(this.plaintextFilePath);
         } catch {
@@ -779,18 +867,18 @@ var DenialLog = class {
     return Buffer.concat([decipher.update(Buffer.from(blob.ciphertext, "hex")), decipher.final()]).toString("utf8");
   }
   get plaintextFilePath() {
-    return join3(this.baseDir, "denials.json");
+    return join4(this.baseDir, "denials.json");
   }
   get encryptedFilePath() {
-    return join3(this.baseDir, "denials.enc.json");
+    return join4(this.baseDir, "denials.enc.json");
   }
   loadPlaintext() {
-    if (!existsSync3(this.plaintextFilePath)) {
+    if (!existsSync4(this.plaintextFilePath)) {
       mkdirSync3(this.baseDir, { recursive: true });
       return;
     }
     try {
-      const data = JSON.parse(readFileSync3(this.plaintextFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.plaintextFilePath, "utf-8"));
       this.records = data.records ?? [];
     } catch {
       console.error(`[DenialLog] Could not parse ${this.plaintextFilePath}, starting fresh`);
@@ -798,9 +886,9 @@ var DenialLog = class {
     }
   }
   loadEncrypted() {
-    if (!existsSync3(this.encryptedFilePath)) return;
+    if (!existsSync4(this.encryptedFilePath)) return;
     try {
-      const data = JSON.parse(readFileSync3(this.encryptedFilePath, "utf-8"));
+      const data = JSON.parse(readFileSync4(this.encryptedFilePath, "utf-8"));
       const logFile = JSON.parse(this.decrypt(data.blob));
       this.records = logFile.records ?? [];
     } catch (err) {
@@ -825,12 +913,242 @@ var DenialLog = class {
   }
 };
 
+// src/lib/receipt-archive.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5, unlinkSync as unlinkSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname4, join as join5 } from "path";
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes4 } from "crypto";
+var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join5(homedir4(), ".suveren");
+function stripPreviews(proposal) {
+  const args = proposal.toolArgs;
+  if (!args || typeof args !== "object") return proposal;
+  const { _imagePreview, ...rest } = args;
+  if (_imagePreview === void 0) return proposal;
+  return { ...proposal, toolArgs: rest };
+}
+var ReceiptArchive = class {
+  data = { version: 1, authorizations: {}, receipts: [] };
+  baseDir;
+  vaultKey = null;
+  constructor(filePath) {
+    if (filePath && filePath.endsWith(".json")) {
+      this.baseDir = dirname4(filePath);
+    } else {
+      this.baseDir = filePath ?? DEFAULT_DIR4;
+    }
+    this.loadPlaintext();
+  }
+  /**
+   * Set the vault key for encryption. Triggers migration from plaintext if needed.
+   */
+  setVaultKey(key) {
+    this.vaultKey = key;
+    if (existsSync5(this.encryptedFilePath)) {
+      this.loadEncrypted();
+    } else if (this.data.receipts.length > 0 || Object.keys(this.data.authorizations).length > 0) {
+      this.persistEncrypted();
+      if (existsSync5(this.plaintextFilePath)) {
+        try {
+          unlinkSync4(this.plaintextFilePath);
+        } catch {
+        }
+      }
+    }
+  }
+  /**
+   * True when encrypted evidence exists on disk that this process cannot read
+   * yet (no vault key). Callers MUST NOT present the archive as "empty" in
+   * this state — that would report a hollow success over unreadable evidence.
+   */
+  isLocked() {
+    return this.vaultKey === null && existsSync5(this.encryptedFilePath);
+  }
+  /**
+   * Archive a signed receipt (and the grant it was issued under).
+   * Idempotent on receipt id — a replayed receipt is recorded once.
+   */
+  record(entry, now = Math.floor(Date.now() / 1e3)) {
+    let changed = false;
+    const receiptId = typeof entry.receipt?.id === "string" ? entry.receipt.id : void 0;
+    const alreadyArchived = receiptId !== void 0 && this.data.receipts.some((r) => r.receipt.id === receiptId);
+    if (!alreadyArchived) {
+      this.data.receipts.push({
+        archivedAt: now,
+        authorizationId: entry.authorizationId,
+        asUrl: entry.asUrl,
+        asPublicKey: entry.asPublicKey,
+        receipt: entry.receipt,
+        ...entry.proposal ? { proposal: stripPreviews(entry.proposal) } : {},
+        ...entry.boundContent !== void 0 ? { boundContent: entry.boundContent } : {}
+      });
+      changed = true;
+    }
+    if (entry.authorization) {
+      const existing = this.data.authorizations[entry.authorizationId];
+      if (!existing) {
+        this.data.authorizations[entry.authorizationId] = {
+          authorizationId: entry.authorizationId,
+          profileId: entry.authorization.profileId,
+          boundsHash: entry.authorization.boundsHash,
+          contextHash: entry.authorization.contextHash,
+          bounds: entry.authorization.bounds,
+          context: entry.authorization.context,
+          intent: entry.authorization.intent,
+          attestations: [...entry.authorization.attestations],
+          archivedAt: now
+        };
+        changed = true;
+      } else {
+        for (const att of entry.authorization.attestations) {
+          const seen = existing.attestations.some(
+            (a) => a.domain === att.domain && a.blob === att.blob
+          );
+          if (!seen) {
+            existing.attestations.push(att);
+            changed = true;
+          }
+        }
+        if (!existing.bounds && entry.authorization.bounds) {
+          existing.bounds = entry.authorization.bounds;
+          changed = true;
+        }
+        if (!existing.context && entry.authorization.context) {
+          existing.context = entry.authorization.context;
+          changed = true;
+        }
+        if (!existing.intent && entry.authorization.intent) {
+          existing.intent = entry.authorization.intent;
+          changed = true;
+        }
+      }
+    }
+    if (changed) this.persist();
+  }
+  getReceipts() {
+    return [...this.data.receipts];
+  }
+  getAuthorizations() {
+    return Object.values(this.data.authorizations);
+  }
+  get size() {
+    return this.data.receipts.length;
+  }
+  // ─── Encryption helpers ─────────────────────────────────────────────────
+  encrypt(plaintext) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const iv = randomBytes4(12);
+    const cipher = createCipheriv4("aes-256-gcm", this.vaultKey, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+      iv: iv.toString("hex"),
+      ciphertext: encrypted.toString("hex"),
+      tag: tag.toString("hex")
+    };
+  }
+  decrypt(blob) {
+    if (!this.vaultKey) throw new Error("No vault key");
+    const decipher = createDecipheriv4(
+      "aes-256-gcm",
+      this.vaultKey,
+      Buffer.from(blob.iv, "hex")
+    );
+    decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
+    const decrypted = Buffer.concat([
+      decipher.update(Buffer.from(blob.ciphertext, "hex")),
+      decipher.final()
+    ]);
+    return decrypted.toString("utf8");
+  }
+  // ─── File paths ─────────────────────────────────────────────────────────
+  get plaintextFilePath() {
+    return join5(this.baseDir, "receipt-archive.json");
+  }
+  get encryptedFilePath() {
+    return join5(this.baseDir, "receipt-archive.enc.json");
+  }
+  // ─── Load / Persist ─────────────────────────────────────────────────────
+  loadPlaintext() {
+    if (!existsSync5(this.plaintextFilePath)) {
+      mkdirSync4(this.baseDir, { recursive: true });
+      return;
+    }
+    try {
+      const raw = readFileSync5(this.plaintextFilePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      this.data = {
+        version: 1,
+        authorizations: parsed.authorizations ?? {},
+        receipts: parsed.receipts ?? []
+      };
+    } catch {
+      console.error(`[ReceiptArchive] Could not parse ${this.plaintextFilePath} \u2014 preserving as .corrupt`);
+      try {
+        writeFileSync4(
+          `${this.plaintextFilePath}.corrupt-${Date.now()}`,
+          readFileSync5(this.plaintextFilePath)
+        );
+      } catch {
+      }
+    }
+  }
+  loadEncrypted() {
+    if (!existsSync5(this.encryptedFilePath)) return;
+    try {
+      const raw = readFileSync5(this.encryptedFilePath, "utf-8");
+      const data = JSON.parse(raw);
+      const decrypted = this.decrypt(data.blob);
+      const parsed = JSON.parse(decrypted);
+      this.data = {
+        version: 1,
+        authorizations: parsed.authorizations ?? {},
+        receipts: parsed.receipts ?? []
+      };
+    } catch (err) {
+      console.error(`[ReceiptArchive] Could not decrypt ${this.encryptedFilePath} \u2014 preserving as .corrupt:`, err);
+      try {
+        writeFileSync4(
+          `${this.encryptedFilePath}.corrupt-${Date.now()}`,
+          readFileSync5(this.encryptedFilePath)
+        );
+      } catch {
+      }
+    }
+  }
+  persist() {
+    if (this.vaultKey) {
+      this.persistEncrypted();
+    } else {
+      this.persistPlaintext();
+    }
+  }
+  persistPlaintext() {
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.plaintextFilePath, JSON.stringify(this.data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+  persistEncrypted() {
+    const data = {
+      version: 1,
+      blob: this.encrypt(JSON.stringify(this.data))
+    };
+    mkdirSync4(this.baseDir, { recursive: true, mode: 448 });
+    writeFileSync4(this.encryptedFilePath, JSON.stringify(data, null, 2), { encoding: "utf-8", mode: 384 });
+  }
+};
+
 // src/lib/gatekeeper.ts
 import { verify } from "@hap/core";
 var MCPGatekeeper = class {
-  constructor(cache, executionLog) {
+  /**
+   * No ExecutionLog dependency by construction. The local record is
+   * display-only (protocol.md → "Executor Gating, Context vs Bounds,
+   * Display-Only Logs"), so the Gatekeeper must not be able to read it: with
+   * no log in scope, a local cumulative check cannot be reintroduced by
+   * accident. `SharedState.executionLog` stays — it feeds the UI's consumption
+   * display and nothing else.
+   */
+  constructor(cache) {
     this.cache = cache;
-    this.executionLog = executionLog;
   }
   /**
    * Verify an execution request against a cached authorization.
@@ -877,16 +1195,15 @@ var MCPGatekeeper = class {
       attestations: auth.attestations.map((a) => a.blob),
       execution,
       context: resolvedContext,
-      // Scopes the local cumulative check to the same (profileId, path) key the
-      // ExecutionLog records under (see tool-proxy's record call). It cannot go
-      // inside `frame`: that is validated against the profile's boundsSchema,
-      // which declares no `path` field in any shipped profile, so an extra key
-      // there fails verification with "Unknown field". Omitting it entirely —
-      // the previous behaviour — made every cumulative lookup return zero, so
-      // the local gate never fired and the AS was doing all the enforcing.
+      // Identifies the grant whose bounds are being checked. hap-core reads it
+      // only to scope a cumulative lookup, which no longer happens here (see
+      // below); it is kept because it belongs to the request, not to the
+      // dropped check. It cannot go inside `frame`: that is validated against
+      // the profile's boundsSchema, which declares no `path` field in any
+      // shipped profile, so an extra key there fails with "Unknown field".
       path: auth.path
     };
-    const result = await verify(request, publicKeyHex, void 0, this.executionLog);
+    const result = await verify(request, publicKeyHex);
     return { result, authorization: auth };
   }
 };
@@ -898,6 +1215,7 @@ var SharedState = class {
   gateStore;
   executionLog;
   denialLog;
+  receiptArchive;
   gatekeeper;
   constructor(spUrl2, gateStorePath) {
     this.spClient = new SPClient(spUrl2);
@@ -905,7 +1223,49 @@ var SharedState = class {
     this.gateStore = new GateStore(gateStorePath);
     this.executionLog = new ExecutionLog(gateStorePath);
     this.denialLog = new DenialLog(gateStorePath);
-    this.gatekeeper = new MCPGatekeeper(this.cache, this.executionLog);
+    this.receiptArchive = new ReceiptArchive(gateStorePath);
+    this.gatekeeper = new MCPGatekeeper(this.cache);
+  }
+  /**
+   * Archive a signed receipt into the local receipt archive — the subject's
+   * own durable copy of the evidence (see receipt-archive.ts).
+   *
+   * Best-effort by contract: the AS has already issued the receipt and holds
+   * the authoritative copy, so an archive failure logs loudly but MUST NOT
+   * block the execution it documents.
+   */
+  async archiveReceipt(receipt, opts) {
+    try {
+      let asPublicKey;
+      try {
+        asPublicKey = await this.cache.getPublicKey();
+      } catch {
+      }
+      this.receiptArchive.record({
+        receipt,
+        authorizationId: opts.authorizationId,
+        asUrl: this.spClient.url,
+        asPublicKey,
+        proposal: opts.proposal,
+        boundContent: opts.boundContent,
+        authorization: opts.profileId ? {
+          profileId: opts.profileId,
+          boundsHash: opts.boundsHash,
+          contextHash: opts.contextHash ?? this.gateStore.get(opts.authorizationId)?.contextHash,
+          bounds: opts.bounds,
+          context: opts.context,
+          // Fall back to the gate store — the review path's cached auth
+          // carries no gate content.
+          intent: opts.intent ?? this.gateStore.get(opts.authorizationId)?.gateContent?.intent,
+          attestations: opts.attestations ?? []
+        } : void 0
+      });
+    } catch (err) {
+      console.error(
+        "[Suveren MCP] Receipt archive write failed (execution proceeds \u2014 AS retains authoritative copy):",
+        err
+      );
+    }
   }
   setGateContent(path, authorizationId, profileId, content, opts) {
     this.gateStore.set(authorizationId, {
@@ -1012,17 +1372,17 @@ function formatConsumptionFull(entries) {
 }
 
 // src/lib/context-loader.ts
-import { readFileSync as readFileSync4, existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-var DEFAULT_DIR4 = process.env.SUVEREN_DATA_DIR ?? join4(homedir4(), ".suveren");
+import { readFileSync as readFileSync6, existsSync as existsSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+var DEFAULT_DIR5 = process.env.SUVEREN_DATA_DIR ?? join6(homedir5(), ".suveren");
 var BRIEF_MAX_CHARS = 16 * 1024;
 function readContextFile(dataDir) {
-  const dir = dataDir ?? DEFAULT_DIR4;
-  const filePath = join4(dir, "context.md");
-  if (!existsSync4(filePath)) return null;
+  const dir = dataDir ?? DEFAULT_DIR5;
+  const filePath = join6(dir, "context.md");
+  if (!existsSync6(filePath)) return null;
   try {
-    const content = readFileSync4(filePath, "utf-8").trim();
+    const content = readFileSync6(filePath, "utf-8").trim();
     return content || null;
   } catch {
     return null;
@@ -1192,7 +1552,7 @@ function appendVerificationFooter(tool, args, receiptId, subject) {
 // src/lib/content-binding.ts
 import {
   computeContentHash,
-  computeFieldsContentHash,
+  selectBoundFields,
   isFieldBinding,
   bindingAppliesTo,
   getProfile as getProfile2
@@ -1212,14 +1572,18 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
       }
       return void 0;
     }
+    const bound = selectBoundFields(binding, toolArgs);
     return {
-      contentHash: computeFieldsContentHash(binding, toolArgs),
-      contentBinding: { version: binding.version, kind: binding.kind, fields: binding.fields }
+      contentHash: computeContentHash(binding, bound),
+      contentBinding: { version: binding.version, kind: binding.kind, fields: binding.fields },
+      boundContent: bound
     };
   }
   let contentHash;
+  let boundContent;
   if (binding.kind === "jcs") {
     contentHash = computeContentHash(binding, toolArgs);
+    boundContent = toolArgs;
   } else {
     const declared = tool?.gating?.contentField;
     const field = declared ?? (tool ? detectContentField(tool) : null);
@@ -1227,10 +1591,12 @@ function computeContentBinding(profileId, tool, toolArgs, actionType) {
     const raw = typeof toolArgs[field] === "string" ? toolArgs[field] : "";
     if (raw === "") return void 0;
     contentHash = computeContentHash(binding, raw);
+    boundContent = raw;
   }
   return {
     contentHash,
-    contentBinding: { version: binding.version, kind: binding.kind }
+    contentBinding: { version: binding.version, kind: binding.kind },
+    boundContent
   };
 }
 function attachReceiptId(tool, args, receiptId) {
@@ -1657,10 +2023,11 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
     return inner(args);
   };
   if (category === "disabled") {
+    const reason = tool.gating.disabledReason;
     return async () => ({
       content: [{
         type: "text",
-        text: `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
+        text: reason ? `Tool "${tool.namespacedName}" is refused: ${reason}. A tool that no manifest entry describes cannot be gated \u2014 there is nothing declaring which action type it performs or how its arguments map to the bounds. Add an entry for "${tool.originalName}" under this integration's toolGating.overrides (with "category": "read" for a read-only tool) before it can be used.` : `Tool "${tool.namespacedName}" is disabled by the integration manifest and cannot be used.`
       }],
       isError: true
     });
@@ -1849,6 +2216,29 @@ function createGatedToolHandlerInner(tool, integrationManager2, state2) {
         }
       }
     }
+    const declaredActionType = typeof execution.action_type === "string" && execution.action_type.length > 0 ? execution.action_type : void 0;
+    if (!declaredActionType) {
+      return {
+        content: [{
+          type: "text",
+          text: `Blocked by Gatekeeper: tool ${tool.namespacedName} declares no action_type in its manifest's staticExecution. A write cannot be bounds-checked without its action type \u2014 fix the integration manifest.`
+        }],
+        isError: true
+      };
+    }
+    {
+      const profileDef = getProfile3(profile);
+      const registry = profileDef?.boundsSchema?.actionTypes;
+      if (Array.isArray(registry) && registry.length > 0 && !registry.includes(declaredActionType)) {
+        return {
+          content: [{
+            type: "text",
+            text: `Blocked by Gatekeeper: action_type "${declaredActionType}" is not in profile ${profile}'s actionTypes registry (${registry.join(", ")}). Fix the integration manifest.`
+          }],
+          isError: true
+        };
+      }
+    }
     const auths = state2.getEnrichedAuthorizations();
     const matchingAuths = auths.filter(
       (a) => a.complete && profileMatches(a.profileId, profile)
@@ -1946,12 +2336,7 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
       }
       let receiptId;
       try {
-        const actionType = typeof execution.action_type === "string" ? execution.action_type : void 0;
-        if (!actionType) {
-          console.error(
-            `[Suveren MCP] Warning: tool ${tool.namespacedName} has no action_type in staticExecution. Bounds check may be skipped. Fix the integration manifest.`
-          );
-        }
+        const actionType = declaredActionType;
         const binding = computeContentBinding(auth.profileId, tool, args, actionType);
         const { receipt } = await state2.spClient.postReceipt({
           authorizationId: authzId,
@@ -1963,9 +2348,27 @@ Proposal ID: ${proposal.id}. Check status with check-pending-commitments(proposa
           executionContext: { ...execution },
           amount: typeof execution.amount === "number" ? execution.amount : void 0,
           idempotencyKey: randomUUID(),
-          ...binding ?? {}
+          // Privacy: send the hash and how to reproduce it — never the
+          // preimage. `binding` also carries `boundContent`, the plaintext
+          // that was hashed (an email's to/cc/subject/body); it stays on
+          // this machine for the local archive, so it must be picked out
+          // field by field rather than spread.
+          ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
         });
         receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+        await state2.archiveReceipt(receipt, {
+          authorizationId: authzId,
+          profileId: auth.profileId,
+          boundsHash: auth.boundsHash,
+          contextHash: auth.contextHash,
+          bounds: auth.bounds ?? auth.frame,
+          context: auth.context,
+          intent: auth.gateContent?.intent,
+          attestations: auth.attestations,
+          // Automatic path has no proposal, so without this the archive
+          // would hold a hash of content it cannot reproduce.
+          boundContent: binding?.boundContent
+        });
       } catch (err) {
         if (err instanceof ContentBindingError) {
           return {
@@ -2100,7 +2503,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   const shortName = shortProfileName2(profileId);
   const gated = [];
   const readOnly = [];
-  const defaultGated = [];
+  const undescribed = [];
   for (const tool of allTools) {
     if (!tool.gating || !tool.gating.profile) {
       continue;
@@ -2122,12 +2525,7 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
       const actionType = override.staticExecution?.action_type ?? "unknown";
       gated.push(`      - ${tool.originalName}: ${actionType}${mappingDesc ? `, ${mappingDesc}` : ""}`);
     } else {
-      const defaultAction = toolGating.default.staticExecution?.action_type;
-      if (defaultAction === "read" && Object.keys(toolGating.default.executionMapping ?? {}).length === 0) {
-        defaultGated.push(tool.originalName);
-      } else {
-        gated.push(`      - ${tool.originalName}: ${defaultAction ?? "default"} (default gating)`);
-      }
+      undescribed.push(tool.originalName);
     }
   }
   const lines = [];
@@ -2139,10 +2537,12 @@ function buildCapabilityMap(profileId, toolGating, integrationManager2) {
   if (readOnly.length > 0) {
     lines.push(`    Read-only (no authorization needed): ${readOnly.join(", ")}`);
   }
-  if (defaultGated.length > 0) {
-    lines.push(`    Default-gated (action_type: ${toolGating.default.staticExecution?.action_type ?? "read"}): ${defaultGated.join(", ")}`);
+  if (undescribed.length > 0) {
+    lines.push(
+      `    Refused (no manifest entry \u2014 do not call): ${undescribed.join(", ")}`
+    );
   }
-  if (gated.length === 0 && readOnly.length === 0 && defaultGated.length === 0) {
+  if (gated.length === 0 && readOnly.length === 0 && undescribed.length === 0) {
     lines.push("    No tools discovered for this profile.");
   }
   return lines.join("\n");
@@ -2431,9 +2831,25 @@ async function executeCommitted(proposal, state2, integrationManager2) {
       // SPClient therefore treats proposalId as retry-safe on its own; a
       // PROPOSAL_ALREADY_EXECUTED answer is still a definitive rejection
       // (never retried) and means a *different* caller consumed the proposal.
-      ...binding ?? {}
+      // Privacy: hash + how to reproduce it only. `binding.boundContent` is
+      // the plaintext preimage (what the human approved) and never leaves
+      // this machine — see the archive call below.
+      ...binding ? { contentHash: binding.contentHash, contentBinding: binding.contentBinding } : {}
     });
     receiptId = typeof receipt?.id === "string" ? receipt.id : void 0;
+    await state2.archiveReceipt(receipt, {
+      authorizationId: proposal.authorizationId,
+      profileId: proposal.profileId,
+      boundsHash: cachedAuth?.boundsHash,
+      contextHash: cachedAuth?.contextHash,
+      bounds: cachedAuth?.bounds ?? cachedAuth?.frame,
+      context: cachedAuth?.context,
+      attestations: cachedAuth?.attestations,
+      // What the human actually approved, kept next to the receipt that cites
+      // it — otherwise `proposalId` is a pointer to a server we may not have.
+      proposal,
+      boundContent: binding?.boundContent
+    });
   } catch (err) {
     if (err instanceof ContentBindingError2) {
       return {
@@ -2756,16 +3172,16 @@ function verifyGateContentHashes(content, auth) {
 }
 
 // src/lib/integration-registry.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
-var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join5(homedir5(), ".suveren");
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname5, join as join7 } from "path";
+var DEFAULT_DATA_DIR = process.env.SUVEREN_DATA_DIR ?? join7(homedir6(), ".suveren");
 var IntegrationRegistry = class {
   integrations = /* @__PURE__ */ new Map();
   filePath;
   constructor(dataDir) {
     const dir = dataDir ?? DEFAULT_DATA_DIR;
-    this.filePath = join5(dir, "integrations.json");
+    this.filePath = join7(dir, "integrations.json");
     this.load();
   }
   // ─── CRUD ───────────────────────────────────────────────────────────────
@@ -2796,12 +3212,12 @@ var IntegrationRegistry = class {
   }
   // ─── Load / Save ────────────────────────────────────────────────────────
   load() {
-    if (!existsSync5(this.filePath)) {
-      mkdirSync4(dirname4(this.filePath), { recursive: true });
+    if (!existsSync7(this.filePath)) {
+      mkdirSync5(dirname5(this.filePath), { recursive: true });
       return;
     }
     try {
-      const raw = readFileSync5(this.filePath, "utf-8");
+      const raw = readFileSync7(this.filePath, "utf-8");
       const data = JSON.parse(raw);
       const migrated = data.integrations.map((i) => {
         if ("toolGating" in i && !("profile" in i)) {
@@ -2830,33 +3246,39 @@ var IntegrationRegistry = class {
       version: 1,
       integrations: Array.from(this.integrations.values())
     };
-    mkdirSync4(dirname4(this.filePath), { recursive: true });
-    writeFileSync4(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+    mkdirSync5(dirname5(this.filePath), { recursive: true });
+    writeFileSync5(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf-8" });
   }
 };
 
 // src/lib/integration-manager.ts
-import { homedir as homedir6 } from "os";
-import { join as join6, delimiter } from "path";
-import { existsSync as existsSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync6, rmSync } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join8, delimiter } from "path";
+import { existsSync as existsSync8, writeFileSync as writeFileSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync8, rmSync } from "fs";
 import { execFile } from "child_process";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { getProfile as getProfile5 } from "@hap/core";
-var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join6(homedir6(), ".suveren");
-var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join6(DEFAULT_DATA_DIR2, "integrations");
-var INTEGRATIONS_BIN = join6(INTEGRATIONS_DIR, "node_modules", ".bin");
+var DEFAULT_DATA_DIR2 = process.env.SUVEREN_DATA_DIR ?? join8(homedir7(), ".suveren");
+var INTEGRATIONS_DIR = process.env.SUVEREN_INTEGRATIONS_DIR ?? join8(DEFAULT_DATA_DIR2, "integrations");
+var installLock = Promise.resolve();
+function withInstallLock(task) {
+  const run = installLock.then(task, task);
+  installLock = run.then(() => void 0, () => void 0);
+  return run;
+}
+var INTEGRATIONS_BIN = join8(INTEGRATIONS_DIR, "node_modules", ".bin");
 function buildPath() {
   const base = process.env.PATH ?? "";
   return [INTEGRATIONS_BIN, base].join(delimiter);
 }
 function ensureIntegrationsDir() {
-  if (!existsSync6(INTEGRATIONS_DIR)) {
-    mkdirSync5(INTEGRATIONS_DIR, { recursive: true });
+  if (!existsSync8(INTEGRATIONS_DIR)) {
+    mkdirSync6(INTEGRATIONS_DIR, { recursive: true });
   }
-  const pkgPath = join6(INTEGRATIONS_DIR, "package.json");
-  if (!existsSync6(pkgPath)) {
-    writeFileSync5(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
+  const pkgPath = join8(INTEGRATIONS_DIR, "package.json");
+  if (!existsSync8(pkgPath)) {
+    writeFileSync6(pkgPath, JSON.stringify({ name: "suveren-integrations", version: "1.0.0", private: true }, null, 2));
   }
 }
 function readAgeOf(config) {
@@ -2922,19 +3344,19 @@ var IntegrationManager = class {
    * exist, and treat anything else as not-installed (and reinstallable).
    */
   isUsableInstall(npmPackage) {
-    const pkgDir = join6(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    const pkgJson = join6(pkgDir, "package.json");
-    if (!existsSync6(pkgDir) || !existsSync6(pkgJson)) return false;
+    const pkgDir = join8(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    const pkgJson = join8(pkgDir, "package.json");
+    if (!existsSync8(pkgDir) || !existsSync8(pkgJson)) return false;
     try {
-      const pkg = JSON.parse(readFileSync6(pkgJson, "utf8"));
+      const pkg = JSON.parse(readFileSync8(pkgJson, "utf8"));
       const defaultBinName = (pkg.name ?? npmPackage).split("/").pop() ?? "";
       const binMap = typeof pkg.bin === "string" ? { [defaultBinName]: pkg.bin } : pkg.bin ?? {};
       const binEntries = Object.entries(binMap);
       for (const [binName, target] of binEntries) {
-        if (!existsSync6(join6(pkgDir, target))) return false;
+        if (!existsSync8(join8(pkgDir, target))) return false;
         if (!this.binShimExists(binName)) return false;
       }
-      if (binEntries.length === 0 && pkg.main && !existsSync6(join6(pkgDir, pkg.main))) return false;
+      if (binEntries.length === 0 && pkg.main && !existsSync8(join8(pkgDir, pkg.main))) return false;
       return true;
     } catch {
       return false;
@@ -2948,7 +3370,7 @@ var IntegrationManager = class {
   binShimExists(binName) {
     if (!binName) return false;
     const candidates = process.platform === "win32" ? [binName, `${binName}.cmd`, `${binName}.CMD`, `${binName}.ps1`] : [binName];
-    return candidates.some((c) => existsSync6(join6(INTEGRATIONS_BIN, c)));
+    return candidates.some((c) => existsSync8(join8(INTEGRATIONS_BIN, c)));
   }
   /**
    * Install an npm package into the managed integrations directory if not
@@ -2965,8 +3387,15 @@ var IntegrationManager = class {
   async ensureInstalled(npmPackage) {
     ensureIntegrationsDir();
     if (this.isUsableInstall(npmPackage)) return;
-    const pkgDir = join6(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
-    if (existsSync6(pkgDir)) {
+    return withInstallLock(async () => {
+      if (this.isUsableInstall(npmPackage)) return;
+      await this.installNow(npmPackage);
+    });
+  }
+  /** The actual install. Callers MUST hold the install lock. */
+  async installNow(npmPackage) {
+    const pkgDir = join8(INTEGRATIONS_DIR, "node_modules", ...npmPackage.split("/"));
+    if (existsSync8(pkgDir)) {
       console.error(`[IntegrationManager] Removing unusable install of ${npmPackage}`);
       try {
         rmSync(pkgDir, { recursive: true, force: true });
@@ -3338,8 +3767,9 @@ var IntegrationManager = class {
     }
     return {
       profile: profileId,
-      executionMapping: profileGating.default.executionMapping,
-      staticExecution: profileGating.default.staticExecution
+      executionMapping: {},
+      category: "disabled",
+      disabledReason: "not described in manifest"
     };
   }
   /**
@@ -3381,28 +3811,28 @@ var IntegrationManager = class {
 };
 
 // src/lib/profile-loader.ts
-import { readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
-import { join as join7, resolve } from "path";
+import { readFileSync as readFileSync9, existsSync as existsSync9 } from "fs";
+import { join as join9, resolve } from "path";
 import { registerProfile } from "@hap/core";
 function loadProfiles(profilesDir) {
-  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join7(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
-  const indexPath = join7(dir, "index.json");
-  if (!existsSync7(indexPath)) {
+  const dir = resolve(profilesDir ?? process.env.SUVEREN_PROFILES_DIR ?? join9(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "..", "hap-profiles"));
+  const indexPath = join9(dir, "index.json");
+  if (!existsSync9(indexPath)) {
     warnNoProfiles(`No index.json at ${indexPath}`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync7(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync9(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ProfileLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [profileId, relativePath] of Object.entries(index.profiles)) {
-    const profilePath = join7(dir, relativePath);
+    const profilePath = join9(dir, relativePath);
     try {
-      const profile = JSON.parse(readFileSync7(profilePath, "utf-8"));
+      const profile = JSON.parse(readFileSync9(profilePath, "utf-8"));
       registerProfile(profileId, profile);
       const shortName = profileId.split("/").pop()?.replace(/@.*$/, "");
       if (shortName && shortName !== profileId) {
@@ -3435,30 +3865,30 @@ function warnNoProfiles(reason) {
 }
 
 // src/lib/manifest-loader.ts
-import { readFileSync as readFileSync8, existsSync as existsSync8 } from "fs";
-import { join as join8, resolve as resolve2 } from "path";
+import { readFileSync as readFileSync10, existsSync as existsSync10 } from "fs";
+import { join as join10, resolve as resolve2 } from "path";
 var manifests = /* @__PURE__ */ new Map();
 function loadManifests(integrationsDir) {
   const dir = resolve2(
-    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join8(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
+    integrationsDir ?? process.env.SUVEREN_MANIFESTS_DIR ?? join10(import.meta.dirname ?? __dirname, "..", "..", "..", "..", "content", "integrations")
   );
-  const indexPath = join8(dir, "index.json");
-  if (!existsSync8(indexPath)) {
+  const indexPath = join10(dir, "index.json");
+  if (!existsSync10(indexPath)) {
     console.error(`[ManifestLoader] No index.json found at ${indexPath}, skipping manifest loading`);
     return 0;
   }
   let index;
   try {
-    index = JSON.parse(readFileSync8(indexPath, "utf-8"));
+    index = JSON.parse(readFileSync10(indexPath, "utf-8"));
   } catch (err) {
     console.error(`[ManifestLoader] Failed to parse ${indexPath}:`, err);
     return 0;
   }
   let loaded = 0;
   for (const [id, relativePath] of Object.entries(index.integrations)) {
-    const manifestPath = join8(dir, relativePath);
+    const manifestPath = join10(dir, relativePath);
     try {
-      const manifest = JSON.parse(readFileSync8(manifestPath, "utf-8"));
+      const manifest = JSON.parse(readFileSync10(manifestPath, "utf-8"));
       manifests.set(id, manifest);
       loaded++;
     } catch (err) {
@@ -3476,6 +3906,7 @@ function getAllManifests() {
 }
 
 // bin/http.ts
+import { decodeAttestationBlob as decodeAttestationBlob3 } from "@hap/core";
 var spUrl = process.env.SUVEREN_AS_URL ?? "https://www.suveren.ai";
 var port = parseInt(process.env.SUVEREN_MCP_PORT ?? "3430", 10);
 var state = new SharedState(spUrl);
@@ -3539,7 +3970,8 @@ app.post("/internal/configure", internalOnly, (req, res) => {
     const key = Buffer.from(vaultKeyHex, "hex");
     state.gateStore.setVaultKey(key);
     state.denialLog.setVaultKey(key);
-    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log encryption active");
+    state.receiptArchive.setVaultKey(key);
+    console.error("[Suveren MCP] Vault key configured \u2014 gate store + denial log + receipt archive encryption active");
   }
   if (apiKey) {
     state.spClient.setApiKey(apiKey);
@@ -3836,6 +4268,27 @@ app.get("/internal/authorizations", internalOnly, (_req, res) => {
 app.get("/internal/manifests", internalOnly, (_req, res) => {
   res.json({ manifests: getAllManifests() });
 });
+app.get("/internal/evidence", internalOnly, (_req, res) => {
+  if (state.receiptArchive.isLocked()) {
+    res.status(503).json({ error: "Vault locked \u2014 the evidence archive is encrypted until sign-in." });
+    return;
+  }
+  const authorizations = state.receiptArchive.getAuthorizations().map((a) => ({
+    ...a,
+    attestations: a.attestations.map((att) => {
+      try {
+        return { ...att, decoded: decodeAttestationBlob3(att.blob) };
+      } catch {
+        return att;
+      }
+    })
+  }));
+  res.json({
+    receipts: state.receiptArchive.getReceipts(),
+    authorizations,
+    gates: state.gateStore.getAll()
+  });
+});
 app.get("/internal/brief", internalOnly, (_req, res) => {
   try {
     const enriched = state.getEnrichedAuthorizations();