@synoi/gateway-lite 0.1.0

package/dist/gap/local-ingest-router.js

@@ -0,0 +1,1642 @@
+"use strict";
+/**
+ * gap/local-ingest-router.ts — /local/* localhost ingest API per ADR_014 Section 3.
+ *
+ * Status: PARTIAL (SHIPPED-against-test-keys). Auth/exposure surface is
+ *   PARTIAL-pending-Security+Adversary-panel. Production keys PAPER + ceremony-gated.
+ *
+ * Placement: TS gateway layer (same pattern as /v1/demo and /internal/gate).
+ * Mount: app.use('/local', localIngestRouter) BEFORE app.use('/v1', authMiddleware).
+ *
+ * Security model (load-bearing; a Security+Adversary panel follows):
+ *   1. LOOPBACK-ONLY: identical guard to consult-gate-router.ts. req.socket.remoteAddress
+ *      must be 127.0.0.x / ::1 / ::ffff:127.0.0.x. Checked FIRST, before any route.
+ *      Non-loopback -> 403. Never trust X-Forwarded-For or any proxy header.
+ *   2. HOST-HEADER: reject any /local/* request whose Host header is not 127.0.0.1:PORT
+ *      or localhost:PORT. This defeats DNS-rebinding: the attacker controls the DNS
+ *      response but the browser sends the attacker origin as the Host header, which
+ *      won't match 127.0.0.1. Checked after the socket check.
+ *   3. CUSTOM-HEADER: require X-SynOI-Local: 1 on every /local/* request. Browsers
+ *      cannot set arbitrary custom headers on cross-origin no-cors requests, so this
+ *      defeats CSRF without a per-request token. The local dashboard always sets it.
+ *   4. OPERATOR-AUTH on /local/decide: the request body must carry a valid
+ *      operator_pubkey_hex + operator_signature over the canonical decision payload
+ *      (matching the OID-binding pattern from demo-router). Wrong key -> 403.
+ *      Missing -> 400. No anonymous approve/deny.
+ *   5. FAIL-CLOSED: malformed body -> 400/reject. Unknown pending_oid -> 404.
+ *      Timeout -> auto-deny (via checkTimeouts sweep, per SHIPPED provisional+auto-lift
+ *      primitive in revocation.ts line 149). Never auto-allow.
+ *   6. BUNDLE_OID GRANT CHECK at /local/gate: bundle_oid must exist in gap_grants as an
+ *      active (non-revoked, non-expired) grant. Unknown or revoked bundle -> 403. This is
+ *      an Axis-3 subset; Axis 3 full entitlement remains PARTIAL (panel decides scope).
+ *   7. RATE-LIMIT + PENDING-STORE CAP: /local/gate enforces MAX_PENDING_ACTIONS. At cap,
+ *      further calls get 429. A per-IP (loopback) rate limiter with a token-bucket also
+ *      applies. The pending store stays bounded in memory.
+ *   8. SWEEP BATCHING: sweepExpiredPending() processes at most SWEEP_BATCH_SIZE expired
+ *      entries per tick and yields with setImmediate between batches, keeping the event
+ *      loop responsive even if the store grows before the cap was added.
+ *   9. CHALLENGE NONCE TRUST MODEL AND ORACLE HARDENING (ADR_016 Findings 2+3):
+ *      (a) The challenge_nonce in the /local/gate 201 response is trusted to the
+ *          gate-submitting process (the AI agent). The /local/decide-challenge endpoint
+ *          is the dashboard UX channel, not the agent channel. The machine-local
+ *          loopback boundary (layers 1-3 above) is the primary control that separates
+ *          these channels; there is no cryptographic separation between processes on
+ *          the same loopback. This is the intended threat model for v1 local mode.
+ *      (b) The challenge_nonce is NOT consumed on /local/decide-challenge fetch
+ *          (intentional). It is inert without the enrolled operator's Ed25519 key.
+ *          Re-fetching the nonce does not let an unauthenticated caller decide: the
+ *          decide payload signature must verify against the enrolled operator's key.
+ *      (c) /local/decide-challenge collapses OperatorNotEnrolledForTenantError and
+ *          OperatorNotEnrolledError both to 404, making the response indistinguishable
+ *          from "pending_oid not found." This closes two existence oracles: wrong-tenant
+ *          callers cannot probe whether a pending_oid is real, and unenrolled callers
+ *          cannot determine whether they are enrolled anywhere.
+ *      (d) Both the fetch-challenge and decide canonical payloads include tenant_id so
+ *          signatures are bound to the specific tenant. A signature obtained for one
+ *          tenant cannot be replayed against a pending action owned by another tenant.
+ *
+ * Endpoints (ADR_014 Section 3.3, all bound to 127.0.0.1):
+ *   GET  /local/health              liveness
+ *   POST /local/gate                ingest action -> PENDING; emit governed-action.requested receipt
+ *   GET  /local/pending             list pending actions awaiting decision
+ *   POST /local/decide              HITL approve/deny; emits governed-action.allowed|denied receipt
+ *   GET  /local/receipts            receipt stream (all three own subjects)
+ *   GET  /local/receipts/:oid       single receipt by OID
+ *
+ * Deny-on-timeout: a background sweep runs every TIMEOUT_SWEEP_MS; any PENDING action
+ * older than PENDING_TIMEOUT_MS is auto-denied with a signed governed-action.denied receipt.
+ *
+ * Bind note: the full gateway listener binds 0.0.0.0 (production infra needs it for
+ * health-check traffic on non-loopback interfaces). The /local surface is protected by
+ * layers 1-3 above (socket address + Host header + custom header), which together
+ * constitute the loopback-equivalent defense for /local/* without restricting the
+ * entire server to 127.0.0.1. The panel may decide an additional split-listener is
+ * warranted; surfaced here rather than breaking non-/local routes.
+ *
+ * SECURITY NOTE: "PARTIAL-pending-panel" -- the operator-auth surface here relies on
+ * Ed25519 signature verification against a caller-supplied public key. The OID-binding
+ * check (sha256(pubkey) == operator_oid) ensures the key matches the declared identity
+ * but the operator session itself (who issued the operator OID) is NOT authenticated by
+ * a genesis-rooted chain in this slice. A Security+Adversary panel reviews this surface
+ * before any production exposure.
+ *
+ * No em dashes. No AI attribution.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CONCURRENT_OUTCOME_WAITS = exports.MAX_OUTCOME_WAIT_MS = exports.DEFAULT_MAX_LOCAL_RECEIPT_OIDS = exports.DEFAULT_TIMEOUT_SWEEP_MS = exports.DEFAULT_PENDING_TIMEOUT_MS = exports._pendingStore = exports.GATE_RATE_MAX_CALLS = exports.GATE_RATE_WINDOW_MS = exports.MAX_PENDING_ACTIONS = exports.LOCAL_CUSTOM_HEADER_VALUE = exports.LOCAL_CUSTOM_HEADER_NAME = exports._setLiteMode = exports.isLiteMode = void 0;
+exports._resetGateRateLimit = _resetGateRateLimit;
+exports._setPendingTimeoutMs = _setPendingTimeoutMs;
+exports.sweepExpiredPending = sweepExpiredPending;
+exports._setMaxLocalReceiptOids = _setMaxLocalReceiptOids;
+exports._registerLocalReceiptOid = _registerLocalReceiptOid;
+exports._listLocalReceipts = _listLocalReceipts;
+exports._clearLocalReceiptTracking = _clearLocalReceiptTracking;
+exports.startLocalIngestSweep = startLocalIngestSweep;
+exports.stopLocalIngestSweep = stopLocalIngestSweep;
+exports._resetActiveLongPolls = _resetActiveLongPolls;
+const express_1 = __importDefault(require("express"));
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const operator_enrollment_1 = require("./operator-enrollment");
+const store_1 = require("./store");
+const sraid_1 = require("@synoi/sraid");
+const verify_router_1 = require("../verify-router");
+const gap_1 = require("@synoi/gap");
+const lite_signing_key_1 = require("./lite-signing-key");
+const lite_mode_1 = require("./lite-mode");
+Object.defineProperty(exports, "isLiteMode", { enumerable: true, get: function () { return lite_mode_1.isLiteMode; } });
+/** daemon.ts / TEST ONLY: explicitly select the lite self-sign receipt tier. */
+exports._setLiteMode = lite_mode_1.setLiteMode;
+// DSSE payloadType for a GAP object (ADR_007 payloadType split). Duplicated
+// here rather than imported from ./receipt-sign (which is the ONE constant
+// this router needed from that module): receipt-sign.ts imports
+// ./signing-oracle (the KMS-hybrid managed-custody oracle), and this router
+// is also mounted by the standalone lite daemon entrypoint (src/daemon.ts),
+// which must have NO reachable import edge into KMS (ADR_014 Section 10.2 /
+// 10.3, enforced by the CI dep-graph assertion). A single string-literal
+// constant is worth duplicating to break that edge; matches
+// receipt-sign.ts's SYNOI_GAP_RECEIPT_PAYLOAD_TYPE and @synoi/verify's
+// V2_PAYLOAD_TYPE byte-for-byte (both 'application/vnd.synoi.gap+json').
+const GAP_RECEIPT_PAYLOAD_TYPE = 'application/vnd.synoi.gap+json';
+// ── Loopback guard (reuse same logic as consult-gate-router.ts) ───────────────
+//
+// Security note: req.socket.remoteAddress is the real peer address; it cannot
+// be spoofed via HTTP headers. We deliberately do NOT read X-Forwarded-For.
+const LOOPBACK_ADDRESSES = new Set([
+    '127.0.0.1',
+    '::1',
+    '::ffff:127.0.0.1',
+]);
+function isLoopbackAddress(addr) {
+    if (!addr)
+        return false;
+    if (LOOPBACK_ADDRESSES.has(addr))
+        return true;
+    if (addr.startsWith('127.'))
+        return true;
+    if (addr.startsWith('::ffff:127.'))
+        return true;
+    return false;
+}
+// ── #2: Host-header + custom-header validation ────────────────────────────────
+//
+// These two checks run after the socket-address check and defeat DNS-rebinding
+// and CSRF respectively.
+/**
+ * Validate the Host header for /local/* requests.
+ * Accepts: 127.0.0.1[:PORT], localhost[:PORT].
+ * Rejects: everything else (including attacker-controlled domains).
+ */
+function isValidLocalHost(host) {
+    if (!host)
+        return false;
+    // Strip the port if present.
+    const hostOnly = host.replace(/:\d+$/, '');
+    return hostOnly === '127.0.0.1' || hostOnly === 'localhost';
+}
+/** The required custom header name and value. */
+exports.LOCAL_CUSTOM_HEADER_NAME = 'x-synoi-local';
+exports.LOCAL_CUSTOM_HEADER_VALUE = '1';
+// ── #4: Rate-limit + pending-store cap ───────────────────────────────────────
+//
+// MAX_PENDING_ACTIONS: absolute cap on the in-memory pending store. /local/gate
+// returns 429 if the store is already at this size. This bounds memory and
+// prevents a flood attack from inflating the store indefinitely.
+//
+// GATE_RATE_WINDOW_MS / GATE_RATE_MAX_CALLS: token-bucket parameters for the
+// /local/gate endpoint. All callers are loopback so a single global bucket is
+// sufficient for v1. A per-principal bucket would be more precise but the
+// caller set is always a single operator in the v1 model.
+//
+// SWEEP_BATCH_SIZE: maximum number of expired entries processed per event-loop
+// tick in sweepExpiredPending(). Yields with setImmediate between batches.
+exports.MAX_PENDING_ACTIONS = 100;
+exports.GATE_RATE_WINDOW_MS = 10_000; // 10-second window
+exports.GATE_RATE_MAX_CALLS = 50; // max 50 /local/gate calls per window
+let _gateCallTimestamps = [];
+/** TEST ONLY: reset the rate-limit window. */
+function _resetGateRateLimit() {
+    _gateCallTimestamps = [];
+}
+/** Returns true if the call is within the rate limit, false if over limit. */
+function _checkAndRecordGateCall() {
+    const now = Date.now();
+    // Evict timestamps older than the window.
+    _gateCallTimestamps = _gateCallTimestamps.filter(t => now - t < exports.GATE_RATE_WINDOW_MS);
+    if (_gateCallTimestamps.length >= exports.GATE_RATE_MAX_CALLS)
+        return false;
+    _gateCallTimestamps.push(now);
+    return true;
+}
+const SWEEP_BATCH_SIZE = 20;
+// ── Operator-auth helpers (OID-binding pattern from demo-router.ts) ───────────
+//
+// Security F6 (2026-07-12 quality gate): `operator_oid` ("oid-" + 64 lowercase
+// hex chars, i.e. sha256(operator_pubkey) with a distinct prefix) is a SEPARATE
+// identity namespace from the content-addressed `sha256:<64hex>` OID namespace
+// every GAP CDRO (receipts, grants, etc.) uses. Both are sha256 digests
+// expressed as 64 lowercase hex characters, so the two namespaces are
+// syntactically similar enough to invite confusion if hand-read: an
+// operator_oid identifies WHO (the hash of a specific Ed25519 public key,
+// verifyOidBinding below), never WHAT (the hash of an object's canonical
+// content, computeGapOid / @synoi/sraid's oid.ts). The "oid-" vs "sha256:"
+// prefix is what disambiguates them on the wire; never compare or interchange
+// the two without first checking the prefix.
+function isValidOperatorOid(oid) {
+    return typeof oid === 'string' && /^oid-[0-9a-f]{64}$/.test(oid);
+}
+function isValidPubkeyHex(hex) {
+    return typeof hex === 'string' && /^[0-9a-f]{64}$/.test(hex);
+}
+function verifyOidBinding(operator_oid, operator_pubkey_hex) {
+    try {
+        const pubBytes = Buffer.from(operator_pubkey_hex, 'hex');
+        const computed = 'oid-' + (0, node_crypto_1.createHash)('sha256').update(pubBytes).digest('hex');
+        return computed === operator_oid;
+    }
+    catch {
+        return false;
+    }
+}
+// Canonicalization for operator-signature payloads uses the SINGLE canonical
+// serializer imported from @synoi/sraid (RFC 8785 JCS). The previous local
+// `canonicalizeForSigning` copy was byte-identical to @synoi/sraid for every
+// in-use payload (verified: all values are strings + OIDs); it is removed so
+// there is exactly one canonicalization + signature path. Out-of-domain inputs
+// (NaN/Infinity/Date/undefined-array-element) now reject-loud via @synoi/sraid
+// instead of silently corrupting the signed bytes.
+function verifyOperatorSignature(canonical, operator_pubkey_hex, operator_signature) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { ed25519 } = require('@noble/curves/ed25519');
+    try {
+        return ed25519.verify(Buffer.from(operator_signature, 'hex'), Buffer.from(canonical, 'utf8'), Buffer.from(operator_pubkey_hex, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/** Exported for tests to inspect. Not part of the public API surface. */
+exports._pendingStore = new Map();
+// ── Timeout sweep (deny-on-timeout, fail-closed) ──────────────────────────────
+//
+// PENDING_TIMEOUT_MS: how long an action may wait before it is auto-denied.
+// Default 5 minutes for v1. Exportable so tests can override via module mock
+// without relying on real wall-clock waits.
+//
+// The sweep emits a signed governed-action.denied receipt for each expired
+// action, exactly the same receipt as an explicit deny decision, so the
+// timeout is indistinguishable from a human deny in the audit trail.
+//
+// OPERATOR note: the auto-deny receipt uses a sentinel operator_oid equal to
+// 'oid-' followed by exactly 64 zero characters ('oid-' + '0'.repeat(64)) to
+// indicate daemon-originated auto-deny rather than an operator decision. The
+// pending_oid is the authority reference. This sentinel is explicitly rejected
+// at the TOP of /local/decide validation (sentinel_reserved) so it cannot be
+// presented as an operator identity. This is the SHIPS-against-test-keys
+// sentinel; a production slot would use the daemon key identity.
+const TIMEOUT_SENTINEL_OID = 'oid-' + '0'.repeat(64);
+exports.DEFAULT_PENDING_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+exports.DEFAULT_TIMEOUT_SWEEP_MS = 10_000; // 10 seconds
+let _pendingTimeoutMs = exports.DEFAULT_PENDING_TIMEOUT_MS;
+/** TEST ONLY: override the pending timeout. Returns a restore fn. */
+function _setPendingTimeoutMs(ms) {
+    const prior = _pendingTimeoutMs;
+    _pendingTimeoutMs = ms;
+    return () => { _pendingTimeoutMs = prior; };
+}
+function sweepExpiredPending() {
+    const now = Date.now();
+    const allExpiredOids = [];
+    for (const [oid, action] of exports._pendingStore) {
+        if (now - action.ingested_at_ms >= _pendingTimeoutMs) {
+            allExpiredOids.push(oid);
+        }
+    }
+    if (allExpiredOids.length === 0)
+        return [];
+    // Process the first batch synchronously (so callers in tests get the result).
+    // Subsequent batches are yielded with setImmediate to avoid blocking the event loop.
+    const synchronousExpired = [];
+    function processBatch(oids) {
+        for (const oid of oids) {
+            const action = exports._pendingStore.get(oid);
+            if (action === undefined)
+                continue; // already removed (race guard)
+            _emitDeniedReceipt(action, TIMEOUT_SENTINEL_OID, 'timeout: no operator decision within the allowed window');
+            exports._pendingStore.delete(oid);
+        }
+    }
+    const firstBatch = allExpiredOids.slice(0, SWEEP_BATCH_SIZE);
+    processBatch(firstBatch);
+    synchronousExpired.push(...firstBatch);
+    // Schedule remaining batches asynchronously.
+    if (allExpiredOids.length > SWEEP_BATCH_SIZE) {
+        let offset = SWEEP_BATCH_SIZE;
+        function scheduleNext() {
+            if (offset >= allExpiredOids.length)
+                return;
+            const batch = allExpiredOids.slice(offset, offset + SWEEP_BATCH_SIZE);
+            offset += SWEEP_BATCH_SIZE;
+            setImmediate(() => {
+                processBatch(batch);
+                scheduleNext();
+            });
+        }
+        scheduleNext();
+    }
+    return synchronousExpired;
+}
+// ── Local receipt OID registry (must precede _buildReceiptBase) ───────────────
+//
+// Tracks OIDs of receipts emitted by this router so /local/receipts can list
+// them without a full-table scan. Declared here so _buildReceiptBase can call
+// _localReceiptOids.add() before the exported helper functions below.
+//
+// Adversary #5 (2026-07-12 quality gate, MEDIUM): this registry used to be a
+// plain Set that grew without bound for the lifetime of the process, and
+// GET /local/receipts (_listLocalReceipts) did one getReceipt() SQLite read
+// per entry -- an unbounded, O(N) cost per call as the receipt count grows
+// across a long-running daemon's lifetime.
+//
+// Fix: cap it at MAX_LOCAL_RECEIPT_OIDS, evicting the OLDEST-registered oid
+// (FIFO, via Map's insertion-order iteration) once the cap is reached. This
+// bounds both the memory (the Set itself) and the per-call SQLite read cost
+// (_listLocalReceipts never reads more than the cap). The evicted oid's
+// underlying receipt is NOT deleted from gap_receipts (store.ts) -- it
+// remains fetchable individually via GET /local/receipts/:oid, which reads
+// the SQLite table directly (store.ts:691-694), not this registry. Only the
+// STREAM LISTING (GET /local/receipts, the dashboard's "Receipts" tab) is
+// bounded to the most recent MAX_LOCAL_RECEIPT_OIDS; nothing is destroyed.
+//
+// A direct SQLite range query (store.ts already has listReceipts(tenantId,
+// opts), PC-17/PC-18) was considered and rejected for THIS surface: local
+// receipts span potentially many operator tenant_ids
+// (tenant:local-${principal_oid}, one per enrolled operator in the v1
+// single-machine model), and listReceipts is tenant-scoped by design (its
+// WHERE tenant_id = ? clause is the multi-tenant isolation boundary
+// elsewhere in the gateway) -- there is no existing "all local receipts
+// across tenants" query, and inventing one would touch tenant-isolation
+// semantics outside this fix's scope. The bounded in-memory registry keeps
+// the existing "one dashboard, one machine, all local receipts" semantics
+// unchanged while fixing the actual unboundedness.
+exports.DEFAULT_MAX_LOCAL_RECEIPT_OIDS = 500;
+/**
+ * A Set-like registry (same .add / .clear / for-of interface every call site
+ * already uses) bounded at `cap` entries, evicting the oldest (FIFO, by
+ * insertion order) once full. Re-adding an already-present oid is a no-op
+ * (does not refresh its position) -- a receipt oid is only ever registered
+ * once, at emission time, so recency-on-read semantics do not apply here.
+ */
+class BoundedOidRegistry {
+    cap;
+    entries = new Map();
+    constructor(cap) {
+        this.cap = cap;
+    }
+    add(oid) {
+        if (this.entries.has(oid))
+            return;
+        if (this.entries.size >= this.cap) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest !== undefined)
+                this.entries.delete(oldest);
+        }
+        this.entries.set(oid, true);
+    }
+    has(oid) {
+        return this.entries.has(oid);
+    }
+    clear() {
+        this.entries.clear();
+    }
+    /** TEST ONLY: change the cap at runtime (does not retroactively evict). */
+    setCap(n) {
+        this.cap = n;
+    }
+    get size() {
+        return this.entries.size;
+    }
+    [Symbol.iterator]() {
+        return this.entries.keys();
+    }
+}
+const _localReceiptOids = new BoundedOidRegistry(exports.DEFAULT_MAX_LOCAL_RECEIPT_OIDS);
+/** TEST ONLY: override the cap (e.g. to a small number) so a bounded-growth
+ *  vector does not need to actually emit hundreds of real receipts. */
+function _setMaxLocalReceiptOids(n) {
+    _localReceiptOids.setCap(n);
+}
+/** Register a receipt OID as emitted by the local-ingest router. */
+function _registerLocalReceiptOid(oid) {
+    _localReceiptOids.add(oid);
+}
+/** Return all receipts emitted by the local-ingest router, newest first. */
+function _listLocalReceipts() {
+    const out = [];
+    for (const oid of _localReceiptOids) {
+        const r = (0, store_1.getReceipt)(oid);
+        if (r !== null)
+            out.push(r);
+    }
+    out.sort((a, b) => b.created_at_ms - a.created_at_ms);
+    return out;
+}
+/** Clear local receipt tracking (for test teardown). */
+function _clearLocalReceiptTracking() {
+    _localReceiptOids.clear();
+}
+// ── Receipt emission helpers ──────────────────────────────────────────────────
+//
+// Subjects per ADR_014 Section 1.1 bundle receipt_subjects:
+//   governed-action.requested  -- held PENDING, pre-decision provenance
+//   governed-action.allowed    -- gate decision: allow; action may run
+//   governed-action.denied     -- gate decision: deny; action must NOT run
+const GOVERNED_ACTION_BUNDLE_OID = 'capbundle/1'; // per ADR_014 Section 1
+/**
+ * Build a receipt-v2 CDRO for the three local receipt subjects.
+ *
+ * Signing: canonicalize(cdroContentCore(cdro)) is signed over DSSE with the
+ * active hybrid signer (Ed25519 + ML-DSA-65). This matches what verifyReceiptV2
+ * in @synoi/verify expects: it recomputes canonicalize(cdroContentCore(receipt))
+ * and checks it equals the attestation envelope payload, then verifies both sigs.
+ *
+ * Store compat: saveReceipt reads r.oid, r.tenant_id, r.body.subject_kind,
+ * r.body.subject_oid, r.body.status, r.body.initiator.actor_oid,
+ * r.body.initiated_at_ms, r.body.resolved_at_ms -- all present in body below.
+ * The full CDRO is stored as JSON so getReceipt returns the v2 shape intact.
+ */
+function _buildDecisionReceiptV2(action, subject, subject_oid, decision, status, operator_oid, detail) {
+    const now = Date.now();
+    const tenant_id = `tenant:local-${action.principal_oid}`;
+    // Build the body: includes all fields saveReceipt column-extracts plus the
+    // AARM decision verb and authority block for audit chain compat.
+    const body = {
+        subject_kind: 'capability_invocation',
+        subject_oid,
+        decision,
+        action_kind: action.action_kind,
+        panel_id: action.panel_id,
+        decision_oid: action.originating_receipt_oid ?? null,
+        initiator: { actor_oid: operator_oid, actor_type: 'human_user' },
+        status,
+        authority: {
+            grant_oid: action.bundle_oid,
+            subject_oid: action.principal_oid,
+        },
+        capability_grant_oids: [action.bundle_oid],
+        initiated_at_ms: now,
+        resolved_at_ms: now,
+        cited_oracle_inputs: [],
+        ...(detail !== undefined ? { detail } : {}),
+    };
+    // Build the content core (oid and attestation absent at this stage).
+    // getSignerKeyId() may throw when keys are not yet initialized; fall back to
+    // a placeholder so the receipt is still stored (matches signGapReceiptV2 contract:
+    // "never throws -- a signing failure is logged and the receipt is returned
+    // without an attestation field, which a verifier treats as unsigned, not valid").
+    let signerKeyId = 'uninitialised';
+    try {
+        signerKeyId = (0, verify_router_1.getSignerKeyId)();
+    }
+    catch { /* keys not initialised yet */ }
+    const coreObj = {
+        type: 'gap:decision_receipt',
+        sraid_version: '2.0',
+        receipt_scheme: 'synoi.receipt/v2',
+        tenant_id,
+        created_at_ms: now,
+        created_by: signerKeyId,
+        subject,
+        body,
+    };
+    // Compute OID via sraid cdroOid (= oidOf(cdroContentCore(coreObj))).
+    // coreObj has no oid/attestation yet so cdroContentCore returns it unchanged.
+    const oid = (0, sraid_1.cdroOid)(coreObj);
+    // The DSSE payload is canonicalize(cdroContentCore(fullCdro)).
+    // cdroContentCore strips oid and attestation, so this equals canonicalize(coreObj).
+    const fullWithOid = { oid, ...coreObj };
+    const payload = (0, sraid_1.canonicalize)((0, sraid_1.cdroContentCore)(fullWithOid));
+    // Signing: never throws -- failure is logged and receipt is returned without
+    // attestation (verifier treats missing attestation as unsigned, not valid).
+    let attestation;
+    try {
+        attestation = (0, verify_router_1.signDssePayload)(GAP_RECEIPT_PAYLOAD_TYPE, payload);
+    }
+    catch (err) {
+        process.stderr.write(`[local-ingest] v2 sign failed oid=${oid}: ${err instanceof Error ? err.message : String(err)}\n`);
+    }
+    // Assemble the complete CDRO.
+    const cdro = {
+        oid,
+        ...coreObj,
+        ...(attestation !== undefined ? { attestation } : {}),
+    };
+    // Cast to GapDecisionReceipt for store compat. The store reads the fields
+    // enumerated above (all present in body) and persists JSON.stringify(r),
+    // so getReceipt returns the full v2 CDRO shape including type and subject.
+    const r = cdro;
+    (0, store_1.saveReceipt)(r);
+    _localReceiptOids.add(oid);
+    return r;
+}
+/**
+ * Lite self-sign receipt tier (ADR_014 Section 10.1/10.3): builds and signs a
+ * governed-action decision receipt using @synoi/gap's `receipt()` one-liner
+ * against the per-instance operator-owned key (lite-signing-key.ts), instead
+ * of the gateway's KMS-hybrid DSSE tier (_buildDecisionReceiptV2 above).
+ *
+ * This is intentionally a NARROWER body than _buildDecisionReceiptV2: it
+ * commits to the OSS @synoi/gap GapDecisionReceiptBody schema (subject_kind,
+ * subject_oid, initiator, status, detail, timing) rather than the gateway's
+ * internally-enriched shape (action_kind/panel_id/decision/authority/
+ * decision_oid as separate typed fields). The gateway-specific enrichment has
+ * no OSS-schema home on this tier, so it is folded into `detail` as free text
+ * instead of silently dropped. This is the accepted lite-vs-full divergence:
+ * lite commits to the public GAP receipt shape a third party can verify with
+ * nothing but @synoi/gap + @synoi/verify; the full gateway's enriched shape
+ * stays internal-audit-trail-only.
+ *
+ * decisionStatus follows @synoi/gap's own DecisionStatus enum ('pending' for
+ * the requested receipt, 'ok' for allow, 'denied' for deny) -- the SAME two
+ * values ('ok'/'denied') the gateway's own status field already used for
+ * allow/deny before this tier existed (see _emitAllowedReceipt/
+ * _emitDeniedReceipt below), so _decisionVerdict (below) reads either shape
+ * without ambiguity.
+ */
+function _buildLiteSelfSignReceipt(action, subjectOid, decisionStatus, operator_oid, extraDetail) {
+    const keyPair = (0, lite_signing_key_1.loadOrCreateLiteSigningKey)();
+    const detailParts = [
+        `action_kind=${action.action_kind}`,
+        `panel_id=${action.panel_id}`,
+        `bundle_oid=${action.bundle_oid}`,
+        ...(action.originating_receipt_oid !== null && action.originating_receipt_oid !== undefined
+            ? [`originating_receipt_oid=${action.originating_receipt_oid}`]
+            : []),
+        ...(extraDetail !== undefined ? [extraDetail] : []),
+    ];
+    const r = (0, gap_1.receipt)({
+        tenantId: `tenant:local-${action.principal_oid}`,
+        subjectKind: 'capability_invocation',
+        subjectOid,
+        initiator: { actor_oid: operator_oid, actor_type: 'human_user' },
+        status: decisionStatus,
+        detail: detailParts.join('; '),
+    }, { keyPair });
+    const gapReceipt = r.envelope;
+    (0, store_1.saveReceipt)(gapReceipt);
+    _localReceiptOids.add(gapReceipt.oid);
+    return gapReceipt;
+}
+/**
+ * Read the effective allow/deny verdict off a decision receipt, tolerant of
+ * both receipt shapes this router can emit: the full-gateway
+ * _buildDecisionReceiptV2 shape (body.decision: 'allow'|'deny'|'step_up') and
+ * the lite self-sign @synoi/gap receipt() shape (no body.decision field;
+ * body.status: 'ok'|'denied' carries the verdict instead -- and already did,
+ * even on the full-gateway shape, for these two cases). Returns null for a
+ * receipt that carries neither (e.g. the 'requested' receipt itself, whose
+ * status is 'pending').
+ */
+function _decisionVerdict(r) {
+    const decision = r.body.decision;
+    if (decision === 'allow')
+        return 'allow';
+    if (decision === 'deny')
+        return 'deny';
+    if (r.body.status === 'ok')
+        return 'allow';
+    if (r.body.status === 'denied')
+        return 'deny';
+    return null;
+}
+function _emitRequestedReceipt(action) {
+    if ((0, lite_mode_1.isLiteMode)()) {
+        return _buildLiteSelfSignReceipt(action, action.bundle_oid, 'pending', action.principal_oid);
+    }
+    return _buildDecisionReceiptV2(action, 'governed-action.requested', action.bundle_oid, 'step_up', 'pending', action.principal_oid, `governed-action.requested: action_kind=${action.action_kind} awaiting operator decision`);
+}
+function _emitAllowedReceipt(action, operator_oid, reason) {
+    const detail = reason !== undefined ? reason : 'governed-action.allowed: operator approved';
+    if ((0, lite_mode_1.isLiteMode)()) {
+        return _buildLiteSelfSignReceipt(action, action.pending_oid, 'ok', operator_oid, detail);
+    }
+    return _buildDecisionReceiptV2(action, 'governed-action.allowed', action.pending_oid, 'allow', 'ok', operator_oid, detail);
+}
+function _emitDeniedReceipt(action, operator_oid, reason) {
+    const detail = reason !== undefined ? reason : 'governed-action.denied: operator denied';
+    if ((0, lite_mode_1.isLiteMode)()) {
+        return _buildLiteSelfSignReceipt(action, action.pending_oid, 'denied', operator_oid, detail);
+    }
+    return _buildDecisionReceiptV2(action, 'governed-action.denied', action.pending_oid, 'deny', 'denied', operator_oid, detail);
+}
+// ── Background timeout sweep ──────────────────────────────────────────────────
+let _sweepTimer = null;
+/** Start the timeout sweep. Called by startLocalIngestSweep() at gateway init. */
+function startLocalIngestSweep(intervalMs = exports.DEFAULT_TIMEOUT_SWEEP_MS) {
+    if (_sweepTimer !== null)
+        return;
+    _sweepTimer = setInterval(() => { sweepExpiredPending(); }, intervalMs);
+    if (_sweepTimer.unref)
+        _sweepTimer.unref(); // don't prevent process exit
+}
+/** Stop the sweep (for tests). */
+function stopLocalIngestSweep() {
+    if (_sweepTimer !== null) {
+        clearInterval(_sweepTimer);
+        _sweepTimer = null;
+    }
+}
+// ── Router ────────────────────────────────────────────────────────────────────
+const router = express_1.default.Router();
+router.use(express_1.default.json({ limit: '64kb' }));
+// LOOPBACK-ONLY guard (runs FIRST, before every route).
+// PARTIAL-pending-Security+Adversary-panel: loopback enforcement is built and
+// tested; the panel will review the full exposure surface.
+router.use((req, res, next) => {
+    const peer = req.socket.remoteAddress;
+    if (!isLoopbackAddress(peer)) {
+        res.status(403).json({
+            error: 'forbidden',
+            detail: '/local/* is loopback-only; remote access is not permitted',
+            // Security note: 403 (not 404) to signal that the resource exists but
+            // access is denied. The panel may decide 404 is preferable to avoid
+            // confirming endpoint existence; tagging for panel review.
+        });
+        return;
+    }
+    next();
+});
+// #2a: HOST-HEADER guard (DNS-rebinding defense, runs after socket check).
+// A browser making a cross-origin request to 127.0.0.1 will set Host to the
+// ATTACKER domain (via DNS rebinding). This rejects it before any handler.
+// Accepting: 127.0.0.1[:PORT] and localhost[:PORT] only.
+router.use((req, res, next) => {
+    const host = req.headers['host'];
+    if (!isValidLocalHost(host)) {
+        res.status(403).json({
+            error: 'forbidden',
+            detail: '/local/* requires Host: 127.0.0.1 or Host: localhost; DNS-rebinding not permitted',
+        });
+        return;
+    }
+    next();
+});
+// #2b: CUSTOM-HEADER guard (CSRF defense, runs after host check).
+// Browsers cannot set X-SynOI-Local on cross-origin no-cors requests, so this
+// defeats CSRF for STATE-CHANGING calls without a per-request token.
+//
+// EXEMPTION: GET /dashboard and GET /dashboard/* (the page-load navigation
+// itself -- both the built-portal express.static branch and the lite HTML
+// fallback below register under this same path). A top-level browser
+// navigation CANNOT set a custom header (no <a>/address-bar mechanism exists
+// for it), so requiring this header on the page load makes the dashboard
+// permanently unreachable by an operator actually typing/clicking the URL --
+// found 2026-07-11 while browser-testing the lite dashboard fallback (ADR_014
+// Section 10.3 renderer item 3); the SAME gap silently affected the
+// built-portal branch too, since both register after this guard. The
+// dashboard's OWN subsequent fetch() calls (POST /local/decide, GET
+// /local/pending, etc.) DO set the header -- exactly what the dashboard
+// registration comment always assumed; only the very first page-load request
+// needed the exemption. Loopback + Host-header guards (both run before this
+// one) still apply IN FULL to the exempted routes; this exemption is
+// CSRF-scope only, and a plain GET here returns static HTML, not a
+// state-changing effect.
+router.use((req, res, next) => {
+    if (req.method === 'GET' && (req.path === '/dashboard' || req.path.startsWith('/dashboard/'))) {
+        next();
+        return;
+    }
+    const hdr = req.headers[exports.LOCAL_CUSTOM_HEADER_NAME];
+    if (hdr !== exports.LOCAL_CUSTOM_HEADER_VALUE) {
+        res.status(403).json({
+            error: 'forbidden',
+            detail: `${exports.LOCAL_CUSTOM_HEADER_NAME}: ${exports.LOCAL_CUSTOM_HEADER_VALUE} is required on all /local/* requests`,
+        });
+        return;
+    }
+    next();
+});
+// ── GET /local/health ─────────────────────────────────────────────────────────
+//
+// ADR_016 Section 3.3 / 2.1: includes enrolled + tenant_id? so the dashboard
+// can branch to the first-run view without a failed decide.
+router.get('/health', (_req, res) => {
+    // Probe the enrollment record for any active first-run-local entry.
+    let enrolled = false;
+    let tenant_id;
+    try {
+        const record = (0, operator_enrollment_1.loadEnrollmentRecord)();
+        if (record !== null) {
+            const activeLocal = record.enrolled_operators.find(e => e.status === 'active' && e.enrollment_source === 'first-run-local');
+            if (activeLocal !== undefined) {
+                enrolled = true;
+                tenant_id = activeLocal.tenant_id;
+            }
+        }
+    }
+    catch { /* fail-closed: report not-enrolled */ }
+    res.json({
+        status: 'ok',
+        surface: 'local-ingest',
+        adr: 'ADR_014 Section 3 / ADR_016',
+        pending_count: exports._pendingStore.size,
+        keys: 'TEST-KEYS',
+        // ADR_016 Section 3.3: enrollment status for dashboard first-run branching.
+        enrolled,
+        ...(tenant_id !== undefined ? { tenant_id } : {}),
+        // Honest tag: this surface is PARTIAL-pending-Security+Adversary-panel.
+        // Do not read 'ok' here as a panel clearance.
+        tag: 'PARTIAL-pending-panel',
+    });
+});
+// ── GET /local/dashboard (+ /local/dashboard/*) -- static asset serve ────────
+//
+// ADR_016 Section 3.2: serve the built operator dashboard static assets same-origin
+// from the daemon. The portal Next.js app is built to static output and the assets
+// placed in SYNOI_DASHBOARD_DIR (env) or the default path below. This route sits
+// BEHIND the three pre-route guards (socket + Host + custom-header), so remote peers
+// cannot fetch dashboard assets (ADR_016 Section 5 residual / Section 3.2 flag).
+//
+// In development (no SYNOI_DASHBOARD_DIR, no built assets): the route returns a
+// minimal HTML stub so the daemon boots without a portal build present.
+//
+// The dashboard calls /local/* over the same origin and same port; no CORS is needed.
+const DASHBOARD_ENV_DIR = process.env['SYNOI_DASHBOARD_DIR'];
+const DASHBOARD_DEFAULT = path.join(os.homedir(), '.synoi', 'dashboard');
+const DASHBOARD_DIR = DASHBOARD_ENV_DIR ?? DASHBOARD_DEFAULT;
+const DASHBOARD_BUILT = DASHBOARD_DIR !== '' && fs.existsSync(DASHBOARD_DIR);
+// Adversary #2 (2026-07-12 quality gate): the dashboard set no framing
+// defense, so it could be iframed by a malicious co-located page and
+// clickjacked into an operator approving an action they never saw. Applied
+// to EVERY /local/dashboard* response, both branches below (express.static
+// AND the lite HTML fallback), mirroring the pattern already shipped at
+// device-page.ts:185-188.
+router.use('/dashboard', (_req, res, next) => {
+    res.setHeader('X-Frame-Options', 'DENY');
+    res.setHeader('Content-Security-Policy', "frame-ancestors 'none'");
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    next();
+});
+if (DASHBOARD_BUILT) {
+    // Serve static assets (html/css/js) under /local/dashboard.
+    // express.static is mounted on the sub-path after the three router-level guards.
+    router.use('/dashboard', express_1.default.static(DASHBOARD_DIR, {
+        index: 'index.html',
+        maxAge: 0, // no client caching -- operator dashboard is live state
+        etag: false,
+        fallthrough: true,
+    }));
+    // SPA fallback: any /local/dashboard/* path that isn't a static file returns index.html.
+    router.get('/dashboard/*', (_req, res) => {
+        res.sendFile(path.join(DASHBOARD_DIR, 'index.html'));
+    });
+}
+else {
+    // No built portal assets (ADR_016 Section 3.2's "development" case, and the
+    // ONLY case the lite daemon has: Tauri/portal packaging is deferred to
+    // v1.x per ADR_014 Section 3.4). ADR_014 Section 10.3 renderer item 3:
+    // this is a generic, MAXIMALLY-CONSERVATIVE, self-contained HTML fallback,
+    // not a placeholder -- it is the real operator surface for lite. Zero
+    // external build deps (no bundler, no framework, no CDN script): one
+    // static HTML file with inline CSS + vanilla JS, using only the browser's
+    // native Web Crypto Ed25519 API to sign the operator's decisions.
+    //
+    // It renders every pending action's args VERBATIM (no summarization that
+    // could hide a dangerous argument), flags any action_kind outside the
+    // three declared ADR_005 Section 5 values ("command" | "render" |
+    // "background-refresh") as highest-risk and demands an explicit "I have
+    // reviewed the raw arguments" confirmation before Approve is enabled, and
+    // wires approve/deny through the FULL signed-assent ceremony: GET
+    // /local/decide-challenge/:pending_oid (operator signs the fetch-challenge
+    // payload) -> operator signs the canonical decide payload -> POST
+    // /local/decide. It emits NO other state-changing control besides that and
+    // the one-time POST /local/enroll bootstrap ceremony (itself a signed,
+    // verified action, not a bare bypass) -- the signed-control invariant.
+    //
+    // Read once at module load and cached; the file rarely changes at runtime
+    // (unlike the built-portal branch above, which intentionally serves live
+    // off disk with no caching for iterative portal development).
+    const LITE_DASHBOARD_HTML = fs.readFileSync(path.join(__dirname, 'lite-dashboard.html'), 'utf8');
+    router.get('/dashboard', (_req, res) => {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.send(LITE_DASHBOARD_HTML);
+    });
+    router.get('/dashboard/*', (_req, res) => {
+        res.setHeader('Content-Type', 'text/html; charset=utf-8');
+        res.send(LITE_DASHBOARD_HTML);
+    });
+}
+// ── POST /local/enroll ────────────────────────────────────────────────────────
+//
+// First-run enrollment endpoint (ADR_016 Section 2). Loopback-only (inherits the
+// three router-level guards). Server-derives tenant_id = `tenant:local-${operator_oid}`;
+// the body MUST NOT carry a tenant. Verifies enrollment_signature (proof of key
+// possession, Section 2.2) then calls the SHIPPED enrollOperator.
+//
+// Body: { operator_oid, operator_pubkey_hex, device_label, confirm: true,
+//         enrollment_signature }
+// -> 201 { enrolled: true, operator_oid, tenant_id, enrollment_source }
+// -> 400 oid_binding_mismatch | invalid_request
+// -> 403 signature_invalid
+// -> 409 already_enrolled
+router.post('/enroll', (req, res) => {
+    const body = req.body;
+    // confirm: true is the deliberate-act gate (ADR_016 Section 2.2).
+    if (body.confirm !== true) {
+        res.status(400).json({ error: 'confirm must be true', type: 'invalid_request' });
+        return;
+    }
+    // Validate required fields.
+    if (!isValidOperatorOid(body.operator_oid)) {
+        res.status(400).json({ error: 'operator_oid must be "oid-" + 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (!isValidPubkeyHex(body.operator_pubkey_hex)) {
+        res.status(400).json({ error: 'operator_pubkey_hex must be 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (typeof body.device_label !== 'string' || !body.device_label) {
+        res.status(400).json({ error: 'device_label required', type: 'invalid_request' });
+        return;
+    }
+    if (typeof body.enrollment_signature !== 'string' || !/^[0-9a-f]{128}$/.test(body.enrollment_signature)) {
+        res.status(400).json({ error: 'enrollment_signature must be 128 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    const operator_oid = body.operator_oid;
+    const operator_pubkey_hex = body.operator_pubkey_hex;
+    const device_label = body.device_label;
+    const enrollment_signature = body.enrollment_signature;
+    // Sentinel-OID guard: the timeout sentinel is reserved for daemon auto-deny;
+    // reject it at enroll too (defense-in-depth, ADR_016 Section 2.1).
+    if (operator_oid === TIMEOUT_SENTINEL_OID) {
+        res.status(400).json({
+            error: 'operator_oid is the reserved timeout sentinel and cannot be used as an operator identity',
+            type: 'sentinel_reserved',
+        });
+        return;
+    }
+    // OID-binding: sha256(pubkey) must equal operator_oid (ADR_016 Section 2.1 step 2).
+    if (!verifyOidBinding(operator_oid, operator_pubkey_hex)) {
+        res.status(400).json({
+            error: 'operator_oid does not match sha256(operator_pubkey_hex)',
+            type: 'oid_binding_mismatch',
+        });
+        return;
+    }
+    // Derive tenant server-side (NEVER from body, ADR_016 Section 2.1 step 3).
+    const tenant_id = `tenant:local-${operator_oid}`;
+    // Verify enrollment_signature over the canonical enroll payload (Section 2.2).
+    // This proves the caller holds the private half of the enrolling key.
+    const enrollCanonical = (0, sraid_1.canonicalize)({
+        action: 'enroll',
+        device_label,
+        operator_oid,
+        tenant_id,
+    });
+    if (!verifyOperatorSignature(enrollCanonical, operator_pubkey_hex, enrollment_signature)) {
+        res.status(403).json({ error: 'enrollment_signature does not verify', type: 'signature_invalid' });
+        return;
+    }
+    // Call the SHIPPED enrollOperator; map already-enrolled throw to 409.
+    try {
+        (0, operator_enrollment_1.enrollOperator)(tenant_id, operator_pubkey_hex, device_label, { source: 'first-run-local' });
+    }
+    catch (e) {
+        const msg = e.message ?? '';
+        if (msg.includes('already enrolled')) {
+            res.status(409).json({ error: 'operator already enrolled for this tenant', type: 'already_enrolled' });
+            return;
+        }
+        res.status(500).json({ error: 'enrollment failed', type: 'internal_error' });
+        return;
+    }
+    res.status(201).json({
+        enrolled: true,
+        operator_oid,
+        tenant_id,
+        enrollment_source: 'first-run-local',
+    });
+});
+// ── GET /local/decide-challenge/:pending_oid ──────────────────────────────────
+//
+// Authenticated nonce delivery for the dashboard (ADR_016 Section 4.2).
+// Returns the per-pending challenge_nonce ONLY to an enrolled operator who
+// proves possession of their key by signing a fetch-challenge canonical payload.
+// Does NOT consume the nonce. F3 is not re-opened (Section 4.3).
+//
+// Auth headers: X-Operator-OID, X-Operator-Pubkey, X-Operator-Challenge-Sig
+// Runs assertEnrolledOperatorAuth (steps 1-3) for tenant:local-${pending.principal_oid}.
+//
+// -> 200 { pending_oid, challenge_nonce }
+// -> 400 invalid_request (missing fields)
+// -> 403 signature_invalid | operator_not_enrolled_for_tenant
+// -> 404 pending_oid not found or already decided
+router.get('/decide-challenge/:pending_oid', (req, res) => {
+    const pending_oid = typeof req.params['pending_oid'] === 'string' ? req.params['pending_oid'] : '';
+    if (!pending_oid) {
+        res.status(400).json({ error: 'pending_oid required', type: 'invalid_request' });
+        return;
+    }
+    // Extract operator auth from headers.
+    const operator_oid = req.headers['x-operator-oid'];
+    const operator_pubkey_hex = req.headers['x-operator-pubkey'];
+    const challenge_sig = req.headers['x-operator-challenge-sig'];
+    if (typeof operator_oid !== 'string' || !isValidOperatorOid(operator_oid)) {
+        res.status(400).json({ error: 'X-Operator-OID must be "oid-" + 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (typeof operator_pubkey_hex !== 'string' || !isValidPubkeyHex(operator_pubkey_hex)) {
+        res.status(400).json({ error: 'X-Operator-Pubkey must be 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (typeof challenge_sig !== 'string' || !/^[0-9a-f]{128}$/.test(challenge_sig)) {
+        res.status(400).json({ error: 'X-Operator-Challenge-Sig must be 128 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    // Look up the pending action. Unknown or already-decided -> 404.
+    const storedAction = exports._pendingStore.get(pending_oid);
+    if (storedAction === undefined) {
+        res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+        return;
+    }
+    // Derive the action tenant (same derivation as /local/decide line 760).
+    const action_tenant_id = `tenant:local-${storedAction.principal_oid}`;
+    // Build the canonical fetch-challenge payload (ADR_016 Section 4.2).
+    // Fix 2 (ADR_016): include tenant_id so signatures are not portable across
+    // tenants. A signature over {action, operator_oid, pending_oid} without
+    // tenant_id could be replayed against a different tenant's action store.
+    const canonical = (0, sraid_1.canonicalize)({
+        action: 'fetch-challenge',
+        operator_oid,
+        pending_oid,
+        tenant_id: action_tenant_id,
+    });
+    // Run steps 1-3 of enrolled-operator auth (assertEnrolledOperatorAuth).
+    // On any failure -> 403, no nonce disclosed.
+    try {
+        (0, operator_enrollment_1.assertEnrolledOperatorAuth)(action_tenant_id, operator_oid, operator_pubkey_hex, challenge_sig, canonical);
+    }
+    catch (e) {
+        if (e instanceof operator_enrollment_1.OperatorNotEnrolledForTenantError) {
+            // Fix 1 (ADR_016): return 404 instead of 403 so callers cannot distinguish
+            // "enrolled for wrong tenant" (action exists) from "action not found".
+            // Returning 403 here was an existence oracle: a wrong-tenant caller could
+            // probe whether a pending_oid is real by observing 403 vs 404.
+            res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+            return;
+        }
+        if (e instanceof operator_enrollment_1.OperatorNotEnrolledError) {
+            // Fix 3 (ADR_016): collapse enrolled-anywhere oracle. Previously, an unenrolled
+            // caller got 403 (not_enrolled) while a wrong-tenant caller got 404 (Fix 1).
+            // The difference reveals whether the caller is enrolled anywhere at all.
+            // Return 404 here too so the response is indistinguishable from "action not found".
+            res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+            return;
+        }
+        if (e instanceof operator_enrollment_1.EnrollmentIntegrityError) {
+            const detail = e.message;
+            if (detail.includes('oid_binding_mismatch')) {
+                res.status(400).json({ error: 'operator_oid does not match sha256(X-Operator-Pubkey)', type: 'oid_binding_mismatch' });
+                return;
+            }
+            if (detail.includes('signature_invalid')) {
+                res.status(403).json({ error: 'X-Operator-Challenge-Sig does not verify', type: 'signature_invalid' });
+                return;
+            }
+            res.status(400).json({ error: detail, type: 'invalid_request' });
+            return;
+        }
+        res.status(500).json({ error: 'internal error', type: 'internal_error' });
+        return;
+    }
+    // Auth passed: return the stored nonce. Do NOT consume it (consume is at /decide).
+    res.status(200).json({
+        pending_oid,
+        challenge_nonce: storedAction.challenge_nonce,
+    });
+});
+// ── POST /local/gate principal_oid derive-or-validate (ADR_016 v1.1) ─────────
+//
+// Derive rule (v1 ergonomic win, single-operator deployment):
+//   If principal_oid is OMITTED or empty in the body:
+//     - ZERO active non-demo enrolled operators  -> 409 not_enrolled  (clear error)
+//     - EXACTLY ONE active non-demo enrolled op  -> derive from that operator's OID
+//     - TWO OR MORE active non-demo enrolled ops -> 409 principal_oid_ambiguous (clear error)
+//   If principal_oid IS present:
+//     - validate that it matches an active enrolled operator for tenant:local-<principal_oid>
+//     - mismatch -> 400 principal_not_enrolled (early rejection, not silent decide-time 403)
+//
+// The D1 limitation note (receipt attests operator-APPROVAL not principal PROVENANCE
+// for the general multi-party case) remains intact. This is the v1 single-operator guard.
+/**
+ * Returns the set of active non-demo enrolled operators from the current record.
+ * Returns an empty array if the record cannot be loaded.
+ */
+function _getActiveLocalOperators() {
+    try {
+        const record = (0, operator_enrollment_1.loadEnrollmentRecord)();
+        if (record === null)
+            return [];
+        return record.enrolled_operators.filter(e => e.status === 'active' &&
+            e.enrollment_source !== 'demo-session' &&
+            e.tenant_id.startsWith('tenant:local-'));
+    }
+    catch {
+        return [];
+    }
+}
+// ── POST /local/gate ──────────────────────────────────────────────────────────
+//
+// Ingest an AI action. Body: { bundle_oid, principal_oid?, panel_id, action_kind,
+//   originating_receipt_oid?, args? }
+// principal_oid is OPTIONAL: if omitted the daemon derives it from the single
+// active enrolled operator (ADR_016 v1.1 ergonomics). Returns:
+//   { pending_oid, status: "pending", requested_receipt_oid, ingested_at }
+router.post('/gate', (req, res) => {
+    // #4: Rate-limit check (before any store interaction).
+    if (!_checkAndRecordGateCall()) {
+        res.status(429).json({
+            error: 'too_many_requests',
+            detail: `Rate limit: max ${exports.GATE_RATE_MAX_CALLS} calls per ${exports.GATE_RATE_WINDOW_MS}ms window`,
+            type: 'rate_limited',
+        });
+        return;
+    }
+    // #4: Pending-store cap (before any store interaction).
+    if (exports._pendingStore.size >= exports.MAX_PENDING_ACTIONS) {
+        res.status(429).json({
+            error: 'too_many_requests',
+            detail: `Pending store at capacity (${exports.MAX_PENDING_ACTIONS}); resolve or await timeout of existing actions`,
+            type: 'pending_cap_exceeded',
+        });
+        return;
+    }
+    const body = req.body;
+    if (typeof body.bundle_oid !== 'string' || !body.bundle_oid) {
+        res.status(400).json({ error: 'bundle_oid required', type: 'invalid_request' });
+        return;
+    }
+    if (typeof body.panel_id !== 'string' || !body.panel_id) {
+        res.status(400).json({ error: 'panel_id required', type: 'invalid_request' });
+        return;
+    }
+    if (typeof body.action_kind !== 'string' || !body.action_kind) {
+        res.status(400).json({ error: 'action_kind required', type: 'invalid_request' });
+        return;
+    }
+    // #3: Bundle-OID grant check (Axis-3 subset).
+    // bundle_oid must exist in gap_grants as an active (non-revoked, non-expired) grant.
+    // A bundle_oid that is unknown, revoked, or expired is rejected 403 here.
+    // NOTE: The test-key bootstrap sentinel 'capbundle/1' is whitelisted for test runs
+    // (SYNOI_ALLOW_EPHEMERAL_KEYS=true), because in the test harness no real grants
+    // are written to the DB. In production (SYNOI_ALLOW_EPHEMERAL_KEYS unset/false),
+    // the grant must actually exist in gap_grants.
+    const bundleOid = body.bundle_oid;
+    // Re-panel F2 (2026-06-22): isTestMode requires BOTH SYNOI_ALLOW_EPHEMERAL_KEYS=true
+    // AND NODE_ENV !== 'production'. A prod deploy with the env flag set must not
+    // reopen the capbundle/1 sentinel bypass.
+    const isTestMode = process.env['SYNOI_ALLOW_EPHEMERAL_KEYS'] === 'true' &&
+        process.env['NODE_ENV'] !== 'production';
+    const isBootstrapSentinel = bundleOid === 'capbundle/1';
+    if (!isTestMode || !isBootstrapSentinel) {
+        // Reject if the bundle_oid is known-revoked (covers explicit revocations).
+        if ((0, store_1.isOidRevoked)(bundleOid)) {
+            res.status(403).json({
+                error: 'forbidden',
+                detail: `bundle_oid '${bundleOid}' is revoked`,
+                type: 'bundle_revoked',
+            });
+            return;
+        }
+        // Reject if the grant does not exist at all in the grants table.
+        const grant = (0, store_1.getGrant)(bundleOid);
+        if (grant === null) {
+            res.status(403).json({
+                error: 'forbidden',
+                detail: `bundle_oid '${bundleOid}' is not a known capability grant`,
+                type: 'bundle_unknown',
+            });
+            return;
+        }
+        // Reject if the grant is expired.
+        if (grant.body.expires_at_ms !== undefined && grant.body.expires_at_ms !== null && grant.body.expires_at_ms <= Date.now()) {
+            res.status(403).json({
+                error: 'forbidden',
+                detail: `bundle_oid '${bundleOid}' grant has expired`,
+                type: 'bundle_expired',
+            });
+            return;
+        }
+        // Grant exists and is active. Proceed.
+    }
+    const originating_receipt_oid = typeof body.originating_receipt_oid === 'string' ? body.originating_receipt_oid : null;
+    // ── principal_oid derive-or-validate (ADR_016 v1.1) ──────────────────────
+    //
+    // Runs AFTER bundle/panel/action_kind validation (so bundle errors surface first).
+    //
+    // If omitted: derive from the single active enrolled operator (common v1 case).
+    // If present:  validate that it corresponds to an active enrolled operator.
+    const principalOidRaw = typeof body.principal_oid === 'string' ? body.principal_oid.trim() : '';
+    let resolved_principal_oid;
+    if (!principalOidRaw) {
+        // DERIVE path: inspect the enrollment record.
+        const activeOps = _getActiveLocalOperators();
+        if (activeOps.length === 0) {
+            // Zero enrolled operators: reject with a clear actionable error.
+            res.status(409).json({
+                error: 'no active enrolled operator; enroll an operator first via POST /local/enroll, or pass principal_oid explicitly',
+                type: 'not_enrolled',
+            });
+            return;
+        }
+        if (activeOps.length > 1) {
+            // Multiple enrolled operators: cannot auto-derive; require explicit principal_oid.
+            res.status(409).json({
+                error: 'multiple active enrolled operators; pass principal_oid explicitly to identify which operator governs this action',
+                type: 'principal_oid_ambiguous',
+            });
+            return;
+        }
+        // Exactly one: derive.
+        resolved_principal_oid = activeOps[0].operator_oid;
+    }
+    else {
+        // VALIDATE path: principal_oid was provided; check it matches an enrolled operator.
+        if (!isValidOperatorOid(principalOidRaw)) {
+            res.status(400).json({
+                error: 'principal_oid must be "oid-" + 64 lowercase hex chars',
+                type: 'invalid_request',
+            });
+            return;
+        }
+        const expectedTenant = `tenant:local-${principalOidRaw}`;
+        const activeOps = _getActiveLocalOperators();
+        const match = activeOps.find(e => e.operator_oid === principalOidRaw && e.tenant_id === expectedTenant);
+        if (match === undefined) {
+            // Early reject: fail-closed rather than queuing an action no one can approve.
+            res.status(400).json({
+                error: `principal_oid '${principalOidRaw}' does not match an active enrolled operator; enroll first or verify the OID`,
+                type: 'principal_not_enrolled',
+            });
+            return;
+        }
+        resolved_principal_oid = principalOidRaw;
+    }
+    // Build action. We emit the .requested receipt first to get the OID, then
+    // store the action with that OID as the pending_oid.
+    const now = Date.now();
+    const challenge_nonce = (0, node_crypto_1.randomBytes)(32).toString('hex');
+    // Temporary action object for receipt emission (pending_oid filled after).
+    // principal_oid is resolved_principal_oid (derived or validated above, never raw body).
+    const partial = {
+        bundle_oid: body.bundle_oid,
+        principal_oid: resolved_principal_oid,
+        panel_id: body.panel_id,
+        action_kind: body.action_kind,
+        originating_receipt_oid,
+        args: body.args ?? null,
+        ingested_at_ms: now,
+        status: 'pending',
+    };
+    // Emit the governed-action.requested receipt (signed, precondition-certificate ordering).
+    const requestedReceipt = _emitRequestedReceipt({
+        ...partial,
+        pending_oid: 'pending-placeholder',
+        requested_receipt_oid: 'pending-placeholder',
+        challenge_nonce,
+    });
+    // The receipt OID IS the pending_oid (content-addressed).
+    const pending_oid = requestedReceipt.oid;
+    const action = {
+        ...partial,
+        pending_oid,
+        challenge_nonce,
+        requested_receipt_oid: pending_oid,
+    };
+    exports._pendingStore.set(pending_oid, action);
+    res.status(201).json({
+        pending_oid,
+        status: 'pending',
+        requested_receipt_oid: pending_oid,
+        challenge_nonce,
+        ingested_at: new Date(now).toISOString(),
+    });
+});
+// ── GET /local/pending ────────────────────────────────────────────────────────
+router.get('/pending', (_req, res) => {
+    // Re-panel finding #3 (2026-06-22): challenge_nonce is deliberately NOT included
+    // here. It is already returned in the POST /local/gate 201 response, so the client
+    // has it. Exposing it on every listing poll lets any loopback process enumerate live
+    // nonces, which is the nonce-farming attack surface closed by this fix.
+    const pending = Array.from(exports._pendingStore.values()).map(a => ({
+        pending_oid: a.pending_oid,
+        bundle_oid: a.bundle_oid,
+        principal_oid: a.principal_oid,
+        panel_id: a.panel_id,
+        action_kind: a.action_kind,
+        originating_receipt_oid: a.originating_receipt_oid,
+        ingested_at: new Date(a.ingested_at_ms).toISOString(),
+        status: a.status,
+    }));
+    res.json({ pending, count: pending.length });
+});
+// ── GET /local/pending/:pending_oid ───────────────────────────────────────────
+//
+// ADR_014 Section 10.3 renderer item 4. The list endpoint above (GET /pending)
+// deliberately omits `args` -- returning every pending action's full argument
+// payload on every poll would let any loopback process enumerate all live
+// actions' arguments at once. This endpoint returns ONE pending action's full
+// detail, including `args`, on-demand -- the approval `form` panel calls this
+// once the operator has selected which pending action to review, not on every
+// list refresh. Same re-panel-finding-#3 reasoning as the list endpoint applies
+// to challenge_nonce: it is NOT included here either (already delivered via the
+// POST /local/gate 201 response and re-derivable by an enrolled operator via
+// GET /local/decide-challenge/:pending_oid, so there is no operational reason
+// to also expose it on a read-only detail fetch, and every additional exposure
+// point is additional nonce-farming surface).
+//
+// Inherits the three router-level guards (loopback, Host, custom-header) --
+// no separate auth is added here, same as GET /local/receipts/:oid and GET
+// /local/gate/:pending_oid: this is a read of an action already visible via
+// the list endpoint, just with the args field included.
+router.get('/pending/:pending_oid', (req, res) => {
+    const pending_oid = typeof req.params['pending_oid'] === 'string' ? req.params['pending_oid'] : '';
+    if (!pending_oid) {
+        res.status(400).json({ error: 'pending_oid required', type: 'invalid_request' });
+        return;
+    }
+    const a = exports._pendingStore.get(pending_oid);
+    if (a === undefined) {
+        res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+        return;
+    }
+    res.json({
+        pending_oid: a.pending_oid,
+        bundle_oid: a.bundle_oid,
+        principal_oid: a.principal_oid,
+        panel_id: a.panel_id,
+        action_kind: a.action_kind,
+        originating_receipt_oid: a.originating_receipt_oid,
+        args: a.args,
+        ingested_at: new Date(a.ingested_at_ms).toISOString(),
+        status: a.status,
+    });
+});
+// ── POST /local/decide ────────────────────────────────────────────────────────
+//
+// OPERATOR-AUTH: body must carry operator_oid, operator_pubkey_hex,
+// operator_signature over canonicalize({choice, pending_oid, operator_oid}).
+//
+// PARTIAL-pending-Security+Adversary-panel: the OID-binding check ensures the
+// supplied pubkey matches the declared operator OID (sha256 binding). It does
+// NOT verify that this operator OID is enrolled / trusted by a genesis-rooted
+// chain. That check is a future step after panel review.
+router.post('/decide', (req, res) => {
+    const body = req.body;
+    // Validate required decision fields.
+    if (typeof body.pending_oid !== 'string' || !body.pending_oid) {
+        res.status(400).json({ error: 'pending_oid required', type: 'invalid_request' });
+        return;
+    }
+    if (body.choice !== 'allow' && body.choice !== 'deny') {
+        res.status(400).json({ error: 'choice must be "allow" or "deny"', type: 'invalid_request' });
+        return;
+    }
+    // Sentinel-OID guard (defense-in-depth, must run before OID-binding check).
+    // TIMEOUT_SENTINEL_OID is reserved for daemon-originated auto-deny receipts;
+    // it passes isValidOperatorOid (all-zero hex is syntactically valid) but must
+    // NEVER be presentable as an operator identity. Reject early with a distinct
+    // type so the audit trail is unambiguous.
+    if (body.operator_oid === TIMEOUT_SENTINEL_OID) {
+        res.status(400).json({
+            error: 'operator_oid is the reserved timeout sentinel and cannot be used as an operator identity',
+            type: 'sentinel_reserved',
+        });
+        return;
+    }
+    // Validate operator identity fields (OPERATOR-AUTH, load-bearing).
+    if (!isValidOperatorOid(body.operator_oid)) {
+        res.status(400).json({ error: 'operator_oid must be "oid-" + 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (!isValidPubkeyHex(body.operator_pubkey_hex)) {
+        res.status(400).json({ error: 'operator_pubkey_hex must be 64 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    if (typeof body.operator_signature !== 'string' || !/^[0-9a-f]{128}$/.test(body.operator_signature)) {
+        res.status(400).json({ error: 'operator_signature must be 128 lowercase hex chars', type: 'invalid_request' });
+        return;
+    }
+    // challenge_nonce is required for replay protection (ADR_015).
+    if (typeof body.challenge_nonce !== 'string' || !body.challenge_nonce) {
+        res.status(400).json({ error: 'challenge_nonce required', type: 'invalid_request' });
+        return;
+    }
+    // Look up the action BEFORE auth to extract stored nonce and tenant.
+    // Do not delete yet.
+    const storedAction = exports._pendingStore.get(body.pending_oid);
+    const stored_nonce = storedAction?.challenge_nonce;
+    // Derive the tenant from the pending action's principal_oid (ADR_015 Section 10.2.A).
+    // This is the same derivation used by _buildReceiptBase.
+    // When storedAction is undefined the action does not exist (timed out, double-decide,
+    // or unknown oid). In that case action_tenant_id is empty: Step-2 in assertEnrolledOperator
+    // will fail with OperatorNotEnrolledForTenantError, which we map to 404 (same as the
+    // nonce_missing path, so the enrolled-but-replay and enrolled-but-unknown cases
+    // both return 404 consistently -- no information leakage to unenrolled callers who
+    // still get 403/409 from the OID-binding / enrollment_missing steps that fire earlier).
+    const action_tenant_id = storedAction !== undefined
+        ? `tenant:local-${storedAction.principal_oid}`
+        : '';
+    // Build canonical payload WITH challenge_nonce (ADR_015 Section 3.5).
+    // Fix 2 (ADR_016): include tenant_id so signatures are bound to the specific
+    // tenant. Without tenant_id, a signature over a decide payload could be
+    // presented to any tenant that accepted the same operator_oid.
+    const canonical = (0, sraid_1.canonicalize)({
+        choice: body.choice,
+        operator_oid: body.operator_oid,
+        pending_oid: body.pending_oid,
+        challenge_nonce: body.challenge_nonce,
+        tenant_id: action_tenant_id,
+    });
+    // Enrollment check: OID-binding + tenant-scoped enrolled-member + signature + freshness.
+    // Passes action_tenant_id as the first arg (ADR_015 Section 10.2.A).
+    try {
+        (0, operator_enrollment_1.assertEnrolledOperator)(action_tenant_id, body.operator_oid, body.operator_pubkey_hex, body.operator_signature, canonical, body.challenge_nonce, stored_nonce);
+    }
+    catch (e) {
+        if (e instanceof operator_enrollment_1.OperatorNotEnrolledForTenantError) {
+            // When storedAction was undefined we used tenant_id=''. If the operator IS enrolled
+            // for some tenant but there is no action, this error means the action does not exist
+            // (already consumed / timed out / never existed). Return 404 in that case to
+            // preserve the original replay -> 404 behavior. If storedAction was present but
+            // the operator is enrolled for a different tenant, return 403.
+            if (storedAction === undefined) {
+                res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+            }
+            else {
+                res.status(403).json({ error: e.message, type: e.code });
+            }
+            return;
+        }
+        if (e instanceof operator_enrollment_1.OperatorNotEnrolledError) {
+            const code = e.code;
+            res.status(code === 'not_enrolled' ? 403 : 409).json({ error: e.message, type: code });
+            return;
+        }
+        if (e instanceof operator_enrollment_1.EnrollmentIntegrityError) {
+            const detail = e.message;
+            if (detail.includes('oid_binding_mismatch')) {
+                res.status(400).json({ error: 'operator_oid does not match sha256(operator_pubkey_hex)', type: 'oid_binding_mismatch' });
+                return;
+            }
+            if (detail.includes('signature_invalid')) {
+                res.status(403).json({ error: 'operator_signature does not verify', type: 'signature_invalid' });
+                return;
+            }
+            if (detail.includes('stale_or_replayed')) {
+                res.status(409).json({ error: detail, type: 'stale_or_replayed' });
+                return;
+            }
+            if (detail.includes('nonce_missing')) {
+                // nonce_missing means the action was not in the store at lookup time.
+                // Treat this as not-found (action timed out, was already decided, etc.).
+                res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+                return;
+            }
+            res.status(400).json({ error: detail, type: 'invalid_request' });
+            return;
+        }
+        res.status(500).json({ error: 'internal error', type: 'internal_error' });
+        return;
+    }
+    // Re-check that the action still exists (may have timed out between lookup and auth).
+    const action = exports._pendingStore.get(body.pending_oid);
+    if (action === undefined) {
+        res.status(404).json({ error: 'pending_oid not found or already decided', type: 'not_found' });
+        return;
+    }
+    // Remove from pending BEFORE emitting the receipt (fail-closed: if receipt
+    // emission fails we have already removed the action so it cannot be
+    // double-decided).
+    exports._pendingStore.delete(body.pending_oid);
+    const reason = typeof body.reason === 'string' ? body.reason : undefined;
+    const operator_oid = body.operator_oid;
+    // Emit the decision receipt (signed, precondition-certificate ordering).
+    let decisionReceipt;
+    if (body.choice === 'allow') {
+        decisionReceipt = _emitAllowedReceipt(action, operator_oid, reason);
+    }
+    else {
+        decisionReceipt = _emitDeniedReceipt(action, operator_oid, reason);
+    }
+    // The action is released to the caller ONLY on allow, ONLY after the receipt
+    // is signed (precondition-certificate ordering per ADR_014 Section 1.6).
+    res.status(200).json({
+        decision: body.choice,
+        decision_oid: decisionReceipt.oid,
+        receipt_oid: decisionReceipt.oid,
+        // The action may run ONLY if decision == 'allow' AND the caller verifies
+        // the receipt at /local/receipts/:oid. Do NOT run the action on deny.
+        action_released: body.choice === 'allow',
+        verify_url: `/local/receipts/${decisionReceipt.oid}`,
+    });
+});
+// ── GET /local/gate/:pending_oid ─────────────────────────────────────────────
+//
+// ADR_014 Section 9.1 / 9.2 outcome endpoint.
+//
+// Returns the resolution status of a submitted pending action. The agent
+// calls this (NOT /local/decide -- that is operator-only). Three logical phases:
+//
+//   1. pending_oid still in _pendingStore -> status:"pending"
+//      Optional ?wait_ms=<n> long-poll: park up to min(wait_ms, MAX_WAIT_MS)
+//      checking _pendingStore on a 250ms tick; return early when the action
+//      leaves the store (decided or swept). On window elapse with action still
+//      pending: return 200 status:"pending". Mirrors /v1/risk/hitl/:id/wait.
+//
+//   2. pending_oid gone from _pendingStore AND a decision receipt found in
+//      _localReceiptOids whose body.subject_oid === pending_oid:
+//        - body.initiator.actor_oid === TIMEOUT_SENTINEL_OID -> status:"timeout"
+//        - body.decision === 'allow' -> status:"allowed", decision, receipt_oid, verify_url
+//        - body.decision === 'deny' (operator) -> status:"denied", decision, receipt_oid, verify_url
+//
+//   3. Neither (unknown OID: never submitted, or evicted with no receipt) -> 404.
+//
+// Loopback + Host + custom-header guards are inherited from the router-level
+// middlewares above (do NOT add auth here; this is a read-only agent observe).
+// challenge_nonce is deliberately NOT returned (ADR_014 Section 9.4 / re-panel #3).
+//
+// Status: DESIGN (ADR_014 Section 9.5 DESIGN). PARTIAL-against-test-keys.
+/** Maximum server-side long-poll window (mirrors /v1/risk/hitl/:id/wait 30s cap). */
+exports.MAX_OUTCOME_WAIT_MS = 30_000;
+/** Tick interval for the long-poll internal poller. */
+const OUTCOME_POLL_TICK_MS = 250;
+/**
+ * Concurrency cap for the long-poll path only (wait_ms > 0).
+ * Short-poll (wait_ms=0 or absent) is never subject to this cap.
+ * Mirrors the MAX_PENDING_ACTIONS pattern: prevents unbounded open handles.
+ */
+exports.MAX_CONCURRENT_OUTCOME_WAITS = 20;
+let _activeLongPolls = 0;
+/** TEST ONLY: reset the active long-poll counter to 0 (or to a given value). */
+function _resetActiveLongPolls(to = 0) {
+    _activeLongPolls = to;
+}
+/**
+ * Look up a decision receipt whose body.subject_oid === pending_oid from the
+ * _localReceiptOids registry. Returns null if none found.
+ */
+function _findDecisionReceiptForPendingOid(pending_oid) {
+    for (const oid of _localReceiptOids) {
+        const r = (0, store_1.getReceipt)(oid);
+        if (r === null)
+            continue;
+        // The requested receipt has status='pending' (both shapes); skip it.
+        // Decision receipts (allowed/denied) resolve to a verdict on EITHER shape
+        // this router emits -- see _decisionVerdict for why body.decision may be
+        // absent on the lite self-sign tier.
+        if (r.body.subject_oid === pending_oid && _decisionVerdict(r) !== null) {
+            return r;
+        }
+    }
+    return null;
+}
+router.get('/gate/:pending_oid', (req, res) => {
+    const pending_oid = typeof req.params['pending_oid'] === 'string'
+        ? req.params['pending_oid']
+        : '';
+    if (!pending_oid) {
+        res.status(400).json({ error: 'pending_oid required', type: 'invalid_request' });
+        return;
+    }
+    const rawWaitMs = req.query['wait_ms'];
+    const requestedWaitMs = typeof rawWaitMs === 'string' && /^\d+$/.test(rawWaitMs)
+        ? Math.min(parseInt(rawWaitMs, 10), exports.MAX_OUTCOME_WAIT_MS)
+        : 0;
+    function resolveNow() {
+        // Phase 1: still pending.
+        if (exports._pendingStore.has(pending_oid)) {
+            res.status(200).json({ pending_oid, status: 'pending' });
+            return;
+        }
+        // Phase 2: look up decision receipt.
+        const receipt = _findDecisionReceiptForPendingOid(pending_oid);
+        if (receipt !== null) {
+            const isSentinel = receipt.body.initiator.actor_oid === TIMEOUT_SENTINEL_OID;
+            if (isSentinel) {
+                res.status(200).json({
+                    pending_oid,
+                    status: 'timeout',
+                    receipt_oid: receipt.oid,
+                    verify_url: `/local/receipts/${receipt.oid}`,
+                });
+            }
+            else if (_decisionVerdict(receipt) === 'allow') {
+                res.status(200).json({
+                    pending_oid,
+                    status: 'allowed',
+                    decision: 'allow',
+                    receipt_oid: receipt.oid,
+                    verify_url: `/local/receipts/${receipt.oid}`,
+                });
+            }
+            else {
+                // deny (operator-decided, non-sentinel)
+                res.status(200).json({
+                    pending_oid,
+                    status: 'denied',
+                    decision: 'deny',
+                    receipt_oid: receipt.oid,
+                    verify_url: `/local/receipts/${receipt.oid}`,
+                });
+            }
+            return;
+        }
+        // Phase 3: unknown pending_oid (never existed, no pending, no receipt).
+        res.status(404).json({ error: 'not_found', type: 'not_found' });
+    }
+    // No wait_ms: short-poll, return immediately.
+    if (requestedWaitMs <= 0) {
+        resolveNow();
+        return;
+    }
+    // Long-poll: action is currently pending; park up to requestedWaitMs.
+    // If the action is already decided (or unknown) return immediately.
+    if (!exports._pendingStore.has(pending_oid)) {
+        resolveNow();
+        return;
+    }
+    // Concurrency cap: only long-poll paths (wait_ms > 0) count toward the cap.
+    // Short-poll (requestedWaitMs <= 0) already returned above.
+    if (_activeLongPolls >= exports.MAX_CONCURRENT_OUTCOME_WAITS) {
+        res.status(429).json({
+            error: `Too many concurrent long-polls (cap: ${exports.MAX_CONCURRENT_OUTCOME_WAITS}); use wait_ms=0 for immediate status`,
+            type: 'too_many_long_polls',
+        });
+        return;
+    }
+    // Increment before entering the wait loop; decrement on ALL exit paths.
+    _activeLongPolls++;
+    // Park: poll _pendingStore every OUTCOME_POLL_TICK_MS until the action
+    // leaves (decided/swept) or the window elapses.
+    const deadline = Date.now() + requestedWaitMs;
+    let timer = null;
+    let settled = false;
+    function cleanup() {
+        if (settled)
+            return;
+        settled = true;
+        _activeLongPolls--;
+        if (timer !== null) {
+            clearTimeout(timer);
+            timer = null;
+        }
+    }
+    // Handle early client disconnect (avoid writing to a closed socket).
+    req.on('close', cleanup);
+    function tick() {
+        if (settled)
+            return;
+        if (!exports._pendingStore.has(pending_oid)) {
+            // Action left the store (decided or swept); resolve now.
+            cleanup();
+            resolveNow();
+            return;
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            // Window elapsed; action still pending.
+            cleanup();
+            res.status(200).json({ pending_oid, status: 'pending' });
+            return;
+        }
+        timer = setTimeout(tick, Math.min(OUTCOME_POLL_TICK_MS, remaining));
+    }
+    timer = setTimeout(tick, Math.min(OUTCOME_POLL_TICK_MS, requestedWaitMs));
+});
+// ── GET /local/receipts ───────────────────────────────────────────────────────
+//
+// Returns receipts from the store for this session. For v1 (single tenant),
+// we query the receipts store for receipts whose detail contains
+// "governed-action." subjects. In a future slice this uses receipt.query
+// over the bundle's three own subjects.
+router.get('/receipts', (_req, res) => {
+    // Use the _listLocalReceipts helper (exported for tests).
+    const receipts = _listLocalReceipts();
+    res.json({ receipts, count: receipts.length });
+});
+// ── GET /local/receipts/:oid ──────────────────────────────────────────────────
+router.get('/receipts/:oid', (req, res) => {
+    const oid = typeof req.params['oid'] === 'string' ? req.params['oid'] : '';
+    if (!oid) {
+        res.status(400).json({ error: 'oid required', type: 'invalid_request' });
+        return;
+    }
+    const r = (0, store_1.getReceipt)(oid);
+    if (r === null) {
+        res.status(404).json({ error: 'receipt not found', type: 'not_found' });
+        return;
+    }
+    res.json(r);
+});
+exports.default = router;