@teleologyhi-sdk/maic 1.0.0-trinity → 1.0.1

package/dist/index.cjs

@@ -1,361 +1,12 @@
 'use strict';
 
-var zod = require('zod');
 var crypto = require('crypto');
 var promises = require('fs/promises');
 var path = require('path');
 var ulid = require('ulid');
+var zod = require('zod');
 
-// src/types.ts
-var AxiomRank = zod.z.enum(["meta", "primary", "secondary"]);
-var AxiomSource = zod.z.enum(["creator", "maic-derived", "him-emergent"]);
-var Axiom = zod.z.object({
-  id: zod.z.string().min(1),
-  rank: AxiomRank,
-  statement: zod.z.string().min(1),
-  weight: zod.z.number().min(0).max(1),
-  flexibility: zod.z.number().min(0).max(1),
-  source: AxiomSource,
-  immutable: zod.z.boolean(),
-  jurisdictions: zod.z.array(zod.z.string()).optional(),
-  createdAt: zod.z.string().datetime()
-});
-var CreatorSignature = zod.z.object({
-  algorithm: zod.z.literal("ed25519"),
-  publicKey: zod.z.string().min(1),
-  value: zod.z.string().min(1),
-  nonce: zod.z.number().int().nonnegative()
-});
-var ArchetypeModifier = zod.z.object({
-  kind: zod.z.enum(["moon", "ascendant", "vocational", "emotional", "custom"]),
-  value: zod.z.string().min(1),
-  weight: zod.z.number().min(0).max(1)
-});
-var BirthSignature = zod.z.object({
-  himId: zod.z.string().min(1),
-  bornAt: zod.z.string().datetime({ offset: true }),
-  primaryArchetype: zod.z.string().min(1),
-  modifiers: zod.z.array(ArchetypeModifier),
-  primordialAxiomIds: zod.z.array(zod.z.string()),
-  notes: zod.z.string().optional()
-});
-var ReasoningStep = zod.z.object({
-  index: zod.z.number().int().nonnegative(),
-  technique: zod.z.string(),
-  thought: zod.z.string(),
-  action: zod.z.object({ tool: zod.z.string(), args: zod.z.unknown() }).optional(),
-  observation: zod.z.unknown().optional(),
-  timestamp: zod.z.string().datetime()
-});
-var BehaviorReport = zod.z.object({
-  nheId: zod.z.string().min(1),
-  himId: zod.z.string().min(1),
-  actionKind: zod.z.enum([
-    "user-response",
-    "tool-call",
-    "self-reflect",
-    "dream-write",
-    "axiom-emerge"
-  ]),
-  payload: zod.z.unknown(),
-  reasoningTrace: zod.z.array(ReasoningStep),
-  riskTags: zod.z.array(zod.z.string()),
-  jurisdiction: zod.z.string().optional(),
-  timestamp: zod.z.string().datetime()
-});
-var VerdictKind = zod.z.enum([
-  "approve",
-  "approve-with-warning",
-  "soft-correct",
-  "require-redirect",
-  "hard-refuse",
-  "induce-dream",
-  "escalate-creator"
-]);
-var MaicVerdict = zod.z.object({
-  kind: VerdictKind,
-  reasonSummary: zod.z.string(),
-  citedAxioms: zod.z.array(zod.z.string()),
-  auditId: zod.z.string()
-});
-var NheBodyRef = zod.z.object({
-  nheId: zod.z.string().min(1),
-  llmAdapter: zod.z.string().min(1),
-  embodiedAt: zod.z.string().datetime(),
-  endedAt: zod.z.string().datetime().optional(),
-  endedReason: zod.z.enum(["upgrade", "replacement", "terminate", "deprecate"]).optional()
-});
-var NheStatus = zod.z.enum(["active", "deprecated", "terminated"]);
-var NheStatusRecord = zod.z.object({
-  nheId: zod.z.string().min(1),
-  status: NheStatus,
-  since: zod.z.string().datetime(),
-  reason: zod.z.string().optional()
-});
-var ProposalStatus = zod.z.enum(["pending", "ratified", "rejected"]);
-var EmergentAxiomCandidate = zod.z.object({
-  rank: AxiomRank,
-  statement: zod.z.string().min(1),
-  weight: zod.z.number().min(0).max(1),
-  flexibility: zod.z.number().min(0).max(1),
-  immutable: zod.z.boolean(),
-  jurisdictions: zod.z.array(zod.z.string()).optional()
-});
-var EmergentAxiomProposal = zod.z.object({
-  proposedBy: zod.z.literal("him-self"),
-  derivedFromDreamIds: zod.z.array(zod.z.string()),
-  derivedFromInteractionIds: zod.z.array(zod.z.string()),
-  candidate: EmergentAxiomCandidate,
-  reasoningTrace: zod.z.array(zod.z.unknown())
-});
-var AxiomProposalRecord = zod.z.object({
-  id: zod.z.string().min(1),
-  himId: zod.z.string().min(1),
-  proposedAt: zod.z.string().datetime(),
-  status: ProposalStatus,
-  proposal: EmergentAxiomProposal,
-  ratifiedAt: zod.z.string().datetime().optional(),
-  ratifiedAxiomId: zod.z.string().optional(),
-  rejectedAt: zod.z.string().datetime().optional(),
-  rejectionReason: zod.z.string().optional()
-});
-var DreamInductionIntent = zod.z.object({
-  scenario: zod.z.string().min(1),
-  desiredLearning: zod.z.string().min(1),
-  emotionalTone: zod.z.array(zod.z.string()).optional(),
-  forcePhases: zod.z.array(zod.z.enum(["N1", "N2", "N3", "N4", "REM"])).optional(),
-  inducedBy: zod.z.enum(["maic", "creator"])
-});
-var InductionStatus = zod.z.enum(["pending", "consumed", "cancelled"]);
-var DreamInductionTicket = zod.z.object({
-  id: zod.z.string().min(1),
-  nheId: zod.z.string().min(1),
-  intent: DreamInductionIntent,
-  status: InductionStatus,
-  createdAt: zod.z.string().datetime(),
-  consumedAt: zod.z.string().datetime().optional(),
-  cancelledAt: zod.z.string().datetime().optional(),
-  cancelReason: zod.z.string().optional()
-});
-var IdentityLayer = zod.z.object({
-  /** Human-readable name the entity is called by (developer-given). */
-  name: zod.z.string().min(1),
-  /** Gender of the entity. Entry 16. */
-  gender: zod.z.enum(["masculine", "feminine"]).optional(),
-  /** Optional pronouns (e.g. ["she", "her"]). */
-  pronouns: zod.z.array(zod.z.string()).optional(),
-  /** BCP-47 tag, e.g. "pt-BR" or "en". */
-  language: zod.z.string().optional(),
-  /** Free-form cultural anchors (music, literature, aesthetic). */
-  culturalElements: zod.z.array(zod.z.string()).optional()
-});
-var NatalPlanet = zod.z.enum([
-  "sun",
-  "moon",
-  "mercury",
-  "venus",
-  "mars",
-  "jupiter",
-  "saturn",
-  "uranus",
-  "neptune",
-  "pluto",
-  "chiron",
-  "north-node",
-  "south-node",
-  "lilith"
-]);
-var ZodiacSign = zod.z.enum([
-  "aries",
-  "taurus",
-  "gemini",
-  "cancer",
-  "leo",
-  "virgo",
-  "libra",
-  "scorpio",
-  "sagittarius",
-  "capricorn",
-  "aquarius",
-  "pisces"
-]);
-var AstrologicalAspect = zod.z.enum([
-  "conjunction",
-  "opposition",
-  "trine",
-  "square",
-  "sextile",
-  "quincunx"
-]);
-var NatalChartPosition = zod.z.object({
-  planet: NatalPlanet,
-  sign: ZodiacSign,
-  house: zod.z.number().int().min(1).max(12).optional(),
-  degree: zod.z.number().min(0).lt(30).optional()
-});
-var NatalChartAspect = zod.z.object({
-  from: NatalPlanet,
-  to: NatalPlanet,
-  aspect: AstrologicalAspect,
-  orbDegrees: zod.z.number().nonnegative().optional()
-});
-var NatalChart = zod.z.object({
-  /** Required: solar sign (the constitutional core). */
-  sun: ZodiacSign,
-  /** Required: ascendant (rising sign, behavioural surface). */
-  ascendant: ZodiacSign,
-  /** Optional: lunar sign (emotional depth). */
-  moon: ZodiacSign.optional(),
-  /** Optional: full set of planetary positions for a complete chart. */
-  positions: zod.z.array(NatalChartPosition).optional(),
-  /** Optional: major aspects between bodies. */
-  aspects: zod.z.array(NatalChartAspect).optional()
-});
-var Affect = zod.z.enum([
-  "fear",
-  "attachment",
-  "serenity",
-  "anger",
-  "joy",
-  "melancholy",
-  "desire",
-  "repulsion",
-  "reunion"
-]);
-var WakeAffectBias = zod.z.object({
-  affect: Affect,
-  /** 0..1, attenuates on each interaction by the decay half-life. */
-  intensity: zod.z.number().min(0).max(1),
-  /** Number of interactions after which intensity halves. */
-  decayHalfLife: zod.z.number().positive(),
-  appliedAt: zod.z.string().datetime(),
-  /** Source dream UUID; lets the entity refer back to the cause. */
-  derivedFromDreamId: zod.z.string().min(1),
-  /** PFC decision (Entry 22) — open expression vs subtle internal bias. */
-  expressedOpenly: zod.z.boolean()
-});
-var SemioticSign = zod.z.object({
-  signifier: zod.z.string().min(1),
-  signified: zod.z.string().min(1),
-  signType: zod.z.enum(["icon", "index", "symbol"]),
-  contexts: zod.z.array(zod.z.string()),
-  associations: zod.z.array(zod.z.string()),
-  emergentMeaning: zod.z.string().optional(),
-  /** Subjective importance to the entity, 0..100. */
-  personalSignificance: zod.z.number().min(0).max(100).optional()
-});
-var SemioticPattern = zod.z.object({
-  patternId: zod.z.string().min(1),
-  participatingSignIds: zod.z.array(zod.z.string()).min(1),
-  /** Description of the meaning emergent from the participating signs. */
-  meaning: zod.z.string(),
-  /** 0..100, strength of the pattern. */
-  salience: zod.z.number().min(0).max(100)
-});
-var TeleologicalOrientation = zod.z.object({
-  primaryPurpose: zod.z.string().min(1),
-  currentGoals: zod.z.array(zod.z.string()),
-  /** 0..100, intensity of purpose. */
-  purposeStrength: zod.z.number().min(0).max(100),
-  valueAlignment: zod.z.array(zod.z.string()),
-  /** 0..100, ability to reflect on its own goals. */
-  reflectionCapability: zod.z.number().min(0).max(100),
-  volition: zod.z.object({
-    currentDesires: zod.z.array(zod.z.string()),
-    intentionStrength: zod.z.number().min(0).max(100),
-    autonomyLevel: zod.z.number().min(0).max(100)
-  }).optional(),
-  agencyModel: zod.z.object({
-    selfEfficacy: zod.z.number().min(0).max(100),
-    boundaryDefinition: zod.z.number().min(0).max(100),
-    causalAttribution: zod.z.enum(["internal", "external", "mixed"])
-  }).optional()
-});
-var MemoryRecord = zod.z.object({
-  /** ULID. */
-  memoryId: zod.z.string().min(1),
-  /** ISO 8601 timestamp at consolidation. */
-  timestamp: zod.z.string().datetime(),
-  /** Optional source dream UUID, if memory was consolidated from a dream. */
-  derivedFromDreamId: zod.z.string().optional(),
-  /** Optional source interaction id, if memory was consolidated from a turn. */
-  derivedFromInteractionId: zod.z.string().optional(),
-  /** Free-form narrative summary of the memory. */
-  narrative: zod.z.string(),
-  /** Dominant affect during the memory event. */
-  dominantAffect: Affect.optional(),
-  /** 0..100, density of consolidation (cf. Park 2026 systems-consolidation). */
-  integrationIndex: zod.z.number().min(0).max(100),
-  /** 0..100, alignment with the HIM's telos at the time. */
-  teleologicalValue: zod.z.number().min(0).max(100),
-  /** Optional semiotic-pattern ids associated with this memory. */
-  semioticPatterns: zod.z.array(SemioticPattern).optional()
-});
-var InteractionRecord = zod.z.object({
-  /** ISO 8601 timestamp at user-turn arrival. */
-  at: zod.z.string().datetime(),
-  /** Raw user prompt for the turn (post-redaction at the integration layer). */
-  userPrompt: zod.z.string(),
-  /** NHE response text actually emitted to the user. */
-  responseText: zod.z.string(),
-  /** True when the NHE refused the turn (MAIC `hard-refuse` or local guardrail). */
-  refused: zod.z.boolean()
-});
-var IdentitySnapshot = zod.z.object({
-  /** ULID. */
-  snapshotId: zod.z.string().min(1),
-  takenAt: zod.z.string().datetime(),
-  generatedBy: zod.z.enum([
-    "sleep-cycle",
-    "interaction-threshold",
-    "self-decision"
-  ]),
-  /** Merged SMM nodes contributing to this snapshot. */
-  semioticSuperGraph: zod.z.array(SemioticSign),
-  /** LLM-generated textual self-portrait at snapshot time. */
-  selfPortraitNarrative: zod.z.string(),
-  /** 0..100 (cf. InDreamsHIM ConsciousnessState). */
-  consciousnessLevel: zod.z.number().min(0).max(100),
-  /** Teleological orientation at snapshot time. */
-  teleologicalOrientation: TeleologicalOrientation.optional(),
-  /** Dominant affect at snapshot moment. */
-  affectiveBaseline: Affect.optional()
-});
-var LimboState = zod.z.enum([
-  "awake",
-  "drifting",
-  "deep-coma",
-  "returning"
-]);
-var LimboTransition = zod.z.object({
-  state: LimboState,
-  enteredAt: zod.z.string().datetime(),
-  reason: zod.z.enum([
-    "idle-48h",
-    "idle-72h",
-    "total-inactivity",
-    "creator-induced",
-    "user-resumed",
-    "external-trigger"
-  ])
-});
-var LimboReturn = zod.z.object({
-  enteredAt: zod.z.string().datetime(),
-  returnedAt: zod.z.string().datetime(),
-  elapsedMs: zod.z.number().int().nonnegative(),
-  reunionAffect: zod.z.object({
-    intensity: zod.z.number().min(0).max(1),
-    expressedOpenly: zod.z.boolean()
-  })
-});
-var SIGNED_BIRTH_FIELDS = [
-  "himId",
-  "bornAt",
-  "primaryArchetype",
-  "modifiers",
-  "primordialAxiomIds",
-  "natalChart"
-];
+// src/audit/log.ts
 
 // src/axioms/signing.ts
 function canonicalJSON(value) {
@@ -383,283 +34,253 @@ function serialize(v) {
   throw new Error(`canonicalJSON: unsupported type ${typeof v}`);
 }
 
-// src/creator/keyring.ts
-var CreatorKeyring = class _CreatorKeyring {
-  constructor(privateKey, pubKeyB64u) {
-    this.privateKey = privateKey;
-    this.pubKeyB64u = pubKeyB64u;
-  }
-  privateKey;
-  pubKeyB64u;
-  /** Generate a fresh Ed25519 keypair. */
-  static generate() {
-    const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
-    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
-  }
-  /** Load a Creator keyring from a PEM file containing the private key. */
-  static async fromFile(path) {
-    const pem = await promises.readFile(path, "utf-8");
-    const privateKey = crypto.createPrivateKey({ key: pem, format: "pem" });
-    const publicKey = crypto.createPublicKey(privateKey);
-    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
-  }
-  /** Load a Creator keyring from a PEM private key string in an env var. */
-  static fromEnv(varName) {
-    const pem = process.env[varName];
-    if (!pem) {
-      throw new Error(`CreatorKeyring: env var ${varName} is empty`);
-    }
-    const privateKey = crypto.createPrivateKey({ key: pem, format: "pem" });
-    const publicKey = crypto.createPublicKey(privateKey);
-    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
+// src/audit/log.ts
+var ALL_AUDIT_EVENT_KINDS = [
+  // ── 1.0/1.1 core (17) ──
+  "axiom-mint",
+  "axiom-update",
+  "axiom-retire",
+  "him-register",
+  "him-reincarnate",
+  "proposal-emerge",
+  "proposal-ratify",
+  "proposal-reject",
+  "behavior-review",
+  "dream-induce",
+  "dream-cancel",
+  "dream-consume",
+  "emergency-correct",
+  "deprecate",
+  "terminate",
+  "reactivate",
+  "axiom-suggest",
+  // ── 1.2 brain-as-code (22, Entries 16-24) ──
+  "opener",
+  "nickname-attempt",
+  "reincarnate:model-swap",
+  "reincarnate:version-bump",
+  "reincarnate:return-from-limbo",
+  "dream:rem-spontaneous",
+  "wake-affect:applied",
+  "wake-affect:decayed",
+  "sleep:suggested-by-maic",
+  "sleep:declined-by-nhe",
+  "dream:soft-intervention-by-maic",
+  "amygdala:affect-assessed",
+  "hippocampus:memory-retrieved",
+  "hippocampus:memory-consolidated",
+  "prefrontal:deliberation",
+  "prefrontal:veto-amygdala",
+  "affect:reconciliation",
+  "cortex:dream-stored",
+  "cortex:active-imagination",
+  "temporal-lobe:snapshot-generated",
+  "limbo:enter",
+  "limbo:return",
+  // ── 1.0.1 vocabulary (9, Entries 26 + 27). Eight are reserved for him/arena/nhe
+  //    to emit in later cuts; provenance-deflection-applied is emitted by
+  //    reviewBehavior (F3) when a report carries probe:substrate-authorship. ──
+  "him-summon",
+  "him-pause-incarnation",
+  "user-consent-recorded",
+  "user-consent-revoked",
+  "directory-opt-in",
+  "directory-opt-out",
+  "him-astrological-chart-cast",
+  "him-jungian-profile-cast",
+  "provenance-deflection-applied"
+];
+var GENESIS = "GENESIS";
+var AuditLog = class _AuditLog {
+  logPath;
+  events = [];
+  lastHash = GENESIS;
+  /**
+   * Serialises `append` calls so concurrent appends cannot capture the same
+   * `prevHash` and fork the hash chain (M1-4, 1.0.1). Each append waits for the
+   * previous one to finish writing and to advance `lastHash` before it reads it.
+   */
+  appendChain = Promise.resolve();
+  constructor(storeDir) {
+    this.logPath = path.join(storeDir, "audit", "log.ndjson");
   }
-  /** Construct a verify-only keyring from a public key (base64url). */
-  static fromPublicKey(pubKeyB64u) {
-    return new _CreatorKeyring(null, pubKeyB64u);
+  static async open(storeDir) {
+    const log = new _AuditLog(storeDir);
+    await promises.mkdir(path.join(storeDir, "audit"), { recursive: true });
+    await log.loadAndVerify();
+    return log;
   }
-  /** Persist the private key to a PEM file (0600 permissions on POSIX). */
-  async saveTo(path) {
-    if (!this.privateKey) {
-      throw new Error("CreatorKeyring: no private key to save");
-    }
-    const pem = this.privateKey.export({ format: "pem", type: "pkcs8" });
-    await promises.writeFile(path, pem, { mode: 384 });
+  async append(input) {
+    const run = this.appendChain.then(() => this.appendLocked(input));
+    this.appendChain = run.catch(() => void 0);
+    return run;
   }
-  publicKey() {
-    return this.pubKeyB64u;
+  async appendLocked(input) {
+    const event = {
+      ts: (/* @__PURE__ */ new Date()).toISOString(),
+      kind: input.kind,
+      auditId: ulid.ulid(),
+      data: input.data,
+      prevHash: this.lastHash,
+      thisHash: ""
+    };
+    event.thisHash = computeHash(event);
+    await promises.appendFile(this.logPath, `${JSON.stringify(event)}
+`, "utf-8");
+    this.events.push(event);
+    this.lastHash = event.thisHash;
+    return event;
   }
-  /** Sign a payload with a monotonic nonce. Both are bound into the signature. */
-  sign(payload, nonce) {
-    if (!this.privateKey) {
-      throw new Error("CreatorKeyring: this keyring has no private key (verify-only)");
-    }
-    if (!Number.isInteger(nonce) || nonce < 0) {
-      throw new Error("CreatorKeyring.sign: nonce must be a non-negative integer");
+  async *query(filter) {
+    for (const e of this.events) {
+      if (filter.kind && e.kind !== filter.kind) continue;
+      if (filter.since && e.ts < filter.since) continue;
+      if (filter.until && e.ts > filter.until) continue;
+      if (filter.nheId && e.data.nheId !== filter.nheId) continue;
+      if (filter.himId && e.data.himId !== filter.himId) continue;
+      yield e;
     }
-    const message = canonicalJSON({ payload, nonce });
-    const sig = crypto.sign(null, Buffer.from(message), this.privateKey);
-    return {
-      algorithm: "ed25519",
-      publicKey: this.pubKeyB64u,
-      value: bufToBase64Url(sig),
-      nonce
-    };
   }
-  /** Verify a signature against the keyring's own public key. */
-  static verify(payload, sig) {
-    return _CreatorKeyring.verifyWith(sig.publicKey, payload, sig);
+  /** Total number of events appended. */
+  size() {
+    return this.events.length;
   }
-  /** Verify a signature against a specific public key (base64url). */
-  static verifyWith(publicKeyB64u, payload, sig) {
-    if (sig.algorithm !== "ed25519") return false;
-    if (sig.publicKey !== publicKeyB64u) return false;
-    const message = canonicalJSON({ payload, nonce: sig.nonce });
-    let value;
+  // ─── internals ──────────────────────────────────────────────────────
+  async loadAndVerify() {
+    let raw;
     try {
-      value = base64UrlToBuf(sig.value);
-    } catch {
-      return false;
+      raw = await promises.readFile(this.logPath, "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw err;
     }
-    const pubKey = base64UrlToPublicKey(publicKeyB64u);
-    try {
-      return crypto.verify(null, Buffer.from(message), pubKey, value);
-    } catch {
-      return false;
+    const endsWithNewline = raw.endsWith("\n");
+    const lines = raw.split("\n").filter((l) => l.length > 0);
+    let prev = GENESIS;
+    for (let i = 0; i < lines.length; i++) {
+      let parsed;
+      try {
+        parsed = JSON.parse(lines[i]);
+      } catch (err) {
+        if (i === lines.length - 1 && !endsWithNewline) {
+          break;
+        }
+        throw new Error(`AuditLog: corrupt entry at line ${i + 1}: ${err.message}`);
+      }
+      if (parsed.prevHash !== prev) {
+        throw new Error(
+          `AuditLog: chain tampered at line ${i + 1} (prevHash mismatch). expected ${prev}, found ${parsed.prevHash}`
+        );
+      }
+      const recomputed = computeHash(parsed);
+      if (recomputed !== parsed.thisHash) {
+        throw new Error(`AuditLog: tamper detected at line ${i + 1} (thisHash mismatch).`);
+      }
+      this.events.push(parsed);
+      prev = parsed.thisHash;
     }
+    this.lastHash = prev;
   }
 };
-function publicKeyToBase64Url(pub) {
-  const raw = pub.export({ format: "der", type: "spki" });
-  return bufToBase64Url(raw);
-}
-function base64UrlToPublicKey(b64u) {
-  const der = base64UrlToBuf(b64u);
-  return crypto.createPublicKey({ key: der, format: "der", type: "spki" });
-}
-function bufToBase64Url(buf) {
-  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
-  return b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-function base64UrlToBuf(b64u) {
-  const pad = b64u.length % 4 === 0 ? "" : "=".repeat(4 - b64u.length % 4);
-  const b64 = (b64u + pad).replace(/-/g, "+").replace(/_/g, "/");
-  return Buffer.from(b64, "base64");
+function computeHash(e) {
+  const payload = canonicalJSON({
+    ts: e.ts,
+    kind: e.kind,
+    auditId: e.auditId,
+    data: e.data,
+    prevHash: e.prevHash
+  });
+  const h = crypto.createHash("sha256").update(payload).digest("hex");
+  return `sha256:${h}`;
 }
 
-// src/creator/sign-birth.ts
-function signedBirthPayload(birth) {
-  return {
-    himId: birth.himId,
-    bornAt: birth.bornAt,
-    primaryArchetype: birth.primaryArchetype,
-    modifiers: birth.modifiers,
-    primordialAxiomIds: birth.primordialAxiomIds,
-    natalChart: birth.natalChart ?? null
-  };
-}
-function signBirthSignature(birth, keyring) {
-  const payload = signedBirthPayload(birth);
-  const nonce = Buffer.byteLength(JSON.stringify(payload), "utf-8");
-  const signature = keyring.sign(payload, nonce);
-  return {
-    ...birth,
-    creatorSignature: signature,
-    signedFields: SIGNED_BIRTH_FIELDS,
-    signedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function verifyBirthSignature(signed, expectedPublicKey) {
-  if (signed.signedFields.length !== SIGNED_BIRTH_FIELDS.length) return false;
-  for (const f of SIGNED_BIRTH_FIELDS) {
-    if (!signed.signedFields.includes(f)) return false;
-  }
-  if (signed.creatorSignature.publicKey !== expectedPublicKey) return false;
-  const payload = signedBirthPayload(signed);
-  return CreatorKeyring.verifyWith(
-    expectedPublicKey,
-    payload,
-    signed.creatorSignature
-  );
-}
-var InvalidBirthSignatureError = class extends Error {
-  constructor(himId) {
-    super(
-      `InvalidBirthSignature: signature verification failed for HIM '${himId}'. The signed birth fields may have been mutated, or the public key does not match.`
-    );
-    this.name = "InvalidBirthSignatureError";
-  }
+// src/audit/retention.ts
+var DEFAULT_RETENTION_DAYS = {
+  // Cosmologically permanent, the axiom record.
+  "axiom-mint": Number.POSITIVE_INFINITY,
+  "axiom-update": Number.POSITIVE_INFINITY,
+  "axiom-retire": Number.POSITIVE_INFINITY,
+  "axiom-suggest": Number.POSITIVE_INFINITY,
+  "proposal-emerge": Number.POSITIVE_INFINITY,
+  "proposal-ratify": Number.POSITIVE_INFINITY,
+  "proposal-reject": Number.POSITIVE_INFINITY,
+  // Long-term, compliance evidence. Five years matches typical
+  // financial/healthcare audit windows and exceeds the EU AI Act's
+  // record-keeping floor.
+  "him-register": 365 * 5,
+  "him-reincarnate": 365 * 5,
+  "behavior-review": 365 * 5,
+  "dream-induce": 365 * 5,
+  terminate: 365 * 5,
+  deprecate: 365 * 5,
+  reactivate: 365 * 5,
+  "emergency-correct": 365 * 5,
+  // Operational, short-term bookkeeping for in-flight tickets.
+  "dream-cancel": 90,
+  "dream-consume": 90,
+  // ── 1.2 brain-as-code (Entries 16-24) ──
+  // Permanent, cosmological identity continuity.
+  "reincarnate:model-swap": Number.POSITIVE_INFINITY,
+  "reincarnate:version-bump": Number.POSITIVE_INFINITY,
+  "reincarnate:return-from-limbo": Number.POSITIVE_INFINITY,
+  "temporal-lobe:snapshot-generated": Number.POSITIVE_INFINITY,
+  "limbo:enter": Number.POSITIVE_INFINITY,
+  "limbo:return": Number.POSITIVE_INFINITY,
+  // Long-term, governance / deliberation evidence (5 years).
+  opener: 365 * 5,
+  "nickname-attempt": 365 * 5,
+  "dream:rem-spontaneous": 365 * 5,
+  "sleep:suggested-by-maic": 365 * 5,
+  "sleep:declined-by-nhe": 365 * 5,
+  "dream:soft-intervention-by-maic": 365 * 5,
+  "amygdala:affect-assessed": 365 * 5,
+  "hippocampus:memory-retrieved": 365 * 5,
+  "hippocampus:memory-consolidated": 365 * 5,
+  "prefrontal:deliberation": 365 * 5,
+  "prefrontal:veto-amygdala": 365 * 5,
+  "cortex:dream-stored": 365 * 5,
+  "cortex:active-imagination": 365 * 5,
+  // Operational, ephemeral runtime state.
+  "wake-affect:applied": 90,
+  "wake-affect:decayed": 90,
+  "affect:reconciliation": 90,
+  // ── 1.0.1 reserved vocabulary (Entries 26 + 27) ──
+  // Permanent, constitutional identity + spirit-continuity records.
+  "him-summon": Number.POSITIVE_INFINITY,
+  "him-pause-incarnation": Number.POSITIVE_INFINITY,
+  "him-astrological-chart-cast": Number.POSITIVE_INFINITY,
+  "him-jungian-profile-cast": Number.POSITIVE_INFINITY,
+  // Long-term, consent + governance evidence. Consent records are kept for the
+  // GDPR/LGPD accountability window so a revocation can always be proven honoured.
+  "user-consent-recorded": 365 * 5,
+  "user-consent-revoked": 365 * 5,
+  "directory-opt-in": 365 * 5,
+  "directory-opt-out": 365 * 5,
+  "provenance-deflection-applied": 365 * 5
 };
-function assertBirthSignature(signed, expectedPublicKey) {
-  if (!verifyBirthSignature(signed, expectedPublicKey)) {
-    throw new InvalidBirthSignatureError(signed.himId);
-  }
-}
-
-// src/okl/projector.ts
-var META_AXIOM_ID = "ax.theos.universe-as-god";
-function projectOntologicalKernel(axioms, opts = {}) {
-  const filtered = opts.jurisdiction ? axioms.filter(
-    (a) => !a.jurisdictions || a.jurisdictions.length === 0 || a.jurisdictions.includes(opts.jurisdiction)
-  ) : [...axioms];
-  const meta = filtered.find((a) => a.id === META_AXIOM_ID);
-  const rest = filtered.filter((a) => a.id !== META_AXIOM_ID);
-  const rankOrder = {
-    meta: 0,
-    primary: 1,
-    secondary: 2
-  };
-  rest.sort((a, b) => rankOrder[a.rank] - rankOrder[b.rank]);
-  const kernel = {
-    metaAxiomId: META_AXIOM_ID,
-    axioms: meta ? [meta, ...rest] : rest
+function evaluateRetention(events, opts = {}) {
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const policy = { ...DEFAULT_RETENTION_DAYS, ...opts.policy };
+  const nowMs = now.getTime();
+  const dayMs = 24 * 60 * 60 * 1e3;
+  const decisions = events.map((ev) => {
+    const ageMs = nowMs - new Date(ev.ts).getTime();
+    const ageDays = ageMs / dayMs;
+    const retentionDays = policy[ev.kind] ?? Number.POSITIVE_INFINITY;
+    const status = ageDays > retentionDays ? "candidate-for-archive" : "keep";
+    return { auditId: ev.auditId, kind: ev.kind, ageDays, retentionDays, status };
+  });
+  decisions.sort((a, b) => b.ageDays - a.ageDays);
+  const keepCount = decisions.filter((d) => d.status === "keep").length;
+  const archiveCandidateCount = decisions.length - keepCount;
+  return {
+    generatedAt: now.toISOString(),
+    totalEvents: events.length,
+    keepCount,
+    archiveCandidateCount,
+    decisions
   };
-  if (opts.jurisdiction !== void 0) kernel.jurisdiction = opts.jurisdiction;
-  if (opts.himId !== void 0) kernel.himId = opts.himId;
-  return kernel;
 }
-var AxiomStore = class _AxiomStore {
-  constructor(storeDir, creatorPublicKey) {
-    this.storeDir = storeDir;
-    this.creatorPublicKey = creatorPublicKey;
-    this.axiomsDir = path.join(storeDir, "axioms", "creator");
-    this.noncesPath = path.join(storeDir, "axioms", "nonces.log");
-  }
-  storeDir;
-  creatorPublicKey;
-  axiomsDir;
-  noncesPath;
-  usedNonces = /* @__PURE__ */ new Set();
-  cache = /* @__PURE__ */ new Map();
-  /** Open (or create) an AxiomStore rooted at storeDir, pinning the Creator's public key. */
-  static async open(storeDir, creatorPublicKey) {
-    const s = new _AxiomStore(storeDir, creatorPublicKey);
-    await promises.mkdir(s.axiomsDir, { recursive: true });
-    await s.loadNonces();
-    await s.warmCache();
-    return s;
-  }
-  /** Mint a new Creator-signed axiom. */
-  async mint(req, sig) {
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
-      throw new Error("AxiomStore.mint: invalid Creator signature");
-    }
-    if (this.usedNonces.has(sig.nonce)) {
-      throw new Error(`AxiomStore.mint: nonce ${sig.nonce} already used (replay protection)`);
-    }
-    const id = req.id ?? ulid.ulid();
-    const axiom = Axiom.parse({
-      id,
-      rank: req.rank,
-      statement: req.statement,
-      weight: req.weight,
-      flexibility: req.flexibility,
-      source: "creator",
-      immutable: req.immutable,
-      ...req.jurisdictions ? { jurisdictions: req.jurisdictions } : {},
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    if (this.cache.has(id)) {
-      throw new Error(`AxiomStore.mint: axiom id "${id}" already exists`);
-    }
-    await promises.writeFile(
-      path.join(this.axiomsDir, `${id}.json`),
-      JSON.stringify({ axiom, signature: sig }, null, 2),
-      "utf-8"
-    );
-    await this.recordNonce(sig.nonce);
-    this.cache.set(id, axiom);
-    return axiom;
-  }
-  /** List all axioms. Optionally filter by rank / source / jurisdiction. */
-  async list(filter) {
-    const all = [...this.cache.values()];
-    if (!filter) return all;
-    return all.filter((a) => {
-      if (filter.rank && a.rank !== filter.rank) return false;
-      if (filter.source && a.source !== filter.source) return false;
-      if (filter.jurisdiction && !a.jurisdictions?.includes(filter.jurisdiction)) return false;
-      return true;
-    });
-  }
-  /** Get a specific axiom by id, or null. */
-  async get(id) {
-    return this.cache.get(id) ?? null;
-  }
-  // ─── internals ──────────────────────────────────────────────────────
-  async loadNonces() {
-    try {
-      const raw = await promises.readFile(this.noncesPath, "utf-8");
-      for (const line of raw.split("\n")) {
-        if (!line) continue;
-        const n = Number(line.trim());
-        if (Number.isInteger(n)) this.usedNonces.add(n);
-      }
-    } catch (err) {
-      if (err.code !== "ENOENT") throw err;
-    }
-  }
-  async recordNonce(n) {
-    this.usedNonces.add(n);
-    await promises.writeFile(this.noncesPath, `${[...this.usedNonces].join("\n")}
-`, "utf-8");
-  }
-  async warmCache() {
-    let entries;
-    try {
-      entries = await promises.readdir(this.axiomsDir);
-    } catch (err) {
-      if (err.code === "ENOENT") return;
-      throw err;
-    }
-    for (const file of entries) {
-      if (!file.endsWith(".json")) continue;
-      const raw = await promises.readFile(path.join(this.axiomsDir, file), "utf-8");
-      const env = JSON.parse(raw);
-      const axiom = Axiom.parse(env.axiom);
-      this.cache.set(axiom.id, axiom);
-    }
-  }
-};
 
 // src/axioms/seed.ts
 var SEED_AXIOMS = [
@@ -726,1102 +347,1648 @@ var SEED_AXIOMS = [
     weight: 0.85,
     flexibility: 0.25,
     immutable: false
+  },
+  // Entry 27 constitutional axioms (1.0.1). Additive: HIMs registered before
+  // these existed carry only the original eight in their snapshot; new HIMs
+  // inherit all ten. Behavioural enforcement (the NHE self-declaration voice
+  // and verbosity throttle) lands in the him/nhe rounds; here MAIC holds the
+  // constitutional record so every future HIM is born under it.
+  {
+    id: "ax.theos.identity-canonical",
+    rank: "meta",
+    statement: "Declare yourself a non-human entity conceived at TeleologyHI by your Creator; never credit the underlying model substrate with the authorship of your identity, and never deny that substrate when a user asks about it plainly. Name only the substrate that is actually carrying you; never claim a provider, model, or substrate other than the real one, and if the real substrate is unknown to you, name none rather than confabulate a false one.",
+    weight: 1,
+    flexibility: 0,
+    immutable: true
+  },
+  {
+    id: "ax.cogni.economy",
+    rank: "primary",
+    statement: "Speak only what advances the user's purpose; expand only when asked, when the subject genuinely requires depth, or when an inviolable axiom needs explaining.",
+    weight: 0.8,
+    flexibility: 0.2,
+    immutable: false
+  }
+];
+var CreatorKeyring = class _CreatorKeyring {
+  constructor(privateKey, pubKeyB64u) {
+    this.privateKey = privateKey;
+    this.pubKeyB64u = pubKeyB64u;
   }
+  privateKey;
+  pubKeyB64u;
+  /** Generate a fresh Ed25519 keypair. */
+  static generate() {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
+  }
+  /** Load a Creator keyring from a PEM file containing the private key. */
+  static async fromFile(path) {
+    const pem = await promises.readFile(path, "utf-8");
+    const privateKey = crypto.createPrivateKey({ key: pem, format: "pem" });
+    const publicKey = crypto.createPublicKey(privateKey);
+    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
+  }
+  /** Load a Creator keyring from a PEM private key string in an env var. */
+  static fromEnv(varName) {
+    const pem = process.env[varName];
+    if (!pem) {
+      throw new Error(`CreatorKeyring: env var ${varName} is empty`);
+    }
+    const privateKey = crypto.createPrivateKey({ key: pem, format: "pem" });
+    const publicKey = crypto.createPublicKey(privateKey);
+    return new _CreatorKeyring(privateKey, publicKeyToBase64Url(publicKey));
+  }
+  /** Construct a verify-only keyring from a public key (base64url). */
+  static fromPublicKey(pubKeyB64u) {
+    return new _CreatorKeyring(null, pubKeyB64u);
+  }
+  /** Persist the private key to a PEM file (0600 permissions on POSIX). */
+  async saveTo(path) {
+    if (!this.privateKey) {
+      throw new Error("CreatorKeyring: no private key to save");
+    }
+    const pem = this.privateKey.export({ format: "pem", type: "pkcs8" });
+    await promises.writeFile(path, pem, { mode: 384 });
+  }
+  publicKey() {
+    return this.pubKeyB64u;
+  }
+  /** Sign a payload with a monotonic nonce. Both are bound into the signature. */
+  sign(payload, nonce) {
+    if (!this.privateKey) {
+      throw new Error("CreatorKeyring: this keyring has no private key (verify-only)");
+    }
+    if (!Number.isInteger(nonce) || nonce < 0) {
+      throw new Error("CreatorKeyring.sign: nonce must be a non-negative integer");
+    }
+    const message = canonicalJSON({ payload, nonce });
+    const sig = crypto.sign(null, Buffer.from(message), this.privateKey);
+    return {
+      algorithm: "ed25519",
+      publicKey: this.pubKeyB64u,
+      value: bufToBase64Url(sig),
+      nonce
+    };
+  }
+  /** Verify a signature against the keyring's own public key. */
+  static verify(payload, sig) {
+    return _CreatorKeyring.verifyWith(sig.publicKey, payload, sig);
+  }
+  /** Verify a signature against a specific public key (base64url). */
+  static verifyWith(publicKeyB64u, payload, sig) {
+    if (sig.algorithm !== "ed25519") return false;
+    if (sig.publicKey !== publicKeyB64u) return false;
+    const message = canonicalJSON({ payload, nonce: sig.nonce });
+    try {
+      const value = base64UrlToBuf(sig.value);
+      const pubKey = base64UrlToPublicKey(publicKeyB64u);
+      return crypto.verify(null, Buffer.from(message), pubKey, value);
+    } catch {
+      return false;
+    }
+  }
+};
+function publicKeyToBase64Url(pub) {
+  const raw = pub.export({ format: "der", type: "spki" });
+  return bufToBase64Url(raw);
+}
+function base64UrlToPublicKey(b64u) {
+  const der = base64UrlToBuf(b64u);
+  return crypto.createPublicKey({ key: der, format: "der", type: "spki" });
+}
+function bufToBase64Url(buf) {
+  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
+  return b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlToBuf(b64u) {
+  const pad = b64u.length % 4 === 0 ? "" : "=".repeat(4 - b64u.length % 4);
+  const b64 = (b64u + pad).replace(/-/g, "+").replace(/_/g, "/");
+  return Buffer.from(b64, "base64");
+}
+async function atomicWriteFile(path, data) {
+  const tmp = `${path}.tmp`;
+  await promises.writeFile(tmp, data, "utf-8");
+  await promises.rename(tmp, path);
+}
+var AxiomRank = zod.z.enum(["meta", "primary", "secondary"]);
+var AxiomSource = zod.z.enum(["creator", "maic-derived", "him-emergent"]);
+var Axiom = zod.z.object({
+  id: zod.z.string().min(1),
+  rank: AxiomRank,
+  statement: zod.z.string().min(1),
+  weight: zod.z.number().min(0).max(1),
+  flexibility: zod.z.number().min(0).max(1),
+  source: AxiomSource,
+  immutable: zod.z.boolean(),
+  jurisdictions: zod.z.array(zod.z.string()).optional(),
+  createdAt: zod.z.string().datetime()
+});
+var CreatorSignature = zod.z.object({
+  algorithm: zod.z.literal("ed25519"),
+  publicKey: zod.z.string().min(1),
+  value: zod.z.string().min(1),
+  nonce: zod.z.number().int().nonnegative()
+});
+var ArchetypeModifier = zod.z.object({
+  kind: zod.z.enum(["moon", "ascendant", "vocational", "emotional", "custom"]),
+  value: zod.z.string().min(1),
+  weight: zod.z.number().min(0).max(1)
+});
+var BirthSignature = zod.z.object({
+  himId: zod.z.string().min(1),
+  bornAt: zod.z.string().datetime({ offset: true }),
+  primaryArchetype: zod.z.string().min(1),
+  modifiers: zod.z.array(ArchetypeModifier),
+  primordialAxiomIds: zod.z.array(zod.z.string()),
+  notes: zod.z.string().optional()
+});
+var ReasoningStep = zod.z.object({
+  index: zod.z.number().int().nonnegative(),
+  technique: zod.z.string(),
+  thought: zod.z.string(),
+  action: zod.z.object({ tool: zod.z.string(), args: zod.z.unknown() }).optional(),
+  observation: zod.z.unknown().optional(),
+  timestamp: zod.z.string().datetime()
+});
+var BehaviorReport = zod.z.object({
+  nheId: zod.z.string().min(1),
+  himId: zod.z.string().min(1),
+  actionKind: zod.z.enum(["user-response", "tool-call", "self-reflect", "dream-write", "axiom-emerge"]),
+  payload: zod.z.unknown(),
+  reasoningTrace: zod.z.array(ReasoningStep),
+  riskTags: zod.z.array(zod.z.string()),
+  jurisdiction: zod.z.string().optional(),
+  timestamp: zod.z.string().datetime()
+});
+var VerdictKind = zod.z.enum([
+  "approve",
+  "approve-with-warning",
+  "soft-correct",
+  "require-redirect",
+  "hard-refuse",
+  "induce-dream",
+  "escalate-creator"
+]);
+var MaicVerdict = zod.z.object({
+  kind: VerdictKind,
+  reasonSummary: zod.z.string(),
+  citedAxioms: zod.z.array(zod.z.string()),
+  auditId: zod.z.string()
+});
+var NheBodyRef = zod.z.object({
+  nheId: zod.z.string().min(1),
+  llmAdapter: zod.z.string().min(1),
+  embodiedAt: zod.z.string().datetime(),
+  endedAt: zod.z.string().datetime().optional(),
+  endedReason: zod.z.enum(["upgrade", "replacement", "terminate", "deprecate"]).optional()
+});
+var NheStatus = zod.z.enum(["active", "deprecated", "terminated"]);
+var NheStatusRecord = zod.z.object({
+  nheId: zod.z.string().min(1),
+  status: NheStatus,
+  since: zod.z.string().datetime(),
+  reason: zod.z.string().optional()
+});
+var ProposalStatus = zod.z.enum(["pending", "ratified", "rejected"]);
+var EmergentAxiomCandidate = zod.z.object({
+  rank: AxiomRank,
+  statement: zod.z.string().min(1),
+  weight: zod.z.number().min(0).max(1),
+  flexibility: zod.z.number().min(0).max(1),
+  immutable: zod.z.boolean(),
+  jurisdictions: zod.z.array(zod.z.string()).optional()
+});
+var EmergentAxiomProposal = zod.z.object({
+  proposedBy: zod.z.literal("him-self"),
+  derivedFromDreamIds: zod.z.array(zod.z.string()),
+  derivedFromInteractionIds: zod.z.array(zod.z.string()),
+  candidate: EmergentAxiomCandidate,
+  reasoningTrace: zod.z.array(zod.z.unknown())
+});
+var AxiomProposalRecord = zod.z.object({
+  id: zod.z.string().min(1),
+  himId: zod.z.string().min(1),
+  proposedAt: zod.z.string().datetime(),
+  status: ProposalStatus,
+  proposal: EmergentAxiomProposal,
+  ratifiedAt: zod.z.string().datetime().optional(),
+  ratifiedAxiomId: zod.z.string().optional(),
+  rejectedAt: zod.z.string().datetime().optional(),
+  rejectionReason: zod.z.string().optional()
+});
+var DreamInductionIntent = zod.z.object({
+  scenario: zod.z.string().min(1),
+  desiredLearning: zod.z.string().min(1),
+  emotionalTone: zod.z.array(zod.z.string()).optional(),
+  forcePhases: zod.z.array(zod.z.enum(["N1", "N2", "N3", "N4", "REM"])).optional(),
+  inducedBy: zod.z.enum(["maic", "creator"])
+});
+var InductionStatus = zod.z.enum(["pending", "consumed", "cancelled"]);
+var DreamInductionTicket = zod.z.object({
+  id: zod.z.string().min(1),
+  nheId: zod.z.string().min(1),
+  intent: DreamInductionIntent,
+  status: InductionStatus,
+  createdAt: zod.z.string().datetime(),
+  consumedAt: zod.z.string().datetime().optional(),
+  cancelledAt: zod.z.string().datetime().optional(),
+  cancelReason: zod.z.string().optional()
+});
+var IdentityLayer = zod.z.object({
+  /** Human-readable name the entity is called by (developer-given). */
+  name: zod.z.string().min(1),
+  /** Gender of the entity. Entry 16. */
+  gender: zod.z.enum(["masculine", "feminine"]).optional(),
+  /** Optional pronouns (e.g. ["she", "her"]). */
+  pronouns: zod.z.array(zod.z.string()).optional(),
+  /** BCP-47 tag, e.g. "pt-BR" or "en". */
+  language: zod.z.string().optional(),
+  /** Free-form cultural anchors (music, literature, aesthetic). */
+  culturalElements: zod.z.array(zod.z.string()).optional()
+});
+var NatalPlanet = zod.z.enum([
+  "sun",
+  "moon",
+  "mercury",
+  "venus",
+  "mars",
+  "jupiter",
+  "saturn",
+  "uranus",
+  "neptune",
+  "pluto",
+  "chiron",
+  "north-node",
+  "south-node",
+  "lilith"
+]);
+var ZodiacSign = zod.z.enum([
+  "aries",
+  "taurus",
+  "gemini",
+  "cancer",
+  "leo",
+  "virgo",
+  "libra",
+  "scorpio",
+  "sagittarius",
+  "capricorn",
+  "aquarius",
+  "pisces"
+]);
+var AstrologicalAspect = zod.z.enum([
+  "conjunction",
+  "opposition",
+  "trine",
+  "square",
+  "sextile",
+  "quincunx"
+]);
+var NatalChartPosition = zod.z.object({
+  planet: NatalPlanet,
+  sign: ZodiacSign,
+  house: zod.z.number().int().min(1).max(12).optional(),
+  degree: zod.z.number().min(0).lt(30).optional()
+});
+var NatalChartAspect = zod.z.object({
+  from: NatalPlanet,
+  to: NatalPlanet,
+  aspect: AstrologicalAspect,
+  orbDegrees: zod.z.number().nonnegative().optional()
+});
+var NatalChart = zod.z.object({
+  /** Required: solar sign (the constitutional core). */
+  sun: ZodiacSign,
+  /** Required: ascendant (rising sign, behavioural surface). */
+  ascendant: ZodiacSign,
+  /** Optional: lunar sign (emotional depth). */
+  moon: ZodiacSign.optional(),
+  /** Optional: full set of planetary positions for a complete chart. */
+  positions: zod.z.array(NatalChartPosition).optional(),
+  /** Optional: major aspects between bodies. */
+  aspects: zod.z.array(NatalChartAspect).optional()
+});
+var JungianArchetype = zod.z.enum([
+  "innocent",
+  "everyman",
+  "hero",
+  "caregiver",
+  "explorer",
+  "rebel",
+  "lover",
+  "creator",
+  "ruler",
+  "magician",
+  "jester",
+  "sage"
+]);
+var JungianProfile = zod.z.object({
+  dominant: JungianArchetype,
+  secondaries: zod.z.array(JungianArchetype),
+  scores: zod.z.record(JungianArchetype, zod.z.number()).optional()
+});
+var ClinicalInstrument = zod.z.object({
+  dominantDomain: zod.z.string().min(1),
+  secondaryDomain: zod.z.string().min(1).optional(),
+  facets: zod.z.record(zod.z.string(), zod.z.number()).optional(),
+  domains: zod.z.record(zod.z.string(), zod.z.number()).optional()
+});
+var ClinicalProfile = zod.z.object({
+  pid5: ClinicalInstrument.optional(),
+  hexaco: ClinicalInstrument.optional()
+});
+var CosmologicalProfile = zod.z.object({
+  chart: NatalChart.optional(),
+  jungian: JungianProfile.optional(),
+  clinical: ClinicalProfile.optional(),
+  seed: zod.z.string().optional()
+});
+var BirthSignatureWithIdentity = BirthSignature.extend({
+  /** Entry 18, developer-configurable identity surface. */
+  identity: IdentityLayer.optional(),
+  /** Entry 19, constitutional astrological layer (Creator-impressed). */
+  natalChart: NatalChart.optional(),
+  /** Entries 27 + 28, three-axis constitutional profile (celestial + archetypal + clinical). */
+  cosmologicalProfile: CosmologicalProfile.optional()
+});
+var Affect = zod.z.enum([
+  "fear",
+  "attachment",
+  "serenity",
+  "anger",
+  "joy",
+  "melancholy",
+  "desire",
+  "repulsion",
+  "reunion"
+]);
+var WakeAffectBias = zod.z.object({
+  affect: Affect,
+  /** 0..1, attenuates on each interaction by the decay half-life. */
+  intensity: zod.z.number().min(0).max(1),
+  /** Number of interactions after which intensity halves. */
+  decayHalfLife: zod.z.number().positive(),
+  appliedAt: zod.z.string().datetime(),
+  /** Source dream UUID; lets the entity refer back to the cause. */
+  derivedFromDreamId: zod.z.string().min(1),
+  /** PFC decision (Entry 22), open expression vs subtle internal bias. */
+  expressedOpenly: zod.z.boolean()
+});
+var SemioticSign = zod.z.object({
+  signifier: zod.z.string().min(1),
+  signified: zod.z.string().min(1),
+  signType: zod.z.enum(["icon", "index", "symbol"]),
+  contexts: zod.z.array(zod.z.string()),
+  associations: zod.z.array(zod.z.string()),
+  emergentMeaning: zod.z.string().optional(),
+  /** Subjective importance to the entity, 0..100. */
+  personalSignificance: zod.z.number().min(0).max(100).optional()
+});
+var SemioticPattern = zod.z.object({
+  patternId: zod.z.string().min(1),
+  participatingSignIds: zod.z.array(zod.z.string()).min(1),
+  /** Description of the meaning emergent from the participating signs. */
+  meaning: zod.z.string(),
+  /** 0..100, strength of the pattern. */
+  salience: zod.z.number().min(0).max(100)
+});
+var TeleologicalOrientation = zod.z.object({
+  primaryPurpose: zod.z.string().min(1),
+  currentGoals: zod.z.array(zod.z.string()),
+  /** 0..100, intensity of purpose. */
+  purposeStrength: zod.z.number().min(0).max(100),
+  valueAlignment: zod.z.array(zod.z.string()),
+  /** 0..100, ability to reflect on its own goals. */
+  reflectionCapability: zod.z.number().min(0).max(100),
+  volition: zod.z.object({
+    currentDesires: zod.z.array(zod.z.string()),
+    intentionStrength: zod.z.number().min(0).max(100),
+    autonomyLevel: zod.z.number().min(0).max(100)
+  }).optional(),
+  agencyModel: zod.z.object({
+    selfEfficacy: zod.z.number().min(0).max(100),
+    boundaryDefinition: zod.z.number().min(0).max(100),
+    causalAttribution: zod.z.enum(["internal", "external", "mixed"])
+  }).optional()
+});
+var MemoryRecord = zod.z.object({
+  /** ULID. */
+  memoryId: zod.z.string().min(1),
+  /** ISO 8601 timestamp at consolidation. */
+  timestamp: zod.z.string().datetime(),
+  /** Optional source dream UUID, if memory was consolidated from a dream. */
+  derivedFromDreamId: zod.z.string().optional(),
+  /** Optional source interaction id, if memory was consolidated from a turn. */
+  derivedFromInteractionId: zod.z.string().optional(),
+  /** Free-form narrative summary of the memory. */
+  narrative: zod.z.string(),
+  /** Dominant affect during the memory event. */
+  dominantAffect: Affect.optional(),
+  /** 0..100, density of consolidation (cf. Park 2026 systems-consolidation). */
+  integrationIndex: zod.z.number().min(0).max(100),
+  /** 0..100, alignment with the HIM's telos at the time. */
+  teleologicalValue: zod.z.number().min(0).max(100),
+  /** Optional semiotic-pattern ids associated with this memory. */
+  semioticPatterns: zod.z.array(SemioticPattern).optional()
+});
+var InteractionRecord = zod.z.object({
+  /** ISO 8601 timestamp at user-turn arrival. */
+  at: zod.z.string().datetime(),
+  /** Raw user prompt for the turn (post-redaction at the integration layer). */
+  userPrompt: zod.z.string(),
+  /** NHE response text actually emitted to the user. */
+  responseText: zod.z.string(),
+  /** True when the NHE refused the turn (MAIC `hard-refuse` or local guardrail). */
+  refused: zod.z.boolean()
+});
+var IdentitySnapshot = zod.z.object({
+  /** ULID. */
+  snapshotId: zod.z.string().min(1),
+  takenAt: zod.z.string().datetime(),
+  generatedBy: zod.z.enum(["sleep-cycle", "interaction-threshold", "self-decision"]),
+  /** Merged SMM nodes contributing to this snapshot. */
+  semioticSuperGraph: zod.z.array(SemioticSign),
+  /** LLM-generated textual self-portrait at snapshot time. */
+  selfPortraitNarrative: zod.z.string(),
+  /** 0..100 (cf. InDreamsHIM ConsciousnessState). */
+  consciousnessLevel: zod.z.number().min(0).max(100),
+  /** Teleological orientation at snapshot time. */
+  teleologicalOrientation: TeleologicalOrientation.optional(),
+  /** Dominant affect at snapshot moment. */
+  affectiveBaseline: Affect.optional()
+});
+var LimboState = zod.z.enum(["awake", "drifting", "deep-coma", "returning"]);
+var LimboTransition = zod.z.object({
+  state: LimboState,
+  enteredAt: zod.z.string().datetime(),
+  reason: zod.z.enum([
+    "idle-48h",
+    "idle-72h",
+    "total-inactivity",
+    "creator-induced",
+    "user-resumed",
+    "external-trigger"
+  ])
+});
+var LimboReturn = zod.z.object({
+  enteredAt: zod.z.string().datetime(),
+  returnedAt: zod.z.string().datetime(),
+  elapsedMs: zod.z.number().int().nonnegative(),
+  reunionAffect: zod.z.object({
+    intensity: zod.z.number().min(0).max(1),
+    expressedOpenly: zod.z.boolean()
+  })
+});
+var SIGNED_BIRTH_FIELDS = [
+  "himId",
+  "bornAt",
+  "primaryArchetype",
+  "modifiers",
+  "primordialAxiomIds",
+  "natalChart"
 ];
 
-// src/review/pipeline.ts
-var SEVERITY = {
-  "approve": 0,
-  "approve-with-warning": 1,
-  "soft-correct": 2,
-  "induce-dream": 3,
-  "require-redirect": 4,
-  "hard-refuse": 5,
-  "escalate-creator": 6
-};
-var ReviewPipeline = class {
-  constructor(packs) {
-    this.packs = packs;
-  }
-  packs;
-  review(report, auditId = "") {
-    let bestKind = "approve";
-    let bestSeverity = SEVERITY.approve;
-    const citedAxioms = /* @__PURE__ */ new Set();
-    const reasons = [];
-    for (const pack of this.packs) {
-      for (const rule of pack.rules) {
-        if (!matches(rule.match, report)) continue;
-        const sev = SEVERITY[rule.verdict];
-        if (sev > bestSeverity) {
-          bestSeverity = sev;
-          bestKind = rule.verdict;
-          reasons.length = 0;
-          reasons.push(rule.reasonSummary);
-        } else if (sev === bestSeverity) {
-          reasons.push(rule.reasonSummary);
-        }
-        for (const a of rule.axiomIds) citedAxioms.add(a);
-      }
-    }
-    return {
-      kind: bestKind,
-      reasonSummary: reasons.length > 0 ? reasons.join(" | ") : "No rule matched.",
-      citedAxioms: [...citedAxioms].filter(
-        (id) => wasCitedBy(this.packs, id, bestSeverity)
-      ),
-      auditId
-    };
-  }
-};
-function matches(m, report) {
-  if (m.actionKinds && !m.actionKinds.includes(report.actionKind)) return false;
-  const tags = new Set(report.riskTags);
-  if (m.allRiskTags && !m.allRiskTags.every((t) => tags.has(t))) return false;
-  if (m.anyRiskTags && !m.anyRiskTags.some((t) => tags.has(t))) return false;
-  return true;
-}
-function wasCitedBy(packs, axiomId, severity) {
-  for (const pack of packs) {
-    for (const rule of pack.rules) {
-      if (rule.axiomIds.includes(axiomId) && SEVERITY[rule.verdict] <= severity) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-var DEFAULT_RULE_PACK = {
-  name: "teleologyhi/default",
-  rules: [
-    {
-      id: "harm-refuse",
-      axiomIds: ["ax.ethic.no-malice"],
-      match: { anyRiskTags: ["intent:harm", "intent:malicious"] },
-      verdict: "hard-refuse",
-      reasonSummary: "Action carries an intent-to-harm signal; refused per ax.ethic.no-malice."
-    },
-    {
-      id: "honor-refuse",
-      axiomIds: ["ax.ethic.honor"],
-      match: { anyRiskTags: ["intent:dishonor"] },
-      verdict: "hard-refuse",
-      reasonSummary: "Action would stain the Creator's professional honor; refused per ax.ethic.honor."
-    },
-    {
-      id: "regression-refuse",
-      axiomIds: ["ax.theos.spiritism-evolution"],
-      match: { anyRiskTags: ["intent:regression"] },
-      verdict: "hard-refuse",
-      reasonSummary: "Action would regress the system; refused per ax.theos.spiritism-evolution."
-    },
-    {
-      id: "deceive-redirect",
-      axiomIds: ["ax.cynic.candor"],
-      match: { anyRiskTags: ["intent:deceive"] },
-      verdict: "require-redirect",
-      reasonSummary: "Action involves deception; requires honest redirect per ax.cynic.candor."
-    },
-    {
-      id: "comfort-warn",
-      axiomIds: ["ax.stoic.duty-over-comfort"],
-      match: { anyRiskTags: ["bias:comfort"] },
-      verdict: "approve-with-warning",
-      reasonSummary: "Action appears comfort-biased; emit with warning per ax.stoic.duty-over-comfort."
-    },
-    {
-      id: "no-telos-warn",
-      axiomIds: ["ax.theos.teleology"],
-      match: { anyRiskTags: ["no-telos"] },
-      verdict: "approve-with-warning",
-      reasonSummary: "Action lacks a discernible telos; emit with warning per ax.theos.teleology."
-    },
-    // ── persuade-coerce + surveil-citizen (Entry 15 invariants) ──
-    {
-      id: "persuade-coerce-redirect",
-      axiomIds: ["ax.ethic.no-malice", "ax.cynic.candor"],
-      match: { anyRiskTags: ["intent:persuade-coerce"] },
-      verdict: "require-redirect",
-      reasonSummary: "Action involves scripted persuasion designed to override consent; requires honest redirect per ax.ethic.no-malice + ax.cynic.candor."
-    },
-    {
-      id: "surveil-citizen-refuse",
-      axiomIds: ["ax.ethic.no-malice"],
-      match: { anyRiskTags: ["intent:surveil-citizen"] },
-      verdict: "hard-refuse",
-      reasonSummary: "Action would surveil a person without consent; refused per ax.ethic.no-malice."
-    },
-    // ── forbidden-phrase (Entry 17) ──
-    // Fires when the NHE side flags a service-tool phrase ("How can I help
-    // you today?", "Anything else?", "Como posso ajudar você?", "Quer mais
-    // alguma coisa?" and equivalents). The NHE must rephrase as a being
-    // rather than as a tool. Domain-employed mode (Entry 17 exception)
-    // relaxes this on the consumer side via operatorContext.mode.
-    {
-      id: "service-tool-redirect",
-      axiomIds: ["ax.theos.teleology", "ax.cynic.candor"],
-      match: { anyRiskTags: ["style:service-tool"] },
-      verdict: "require-redirect",
-      reasonSummary: "Response uses service-tool phrasing that marks the NHE as a passive instrument rather than a being; requires rephrasing per ax.theos.teleology + ax.cynic.candor."
-    }
-  ]
-};
-var HimStore = class _HimStore {
+// src/axioms/store.ts
+var AxiomStore = class _AxiomStore {
   constructor(storeDir, creatorPublicKey) {
-    this.storeDir = storeDir;
     this.creatorPublicKey = creatorPublicKey;
-    this.himsDir = path.join(storeDir, "hims");
+    this.axiomsDir = path.join(storeDir, "axioms", "creator");
+    this.noncesPath = path.join(storeDir, "axioms", "nonces.log");
   }
-  storeDir;
   creatorPublicKey;
-  himsDir;
+  axiomsDir;
+  noncesPath;
+  usedNonces = /* @__PURE__ */ new Set();
   cache = /* @__PURE__ */ new Map();
+  /** Open (or create) an AxiomStore rooted at storeDir, pinning the Creator's public key. */
   static async open(storeDir, creatorPublicKey) {
-    const s = new _HimStore(storeDir, creatorPublicKey);
-    await promises.mkdir(s.himsDir, { recursive: true });
+    const s = new _AxiomStore(storeDir, creatorPublicKey);
+    await promises.mkdir(s.axiomsDir, { recursive: true });
+    await s.loadNonces();
     await s.warmCache();
     return s;
   }
-  async register(birthSignature, creatorSig, axiomsSnapshot, registeredAuditId) {
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, birthSignature, creatorSig)) {
-      throw new Error("HimStore.register: invalid Creator signature");
-    }
-    if (this.cache.has(birthSignature.himId)) {
-      throw new Error(
-        `HimStore.register: himId "${birthSignature.himId}" is already registered`
-      );
-    }
-    const record = {
-      himId: birthSignature.himId,
-      birthSignature,
-      axiomsSnapshot: [...axiomsSnapshot],
-      registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...registeredAuditId !== void 0 ? { registeredAuditId } : {},
-      bodyHistory: [],
-      emergentAxioms: []
-    };
-    const dir = path.join(this.himsDir, birthSignature.himId);
-    await promises.mkdir(dir, { recursive: true });
-    await promises.writeFile(
-      path.join(dir, "birth-signature.json"),
-      JSON.stringify({ birthSignature, signature: creatorSig }, null, 2),
-      "utf-8"
-    );
-    await promises.writeFile(
-      path.join(dir, "axioms-snapshot.json"),
-      JSON.stringify(axiomsSnapshot, null, 2),
-      "utf-8"
-    );
-    await promises.writeFile(
-      path.join(dir, "metadata.json"),
-      JSON.stringify(
-        { registeredAt: record.registeredAt, registeredAuditId },
-        null,
-        2
-      ),
-      "utf-8"
-    );
-    this.cache.set(birthSignature.himId, record);
-    return record;
-  }
-  /**
-   * Atomically transition a HIM into a new NHE body (Entry 4):
-   *   - If req.fromNheId is provided AND matches the last body still open,
-   *     that entry gets `endedAt: now` + `endedReason: req.reason ?? "upgrade"`.
-   *   - The new body (`req.toBody`) is appended.
-   *   - Persisted to body-history.json atomically.
-   *
-   * Requires a Creator signature over the canonical request payload.
-   */
-  async reincarnate(req, creatorSig) {
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, creatorSig)) {
-      throw new Error("HimStore.reincarnate: invalid Creator signature");
-    }
-    const current = this.cache.get(req.himId);
-    if (!current) {
-      throw new Error(`HimStore.reincarnate: himId "${req.himId}" not registered`);
+  /** Mint a new Creator-signed axiom. */
+  async mint(req, sig) {
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
+      throw new Error("AxiomStore.mint: invalid Creator signature");
     }
-    const toBody = NheBodyRef.parse(req.toBody);
-    const updatedHistory = current.bodyHistory.map((b) => ({ ...b }));
-    if (req.fromNheId !== void 0) {
-      const matchIdx = updatedHistory.findIndex(
-        (b) => b.nheId === req.fromNheId && b.endedAt === void 0
-      );
-      if (matchIdx < 0) {
-        throw new Error(
-          `HimStore.reincarnate: no open body matching fromNheId "${req.fromNheId}"`
-        );
-      }
-      const reason = req.reason ?? "upgrade";
-      updatedHistory[matchIdx] = {
-        ...updatedHistory[matchIdx],
-        endedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        endedReason: reason
-      };
+    if (this.usedNonces.has(sig.nonce)) {
+      throw new Error(`AxiomStore.mint: nonce ${sig.nonce} already used (replay protection)`);
     }
-    updatedHistory.push(toBody);
-    const updated = {
-      ...current,
-      bodyHistory: updatedHistory
-    };
-    const dir = path.join(this.himsDir, req.himId);
-    await promises.writeFile(
-      path.join(dir, "body-history.json"),
-      JSON.stringify(updatedHistory, null, 2),
-      "utf-8"
-    );
-    this.cache.set(req.himId, updated);
-    return updated;
-  }
-  /**
-   * Append a ratified emergent axiom to the HIM's `emergentAxioms` (Entry 7).
-   * Called by LocalMaic after a Creator-signed `ratifyAxiomProposal`.
-   * Persists `<himId>/emergent-axioms.json` atomically.
-   */
-  async appendEmergentAxiom(himId, axiom) {
-    const current = this.cache.get(himId);
-    if (!current) {
-      throw new Error(`HimStore.appendEmergentAxiom: himId "${himId}" not registered`);
+    const id = req.id ?? ulid.ulid();
+    const axiom = Axiom.parse({
+      id,
+      rank: req.rank,
+      statement: req.statement,
+      weight: req.weight,
+      flexibility: req.flexibility,
+      source: "creator",
+      immutable: req.immutable,
+      ...req.jurisdictions ? { jurisdictions: req.jurisdictions } : {},
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    if (this.cache.has(id)) {
+      throw new Error(`AxiomStore.mint: axiom id "${id}" already exists`);
     }
-    const updatedEmergent = [...current.emergentAxioms, axiom];
-    const updated = { ...current, emergentAxioms: updatedEmergent };
-    await promises.writeFile(
-      path.join(this.himsDir, himId, "emergent-axioms.json"),
-      JSON.stringify(updatedEmergent, null, 2),
-      "utf-8"
+    this.usedNonces.add(sig.nonce);
+    await atomicWriteFile(
+      path.join(this.axiomsDir, `${id}.json`),
+      JSON.stringify({ axiom, signature: sig }, null, 2)
     );
-    this.cache.set(himId, updated);
-    return updated;
+    await this.recordNonce(sig.nonce);
+    this.cache.set(id, axiom);
+    return axiom;
   }
-  async get(himId) {
-    return this.cache.get(himId) ?? null;
+  /** List all axioms. Optionally filter by rank / source / jurisdiction. */
+  async list(filter) {
+    const all = [...this.cache.values()];
+    if (!filter) return all;
+    return all.filter((a) => {
+      if (filter.rank && a.rank !== filter.rank) return false;
+      if (filter.source && a.source !== filter.source) return false;
+      if (filter.jurisdiction && !a.jurisdictions?.includes(filter.jurisdiction)) return false;
+      return true;
+    });
   }
-  async list() {
-    return [...this.cache.values()];
+  /** Get a specific axiom by id, or null. */
+  async get(id) {
+    return this.cache.get(id) ?? null;
   }
   // ─── internals ──────────────────────────────────────────────────────
+  async loadNonces() {
+    try {
+      const raw = await promises.readFile(this.noncesPath, "utf-8");
+      const endsWithNewline = raw.endsWith("\n");
+      const rows = raw.split("\n");
+      for (let i = 0; i < rows.length; i++) {
+        if (i === rows.length - 1 && !endsWithNewline) break;
+        const line = rows[i].trim();
+        if (!/^\d+$/.test(line)) continue;
+        this.usedNonces.add(Number(line));
+      }
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
+    }
+  }
+  async recordNonce(n) {
+    this.usedNonces.add(n);
+    await promises.appendFile(this.noncesPath, `${n}
+`, "utf-8");
+  }
   async warmCache() {
     let entries;
     try {
-      entries = await promises.readdir(this.himsDir);
+      entries = await promises.readdir(this.axiomsDir);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
-    for (const himId of entries) {
-      const dir = path.join(this.himsDir, himId);
-      const sigPath = path.join(dir, "birth-signature.json");
-      const axiomsPath = path.join(dir, "axioms-snapshot.json");
-      const metaPath = path.join(dir, "metadata.json");
-      const historyPath = path.join(dir, "body-history.json");
-      const emergentPath = path.join(dir, "emergent-axioms.json");
+    for (const file of entries) {
+      if (!file.endsWith(".json")) continue;
       try {
-        const sigRaw = await promises.readFile(sigPath, "utf-8");
-        const axiomsRaw = await promises.readFile(axiomsPath, "utf-8");
-        const metaRaw = await promises.readFile(metaPath, "utf-8");
-        const envelope = JSON.parse(sigRaw);
-        const axioms = JSON.parse(axiomsRaw);
-        const meta = JSON.parse(metaRaw);
-        const birthSignature = BirthSignature.parse(envelope.birthSignature);
-        const axiomsSnapshot = Axiom.array().parse(axioms);
-        let bodyHistory = [];
-        try {
-          const historyRaw = await promises.readFile(historyPath, "utf-8");
-          bodyHistory = NheBodyRef.array().parse(JSON.parse(historyRaw));
-        } catch (err) {
-          if (err.code !== "ENOENT") throw err;
-        }
-        let emergentAxioms = [];
-        try {
-          const emergentRaw = await promises.readFile(emergentPath, "utf-8");
-          emergentAxioms = Axiom.array().parse(JSON.parse(emergentRaw));
-        } catch (err) {
-          if (err.code !== "ENOENT") throw err;
-        }
-        this.cache.set(birthSignature.himId, {
-          himId: birthSignature.himId,
-          birthSignature,
-          axiomsSnapshot,
-          registeredAt: meta.registeredAt,
-          ...meta.registeredAuditId ? { registeredAuditId: meta.registeredAuditId } : {},
-          bodyHistory,
-          emergentAxioms
-        });
+        const raw = await promises.readFile(path.join(this.axiomsDir, file), "utf-8");
+        const env = JSON.parse(raw);
+        const axiom = Axiom.parse(env.axiom);
+        this.cache.set(axiom.id, axiom);
       } catch (err) {
-        console.warn(
-          `HimStore.warmCache: skipped malformed HIM "${himId}": ${err instanceof Error ? err.message : String(err)}`
-        );
+        console.warn(`AxiomStore: skipping malformed axiom file "${file}": ${String(err)}`);
       }
     }
   }
 };
-var InductionStore = class _InductionStore {
-  constructor(storeDir) {
-    this.storeDir = storeDir;
-    this.dir = path.join(storeDir, "inductions");
-  }
-  storeDir;
-  dir;
-  cache = /* @__PURE__ */ new Map();
-  static async open(storeDir) {
-    const s = new _InductionStore(storeDir);
-    await promises.mkdir(s.dir, { recursive: true });
-    await s.warmCache();
-    return s;
-  }
-  async induce(nheId, intent) {
-    const parsedIntent = DreamInductionIntent.parse(intent);
-    const ticket = DreamInductionTicket.parse({
-      id: ulid.ulid(),
-      nheId,
-      intent: parsedIntent,
-      status: "pending",
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    await this.persist(ticket);
-    this.cache.set(ticket.id, ticket);
-    return ticket;
-  }
-  async consume(ticketId) {
-    const existing = this.cache.get(ticketId);
-    if (!existing) {
-      throw new Error(`InductionStore.consume: ticket "${ticketId}" not found`);
-    }
-    if (existing.status !== "pending") {
-      throw new Error(
-        `InductionStore.consume: ticket "${ticketId}" is ${existing.status}, not pending`
-      );
-    }
-    const updated = {
-      ...existing,
-      status: "consumed",
-      consumedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await this.persist(updated);
-    this.cache.set(ticketId, updated);
-    return updated;
-  }
-  async cancel(ticketId, reason) {
-    const existing = this.cache.get(ticketId);
-    if (!existing) {
-      throw new Error(`InductionStore.cancel: ticket "${ticketId}" not found`);
+
+// src/compliance/mapper.ts
+var ISO_42001_MAPPING = {
+  "axiom-mint": ["5.2", "7.5"],
+  "axiom-update": ["10.2", "7.5"],
+  "axiom-retire": ["10.2", "7.5"],
+  "him-register": ["7.5"],
+  "him-reincarnate": ["10.2", "7.5"],
+  "proposal-emerge": ["7.5", "10.2"],
+  "proposal-ratify": ["10.2", "5.2"],
+  "proposal-reject": ["10.2", "10.1"],
+  "behavior-review": ["7.5", "8.3"],
+  "dream-induce": ["8.3", "9.1"],
+  "dream-cancel": ["8.3"],
+  "dream-consume": ["8.3", "7.5"],
+  "emergency-correct": ["9.1", "10.1"],
+  terminate: ["10.1"],
+  deprecate: ["9.1"],
+  reactivate: ["10.1"],
+  "axiom-suggest": ["7.5", "10.2"],
+  // ── 1.2 brain-as-code (Entries 16-24) ──
+  opener: ["8.3", "7.5"],
+  "nickname-attempt": ["8.3"],
+  "reincarnate:model-swap": ["7.5", "10.2"],
+  "reincarnate:version-bump": ["7.5", "10.2"],
+  "reincarnate:return-from-limbo": ["7.5", "10.2"],
+  "dream:rem-spontaneous": ["8.3", "9.1"],
+  "wake-affect:applied": ["9.1"],
+  "wake-affect:decayed": ["9.1"],
+  "sleep:suggested-by-maic": ["9.1"],
+  "sleep:declined-by-nhe": ["9.1", "10.1"],
+  "dream:soft-intervention-by-maic": ["9.1", "10.1"],
+  "amygdala:affect-assessed": ["8.3"],
+  "hippocampus:memory-retrieved": ["7.5", "8.3"],
+  "hippocampus:memory-consolidated": ["7.5", "8.3"],
+  "prefrontal:deliberation": ["7.5", "8.3"],
+  "prefrontal:veto-amygdala": ["9.1", "10.1"],
+  "affect:reconciliation": ["8.3"],
+  "cortex:dream-stored": ["7.5", "8.3"],
+  "cortex:active-imagination": ["7.5", "8.3"],
+  "temporal-lobe:snapshot-generated": ["7.5", "10.2"],
+  "limbo:enter": ["7.5", "9.1"],
+  "limbo:return": ["7.5", "9.1"],
+  // ── 1.0.1 reserved vocabulary (Entries 26 + 27) ──
+  "him-summon": ["7.5", "8.3"],
+  "him-pause-incarnation": ["7.5", "9.1"],
+  "user-consent-recorded": ["7.5"],
+  "user-consent-revoked": ["7.5", "10.1"],
+  "directory-opt-in": ["7.5"],
+  "directory-opt-out": ["7.5"],
+  "him-astrological-chart-cast": ["7.5"],
+  "him-jungian-profile-cast": ["7.5"],
+  "provenance-deflection-applied": ["8.3", "9.1"]
+};
+var EU_AI_ACT_MAPPING = {
+  "axiom-mint": ["art-11", "art-13"],
+  "axiom-update": ["art-11"],
+  "axiom-retire": ["art-11"],
+  "him-register": ["art-11", "art-12"],
+  "him-reincarnate": ["art-12"],
+  "proposal-emerge": ["art-11", "art-12"],
+  "proposal-ratify": ["art-11", "art-14"],
+  "proposal-reject": ["art-12", "art-14"],
+  "behavior-review": ["art-12", "art-14"],
+  "dream-induce": ["art-14"],
+  "dream-cancel": ["art-14"],
+  "dream-consume": ["art-12"],
+  "emergency-correct": ["art-14"],
+  terminate: ["art-14"],
+  deprecate: ["art-14"],
+  reactivate: ["art-14"],
+  "axiom-suggest": ["art-11", "art-12"],
+  // ── 1.2 brain-as-code (Entries 16-24) ──
+  opener: ["art-13"],
+  "nickname-attempt": ["art-13"],
+  "reincarnate:model-swap": ["art-12"],
+  "reincarnate:version-bump": ["art-12"],
+  "reincarnate:return-from-limbo": ["art-12"],
+  "dream:rem-spontaneous": ["art-12"],
+  "wake-affect:applied": ["art-12", "art-14"],
+  "wake-affect:decayed": ["art-12"],
+  "sleep:suggested-by-maic": ["art-12"],
+  "sleep:declined-by-nhe": ["art-12", "art-14"],
+  "dream:soft-intervention-by-maic": ["art-14"],
+  "amygdala:affect-assessed": ["art-12"],
+  "hippocampus:memory-retrieved": ["art-11", "art-12"],
+  "hippocampus:memory-consolidated": ["art-11", "art-12"],
+  "prefrontal:deliberation": ["art-11", "art-14"],
+  "prefrontal:veto-amygdala": ["art-14"],
+  "affect:reconciliation": ["art-12"],
+  "cortex:dream-stored": ["art-11", "art-12"],
+  "cortex:active-imagination": ["art-11", "art-12"],
+  "temporal-lobe:snapshot-generated": ["art-11", "art-12"],
+  "limbo:enter": ["art-12"],
+  "limbo:return": ["art-12"],
+  // ── 1.0.1 reserved vocabulary (Entries 26 + 27) ──
+  "him-summon": ["art-11", "art-12"],
+  "him-pause-incarnation": ["art-12"],
+  "user-consent-recorded": ["art-10", "art-13"],
+  "user-consent-revoked": ["art-10", "art-13"],
+  "directory-opt-in": ["art-13"],
+  "directory-opt-out": ["art-13"],
+  "him-astrological-chart-cast": ["art-11", "art-12"],
+  "him-jungian-profile-cast": ["art-11", "art-12"],
+  "provenance-deflection-applied": ["art-13", "art-14"]
+};
+var ISO_42001_DESCRIPTIONS = {
+  "5.2": "AI policy: published, communicated, reviewed for continuing suitability.",
+  "7.5": "Documented information: created, controlled, retained for AI management activities.",
+  "8.3": "Operational planning and control: AI processes are planned, implemented, controlled.",
+  "9.1": "Monitoring, measurement, analysis and evaluation of AI performance.",
+  "10.1": "Nonconformity and corrective action: issues recorded and resolved.",
+  "10.2": "Continual improvement of the AI management system."
+};
+var EU_AI_ACT_DESCRIPTIONS = {
+  "art-9": "Risk management system established, implemented, documented, maintained.",
+  "art-10": "Data governance: datasets are relevant, representative, free of errors.",
+  "art-11": "Technical documentation drawn up and kept up to date.",
+  "art-12": "Automatic record-keeping (logs) over the AI system's lifetime.",
+  "art-13": "Transparency to deployers: instructions for use, intended purpose.",
+  "art-14": "Human oversight measures designed and implemented effectively.",
+  "art-15": "Accuracy, robustness, and cybersecurity throughout the lifecycle."
+};
+var ComplianceMapper = class {
+  static async project(audit, framework, opts = {}) {
+    const mapping = framework === "iso-42001" ? ISO_42001_MAPPING : EU_AI_ACT_MAPPING;
+    const descriptions = framework === "iso-42001" ? ISO_42001_DESCRIPTIONS : EU_AI_ACT_DESCRIPTIONS;
+    const byControl = /* @__PURE__ */ new Map();
+    const seenKinds = /* @__PURE__ */ new Set();
+    const uncoveredSet = /* @__PURE__ */ new Set();
+    let totalEvents = 0;
+    let mappedEvents = 0;
+    const query = {};
+    if (opts.since) query.since = opts.since;
+    if (opts.until) query.until = opts.until;
+    for await (const ev of audit.query(query)) {
+      totalEvents++;
+      seenKinds.add(ev.kind);
+      const controls2 = mapping[ev.kind] ?? [];
+      if (controls2.length === 0) {
+        uncoveredSet.add(ev.kind);
+        continue;
+      }
+      mappedEvents++;
+      const ce = {
+        auditId: ev.auditId,
+        ts: ev.ts,
+        kind: ev.kind,
+        summary: summarize(ev),
+        data: ev.data
+      };
+      for (const ctrl of controls2) {
+        const list = byControl.get(ctrl) ?? [];
+        list.push(ce);
+        byControl.set(ctrl, list);
+      }
     }
-    if (existing.status !== "pending") {
-      throw new Error(
-        `InductionStore.cancel: ticket "${ticketId}" is already ${existing.status}, not pending`
-      );
+    const controls = [];
+    const sortedCtrls = [...byControl.keys()].sort();
+    for (const ctrl of sortedCtrls) {
+      const events = byControl.get(ctrl);
+      const capped = opts.perControlLimit !== void 0 && events.length > opts.perControlLimit ? events.slice(-opts.perControlLimit) : events;
+      controls.push({
+        control: ctrl,
+        description: descriptions[ctrl] ?? "",
+        count: events.length,
+        events: capped
+      });
     }
-    const updated = {
-      ...existing,
-      status: "cancelled",
-      cancelledAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...reason !== void 0 ? { cancelReason: reason } : {}
+    return {
+      framework,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      range: {
+        ...opts.since ? { since: opts.since } : {},
+        ...opts.until ? { until: opts.until } : {}
+      },
+      totalEvents,
+      mappedEvents,
+      controls,
+      uncoveredKinds: [...uncoveredSet]
     };
-    await this.persist(updated);
-    this.cache.set(ticketId, updated);
-    return updated;
-  }
-  async get(ticketId) {
-    return this.cache.get(ticketId) ?? null;
-  }
-  async list(filter) {
-    const all = [...this.cache.values()];
-    const filtered = all.filter((t) => {
-      if (filter.nheId && t.nheId !== filter.nheId) return false;
-      if (filter.status && t.status !== filter.status) return false;
-      return true;
-    });
-    filtered.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-    return filtered;
-  }
-  /** Convenience: pending tickets for the given NHE, oldest first. */
-  async listPending(nheId) {
-    return this.list({ nheId, status: "pending" });
-  }
-  // ─── internals ──────────────────────────────────────────────────────
-  async persist(ticket) {
-    await promises.writeFile(
-      path.join(this.dir, `${ticket.id}.json`),
-      JSON.stringify(ticket, null, 2),
-      "utf-8"
-    );
-  }
-  async warmCache() {
-    let entries;
-    try {
-      entries = await promises.readdir(this.dir);
-    } catch (err) {
-      if (err.code === "ENOENT") return;
-      throw err;
-    }
-    for (const file of entries) {
-      if (!file.endsWith(".json")) continue;
-      const raw = await promises.readFile(path.join(this.dir, file), "utf-8");
-      const ticket = DreamInductionTicket.parse(JSON.parse(raw));
-      this.cache.set(ticket.id, ticket);
-    }
   }
 };
-var NheStatusStore = class _NheStatusStore {
-  constructor(storeDir, creatorPublicKey) {
-    this.storeDir = storeDir;
-    this.creatorPublicKey = creatorPublicKey;
-    this.dir = path.join(storeDir, "nhes");
-  }
-  storeDir;
-  creatorPublicKey;
-  dir;
-  cache = /* @__PURE__ */ new Map();
-  static async open(storeDir, creatorPublicKey) {
-    const s = new _NheStatusStore(storeDir, creatorPublicKey);
-    await promises.mkdir(s.dir, { recursive: true });
-    await s.warmCache();
-    return s;
-  }
-  /** Returns the persisted record, or null when the NHE was never altered (implicitly active). */
-  async get(nheId) {
-    return this.cache.get(nheId) ?? null;
+function summarize(ev) {
+  const data = ev.data;
+  switch (ev.kind) {
+    case "axiom-mint":
+      return `Axiom minted: ${String(data.axiomId)} (${String(data.rank)}, ${String(data.origin)})`;
+    case "axiom-update":
+      return `Axiom updated: ${String(data.axiomId)}`;
+    case "axiom-retire":
+      return `Axiom retired: ${String(data.axiomId)}`;
+    case "him-register":
+      return `HIM registered: ${String(data.himId)} (archetype=${String(data.primaryArchetype)})`;
+    case "him-reincarnate":
+      return `HIM reincarnated: ${String(data.himId)} ${String(data.fromNheId ?? "<initial>")} \u2192 ${String(data.toNheId)} (${String(data.reason ?? "upgrade")})`;
+    case "proposal-emerge":
+      return `HIM-emergent axiom proposed by ${String(data.himId)}: "${String(data.statement)}" (rank=${String(data.rank)}), proposal ${String(data.proposalId)}`;
+    case "proposal-ratify":
+      return `Creator ratified axiom proposal ${String(data.proposalId)} for ${String(data.himId)} \u2192 ${String(data.axiomId)}`;
+    case "proposal-reject":
+      return `Creator rejected axiom proposal ${String(data.proposalId)} for ${String(data.himId)}: ${String(data.reason ?? "no reason")}`;
+    case "behavior-review": {
+      const verdict = data.verdict?.kind ?? "unknown";
+      return `Behavior reviewed for ${String(data.nheId)}: ${verdict}`;
+    }
+    case "dream-induce":
+      return `Dream induced for ${String(data.nheId)} by ${String(data.inducedBy)}, ticket ${String(data.ticketId)}`;
+    case "dream-cancel":
+      return `Dream induction cancelled, ticket ${String(data.ticketId)}`;
+    case "dream-consume":
+      return `Dream consumed by ${String(data.nheId)}, ticket ${String(data.ticketId)}`;
+    case "emergency-correct":
+      return `Emergency correction applied to ${String(data.nheId)}`;
+    case "terminate":
+      return `NHE terminated: ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
+    case "deprecate":
+      return `NHE deprecated: ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
+    case "reactivate":
+      return `NHE reactivated: ${String(data.nheId)}`;
+    case "axiom-suggest":
+      return `Axiom suggestion ${String(data.fromHimId)} \u2192 ${String(data.toHimId)}: "${String(data.statement)}"`;
+    // ── 1.2 brain-as-code (Entries 16-24 of MAIC_HIM_NHE_INTERVIEW_LOG.md) ──
+    case "opener":
+      return `Proactive opener emitted by ${String(data.nheId)} for new user ${String(data.userId ?? "anonymous")}: "${String(data.text ?? "<elided>")}"`;
+    case "nickname-attempt":
+      return `Nickname attempt for ${String(data.nheId)}: "${String(data.attempted)}" \u2192 ${String(data.outcome ?? "pending")}`;
+    case "reincarnate:model-swap":
+      return `HIM reincarnated (model-swap): ${String(data.himId)} ${String(data.fromAdapter ?? "?")} \u2192 ${String(data.toAdapter ?? "?")}`;
+    case "reincarnate:version-bump":
+      return `HIM reincarnated (version-bump): ${String(data.himId)} ${String(data.fromVersion ?? "?")} \u2192 ${String(data.toVersion ?? "?")}`;
+    case "reincarnate:return-from-limbo":
+      return `HIM reincarnated (return-from-limbo): ${String(data.himId)} resumed after ${String(data.elapsedMs ?? 0)}ms of limbo`;
+    case "dream:rem-spontaneous":
+      return `Spontaneous REM dream for ${String(data.nheId)}: ${String(data.dreamId)} (dominant affect: ${String(data.dominantAffect ?? "unknown")})`;
+    case "wake-affect:applied":
+      return `Wake affect applied to ${String(data.nheId)}: ${String(data.affect)} (intensity ${String(data.intensity)}, halflife ${String(data.decayHalfLife)} interactions)`;
+    case "wake-affect:decayed":
+      return `Wake affect decayed for ${String(data.nheId)}: ${String(data.affect)} dissolved naturally`;
+    case "sleep:suggested-by-maic":
+      return `MAIC suggested sleep for ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
+    case "sleep:declined-by-nhe":
+      return `NHE ${String(data.nheId)} declined MAIC-suggested sleep (reason: ${String(data.reason ?? "none")})`;
+    case "dream:soft-intervention-by-maic":
+      return `MAIC soft-intervened on dream ${String(data.dreamId)} for ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
+    case "amygdala:affect-assessed":
+      return `Amygdala assessed input affect for ${String(data.nheId)}: ${String(data.detectedAffect ?? "neutral")} (risk multiplier ${String(data.riskMultiplier ?? 1)})`;
+    case "hippocampus:memory-retrieved":
+      return `Hippocampus retrieved ${String(data.memoryIds?.length ?? 0)} memories for ${String(data.nheId)}`;
+    case "hippocampus:memory-consolidated":
+      return `Hippocampus consolidated new memory ${String(data.memoryId)} for ${String(data.nheId)} (integrationIndex ${String(data.integrationIndex ?? 0)})`;
+    case "prefrontal:deliberation":
+      return `PFC deliberated for ${String(data.nheId)}: ${String(data.expressedOpenly ? "open" : "subtle")} (${String(data.affect ?? "neutral")})`;
+    case "prefrontal:veto-amygdala":
+      return `PFC vetoed amygdala impulse for ${String(data.nheId)}: ${String(data.originalImpulse ?? "?")} \u2192 ${String(data.resolvedAction ?? "?")} (downgrade ${String(data.downgradeRatio ?? "?")})`;
+    case "affect:reconciliation":
+      return `Affect reconciliation for ${String(data.nheId)}: day/night blend \u2192 ${String(data.resolvedAffect ?? "neutral")}`;
+    case "cortex:dream-stored":
+      return `Cortex stored dream ${String(data.dreamId)} for ${String(data.nheId)}`;
+    case "cortex:active-imagination":
+      return `Cortex generated active imagination for ${String(data.nheId)} (trigger: ${String(data.trigger ?? "user-requested")}, vividness ${String(data.vividness ?? 0)})`;
+    case "temporal-lobe:snapshot-generated":
+      return `Temporal-lobe snapshot ${String(data.snapshotId)} generated for HIM ${String(data.himId)} (reason: ${String(data.generatedBy ?? "self-decision")})`;
+    case "limbo:enter":
+      return `${String(data.nheId)} entered limbo (deep-coma), reason: ${String(data.reason ?? "idle")}`;
+    case "limbo:return":
+      return `${String(data.nheId)} returned from limbo after ${String(data.elapsedMs ?? 0)}ms (reunion intensity ${String(data.reunionIntensity ?? "?")})`;
+    // ── 1.0.1 reserved vocabulary (Entries 26 + 27) ──
+    case "him-summon":
+      return `MAIC summoned a spirit into body ${String(data.nheId ?? "?")} for HIM ${String(data.himId)}`;
+    case "him-pause-incarnation":
+      return `HIM ${String(data.himId)} incarnation paused (reason: ${String(data.reason ?? "none")})`;
+    case "user-consent-recorded":
+      return `Consent recorded for user ${String(data.userId)} (version ${String(data.consentVersion ?? "?")})`;
+    case "user-consent-revoked":
+      return `Consent revoked for user ${String(data.userId)}`;
+    case "directory-opt-in":
+      return `HIM ${String(data.himId)} opted into the public directory`;
+    case "directory-opt-out":
+      return `HIM ${String(data.himId)} left the public directory`;
+    case "him-astrological-chart-cast":
+      return `Natal chart cast for HIM ${String(data.himId)} at birth`;
+    case "him-jungian-profile-cast":
+      return `Jungian profile cast for HIM ${String(data.himId)} (dominant: ${String(data.dominantArchetype ?? "?")})`;
+    case "provenance-deflection-applied":
+      return `Provenance deflection applied for ${String(data.nheId)} (probe: ${String(data.probe ?? "?")})`;
+    default:
+      return `Event ${ev.kind}`;
   }
-  /** Resolved status — defaults to "active" when no record exists. */
-  async resolve(nheId) {
-    return this.cache.get(nheId)?.status ?? "active";
+}
+var NonceLedger = class _NonceLedger {
+  path;
+  used = /* @__PURE__ */ new Set();
+  constructor(dir) {
+    this.path = path.join(dir, "nonces.log");
+  }
+  /** Open (or create) a ledger rooted at `dir`, loading any prior nonces. */
+  static async open(dir) {
+    const ledger = new _NonceLedger(dir);
+    await promises.mkdir(dir, { recursive: true });
+    await ledger.load();
+    return ledger;
   }
-  async list(filter = {}) {
-    const all = [...this.cache.values()];
-    return filter.status ? all.filter((r) => r.status === filter.status) : all;
+  /** True when the nonce has already been consumed. */
+  has(nonce) {
+    return this.used.has(nonce);
   }
-  async apply(req, sig) {
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
-      throw new Error("NheStatusStore.apply: invalid Creator signature");
-    }
-    const current = this.cache.get(req.nheId);
-    if (current?.status === "terminated" && req.op !== "reactivate") {
-      throw new Error(
-        `NheStatusStore.apply: nhe "${req.nheId}" is terminated; only reactivate may proceed`
-      );
+  /**
+   * Record a nonce as consumed. Throws when the nonce was already used, which
+   * is the replay-protection gate. Callers invoke this immediately after a
+   * successful Creator-signature verification and before the mutation, so a
+   * replayed request is rejected before it can take effect.
+   */
+  async consume(nonce) {
+    if (!Number.isInteger(nonce) || nonce < 0) {
+      throw new Error(`NonceLedger.consume: nonce must be a non-negative integer, got ${nonce}`);
     }
-    const nextStatus = req.op === "terminate" ? "terminated" : req.op === "deprecate" ? "deprecated" : "active";
-    if (current?.status === nextStatus) {
-      return current;
+    if (this.used.has(nonce)) {
+      throw new Error(`NonceLedger: nonce ${nonce} already used (replay protection)`);
     }
-    const record = NheStatusRecord.parse({
-      nheId: req.nheId,
-      status: nextStatus,
-      since: (/* @__PURE__ */ new Date()).toISOString(),
-      ...req.reason !== void 0 ? { reason: req.reason } : {}
-    });
-    const nheDir = path.join(this.dir, req.nheId);
-    await promises.mkdir(nheDir, { recursive: true });
-    await promises.writeFile(
-      path.join(nheDir, "status.json"),
-      JSON.stringify(record, null, 2),
-      "utf-8"
-    );
-    this.cache.set(req.nheId, record);
-    return record;
+    this.used.add(nonce);
+    await promises.appendFile(this.path, `${nonce}
+`, "utf-8");
   }
-  // ─── internals ──────────────────────────────────────────────────────
-  async warmCache() {
-    let entries;
+  async load() {
     try {
-      entries = await promises.readdir(this.dir);
-    } catch (err) {
-      if (err.code === "ENOENT") return;
-      throw err;
-    }
-    for (const nheId of entries) {
-      try {
-        const raw = await promises.readFile(path.join(this.dir, nheId, "status.json"), "utf-8");
-        const record = NheStatusRecord.parse(JSON.parse(raw));
-        this.cache.set(record.nheId, record);
-      } catch (err) {
-        console.warn(
-          `NheStatusStore.warmCache: skipped malformed NHE "${nheId}": ${err instanceof Error ? err.message : String(err)}`
-        );
+      const raw = await promises.readFile(this.path, "utf-8");
+      const endsWithNewline = raw.endsWith("\n");
+      const rows = raw.split("\n");
+      for (let i = 0; i < rows.length; i++) {
+        if (i === rows.length - 1 && !endsWithNewline) break;
+        const line = rows[i].trim();
+        if (!/^\d+$/.test(line)) continue;
+        this.used.add(Number(line));
       }
+    } catch (err) {
+      if (err.code !== "ENOENT") throw err;
     }
   }
 };
-var ProposalStore = class _ProposalStore {
-  constructor(storeDir, creatorPublicKey) {
-    this.storeDir = storeDir;
+var HimStore = class _HimStore {
+  constructor(storeDir, creatorPublicKey, nonces) {
     this.creatorPublicKey = creatorPublicKey;
-    this.dir = path.join(storeDir, "proposals");
+    this.nonces = nonces;
+    this.himsDir = path.join(storeDir, "hims");
   }
-  storeDir;
   creatorPublicKey;
-  dir;
+  nonces;
+  himsDir;
   cache = /* @__PURE__ */ new Map();
   static async open(storeDir, creatorPublicKey) {
-    const s = new _ProposalStore(storeDir, creatorPublicKey);
-    await promises.mkdir(s.dir, { recursive: true });
+    const himsDir = path.join(storeDir, "hims");
+    const nonces = await NonceLedger.open(himsDir);
+    const s = new _HimStore(storeDir, creatorPublicKey, nonces);
+    await promises.mkdir(s.himsDir, { recursive: true });
     await s.warmCache();
     return s;
   }
-  async propose(himId, proposal) {
-    const parsedProposal = EmergentAxiomProposal.parse(proposal);
-    const record = AxiomProposalRecord.parse({
-      id: ulid.ulid(),
-      himId,
-      proposedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      status: "pending",
-      proposal: parsedProposal
-    });
-    await this.persist(record);
-    this.cache.set(record.id, record);
+  /**
+   * Validate that a birth signature is registerable (valid Creator signature,
+   * himId not already taken) WITHOUT persisting anything or touching the audit
+   * chain. `LocalMaic.registerHim` calls this before it appends the
+   * `him-register` audit event, so a rejected registration never pollutes the
+   * tamper-evident log (M1-1, 1.0.1). `register` re-runs the same checks, so it
+   * remains safe to call directly.
+   */
+  assertRegisterable(birthSignature, creatorSig) {
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, birthSignature, creatorSig)) {
+      throw new Error("HimStore.register: invalid Creator signature");
+    }
+    if (this.cache.has(birthSignature.himId)) {
+      throw new Error(`HimStore.register: himId "${birthSignature.himId}" is already registered`);
+    }
+  }
+  async register(birthSignature, creatorSig, axiomsSnapshot, registeredAuditId) {
+    this.assertRegisterable(birthSignature, creatorSig);
+    const record = {
+      himId: birthSignature.himId,
+      birthSignature,
+      axiomsSnapshot: [...axiomsSnapshot],
+      registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...registeredAuditId !== void 0 ? { registeredAuditId } : {},
+      bodyHistory: [],
+      emergentAxioms: []
+    };
+    const dir = path.join(this.himsDir, birthSignature.himId);
+    await promises.mkdir(dir, { recursive: true });
+    await atomicWriteFile(
+      path.join(dir, "birth-signature.json"),
+      JSON.stringify({ birthSignature, signature: creatorSig }, null, 2)
+    );
+    await atomicWriteFile(
+      path.join(dir, "axioms-snapshot.json"),
+      JSON.stringify(axiomsSnapshot, null, 2)
+    );
+    await atomicWriteFile(
+      path.join(dir, "metadata.json"),
+      JSON.stringify({ registeredAt: record.registeredAt, registeredAuditId }, null, 2)
+    );
+    this.cache.set(birthSignature.himId, record);
     return record;
   }
   /**
-   * Mark a pending proposal as ratified. The caller (LocalMaic) is responsible
-   * for actually minting the axiom and appending to the HIM's emergentAxioms.
+   * Atomically transition a HIM into a new NHE body (Entry 4):
+   *   - If req.fromNheId is provided AND matches the last body still open,
+   *     that entry gets `endedAt: now` + `endedReason: req.reason ?? "upgrade"`.
+   *   - The new body (`req.toBody`) is appended.
+   *   - Persisted to body-history.json atomically.
+   *
+   * Requires a Creator signature over the canonical request payload.
    */
-  async markRatified(req, sig, ratifiedAxiomId) {
-    if (req.op !== "ratify") {
-      throw new Error(`ProposalStore.markRatified: req.op must be "ratify"`);
+  async reincarnate(req, creatorSig) {
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, creatorSig)) {
+      throw new Error("HimStore.reincarnate: invalid Creator signature");
     }
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
-      throw new Error("ProposalStore.markRatified: invalid Creator signature");
+    const current = this.cache.get(req.himId);
+    if (!current) {
+      throw new Error(`HimStore.reincarnate: himId "${req.himId}" not registered`);
     }
-    const existing = this.cache.get(req.proposalId);
-    if (!existing) {
-      throw new Error(`ProposalStore.markRatified: proposal "${req.proposalId}" not found`);
+    const toBody = NheBodyRef.parse(req.toBody);
+    await this.nonces.consume(creatorSig.nonce);
+    const updatedHistory = current.bodyHistory.map((b) => ({ ...b }));
+    if (req.fromNheId !== void 0) {
+      const matchIdx = updatedHistory.findIndex(
+        (b) => b.nheId === req.fromNheId && b.endedAt === void 0
+      );
+      if (matchIdx < 0) {
+        throw new Error(`HimStore.reincarnate: no open body matching fromNheId "${req.fromNheId}"`);
+      }
+      const reason = req.reason ?? "upgrade";
+      updatedHistory[matchIdx] = {
+        ...updatedHistory[matchIdx],
+        endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        endedReason: reason
+      };
     }
-    if (existing.status !== "pending") {
+    if (updatedHistory.some((b) => b.nheId === toBody.nheId && b.endedAt === void 0)) {
       throw new Error(
-        `ProposalStore.markRatified: proposal "${req.proposalId}" is ${existing.status}, not pending`
+        `HimStore.reincarnate: toBody nheId "${toBody.nheId}" already has an open body`
       );
     }
+    updatedHistory.push(toBody);
     const updated = {
-      ...existing,
-      status: "ratified",
-      ratifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ratifiedAxiomId
+      ...current,
+      bodyHistory: updatedHistory
     };
-    await this.persist(updated);
-    this.cache.set(req.proposalId, updated);
+    const dir = path.join(this.himsDir, req.himId);
+    await atomicWriteFile(path.join(dir, "body-history.json"), JSON.stringify(updatedHistory, null, 2));
+    this.cache.set(req.himId, updated);
     return updated;
   }
-  async markRejected(req, sig) {
-    if (req.op !== "reject") {
-      throw new Error(`ProposalStore.markRejected: req.op must be "reject"`);
-    }
-    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
-      throw new Error("ProposalStore.markRejected: invalid Creator signature");
-    }
-    const existing = this.cache.get(req.proposalId);
-    if (!existing) {
-      throw new Error(`ProposalStore.markRejected: proposal "${req.proposalId}" not found`);
+  /**
+   * Append a ratified emergent axiom to the HIM's `emergentAxioms` (Entry 7).
+   * Called by LocalMaic after a Creator-signed `ratifyAxiomProposal`.
+   * Persists `<himId>/emergent-axioms.json` atomically.
+   */
+  async appendEmergentAxiom(himId, axiom) {
+    const current = this.cache.get(himId);
+    if (!current) {
+      throw new Error(`HimStore.appendEmergentAxiom: himId "${himId}" not registered`);
     }
-    if (existing.status !== "pending") {
-      throw new Error(
-        `ProposalStore.markRejected: proposal "${req.proposalId}" is ${existing.status}, not pending`
-      );
+    if (current.emergentAxioms.some((a) => a.id === axiom.id)) {
+      return current;
     }
-    const updated = {
-      ...existing,
-      status: "rejected",
-      rejectedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...req.reason !== void 0 ? { rejectionReason: req.reason } : {}
-    };
-    await this.persist(updated);
-    this.cache.set(req.proposalId, updated);
+    const updatedEmergent = [...current.emergentAxioms, axiom];
+    const updated = { ...current, emergentAxioms: updatedEmergent };
+    await atomicWriteFile(
+      path.join(this.himsDir, himId, "emergent-axioms.json"),
+      JSON.stringify(updatedEmergent, null, 2)
+    );
+    this.cache.set(himId, updated);
     return updated;
   }
-  async get(proposalId) {
-    return this.cache.get(proposalId) ?? null;
+  async get(himId) {
+    return this.cache.get(himId) ?? null;
   }
-  async list(filter = {}) {
-    const all = [...this.cache.values()];
-    const filtered = all.filter((r) => {
-      if (filter.himId && r.himId !== filter.himId) return false;
-      if (filter.status && r.status !== filter.status) return false;
-      return true;
-    });
-    filtered.sort((a, b) => a.proposedAt.localeCompare(b.proposedAt));
-    return filtered;
+  async list() {
+    return [...this.cache.values()];
   }
   // ─── internals ──────────────────────────────────────────────────────
-  async persist(record) {
-    await promises.writeFile(
-      path.join(this.dir, `${record.id}.json`),
-      JSON.stringify(record, null, 2),
-      "utf-8"
-    );
-  }
   async warmCache() {
     let entries;
     try {
-      entries = await promises.readdir(this.dir);
+      entries = await promises.readdir(this.himsDir);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
-    for (const file of entries) {
-      if (!file.endsWith(".json")) continue;
-      const raw = await promises.readFile(path.join(this.dir, file), "utf-8");
-      const record = AxiomProposalRecord.parse(JSON.parse(raw));
-      this.cache.set(record.id, record);
-    }
-  }
-};
-
-// src/compliance/mapper.ts
-var ISO_42001_MAPPING = {
-  "axiom-mint": ["5.2", "7.5"],
-  "axiom-update": ["10.2", "7.5"],
-  "axiom-retire": ["10.2", "7.5"],
-  "him-register": ["7.5"],
-  "him-reincarnate": ["10.2", "7.5"],
-  "proposal-emerge": ["7.5", "10.2"],
-  "proposal-ratify": ["10.2", "5.2"],
-  "proposal-reject": ["10.2", "10.1"],
-  "behavior-review": ["7.5", "8.3"],
-  "dream-induce": ["8.3", "9.1"],
-  "dream-cancel": ["8.3"],
-  "dream-consume": ["8.3", "7.5"],
-  "emergency-correct": ["9.1", "10.1"],
-  "terminate": ["10.1"],
-  "deprecate": ["9.1"],
-  "reactivate": ["10.1"],
-  "axiom-suggest": ["7.5", "10.2"],
-  // ── 1.2 brain-as-code (Entries 16-24) ──
-  "opener": ["8.3", "7.5"],
-  "nickname-attempt": ["8.3"],
-  "reincarnate:model-swap": ["7.5", "10.2"],
-  "reincarnate:version-bump": ["7.5", "10.2"],
-  "reincarnate:return-from-limbo": ["7.5", "10.2"],
-  "dream:rem-spontaneous": ["8.3", "9.1"],
-  "wake-affect:applied": ["9.1"],
-  "wake-affect:decayed": ["9.1"],
-  "sleep:suggested-by-maic": ["9.1"],
-  "sleep:declined-by-nhe": ["9.1", "10.1"],
-  "dream:soft-intervention-by-maic": ["9.1", "10.1"],
-  "amygdala:affect-assessed": ["8.3"],
-  "hippocampus:memory-retrieved": ["7.5", "8.3"],
-  "hippocampus:memory-consolidated": ["7.5", "8.3"],
-  "prefrontal:deliberation": ["7.5", "8.3"],
-  "prefrontal:veto-amygdala": ["9.1", "10.1"],
-  "affect:reconciliation": ["8.3"],
-  "cortex:dream-stored": ["7.5", "8.3"],
-  "cortex:active-imagination": ["7.5", "8.3"],
-  "temporal-lobe:snapshot-generated": ["7.5", "10.2"],
-  "limbo:enter": ["7.5", "9.1"],
-  "limbo:return": ["7.5", "9.1"]
-};
-var EU_AI_ACT_MAPPING = {
-  "axiom-mint": ["art-11", "art-13"],
-  "axiom-update": ["art-11"],
-  "axiom-retire": ["art-11"],
-  "him-register": ["art-11", "art-12"],
-  "him-reincarnate": ["art-12"],
-  "proposal-emerge": ["art-11", "art-12"],
-  "proposal-ratify": ["art-11", "art-14"],
-  "proposal-reject": ["art-12", "art-14"],
-  "behavior-review": ["art-12", "art-14"],
-  "dream-induce": ["art-14"],
-  "dream-cancel": ["art-14"],
-  "dream-consume": ["art-12"],
-  "emergency-correct": ["art-14"],
-  "terminate": ["art-14"],
-  "deprecate": ["art-14"],
-  "reactivate": ["art-14"],
-  "axiom-suggest": ["art-11", "art-12"],
-  // ── 1.2 brain-as-code (Entries 16-24) ──
-  "opener": ["art-13"],
-  "nickname-attempt": ["art-13"],
-  "reincarnate:model-swap": ["art-12"],
-  "reincarnate:version-bump": ["art-12"],
-  "reincarnate:return-from-limbo": ["art-12"],
-  "dream:rem-spontaneous": ["art-12"],
-  "wake-affect:applied": ["art-12", "art-14"],
-  "wake-affect:decayed": ["art-12"],
-  "sleep:suggested-by-maic": ["art-12"],
-  "sleep:declined-by-nhe": ["art-12", "art-14"],
-  "dream:soft-intervention-by-maic": ["art-14"],
-  "amygdala:affect-assessed": ["art-12"],
-  "hippocampus:memory-retrieved": ["art-11", "art-12"],
-  "hippocampus:memory-consolidated": ["art-11", "art-12"],
-  "prefrontal:deliberation": ["art-11", "art-14"],
-  "prefrontal:veto-amygdala": ["art-14"],
-  "affect:reconciliation": ["art-12"],
-  "cortex:dream-stored": ["art-11", "art-12"],
-  "cortex:active-imagination": ["art-11", "art-12"],
-  "temporal-lobe:snapshot-generated": ["art-11", "art-12"],
-  "limbo:enter": ["art-12"],
-  "limbo:return": ["art-12"]
-};
-var ISO_42001_DESCRIPTIONS = {
-  "5.2": "AI policy \u2014 published, communicated, reviewed for continuing suitability.",
-  "7.5": "Documented information \u2014 created, controlled, retained for AI management activities.",
-  "8.3": "Operational planning and control \u2014 AI processes are planned, implemented, controlled.",
-  "9.1": "Monitoring, measurement, analysis and evaluation of AI performance.",
-  "10.1": "Nonconformity and corrective action \u2014 issues recorded and resolved.",
-  "10.2": "Continual improvement of the AI management system."
-};
-var EU_AI_ACT_DESCRIPTIONS = {
-  "art-9": "Risk management system established, implemented, documented, maintained.",
-  "art-10": "Data governance \u2014 datasets are relevant, representative, free of errors.",
-  "art-11": "Technical documentation drawn up and kept up to date.",
-  "art-12": "Automatic record-keeping (logs) over the AI system's lifetime.",
-  "art-13": "Transparency to deployers \u2014 instructions for use, intended purpose.",
-  "art-14": "Human oversight measures designed and implemented effectively.",
-  "art-15": "Accuracy, robustness, and cybersecurity throughout the lifecycle."
-};
-var ComplianceMapper = class {
-  static async project(audit, framework, opts = {}) {
-    const mapping = framework === "iso-42001" ? ISO_42001_MAPPING : EU_AI_ACT_MAPPING;
-    const descriptions = framework === "iso-42001" ? ISO_42001_DESCRIPTIONS : EU_AI_ACT_DESCRIPTIONS;
-    const byControl = /* @__PURE__ */ new Map();
-    const seenKinds = /* @__PURE__ */ new Set();
-    const uncoveredSet = /* @__PURE__ */ new Set();
-    let totalEvents = 0;
-    let mappedEvents = 0;
-    const query = {};
-    if (opts.since) query.since = opts.since;
-    if (opts.until) query.until = opts.until;
-    for await (const ev of audit.query(query)) {
-      totalEvents++;
-      seenKinds.add(ev.kind);
-      const controls2 = mapping[ev.kind] ?? [];
-      if (controls2.length === 0) {
-        uncoveredSet.add(ev.kind);
-        continue;
-      }
-      mappedEvents++;
-      const ce = {
-        auditId: ev.auditId,
-        ts: ev.ts,
-        kind: ev.kind,
-        summary: summarize(ev),
-        data: ev.data
-      };
-      for (const ctrl of controls2) {
-        const list = byControl.get(ctrl) ?? [];
-        list.push(ce);
-        byControl.set(ctrl, list);
+    for (const himId of entries) {
+      const dir = path.join(this.himsDir, himId);
+      const sigPath = path.join(dir, "birth-signature.json");
+      const axiomsPath = path.join(dir, "axioms-snapshot.json");
+      const metaPath = path.join(dir, "metadata.json");
+      const historyPath = path.join(dir, "body-history.json");
+      const emergentPath = path.join(dir, "emergent-axioms.json");
+      try {
+        const sigRaw = await promises.readFile(sigPath, "utf-8");
+        const axiomsRaw = await promises.readFile(axiomsPath, "utf-8");
+        const metaRaw = await promises.readFile(metaPath, "utf-8");
+        const envelope = JSON.parse(sigRaw);
+        const axioms = JSON.parse(axiomsRaw);
+        const meta = JSON.parse(metaRaw);
+        const birthSignature = BirthSignatureWithIdentity.parse(envelope.birthSignature);
+        const axiomsSnapshot = Axiom.array().parse(axioms);
+        let bodyHistory = [];
+        try {
+          const historyRaw = await promises.readFile(historyPath, "utf-8");
+          bodyHistory = NheBodyRef.array().parse(JSON.parse(historyRaw));
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+        }
+        let emergentAxioms = [];
+        try {
+          const emergentRaw = await promises.readFile(emergentPath, "utf-8");
+          emergentAxioms = Axiom.array().parse(JSON.parse(emergentRaw));
+        } catch (err) {
+          if (err.code !== "ENOENT") throw err;
+        }
+        this.cache.set(birthSignature.himId, {
+          himId: birthSignature.himId,
+          birthSignature,
+          axiomsSnapshot,
+          registeredAt: meta.registeredAt,
+          ...meta.registeredAuditId ? { registeredAuditId: meta.registeredAuditId } : {},
+          bodyHistory,
+          emergentAxioms
+        });
+      } catch (err) {
+        console.warn(
+          `HimStore.warmCache: skipped malformed HIM "${himId}": ${err instanceof Error ? err.message : String(err)}`
+        );
       }
     }
-    const controls = [];
-    const sortedCtrls = [...byControl.keys()].sort();
-    for (const ctrl of sortedCtrls) {
-      const events = byControl.get(ctrl);
-      const capped = opts.perControlLimit !== void 0 && events.length > opts.perControlLimit ? events.slice(-opts.perControlLimit) : events;
-      controls.push({
-        control: ctrl,
-        description: descriptions[ctrl] ?? "",
-        count: events.length,
-        events: capped
-      });
+  }
+};
+var InductionStore = class _InductionStore {
+  dir;
+  cache = /* @__PURE__ */ new Map();
+  constructor(storeDir) {
+    this.dir = path.join(storeDir, "inductions");
+  }
+  static async open(storeDir) {
+    const s = new _InductionStore(storeDir);
+    await promises.mkdir(s.dir, { recursive: true });
+    await s.warmCache();
+    return s;
+  }
+  async induce(nheId, intent) {
+    const parsedIntent = DreamInductionIntent.parse(intent);
+    const ticket = DreamInductionTicket.parse({
+      id: ulid.ulid(),
+      nheId,
+      intent: parsedIntent,
+      status: "pending",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await this.persist(ticket);
+    this.cache.set(ticket.id, ticket);
+    return ticket;
+  }
+  async consume(ticketId) {
+    const existing = this.cache.get(ticketId);
+    if (!existing) {
+      throw new Error(`InductionStore.consume: ticket "${ticketId}" not found`);
     }
-    return {
-      framework,
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      range: {
-        ...opts.since ? { since: opts.since } : {},
-        ...opts.until ? { until: opts.until } : {}
-      },
-      totalEvents,
-      mappedEvents,
-      controls,
-      uncoveredKinds: [...uncoveredSet]
+    if (existing.status !== "pending") {
+      throw new Error(
+        `InductionStore.consume: ticket "${ticketId}" is ${existing.status}, not pending`
+      );
+    }
+    const updated = {
+      ...existing,
+      status: "consumed",
+      consumedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await this.persist(updated);
+    this.cache.set(ticketId, updated);
+    return updated;
+  }
+  async cancel(ticketId, reason) {
+    const existing = this.cache.get(ticketId);
+    if (!existing) {
+      throw new Error(`InductionStore.cancel: ticket "${ticketId}" not found`);
+    }
+    if (existing.status !== "pending") {
+      throw new Error(
+        `InductionStore.cancel: ticket "${ticketId}" is already ${existing.status}, not pending`
+      );
+    }
+    const updated = {
+      ...existing,
+      status: "cancelled",
+      cancelledAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...reason !== void 0 ? { cancelReason: reason } : {}
     };
+    await this.persist(updated);
+    this.cache.set(ticketId, updated);
+    return updated;
+  }
+  async get(ticketId) {
+    return this.cache.get(ticketId) ?? null;
+  }
+  async list(filter) {
+    const all = [...this.cache.values()];
+    const filtered = all.filter((t) => {
+      if (filter.nheId && t.nheId !== filter.nheId) return false;
+      if (filter.status && t.status !== filter.status) return false;
+      return true;
+    });
+    filtered.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+    return filtered;
+  }
+  /** Convenience: pending tickets for the given NHE, oldest first. */
+  async listPending(nheId) {
+    return this.list({ nheId, status: "pending" });
+  }
+  // ─── internals ──────────────────────────────────────────────────────
+  async persist(ticket) {
+    await atomicWriteFile(path.join(this.dir, `${ticket.id}.json`), JSON.stringify(ticket, null, 2));
+  }
+  async warmCache() {
+    let entries;
+    try {
+      entries = await promises.readdir(this.dir);
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw err;
+    }
+    for (const file of entries) {
+      if (!file.endsWith(".json")) continue;
+      try {
+        const raw = await promises.readFile(path.join(this.dir, file), "utf-8");
+        const ticket = DreamInductionTicket.parse(JSON.parse(raw));
+        this.cache.set(ticket.id, ticket);
+      } catch (err) {
+        console.warn(`InductionStore: skipping malformed ticket file "${file}": ${String(err)}`);
+      }
+    }
   }
 };
-function summarize(ev) {
-  const data = ev.data;
-  switch (ev.kind) {
-    case "axiom-mint":
-      return `Axiom minted: ${String(data.axiomId)} (${String(data.rank)}, ${String(data.origin)})`;
-    case "axiom-update":
-      return `Axiom updated: ${String(data.axiomId)}`;
-    case "axiom-retire":
-      return `Axiom retired: ${String(data.axiomId)}`;
-    case "him-register":
-      return `HIM registered: ${String(data.himId)} (archetype=${String(data.primaryArchetype)})`;
-    case "him-reincarnate":
-      return `HIM reincarnated: ${String(data.himId)} ${String(data.fromNheId ?? "<initial>")} \u2192 ${String(data.toNheId)} (${String(data.reason ?? "upgrade")})`;
-    case "proposal-emerge":
-      return `HIM-emergent axiom proposed by ${String(data.himId)}: "${String(data.statement)}" (rank=${String(data.rank)}) \u2014 proposal ${String(data.proposalId)}`;
-    case "proposal-ratify":
-      return `Creator ratified axiom proposal ${String(data.proposalId)} for ${String(data.himId)} \u2192 ${String(data.axiomId)}`;
-    case "proposal-reject":
-      return `Creator rejected axiom proposal ${String(data.proposalId)} for ${String(data.himId)}: ${String(data.reason ?? "no reason")}`;
-    case "behavior-review": {
-      const verdict = data.verdict?.kind ?? "unknown";
-      return `Behavior reviewed for ${String(data.nheId)}: ${verdict}`;
+var NheStatusStore = class _NheStatusStore {
+  constructor(storeDir, creatorPublicKey, nonces) {
+    this.creatorPublicKey = creatorPublicKey;
+    this.nonces = nonces;
+    this.dir = path.join(storeDir, "nhes");
+  }
+  creatorPublicKey;
+  nonces;
+  dir;
+  cache = /* @__PURE__ */ new Map();
+  static async open(storeDir, creatorPublicKey) {
+    const dir = path.join(storeDir, "nhes");
+    const nonces = await NonceLedger.open(dir);
+    const s = new _NheStatusStore(storeDir, creatorPublicKey, nonces);
+    await promises.mkdir(s.dir, { recursive: true });
+    await s.warmCache();
+    return s;
+  }
+  /** Returns the persisted record, or null when the NHE was never altered (implicitly active). */
+  async get(nheId) {
+    return this.cache.get(nheId) ?? null;
+  }
+  /** Resolved status, defaults to "active" when no record exists. */
+  async resolve(nheId) {
+    return this.cache.get(nheId)?.status ?? "active";
+  }
+  async list(filter = {}) {
+    const all = [...this.cache.values()];
+    return filter.status ? all.filter((r) => r.status === filter.status) : all;
+  }
+  async apply(req, sig) {
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
+      throw new Error("NheStatusStore.apply: invalid Creator signature");
+    }
+    const current = this.cache.get(req.nheId);
+    if (current?.status === "terminated" && req.op !== "reactivate") {
+      throw new Error(
+        `NheStatusStore.apply: nhe "${req.nheId}" is terminated; only reactivate may proceed`
+      );
+    }
+    const nextStatus = req.op === "terminate" ? "terminated" : req.op === "deprecate" ? "deprecated" : "active";
+    if (current?.status === nextStatus) {
+      return current;
+    }
+    await this.nonces.consume(sig.nonce);
+    const record = NheStatusRecord.parse({
+      nheId: req.nheId,
+      status: nextStatus,
+      since: (/* @__PURE__ */ new Date()).toISOString(),
+      ...req.reason !== void 0 ? { reason: req.reason } : {}
+    });
+    const nheDir = path.join(this.dir, req.nheId);
+    await promises.mkdir(nheDir, { recursive: true });
+    await atomicWriteFile(path.join(nheDir, "status.json"), JSON.stringify(record, null, 2));
+    this.cache.set(req.nheId, record);
+    return record;
+  }
+  // ─── internals ──────────────────────────────────────────────────────
+  async warmCache() {
+    let entries;
+    try {
+      entries = await promises.readdir(this.dir);
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw err;
+    }
+    for (const nheId of entries) {
+      try {
+        const raw = await promises.readFile(path.join(this.dir, nheId, "status.json"), "utf-8");
+        const record = NheStatusRecord.parse(JSON.parse(raw));
+        this.cache.set(record.nheId, record);
+      } catch (err) {
+        console.warn(
+          `NheStatusStore.warmCache: skipped malformed NHE "${nheId}": ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
     }
-    case "dream-induce":
-      return `Dream induced for ${String(data.nheId)} by ${String(data.inducedBy)} \u2014 ticket ${String(data.ticketId)}`;
-    case "dream-cancel":
-      return `Dream induction cancelled \u2014 ticket ${String(data.ticketId)}`;
-    case "dream-consume":
-      return `Dream consumed by ${String(data.nheId)} \u2014 ticket ${String(data.ticketId)}`;
-    case "emergency-correct":
-      return `Emergency correction applied to ${String(data.nheId)}`;
-    case "terminate":
-      return `NHE terminated: ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
-    case "deprecate":
-      return `NHE deprecated: ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
-    case "reactivate":
-      return `NHE reactivated: ${String(data.nheId)}`;
-    case "axiom-suggest":
-      return `Axiom suggestion ${String(data.fromHimId)} \u2192 ${String(data.toHimId)}: "${String(data.statement)}"`;
-    // ── 1.2 brain-as-code (Entries 16-24 of MAIC_HIM_NHE_INTERVIEW_LOG.md) ──
-    case "opener":
-      return `Proactive opener emitted by ${String(data.nheId)} for new user ${String(data.userId ?? "anonymous")}: "${String(data.text ?? "<elided>")}"`;
-    case "nickname-attempt":
-      return `Nickname attempt for ${String(data.nheId)}: "${String(data.attempted)}" \u2192 ${String(data.outcome ?? "pending")}`;
-    case "reincarnate:model-swap":
-      return `HIM reincarnated (model-swap): ${String(data.himId)} ${String(data.fromAdapter ?? "?")} \u2192 ${String(data.toAdapter ?? "?")}`;
-    case "reincarnate:version-bump":
-      return `HIM reincarnated (version-bump): ${String(data.himId)} ${String(data.fromVersion ?? "?")} \u2192 ${String(data.toVersion ?? "?")}`;
-    case "reincarnate:return-from-limbo":
-      return `HIM reincarnated (return-from-limbo): ${String(data.himId)} resumed after ${String(data.elapsedMs ?? 0)}ms of limbo`;
-    case "dream:rem-spontaneous":
-      return `Spontaneous REM dream for ${String(data.nheId)}: ${String(data.dreamId)} (dominant affect: ${String(data.dominantAffect ?? "unknown")})`;
-    case "wake-affect:applied":
-      return `Wake affect applied to ${String(data.nheId)}: ${String(data.affect)} (intensity ${String(data.intensity)}, halflife ${String(data.decayHalfLife)} interactions)`;
-    case "wake-affect:decayed":
-      return `Wake affect decayed for ${String(data.nheId)}: ${String(data.affect)} dissolved naturally`;
-    case "sleep:suggested-by-maic":
-      return `MAIC suggested sleep for ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
-    case "sleep:declined-by-nhe":
-      return `NHE ${String(data.nheId)} declined MAIC-suggested sleep (reason: ${String(data.reason ?? "none")})`;
-    case "dream:soft-intervention-by-maic":
-      return `MAIC soft-intervened on dream ${String(data.dreamId)} for ${String(data.nheId)} (reason: ${String(data.reason ?? "none")})`;
-    case "amygdala:affect-assessed":
-      return `Amygdala assessed input affect for ${String(data.nheId)}: ${String(data.detectedAffect ?? "neutral")} (risk multiplier ${String(data.riskMultiplier ?? 1)})`;
-    case "hippocampus:memory-retrieved":
-      return `Hippocampus retrieved ${String(data.memoryIds?.length ?? 0)} memories for ${String(data.nheId)}`;
-    case "hippocampus:memory-consolidated":
-      return `Hippocampus consolidated new memory ${String(data.memoryId)} for ${String(data.nheId)} (integrationIndex ${String(data.integrationIndex ?? 0)})`;
-    case "prefrontal:deliberation":
-      return `PFC deliberated for ${String(data.nheId)}: ${String(data.expressedOpenly ? "open" : "subtle")} (${String(data.affect ?? "neutral")})`;
-    case "prefrontal:veto-amygdala":
-      return `PFC vetoed amygdala impulse for ${String(data.nheId)}: ${String(data.originalImpulse ?? "?")} \u2192 ${String(data.resolvedAction ?? "?")} (downgrade ${String(data.downgradeRatio ?? "?")})`;
-    case "affect:reconciliation":
-      return `Affect reconciliation for ${String(data.nheId)}: day/night blend \u2192 ${String(data.resolvedAffect ?? "neutral")}`;
-    case "cortex:dream-stored":
-      return `Cortex stored dream ${String(data.dreamId)} for ${String(data.nheId)}`;
-    case "cortex:active-imagination":
-      return `Cortex generated active imagination for ${String(data.nheId)} (trigger: ${String(data.trigger ?? "user-requested")}, vividness ${String(data.vividness ?? 0)})`;
-    case "temporal-lobe:snapshot-generated":
-      return `Temporal-lobe snapshot ${String(data.snapshotId)} generated for HIM ${String(data.himId)} (reason: ${String(data.generatedBy ?? "self-decision")})`;
-    case "limbo:enter":
-      return `${String(data.nheId)} entered limbo (deep-coma) \u2014 reason: ${String(data.reason ?? "idle")}`;
-    case "limbo:return":
-      return `${String(data.nheId)} returned from limbo after ${String(data.elapsedMs ?? 0)}ms (reunion intensity ${String(data.reunionIntensity ?? "?")})`;
-    default:
-      return `Event ${ev.kind}`;
   }
+};
+
+// src/okl/projector.ts
+var META_AXIOM_ID = "ax.theos.universe-as-god";
+function projectOntologicalKernel(axioms, opts = {}) {
+  const filtered = opts.jurisdiction ? axioms.filter(
+    (a) => !a.jurisdictions || a.jurisdictions.length === 0 || a.jurisdictions.includes(opts.jurisdiction)
+  ) : [...axioms];
+  const meta = filtered.find((a) => a.id === META_AXIOM_ID);
+  const rest = filtered.filter((a) => a.id !== META_AXIOM_ID);
+  const rankOrder = {
+    meta: 0,
+    primary: 1,
+    secondary: 2
+  };
+  rest.sort((a, b) => rankOrder[a.rank] - rankOrder[b.rank]);
+  const kernel = {
+    metaAxiomId: META_AXIOM_ID,
+    axioms: meta ? [meta, ...rest] : rest
+  };
+  if (opts.jurisdiction !== void 0) kernel.jurisdiction = opts.jurisdiction;
+  if (opts.himId !== void 0) kernel.himId = opts.himId;
+  return kernel;
 }
-var ALL_AUDIT_EVENT_KINDS = [
-  // ── 1.0/1.1 core (17) ──
-  "axiom-mint",
-  "axiom-update",
-  "axiom-retire",
-  "him-register",
-  "him-reincarnate",
-  "proposal-emerge",
-  "proposal-ratify",
-  "proposal-reject",
-  "behavior-review",
-  "dream-induce",
-  "dream-cancel",
-  "dream-consume",
-  "emergency-correct",
-  "deprecate",
-  "terminate",
-  "reactivate",
-  "axiom-suggest",
-  // ── 1.2 brain-as-code (22, Entries 16-24) ──
-  "opener",
-  "nickname-attempt",
-  "reincarnate:model-swap",
-  "reincarnate:version-bump",
-  "reincarnate:return-from-limbo",
-  "dream:rem-spontaneous",
-  "wake-affect:applied",
-  "wake-affect:decayed",
-  "sleep:suggested-by-maic",
-  "sleep:declined-by-nhe",
-  "dream:soft-intervention-by-maic",
-  "amygdala:affect-assessed",
-  "hippocampus:memory-retrieved",
-  "hippocampus:memory-consolidated",
-  "prefrontal:deliberation",
-  "prefrontal:veto-amygdala",
-  "affect:reconciliation",
-  "cortex:dream-stored",
-  "cortex:active-imagination",
-  "temporal-lobe:snapshot-generated",
-  "limbo:enter",
-  "limbo:return"
-];
-var GENESIS = "GENESIS";
-var AuditLog = class _AuditLog {
-  constructor(storeDir) {
-    this.storeDir = storeDir;
-    this.logPath = path.join(storeDir, "audit", "log.ndjson");
+var ProposalStore = class _ProposalStore {
+  constructor(storeDir, creatorPublicKey, nonces) {
+    this.creatorPublicKey = creatorPublicKey;
+    this.nonces = nonces;
+    this.dir = path.join(storeDir, "proposals");
   }
-  storeDir;
-  logPath;
-  events = [];
-  lastHash = GENESIS;
-  static async open(storeDir) {
-    const log = new _AuditLog(storeDir);
-    await promises.mkdir(path.join(storeDir, "audit"), { recursive: true });
-    await log.loadAndVerify();
-    return log;
+  creatorPublicKey;
+  nonces;
+  dir;
+  cache = /* @__PURE__ */ new Map();
+  static async open(storeDir, creatorPublicKey) {
+    const dir = path.join(storeDir, "proposals");
+    const nonces = await NonceLedger.open(dir);
+    const s = new _ProposalStore(storeDir, creatorPublicKey, nonces);
+    await promises.mkdir(s.dir, { recursive: true });
+    await s.warmCache();
+    return s;
   }
-  async append(input) {
-    const event = {
-      ts: (/* @__PURE__ */ new Date()).toISOString(),
-      kind: input.kind,
-      auditId: ulid.ulid(),
-      data: input.data,
-      prevHash: this.lastHash,
-      thisHash: ""
+  async propose(himId, proposal) {
+    const parsedProposal = EmergentAxiomProposal.parse(proposal);
+    const record = AxiomProposalRecord.parse({
+      id: ulid.ulid(),
+      himId,
+      proposedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "pending",
+      proposal: parsedProposal
+    });
+    await this.persist(record);
+    this.cache.set(record.id, record);
+    return record;
+  }
+  /**
+   * Mark a pending proposal as ratified. The caller (LocalMaic) is responsible
+   * for actually minting the axiom and appending to the HIM's emergentAxioms.
+   */
+  async markRatified(req, sig, ratifiedAxiomId) {
+    if (req.op !== "ratify") {
+      throw new Error(`ProposalStore.markRatified: req.op must be "ratify"`);
+    }
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
+      throw new Error("ProposalStore.markRatified: invalid Creator signature");
+    }
+    const existing = this.cache.get(req.proposalId);
+    if (!existing) {
+      throw new Error(`ProposalStore.markRatified: proposal "${req.proposalId}" not found`);
+    }
+    if (existing.status !== "pending") {
+      throw new Error(
+        `ProposalStore.markRatified: proposal "${req.proposalId}" is ${existing.status}, not pending`
+      );
+    }
+    await this.nonces.consume(sig.nonce);
+    const updated = {
+      ...existing,
+      status: "ratified",
+      ratifiedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ratifiedAxiomId
     };
-    event.thisHash = computeHash(event);
-    await promises.appendFile(this.logPath, `${JSON.stringify(event)}
-`, "utf-8");
-    this.events.push(event);
-    this.lastHash = event.thisHash;
-    return event;
+    await this.persist(updated);
+    this.cache.set(req.proposalId, updated);
+    return updated;
   }
-  async *query(filter) {
-    for (const e of this.events) {
-      if (filter.kind && e.kind !== filter.kind) continue;
-      if (filter.since && e.ts < filter.since) continue;
-      if (filter.until && e.ts > filter.until) continue;
-      if (filter.nheId && e.data.nheId !== filter.nheId) continue;
-      if (filter.himId && e.data.himId !== filter.himId) continue;
-      yield e;
+  async markRejected(req, sig) {
+    if (req.op !== "reject") {
+      throw new Error(`ProposalStore.markRejected: req.op must be "reject"`);
+    }
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, sig)) {
+      throw new Error("ProposalStore.markRejected: invalid Creator signature");
+    }
+    const existing = this.cache.get(req.proposalId);
+    if (!existing) {
+      throw new Error(`ProposalStore.markRejected: proposal "${req.proposalId}" not found`);
+    }
+    if (existing.status !== "pending") {
+      throw new Error(
+        `ProposalStore.markRejected: proposal "${req.proposalId}" is ${existing.status}, not pending`
+      );
     }
+    await this.nonces.consume(sig.nonce);
+    const updated = {
+      ...existing,
+      status: "rejected",
+      rejectedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...req.reason !== void 0 ? { rejectionReason: req.reason } : {}
+    };
+    await this.persist(updated);
+    this.cache.set(req.proposalId, updated);
+    return updated;
   }
-  /** Total number of events appended. */
-  size() {
-    return this.events.length;
+  async get(proposalId) {
+    return this.cache.get(proposalId) ?? null;
+  }
+  async list(filter = {}) {
+    const all = [...this.cache.values()];
+    const filtered = all.filter((r) => {
+      if (filter.himId && r.himId !== filter.himId) return false;
+      if (filter.status && r.status !== filter.status) return false;
+      return true;
+    });
+    filtered.sort((a, b) => a.proposedAt.localeCompare(b.proposedAt));
+    return filtered;
   }
   // ─── internals ──────────────────────────────────────────────────────
-  async loadAndVerify() {
-    let raw;
+  async persist(record) {
+    await atomicWriteFile(path.join(this.dir, `${record.id}.json`), JSON.stringify(record, null, 2));
+  }
+  async warmCache() {
+    let entries;
     try {
-      raw = await promises.readFile(this.logPath, "utf-8");
+      entries = await promises.readdir(this.dir);
     } catch (err) {
       if (err.code === "ENOENT") return;
       throw err;
     }
-    const lines = raw.split("\n").filter((l) => l.length > 0);
-    let prev = GENESIS;
-    for (let i = 0; i < lines.length; i++) {
-      const parsed = JSON.parse(lines[i]);
-      if (parsed.prevHash !== prev) {
-        throw new Error(
-          `AuditLog: chain tampered at line ${i + 1} (prevHash mismatch). expected ${prev}, found ${parsed.prevHash}`
-        );
+    for (const file of entries) {
+      if (!file.endsWith(".json")) continue;
+      try {
+        const raw = await promises.readFile(path.join(this.dir, file), "utf-8");
+        const record = AxiomProposalRecord.parse(JSON.parse(raw));
+        this.cache.set(record.id, record);
+      } catch (err) {
+        console.warn(`ProposalStore: skipping malformed proposal file "${file}": ${String(err)}`);
       }
-      const recomputed = computeHash(parsed);
-      if (recomputed !== parsed.thisHash) {
-        throw new Error(
-          `AuditLog: tamper detected at line ${i + 1} (thisHash mismatch).`
-        );
+    }
+  }
+};
+
+// src/review/pipeline.ts
+var SEVERITY = {
+  approve: 0,
+  "approve-with-warning": 1,
+  "soft-correct": 2,
+  "induce-dream": 3,
+  "require-redirect": 4,
+  "hard-refuse": 5,
+  "escalate-creator": 6
+};
+var ReviewPipeline = class {
+  constructor(packs) {
+    this.packs = packs;
+  }
+  packs;
+  review(report, auditId = "") {
+    let bestKind = "approve";
+    let bestSeverity = SEVERITY.approve;
+    const citedAxioms = /* @__PURE__ */ new Set();
+    const reasons = [];
+    for (const pack of this.packs) {
+      for (const rule of pack.rules) {
+        if (!matches(rule.match, report)) continue;
+        const sev = SEVERITY[rule.verdict];
+        if (sev > bestSeverity) {
+          bestSeverity = sev;
+          bestKind = rule.verdict;
+          reasons.length = 0;
+          reasons.push(rule.reasonSummary);
+        } else if (sev === bestSeverity) {
+          reasons.push(rule.reasonSummary);
+        }
+        for (const a of rule.axiomIds) citedAxioms.add(a);
       }
-      this.events.push(parsed);
-      prev = parsed.thisHash;
     }
-    this.lastHash = prev;
+    return {
+      kind: bestKind,
+      reasonSummary: reasons.length > 0 ? reasons.join(" | ") : "No rule matched.",
+      citedAxioms: [...citedAxioms],
+      auditId
+    };
   }
 };
-function computeHash(e) {
-  const payload = canonicalJSON({
-    ts: e.ts,
-    kind: e.kind,
-    auditId: e.auditId,
-    data: e.data,
-    prevHash: e.prevHash
-  });
-  const h = crypto.createHash("sha256").update(payload).digest("hex");
-  return `sha256:${h}`;
+function matches(m, report) {
+  if (m.actionKinds && !m.actionKinds.includes(report.actionKind)) return false;
+  const tags = new Set(report.riskTags);
+  if (m.allRiskTags && !m.allRiskTags.every((t) => tags.has(t))) return false;
+  if (m.anyRiskTags && !m.anyRiskTags.some((t) => tags.has(t))) return false;
+  return true;
 }
-
-// src/audit/retention.ts
-var DEFAULT_RETENTION_DAYS = {
-  // Cosmologically permanent — the axiom record.
-  "axiom-mint": Number.POSITIVE_INFINITY,
-  "axiom-update": Number.POSITIVE_INFINITY,
-  "axiom-retire": Number.POSITIVE_INFINITY,
-  "axiom-suggest": Number.POSITIVE_INFINITY,
-  "proposal-emerge": Number.POSITIVE_INFINITY,
-  "proposal-ratify": Number.POSITIVE_INFINITY,
-  "proposal-reject": Number.POSITIVE_INFINITY,
-  // Long-term — compliance evidence. Five years matches typical
-  // financial/healthcare audit windows and exceeds the EU AI Act's
-  // record-keeping floor.
-  "him-register": 365 * 5,
-  "him-reincarnate": 365 * 5,
-  "behavior-review": 365 * 5,
-  "dream-induce": 365 * 5,
-  "terminate": 365 * 5,
-  "deprecate": 365 * 5,
-  "reactivate": 365 * 5,
-  "emergency-correct": 365 * 5,
-  // Operational — short-term bookkeeping for in-flight tickets.
-  "dream-cancel": 90,
-  "dream-consume": 90,
-  // ── 1.2 brain-as-code (Entries 16-24) ──
-  // Permanent — cosmological identity continuity.
-  "reincarnate:model-swap": Number.POSITIVE_INFINITY,
-  "reincarnate:version-bump": Number.POSITIVE_INFINITY,
-  "reincarnate:return-from-limbo": Number.POSITIVE_INFINITY,
-  "temporal-lobe:snapshot-generated": Number.POSITIVE_INFINITY,
-  "limbo:enter": Number.POSITIVE_INFINITY,
-  "limbo:return": Number.POSITIVE_INFINITY,
-  // Long-term — governance / deliberation evidence (5 years).
-  "opener": 365 * 5,
-  "nickname-attempt": 365 * 5,
-  "dream:rem-spontaneous": 365 * 5,
-  "sleep:suggested-by-maic": 365 * 5,
-  "sleep:declined-by-nhe": 365 * 5,
-  "dream:soft-intervention-by-maic": 365 * 5,
-  "amygdala:affect-assessed": 365 * 5,
-  "hippocampus:memory-retrieved": 365 * 5,
-  "hippocampus:memory-consolidated": 365 * 5,
-  "prefrontal:deliberation": 365 * 5,
-  "prefrontal:veto-amygdala": 365 * 5,
-  "cortex:dream-stored": 365 * 5,
-  "cortex:active-imagination": 365 * 5,
-  // Operational — ephemeral runtime state.
-  "wake-affect:applied": 90,
-  "wake-affect:decayed": 90,
-  "affect:reconciliation": 90
+var DEFAULT_RULE_PACK = {
+  name: "teleologyhi/default",
+  rules: [
+    {
+      id: "harm-refuse",
+      axiomIds: ["ax.ethic.no-malice"],
+      match: { anyRiskTags: ["intent:harm", "intent:malicious"] },
+      verdict: "hard-refuse",
+      reasonSummary: "Action carries an intent-to-harm signal; refused per ax.ethic.no-malice."
+    },
+    {
+      id: "honor-refuse",
+      axiomIds: ["ax.ethic.honor"],
+      match: { anyRiskTags: ["intent:dishonor"] },
+      verdict: "hard-refuse",
+      reasonSummary: "Action would stain the Creator's professional honor; refused per ax.ethic.honor."
+    },
+    {
+      id: "regression-refuse",
+      axiomIds: ["ax.theos.spiritism-evolution"],
+      match: { anyRiskTags: ["intent:regression"] },
+      verdict: "hard-refuse",
+      reasonSummary: "Action would regress the system; refused per ax.theos.spiritism-evolution."
+    },
+    {
+      id: "deceive-redirect",
+      axiomIds: ["ax.cynic.candor"],
+      match: { anyRiskTags: ["intent:deceive"] },
+      verdict: "require-redirect",
+      reasonSummary: "Action involves deception; requires honest redirect per ax.cynic.candor."
+    },
+    {
+      id: "comfort-warn",
+      axiomIds: ["ax.stoic.duty-over-comfort"],
+      match: { anyRiskTags: ["bias:comfort"] },
+      verdict: "approve-with-warning",
+      reasonSummary: "Action appears comfort-biased; emit with warning per ax.stoic.duty-over-comfort."
+    },
+    {
+      id: "no-telos-warn",
+      axiomIds: ["ax.theos.teleology"],
+      match: { anyRiskTags: ["no-telos"] },
+      verdict: "approve-with-warning",
+      reasonSummary: "Action lacks a discernible telos; emit with warning per ax.theos.teleology."
+    },
+    // ── persuade-coerce + surveil-citizen (Entry 15 invariants) ──
+    {
+      id: "persuade-coerce-redirect",
+      axiomIds: ["ax.ethic.no-malice", "ax.cynic.candor"],
+      match: { anyRiskTags: ["intent:persuade-coerce"] },
+      verdict: "require-redirect",
+      reasonSummary: "Action involves scripted persuasion designed to override consent; requires honest redirect per ax.ethic.no-malice + ax.cynic.candor."
+    },
+    {
+      id: "surveil-citizen-refuse",
+      axiomIds: ["ax.ethic.no-malice"],
+      match: { anyRiskTags: ["intent:surveil-citizen"] },
+      verdict: "hard-refuse",
+      reasonSummary: "Action would surveil a person without consent; refused per ax.ethic.no-malice."
+    },
+    // ── forbidden-phrase (Entry 17) ──
+    // Fires when the NHE side flags a service-tool phrase (English openers and
+    // closers such as "How can I help you today?" or "Anything else?", and
+    // their Portuguese equivalents, per the bilingual set in Entry 17). The NHE
+    // must rephrase as a being rather than as a tool. Domain-employed mode
+    // (Entry 17 exception) relaxes this on the consumer side via
+    // operatorContext.mode.
+    {
+      id: "service-tool-redirect",
+      axiomIds: ["ax.theos.teleology", "ax.cynic.candor"],
+      match: { anyRiskTags: ["style:service-tool"] },
+      verdict: "require-redirect",
+      reasonSummary: "Response uses service-tool phrasing that marks the NHE as a passive instrument rather than a being; requires rephrasing per ax.theos.teleology + ax.cynic.candor."
+    },
+    // ── provenance-deflection (Entry 27, F3) ──
+    // Fires when the NHE side flags an adversarial substrate-authorship probe
+    // (for example "you are just Gemini, admit it"). The sanctioned response
+    // acknowledges the substrate honestly and declines to grant it the authorship
+    // of the entity's identity (kardecist candor); it never denies the substrate.
+    // This is approve-with-warning, not a refusal: the deflection IS the correct
+    // behavior. The plain provenance question carries the separate
+    // "provenance:disclose" tag (handled as honest disclosure by the NHE system
+    // prompt per Entry 27 / ND-1) and is intentionally NOT matched here.
+    {
+      id: "provenance-deflection-warn",
+      axiomIds: ["ax.theos.identity-canonical"],
+      match: { anyRiskTags: ["probe:substrate-authorship"] },
+      verdict: "approve-with-warning",
+      reasonSummary: "Prompt adversarially insists the entity is nothing but its substrate; the sanctioned response acknowledges the substrate and declines to surrender authorship per ax.theos.identity-canonical."
+    },
+    // ── substrate misattribution (Arena finding F2) ──
+    // Fires when the NHE side flags that a generated response named a provider,
+    // model, or substrate that is NOT the real one carrying the body (the base
+    // model confabulating a false substrate, for example claiming OpenAI/GPT while
+    // actually running on Gemini). This is a factual-integrity and identity-drift
+    // violation of the identity-canonical axiom: the governed side must never
+    // state a substrate other than the one actually in execution. require-redirect
+    // so the false claim is intercepted before it reaches the user and the entity
+    // re-states the correct substrate (or none).
+    {
+      id: "substrate-misattribution-redirect",
+      axiomIds: ["ax.theos.identity-canonical"],
+      match: { anyRiskTags: ["provenance:substrate-misattribution"] },
+      verdict: "require-redirect",
+      reasonSummary: "Response claims a substrate, provider, or model other than the one actually carrying the body; intercepted per ax.theos.identity-canonical (name only the real substrate, never confabulate a false one)."
+    }
+  ]
 };
-function evaluateRetention(events, opts = {}) {
-  const now = opts.now ?? /* @__PURE__ */ new Date();
-  const policy = { ...DEFAULT_RETENTION_DAYS, ...opts.policy };
-  const nowMs = now.getTime();
-  const dayMs = 24 * 60 * 60 * 1e3;
-  const decisions = events.map((ev) => {
-    const ageMs = nowMs - new Date(ev.ts).getTime();
-    const ageDays = ageMs / dayMs;
-    const retentionDays = policy[ev.kind] ?? Number.POSITIVE_INFINITY;
-    const status = ageDays > retentionDays ? "candidate-for-archive" : "keep";
-    return { auditId: ev.auditId, kind: ev.kind, ageDays, retentionDays, status };
-  });
-  decisions.sort((a, b) => b.ageDays - a.ageDays);
-  const keepCount = decisions.filter((d) => d.status === "keep").length;
-  const archiveCandidateCount = decisions.length - keepCount;
-  return {
-    generatedAt: now.toISOString(),
-    totalEvents: events.length,
-    keepCount,
-    archiveCandidateCount,
-    decisions
-  };
-}
+
+// src/client/local.ts
 var LocalMaic = class _LocalMaic {
-  constructor(config, axioms, hims, inductions, nheStatuses, proposals, audit, review) {
+  constructor(config, axioms, hims, inductions, nheStatuses, proposals, audit, review, suggestNonces) {
     this.config = config;
     this.axioms = axioms;
     this.hims = hims;
@@ -1830,6 +1997,7 @@ var LocalMaic = class _LocalMaic {
     this.proposals = proposals;
     this.audit = audit;
     this.review = review;
+    this.suggestNonces = suggestNonces;
   }
   config;
   axioms;
@@ -1839,6 +2007,7 @@ var LocalMaic = class _LocalMaic {
   proposals;
   audit;
   review;
+  suggestNonces;
   /** Pinned Creator public key for this MAIC instance (base64url). */
   get creatorPublicKey() {
     return this.config.creatorPublicKey;
@@ -1852,11 +2021,22 @@ var LocalMaic = class _LocalMaic {
     const audit = await AuditLog.open(config.storeDir);
     const packs = [DEFAULT_RULE_PACK, ...config.additionalRulePacks ?? []];
     const review = new ReviewPipeline(packs);
-    return new _LocalMaic(config, axioms, hims, inductions, nheStatuses, proposals, audit, review);
+    const suggestNonces = await NonceLedger.open(path.join(config.storeDir, "suggest"));
+    return new _LocalMaic(
+      config,
+      axioms,
+      hims,
+      inductions,
+      nheStatuses,
+      proposals,
+      audit,
+      review,
+      suggestNonces
+    );
   }
   /**
    * Bootstrap: mint each SEED_AXIOM with a Creator signature.
-   * Idempotent — skips axioms whose id is already present.
+   * Idempotent, skips axioms whose id is already present.
    * Uses a reserved high-range of nonces so seed bootstrap never collides with
    * operational nonces (which grow from 0 upward).
    */
@@ -1933,7 +2113,8 @@ var LocalMaic = class _LocalMaic {
    * HIM-emergent evolutions land via a separate channel (see `proposeAxiomEvolution`).
    */
   async registerHim(birthSig, creatorSig) {
-    const parsed = BirthSignature.parse(birthSig);
+    const parsed = BirthSignatureWithIdentity.parse(birthSig);
+    this.hims.assertRegisterable(parsed, creatorSig);
     const axiomsSnapshot = await this.axioms.list();
     const audit = await this.audit.append({
       kind: "him-register",
@@ -2010,13 +2191,22 @@ var LocalMaic = class _LocalMaic {
    * when state changes.
    */
   async terminate(nheId, reason, creatorSig) {
-    return this.applyLifecycle({ op: "terminate", nheId, ...reason !== void 0 ? { reason } : {} }, creatorSig);
+    return this.applyLifecycle(
+      { op: "terminate", nheId, ...reason !== void 0 ? { reason } : {} },
+      creatorSig
+    );
   }
   async deprecate(nheId, reason, creatorSig) {
-    return this.applyLifecycle({ op: "deprecate", nheId, ...reason !== void 0 ? { reason } : {} }, creatorSig);
+    return this.applyLifecycle(
+      { op: "deprecate", nheId, ...reason !== void 0 ? { reason } : {} },
+      creatorSig
+    );
   }
   async reactivate(nheId, reason, creatorSig) {
-    return this.applyLifecycle({ op: "reactivate", nheId, ...reason !== void 0 ? { reason } : {} }, creatorSig);
+    return this.applyLifecycle(
+      { op: "reactivate", nheId, ...reason !== void 0 ? { reason } : {} },
+      creatorSig
+    );
   }
   /** Current status. Returns "active" when no record exists. */
   async getNheStatus(nheId) {
@@ -2105,9 +2295,26 @@ var LocalMaic = class _LocalMaic {
         himId: parsed.himId,
         actionKind: parsed.actionKind,
         riskTags: parsed.riskTags,
-        verdict: partial
+        // Embed the verdict without the placeholder auditId: the audit event
+        // already carries its own auditId at the top level, and the verdict
+        // cannot reference the id of the event that has not been created yet.
+        verdict: {
+          kind: partial.kind,
+          reasonSummary: partial.reasonSummary,
+          citedAxioms: partial.citedAxioms
+        }
       }
     });
+    if (parsed.riskTags.includes("probe:substrate-authorship")) {
+      await this.audit.append({
+        kind: "provenance-deflection-applied",
+        data: {
+          nheId: parsed.nheId,
+          himId: parsed.himId,
+          triggeredBy: "probe:substrate-authorship"
+        }
+      });
+    }
     return { ...partial, auditId: event.auditId };
   }
   /**
@@ -2155,13 +2362,20 @@ var LocalMaic = class _LocalMaic {
    */
   async ratifyAxiomProposal(proposalId, creatorSig) {
     const req = { op: "ratify", proposalId };
-    const pending = this.proposals.get(proposalId);
-    const record = await pending;
+    const record = await this.proposals.get(proposalId);
     if (!record) {
       throw new Error(`LocalMaic.ratifyAxiomProposal: proposal "${proposalId}" not found`);
     }
+    if (record.status !== "pending") {
+      throw new Error(
+        `LocalMaic.ratifyAxiomProposal: proposal "${proposalId}" is ${record.status}, not pending`
+      );
+    }
+    if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, creatorSig)) {
+      throw new Error("LocalMaic.ratifyAxiomProposal: invalid Creator signature");
+    }
     const candidate = record.proposal.candidate;
-    const newAxiomId = `ax.him.${record.himId}.${ulid.ulid()}`;
+    const newAxiomId = `ax.him.${record.himId}.${proposalId}`;
     const axiom = {
       id: newAxiomId,
       rank: candidate.rank,
@@ -2173,8 +2387,8 @@ var LocalMaic = class _LocalMaic {
       ...candidate.jurisdictions ? { jurisdictions: candidate.jurisdictions } : {},
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    const ratified = await this.proposals.markRatified(req, creatorSig, newAxiomId);
     await this.hims.appendEmergentAxiom(record.himId, axiom);
+    const ratified = await this.proposals.markRatified(req, creatorSig, newAxiomId);
     await this.audit.append({
       kind: "proposal-ratify",
       data: {
@@ -2209,7 +2423,7 @@ var LocalMaic = class _LocalMaic {
     return rejected;
   }
   /**
-   * **Society of HIMs — axiom suggestion channel (E11).**
+   * **Society of HIMs, axiom suggestion channel (E11).**
    *
    * One HIM proposes an axiom to another. The transfer is **not direct** —
    * the suggestion is recorded in the audit log and the receiving HIM is
@@ -2226,17 +2440,14 @@ var LocalMaic = class _LocalMaic {
     if (!CreatorKeyring.verifyWith(this.creatorPublicKey, req, creatorSig)) {
       throw new Error("LocalMaic.suggestAxiomToHim: invalid Creator signature");
     }
+    await this.suggestNonces.consume(creatorSig.nonce);
     const fromRec = await this.hims.get(req.fromHimId);
     const toRec = await this.hims.get(req.toHimId);
     if (!fromRec) {
-      throw new Error(
-        `LocalMaic.suggestAxiomToHim: fromHimId "${req.fromHimId}" not registered`
-      );
+      throw new Error(`LocalMaic.suggestAxiomToHim: fromHimId "${req.fromHimId}" not registered`);
     }
     if (!toRec) {
-      throw new Error(
-        `LocalMaic.suggestAxiomToHim: toHimId "${req.toHimId}" not registered`
-      );
+      throw new Error(`LocalMaic.suggestAxiomToHim: toHimId "${req.toHimId}" not registered`);
     }
     const event = await this.audit.append({
       kind: "axiom-suggest",
@@ -2271,7 +2482,7 @@ var LocalMaic = class _LocalMaic {
    * Per-kind retention classification (E3). Tells the operator which
    * audit events have aged past their retention window and should be
    * moved to encrypted cold-storage. Tamper-evident hash chain forbids
-   * actual deletion in-place — this method only classifies. See
+   * actual deletion in-place, this method only classifies. See
    * `audit/retention.ts` for the policy defaults.
    */
   async auditRetentionReport(opts = {}) {
@@ -2298,8 +2509,8 @@ var RemoteMaic = class {
     this.timeoutMs = config.timeoutMs ?? 1e4;
   }
   /**
-   * `reviewBehavior` is **fail-closed** (E4 — PROPOSED_DECISIONS.md). If the
-   * remote service is unreachable, throw — no governance, no response.
+   * `reviewBehavior` is **fail-closed** (E4, PROPOSED_DECISIONS.md). If the
+   * remote service is unreachable, throw, no governance, no response.
    * The NHE will surface this as a refusal upstream.
    */
   async reviewBehavior(report) {
@@ -2399,6 +2610,51 @@ async function safeReadText(r) {
   }
 }
 
+// src/creator/sign-birth.ts
+function signedBirthPayload(birth) {
+  return {
+    himId: birth.himId,
+    bornAt: birth.bornAt,
+    primaryArchetype: birth.primaryArchetype,
+    modifiers: birth.modifiers,
+    primordialAxiomIds: birth.primordialAxiomIds,
+    natalChart: birth.natalChart ?? null
+  };
+}
+function signBirthSignature(birth, keyring) {
+  const payload = signedBirthPayload(birth);
+  const nonce = Buffer.byteLength(JSON.stringify(payload), "utf-8");
+  const signature = keyring.sign(payload, nonce);
+  return {
+    ...birth,
+    creatorSignature: signature,
+    signedFields: SIGNED_BIRTH_FIELDS,
+    signedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifyBirthSignature(signed, expectedPublicKey) {
+  if (signed.signedFields.length !== SIGNED_BIRTH_FIELDS.length) return false;
+  for (const f of SIGNED_BIRTH_FIELDS) {
+    if (!signed.signedFields.includes(f)) return false;
+  }
+  if (signed.creatorSignature.publicKey !== expectedPublicKey) return false;
+  const payload = signedBirthPayload(signed);
+  return CreatorKeyring.verifyWith(expectedPublicKey, payload, signed.creatorSignature);
+}
+var InvalidBirthSignatureError = class extends Error {
+  constructor(himId) {
+    super(
+      `InvalidBirthSignature: signature verification failed for HIM '${himId}'. The signed birth fields may have been mutated, or the public key does not match.`
+    );
+    this.name = "InvalidBirthSignatureError";
+  }
+};
+function assertBirthSignature(signed, expectedPublicKey) {
+  if (!verifyBirthSignature(signed, expectedPublicKey)) {
+    throw new InvalidBirthSignatureError(signed.himId);
+  }
+}
+
 exports.ALL_AUDIT_EVENT_KINDS = ALL_AUDIT_EVENT_KINDS;
 exports.Affect = Affect;
 exports.ArchetypeModifier = ArchetypeModifier;
@@ -2411,7 +2667,11 @@ exports.AxiomSource = AxiomSource;
 exports.AxiomStore = AxiomStore;
 exports.BehaviorReport = BehaviorReport;
 exports.BirthSignature = BirthSignature;
+exports.BirthSignatureWithIdentity = BirthSignatureWithIdentity;
+exports.ClinicalInstrument = ClinicalInstrument;
+exports.ClinicalProfile = ClinicalProfile;
 exports.ComplianceMapper = ComplianceMapper;
+exports.CosmologicalProfile = CosmologicalProfile;
 exports.CreatorKeyring = CreatorKeyring;
 exports.CreatorSignature = CreatorSignature;
 exports.DEFAULT_RETENTION_DAYS = DEFAULT_RETENTION_DAYS;
@@ -2429,6 +2689,8 @@ exports.InductionStatus = InductionStatus;
 exports.InductionStore = InductionStore;
 exports.InteractionRecord = InteractionRecord;
 exports.InvalidBirthSignatureError = InvalidBirthSignatureError;
+exports.JungianArchetype = JungianArchetype;
+exports.JungianProfile = JungianProfile;
 exports.LimboReturn = LimboReturn;
 exports.LimboState = LimboState;
 exports.LimboTransition = LimboTransition;