enigma-memory 0.1.18 → 0.1.22

package/apps/cli/bin/enigma.mjs

@@ -5,14 +5,44 @@ import { constants as fsConstants, realpathSync } from 'node:fs';
 import { access, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { createVault, remember, recall, updateMemory, deleteMemory, exportBundle, decryptKeyring, KEYRING_ENCRYPTED_TYPE } from '../../../packages/vault/src/index.js';
-import { createPassport, compileContextPack, createMemoryDriveHealthReport } from '../../../packages/passport/src/index.js';
+import { ENIGMA_VERSION } from '../../../packages/core/src/version.mjs';
+import {
+  createVault,
+  remember,
+  recall,
+  updateMemory,
+  deleteMemory,
+  exportBundle,
+  importBundle,
+  rotateContentKey,
+  sealContentKeyEpoch,
+  resetVaultContentKeys,
+} from '../../../packages/vault/src/index.js';
+import {
+  readJsonFileWithRevision,
+  readFileRevision,
+  withBundleFileLock,
+  writeJsonFileAtomic,
+} from '../../../packages/vault/src/persistence.js';
+import { createPassport, compileContextPack, createContextPassport, createProofOfNonUse, createMemoryDriveHealthReport } from '../../../packages/passport/src/index.js';
 import { runBoundarySimulation } from '../../../packages/boundary/src/index.js';
 import { startStdioServer } from '../../../packages/mcp-server/src/index.js';
-import { runMeshDemo } from '../../../packages/mesh/src/index.js';
+import { runMeshDemo, MeshGossipNode, WebSocketTransport, generateMeshIdentity } from '../../../packages/mesh/src/index.js';
 import { runEnterpriseDemo } from '../../../packages/enterprise/src/index.js';
 import { connectClient, disconnectClient, doctorConnectors, getClientProfile, planConnectWizard, renderMcpConfig, supportedClients } from '../../../packages/connectors/src/index.js';
-import { exportEnigmaCapsule, importChatGptExport, importClaudeMemory, importEnigmaCapsule, importLangGraphStore, importLettaAgentFile, importMem0Export, importZepGraphitiExport } from '../../../packages/importers/src/index.js';
+import {
+  exportEnigmaCapsule,
+  importChatGptExport,
+  importClaudeMemory,
+  importEnigmaCapsule,
+  importLangGraphStore,
+  importLettaAgentFile,
+  importMem0Export,
+  importZepGraphitiExport,
+  loadPersistedImporterArtifact,
+  persistEnigmaCapsule,
+  persistImportReport,
+} from '../../../packages/importers/src/index.js';
 import * as relayServer from '../../relay/src/server.mjs';
 import * as gatewayServer from '../../gateway/src/server.mjs';
 import { verifyBundle } from '../../verifier/bin/enigma-verify.mjs';
@@ -47,6 +77,9 @@ import {
   validateRegistryBatch,
   validateProofNetworkPacket,
 } from '../../../packages/proof-network/src/index.js';
+import { runDashboard as runTerminalDashboard } from '../../../packages/terminal-tui/index.mjs';
+import { createAttestation, EnclaveSessionManager, verifyZeroizationReceipt } from '../../../packages/enclave-runtime/index.mjs';
+import { swarmGraphFromBundle, swarmStatusFromBundle } from '../../../packages/connectors/swarm-router.mjs';
 
 const DEFAULT_BUNDLE = '.enigma/bundle.json';
 const DEFAULT_TEST_DRIVE_DIR = '.enigma/test-drive';
@@ -114,7 +147,7 @@ const IMPORTERS = Object.freeze({
   zep_graphiti_export: importZepGraphitiExport,
 });
 
-export const REQUIRED_PACKAGE_BINS = Object.freeze(['enigma', 'enigma-verify', 'enigma-mcp', 'enigma-relay', 'enigma-gateway', 'enigma-native-host']);
+export const REQUIRED_PACKAGE_BINS = Object.freeze(['enigma', 'enigma-terminal', 'enigma-shell', 'enigma-verify', 'enigma-mcp', 'enigma-relay', 'enigma-gateway', 'enigma-native-host']);
 
 function setFlagValue(flags, name, value) {
   if (!flags.has(name)) {
@@ -220,6 +253,100 @@ async function writeJson(path, value) {
   await mkdir(dirname(path), { recursive: true });
   await writeFile(path, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
 }
+export async function resolvePassphrase(flags) {
+  let hasExplicitFlag = false;
+  let explicitFlagVal;
+  let hasExplicitFile = false;
+  let explicitFileVal;
+
+  if (flags) {
+    const rawFlag = getFlag(flags, ['passphrase', 'keyring-passphrase', 'keyringPassphrase']);
+    if (rawFlag !== undefined) {
+      hasExplicitFlag = true;
+      if (rawFlag === true || rawFlag === '') {
+        throw new Error('Passphrase flag was provided but value is empty.');
+      }
+      explicitFlagVal = String(lastFlagValue(rawFlag));
+      if (explicitFlagVal.trim() === '') {
+        throw new Error('Passphrase flag was provided but value is empty.');
+      }
+    }
+
+    const rawFile = getFlag(flags, ['passphrase-file', 'passphraseFile']);
+    if (rawFile !== undefined) {
+      hasExplicitFile = true;
+      if (rawFile === true || rawFile === '') {
+        throw new Error('Passphrase file flag was provided but path is empty.');
+      }
+      explicitFileVal = String(lastFlagValue(rawFile));
+      if (explicitFileVal.trim() === '') {
+        throw new Error('Passphrase file flag was provided but path is empty.');
+      }
+    }
+  }
+
+  // 1. Conflict detection
+  if (hasExplicitFlag && hasExplicitFile) {
+    throw new Error('Cannot specify both --passphrase and --passphrase-file.');
+  }
+
+  // 2. Explicit direct CLI flag outranks everything
+  if (hasExplicitFlag) {
+    return explicitFlagVal;
+  }
+
+  // 3. Explicit CLI passphrase-file outranks ambient environment variables
+  if (hasExplicitFile) {
+    const filePath = resolve(explicitFileVal);
+    let raw;
+    try {
+      raw = await readFile(filePath, 'utf8');
+    } catch (err) {
+      throw new Error(`Cannot read passphrase file at '${filePath}': ${err.message}`);
+    }
+    const clean = raw.replace(/\r?\n$/u, '');
+    if (clean.length === 0 || clean.trim().length === 0) {
+      throw new Error(`Passphrase file at '${filePath}' is empty.`);
+    }
+    return clean;
+  }
+
+  // 4. Ambient environment variable
+  const rawEnv = process.env.ENIGMA_PASSPHRASE ?? process.env.ENIGMA_KEYRING_PASSPHRASE;
+  if (rawEnv !== undefined) {
+    if (rawEnv === '' || String(rawEnv).trim() === '') {
+      throw new Error('ENIGMA_PASSPHRASE environment variable is set but empty.');
+    }
+    return String(rawEnv);
+  }
+
+  return undefined;
+}
+function insecureDevMode(flags = {}) {
+  return booleanFlag(flags, ['insecure-dev', 'insecureDev'], false)
+    || ['1', 'true'].includes(String(process.env.ENIGMA_INSECURE_DEV_MODE ?? '').toLowerCase());
+}
+
+export async function resolveVaultCredentials(flags = {}) {
+  const passphrase = await resolvePassphrase(flags);
+  const insecure = insecureDevMode(flags);
+  if (passphrase === undefined && !insecure) {
+    throw new Error('Persistent vault access requires --passphrase, --passphrase-file, or ENIGMA_PASSPHRASE. Use --insecure-dev only for disposable local development.');
+  }
+  const activeOnlyRaw = getFlag(flags, ['active-epoch-only', 'activeEpochOnly']);
+  const allowOldRaw = getFlag(flags, ['allow-old-epochs', 'allowOldEpochs']);
+  if (activeOnlyRaw !== undefined && allowOldRaw !== undefined) {
+    throw new Error('Cannot combine --active-epoch-only with --allow-old-epochs.');
+  }
+  let allowOldEpochReads;
+  if (activeOnlyRaw !== undefined) allowOldEpochReads = !booleanFlag(flags, ['active-epoch-only', 'activeEpochOnly'], true);
+  if (allowOldRaw !== undefined) allowOldEpochReads = booleanFlag(flags, ['allow-old-epochs', 'allowOldEpochs'], true);
+  return {
+    passphrase,
+    insecureDevMode: insecure,
+    allowOldEpochReads,
+  };
+}
 
 async function fileExists(path) {
   try {
@@ -304,7 +431,8 @@ async function buildQuickstartArtifacts(flags, { bundleInput = DEFAULT_BUNDLE, o
   ensureDistinctOutputPaths(paths.outputs.map((output) => output.path));
   if (checkExisting) await assertCanWriteQuickstartOutputs(paths.outputs, overwrite);
 
-  const passphrase = getFlag(flags, ['passphrase']);
+  const credentials = await resolveVaultCredentials(flags);
+  const { passphrase } = credentials;
   const vault = createVault({
     subjectId: String(getFlag(flags, ['subject', 'subject-id'], 'local-user')),
     displayName: String(getFlag(flags, ['display-name', 'name'], 'Local user')),
@@ -335,13 +463,18 @@ async function buildQuickstartArtifacts(flags, { bundleInput = DEFAULT_BUNDLE, o
   const verifyReport = verifyBundle(bundle);
 
   if (write) {
-    await writeJson(paths.bundlePath, bundle);
-    await writeJson(paths.contextPackPath, contextPack);
-    await writeJson(paths.exportPath, bundle);
+    await withBundleFileLock(paths.bundlePath, async () => {
+      const expectedRevision = await fileExists(paths.bundlePath)
+        ? (await readFileRevision(paths.bundlePath)).revision
+        : null;
+      await writeJsonFileAtomic(paths.bundlePath, bundle, { expectedRevision, resetMonotonicHead: overwrite });
+    });
+    await writeJson(paths.contextPackPath, publicContextPackSummary(contextPack));
+    await writeJsonFileAtomic(paths.exportPath, bundle, { resetMonotonicHead: overwrite });
     await writeJson(paths.verifyReportPath, verifyReport);
   }
 
-  return { ...paths, vault, passport, contextPack, bundle, verifyReport };
+  return { ...paths, vault, passport, contextPack, bundle, verifyReport, credentials };
 }
 
 async function crossModelMemoryTextFromFlags(flags) {
@@ -659,6 +792,41 @@ async function writableVaultPathCheck(bundleInput, displayInput = bundleInput) {
   };
 }
 
+async function bundleInitializedCheck(bundlePath, vaultPath) {
+  if (vaultPath.target_exists !== true) {
+    return {
+      ok: false,
+      bundle: vaultPath.path,
+      target_exists: false,
+      schema: null,
+      reason: 'bundle_missing',
+      hint: 'Run quickstart or setup before using doctor as the final green check.',
+    };
+  }
+  try {
+    const bundle = await readJson(bundlePath);
+    const schema = typeof bundle?.schema === 'string' ? bundle.schema : null;
+    const schemaOk = schema === 'enigma.vault_bundle.v1';
+    return {
+      ok: schemaOk,
+      bundle: vaultPath.path,
+      target_exists: true,
+      schema: schemaOk ? schema : null,
+      reason: schemaOk ? null : 'bundle_schema_mismatch',
+      hint: schemaOk ? null : 'Run quickstart or setup with --overwrite to recreate the local Enigma bundle.',
+    };
+  } catch {
+    return {
+      ok: false,
+      bundle: vaultPath.path,
+      target_exists: true,
+      schema: null,
+      reason: 'bundle_json_invalid',
+      hint: 'Run quickstart or setup with --overwrite to recreate the local Enigma bundle.',
+    };
+  }
+}
+
 async function schemaFiles() {
   return (await readdir(SPECS_URL)).filter((name) => name.endsWith('.schema.json')).sort();
 }
@@ -686,16 +854,28 @@ function publicCapsuleImportResult(result) {
 }
 
 async function ensureBundle(bundlePath, flags = {}) {
-  const existed = await fileExists(bundlePath);
-  if (existed) return { created: false, bundle: await readJson(bundlePath) };
-  const passphrase = getFlag(flags, ['passphrase']);
-  const vault = createVault({
-    subjectId: String(getFlag(flags, ['subject', 'subject-id'], 'local-user')),
-    displayName: String(getFlag(flags, ['display-name', 'name'], 'Local user')),
-    passphrase,
+  const credentials = await resolveVaultCredentials(flags);
+  return withBundleFileLock(bundlePath, async () => {
+    if (await fileExists(bundlePath)) {
+      const state = await loadState(bundlePath, credentials);
+      return { ...state, credentials, created: false, bundle: state.stored };
+    }
+    const vault = createVault({
+      subjectId: String(getFlag(flags, ['subject', 'subject-id'], 'local-user')),
+      displayName: String(getFlag(flags, ['display-name', 'name'], 'Local user')),
+      passphrase: credentials.passphrase,
+    });
+    const bundle = await persistState(bundlePath, vault, { ...credentials, lockHeld: true, expectedRevision: null });
+    return {
+      created: true,
+      bundle,
+      stored: bundle,
+      vault,
+      passport: createPassport({ vault }),
+      revision: bundle.__revision,
+      credentials,
+    };
   });
-  const bundle = await persistState(bundlePath, vault, { passphrase });
-  return { created: true, bundle };
 }
 
 function listenAddress(server) {
@@ -800,68 +980,64 @@ async function serveHttpCommand({ flags, io, service, createServer, defaultPort
   return 0;
 }
 
-function reviveVault(stored, options = {}) {
-  if (stored.schema !== 'enigma.vault_bundle.v1') {
-    if (stored.vault?.schema === 'enigma.vault.local.v1') return stored.vault;
-    throw new Error(`Unsupported Enigma bundle schema: ${stored.schema ?? '<missing>'}`);
-  }
-  const keyring = stored.keyring;
-  let vaultKey;
-  let addressKey;
-  let privateKey;
-  if (keyring?.type === KEYRING_ENCRYPTED_TYPE) {
-    if (!options.passphrase) throw new Error('Encrypted keyring requires passphrase');
-    const decrypted = decryptKeyring(keyring, options.passphrase);
-    vaultKey = decrypted.vault_key_b64;
-    addressKey = decrypted.address_key_b64;
-    privateKey = decrypted.privateKey;
-  } else {
-    vaultKey = keyring?.vault_key_b64;
-    addressKey = keyring?.address_key_b64;
-    privateKey = keyring?.privateKey;
+function assertPersistentVaultCredentials(options = {}) {
+  if (options.passphrase === undefined && options.insecureDevMode !== true) {
+    throw new Error('Persistent vault access requires credentials unless explicit insecure-dev mode is enabled.');
   }
-  const signingKeyPair = privateKey
-    ? { key_id: keyring?.signer?.key_id, publicKey: keyring?.publicKey, privateKey }
-    : undefined;
-  const vault = createVault({
-    vault_id: stored.vault?.vault_id,
-    tenant_id: stored.vault?.tenant_id,
-    subject_id: stored.vault?.subject_id,
-    actor_id: stored.vault?.actor_id,
-    policy_id: stored.vault?.policy_id,
-    vault_key: vaultKey,
-    address_key: addressKey,
-    signingKeyPair,
-    now: stored.vault?.created_at,
-  });
-  if (keyring?.signer) vault.signer = keyring.signer;
-  vault.created_at = stored.vault?.created_at ?? vault.created_at;
-  vault.updated_at = stored.vault?.updated_at ?? vault.updated_at;
-  vault.sequence = Number.isInteger(stored.vault?.sequence) ? stored.vault.sequence : 0;
-  vault.events = Array.isArray(stored.events) ? stored.events : [];
-  vault.receipts = Array.isArray(stored.receipts) ? stored.receipts : [];
-  vault.memories = new Map((stored.memory_objects ?? []).map((record) => [record.memory_addr, { ...record }]));
-  vault.activeAddresses = new Set(stored.active_memory_addresses ?? []);
-  vault.tombstones = new Map((stored.tombstones ?? []).map((tombstone) => [tombstone.memory_addr, tombstone]));
-  const roots = vault.__computeRoots();
-  vault.active_set_root = roots.active_set_root;
-  vault.receipt_log_root = roots.receipt_log_root;
-  return vault;
 }
 
 async function loadState(bundlePath, options = {}) {
-  const stored = await readJson(bundlePath);
-  const vault = reviveVault(stored, options);
-  return { stored, vault, passport: createPassport({ vault }) };
+  assertPersistentVaultCredentials(options);
+  const { value: stored, revision } = await readJsonFileWithRevision(bundlePath, options);
+  const imported = importBundle({
+    bundle: stored,
+    passphrase: options.passphrase,
+    strict: true,
+    insecureDevMode: options.insecureDevMode === true,
+    allowOldEpochReads: options.allowOldEpochReads,
+    recordImport: false,
+  });
+  const vault = imported.vault;
+  return { stored, revision, vault, passport: createPassport({ vault }), verified: imported.verified };
 }
 
 async function persistState(bundlePath, vault, options = {}) {
+  if (options.lockHeld !== true) {
+    return withBundleFileLock(bundlePath, async () => {
+      const expectedRevision = Object.prototype.hasOwnProperty.call(options, 'expectedRevision')
+        ? options.expectedRevision
+        : (await fileExists(bundlePath) ? (await readJsonFileWithRevision(bundlePath, options)).revision : null);
+      return persistState(bundlePath, vault, { ...options, lockHeld: true, expectedRevision });
+    });
+  }
+  assertPersistentVaultCredentials(options);
   const exported = exportBundle({ vault, includePlaintext: false, passphrase: options.passphrase });
   const bundle = exported.bundle ?? exported;
-  await writeJson(bundlePath, bundle);
+  const persisted = await writeJsonFileAtomic(bundlePath, bundle, {
+    ...(Object.prototype.hasOwnProperty.call(options, 'expectedRevision')
+      ? { expectedRevision: options.expectedRevision }
+      : {}),
+    checkpointProvider: options.checkpointProvider,
+    requireExternalCheckpoint: options.requireExternalCheckpoint,
+    minimumSequence: options.minimumSequence,
+  });
+  Object.defineProperty(bundle, '__revision', { value: persisted.revision, enumerable: false });
   return bundle;
 }
 
+async function withVaultTransaction(bundlePath, options, operation) {
+  return withBundleFileLock(bundlePath, async () => {
+    const state = await loadState(bundlePath, options);
+    const result = await operation(state);
+    const bundle = await persistState(bundlePath, state.vault, {
+      ...options,
+      lockHeld: true,
+      expectedRevision: state.revision,
+    });
+    return { ...state, result, bundle };
+  });
+}
+
 
 async function initCommand(flags, io) {
   const bundleInput = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
@@ -907,6 +1083,9 @@ async function initCommand(flags, io) {
     context_pack: displays.context_pack,
     export: displays.export,
     verify_report: displays.verify_report,
+    keyring_type: artifacts.bundle.keyring?.type,
+    vault_credentials_required: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+    insecure_evaluation_mode: artifacts.bundle.keyring?.type === 'local_secret',
     subject_id: artifacts.bundle.vault?.subject_id,
     client_configs_written: anyConnectorWritePerformed,
     client_config_write_requested: connectorWritesRequested,
@@ -1065,8 +1244,10 @@ function publicSetupError(error, rawDisplays, publicDisplays) {
   return new Error(message);
 }
 
+const PUBLIC_PASSPHRASE_FILE_FLAG = '--passphrase-file "<passphrase-file>"';
+
 function oneCommandInstallConnect(bundleDisplay = DEFAULT_BUNDLE, outDirDisplay = dirname(bundleDisplay)) {
-  const parts = ['npm install -g enigma-memory && enigma setup'];
+  const parts = [`npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG}`];
   if (bundleDisplay !== DEFAULT_BUNDLE) parts.push(`--bundle ${commandPath(bundleDisplay)}`);
   if (outDirDisplay !== dirname(bundleDisplay)) parts.push(`--out-dir ${commandPath(outDirDisplay)}`);
   const base = parts.join(' ');
@@ -1095,7 +1276,7 @@ function setupNextCommands(bundleInput, exportDisplay, clients, writeConnectors)
 }
 
 function initExecuteCommand(bundleDisplay, outDirDisplay, requestedSelection, connectRequested, overwrite) {
-  let command = `enigma init --bundle ${commandPath(bundleDisplay)} --out-dir ${commandPath(outDirDisplay)}`;
+  let command = `enigma init --bundle ${commandPath(bundleDisplay)} --out-dir ${commandPath(outDirDisplay)} ${PUBLIC_PASSPHRASE_FILE_FLAG}`;
   for (const client of requestedSelection.explicit_clients) command += ` --client ${client}`;
   if (requestedSelection.auto) command += ' --client auto';
   if (connectRequested) command += ' --connect';
@@ -1113,14 +1294,28 @@ function doctorNextCommands(bundleDisplay, client) {
   const clientId = client ?? DEFAULT_SETUP_CLIENTS[0];
   const bundle = commandPath(bundleDisplay);
   return [
+    `enigma quickstart --bundle ${bundle} ${PUBLIC_PASSPHRASE_FILE_FLAG} --overwrite`,
+    `enigma setup --bundle ${bundle} ${PUBLIC_PASSPHRASE_FILE_FLAG} --overwrite`,
+    `enigma doctor --bundle ${bundle} --client ${clientId}`,
     `enigma status --bundle ${bundle}`,
     `enigma drive health --bundle ${bundle}`,
-    `enigma setup --bundle ${bundle}`,
-    `enigma doctor --bundle ${bundle} --client ${clientId}`,
     `enigma connect ${clientId} --bundle ${bundle}`,
   ];
 }
 
+function doctorFirstRunHint(_bundleDisplay, client) {
+  const clientId = client ?? DEFAULT_SETUP_CLIENTS[0];
+  const bundle = commandPath('<bundle-path>');
+  return {
+    bundle: '<bundle-path>',
+    commands: [
+      `enigma quickstart --bundle ${bundle} ${PUBLIC_PASSPHRASE_FILE_FLAG} --overwrite`,
+      `enigma setup --bundle ${bundle} ${PUBLIC_PASSPHRASE_FILE_FLAG} --overwrite`,
+      `enigma doctor --bundle ${bundle} --client ${clientId}`,
+    ],
+  };
+}
+
 async function setupDoctorChecks(flags, artifacts, clients, displays) {
   const packageJson = await readPackageJson();
   const requiredNodeMajor = minimumNodeMajor(packageJson.engines?.node);
@@ -1320,6 +1515,9 @@ export async function setupCommand(flags, io) {
     connect_installed: connectInstalled,
     bundle: displays.bundle,
     context_pack: displays.context_pack,
+    keyring_type: artifacts.bundle.keyring?.type,
+    vault_credentials_required: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+    insecure_evaluation_mode: artifacts.bundle.keyring?.type === 'local_secret',
     export: displays.export,
     verify_report: displays.verify_report,
     memory_source: setupMemorySource(flags),
@@ -1344,7 +1542,16 @@ export async function setupCommand(flags, io) {
     connect_plans: Object.fromEntries(connectors.map((connector) => [connector.client_id, connector.connect_plan])),
     next_commands: setupNextCommands(displays.bundle, displays.export, clients, connectorWritesRequested && (!connectInstalled || anyConnectorWritePerformed)),
     checks: doctor.checks,
-    claim_boundaries: { ...SETUP_CLAIM_BOUNDARIES, hosted_saas_live: false, raw_memory_printed: false, solana_required: false, browser_extension_required: false },
+    claim_boundaries: {
+      ...SETUP_CLAIM_BOUNDARIES,
+      vault_credentials_required: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+      keyring_encrypted: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+      insecure_evaluation_mode: artifacts.bundle.keyring?.type === 'local_secret',
+      hosted_saas_live: false,
+      raw_memory_printed: false,
+      solana_required: false,
+      browser_extension_required: false,
+    },
   }, io);
   return ok ? 0 : 1;
 }
@@ -1369,6 +1576,9 @@ export async function quickstartCommand(flags, io) {
     context_pack: displays.context_pack,
     export: displays.export,
     verify_report: displays.verify_report,
+    keyring_type: artifacts.bundle.keyring?.type,
+    vault_credentials_required: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+    insecure_evaluation_mode: artifacts.bundle.keyring?.type === 'local_secret',
     memory_count: Array.isArray(artifacts.bundle.memory_objects) ? artifacts.bundle.memory_objects.length : 0,
     receipt_count: Array.isArray(artifacts.bundle.receipts) ? artifacts.bundle.receipts.length : 0,
     context_item_count: Array.isArray(artifacts.contextPack.memories) ? artifacts.contextPack.memories.length : 0,
@@ -1380,6 +1590,9 @@ export async function quickstartCommand(flags, io) {
     claim_boundaries: {
       local_only: true,
       provider_credentials_required: false,
+      vault_credentials_required: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+      keyring_encrypted: artifacts.bundle.keyring?.type === 'local_secret_encrypted',
+      insecure_evaluation_mode: artifacts.bundle.keyring?.type === 'local_secret',
       provider_native_memory_canonical: false,
       provider_deletion_proof: false,
       model_forgetting_proof: false,
@@ -1439,8 +1652,10 @@ export async function crossModelDemoCommand(flags, io) {
   let vault;
   let passport;
   let demoMemoryAddr;
+  let loadedRevision = null;
 
-  const passphrase = getFlag(flags, ['passphrase']);
+  const credentials = await resolveVaultCredentials(flags);
+  const { passphrase } = credentials;
   if (!bundleWasSupplied) {
     vault = createVault({
       subjectId: 'cross-model-demo-user',
@@ -1459,12 +1674,10 @@ export async function crossModelDemoCommand(flags, io) {
     demoMemoryAddr = remembered.memory_addr;
     bundleCreated = true;
   } else {
-    const existed = await fileExists(bundlePath);
-    if (!existed) {
-      await ensureBundle(bundlePath, flags);
-      bundleCreated = true;
-    }
-    ({ vault, passport } = await loadState(bundlePath, { passphrase }));
+    const state = await ensureBundle(bundlePath, flags);
+    bundleCreated = state.created;
+    loadedRevision = state.revision;
+    ({ vault, passport } = state);
     const remembered = remember({
       vault,
       passport,
@@ -1482,7 +1695,7 @@ export async function crossModelDemoCommand(flags, io) {
   const receiptCountBeforeProfiles = Array.isArray(vault.receipts) ? vault.receipts.length : 0;
   const profiles = buildCrossModelProfileSummaries({ vault, passport, demoMemoryAddr, limit });
 
-  const bundle = await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
+  const bundle = await persistState(bundlePath, vault, { ...credentials, expectedRevision: loadedRevision });
   const report = {
     ok: true,
     schema: 'enigma.cross_model_demo.v1',
@@ -1511,82 +1724,121 @@ export async function crossModelDemoCommand(flags, io) {
 
 async function rememberCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
+  const credentials = await resolveVaultCredentials(flags);
+  const text = await memoryTextFromFlags(flags);
   const importance = parseImportanceFlag(flags);
-  const result = remember({
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault, passport }) => remember({
     vault,
     passport,
-    text: await memoryTextFromFlags(flags),
+    text,
     importance,
     purpose: getFlag(flags, ['purpose'], 'user_memory'),
     purpose_tags: parseList(getFlag(flags, ['tags'])),
     metadata: parseJson(getFlag(flags, ['metadata']), {}),
-  });
-  await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
+  }));
   print({ ok: true, memory_addr: result.memory_addr, receipt_id: result.receipt?.receipt_id }, io);
   return 0;
 }
 
+async function recallCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  const credentials = await resolveVaultCredentials(flags);
+  const memoryAddr = requireFlag(flags, ['id', 'memory-addr'], 'id');
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault, passport }) => recall({
+    vault,
+    passport,
+    memory_addr: memoryAddr,
+    purpose: getFlag(flags, ['purpose'], 'cli_recall'),
+  }));
+  print({
+    ok: true,
+    memory_addr: result.memory_addr,
+    content: result.content,
+    memory: result.memory,
+    receipt: result.receipt,
+    receipt_id: result.receipt?.receipt_id,
+  }, io);
+  return 0;
+}
+
 async function updateCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
-  const result = updateMemory({
+  const credentials = await resolveVaultCredentials(flags);
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault, passport }) => updateMemory({
     vault,
     passport,
     memory_addr: requireFlag(flags, ['id', 'memory-addr'], 'id'),
     text: requireFlag(flags, ['text', 'memory'], 'text'),
     metadata: parseJson(getFlag(flags, ['metadata']), {}),
-  });
-  await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
+  }));
   print({ ok: true, old_memory_addr: result.old_memory_addr, memory_addr: result.memory_addr, receipt_id: result.receipt?.receipt_id }, io);
   return 0;
 }
 
 async function deleteCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
-  const result = deleteMemory({
+  const credentials = await resolveVaultCredentials(flags);
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault, passport }) => deleteMemory({
     vault,
     passport,
     memory_addr: requireFlag(flags, ['id', 'memory-addr'], 'id'),
     reason: getFlag(flags, ['reason'], 'user_delete'),
-  });
-  await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
+  }));
   print({ ok: true, memory_addr: result.memory_addr, receipt_id: result.receipt?.receipt_id }, io);
   return 0;
 }
 
 async function contextCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
+  const credentials = await resolveVaultCredentials(flags);
   const query = getFlag(flags, ['query', 'q'], '');
   const optimize = getFlag(flags, ['optimize']) === true
     || getFlag(flags, ['optimize']) === 'true'
     || String(query).trim().length > 0;
   const includeUnrelated = booleanFlag(flags, ['include-unrelated', 'includeUnrelated', 'no-strict-relevance', 'noStrictRelevance'], false);
   const strictRelevance = String(query).trim().length > 0 && !includeUnrelated;
-  const pack = compileContextPack({
-    vault,
-    passport,
-    query,
-    purpose: getFlag(flags, ['purpose'], 'local_context'),
-    limit: Number(getFlag(flags, ['limit'], 8)),
-    optimize,
-    strict_relevance: strictRelevance,
-    max_estimated_tokens: parseOptionalNumber(getFlag(flags, ['max-estimated-tokens', 'maxEstimatedTokens'])),
-    price_per_million_tokens: parseOptionalNumber(getFlag(flags, ['price-per-million-tokens', 'pricePerMillionTokens'])),
-    currency: getFlag(flags, ['currency']),
+  const withProof = booleanFlag(flags, ['proof', 'with-proof', 'withProof'], false);
+  const { result: output } = await withVaultTransaction(bundlePath, credentials, ({ vault, passport }) => {
+    const pack = compileContextPack({
+      vault,
+      passport,
+      query,
+      purpose: getFlag(flags, ['purpose'], 'local_context'),
+      limit: Number(getFlag(flags, ['limit'], 8)),
+      optimize,
+      strict_relevance: strictRelevance,
+      max_estimated_tokens: parseOptionalNumber(getFlag(flags, ['max-estimated-tokens', 'maxEstimatedTokens'])),
+      price_per_million_tokens: parseOptionalNumber(getFlag(flags, ['price-per-million-tokens', 'pricePerMillionTokens'])),
+      currency: getFlag(flags, ['currency']),
+    });
+    return withProof
+      ? {
+        ok: true,
+        schema: 'enigma.context_proof_bundle.v1',
+        context_pack_ref: contextPackPublicDigest(pack),
+        context_pack_summary: publicContextPackSummary(pack),
+        context_passport: createContextPassport({ contextPack: pack, passport, vault, query, now: getFlag(flags, ['now']) }),
+        proof_of_non_use: createProofOfNonUse({ contextPack: pack, passport, vault, query, now: getFlag(flags, ['now']) }),
+        claim_boundaries: {
+          local_enigma_vault_only: true,
+          provider_deletion_claim: false,
+          model_forgetting_claim: false,
+          raw_memory_printed: false,
+        },
+      }
+      : pack;
   });
-  await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
   const out = getFlag(flags, ['out']);
-  if (out && out !== true) await writeJson(resolve(String(out)), pack);
-  print(pack, io);
+  if (out && out !== true) {
+    const persistedOutput = withProof ? output : publicContextPackSummary(output);
+    await writeJson(resolve(String(out)), persistedOutput);
+  }
+  print(output, io);
   return 0;
 }
 
 
 function memorySearchReport({ bundlePath, vault, query, limit, includeContent = false, includeUnrelated = false, now = '2026-01-01T00:00:00.000Z' }) {
-  const roots = vault.__computeRoots();
   const queryTokens = searchTokensFrom(query);
   const { candidates, byAddress } = searchCandidates(vault, queryTokens, includeUnrelated);
   const plan = createMemoryOptimizationPlan({
@@ -1603,6 +1855,17 @@ function memorySearchReport({ bundlePath, vault, query, limit, includeContent =
       return planIndex.get(left.address) - planIndex.get(right.address);
     })
     .slice(0, limit);
+  const auditReceiptByAddress = new Map(selectedItems.map((item) => {
+    const audited = recall({
+      vault,
+      memory_addr: item.address,
+      operation: 'search_read',
+      purpose: 'cli_search',
+      now,
+    });
+    return [item.address, audited.receipt];
+  }));
+  const roots = vault.__computeRoots();
   const accessReceipts = selectedItems.map((item, index) => createMemoryAccessReceipt({
     item,
     plan,
@@ -1626,6 +1889,7 @@ function memorySearchReport({ bundlePath, vault, query, limit, includeContent =
       score: hit.score,
       tier: item.tier,
       receipt_ids: searchResultReceiptIds(vault, item.address),
+      read_receipt_id: auditReceiptByAddress.get(item.address)?.receipt_id,
       access_receipt_ref: accessReceipt?.access_receipt_ref,
       access_receipt_id: accessReceipt?.receipt_id,
       access_receipt_refs: accessReceipt?.access_receipt_ref ? [accessReceipt.access_receipt_ref] : [],
@@ -1658,8 +1922,8 @@ async function searchCommand(flags, io) {
   if (limit < 0) throw new Error('--limit must be non-negative.');
   const includeContent = getFlag(flags, ['include-content', 'includeContent']) === true || getFlag(flags, ['include-content', 'includeContent']) === 'true';
   const includeUnrelated = booleanFlag(flags, ['include-unrelated', 'includeUnrelated', 'no-strict-relevance', 'noStrictRelevance'], false);
-  const { vault } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
-  print(memorySearchReport({
+  const credentials = await resolveVaultCredentials(flags);
+  const { result: report } = await withVaultTransaction(bundlePath, credentials, ({ vault }) => memorySearchReport({
     bundlePath,
     vault,
     query,
@@ -1667,7 +1931,8 @@ async function searchCommand(flags, io) {
     includeContent,
     includeUnrelated,
     now: getFlag(flags, ['now'], '2026-01-01T00:00:00.000Z'),
-  }), io);
+  }));
+  print(report, io);
   return 0;
 }
 
@@ -1709,10 +1974,47 @@ function passportStatusReport({ bundlePath, stored = {}, vault, passport }) {
 
 async function statusCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { stored, vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
+  const credentials = await resolveVaultCredentials(flags);
+  const { stored, vault, passport } = await loadState(bundlePath, credentials);
   print(passportStatusReport({ bundlePath, stored, vault, passport }), io);
   return 0;
 }
+async function rotateVaultKeyCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  const credentials = await resolveVaultCredentials(flags);
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault }) => rotateContentKey({
+    vault,
+    key_id: getFlag(flags, ['key-id', 'keyId']),
+    now: getFlag(flags, ['now']),
+  }));
+  print({ ok: true, operation: 'key_rotate', ...result }, io);
+  return 0;
+}
+
+async function sealVaultKeyCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  const credentials = await resolveVaultCredentials(flags);
+  const epochValue = getFlag(flags, ['epoch']);
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault }) => sealContentKeyEpoch({
+    vault,
+    epoch: epochValue === undefined ? undefined : Number(epochValue),
+    now: getFlag(flags, ['now']),
+  }));
+  print({ ok: true, operation: 'key_seal', ...result }, io);
+  return 0;
+}
+
+async function resetVaultKeysCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  const credentials = await resolveVaultCredentials(flags);
+  const { result } = await withVaultTransaction(bundlePath, credentials, ({ vault }) => resetVaultContentKeys({
+    vault,
+    key_id: getFlag(flags, ['key-id', 'keyId']),
+    now: getFlag(flags, ['now']),
+  }));
+  print({ ok: true, operation: 'key_reset', ...result }, io);
+  return 0;
+}
 async function readOptionalJsonInput(flags, names) {
   const path = getFlag(flags, names);
   if (!path) return null;
@@ -1722,7 +2024,8 @@ async function readOptionalJsonInput(flags, names) {
 
 async function driveHealthCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault, passport } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
+  const credentials = await resolveVaultCredentials(flags);
+  const { vault, passport } = await loadState(bundlePath, credentials);
   const benchmarkSummary = await readOptionalJsonInput(flags, ['benchmark-summary', 'benchmarkSummary']);
   const connectorSummary = await readOptionalJsonInput(flags, ['connector-summary', 'connectorSummary']);
   const replicas = await readOptionalJsonInput(flags, ['replicas']);
@@ -1785,29 +2088,35 @@ function firstActiveMemoryAddress(vault) {
   return first.value;
 }
 
-function testDriveNextCommands(bundleDisplay, crossModelReportDisplay) {
+function testDriveCredentialFlag(insecureEvaluationMode) {
+  return insecureEvaluationMode ? '--insecure-dev' : PUBLIC_PASSPHRASE_FILE_FLAG;
+}
+
+function testDriveNextCommands(bundleDisplay, crossModelReportDisplay, insecureEvaluationMode) {
   const quotedBundle = commandPath(bundleDisplay);
   const quotedReport = commandPath(crossModelReportDisplay);
+  const credentialFlag = testDriveCredentialFlag(insecureEvaluationMode);
   return [
-    `enigma status --bundle ${quotedBundle}`,
-    `enigma drive health --bundle ${quotedBundle}`,
-    `enigma search --bundle ${quotedBundle} --query "local proof bundle"`,
-    `enigma demo cross-model --bundle ${quotedBundle} --out ${quotedReport}`,
-    'enigma setup --overwrite',
+    `enigma status --bundle ${quotedBundle} ${credentialFlag}`,
+    `enigma drive health --bundle ${quotedBundle} ${credentialFlag}`,
+    `enigma search --bundle ${quotedBundle} ${credentialFlag} --query "local proof bundle"`,
+    `enigma demo cross-model --bundle ${quotedBundle} ${credentialFlag} --out ${quotedReport}`,
+    `enigma setup ${credentialFlag} --overwrite`,
   ];
 }
 
-function testDriveFlowCommands({ bundleDisplay, outDirInput, crossModelReportDisplay, overwrite }) {
+function testDriveFlowCommands({ bundleDisplay, outDirInput, crossModelReportDisplay, overwrite, insecureEvaluationMode }) {
   const overwriteSuffix = overwrite ? ' --overwrite' : '';
   const quotedBundle = commandPath(bundleDisplay);
   const quotedOutDir = commandPath(outDirInput);
   const quotedReport = commandPath(crossModelReportDisplay);
+  const credentialFlag = testDriveCredentialFlag(insecureEvaluationMode);
   return [
-    `enigma quickstart --bundle ${quotedBundle} --out-dir ${quotedOutDir}${overwriteSuffix}`,
-    `enigma status --bundle ${quotedBundle}`,
-    `enigma drive health --bundle ${quotedBundle}`,
-    `enigma search --bundle ${quotedBundle} --query "local proof bundle"`,
-    `enigma demo cross-model --bundle ${quotedBundle} --out ${quotedReport}`,
+    `enigma quickstart --bundle ${quotedBundle} --out-dir ${quotedOutDir} ${credentialFlag}${overwriteSuffix}`,
+    `enigma status --bundle ${quotedBundle} ${credentialFlag}`,
+    `enigma drive health --bundle ${quotedBundle} ${credentialFlag}`,
+    `enigma search --bundle ${quotedBundle} ${credentialFlag} --query "local proof bundle"`,
+    `enigma demo cross-model --bundle ${quotedBundle} ${credentialFlag} --out ${quotedReport}`,
   ];
 }
 
@@ -1843,10 +2152,15 @@ function testDriveBenchmarkPointers() {
   ];
 }
 
-function testDriveClaimBoundaries() {
+function testDriveClaimBoundaries(keyringType) {
+  const encrypted = keyringType === 'local_secret_encrypted';
   return {
     local_only: true,
-    credentials_required: false,
+    credentials_required: encrypted,
+    vault_credentials_required: encrypted,
+    keyring_encrypted: encrypted,
+    insecure_evaluation_only: !encrypted,
+    at_rest_confidentiality: encrypted,
     external_provider_calls: false,
     client_config_writes_performed: false,
     plaintext_memory_echoed: false,
@@ -1927,7 +2241,32 @@ export async function testDriveCommand(flags, io) {
     demoMemoryAddr,
     limit: crossModelLimit,
   });
-  const finalExport = exportBundle({ vault: artifacts.vault, includePlaintext: false });
+  const rawStatusSummary = passportStatusReport({
+    bundlePath: outputs.bundlePath,
+    vault: artifacts.vault,
+    passport: artifacts.passport,
+    stored: {
+      owner: {
+        subject_id: artifacts.vault.subject_id,
+        display_name: artifacts.vault.display_name,
+      },
+    },
+  });
+  const statusSummary = publicTestDriveStatusSummary(rawStatusSummary, bundleInput);
+  const rawSearchSummary = memorySearchReport({
+    bundlePath: outputs.bundlePath,
+    vault: artifacts.vault,
+    query: 'local proof bundle',
+    limit: 3,
+    includeContent: false,
+    now: getFlag(flags, ['now'], '2026-01-01T00:00:00.000Z'),
+  });
+  const searchSummary = publicTestDriveSearchSummary(rawSearchSummary, bundleInput);
+  const finalExport = exportBundle({
+    vault: artifacts.vault,
+    includePlaintext: false,
+    passphrase: artifacts.credentials.passphrase,
+  });
   const finalBundle = finalExport.bundle ?? finalExport;
   const finalVerifyReport = verifyBundle(finalBundle);
   const crossModelReport = {
@@ -1951,27 +2290,6 @@ export async function testDriveCommand(flags, io) {
     out_written: !dryRun,
     claim_boundaries: { ...CROSS_MODEL_CLAIM_BOUNDARIES },
   };
-  const rawStatusSummary = passportStatusReport({
-    bundlePath: outputs.bundlePath,
-    vault: artifacts.vault,
-    passport: artifacts.passport,
-    stored: {
-      owner: {
-        subject_id: artifacts.vault.subject_id,
-        display_name: artifacts.vault.display_name,
-      },
-    },
-  });
-  const statusSummary = publicTestDriveStatusSummary(rawStatusSummary, bundleInput);
-  const rawSearchSummary = memorySearchReport({
-    bundlePath: outputs.bundlePath,
-    vault: artifacts.vault,
-    query: 'local proof bundle',
-    limit: 3,
-    includeContent: false,
-    now: getFlag(flags, ['now'], '2026-01-01T00:00:00.000Z'),
-  });
-  const searchSummary = publicTestDriveSearchSummary(rawSearchSummary, bundleInput);
 
   if (!dryRun) {
     await writeJson(outputs.bundlePath, finalBundle);
@@ -1986,8 +2304,9 @@ export async function testDriveCommand(flags, io) {
     outDirInput,
     crossModelReportDisplay: outputs.crossModelReportDisplay,
     overwrite,
+    insecureEvaluationMode: artifacts.credentials.insecureDevMode,
   });
-  const nextCommands = testDriveNextCommands(bundleInput, outputs.crossModelReportDisplay);
+  const nextCommands = testDriveNextCommands(bundleInput, outputs.crossModelReportDisplay, artifacts.credentials.insecureDevMode);
   const files = testDriveFileSummaries(outputs.artifacts, !dryRun);
   const packageJson = await readPackageJson();
   const ok = finalVerifyReport.ok === true && crossModelReport.ok === true && statusSummary.ok === true && searchSummary.ok === true;
@@ -1999,12 +2318,15 @@ export async function testDriveCommand(flags, io) {
     out_dir: outDirInput,
     bundle: bundleInput,
     install_command: `npm install -g ${packageJson.name ?? 'enigma-memory'}`,
-    release_target: '0.1.18',
+    release_target: packageJson.version ?? '0.1.20',
     artifacts_written: !dryRun,
     client_configs_written: false,
     client_config_write_required: false,
     memory_plaintext_echoed: false,
     provider_credentials_required: false,
+    keyring_type: finalBundle.keyring?.type,
+    vault_credentials_required: finalBundle.keyring?.type === 'local_secret_encrypted',
+    insecure_evaluation_mode: finalBundle.keyring?.type === 'local_secret',
     hosted_saas_live: false,
     files,
     files_written: dryRun ? [] : files.map((file) => file.path),
@@ -2024,6 +2346,9 @@ export async function testDriveCommand(flags, io) {
       client_selection: publicSetupClientSelection(selection),
       client_configs_written: false,
       provider_credentials_required: false,
+      keyring_type: finalBundle.keyring?.type,
+      vault_credentials_required: finalBundle.keyring?.type === 'local_secret_encrypted',
+      insecure_evaluation_mode: finalBundle.keyring?.type === 'local_secret',
       memory_plaintext_echoed: false,
       memory_count: Array.isArray(finalBundle.memory_objects) ? finalBundle.memory_objects.length : 0,
       receipt_count: Array.isArray(finalBundle.receipts) ? finalBundle.receipts.length : 0,
@@ -2033,19 +2358,17 @@ export async function testDriveCommand(flags, io) {
     status_summary: statusSummary,
     search_summary: searchSummary,
     cross_model_summary: crossModelReport,
-    claim_boundaries: testDriveClaimBoundaries(),
+    claim_boundaries: testDriveClaimBoundaries(finalBundle.keyring?.type),
   }, io);
   return ok ? 0 : 1;
 }
 
 async function exportCommand(flags, io) {
   const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const { vault } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) });
-  const exported = exportBundle({ vault, includePlaintext: false, passphrase: getFlag(flags, ['passphrase']) });
-  const bundle = exported.bundle ?? exported;
-  await writeJson(bundlePath, bundle);
+  const credentials = await resolveVaultCredentials(flags);
+  const { bundle } = await withVaultTransaction(bundlePath, credentials, () => ({ operation: 'export' }));
   const out = resolve(String(getFlag(flags, ['out'], 'enigma-export.json')));
-  await writeJson(out, bundle);
+  await writeJsonFileAtomic(out, bundle);
   print({ ok: true, export: out, receipt_count: Array.isArray(bundle.receipts) ? bundle.receipts.length : 0 }, io);
   return 0;
 }
@@ -2083,88 +2406,368 @@ export async function meshDemoCommand(_flags, io) {
   print(runMeshDemo(), io);
   return 0;
 }
-
-export async function enterpriseDemoCommand(_flags, io) {
-  print(runEnterpriseDemo(), io);
+export async function meshStatusCommand(flags, io) {
+  const node = new MeshGossipNode({
+    scope: String(getFlag(flags, ['scope'], 'enigma.global')),
+  });
+  print(node.getStatus(), io);
   return 0;
 }
 
-export async function doctorCommand(flags, io) {
-  const packageJson = await readPackageJson();
-  const requiredNodeMajor = minimumNodeMajor(packageJson.engines?.node);
-  const currentNodeMajor = nodeMajor(process.versions.node);
-  const binMap = packageJson.bin && typeof packageJson.bin === 'object' && !Array.isArray(packageJson.bin) ? packageJson.bin : {};
-  const binEntries = await Promise.all(REQUIRED_PACKAGE_BINS.map(async (name) => {
-    const target = binMap[name];
-    const declared = typeof target === 'string' && target.length > 0;
-    return {
-      name,
-      target: declared ? target : null,
-      declared,
-      exists: declared ? await fileExists(packageFileUrl(target)) : false,
-    };
-  }));
-  const schemas = await schemaFiles();
-  const bundleInput = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
-  const selectedClient = getFlag(flags, ['client']);
-  const doctorOptions = selectedClient && selectedClient !== true
-    ? { ...connectorOptions(flags), clientId: String(selectedClient), redactPaths: true }
-    : { ...connectorOptions(flags), clientId: undefined, redactPaths: true };
-  const connectorDoctor = await doctorConnectors(doctorOptions);
-  const profile = getClientProfile(String(selectedClient && selectedClient !== true ? selectedClient : 'generic-mcp'), connectorOptions(flags));
-  const checks = {
-    node: {
-      ok: requiredNodeMajor === 0 || currentNodeMajor >= requiredNodeMajor,
-      current: process.versions.node,
-      required: packageJson.engines?.node ?? null,
-    },
-    npm: npmUserAgentCheck(),
-    package_bins: {
-      ok: binEntries.every((entry) => entry.declared && entry.exists),
-      required: REQUIRED_PACKAGE_BINS,
-      entries: binEntries,
-      missing: binEntries.filter((entry) => !entry.declared).map((entry) => entry.name),
-      missing_targets: binEntries.filter((entry) => entry.declared && !entry.exists).map((entry) => entry.name),
-    },
-    bundle_default_path: {
-      ok: DEFAULT_BUNDLE === '.enigma/bundle.json',
-      path: DEFAULT_BUNDLE,
-      resolved: publicPathDisplay(resolve(bundleInput), 'bundle-path'),
-    },
-    vault_path: await writableVaultPathCheck(resolve(bundleInput), publicPathDisplay(bundleInput, 'bundle-path')),
-    schemas: {
-      ok: schemas.length > 0,
-      count: schemas.length,
-      files: schemas,
-    },
-    mcp_command_name: {
-      ok: profile.command === 'enigma-mcp',
-      command: profile.command,
-      expected: 'enigma-mcp',
-    },
-    connectors: connectorDoctor,
-  };
-  const ok = Object.values(checks).every((check) => check.ok !== false);
+export async function meshAnnounceCommand(flags, io) {
+  const node = new MeshGossipNode({
+    scope: String(getFlag(flags, ['scope'], 'enigma.global')),
+  });
+  const packet = await node.announce({
+    agentName: String(getFlag(flags, ['name'], 'enigma-cli-agent')),
+  });
   print({
-    ok,
-    node: checks.node,
-    package_bins: checks.package_bins,
-    npm: checks.npm,
-    vault_path: checks.vault_path,
-    bundle_default_path: checks.bundle_default_path,
-    schema_count: checks.schemas.count,
-    schemas: checks.schemas,
-    mcp_command_name: checks.mcp_command_name.command,
-    connectors: checks.connectors,
-    next_commands: doctorNextCommands(checks.vault_path.path, String(selectedClient && selectedClient !== true ? selectedClient : 'generic-mcp')),
-    checks,
+    ok: true,
+    action: 'ANNOUNCE_BROADCAST',
+    destinationHex: node.identity.destinationHex,
+    publicKeyHex: node.identity.publicKey.toString('hex'),
+    packetSize: packet.length,
   }, io);
-  return ok ? 0 : 1;
+  return 0;
 }
 
-export async function installCommand(flags, io) {
-  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
-  const bundleState = await ensureBundle(bundlePath, flags);
+export async function meshSendCommand(flags, io) {
+  const to = requireFlag(flags, ['to', 'destination']);
+  const recipientPub = requireFlag(flags, ['recipient-pub', 'recipientPub']);
+  const memory = requireFlag(flags, ['memory', 'content', 'message']);
+  const node = new MeshGossipNode({
+    scope: String(getFlag(flags, ['scope'], 'enigma.global')),
+  });
+  const result = await node.sendEncryptedCapsule(
+    to,
+    Buffer.from(recipientPub, 'hex'),
+    memory
+  );
+  print({ ok: true, ...result }, io);
+  return 0;
+}
+
+export async function meshListenCommand(flags, io) {
+  const port = Number(getFlag(flags, ['port'], 9190));
+  const node = new MeshGossipNode({
+    scope: String(getFlag(flags, ['scope'], 'enigma.global')),
+    transports: [new WebSocketTransport({ port })],
+  });
+  await node.start();
+  print({
+    ok: true,
+    status: 'LISTENING',
+    nodeId: node.nodeId,
+    destinationHex: node.identity.destinationHex,
+    port,
+  }, io);
+  return 0;
+}
+
+export async function marketStatusCommand(flags, io) {
+  const bundlePath = getFlag(flags, ['bundle', 'b'], DEFAULT_BUNDLE);
+  const statePath = join(dirname(resolve(bundlePath)), 'zk-tree-state.json');
+  let localStateAvailable = false;
+  try {
+    await access(statePath, fsConstants.F_OK);
+    localStateAvailable = true;
+  } catch {}
+
+  print({
+    ok: true,
+    market: {
+      mode: 'local_standalone',
+      protocol: 'Sealed Sale (ZKCP Fair Exchange)',
+      circuit: 'sealed_sale_release (87,422 R1CS constraints)',
+      onChainProgram: 'E18KZR1Jq8fG3FFACpoHsE21ME3t1ftKPEwXL7cFWkoZ',
+      settlement: 'Commitments-Only Settle -> Envelope Reveal Claim',
+      localStatePath: statePath,
+      localStateAvailable,
+      rpcChecked: false,
+      transactionSubmitted: false,
+      honestyNote: 'Localnet/Devnet demo ceremony; nullifiers prove protocol-level non-use, not physical deletion.',
+    },
+  }, io);
+  return 0;
+}
+
+export async function marketListCommand(flags, io) {
+  const bundlePath = getFlag(flags, ['bundle', 'b'], DEFAULT_BUNDLE);
+  const statePath = join(dirname(resolve(bundlePath)), 'zk-tree-state.json');
+
+  let state;
+  try {
+    const { readZkState } = await import('../../desktop/src/zk-state.mjs');
+    state = readZkState(statePath);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      print({
+        ok: true,
+        statePath,
+        count: 0,
+        listings: [],
+        note: `No local ZK tree state file found at ${statePath}. Ingest a memory with --saleable to create a listing.`,
+      }, io);
+      return 0;
+    }
+    throw err;
+  }
+
+  if (!state) {
+    print({
+      ok: true,
+      statePath,
+      count: 0,
+      listings: [],
+      note: `No local ZK tree state file found at ${statePath}. Ingest a memory with --saleable to create a listing.`,
+    }, io);
+    return 0;
+  }
+
+  const rawNotes = Array.isArray(state.notes) ? state.notes : [];
+  const saleableNotes = rawNotes.filter((n) => n && n.saleable === true);
+
+  const listings = saleableNotes.map((note) => {
+    const noteIdx = Number(note.index);
+    const rawLeaf = (Array.isArray(state.noteLeaves) && noteIdx >= 0 && noteIdx < state.noteLeaves.length)
+      ? state.noteLeaves[noteIdx]
+      : undefined;
+
+    let leafCommitmentHex = null;
+    let leafCommitmentDecimal = null;
+    if (rawLeaf !== undefined) {
+      try {
+        const leafBigInt = BigInt(rawLeaf);
+        leafCommitmentDecimal = leafBigInt.toString(10);
+        leafCommitmentHex = '0x' + leafBigInt.toString(16).padStart(64, '0');
+      } catch {}
+    }
+
+    return {
+      index: note.index,
+      scope: note.scope,
+      saleable: true,
+      leafCommitmentDecimal,
+      leafCommitmentHex,
+      appendSig: note.appendSig || null,
+      appendedAt: note.appendedAt || null,
+    };
+  });
+
+  print({
+    ok: true,
+    statePath,
+    count: listings.length,
+    listings,
+    honestyNote: 'Local ZK tree state saleable notes only; secret openings remain in host custody.',
+  }, io);
+  return 0;
+}
+
+const ZKCP_FIELD_R = BigInt('0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001');
+const ZKCP_HEX32_RE = /^0x[0-9a-fA-F]{64}$/;
+
+function parseZkcpHex32(val, fieldName) {
+  if (typeof val !== 'string' || !ZKCP_HEX32_RE.test(val)) {
+    throw new Error(`Field ${fieldName} must be a 32-byte hex string (0x followed by 64 hex characters); got ${val}`);
+  }
+  return val.toLowerCase();
+}
+
+function parseZkcpLimb(val, index) {
+  if (typeof val !== 'string' || !/^(0|[1-9][0-9]*)$/.test(val)) {
+    throw new Error(`Chunk [${index}] must be a canonical decimal string; got ${JSON.stringify(val)}`);
+  }
+  const n = BigInt(val);
+  if (n < 0n || n >= ZKCP_FIELD_R) {
+    throw new Error(`Chunk [${index}] value is not a canonical BN254 scalar field element (must be 0 <= x < r)`);
+  }
+  return n;
+}
+
+export async function marketVerifyCommand(flags, io) {
+  const listingPath = getFlag(flags, ['listing', 'file']);
+  if (!listingPath) {
+    throw new Error('Missing required flag: --listing <path_to_listing.json>');
+  }
+
+  let listing;
+  try {
+    const content = await readFile(resolve(listingPath), 'utf8');
+    listing = JSON.parse(content);
+  } catch (err) {
+    throw new Error(`Failed to read listing file at ${listingPath}: ${err.message}`);
+  }
+
+  if (!listing || typeof listing !== 'object') {
+    throw new Error('Listing payload must be a JSON object');
+  }
+
+  const termsHash = parseZkcpHex32(listing.saleTermsHashHex || listing.saleTermsHash, 'saleTermsHash');
+  const keyCommit = parseZkcpHex32(listing.keyCommitHex || listing.keyCommit, 'keyCommit');
+  const envelopeCommit = parseZkcpHex32(listing.envelopeCommitHex || listing.envelopeCommit, 'envelopeCommit');
+  const expectedCipherCommit = parseZkcpHex32(listing.cipherCommitHex || listing.cipherCommit, 'cipherCommit');
+  const chunks = listing.ciphertextChunks || listing.ciphertext;
+
+  if (!Array.isArray(chunks) || chunks.length !== 32) {
+    throw new Error(`Listing ciphertextChunks must be an array of exactly 32 BN254 limbs; got ${Array.isArray(chunks) ? chunks.length : typeof chunks}`);
+  }
+
+  const parsedLimbs = chunks.map((c, idx) => parseZkcpLimb(c, idx));
+
+  const { poseidon } = await import('../../../cortex-v3/zk/zk-tree.mjs');
+  let acc = 0n;
+  for (const limb of parsedLimbs) {
+    acc = poseidon([acc, limb]);
+  }
+  const computedCipherCommit = '0x' + acc.toString(16).padStart(64, '0');
+
+  if (computedCipherCommit.toLowerCase() !== expectedCipherCommit.toLowerCase()) {
+    print({
+      ok: false,
+      verified: false,
+      error: 'Cipher fold mismatch: computed Poseidon fold of ciphertext chunks does not match listing cipherCommit',
+      computedCipherCommit,
+      expectedCipherCommit,
+    }, io);
+    return 1;
+  }
+
+  print({
+    ok: true,
+    offlineCipherFoldValid: true,
+    formatChecks: {
+      listingFormatValid: true,
+      canonicalCommitments: true,
+      chunkCount: 32,
+      canonicalDecimalLimbs: true,
+      cipherFoldMatch: true,
+    },
+    saleTermsHash: termsHash,
+    keyCommit,
+    envelopeCommit,
+    cipherCommit: computedCipherCommit,
+    honestyNote: 'Offline cryptographic cipher fold verification against listing commitments. Does not attest to on-chain receipt existence without RPC connection.',
+  }, io);
+  return 0;
+}
+export async function marketDemoCommand(flags, io) {
+  print({
+    ok: true,
+    mode: 'demo_fixture',
+    fixture: {
+      saleTermsHash: '0x4a91f48bc29124a919024fba901249b910294bca',
+      priceSol: '0.015 SOL',
+      status: 'DEMO_FIXTURE',
+    },
+    honestyNote: 'Local fixture demonstration only; not an on-chain transaction.',
+  }, io);
+  return 0;
+}
+export async function zkStatusCommand(flags, io) {
+  print({
+    ok: true,
+    zkEngine: {
+      status: 'ONLINE',
+      curves: ['BN254 (alt_bn128 BE)', 'BabyJubjub'],
+      prover: 'Groth16 SnarkJS WASM (Client-Side)',
+      verifierProgram: 'E18KZR1Jq8fG3FFACpoHsE21ME3t1ftKPEwXL7cFWkoZ',
+      trees: ['Note Sparse Merkle Tree (SMT)', 'Nullifier Indexed Merkle Tree (IMT)'],
+      honesty: 'Localnet/Devnet demo ceremony; nullifiers prove non-use, not deletion.',
+    },
+  }, io);
+  return 0;
+}
+export async function enterpriseDemoCommand(_flags, io) {
+  print(runEnterpriseDemo(), io);
+  return 0;
+}
+
+export async function doctorCommand(flags, io) {
+  const packageJson = await readPackageJson();
+  const requiredNodeMajor = minimumNodeMajor(packageJson.engines?.node);
+  const currentNodeMajor = nodeMajor(process.versions.node);
+  const binMap = packageJson.bin && typeof packageJson.bin === 'object' && !Array.isArray(packageJson.bin) ? packageJson.bin : {};
+  const binEntries = await Promise.all(REQUIRED_PACKAGE_BINS.map(async (name) => {
+    const target = binMap[name];
+    const declared = typeof target === 'string' && target.length > 0;
+    return {
+      name,
+      target: declared ? target : null,
+      declared,
+      exists: declared ? await fileExists(packageFileUrl(target)) : false,
+    };
+  }));
+  const schemas = await schemaFiles();
+  const bundleInput = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
+  const resolvedBundlePath = resolve(bundleInput);
+  const publicBundlePath = publicPathDisplay(bundleInput, 'bundle-path');
+  const vaultPath = await writableVaultPathCheck(resolvedBundlePath, publicBundlePath);
+  const selectedClient = getFlag(flags, ['client']);
+  const doctorOptions = selectedClient && selectedClient !== true
+    ? { ...connectorOptions(flags), clientId: String(selectedClient), redactPaths: true }
+    : { ...connectorOptions(flags), clientId: undefined, redactPaths: true };
+  const connectorDoctor = await doctorConnectors(doctorOptions);
+  const profile = getClientProfile(String(selectedClient && selectedClient !== true ? selectedClient : 'generic-mcp'), connectorOptions(flags));
+  const checks = {
+    node: {
+      ok: requiredNodeMajor === 0 || currentNodeMajor >= requiredNodeMajor,
+      current: process.versions.node,
+      required: packageJson.engines?.node ?? null,
+    },
+    npm: npmUserAgentCheck(),
+    package_bins: {
+      ok: binEntries.every((entry) => entry.declared && entry.exists),
+      required: REQUIRED_PACKAGE_BINS,
+      entries: binEntries,
+      missing: binEntries.filter((entry) => !entry.declared).map((entry) => entry.name),
+      missing_targets: binEntries.filter((entry) => entry.declared && !entry.exists).map((entry) => entry.name),
+    },
+    bundle_default_path: {
+      ok: DEFAULT_BUNDLE === '.enigma/bundle.json',
+      path: DEFAULT_BUNDLE,
+      resolved: publicPathDisplay(resolvedBundlePath, 'bundle-path'),
+    },
+    vault_path: vaultPath,
+    bundle_initialized: await bundleInitializedCheck(resolvedBundlePath, vaultPath),
+    schemas: {
+      ok: schemas.length > 0,
+      count: schemas.length,
+      files: schemas,
+    },
+    mcp_command_name: {
+      ok: profile.command === 'enigma-mcp',
+      command: profile.command,
+      expected: 'enigma-mcp',
+    },
+    connectors: connectorDoctor,
+  };
+  const ok = Object.values(checks).every((check) => check.ok !== false);
+  const doctorClient = String(selectedClient && selectedClient !== true ? selectedClient : 'generic-mcp');
+  const firstRunHint = doctorFirstRunHint(checks.vault_path.path, doctorClient);
+  print({
+    ok,
+    node: checks.node,
+    package_bins: checks.package_bins,
+    npm: checks.npm,
+    vault_path: checks.vault_path,
+    bundle_initialized: checks.bundle_initialized,
+    bundle_default_path: checks.bundle_default_path,
+    schema_count: checks.schemas.count,
+    schemas: checks.schemas,
+    mcp_command_name: checks.mcp_command_name.command,
+    connectors: checks.connectors,
+    first_run_hint: firstRunHint,
+    fresh_install_hint: firstRunHint,
+    next_commands: doctorNextCommands(checks.vault_path.path, doctorClient),
+    checks,
+  }, io);
+  return ok ? 0 : 1;
+}
+
+export async function installCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  const bundleState = await ensureBundle(bundlePath, flags);
   const selectedClient = getFlag(flags, ['client']);
   const clients = selectedClient && selectedClient !== true ? [String(selectedClient)] : supportedClients;
   const snippets = {};
@@ -2213,23 +2816,65 @@ export async function importCommand(source, flags, io, positionalFile = undefine
   const now = getFlag(flags, ['now']);
   if (now && now !== true) options.now = String(now);
   const bundlePath = resolve(String(getFlag(flags, ['bundle'], DEFAULT_BUNDLE)));
-  let vault;
-  if (getFlag(flags, ['write-vault'], false) === true) {
-    await ensureBundle(bundlePath, flags);
-    ({ vault } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) }));
-    options.vault = vault;
+  const accepted = (result) => result.memory_candidates?.length > 0 || result.ok === true;
+  const preflightReport = importer(input, options);
+  let report = preflightReport;
+  let vaultWritten = false;
+
+  if (getFlag(flags, ['write-vault'], false) === true && accepted(preflightReport)) {
+    const credentials = await resolveVaultCredentials(flags);
+    report = await withBundleFileLock(bundlePath, async () => {
+      let vault;
+      let revision = null;
+      if (await fileExists(bundlePath)) {
+        const state = await loadState(bundlePath, credentials);
+        vault = state.vault;
+        revision = state.revision;
+      } else {
+        vault = createVault({
+          subjectId: String(getFlag(flags, ['subject', 'subject-id'], 'local-user')),
+          displayName: String(getFlag(flags, ['display-name', 'name'], 'Local user')),
+          passphrase: credentials.passphrase,
+        });
+      }
+
+      const imported = importer(input, { ...options, vault });
+      if (!accepted(imported)) return imported;
+      await persistState(bundlePath, vault, {
+        ...credentials,
+        lockHeld: true,
+        expectedRevision: revision,
+      });
+      vaultWritten = true;
+      return imported;
+    });
   }
-  const report = importer(input, options);
-  if (vault) await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
+
   const out = getFlag(flags, ['out']);
-  if (out && out !== true) await writeJson(resolve(String(out)), report);
-  print({ ...report, source_file: file, bundle: vault ? bundlePath : undefined, out: out && out !== true ? resolve(String(out)) : undefined }, io);
-  return report.memory_candidates?.length > 0 || report.ok === true ? 0 : 1;
+  let persistedReport;
+  if (out && out !== true) {
+    const passphrase = await resolvePassphrase(flags);
+    if (!passphrase) throw new Error('Persisted import reports require --passphrase, --passphrase-file, or ENIGMA_PASSPHRASE.');
+    persistedReport = await persistImportReport(report, {
+      path: resolve(String(out)),
+      passphrase,
+      now: options.now,
+    });
+  }
+  print({
+    ...publicCapsuleImportResult(report),
+    source_file: file,
+    bundle: vaultWritten ? bundlePath : undefined,
+    out: persistedReport?.path,
+  }, io);
+  return accepted(report) ? 0 : 1;
 }
 
 export async function capsuleExportCommand(flags, io, positionalFile = undefined) {
   const file = resolve(requireFileArg(flags, ['file', 'report'], positionalFile, 'file'));
-  const input = await readJson(file);
+  const passphrase = await resolvePassphrase(flags);
+  if (!passphrase) throw new Error('Capsule export requires --passphrase, --passphrase-file, or ENIGMA_PASSPHRASE.');
+  const input = await loadPersistedImporterArtifact({ path: file, passphrase });
   const now = getFlag(flags, ['now']);
   const capsule = exportEnigmaCapsule({
     reports: Array.isArray(input) ? input : (input.reports ?? input.report ?? input),
@@ -2237,7 +2882,11 @@ export async function capsuleExportCommand(flags, io, positionalFile = undefined
     now: now && now !== true ? String(now) : undefined,
   });
   const out = resolve(String(getFlag(flags, ['out'], 'enigma-capsule.json')));
-  await writeJson(out, capsule);
+  await persistEnigmaCapsule(capsule, {
+    path: out,
+    passphrase,
+    now: now && now !== true ? String(now) : undefined,
+  });
   print({
     ok: capsule.schema === 'enigma.import_capsule.v1',
     schema: capsule.schema,
@@ -2251,20 +2900,61 @@ export async function capsuleExportCommand(flags, io, positionalFile = undefined
 
 export async function capsuleImportCommand(flags, io, positionalFile = undefined) {
   const file = resolve(requireFileArg(flags, ['file', 'capsule'], positionalFile, 'file'));
-  const capsule = await readJson(file);
+  const passphrase = await resolvePassphrase(flags);
+  if (!passphrase) throw new Error('Capsule import requires --passphrase, --passphrase-file, or ENIGMA_PASSPHRASE.');
+  const capsule = await loadPersistedImporterArtifact({ path: file, passphrase });
   const bundlePath = resolve(String(getFlag(flags, ['bundle'], DEFAULT_BUNDLE)));
-  let vault;
   const options = {};
+  const trustDescriptorPath = getFlag(flags, ['trust-descriptor', 'trustDescriptor']);
+  const trustBundlePath = getFlag(flags, ['trust-bundle', 'trustBundle']);
+  if (trustDescriptorPath && trustBundlePath) {
+    throw new Error('Capsule import accepts one trust source: --trust-descriptor or --trust-bundle.');
+  }
+  if (!trustDescriptorPath && !trustBundlePath) {
+    throw new Error('Capsule import requires --trust-descriptor or --trust-bundle.');
+  }
+  if (trustDescriptorPath) options.trustDescriptor = await readJson(resolve(String(trustDescriptorPath)));
+  if (trustBundlePath) options.trustBundle = await readJson(resolve(String(trustBundlePath)));
   const now = getFlag(flags, ['now']);
   if (now && now !== true) options.now = String(now);
-  if (getFlag(flags, ['write-vault'], false) === true) {
-    await ensureBundle(bundlePath, flags);
-    ({ vault } = await loadState(bundlePath, { passphrase: getFlag(flags, ['passphrase']) }));
-    options.vault = vault;
-  }
-  const result = importEnigmaCapsule(capsule, options);
-  if (vault) await persistState(bundlePath, vault, { passphrase: getFlag(flags, ['passphrase']) });
-  print({ ...publicCapsuleImportResult(result), source_file: file, bundle: vault ? bundlePath : undefined }, io);
+
+  const verifiedResult = importEnigmaCapsule(capsule, options);
+  const writeVault = getFlag(flags, ['write-vault'], false) === true;
+  if (!writeVault || !verifiedResult.ok) {
+    print({ ...publicCapsuleImportResult(verifiedResult), source_file: file }, io);
+    return verifiedResult.ok ? 0 : 1;
+  }
+
+  const credentials = await resolveVaultCredentials(flags);
+  const result = await withBundleFileLock(bundlePath, async () => {
+    let vault;
+    let revision = null;
+    if (await fileExists(bundlePath)) {
+      const state = await loadState(bundlePath, credentials);
+      vault = state.vault;
+      revision = state.revision;
+    } else {
+      vault = createVault({
+        subjectId: String(getFlag(flags, ['subject', 'subject-id'], 'local-user')),
+        displayName: String(getFlag(flags, ['display-name', 'name'], 'Local user')),
+        passphrase: credentials.passphrase,
+      });
+    }
+
+    const imported = importEnigmaCapsule(capsule, { ...options, vault });
+    if (!imported.ok) return imported;
+    await persistState(bundlePath, vault, {
+      ...credentials,
+      lockHeld: true,
+      expectedRevision: revision,
+    });
+    return imported;
+  });
+  print({
+    ...publicCapsuleImportResult(result),
+    source_file: file,
+    bundle: result.ok ? bundlePath : undefined,
+  }, io);
   return result.ok ? 0 : 1;
 }
 
@@ -2467,15 +3157,179 @@ function chainArtifactValidator(artifact) {
 
 const SOLANA_SUBMIT_CLUSTERS = new Set(['devnet', 'testnet', 'mainnet-beta', 'localnet']);
 const SOLANA_MEMO_PROGRAM_ID = 'MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr';
+const SOLANA_RPC_CLUSTERS = Object.freeze({
+  devnet: 'https://api.devnet.solana.com',
+  testnet: 'https://api.testnet.solana.com',
+  'mainnet-beta': 'https://api.mainnet-beta.solana.com',
+  localnet: 'http://127.0.0.1:8899',
+});
+const SOLANA_PUBLIC_CLUSTER_GENESIS_HASHES = Object.freeze({
+  devnet: 'EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG',
+  testnet: '4uhcVJyU9pJkvQyS88uRDiswHXSCkY3zQawwpjk2NsNY',
+  'mainnet-beta': '5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d',
+});
+
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const BASE58_MAP = new Map();
+for (let i = 0; i < BASE58_ALPHABET.length; i += 1) BASE58_MAP.set(BASE58_ALPHABET[i], BigInt(i));
+
+function decodeBase58Utf8(str) {
+  if (typeof str !== 'string' || str.length === 0 || str.length > 100000) return null;
+  let num = 0n;
+  for (let i = 0; i < str.length; i += 1) {
+    const val = BASE58_MAP.get(str[i]);
+    if (val === undefined) return null;
+    num = num * 58n + val;
+  }
+  const bytes = [];
+  while (num > 0n) {
+    bytes.push(Number(num & 0xffn));
+    num >>= 8n;
+  }
+  for (let i = 0; i < str.length && str[i] === '1'; i += 1) {
+    bytes.push(0);
+  }
+  bytes.reverse();
+  return Buffer.from(bytes).toString('utf8');
+}
+
+function decodeBase58Buffer(str) {
+  if (typeof str !== 'string' || str.length === 0 || str.length > 100000) return null;
+  let num = 0n;
+  for (let i = 0; i < str.length; i += 1) {
+    const val = BASE58_MAP.get(str[i]);
+    if (val === undefined) return null;
+    num = num * 58n + val;
+  }
+  const bytes = [];
+  while (num > 0n) {
+    bytes.push(Number(num & 0xffn));
+    num >>= 8n;
+  }
+  for (let i = 0; i < str.length && str[i] === '1'; i += 1) {
+    bytes.push(0);
+  }
+  bytes.reverse();
+  const result = Buffer.from(bytes);
+  if (result.length < 32) {
+    return Buffer.concat([Buffer.alloc(32 - result.length), result]);
+  }
+  return result.length === 32 ? result : result.subarray(result.length - 32);
+}
+
+function encodeBase58Buffer(buffer) {
+  if (!Buffer.isBuffer(buffer) || buffer.length === 0) return '';
+  let leadingZeros = 0;
+  for (let i = 0; i < buffer.length && buffer[i] === 0; i += 1) {
+    leadingZeros += 1;
+  }
+  let num = BigInt('0x' + (buffer.toString('hex') || '0'));
+  let encoded = '';
+  while (num > 0n) {
+    const rem = Number(num % 58n);
+    num = num / 58n;
+    encoded = BASE58_ALPHABET[rem] + encoded;
+  }
+  return '1'.repeat(leadingZeros) + encoded;
+}
+function parseStrictSolanaMemoRef(raw) {
+  if (typeof raw !== 'string' || raw.length === 0 || raw.length > 16384) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
+  if (parsed.memo_ref && typeof parsed.memo_ref === 'object' && !Array.isArray(parsed.memo_ref)) parsed = parsed.memo_ref;
+  const keys = Object.keys(parsed).sort();
+  const expectedKeys = ['artifact_hash', 'artifact_type', 'cluster', 'proof_commitment', 'protocol', 'rail', 'v'];
+  if (keys.length !== expectedKeys.length) return null;
+  for (let i = 0; i < expectedKeys.length; i += 1) {
+    if (keys[i] !== expectedKeys[i]) return null;
+  }
+  if (parsed.v !== 1) return null;
+  if (parsed.protocol !== 'enigma-proof-network') return null;
+  if (parsed.rail !== 'solana-memo') return null;
+  if (typeof parsed.cluster !== 'string' || !SOLANA_SUBMIT_CLUSTERS.has(parsed.cluster)) return null;
+  if (typeof parsed.artifact_type !== 'string' || !parsed.artifact_type.startsWith('enigma.proof_network.')) return null;
+  if (typeof parsed.artifact_hash !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(parsed.artifact_hash)) return null;
+  if (typeof parsed.proof_commitment !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(parsed.proof_commitment)) return null;
+  return parsed;
+}
+
+function isVaultBundle(value) {
+  return value && typeof value === 'object' && value.schema === 'enigma.vault_bundle.v1';
+}
+
+export function anchorBatchFromVaultBundle(bundle, cluster, flags) {
+  const verifyReport = verifyBundle(bundle);
+  if (verifyReport.ok !== true) throw new Error('Local vault bundle verification failed; refusing to derive a Solana anchor.');
+
+  const vault = bundle.vault ?? {};
+  const roots = [vault.active_set_root, vault.receipt_log_root]
+    .filter((root) => typeof root === 'string' && root.startsWith('sha256:'));
+  if (roots.length === 0) throw new Error('Local vault bundle has no anchorable commitment roots.');
+
+  const bundleRef = vault.vault_id ? `enigma://vault/${vault.vault_id}` : 'enigma://vault/local';
+  const refs = [
+    `${bundleRef}/active_set_root`,
+    `${bundleRef}/receipt_log_root`,
+    ...flagValues(flags, ['ref', 'refs', 'public-ref', 'publicRef']),
+  ];
+  const input = {
+    roots,
+    root_count: roots.length,
+    commitment_count: roots.length,
+    refs,
+    public_chain_ref: getFlag(flags, ['public-chain-ref', 'publicChainRef', 'chain-ref', 'chainRef'], `solana:${cluster}:spl-memo`),
+    authority_ref: getFlag(flags, ['authority', 'authority-ref', 'authorityRef'], 'authority:local-enigma-cli'),
+    batch_ref: getFlag(flags, ['batch-ref', 'batchRef'], `${bundleRef}/anchor-batch/${cluster}`),
+    cluster_ref: solanaClusterRef(cluster),
+    transaction_submitted: false,
+    raw_memory_on_chain: false,
+  };
+  const createdAt = getFlag(flags, ['created-at', 'createdAt']) ?? bundle.exported_at;
+  if (createdAt !== undefined) input.created_at = createdAt;
+  const batch = createProofNetworkAnchorBatch(input);
+  const validation = chainValidationResult(validateProofNetworkAnchorBatch, batch);
+  if (validation.ok !== true) throw new Error('Derived local Solana anchor batch failed proof-network validation.');
+  return { artifact: batch, schema: batch.schema, validation, source_schema: bundle.schema };
+}
+
+export function normalizeSolanaLocalArtifact(source, cluster, flags) {
+  const candidate = source?.bundle && isVaultBundle(source.bundle) ? source.bundle : source;
+  if (isVaultBundle(candidate)) return anchorBatchFromVaultBundle(candidate, cluster, flags);
+
+  assertNoPrivateProofPayload(candidate);
+  const [schema, validate] = chainArtifactValidator(candidate);
+  const validation = chainValidationResult(validate, candidate);
+  if (validation.ok !== true) throw new Error(validation.errors?.join('; ') || 'Invalid proof-network artifact.');
+  assertArtifactClusterMatchesSubmit(candidate, cluster);
+  return { artifact: candidate, schema, validation, source_schema: schema };
+}
 
 function solanaSubmitCluster(flags) {
-  const cluster = String(requireFlag(flags, ['cluster'], 'cluster'));
+  let cluster = String(requireFlag(flags, ['cluster'], 'cluster'));
+  if (cluster.startsWith('solana:')) cluster = cluster.slice(7);
   if (!SOLANA_SUBMIT_CLUSTERS.has(cluster)) {
     throw new Error('--cluster must be one of devnet, testnet, mainnet-beta, or localnet.');
   }
   return cluster;
 }
 
+function solanaClusterRef(cluster) {
+  return `solana:${cluster}`;
+}
+
+function assertArtifactClusterMatchesSubmit(artifact, cluster) {
+  const expected = solanaClusterRef(cluster);
+  const actual = artifact?.cluster_ref ?? artifact?.clusterRef;
+  if (actual !== undefined && actual !== expected) {
+    throw new Error(`Proof artifact cluster_ref ${actual} does not match requested Solana cluster ${expected}.`);
+  }
+}
+
 function createSolanaProofMemoRef(schema, artifact, cluster) {
   const artifactHash = proofNetworkSha256Json(artifact);
   const proofCommitment = proofNetworkSha256Json({
@@ -2535,6 +3389,123 @@ function solanaSubmitRpcUrl(flags, cluster, clusterApiUrl) {
   return clusterApiUrl(cluster);
 }
 
+function solanaLocalnetRpcPolicy(rpcUrl, mode = 'execute') {
+  let parsed;
+  try {
+    parsed = new URL(rpcUrl);
+  } catch {
+    throw new Error('Solana --rpc must be a valid HTTP(S) URL.');
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error('Solana --rpc must be a valid HTTP(S) URL.');
+  }
+  const host = parsed.hostname.toLowerCase();
+  const loopback = host === 'localhost' || host === '127.0.0.1' || host === '[::1]' || host === '::1';
+  if (!loopback) {
+    throw new Error(`Solana localnet ${mode} requires a loopback RPC endpoint; use devnet, testnet, or mainnet-beta for public RPC endpoints.`);
+  }
+  return 'localnet-loopback';
+}
+
+async function verifySolanaRpcGenesis(connection, cluster, rpcUrl) {
+  const localnetPolicy = cluster === 'localnet' ? solanaLocalnetRpcPolicy(rpcUrl, 'execute mode') : undefined;
+  let genesisHash;
+  try {
+    genesisHash = await connection.getGenesisHash();
+  } catch {
+    throw new Error('Unable to verify Solana RPC genesis hash before submission.');
+  }
+
+  if (cluster === 'localnet') {
+    return {
+      genesis_hash: genesisHash,
+      genesis_policy: localnetPolicy,
+    };
+  }
+
+  const expected = SOLANA_PUBLIC_CLUSTER_GENESIS_HASHES[cluster];
+  if (genesisHash !== expected) {
+    throw new Error(`Solana RPC genesis hash ${genesisHash} does not match requested cluster ${cluster} (${expected}); refusing to submit a mislabeled memo.`);
+  }
+  return {
+    genesis_hash: genesisHash,
+    expected_genesis_hash: expected,
+    genesis_policy: 'public-cluster-genesis',
+  };
+}
+
+function solanaVerifyRpcUrl(flags, cluster) {
+  const rpc = getFlag(flags, ['rpc']);
+  const custom = rpc !== undefined && rpc !== true && rpc !== '';
+  const url = custom
+    ? String(lastFlagValue(rpc))
+    : SOLANA_RPC_CLUSTERS[cluster];
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error('Solana --rpc must be a valid HTTP(S) URL.');
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') throw new Error('Solana --rpc must be a valid HTTP(S) URL.');
+  if (cluster === 'localnet') solanaLocalnetRpcPolicy(url, 'verification');
+  return { url, label: custom ? '<custom-rpc>' : `${cluster}:default` };
+}
+
+function redactSolanaRpcError(error) {
+  const message = String(error?.message ?? error ?? 'Solana RPC request failed')
+    .replace(/[a-z][a-z0-9+.-]*:\/\/[^\s/@]+:[^\s/@]+@[^\s)]+/giu, '<custom-rpc>')
+    .replace(/https?:\/\/[^\s)]+/giu, '<rpc>')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/giu, 'Bearer <redacted>')
+    .replace(/Basic\s+[A-Za-z0-9+/=-]+/giu, 'Basic <redacted>')
+    .replace(/(?:api[_-]?key|token|password|secret)=?[^\s,;)]*/giu, '$1=<redacted>')
+    .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gu, '<private-key-redacted>');
+  return message.slice(0, 240);
+}
+
+async function solanaRpcCall({ url, method, params = [], fetchFn = globalThis.fetch, timeoutMs = 10000 }) {
+  if (typeof fetchFn !== 'function') throw new Error('Solana verification requires a fetch-capable runtime.');
+  let timer;
+  const controller = typeof AbortController !== 'undefined' ? new AbortController() : null;
+  try {
+    if (controller) timer = setTimeout(() => controller.abort(), timeoutMs);
+    const response = await fetchFn(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ jsonrpc: '2.0', id: `enigma-verify-${method}`, method, params }),
+      signal: controller?.signal,
+    });
+    if (response?.ok === false) throw new Error(`HTTP ${response.status}`);
+    const payload = await response.json();
+    if (payload?.error) throw new Error(payload.error.message || `RPC ${method} failed`);
+    return payload?.result;
+  } catch (error) {
+    throw new Error(redactSolanaRpcError(error));
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+function verifySolanaGenesisHash(genesisHash, cluster, rpcUrl) {
+  const localnetPolicy = cluster === 'localnet' ? solanaLocalnetRpcPolicy(rpcUrl, 'verification') : undefined;
+  if (cluster === 'localnet') return { genesis_hash: genesisHash ?? null, genesis_policy: localnetPolicy };
+  const expected = SOLANA_PUBLIC_CLUSTER_GENESIS_HASHES[cluster];
+  if (genesisHash !== expected) {
+    return {
+      verified: false,
+      genesis_hash: genesisHash ?? null,
+      expected_genesis_hash: expected,
+      genesis_policy: 'public-cluster-genesis',
+      failure_code: 'RPC_GENESIS_MISMATCH',
+    };
+  }
+  return {
+    verified: true,
+    genesis_hash: genesisHash,
+    expected_genesis_hash: expected,
+    genesis_policy: 'public-cluster-genesis',
+  };
+}
+
 async function submitSolanaMemoTransaction(flags, cluster, memoRef) {
   const keypairPath = resolve(String(requireFlag(flags, ['keypair'], 'keypair')));
   const secretKey = await readSolanaKeypair(keypairPath);
@@ -2545,7 +3516,9 @@ async function submitSolanaMemoTransaction(flags, cluster, memoRef) {
   } catch {
     throw new Error('Solana --keypair could not be loaded as a signer.');
   }
-  const connection = new Connection(solanaSubmitRpcUrl(flags, cluster, clusterApiUrl), 'confirmed');
+  const rpcUrl = solanaSubmitRpcUrl(flags, cluster, clusterApiUrl);
+  const connection = new Connection(rpcUrl, 'confirmed');
+  const genesis = await verifySolanaRpcGenesis(connection, cluster, rpcUrl);
   const memoBytes = Buffer.from(JSON.stringify(memoRef), 'utf8');
   const transaction = new Transaction().add(new TransactionInstruction({
     keys: [],
@@ -2553,7 +3526,8 @@ async function submitSolanaMemoTransaction(flags, cluster, memoRef) {
     data: memoBytes,
   }));
   try {
-    return await sendAndConfirmTransaction(connection, transaction, [payer], { commitment: 'confirmed' });
+    const signature = await sendAndConfirmTransaction(connection, transaction, [payer], { commitment: 'confirmed' });
+    return { signature, ...genesis };
   } catch {
     throw new Error('Solana submission failed before a public-safe transaction signature was returned.');
   }
@@ -2562,16 +3536,14 @@ async function submitSolanaMemoTransaction(flags, cluster, memoRef) {
 export async function chainSubmitSolanaCommand(flags, io, positionalFile = undefined) {
   const inPath = resolve(String(requireFileArg(flags, ['file', 'in'], positionalFile, 'file')));
   const cluster = solanaSubmitCluster(flags);
-  let artifact;
+  let source;
   try {
-    artifact = await readJson(inPath);
+    source = await readJson(inPath);
   } catch {
     throw new Error('Unable to read a valid proof artifact JSON file.');
   }
-  assertNoPrivateProofPayload(artifact);
-  const [schema, validate] = chainArtifactValidator(artifact);
-  const result = chainValidationResult(validate, artifact);
-  if (result.ok !== true) throw new Error(result.errors?.join('; ') || 'Invalid proof-network artifact.');
+  const normalized = normalizeSolanaLocalArtifact(source, cluster, flags);
+  const { artifact, schema, validation: result, source_schema } = normalized;
   const memoRef = createSolanaProofMemoRef(schema, artifact, cluster);
   const execute = booleanFlag(flags, ['execute'], false);
   if (!execute) {
@@ -2585,6 +3557,7 @@ export async function chainSubmitSolanaCommand(flags, io, positionalFile = undef
       transaction_submitted: false,
       raw_memory_on_chain: false,
       artifact_type: schema,
+      source_schema,
       artifact_hash: memoRef.artifact_hash,
       proof_commitment: memoRef.proof_commitment,
       memo_program: SOLANA_MEMO_PROGRAM_ID,
@@ -2599,7 +3572,7 @@ export async function chainSubmitSolanaCommand(flags, io, positionalFile = undef
     }, io);
     return 0;
   }
-  const signature = await submitSolanaMemoTransaction(flags, cluster, memoRef);
+  const submission = await submitSolanaMemoTransaction(flags, cluster, memoRef);
   print({
     ok: true,
     command: 'chain submit-solana',
@@ -2609,8 +3582,11 @@ export async function chainSubmitSolanaCommand(flags, io, positionalFile = undef
     rpc_endpoint: solanaSubmitRpcLabel(flags, cluster),
     transaction_submitted: true,
     raw_memory_on_chain: false,
-    signature,
+    signature: submission.signature,
+    rpc_genesis_hash: submission.genesis_hash,
+    rpc_genesis_policy: submission.genesis_policy,
     artifact_type: schema,
+    source_schema,
     artifact_hash: memoRef.artifact_hash,
     proof_commitment: memoRef.proof_commitment,
     memo_program: SOLANA_MEMO_PROGRAM_ID,
@@ -2620,11 +3596,398 @@ export async function chainSubmitSolanaCommand(flags, io, positionalFile = undef
   return 0;
 }
 
+function solanaInstructionProgramId(instruction, message) {
+  if (typeof instruction?.programId === 'string') return instruction.programId;
+  if (instruction?.programId && typeof instruction.programId.toString === 'function') return instruction.programId.toString();
+  if (instruction?.programIdIndex !== undefined) {
+    const key = message?.accountKeys?.[instruction.programIdIndex];
+    return typeof key === 'string' ? key : key?.pubkey?.toString?.() ?? null;
+  }
+  return null;
+}
+
+function memoTextFromInstruction(instruction) {
+  if (typeof instruction?.parsed === 'string') return instruction.parsed;
+  if (instruction?.parsed && typeof instruction.parsed === 'object') {
+    const info = instruction.parsed.info ?? instruction.parsed;
+    if (typeof info.memo === 'string') return info.memo;
+    if (typeof info.data === 'string') return info.data;
+  }
+  const data = instruction?.data;
+  if (Array.isArray(data) && typeof data[0] === 'string') {
+    if (data[1] === 'base64') {
+      try { return Buffer.from(data[0], 'base64').toString('utf8'); } catch { return null; }
+    }
+    return decodeBase58Utf8(data[0]);
+  }
+  if (typeof data === 'string') return data.trim().startsWith('{') ? data : decodeBase58Utf8(data);
+  if (data instanceof Uint8Array || Buffer.isBuffer(data)) return Buffer.from(data).toString('utf8');
+  return null;
+}
+
+function extractSolanaMemoRefs(transaction) {
+  const message = transaction?.transaction?.message ?? transaction?.message;
+  const instructions = Array.isArray(message?.instructions) ? message.instructions : [];
+  const protocolRefs = [];
+  let memoInstructionCount = 0;
+  for (const instruction of instructions) {
+    if (solanaInstructionProgramId(instruction, message) !== SOLANA_MEMO_PROGRAM_ID) continue;
+    memoInstructionCount += 1;
+    const candidate = parseStrictSolanaMemoRef(memoTextFromInstruction(instruction));
+    if (candidate) protocolRefs.push(candidate);
+  }
+  return { memo_instruction_count: memoInstructionCount, protocol_refs: protocolRefs };
+}
+
+function solanaTransactionSignatures(transaction) {
+  const value = transaction?.transaction?.signatures ?? transaction?.signatures;
+  return Array.isArray(value) ? value.map((item) => String(item)).filter(Boolean) : [];
+}
+
+function validateSolanaSignature(value) {
+  const signature = String(value ?? '').trim();
+  if (!/^[1-9A-HJ-NP-Za-km-z]{32,100}$/u.test(signature)) throw new Error('Solana --signature must be a base58 transaction signature.');
+  return signature;
+}
+
+function safeObservedMemoRef(ref) {
+  if (!ref) return null;
+  return {
+    v: ref.v,
+    protocol: ref.protocol,
+    rail: ref.rail,
+    cluster: SOLANA_SUBMIT_CLUSTERS.has(ref.cluster) ? ref.cluster : null,
+    artifact_type: typeof ref.artifact_type === 'string' && /^enigma\.[a-z0-9_.-]{2,120}$/u.test(ref.artifact_type) ? ref.artifact_type : null,
+    artifact_hash: /^sha256:[a-f0-9]{64}$/u.test(ref.artifact_hash) ? ref.artifact_hash : null,
+    proof_commitment: /^sha256:[a-f0-9]{64}$/u.test(ref.proof_commitment) ? ref.proof_commitment : null,
+  };
+}
+
+function solanaBlockTimeIso(value) {
+  if (!Number.isFinite(value)) return null;
+  const date = new Date(value * 1000);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+
+function solanaPayer(transaction) {
+  const key = transaction?.transaction?.message?.accountKeys?.[0];
+  const value = typeof key === 'string' ? key : key?.pubkey;
+  const payer = typeof value === 'string' ? value : value?.toString?.() ?? '';
+  return /^[1-9A-HJ-NP-Za-km-z]{32,44}$/u.test(payer) ? payer : null;
+}
+
+function solanaVerificationBase({ cluster, rpcEndpoint, signature, normalized, source }) {
+  const memoRef = createSolanaProofMemoRef(normalized.schema, normalized.artifact, cluster);
+  return {
+    ok: false,
+    command: 'chain verify-solana',
+    chain: 'solana',
+    cluster,
+    rpc_endpoint: rpcEndpoint,
+    signature: signature ?? null,
+    transaction_source: source,
+    transaction_observed: false,
+    verified_on_chain: false,
+    verification_status: 'not_verified',
+    slot: null,
+    block_time: null,
+    confirmation_status: null,
+    confirmation_depth: null,
+    slot_depth: null,
+    transaction_success: null,
+    memo_program: SOLANA_MEMO_PROGRAM_ID,
+    artifact_type: memoRef.artifact_type,
+    source_schema: normalized.source_schema,
+    artifact_hash: memoRef.artifact_hash,
+    proof_commitment: memoRef.proof_commitment,
+    raw_memory_on_chain: false,
+    local_validation: normalized.validation,
+    claim_boundary: 'Verification proves only that this Solana transaction contains the selected public commitment. It does not prove factual truth, absence of model hallucinations, provider deletion, or physical deletion by a third party.',
+  };
+}
+
+function solanaMemoMatchReport(observed, expected, { uniqueMemo, transactionSuccess }) {
+  return {
+    unique_memo: uniqueMemo,
+    transaction_success: transactionSuccess === true,
+    version: observed?.v === expected.v,
+    protocol: observed?.protocol === expected.protocol,
+    rail: observed?.rail === expected.rail,
+    cluster: observed?.cluster === expected.cluster,
+    artifact_type: observed?.artifact_type === expected.artifact_type,
+    artifact_hash: observed?.artifact_hash === expected.artifact_hash,
+    proof_commitment: observed?.proof_commitment === expected.proof_commitment,
+  };
+}
+
+async function solanaConfirmationInfo({ rpcUrl, signature, transactionSlot, fetchFn }) {
+  let status = null;
+  let currentSlot = null;
+  try {
+    const result = await solanaRpcCall({ url: rpcUrl, method: 'getSignatureStatuses', params: [[signature], { searchTransactionHistory: true }], fetchFn });
+    status = Array.isArray(result) ? result[0] : result?.value?.[0] ?? null;
+  } catch {
+    // Confirmation depth is supplementary; a node may omit it while retaining the transaction.
+  }
+  try {
+    currentSlot = await solanaRpcCall({ url: rpcUrl, method: 'getSlot', params: [{ commitment: 'confirmed' }], fetchFn });
+  } catch {
+    // Keep depth unknown rather than turning a valid memo into a false negative.
+  }
+  return {
+    confirmation_status: status?.confirmationStatus ?? null,
+    confirmation_depth: Number.isInteger(status?.confirmations) ? status.confirmations : null,
+    slot_depth: Number.isInteger(currentSlot) && Number.isInteger(transactionSlot) && currentSlot >= transactionSlot ? currentSlot - transactionSlot : null,
+  };
+}
+
+async function legacyVerifySolanaCommand(flags, io, positionalFile = undefined) {
+  const inPath = resolve(String(requireFileArg(flags, ['file', 'in', 'artifact'], positionalFile, 'file')));
+  const signature = String(requireFlag(flags, ['signature', 'sig', 'tx', 'txid'], 'signature'));
+  const cluster = solanaSubmitCluster(flags);
+  let artifact;
+  try {
+    artifact = await readJson(inPath);
+  } catch {
+    throw new Error('Unable to read a valid proof artifact JSON file.');
+  }
+  assertNoPrivateProofPayload(artifact);
+  const [schema, validate] = chainArtifactValidator(artifact);
+  const result = chainValidationResult(validate, artifact);
+  if (result.ok !== true) throw new Error(result.errors?.join('; ') || 'Invalid proof-network artifact.');
+  assertArtifactClusterMatchesSubmit(artifact, cluster);
+  const expectedMemoRef = createSolanaProofMemoRef(schema, artifact, cluster);
+
+  const { Connection, clusterApiUrl } = await loadSolanaWeb3();
+  const rpcUrl = solanaSubmitRpcUrl(flags, cluster, clusterApiUrl);
+  const connection = new Connection(rpcUrl, 'confirmed');
+  const genesis = await verifySolanaRpcGenesis(connection, cluster, rpcUrl);
+
+  let tx;
+  try {
+    tx = await connection.getParsedTransaction(signature, {
+      maxSupportedTransactionVersion: 0,
+      commitment: 'confirmed',
+    });
+  } catch {
+    throw new Error('Failed to query Solana transaction confirmation.');
+  }
+  if (!tx) {
+    throw new Error(`Solana transaction ${signature} was not found on cluster ${cluster}.`);
+  }
+
+  const signatures = Array.isArray(tx.transaction?.signatures) ? tx.transaction.signatures : [];
+  if (!signatures.includes(signature)) {
+    throw new Error(`Solana transaction response does not contain the requested signature ${signature}.`);
+  }
+
+  if (!tx.meta || tx.meta.err !== null) {
+    throw new Error(`Solana transaction ${signature} missing metadata or failed on-chain; its memo is not valid committed state.`);
+  }
+
+  let foundMemoRef = null;
+  const instructions = tx.transaction?.message?.instructions || [];
+  for (const ix of instructions) {
+    const progId = ix.programId ? ix.programId.toString() : (ix.programIdIndex !== undefined ? tx.transaction.message.accountKeys[ix.programIdIndex]?.pubkey?.toString() : null);
+    if (progId === SOLANA_MEMO_PROGRAM_ID) {
+      let raw = null;
+      if (typeof ix.parsed === 'string') {
+        raw = ix.parsed;
+      } else if (typeof ix.data === 'string') {
+        raw = decodeBase58Utf8(ix.data);
+      }
+      if (raw) {
+        const candidate = parseStrictSolanaMemoRef(raw);
+        if (candidate) {
+          foundMemoRef = candidate;
+          break;
+        }
+      }
+    }
+  }
+
+  if (!foundMemoRef) {
+    throw new Error(`Solana transaction ${signature} does not contain a valid Enigma SPL Memo instruction.`);
+  }
+
+  const isVerified = (
+    foundMemoRef.v === expectedMemoRef.v &&
+    foundMemoRef.protocol === expectedMemoRef.protocol &&
+    foundMemoRef.rail === expectedMemoRef.rail &&
+    foundMemoRef.cluster === expectedMemoRef.cluster &&
+    foundMemoRef.artifact_type === expectedMemoRef.artifact_type &&
+    foundMemoRef.artifact_hash === expectedMemoRef.artifact_hash &&
+    foundMemoRef.proof_commitment === expectedMemoRef.proof_commitment
+  );
+
+  const blockTimeIso = tx.blockTime ? new Date(tx.blockTime * 1000).toISOString() : null;
+  const payer = tx.transaction?.message?.accountKeys?.[0]?.pubkey ? tx.transaction.message.accountKeys[0].pubkey.toString() : (tx.transaction?.message?.accountKeys?.[0] ? tx.transaction.message.accountKeys[0].toString() : 'unknown');
+
+  print({
+    ok: isVerified,
+    command: 'chain verify-solana',
+    chain: 'solana',
+    cluster,
+    signature,
+    verified_on_chain: isVerified,
+    slot: Number(tx.slot),
+    block_time: blockTimeIso,
+    payer,
+    fee_lamports: Number(tx.meta?.fee ?? 0),
+    memo_program: SOLANA_MEMO_PROGRAM_ID,
+    artifact_type: expectedMemoRef.artifact_type,
+    artifact_hash: expectedMemoRef.artifact_hash,
+    proof_commitment: expectedMemoRef.proof_commitment,
+    rpc_genesis_hash: genesis.genesis_hash,
+    rpc_genesis_policy: genesis.genesis_policy,
+  }, io);
+
+  return isVerified ? 0 : 1;
+}
+
+export async function chainVerifySolanaCommand(flags, io, positionalFile = undefined) {
+  const sourceFlag = getFlag(flags, ['file', 'in', 'artifact', 'anchor-file', 'anchor', 'bundle', 'export']);
+  const sourcePath = sourceFlag !== undefined && sourceFlag !== true && sourceFlag !== ''
+    ? String(lastFlagValue(sourceFlag))
+    : (sourceFlag === undefined && positionalFile ? String(positionalFile) : undefined);
+  if (!sourcePath) throw new Error('Missing required --file <anchor-batch.json|bundle.json|export.json>.');
+  const cluster = solanaSubmitCluster(flags);
+  let source;
+  try {
+    source = await readJson(resolve(sourcePath));
+  } catch {
+    throw new Error('Unable to read a valid local anchor, bundle, or export JSON file.');
+  }
+  const normalized = normalizeSolanaLocalArtifact(source, cluster, flags);
+  const rpc = solanaVerifyRpcUrl(flags, cluster);
+  const fetchFn = io?.solanaFetch ?? globalThis.fetch;
+  const signatureFlag = getFlag(flags, ['signature', 'sig', 'tx', 'txid']);
+  const transactionFile = getFlag(flags, ['transaction-file', 'tx-file', 'transactionFile', 'txFile']);
+  const transactionInline = getFlag(flags, ['transaction', 'transaction-json', 'transactionJson', 'transaction-object', 'transactionObject', 'tx-object', 'txObject']);
+  if (transactionFile !== undefined && transactionInline !== undefined) throw new Error('Use either --transaction-file or --transaction, not both.');
+
+  let transaction = null;
+  let transactionSource = 'rpc';
+  if (transactionFile !== undefined) {
+    if (transactionFile === true || transactionFile === '') throw new Error('Missing required --transaction-file.');
+    try { transaction = await readJson(resolve(String(transactionFile))); } catch { throw new Error('Unable to read a valid Solana transaction JSON object.'); }
+    transactionSource = 'input';
+  } else if (transactionInline !== undefined) {
+    if (transactionInline === true || transactionInline === '') throw new Error('Missing required --transaction JSON object.');
+    try { transaction = JSON.parse(String(transactionInline)); } catch { throw new Error('Unable to parse --transaction as a JSON object.'); }
+    transactionSource = 'input';
+  }
+
+  let signature = signatureFlag !== undefined && signatureFlag !== true && signatureFlag !== '' ? validateSolanaSignature(lastFlagValue(signatureFlag)) : undefined;
+  if (!signature && sourceFlag !== undefined && positionalFile) signature = validateSolanaSignature(positionalFile);
+  if (!signature && transaction) {
+    const inferred = solanaTransactionSignatures(transaction)[0] ?? transaction?.signature;
+    if (inferred) signature = validateSolanaSignature(inferred);
+  }
+  if (!signature) throw new Error('Provide --signature <transaction-signature> or a transaction object containing a signature.');
+
+  const report = solanaVerificationBase({
+    cluster,
+    rpcEndpoint: rpc.label,
+    signature,
+    normalized,
+    source: transactionSource,
+  });
+  let genesis;
+  try {
+    const genesisHash = await solanaRpcCall({ url: rpc.url, method: 'getGenesisHash', fetchFn });
+    genesis = verifySolanaGenesisHash(genesisHash, cluster, rpc.url);
+  } catch (error) {
+    print({ ...report, verification_status: 'rpc_error', error: { code: 'SOLANA_RPC_ERROR', message: redactSolanaRpcError(error) } }, io);
+    return 1;
+  }
+  Object.assign(report, {
+    rpc_genesis_hash: genesis.genesis_hash,
+    rpc_genesis_policy: genesis.genesis_policy,
+    network_verified: genesis.verified !== false,
+  });
+  if (genesis.verified === false) {
+    Object.assign(report, { verification_status: 'network_mismatch', failure_code: genesis.failure_code });
+    print(report, io);
+    return 1;
+  }
+
+  if (!transaction) {
+    try {
+      try {
+        transaction = await solanaRpcCall({
+          url: rpc.url,
+          method: 'getTransaction',
+          params: [signature, { encoding: 'jsonParsed', commitment: 'confirmed', maxSupportedTransactionVersion: 0 }],
+          fetchFn,
+        });
+      } catch (firstError) {
+        // Older validators reject maxSupportedTransactionVersion; retry with the legacy-compatible shape.
+        try {
+          transaction = await solanaRpcCall({
+            url: rpc.url,
+            method: 'getTransaction',
+            params: [signature, { encoding: 'jsonParsed', commitment: 'confirmed' }],
+            fetchFn,
+          });
+        } catch {
+          throw firstError;
+        }
+      }
+    } catch (error) {
+      print({ ...report, verification_status: 'rpc_error', error: { code: 'SOLANA_RPC_ERROR', message: redactSolanaRpcError(error) } }, io);
+      return 1;
+    }
+  }
+  if (transaction?.result && !transaction.transaction && transaction.result.transaction) transaction = transaction.result;
+  if (!transaction) {
+    print({ ...report, verification_status: 'not_found', network_verified: true }, io);
+    return 1;
+  }
+  const txSignatures = solanaTransactionSignatures(transaction);
+  if (txSignatures.length > 0 && !txSignatures.includes(signature)) {
+    throw new Error(`Solana transaction response does not contain the requested signature ${signature}.`);
+  }
+
+  const transactionSuccess = transaction?.meta?.err === null;
+  if (!transactionSuccess) throw new Error(`Solana transaction ${signature} missing metadata or failed on-chain; its memo is not valid committed state.`);
+  const extracted = extractSolanaMemoRefs(transaction);
+  const uniqueMemo = extracted.protocol_refs.length === 1;
+  if (!uniqueMemo) throw new Error(`Solana transaction ${signature} does not contain a valid Enigma SPL Memo instruction (exactly one is required).`);
+  const expectedMemoRef = createSolanaProofMemoRef(normalized.schema, normalized.artifact, cluster);
+  const observed = safeObservedMemoRef(uniqueMemo ? extracted.protocol_refs[0] : null);
+  const matches = solanaMemoMatchReport(observed, expectedMemoRef, { uniqueMemo, transactionSuccess });
+  const isVerified = Object.values(matches).every(Boolean);
+  const slot = Number.isInteger(transaction?.slot) ? transaction.slot : null;
+  const confirmation = await solanaConfirmationInfo({ rpcUrl: rpc.url, signature, transactionSlot: slot, fetchFn });
+  Object.assign(report, {
+    ok: isVerified,
+    transaction_observed: true,
+    verified_on_chain: isVerified,
+    verification_status: isVerified ? 'verified' : (transactionSuccess ? 'mismatch' : 'transaction_failed'),
+    failure_code: isVerified ? null : (transactionSuccess ? 'MEMO_COMMITMENT_MISMATCH' : 'TRANSACTION_FAILED'),
+    slot,
+    block_time: solanaBlockTimeIso(transaction?.blockTime),
+    confirmation_status: confirmation.confirmation_status,
+    confirmation_depth: confirmation.confirmation_depth,
+    slot_depth: confirmation.slot_depth,
+    transaction_success: transactionSuccess,
+    payer: solanaPayer(transaction),
+    fee_lamports: Number.isFinite(transaction?.meta?.fee) ? transaction.meta.fee : null,
+    memo_instruction_count: extracted.memo_instruction_count,
+    observed_memo_ref: observed,
+    matches,
+  });
+  print(report, io);
+  return isVerified ? 0 : 1;
+}
+
 export async function chainAnchorCommand(flags, io) {
   const roots = flagValues(flags, ['root', 'roots', 'memory-root', 'memoryRoot', 'receipt-root', 'receiptRoot', 'context-root', 'contextRoot', 'memory-commitment-root', 'memoryCommitmentRoot']);
   if (roots.length === 0) throw new Error('Missing required --root.');
   const refs = flagValues(flags, ['ref', 'refs', 'public-ref', 'publicRef']);
-  const publicChainRef = getFlag(flags, ['public-chain-ref', 'publicChainRef', 'chain-ref', 'chainRef'], 'solana:local-plan');
+  const cluster = getFlag(flags, ['cluster']) === undefined ? undefined : solanaSubmitCluster(flags);
+  const publicChainRef = getFlag(flags, ['public-chain-ref', 'publicChainRef', 'chain-ref', 'chainRef'], cluster ? `solana:${cluster}:spl-memo` : 'solana:local-plan');
   const batch = createProofNetworkAnchorBatch({
     roots,
     root_count: roots.length,
@@ -2634,6 +3997,7 @@ export async function chainAnchorCommand(flags, io) {
     authority_ref: getFlag(flags, ['authority', 'authority-ref', 'authorityRef']),
     batch_ref: getFlag(flags, ['batch-ref', 'batchRef']),
     created_at: getFlag(flags, ['created-at', 'createdAt']),
+    cluster_ref: cluster ? solanaClusterRef(cluster) : undefined,
     transaction_submitted: false,
     raw_memory_on_chain: false,
   });
@@ -2642,9 +4006,29 @@ export async function chainAnchorCommand(flags, io) {
     artifact_type: batch.schema,
     anchor_batch_id: batch.anchor_batch_id,
     anchor_batch_hash: batch.anchor_batch_hash ?? proofNetworkSha256Json(batch),
+    solana_cluster: cluster,
   });
 }
 
+export async function chainAnchorBundleCommand(flags, io) {
+  const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+  let bundle;
+  try {
+    bundle = await readJson(bundlePath);
+  } catch {
+    throw new Error('Unable to read a valid Enigma bundle JSON file.');
+  }
+
+  const cluster = solanaSubmitCluster(flags);
+  const { artifact: batch } = anchorBatchFromVaultBundle(bundle, cluster, flags);
+  return chainWriteOrPrint(flags, io, batch, {
+    artifact_type: batch.schema,
+    anchor_batch_id: batch.anchor_batch_id,
+    anchor_batch_hash: batch.anchor_batch_hash ?? proofNetworkSha256Json(batch),
+    source_bundle_verified: true,
+    solana_cluster: cluster,
+  });
+}
 export async function chainGrantCommand(flags, io) {
   const resourceRefs = flagValues(flags, ['resource-root', 'resource-roots', 'resourceRoot', 'resourceRoots', 'resource-ref', 'resource-refs', 'resourceRef', 'resourceRefs', 'ref', 'refs']);
   const capability = requireFlag(flags, ['capability', 'capability-id', 'capabilityId'], 'capability');
@@ -2673,6 +4057,7 @@ export async function chainGrantCommand(flags, io) {
   });
 }
 
+
 export async function chainRevokeCommand(flags, io) {
   const grantValue = getFlag(flags, ['grant']);
   let grantHash = getFlag(flags, ['grant-hash', 'grantHash']);
@@ -2988,34 +4373,143 @@ export async function settlementBatchCommand(flags, io, positionalFile) {
   return 0;
 }
 
+function terminalColorEnabled(flags) {
+  return !booleanFlag(flags, ['no-color', 'noColor'], false);
+}
+
+export async function tuiCommand(flags, io, mode = 'dashboard') {
+  const bundlePath = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
+  return runTerminalDashboard({
+    bundlePath,
+    once: booleanFlag(flags, ['once'], false),
+    interval: getFlag(flags, ['interval'], 1000),
+    mode,
+    color: terminalColorEnabled(flags),
+    io,
+  });
+}
+
+export async function treeCommand(flags, io) {
+  const bundlePath = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
+  const depth = parseOptionalNumber(getFlag(flags, ['depth']));
+  return runTerminalDashboard({
+    bundlePath,
+    once: true,
+    interval: 1000,
+    mode: 'tree',
+    depth,
+    color: terminalColorEnabled(flags),
+    io,
+  });
+}
+
+export async function monitorCommand(flags, io) {
+  return tuiCommand(flags, io, 'monitor');
+}
+
+async function optionalBundleBytes(flags) {
+  const value = lastFlagValue(getFlag(flags, ['bundle', 'file']));
+  if (value === undefined) return undefined;
+  if (value === true || value === '') throw new Error('Missing required --bundle.');
+  return readFile(resolve(String(value)));
+}
+
+export async function enclaveCycleCommand(flags, io) {
+  const bundle = await optionalBundleBytes(flags);
+  const purpose = lastFlagValue(getFlag(flags, ['purpose']));
+  if (purpose === true || purpose === '') throw new Error('Missing required --purpose.');
+  const manager = new EnclaveSessionManager();
+  const session = manager.initializeSession(bundle === undefined ? {} : { bundle });
+  if (purpose !== undefined) manager.deriveSessionKey(session.session_id, String(purpose));
+  const receipt = manager.zeroizeSession(session.session_id);
+  const verification = verifyZeroizationReceipt(receipt, {
+    expectedSessionId: session.session_id,
+    expectedPublicKey: manager.publicKeySpkiBase64,
+  });
+  if (!verification.valid) throw new Error(`Atomic enclave cycle receipt verification failed: ${verification.errors.join(', ')}`);
+  const receiptOut = lastFlagValue(getFlag(flags, ['receipt-out', 'receiptOut']));
+  if (receiptOut === true || receiptOut === '') throw new Error('Missing required --receipt-out.');
+  if (receiptOut !== undefined) {
+    const outPath = resolve(String(receiptOut));
+    await writeJson(outPath, receipt);
+    print({ ok: true, verified: true, path: outPath, session_id: receipt.session_id, receipt_hash: receipt.receipt_hash }, io);
+  } else {
+    print(receipt, io);
+  }
+  return 0;
+}
+
+export async function enclaveAttestCommand(flags, io) {
+  const bundle = await optionalBundleBytes(flags);
+  print(createAttestation(bundle === undefined ? {} : { bundle }), io);
+  return 0;
+}
+
+export async function enclaveVerifyZeroizationCommand(flags, io, positionalFile) {
+  const receiptPath = resolve(String(requireFileArg(flags, ['receipt'], positionalFile, 'receipt')));
+  const result = verifyZeroizationReceipt(await readJson(receiptPath));
+  print(result, io);
+  return result.valid ? 0 : 1;
+}
+
+export async function swarmStatusCommand(flags, io) {
+  const bundlePath = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
+  print(await swarmStatusFromBundle(bundlePath), io);
+  return 0;
+}
+
+export async function swarmGraphCommand(flags, io) {
+  const bundlePath = pathFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE);
+  print(await swarmGraphFromBundle(bundlePath), io);
+  return 0;
+}
+
 function humanUsage() {
   return `Enigma Memory CLI — local-first AI Memory Passport
 
 Usage: enigma <command> [options]
 
-Quick start:
-  npm install -g enigma-memory
-  enigma setup --bundle "$HOME/.enigma/bundle.json" --client auto --connect-installed --overwrite
-  echo "Your memory text" > memory.txt
-  enigma remember --bundle "$HOME/.enigma/bundle.json" --text-file memory.txt
-  enigma search  --bundle "$HOME/.enigma/bundle.json" --query "your topic"
-  enigma context --bundle "$HOME/.enigma/bundle.json" --query "your topic" --out "$HOME/.enigma/context-pack.json"
-  enigma verify --export "$HOME/.enigma/export.json"
+One-command harness install:
+  npx --yes enigma-memory@latest
+
+Pinned GitHub source before registry publication:
+  npx --yes --package=github:Enigma-Memory/enigma-cortex-enterprise#<commit> enigma-memory
+
+The bootstrap installs every Enigma command, creates an encrypted local vault,
+and opens the desktop with lexical embeddings. Add --no-launch for install-only
+or --terminal to open the interactive terminal instead.
+
+After installation:
+  enigma-terminal --bundle "$HOME/.enigma/bundle.json"
+  enigma passport status --bundle "$HOME/.enigma/bundle.json" --passphrase-file "$HOME/.enigma/passphrase"
 
 Windows CMD uses %USERPROFILE% instead of $HOME:
   enigma remember --bundle "%USERPROFILE%\\.enigma\\bundle.json" --text-file memory.txt
 
 Common commands:
-  init, setup, quickstart, test-drive      First-run / demo paths
+  init, setup, start, quickstart, test-drive First-run / demo paths
   remember, recall, update, delete         Memory operations
   search, context                          Retrieval / context packs
   status, drive health, doctor             Health and diagnostics
+  vault rotate|seal|reset                  Content-key lifecycle
   connect <client>, disconnect <client>    MCP client connectors
   export, import <source>, capsule ...     Migration and packaging
   verify                                   Verify an exported bundle
+  tui, dashboard, tree, monitor            Live local terminal observability
+  enclave cycle|attest|verify-zeroization   Atomic local key lifecycle
+  swarm status|graph                       Local-only metadata simulator
+  chain anchor-bundle|submit-solana       Public-safe Solana proof anchoring
+  chain verify-solana                     Verify an on-chain SPL Memo anchor
   mcp serve, relay demo|serve,             Local service demos
     gateway demo|serve
 
+Security Modes & At-Rest Confidentiality:
+  • Encrypted Default: Persistent commands require ENIGMA_PASSPHRASE,
+    --passphrase <value>, or --passphrase-file <path>, and use AES-256-GCM
+    keyring encryption with scrypt and authenticated bundle metadata.
+  • Explicit Insecure Development: --insecure-dev permits a plaintext keyring only
+    for disposable local evaluation; persistent commands otherwise fail closed.
+
 If no AI clients are installed, setup still creates the local bundle and
 skips connector writes. Connect later with enigma connect <client> or the
 copy-paste MCP snippets in docs/client-connectors.md.
@@ -3030,8 +4524,18 @@ function usage() {
       'init',
       'setup',
       'quickstart',
+      'start',
       'test-drive',
       'demo cross-model',
+      'tui',
+      'dashboard',
+      'tree',
+      'monitor',
+      'enclave cycle',
+      'enclave attest',
+      'enclave verify-zeroization',
+      'swarm status',
+      'swarm graph',
       'doctor',
       'install',
       'connect <client>',
@@ -3044,6 +4548,9 @@ function usage() {
       'search',
       'status',
       'passport status',
+      'vault rotate',
+      'vault seal',
+      'vault reset',
       'export',
       'import <source>',
       'capsule export',
@@ -3068,15 +4575,36 @@ function usage() {
       'settlement verify',
       'settlement batch',
       'chain anchor',
+      'chain anchor-bundle',
       'chain grant',
       'chain revoke',
       'chain attest',
       'chain verify',
       'chain submit-solana',
+      'chain verify-solana',
       'chain register',
       'chain registry',
       'drive health',
     ],
+    terminal_tui_options: {
+      'enigma tui --bundle <path> [--once]': 'Render the full local terminal dashboard; --once exits after one CI-safe snapshot.',
+      'enigma dashboard --bundle <path> [--once]': 'Alias for the full local terminal dashboard.',
+      'enigma tree --bundle <path> [--depth <n>]': 'Render the ANSI Merkle tree, leaf statuses, and a proof verification path.',
+      'enigma monitor --bundle <path> [--interval <ms>]': 'Run the live MCP event and caller monitor; non-TTY output automatically renders once.',
+      '--no-color': 'Disable ANSI colors for logs that require plain text.',
+      boundary: 'Reads the local bundle only. Tombstones mean cryptographic logical tombstoning and active-set de-indexing; the TUI makes no hardware-RAM erasure, provider-deletion, or model-forgetting claim.',
+    },
+    enclave_options: {
+      cycle: 'enigma enclave cycle [--bundle <path>] [--purpose <label>] [--receipt-out <path>]',
+      attest: 'enigma enclave attest [--bundle <path>]',
+      verify_zeroization: 'enigma enclave verify-zeroization --receipt <path>',
+      boundary: 'cycle creates, optionally derives, and zeroizes ephemeral keys atomically within one process; no session key or active session is persisted cross-process. It performs best-effort overwrite of Enigma-retained Node Buffer instances with post-overwrite byte verification and a signed/hashed receipt. PCRs are simulated. State nullification means active-session removal and Enigma key-handle invalidation only; it does not prove hardware-RAM zeroization, runtime/GC/cache/external-copy erasure, physical-media sanitization, unrecoverability, or DoD/NIST compliance.',
+    },
+    swarm_options: {
+      status: 'enigma swarm status [--bundle <path>]',
+      graph: 'enigma swarm graph [--bundle <path>]',
+      boundary: 'Local-only simulator and metadata graph. Raw memory content is redacted by default; no network transmission or decentralization claim.',
+    },
     connector_options: {
       '--bundle <path>': 'Absolute local Enigma vault bundle path rendered as ENIGMA_BUNDLE.',
       '--config <path>': 'Client MCP JSON config path to read/write.',
@@ -3120,6 +4648,8 @@ function usage() {
       '--memory-file <path>': 'Read local memory text from a file without echoing plaintext. Alias: --text-file.',
       '--memory-text <text>': 'Inline demo-only memory text. Avoid for private content because argv can be logged.',
       '--overwrite': 'Replace existing local first-run artifacts.',
+      '--passphrase-file <path>': 'Required encrypted-vault credential file; keeps the passphrase out of shell history and process arguments.',
+      '--insecure-dev': 'INSECURE, EVALUATION ONLY: permit a disposable plaintext-keyring vault. Never use for normal or persistent data.',
     },
     setup_options: {
       '--bundle <path>': 'Bundle JSON to create. Defaults to .enigma/bundle.json.',
@@ -3131,13 +4661,20 @@ function usage() {
       '--overwrite': 'Replace existing local setup artifacts.',
       '--dry-run': 'Plan setup without writing local artifacts or client configs.',
       '--write-connectors': 'Also write selected client MCP config files. Defaults to false.',
+      '--passphrase-file <path>': 'Required encrypted-vault credential file; keeps the passphrase out of shell history and process arguments.',
+      '--insecure-dev': 'INSECURE, EVALUATION ONLY: permit a disposable plaintext-keyring vault. Never use for normal or persistent data.',
     },
     install_options: {
-      'one-command installed clients': 'npm install -g enigma-memory && enigma setup --client auto --connect-installed --overwrite',
-      'one-command Claude Desktop': 'npm install -g enigma-memory && enigma setup --client claude-desktop --write-connectors --overwrite',
-      'one-command Cursor': 'npm install -g enigma-memory && enigma setup --client cursor --write-connectors --overwrite',
-      'one-command Kimi Code': 'npm install -g enigma-memory && enigma setup --client kimi-code --write-connectors --overwrite',
-      'one-command VS Code Cline': 'npm install -g enigma-memory && enigma setup --client vscode-cline --write-connectors --overwrite',
+      'one-command full harness': 'npx --yes enigma-memory@latest',
+      'one-command pinned source': 'npx --yes --package=github:Enigma-Memory/enigma-cortex-enterprise#<commit> enigma-memory',
+      'bootstrap behavior': 'Installs the exact executing package, generates a secure passphrase file only for a new vault, initializes encrypted local state, and opens the lexical desktop without a neural model download.',
+      'bootstrap install only': 'npx --yes enigma-memory@latest --no-launch',
+      'bootstrap terminal': 'npx --yes enigma-memory@latest --terminal',
+      'one-command installed clients': `npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG} --client auto --connect-installed --overwrite`,
+      'one-command Claude Desktop': `npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG} --client claude-desktop --write-connectors --overwrite`,
+      'one-command Cursor': `npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG} --client cursor --write-connectors --overwrite`,
+      'one-command Kimi Code': `npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG} --client kimi-code --write-connectors --overwrite`,
+      'one-command VS Code Cline': `npm install -g enigma-memory && enigma setup ${PUBLIC_PASSPHRASE_FILE_FLAG} --client vscode-cline --write-connectors --overwrite`,
       '--client <id>': 'Limit generated MCP snippets to one supported client.',
       '--out <path>': 'Write generated MCP snippets to a JSON file for review without hand-editing client config JSON.',
     },
@@ -3149,6 +4686,8 @@ function usage() {
       '--memory-file <path>': 'Read local memory text from a file. Alias: --text-file.',
       '--memory-text <text>': 'Inline demo memory text for non-private demos only.',
       '--overwrite': 'Replace existing quickstart output files.',
+      '--passphrase-file <path>': 'Required encrypted-vault credential file; keeps the passphrase out of shell history and process arguments.',
+      '--insecure-dev': 'INSECURE, EVALUATION ONLY: permit a disposable plaintext-keyring vault. Never use for normal or persistent data.',
     },
     test_drive_options: {
       '--out-dir <path>': `Isolated demo directory. Defaults to ${DEFAULT_TEST_DRIVE_DIR}.`,
@@ -3163,6 +4702,13 @@ function usage() {
       '--out <path>': 'Write the same public-safe JSON report to a local file.',
       '--limit <n>': 'Maximum active memories per generated profile context pack. Defaults to 1 for the same-memory demo story.',
     },
+    capsule_options: {
+      export: 'enigma capsule export --file <encrypted-import-report> --passphrase-file <path> --out <encrypted-capsule>',
+      import: 'enigma capsule import --file <encrypted-capsule> --passphrase-file <path> (--trust-descriptor <json> | --trust-bundle <json>) [--write-vault --bundle <path>]',
+      '--trust-descriptor <path>': 'Required external issuer descriptor used to verify the capsule signature. Mutually exclusive with --trust-bundle.',
+      '--trust-bundle <path>': 'Required external issuer trust bundle used to verify the capsule signature. Mutually exclusive with --trust-descriptor.',
+      boundary: 'The trust source must be supplied independently of the encrypted capsule; embedded descriptor metadata is never accepted as its own trust anchor.',
+    },
     native_host: {
       bin: 'enigma-native-host',
       host_name: 'com.enigma.native_host',
@@ -3204,6 +4750,7 @@ function usage() {
     },
     chain: {
       anchor: 'enigma chain anchor --root <sha256:...> [--root <sha256:...>] [--ref <public-ref>] [--authority <public-authority-ref>] [--batch-ref <ref>] [--out <file>]',
+      anchor_bundle: 'enigma chain anchor-bundle --bundle <bundle.json> --cluster <devnet|testnet|mainnet-beta|localnet> [--out <anchor-batch.json>] then enigma chain submit-solana --file <anchor-batch.json> [--execute --keypair <solana-cli-keypair.json>]',
       grant: 'enigma chain grant --subject <public-subject-ref> --capability <capability-id> --scope <scope-id> [--resource-ref <sha256:...>] [--policy-hash <sha256:...>] --expires-at <iso> [--grant-ref <public-ref>] [--out <file>]',
       revoke: 'enigma chain revoke --grant-hash <sha256:...> --reason <public-reason-code> [--revocation-ref <public-ref>] [--out <file>]',
       attest: 'enigma chain attest (--report-hash <sha256:...> | --report-file <report.json>) --dataset-ref <sha256:...> --runner-ref <public-runner-ref> --package-ref <public-package-ref> [--score name=value] [--out <file>]',
@@ -3211,6 +4758,7 @@ function usage() {
       register: 'enigma chain register --entry-type <anchor_batch|benchmark_attestation|connector_conformance|health_report|operator_receipt|settlement_job> (--artifact-hash <sha256:...> | --artifact-file <artifact.json>) --artifact-schema-ref <schema-id> [--digest-ref <sha256:...>] [--signer <public-ref>] [--registry-ref <public-ref>] [--entry-ref <public-ref>] [--entry-count <n>] [--out <file>]',
       registry: 'enigma chain registry --entry <registry-entry.json> [--entry <registry-entry.json>] [--registry-ref <public-ref>] [--out <file>]',
       submit_solana: 'enigma chain submit-solana --file <proof-artifact.json> --cluster <devnet|testnet|mainnet-beta|localnet> [--rpc <url>] [--execute --keypair <solana-cli-64-byte-keypair.json>]',
+      verify_solana: 'enigma chain verify-solana --signature <tx-signature> --file <anchor-batch|bundle|export.json> --cluster <devnet|testnet|mainnet-beta|localnet> [--rpc <url>] [--transaction-file <tx.json> | --transaction <json>]',
       boundary: 'Proof Network chain commands default to local planning and dry-run validation. submit-solana only submits a Solana Memo transaction when --execute is passed; it carries compact public-safe commitment/ref JSON, never raw memory or artifact bodies.',
     },
     memory_drive_health: {
@@ -3248,9 +4796,52 @@ function usage() {
   };
 }
 
+export async function devCommand(subcommand, flags, io) {
+  const { runVectorBenchmark, inspectVaultBundle, simulateSwarmNetwork, runMemoryBenchmarkSuite } = await import('../../../packages/dev-tools/src/index.js');
+  if (subcommand === 'bench') {
+    const items = integerFlag(flags, ['items', 'n'], 'items', 100);
+    const queries = integerFlag(flags, ['queries', 'q'], 'queries', 50);
+    const report = await runVectorBenchmark({
+      ...io.devToolOptions?.vectorBenchmark,
+      itemCount: items,
+      queryCount: queries,
+    });
+    print(report, io);
+    return 0;
+  }
+  if (subcommand === 'bench-suite') {
+    const size = integerFlag(flags, ['size', 's'], 'size', 30);
+    const report = await runMemoryBenchmarkSuite({
+      ...io.devToolOptions?.memoryBenchmark,
+      corpusSize: size,
+    });
+    print(report, io);
+    return 0;
+  }
+  if (subcommand === 'inspect') {
+    const bundlePath = resolve(String(getFlag(flags, ['bundle', 'file'], DEFAULT_BUNDLE)));
+    const credentials = await resolveVaultCredentials(flags);
+    const report = await inspectVaultBundle(bundlePath, { passphrase: credentials.passphrase });
+    print(report, io);
+    return 0;
+  }
+  if (subcommand === 'sim-swarm') {
+    const nodes = integerFlag(flags, ['nodes', 'n'], 'nodes', 4);
+    const messages = integerFlag(flags, ['messages', 'm'], 'messages', 8);
+    const report = await simulateSwarmNetwork({ nodeCount: nodes, messageCount: messages });
+    print(report, io);
+    return 0;
+  }
+  throw new Error(`Unknown dev subcommand: "${subcommand}". Available: bench, bench-suite, inspect, sim-swarm`);
+}
+
 export async function main(argv = process.argv.slice(2), io = { stdout: process.stdout, stderr: process.stderr }) {
   const command = argv[0];
   const subcommand = argv[1];
+  if (command === '--version' || command === '-v' || command === 'version') {
+    io.stdout.write(`enigma v${ENIGMA_VERSION}\n`);
+    return 0;
+  }
   if (!command || command === '--help' || command === '-h' || command === '--help-human') {
     if (command === '--help-human') {
       io.stdout.write(`${humanUsage()}\n`);
@@ -3259,14 +4850,15 @@ export async function main(argv = process.argv.slice(2), io = { stdout: process.
     }
     return 0;
   }
-  const twoPartCommands = ['boundary', 'mcp', 'mesh', 'enterprise', 'capsule', 'relay', 'gateway', 'connect', 'disconnect', 'import', 'native-host', 'meter', 'settlement', 'chain', 'demo', 'passport', 'drive'];
+  const twoPartCommands = ['dev', 'boundary', 'mcp', 'mesh', 'market', 'zk', 'enterprise', 'capsule', 'relay', 'gateway', 'connect', 'disconnect', 'import', 'native-host', 'meter', 'settlement', 'chain', 'demo', 'passport', 'drive', 'enclave', 'swarm', 'vault'];
   const flags = parseArgs(twoPartCommands.includes(command) ? argv.slice(2) : argv.slice(1));
   const positionalFile = optionalPositional(argv[2]);
   if (command === 'help') {
     io.stdout.write(`${humanUsage()}\n`);
     return 0;
   }
-  if ((command === 'chain' && (!subcommand || subcommand === '--help' || subcommand === '-h' || flags.has('help'))) || ((flags.has('help') || argv.includes('-h')) && (command === 'init' || command === 'setup' || command === 'test-drive' || command === 'search' || command === 'status' || (command === 'passport' && subcommand === 'status') || ((command === 'relay' || command === 'gateway') && (subcommand === 'serve' || subcommand === 'demo')) || (command === 'native-host' && (subcommand === 'manifest' || subcommand === 'install-plan')) || (command === 'demo' && subcommand === 'cross-model') || (command === 'drive' && subcommand === 'health')))) {
+  const helpRequested = flags.has('help') || argv.includes('-h') || subcommand === '--help' || subcommand === '-h';
+  if (helpRequested || ((command === 'chain' || command === 'enclave' || command === 'swarm') && !subcommand)) {
     print(usage(), io);
     return 0;
   }
@@ -3274,11 +4866,22 @@ export async function main(argv = process.argv.slice(2), io = { stdout: process.
     if (command === 'init') return await initCommand(flags, io);
     if (command === 'setup') return await setupCommand(flags, io);
     if (command === 'quickstart') return await quickstartCommand(flags, io);
+    if (command === 'start') return await quickstartCommand(flags, io);
     if (command === 'test-drive') return await testDriveCommand(flags, io);
     if (command === 'demo' && subcommand === 'cross-model') return await crossModelDemoCommand(flags, io);
+    if (command === 'tui') return await tuiCommand(flags, io);
+    if (command === 'dashboard') return await tuiCommand(flags, io);
+    if (command === 'tree') return await treeCommand(flags, io);
+    if (command === 'monitor') return await monitorCommand(flags, io);
+    if (command === 'enclave' && subcommand === 'cycle') return await enclaveCycleCommand(flags, io);
+    if (command === 'enclave' && subcommand === 'attest') return await enclaveAttestCommand(flags, io);
+    if (command === 'enclave' && subcommand === 'verify-zeroization') return await enclaveVerifyZeroizationCommand(flags, io, positionalFile);
+    if (command === 'swarm' && subcommand === 'status') return await swarmStatusCommand(flags, io);
+    if (command === 'swarm' && subcommand === 'graph') return await swarmGraphCommand(flags, io);
     if (command === 'doctor') return await doctorCommand(flags, io);
     if (command === 'install') return await installCommand(flags, io);
     if (command === 'connect') return await connectCommand(subcommand, flags, io);
+    if (command === 'dev') return await devCommand(subcommand, flags, io);
     if (command === 'disconnect') return await disconnectCommand(subcommand, flags, io);
     if (command === 'remember') return await rememberCommand(flags, io);
     if (command === 'recall') return await recallCommand(flags, io);
@@ -3289,6 +4892,9 @@ export async function main(argv = process.argv.slice(2), io = { stdout: process.
     if (command === 'status') return await statusCommand(flags, io);
     if (command === 'passport' && subcommand === 'status') return await statusCommand(flags, io);
     if (command === 'drive' && subcommand === 'health') return await driveHealthCommand(flags, io);
+    if (command === 'vault' && subcommand === 'rotate') return await rotateVaultKeyCommand(flags, io);
+    if (command === 'vault' && subcommand === 'seal') return await sealVaultKeyCommand(flags, io);
+    if (command === 'vault' && subcommand === 'reset') return await resetVaultKeysCommand(flags, io);
     if (command === 'export') return await exportCommand(flags, io);
     if (command === 'import') return await importCommand(subcommand, flags, io, positionalFile);
     if (command === 'capsule' && subcommand === 'export') return await capsuleExportCommand(flags, io, positionalFile);
@@ -3309,16 +4915,48 @@ export async function main(argv = process.argv.slice(2), io = { stdout: process.
     if (command === 'settlement' && subcommand === 'receipt') return await settlementReceiptCommand(flags, io);
     if (command === 'settlement' && subcommand === 'verify') return await settlementVerifyCommand(flags, io);
     if (command === 'settlement' && subcommand === 'batch') return await settlementBatchCommand(flags, io, positionalFile);
+    if (command === 'solana') {
+      if (subcommand === 'anchor-bundle') return await chainAnchorBundleCommand(flags, io);
+      if (subcommand === 'submit' || subcommand === 'submit-solana') return await chainSubmitSolanaCommand(flags, io, positionalFile);
+      if (subcommand === 'verify-anchor' || subcommand === 'verify-solana' || subcommand === 'verify') return await chainVerifySolanaCommand(flags, io, positionalFile);
+      if (!subcommand || subcommand === 'status' || subcommand === 'health') {
+        const { probeSolanaRpc, formatSolanaStatusReport } = await import('../../../packages/terminal-console/solana-rpc.mjs');
+        const cluster = getFlag(flags, ['cluster'], 'mainnet-beta');
+        const rpcUrl = getFlag(flags, ['rpc']);
+        const probe = await probeSolanaRpc({ cluster, rpcUrl });
+        const out = formatSolanaStatusReport(probe, { color: !getFlag(flags, ['no-color', 'noColor']) });
+        io.stdout.write('\n' + out + '\n');
+        return probe.ok ? 0 : 1;
+      }
+      if (subcommand === 'stream' || subcommand === 'pulse' || subcommand === 'heartbeat') {
+        const { runSolanaHeartbeatStream } = await import('../../../packages/terminal-console/animations.mjs');
+        const cluster = getFlag(flags, ['cluster'], 'mainnet-beta');
+        const rpcUrl = getFlag(flags, ['rpc']);
+        const samples = getFlag(flags, ['samples', 'n']) ? Number(getFlag(flags, ['samples', 'n'])) : (getFlag(flags, ['once']) ? 1 : undefined);
+        return await runSolanaHeartbeatStream(io, { cluster, rpcUrl, samples, color: !getFlag(flags, ['no-color', 'noColor']) });
+      }
+    }
     if (command === 'chain' && subcommand === 'anchor') return await chainAnchorCommand(flags, io);
+    if (command === 'chain' && subcommand === 'anchor-bundle') return await chainAnchorBundleCommand(flags, io);
     if (command === 'chain' && subcommand === 'grant') return await chainGrantCommand(flags, io);
     if (command === 'chain' && subcommand === 'revoke') return await chainRevokeCommand(flags, io);
     if (command === 'chain' && subcommand === 'attest') return await chainAttestCommand(flags, io);
     if (command === 'chain' && subcommand === 'verify') return await chainVerifyCommand(flags, io, positionalFile);
     if (command === 'chain' && subcommand === 'submit-solana') return await chainSubmitSolanaCommand(flags, io, positionalFile);
+    if (command === 'chain' && (subcommand === 'verify-solana' || subcommand === 'verify-anchor')) return await chainVerifySolanaCommand(flags, io, positionalFile);
     if (command === 'chain' && subcommand === 'register') return await chainRegisterCommand(flags, io);
     if (command === 'chain' && subcommand === 'registry') return await chainRegistryCommand(flags, io, positionalFile);
     if (command === 'native-host' && subcommand === 'install-plan') return await nativeHostInstallPlanCommand(flags, io);
+    if (command === 'mesh' && (subcommand === 'status' || !subcommand)) return await meshStatusCommand(flags, io);
+    if (command === 'mesh' && subcommand === 'announce') return await meshAnnounceCommand(flags, io);
+    if (command === 'mesh' && subcommand === 'send') return await meshSendCommand(flags, io);
+    if (command === 'mesh' && subcommand === 'listen') return await meshListenCommand(flags, io);
     if (command === 'mesh' && subcommand === 'demo') return await meshDemoCommand(flags, io);
+    if (command === 'market' && (subcommand === 'status' || !subcommand)) return await marketStatusCommand(flags, io);
+    if (command === 'market' && subcommand === 'list') return await marketListCommand(flags, io);
+    if (command === 'market' && subcommand === 'verify') return await marketVerifyCommand(flags, io);
+    if (command === 'market' && subcommand === 'demo') return await marketDemoCommand(flags, io);
+    if (command === 'zk' && (subcommand === 'status' || !subcommand)) return await zkStatusCommand(flags, io);
     if (command === 'enterprise' && subcommand === 'demo') return await enterpriseDemoCommand(flags, io);
     throw new Error(`Unknown command: ${[command, subcommand].filter(Boolean).join(' ')}`);
   } catch (error) {