wendkeep 0.86.0 → 0.88.0

package/src/observer.mjs

@@ -1,4 +1,6 @@
 import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
 import { isAbsolute, resolve } from 'node:path';
 import { readObserverIndexSource } from './observer-store.mjs';
 import { buildProjectSnapshot } from './observer-snapshot.mjs';
@@ -6,15 +8,23 @@ import { compareMemoryParity } from './observer-memory-publish.mjs';
 import { publishObserverSql } from './observer-sql-publish.mjs';
 import { migrateObserverData } from './observer-sql-migrate.mjs';
 import { startObserverServer } from './observer-server.mjs';
-import { ensureObserverDatabase, migrateObserverDatabase, listSqlProjects, registerSqlProject, upsertSqlProjectSnapshot, OBSERVER_SQL_FILE, OBSERVER_SQL_SCHEMA_VERSION } from './observer-sql-store.mjs';
+import { ensureObserverDatabase, listSqlProjects, readSqlProject, registerSqlProject, upsertSqlProjectSnapshot, OBSERVER_SQL_FILE, OBSERVER_SQL_SCHEMA_VERSION } from './observer-sql-store.mjs';
 import { resolveProjectVault } from '../packages/vault/src/project-vault.mjs';
 import { observerAuthHeaders, resolveObserverToken } from './observer-auth.mjs';
+import { recordObserverAudit } from '../packages/observer/src/authz.mjs';
+import { readObserverPolicy, saveObserverPolicy } from '../packages/observer/src/policy.mjs';
+import { purgeObserverData } from '../packages/observer/src/purge.mjs';
+import { runObserverRetention } from '../packages/observer/src/retention.mjs';
+import { registerObserverToken, revokeObserverToken, rotateObserverToken } from '../packages/observer/src/token-registry.mjs';
+import { observerEncryptionFromEnvironment } from '../packages/observer/src/encryption.mjs';
 
 export const OBSERVER_HELP = `wendkeep observer — Observer local multi-projeto
 
 Uso:
   wendkeep observer serve [--data-dir P] [--host 127.0.0.1] [--port 8787]
-                          [--allow-non-loopback] [--token TOKEN]
+                          [--allow-non-loopback] [--require-loopback-auth] [--require-encryption] [--token TOKEN]
+                          [--bootstrap-token-id ID] [--bootstrap-role ROLE]
+                          [--bootstrap-projects P1,P2] [--bootstrap-scopes S1,S2] --bootstrap-expires-at ISO
   wendkeep observer register --project P [--vault V] [--data-dir D] [--json]
   wendkeep observer publish --project P [--vault V] [--data-dir D] [--json]
   wendkeep observer reconcile --project P [--vault V] [--data-dir D] [--url U]
@@ -22,6 +32,14 @@ Uso:
   wendkeep observer memory import --project P [--vault V] [--url U] [--token TOKEN]
                                     [--capture-level metadata|messages|full-transcript] [--json]
   wendkeep observer status [--data-dir D] [--json]
+  wendkeep observer security token create --project-id P --role R --scopes S
+                          --token-env ENV --expires-at ISO [--token-id ID] [--reason TEXT] [--json]
+  wendkeep observer security token rotate --project-id P --token-id ID --token-env ENV
+                          --expires-at ISO [--new-token-id ID] [--reason TEXT] [--json]
+  wendkeep observer security token revoke --project-id P --token-id ID [--reason TEXT] [--json]
+  wendkeep observer security policy set --project-id P --file policy.json [--json]
+  wendkeep observer security purge --project-id P --before ISO --classes C [--dry-run] [--operation-id ID] [--json]
+  wendkeep observer security retention run --project-id P [--dry-run] [--operation-id ID] [--observed-at ISO] [--json]
 
 O Observer local pode manter snapshots operacionais e uma cópia completa da memória em volume
 Docker. O comando memory import faz a primeira migração de um vault para o container.
@@ -34,6 +52,10 @@ function optionValue(argv, name) {
   return argv.find((item) => item.startsWith(`${name}=`))?.slice(name.length + 1) || '';
 }
 
+function csv(value) {
+  return String(value || '').split(',').map((item) => item.trim()).filter(Boolean);
+}
+
 function dataDir(argv) {
   return resolve(optionValue(argv, '--data-dir')
     || process.env.WENDKEEP_OBSERVER_DATA_DIR
@@ -62,23 +84,22 @@ function summary(index) {
   };
 }
 
-function databaseSummary(dir) {
-  const db = ensureObserverDatabase(dir);
+function databaseSummary(dir, security) {
+  const db = ensureObserverDatabase(dir, { security });
   try {
-    const migrations = migrateObserverDatabase(db);
     return {
       engine: 'sqlite',
       file: OBSERVER_SQL_FILE,
       schema_version: OBSERVER_SQL_SCHEMA_VERSION,
-      migrations: migrations.applied.length,
+      migrations: Number(db.prepare('SELECT COUNT(*) AS count FROM schema_migrations').get().count),
       projects: listSqlProjects(db).length,
       ready: true,
     };
   } finally { db.close(); }
 }
 
-function sqlProjectsSummary(dir) {
-  const db = ensureObserverDatabase(dir);
+function sqlProjectsSummary(dir, security) {
+  const db = ensureObserverDatabase(dir, { security });
   try {
     return listSqlProjects(db).map((project) => ({
       projectId: project.project_id,
@@ -99,21 +120,133 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
   }
   const dir = dataDir(argv);
   const token = resolveObserverToken(optionValue(argv, '--token'));
+  const databaseSecurity = {
+    encryption: observerEncryptionFromEnvironment({
+      required: argv.includes('--require-encryption') || process.env.WENDKEEP_OBSERVER_REQUIRE_ENCRYPTION === '1',
+    }),
+  };
+
+  if (sub === 'security') {
+    const domain = argv[1] || '';
+    const action = argv[2] || '';
+    const projectId = optionValue(argv, '--project-id');
+    if (!projectId) throw new Error('observer security: --project-id é obrigatório.');
+    const db = ensureObserverDatabase(dir, { security: databaseSecurity });
+    try {
+      readSqlProject(db, projectId);
+      if (domain === 'token' && action === 'create') {
+        const envName = optionValue(argv, '--token-env');
+        const rawToken = envName ? String(process.env[envName] || '') : '';
+        if (!envName || !rawToken) throw new Error('observer security token create: --token-env deve apontar para um segredo não vazio.');
+        const created = registerObserverToken(db, {
+          tokenId: optionValue(argv, '--token-id') || randomBytes(12).toString('hex'),
+          token: rawToken,
+          role: optionValue(argv, '--role'),
+          projectIds: [projectId],
+          scopes: optionValue(argv, '--scopes').split(',').map((item) => item.trim()).filter(Boolean),
+          expiresAt: optionValue(argv, '--expires-at'),
+        });
+        recordObserverAudit(db, {
+          projectId, tokenId: created.token_id, capability: 'security:recovery', outcome: 'created',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token create' },
+        });
+        print(created, asJson, write);
+        return 0;
+      }
+      if (domain === 'token' && action === 'revoke') {
+        const tokenId = optionValue(argv, '--token-id');
+        const revoked = revokeObserverToken(db, { tokenId });
+        recordObserverAudit(db, {
+          projectId, tokenId, capability: 'security:recovery', outcome: revoked.revoked ? 'revoked' : 'not-found',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token revoke' },
+        });
+        print(revoked, asJson, write);
+        return revoked.revoked ? 0 : 1;
+      }
+      if (domain === 'token' && action === 'rotate') {
+        const envName = optionValue(argv, '--token-env');
+        const rawToken = envName ? String(process.env[envName] || '') : '';
+        if (!envName || !rawToken) throw new Error('observer security token rotate: --token-env deve apontar para um segredo não vazio.');
+        const rotated = rotateObserverToken(db, {
+          tokenId: optionValue(argv, '--token-id'),
+          newTokenId: optionValue(argv, '--new-token-id') || randomBytes(12).toString('hex'),
+          newToken: rawToken,
+          expiresAt: optionValue(argv, '--expires-at'),
+        });
+        recordObserverAudit(db, {
+          projectId, tokenId: rotated.token_id, capability: 'security:recovery', outcome: 'rotated',
+          metadata: { route: 'offline-cli', method: 'LOCAL', reason: optionValue(argv, '--reason') || 'token rotate' },
+        });
+        print(rotated, asJson, write);
+        return 0;
+      }
+      if (domain === 'policy' && action === 'set') {
+        const path = optionValue(argv, '--file');
+        if (!path) throw new Error('observer security policy set: --file é obrigatório.');
+        const policy = saveObserverPolicy(db, projectId, JSON.parse(readFileSync(resolve(path), 'utf8')));
+        print({ schema_version: 1, project_id: projectId, policy }, asJson, write);
+        return 0;
+      }
+      if (domain === 'policy' && action === 'show') {
+        print({ schema_version: 1, project_id: projectId, policy: readObserverPolicy(db, projectId) }, asJson, write);
+        return 0;
+      }
+      if (domain === 'purge') {
+        const result = purgeObserverData(db, {
+          projectId,
+          before: optionValue(argv, '--before'),
+          classes: optionValue(argv, '--classes').split(',').map((item) => item.trim()).filter(Boolean),
+          operationId: optionValue(argv, '--operation-id'),
+          dryRun: argv.includes('--dry-run'),
+        });
+        print(result, asJson, write);
+        return 0;
+      }
+      if (domain === 'retention' && action === 'run') {
+        const policy = readObserverPolicy(db, projectId);
+        const observedAt = optionValue(argv, '--observed-at');
+        const result = runObserverRetention(db, {
+          projectId,
+          policy: policy.retention,
+          clock: () => observedAt ? new Date(observedAt) : new Date(),
+          operationId: optionValue(argv, '--operation-id'),
+          dryRun: argv.includes('--dry-run'),
+        });
+        print(result, asJson, write);
+        return 0;
+      }
+      throw new Error(`observer security: operação desconhecida: ${domain} ${action}`.trim());
+    } finally { db.close(); }
+  }
 
   if (sub === 'status') {
     const legacy = summary(readObserverIndexSource(dir));
-    print({ ...legacy, projects: sqlProjectsSummary(dir), legacy_projects: legacy.projects, database: databaseSummary(dir) }, asJson, write);
+    print({ ...legacy, projects: sqlProjectsSummary(dir, databaseSecurity), legacy_projects: legacy.projects, database: databaseSummary(dir, databaseSecurity) }, asJson, write);
     return 0;
   }
 
   if (sub === 'serve') {
     const host = optionValue(argv, '--host') || '127.0.0.1';
+    const encryption = databaseSecurity.encryption;
+    const secureMode = argv.includes('--require-loopback-auth') || Boolean(encryption);
     const server = await startObserverServer({
       dataDir: dir,
       host,
       port: Number(optionValue(argv, '--port') || 8787),
       allowNonLoopback: argv.includes('--allow-non-loopback'),
       token,
+      bootstrap: {
+        tokenId: optionValue(argv, '--bootstrap-token-id') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_TOKEN_ID || '',
+        role: optionValue(argv, '--bootstrap-role') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_ROLE || 'admin',
+        projectIds: csv(optionValue(argv, '--bootstrap-projects') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_PROJECTS),
+        scopes: csv(optionValue(argv, '--bootstrap-scopes') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_SCOPES || '*'),
+        expiresAt: optionValue(argv, '--bootstrap-expires-at') || process.env.WENDKEEP_OBSERVER_BOOTSTRAP_EXPIRES_AT || '',
+      },
+      security: {
+        enabled: secureMode,
+        requireLoopbackAuth: argv.includes('--require-loopback-auth'),
+        encryption,
+      },
     });
     const address = server.address();
     process.stdout.write(`wendkeep observer listening: http://${address.address}:${address.port}\n`);
@@ -179,7 +312,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
     const snapshot = buildProjectSnapshot({ vaultBase: vault, projectRoot: root });
     const url = optionValue(argv, '--url') || process.env.WENDKEEP_OBSERVER_URL || '';
     if (!url) {
-      const db = ensureObserverDatabase(dir);
+      const db = ensureObserverDatabase(dir, { security: databaseSecurity });
       let migration;
       try {
         migration = migrateObserverData({
@@ -231,7 +364,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
   const snapshot = buildProjectSnapshot({ vaultBase: vault, projectRoot: root });
 
   if (sub === 'register') {
-    const db = ensureObserverDatabase(dir);
+    const db = ensureObserverDatabase(dir, { security: databaseSecurity });
     let sql;
     try {
       sql = registerSqlProject(db, {
@@ -245,7 +378,7 @@ export async function runObserver(argv = [], { write = (chunk) => process.stdout
     return 0;
   }
 
-  const db = ensureObserverDatabase(dir);
+  const db = ensureObserverDatabase(dir, { security: databaseSecurity });
   let migration;
   try {
     migration = migrateObserverData({

package/src/skills-seed.mjs

@@ -524,6 +524,83 @@ the author — even if you wrote the code, enter as if you'd never seen it. Fres
 - \`verdict-template.json\` — the exact shape of the \`verdict.json\` to write.
 `;
 
+const WK_COMMIT = `# Commit universal baseado em evidências
+
+Use para preparar commits de implementação que precisem do contrato WendKeep. O gerador recebe
+somente referências sanitizadas e o diff staged resumido; nunca leia, copie ou publique o Vault,
+\`.brain\`, registros de sessão, tokens ou segredos na mensagem.
+
+## Fluxo
+
+1. Confirme que autoridade e referências de evidência estão atuais. O draft **não aceita** texto
+   caller-controlled em \`tasks\` ou \`tests\`: o runtime deriva tasks de Task Contracts concluídos;
+   Tests vêm somente de \`[sensor:<id>]\` executado pelo coletor.
+   Sensors do Envelope devem corresponder exatamente à reexecução; só a reexecução gera Tests.
+   \`[phase:verify]\` sozinho nunca prova execução, e o range reexecuta o sensor no SHA exato,
+   rederiva authority/artefatos/task/spec/Scope/config no SHA. Envelope/Verdict/receipt/TDD ficam
+   somente na validação local e são omitidos da Evidence remota; nunca publique seus IDs locais.
+   Tasks com \`[req:]\` exigem \`spec\` versionada e sanitizada. Use
+   \`authority.kind: adr\` sempre que existe uma change ou ADR causal. Somente sob perfil observado
+   \`OFF\`, sem context/change/lease ou ADR causal real, use \`authority.kind: native\`, com
+   \`Issue #NNN\` e design versionado sob \`docs/superpowers/specs/\` ou \`plans/\`.
+2. Crie um JSON conforme \`schema/commit-message-v1.schema.json\`. Não declare \`fresh\`,
+   \`verified\`, \`tasks\` ou \`tests\`: o runtime rederiva prova, digest SHA-256 do artefato,
+   binding completo de identidade/snapshot/tasks/spec/config e Scope do diff staged. Expected
+   ausente, envelope vazio, task pendente,
+   verdict sem selos/cobertura/independência ou
+   receipt sem chain/observation válidos falham fechados. \`Co-Authored-By\` é omitido
+   enquanto não houver identidade registrada confiável.
+3. Com os arquivos já staged, rode
+   \`wendkeep commit context --input <arquivo.json>\`. O CLI calcula o hash do index e grava o
+   contexto sanitizado dentro de \`.git\`, fora do working tree.
+4. Rode \`git commit\` normalmente. Os hooks opt-in revalidam contexto, hash, privacidade e
+   trivialidade antes de consumir o contexto. Instale-os
+   explicitamente com \`wendkeep init --git-commit-hooks --yes\`.
+5. Para diagnóstico, rode \`wendkeep doctor\`; para limpar contexto abandonado, use
+   \`wendkeep commit context --clear\`.
+
+Não use \`--no-verify\` para implementação. Amend, merge e squash preservam a mensagem existente e
+não recebem conteúdo inventado. A validação remota do PR continua sendo a defesa contra bypass.
+`;
+
+const WK_COMMIT_EN = `# Evidence-based universal commit
+
+Use this skill to prepare implementation commits governed by the WendKeep message contract. The
+generator receives sanitized references and a staged-diff summary only; never read, copy, or publish
+the Vault, \`.brain\`, session registries, tokens, or secrets into a commit message.
+
+## Flow
+
+1. Confirm that authority and evidence references are current. The draft **does not accept**
+   caller-controlled \`tasks\` or \`tests\`; runtime derives tasks from completed Task Contracts.
+   Tests come only from a collector-executed \`[sensor:<id>]\`.
+   Envelope sensors must exactly match reexecution; only reexecution emits Tests.
+   \`[phase:verify]\` alone never proves execution, and range re-executes the sensor at the exact
+   SHA and re-derives authority/artifacts/task/spec/Scope/config there. Envelope/Verdict/receipt/TDD
+   stay local-only and are omitted from remote Evidence; never publish their local IDs. Tasks with
+   \`[req:]\` require a versioned sanitized \`spec\`. Use \`authority.kind: adr\`
+   whenever a causal change or ADR exists. Only under observed profile \`OFF\`, with no real causal
+   context/change/lease or ADR, use \`authority.kind: native\` with \`Issue #NNN\` and a versioned
+   design under \`docs/superpowers/specs/\` or \`plans/\`.
+2. Create JSON matching \`schema/commit-message-v1.schema.json\`. Do not claim \`fresh\`,
+   \`verified\`, \`tasks\`, or \`tests\`: runtime re-derives proof, artifact SHA-256, canonical
+   full identity/snapshot/tasks/spec/config binding, and staged-diff Scope. Missing expected fields,
+   empty envelopes, pending tasks, verdicts without
+   seals/coverage/independence, and receipts
+   without a valid chain/observation fail closed. \`Co-Authored-By\` is omitted
+   until a trusted identity registry can resolve it.
+3. After staging the files, run \`wendkeep commit context --input <file.json>\`. The CLI hashes the
+   Git index and stores the sanitized context inside \`.git\`, outside the working tree.
+4. Run \`git commit\` normally. The opt-in hooks revalidate context, hash, privacy, and triviality
+   before consuming context. Install them
+   explicitly with \`wendkeep init --git-commit-hooks --yes\`.
+5. Run \`wendkeep doctor\` for diagnostics; abandon a context with
+   \`wendkeep commit context --clear\`.
+
+Do not use \`--no-verify\` for implementation work. Amend, merge, and squash preserve the existing
+message and never receive invented content. The PR range check remains the remote bypass defense.
+`;
+
 // --- bundled templates (shipped alongside the relevant SKILL.md) -------------
 
 // Shared, language-neutral verdict skeleton for the independent verify pass.
@@ -709,6 +786,7 @@ const WK_SKILLS_PT = [
   skill('wk-brainstorming', 'Use quando a ideia ainda é vaga ou o usuário quer discutir/planejar uma feature (inclusive em plan mode) — vira design aprovado, com closure gate e tabela out-of-scope, antes de código.', BRAINSTORMING, [{ name: 'design-template.md', content: DESIGN_TEMPLATE_PT }]),
   skill('wk-planning', 'Use após um design aprovado ou um plano aceito (inclusive plan mode) — decompõe em plano de tarefas TDD bite-sized e registra na change ativa.', PLANNING, [{ name: 'plan-template.md', content: PLAN_TEMPLATE_PT }]),
   skill('wk-verify', 'Use no verify deep — passe independente read-only (autor≠verificador) que re-deriva a cobertura do spec e grava verdict.json.', VERIFY, [{ name: 'spec-reviewer-prompt.md', content: REVIEWER_PROMPT_PT }, { name: 'verdict-template.json', content: VERDICT_TEMPLATE }]),
+  skill('wk-commit', 'Use ao preparar commits de implementação baseados em autoridade causal, tarefas, testes e evidências verificadas, com hooks Git opt-in e privacidade local.', WK_COMMIT),
 ];
 
 const WK_SKILLS_EN = [
@@ -718,6 +796,7 @@ const WK_SKILLS_EN = [
   skill('wk-brainstorming', 'Use when the idea is still vague or the user wants to discuss/plan a feature (plan mode included) — turns it into an approved design, with a closure gate and out-of-scope table, before code.', BRAINSTORMING_EN, [{ name: 'design-template.md', content: DESIGN_TEMPLATE_EN }]),
   skill('wk-planning', 'Use after an approved design or an accepted plan (plan mode included) — decomposes it into a bite-sized TDD task plan recorded in the active change.', PLANNING_EN, [{ name: 'plan-template.md', content: PLAN_TEMPLATE_EN }]),
   skill('wk-verify', 'Use in verify deep — an independent read-only pass (author≠verifier) that re-derives spec coverage and writes verdict.json.', VERIFY_EN, [{ name: 'spec-reviewer-prompt.md', content: REVIEWER_PROMPT_EN }, { name: 'verdict-template.json', content: VERDICT_TEMPLATE }]),
+  skill('wk-commit', 'Use when preparing implementation commits from causal authority, tasks, tests, and verified evidence, with opt-in Git hooks and local privacy.', WK_COMMIT_EN),
 ];
 
 // Skill set for a locale. WK_SKILLS stays the pt-BR set for back-compat.

package/src/sync-protocol.mjs

@@ -73,9 +73,25 @@ function validatePrivatePayload(payload) {
   }
 }
 
+function normalizePolicyRef(value) {
+  if (value == null) return null;
+  const keys = Object.keys(value).sort();
+  if (keys.join(',') !== 'hash,policy_id,version'
+    || !HASH_PATTERN.test(String(value.hash || ''))
+    || !Number.isSafeInteger(Number(value.version)) || Number(value.version) < 1) {
+    throw syncError('WENDKEEP_SYNC_POLICY_REF_INVALID', 'policy_ref must contain only policy_id, version and sha256 hash');
+  }
+  return {
+    policy_id: requiredText(value.policy_id, 'policy_ref.policy_id', 160),
+    version: Number(value.version),
+    hash: String(value.hash),
+  };
+}
+
 export function createSyncEvent({
   projectId, recordKey, revision, baseRevision, payload = null, causalParentIds = [],
   actorId, deviceId, leaseId = '', observedAt, operation = 'put', privacy = 'shared',
+  policyRef = null,
 } = {}) {
   const project_id = requiredText(projectId, 'project_id', 160);
   const record_key = requiredText(recordKey, 'record_key', 2048);
@@ -108,6 +124,7 @@ export function createSyncEvent({
     observed_at: timestamp.toISOString(),
     operation,
     privacy,
+    ...(policyRef ? { policy_ref: normalizePolicyRef(policyRef) } : {}),
     payload: operation === 'tombstone' ? null : structuredClone(payload),
   };
   return { ...draft, event_id: syncSha256(draft).slice(7) };
@@ -137,6 +154,7 @@ export function validateSyncEvent(event, { projectId = '' } = {}) {
     observedAt: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    policyRef: event.policy_ref || null,
   });
   return event;
 }
@@ -153,6 +171,7 @@ function eventCandidate(event) {
     observed_at: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    ...(event.policy_ref ? { policy_ref: structuredClone(event.policy_ref) } : {}),
     payload: structuredClone(event.payload),
   };
 }
@@ -168,6 +187,7 @@ function recordFromEvent(event, { conflicted = false } = {}) {
     observed_at: event.observed_at,
     operation: event.operation,
     privacy: event.privacy,
+    ...(event.policy_ref ? { policy_ref: structuredClone(event.policy_ref) } : {}),
     payload: structuredClone(event.payload),
     tombstone: event.operation === 'tombstone',
     conflicted,

package/web/observer/app.mjs

@@ -75,9 +75,15 @@ export function classifyRefreshError(error = {}, hasModels = false) {
   };
 }
 
-async function requestJson(fetchImpl, url) {
+export function observerDashboardHeaders(token = '') {
+  return token
+    ? { Accept: 'application/json', Authorization: `Bearer ${String(token)}` }
+    : { Accept: 'application/json' };
+}
+
+async function requestJson(fetchImpl, url, token = '') {
   const response = await fetchImpl(url, {
-    headers: { Accept: 'application/json' },
+    headers: observerDashboardHeaders(token),
   });
   if (!response.ok) {
     const error = new Error(`Observer respondeu HTTP ${response.status}.`);
@@ -87,11 +93,11 @@ async function requestJson(fetchImpl, url) {
   return response.json();
 }
 
-export async function loadProjectMemory(fetchImpl = globalThis.fetch, projectId = '') {
+export async function loadProjectMemory(fetchImpl = globalThis.fetch, projectId = '', token = '') {
   const id = encodeURIComponent(projectId);
   const [tree, sync] = await Promise.all([
-    requestJson(fetchImpl, '/v1/projects/' + id + '/memory/tree'),
-    requestJson(fetchImpl, '/v1/projects/' + id + '/sync'),
+    requestJson(fetchImpl, '/v1/projects/' + id + '/memory/tree', token),
+    requestJson(fetchImpl, '/v1/projects/' + id + '/sync', token),
   ]);
   return { tree, sync };
 }
@@ -107,13 +113,13 @@ export function usageQuery(filters = {}) {
   return query ? `?${query}` : '';
 }
 
-export async function loadProjectUsage(fetchImpl = globalThis.fetch, projectId = '', filters = {}) {
+export async function loadProjectUsage(fetchImpl = globalThis.fetch, projectId = '', filters = {}, token = '') {
   const id = encodeURIComponent(projectId);
   const query = usageQuery(filters);
   const [summary, breakdown, calls] = await Promise.all([
-    requestJson(fetchImpl, `/v1/projects/${id}/usage/summary${query}`),
-    requestJson(fetchImpl, `/v1/projects/${id}/usage/breakdown${query}`),
-    requestJson(fetchImpl, `/v1/projects/${id}/usage/calls${query}`),
+    requestJson(fetchImpl, `/v1/projects/${id}/usage/summary${query}`, token),
+    requestJson(fetchImpl, `/v1/projects/${id}/usage/breakdown${query}`, token),
+    requestJson(fetchImpl, `/v1/projects/${id}/usage/calls${query}`, token),
   ]);
   return { summary, breakdown, calls, filters: { ...filters } };
 }
@@ -163,29 +169,53 @@ export function buildUsageViewModel(usage = {}) {
   };
 }
 
-export async function loadMemoryDocument(fetchImpl = globalThis.fetch, projectId = '', logicalPath = '') {
+export async function loadMemoryDocument(fetchImpl = globalThis.fetch, projectId = '', logicalPath = '', token = '') {
   const query = new URLSearchParams({ path: logicalPath });
-  return requestJson(fetchImpl, '/v1/projects/' + encodeURIComponent(projectId) + '/memory/document?' + query.toString());
+  return requestJson(fetchImpl, '/v1/projects/' + encodeURIComponent(projectId) + '/memory/document?' + query.toString(), token);
 }
 
-export async function loadProjectTranscript(fetchImpl = globalThis.fetch, projectId = '', transcriptId = '') {
-  return requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(projectId)}/transcripts/${encodeURIComponent(transcriptId)}`);
+export async function loadProjectTranscript(fetchImpl = globalThis.fetch, projectId = '', transcriptId = '', token = '') {
+  return requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(projectId)}/transcripts/${encodeURIComponent(transcriptId)}`, token);
 }
 
-export async function searchProjectMemory(fetchImpl = globalThis.fetch, projectId = '', query = '') {
+export async function searchProjectMemory(fetchImpl = globalThis.fetch, projectId = '', query = '', token = '') {
   const params = new URLSearchParams({ q: query });
-  return requestJson(fetchImpl, '/v1/projects/' + encodeURIComponent(projectId) + '/memory/search?' + params.toString());
+  return requestJson(fetchImpl, '/v1/projects/' + encodeURIComponent(projectId) + '/memory/search?' + params.toString(), token);
 }
 
-export async function loadDashboardData(fetchImpl = globalThis.fetch) {
-  const index = await requestJson(fetchImpl, '/v1/projects');
+export async function loadDashboardData(fetchImpl = globalThis.fetch, token = '') {
+  const index = await requestJson(fetchImpl, '/v1/projects', token);
   const projects = Array.isArray(index?.projects) ? index.projects : [];
   return Promise.all(projects.map(async (summary) => {
-    const detail = await requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(summary.projectId)}`);
+    const detail = await requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(summary.projectId)}`, token);
     return buildProjectViewModel(summary, detail, new Date());
   }));
 }
 
+export async function loadProjectSecurity(fetchImpl = globalThis.fetch, projectId = '', token = '') {
+  return requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(projectId)}/security`, token);
+}
+
+export async function loadMemoryExport(fetchImpl = globalThis.fetch, projectId = '', token = '') {
+  return requestJson(fetchImpl, `/v1/projects/${encodeURIComponent(projectId)}/memory/export`, token);
+}
+
+export function buildObserverSecurityViewModel(payload = {}) {
+  return {
+    tokenCount: Number(payload.tokens?.total || 0),
+    activeTokens: Number(payload.tokens?.active || 0),
+    revokedTokens: Number(payload.tokens?.revoked || 0),
+    encryptionRequired: payload.encryption?.required === true,
+    encryptionConfigured: payload.encryption?.configured === true,
+    policy: payload.policy || {},
+    recentAudit: (Array.isArray(payload.audit) ? payload.audit : []).map((row) => ({
+      capability: String(row.capability || ''),
+      outcome: String(row.outcome || ''),
+      occurredAt: String(row.occurred_at || ''),
+    })),
+  };
+}
+
 export function buildProjectViewModel(summary = {}, detail = {}, now = new Date()) {
   const snapshot = detail.snapshot || {};
   const session = snapshot.session || {};
@@ -455,7 +485,7 @@ function renderChanges(container, projectId, documents) {
   container.replaceChildren(heading, list);
 }
 
-function renderSync(container, sync, projectId = '') {
+function renderSync(container, sync, projectId = '', onExport = null) {
   const heading = node('div', 'workspace-section-heading');
   heading.append(node('p', 'eyebrow', 'SYNC CONTROL'), node('h2', '', 'Sincronização'));
   const facts = node('div', 'detail-facts');
@@ -465,11 +495,35 @@ function renderSync(container, sync, projectId = '') {
     fact('Conflitos', sync?.conflict_count || 0),
   );
   const note = node('div', 'sync-callout', sync?.conflict_count ? 'Existem conflitos que exigem revisão.' : 'A memória local está acompanhando o container.');
-  const exportLink = node('a', 'workspace-open', 'Exportar cópia read-only →');
-  exportLink.href = '/v1/projects/' + encodeURIComponent(projectId) + '/memory/export';
-  exportLink.target = '_blank';
-  exportLink.rel = 'noopener';
-  container.replaceChildren(heading, facts, note, exportLink);
+  const exportButton = node('button', 'workspace-open', 'Exportar cópia sanitizada →');
+  exportButton.type = 'button';
+  exportButton.addEventListener('click', async () => {
+    try {
+      const payload = await onExport?.();
+      const blob = new Blob([JSON.stringify(payload, null, 2)], { type: 'application/json' });
+      const url = URL.createObjectURL(blob);
+      const link = document.createElement('a');
+      link.href = url;
+      link.download = `wendkeep-observer-${projectId}.json`;
+      link.click();
+      URL.revokeObjectURL(url);
+    } catch { exportButton.textContent = 'Exportação não autorizada'; }
+  });
+  container.replaceChildren(heading, facts, note, exportButton);
+}
+
+function renderSecurity(container, payload) {
+  const view = buildObserverSecurityViewModel(payload);
+  const heading = node('div', 'workspace-section-heading');
+  heading.append(node('p', 'eyebrow', 'OBSERVER SECURITY'), node('h2', '', 'Política e acesso'));
+  const grid = node('div', 'detail-facts');
+  grid.append(
+    fact('Tokens ativos', view.activeTokens),
+    fact('Tokens revogados', view.revokedTokens),
+    fact('Criptografia', view.encryptionConfigured ? (view.encryptionRequired ? 'obrigatória' : 'configurada') : 'não configurada'),
+  );
+  const policy = node('pre', 'usage-transcript', JSON.stringify(view.policy, null, 2));
+  container.replaceChildren(heading, grid, node('h3', '', 'Política efetiva'), policy);
 }
 
 function formatNumber(value) {
@@ -670,6 +724,7 @@ function startDashboardV2() {
     memory: new Map(),
     usage: new Map(),
     usageFilters: new Map(),
+    token: '',
     route: parseObserverRoute(globalThis.location?.hash || ''),
   };
   const dashboardError = byId('dashboard-error');
@@ -726,12 +781,12 @@ function startDashboardV2() {
     workspaceContent.replaceChildren(node('div', 'workspace-error', message || 'Não foi possível carregar a memória.'));
   };
   const ensureProjectMemory = async (projectId) => {
-    if (!state.memory.has(projectId)) state.memory.set(projectId, await loadProjectMemory(fetchJson, projectId));
+    if (!state.memory.has(projectId)) state.memory.set(projectId, await loadProjectMemory(fetchJson, projectId, state.token));
     return state.memory.get(projectId);
   };
   const ensureProjectUsage = async (projectId) => {
     const filters = state.usageFilters.get(projectId) || {};
-    const usage = await loadProjectUsage(fetchJson, projectId, filters);
+    const usage = await loadProjectUsage(fetchJson, projectId, filters, state.token);
     state.usage.set(projectId, usage);
     return usage;
   };
@@ -752,7 +807,7 @@ function startDashboardV2() {
         node('p', 'eyebrow', 'MEMORY SEARCH'),
         node('h2', '', query ? 'Resultados para “' + query + '”' : 'Buscar na memória'),
       );
-      const results = query ? (await searchProjectMemory(fetchJson, model.projectId, query)).results || [] : [];
+      const results = query ? (await searchProjectMemory(fetchJson, model.projectId, query, state.token)).results || [] : [];
       const list = node('div', 'memory-document-list');
       renderDocumentRows(list, model.projectId, results, query ? 'Nenhum documento contém esse termo.' : 'Digite um termo para pesquisar.');
       workspaceContent?.replaceChildren(heading, list);
@@ -776,7 +831,7 @@ function startDashboardV2() {
       setWorkspaceHeader(model, memory, route);
       const documents = memory.tree?.documents || [];
       if (route.kind === 'document') {
-        const payload = await loadMemoryDocument(fetchJson, model.projectId, route.logicalPath);
+        const payload = await loadMemoryDocument(fetchJson, model.projectId, route.logicalPath, state.token);
         renderReader(workspaceContent, buildMemoryDocumentViewModel(payload, payload.content));
         return;
       }
@@ -787,12 +842,18 @@ function startDashboardV2() {
             state.usageFilters.set(model.projectId, filters);
             renderWorkspaceRoute({ ...route });
           },
-          onTranscript: (transcriptId) => loadProjectTranscript(fetchJson, model.projectId, transcriptId),
+          onTranscript: (transcriptId) => loadProjectTranscript(fetchJson, model.projectId, transcriptId, state.token),
         });
       } else if (route.section === 'sessions') renderSessions(workspaceContent, model.projectId, documents);
       else if (route.section === 'memory') renderMemory(workspaceContent, model.projectId, documents);
       else if (route.section === 'changes') renderChanges(workspaceContent, model.projectId, documents);
-      else if (route.section === 'sync') renderSync(workspaceContent, memory.sync, model.projectId);
+      else if (route.section === 'sync') renderSync(
+        workspaceContent,
+        memory.sync,
+        model.projectId,
+        () => loadMemoryExport(fetchJson, model.projectId, state.token),
+      );
+      else if (route.section === 'security') renderSecurity(workspaceContent, await loadProjectSecurity(fetchJson, model.projectId, state.token));
       else renderWorkspaceOverview(workspaceContent, model, memory);
     } catch (error) {
       showWorkspaceError(error.message);
@@ -815,7 +876,7 @@ function startDashboardV2() {
   const refresh = async () => {
     setConnection('is-warning', 'Sincronizando');
     try {
-      const models = await loadDashboardData(fetchJson);
+      const models = await loadDashboardData(fetchJson, state.token);
       state.models = models;
       if (!state.selectedId || !models.some((model) => model.projectId === state.selectedId)) state.selectedId = models[0]?.projectId || '';
       setHidden(dashboardError, true);
@@ -831,6 +892,21 @@ function startDashboardV2() {
     }
   };
   byId('refresh-button')?.addEventListener('click', refresh);
+  byId('observer-auth-form')?.addEventListener('submit', (event) => {
+    event.preventDefault();
+    state.token = byId('observer-token-input')?.value || '';
+    state.memory.clear();
+    state.usage.clear();
+    refresh();
+  });
+  byId('observer-token-clear')?.addEventListener('click', () => {
+    state.token = '';
+    const input = byId('observer-token-input');
+    if (input) input.value = '';
+    state.memory.clear();
+    state.usage.clear();
+    refresh();
+  });
   byId('project-filter')?.addEventListener('input', (event) => {
     state.filter = event.target.value;
     renderProjectList(state.models, state.selectedId, state.filter);