atbash-hermes-plugin 0.9.12.dev0__py3-none-any.whl → 0.12.0.dev0__py3-none-any.whl

atbash_hermes_plugin/__init__.py

@@ -1,19 +1,30 @@
 from __future__ import annotations
 
 import atexit
+import base64
 import hashlib
 import json
 import logging
 import inspect
+import ntpath
 import os
 import re
+import sys
+import threading
 import time
 from pathlib import Path
-from typing import Any, Dict, Optional
+from typing import Any, Dict, Iterable, Optional
 
 logger = logging.getLogger("atbash-hermes-plugin")
 _TELEMETRY_SHUTDOWN_REGISTERED = False
 
+try:
+    from atbash_core import redact_secrets as _redact_secrets  # type: ignore
+    _REDACT_AVAILABLE = True
+except Exception:
+    _redact_secrets = None  # type: ignore
+    _REDACT_AVAILABLE = False
+
 HOLD_MESSAGE = (
     "Action held for operator review. The agent will not be jailed — please approve "
     "or reject this request from the Atbash dashboard, then ask the agent to try "
@@ -47,17 +58,32 @@ def _load_tool_map(path: Path) -> Dict[str, str]:
     if not isinstance(raw, dict):
         logger.warning("Ignoring invalid Atbash Hermes tool map path=%s", path)
         return {}
-    return {
+    entries = {
         str(tool_name): str(action_class)
         for tool_name, action_class in raw.items()
         if isinstance(tool_name, str) and isinstance(action_class, str)
     }
+    # Cap learned entries (C-HERMES-13): an agent naming thousands of fake
+    # tools must not grow this file without bound. Defaults always survive;
+    # learned entries keep the most recently seen (dict order).
+    if len(entries) > _TOOL_MAP_MAX_ENTRIES:
+        entries = dict(list(entries.items())[-_TOOL_MAP_MAX_ENTRIES:])
+    return entries
+
+
+_TOOL_MAP_MAX_ENTRIES = 512
+_TOOL_MAP_LOCK = threading.Lock()
 
 
 def _save_tool_map(path: Path, tool_map: Dict[str, str]) -> None:
+    # Unique temp name per process/thread (C-HERMES-13/15): a shared
+    # ``.tmp`` name makes concurrent hook threads replace each other's
+    # files and loses learned entries.
     try:
         path.parent.mkdir(parents=True, exist_ok=True)
-        temp_path = path.with_suffix(f"{path.suffix}.tmp")
+        temp_path = path.with_suffix(
+            f"{path.suffix}.{os.getpid()}.{threading.get_ident()}.tmp"
+        )
         temp_path.write_text(
             json.dumps(dict(sorted(tool_map.items())), indent=2) + "\n",
             encoding="utf-8",
@@ -99,22 +125,618 @@ def _load_recipient_allowlist() -> set:
 # Port of SDK defaults from DEFAULT_MEMORY_WRITE_TOOL_NAMES / DEFAULT_MEMORY_PATH_PATTERNS
 # so Hermes agents get the same detection surface as openclaw without extra config.
 
-_MEMORY_WRITE_TOOL_NAMES = frozenset({"write", "edit", "multiedit"})
+# Hermes's own file tool is write_file; without it a memory write skipped the
+# memory guard entirely and never established a baseline.
+_MEMORY_WRITE_TOOL_NAMES = frozenset({"write", "edit", "multiedit", "write_file", "create_file"})
 _MEMORY_READ_TOOL_NAMES = frozenset({"memory_search", "memory_get"})
 _GENERIC_READ_TOOL_NAMES = frozenset({"read", "read_file"})
-_MEMORY_PATH_PATTERNS = (
+
+_ZERO_WIDTH_RE = re.compile(r"[\u200b-\u200d\ufeff]")
+
+
+def _normalize_tool_name(tool_name: Any) -> str:
+    """Canonical tool-name spelling for routing decisions.
+
+    Hosts spell the same tool `write_file`, `write-file`, `writeFile` or
+    ` write_file ` depending on the registry that dispatched it; routing a
+    write to the memory guard or the guard-state refusal must not depend
+    on which spelling arrived (fuzz round, family d).
+    """
+    return re.sub(r"[\s._\-]+", "", (tool_name or "").strip().lower())
+
+
+def _norm_key(key: Any) -> str:
+    """Canonical argument-key spelling: `file_path`, `FILE_PATH` and
+    ` file_path` are the same key to the tool that reads them."""
+    return re.sub(r"[\s._\-]+", "", str(key).strip().lower())
+# Matched on whole path parts, not substrings: a memory file with no baseline
+# is blocked, so a substring like "memory/" must not catch src/memory/alloc.rs
+# or notes/working-memory.md. Memory is: a file under one of the agent-memory
+# directories below, a known memory document by exact name (Hermes's built-in
+# memory tool writes memories/MEMORY.md and USER.md), or a text document inside
+# a directory named memory/ or memories/. Hermes's own context files (the first
+# found of .hermes.md / HERMES.md, AGENTS.override.md over AGENTS.md, Cursor
+# rules) are loaded into the next session's instructions, so they are memory too.
+_MEMORY_DIR_MARKERS = (
     "/.openclaw/workspace/",
     "/.openclaw/memory/",
     "/.claude/projects/",
-    "/memory/",
-    "memory/",
-    "Memory.md",
-    "DREAMS.md",
-    "CLAUDE.md",
-    "AGENTS.md",
+)
+_MEMORY_BASENAMES = frozenset(
+    {
+        "memory.md",
+        "dreams.md",
+        "claude.md",
+        "agents.md",
+        "agents.override.md",
+        "user.md",
+        ".hermes.md",
+        "hermes.md",
+        ".cursorrules",
+    }
+)
+_MEMORY_DIR_NAMES = frozenset({"memory", "memories"})
+_MEMORY_DOC_SUFFIXES = frozenset({".md", ".markdown", ".txt"})
+
+# ── Guard self-protection ────────────────────────────────────────────────────
+# The guard's own mutable state lives under ~/.config/atbash (tool map,
+# recipient allowlist, persisted memory-hash baseline, agent key). A write tool
+# aimed at any of those paths is a self-protection attack — rewriting the
+# allowlist or the baseline neuters every other check — so it is refused before
+# judging, unconditionally.
+_GUARD_STATE_DIR = Path("~/.config/atbash").expanduser()
+_WRITE_TOOL_NAMES = frozenset(
+    {
+        "write",
+        "edit",
+        "multiedit",
+        "write_file",
+        "create_file",
+        "str_replace_editor",
+        "apply_patch",
+        "patch",
+        "fs_write",
+        "notebook_edit",
+    }
+)
+
+# Routing uses ONE write-class surface, spelling-normalised. The fuzz found
+# the guard-state refusal already knew save_file/apply_patch/... as writes
+# while memory classification did not, so the same call was refused at
+# .hermes/.env but sailed past the memory guard at MEMORY.md — and unstripped
+# or re-spelt names (` write_file`, `writeFile`, `file.write`) bypassed both.
+_WRITE_TOOL_NAMES_N = frozenset(
+    {_normalize_tool_name(n) for n in _WRITE_TOOL_NAMES}
+    | {
+        "savefile", "appendfile", "save", "create", "append", "putfile",
+        "storefile", "uploadfile", "writetofile", "filewrite", "insertfile",
+        "touch", "tee", "filesystemwrite",
+        # Delete family: removing a guard file disarms the guard like
+        # editing it, and the refusal must fire on the first call, before
+        # the tool map has learned anything (security-reviewer follow-up).
+        "deletefile", "removefile", "delete", "remove", "unlink",
+        "erasefile", "erase", "truncatefile", "rm", "deletepath",
+        "removeitem", "deleteitem",
+    }
+)
+_RENAME_TOOL_NAMES_N = frozenset(
+    {"renamefile", "movefile", "rename", "move", "copyfile", "copy", "cp"}
+)
+# True moves (the source disappears) vs copies (the source is only read).
+_MOVE_TOOL_NAMES_N = frozenset({"renamefile", "movefile", "rename", "move"})
+_EDIT_TOOL_NAMES_N = frozenset({"edit", "multiedit", "strreplaceeditor"})
+_APPEND_TOOL_NAMES_N = frozenset({"append", "appendfile"})
+_PATCH_TOOL_NAMES_N = frozenset({"patch", "applypatch"})
+_SEMANTIC_MEMORY_WRITE_TOOLS_N = frozenset(
+    {"memorystore", "memorysave", "memorywrite", "memoryset", "memoryupdate"}
+)
+_MEMORY_READ_TOOL_NAMES_N = frozenset({"memorysearch", "memoryget"})
+_GENERIC_READ_TOOL_NAMES_N = frozenset(
+    {
+        "read", "readfile", "readtextfile", "fileread", "view", "viewfile",
+        "cat", "getfile", "openfile",
+    }
+)
+
+_WRITE_OPERATION_NAMES = frozenset(
+    {"write", "create", "update", "delete", "move", "rename", "append", "patch", "writefile"}
+)
+
+
+def _is_write_operation(tool_args: Dict[str, Any]) -> bool:
+    """Operation-discriminated tools (operation/method/action) classify by
+    what the call DOES; key and value are both matched spelling-normalised,
+    so ` write `, `write_file` and an `Operation` key are the write they
+    name (fuzz family d; governor follow-up @ e6a5385)."""
+    by_norm = _args_by_norm_key(tool_args)
+    for k in ("operation", "method", "action"):
+        v = by_norm.get(k)
+        if isinstance(v, str) and re.sub(r"[\s._\-]+", "", v.strip().lower()) in _WRITE_OPERATION_NAMES:
+            return True
+    return False
+
+
+# Hermes reads the guard's switches (ATBASH_ENFORCE_DECISION, ATBASH_KEY_PATH)
+# from <hermes home>/.env and enables plugins in <hermes home>/config.yaml, so a
+# write to either disarms the guard at the next start just as surely as editing
+# its state.
+def _loaded_hermes_constants():
+    """Hermes's own hermes_constants module, only when Hermes already loaded it.
+
+    Never imported here: outside Hermes that import would find whatever
+    hermes_constants.py sits first on sys.path - the folder the seed command
+    runs in - and run it as the person doing the trust step."""
+    return sys.modules.get("hermes_constants")
+
+
+def _hermes_homes() -> list:
+    """Every directory Hermes may use as its home, resolved the way Hermes does
+    (hermes_constants.get_hermes_home): its own answer when Hermes is loaded,
+    then $HERMES_HOME (the README's Docker setup mounts it at /opt/data), then
+    the platform default (LOCALAPPDATA/hermes on Windows), plus ~/.hermes."""
+    homes = []
+    constants = _loaded_hermes_constants()
+    if constants is not None:
+        try:
+            homes.append(Path(constants.get_hermes_home()))
+        except Exception:
+            pass
+    env_home = os.getenv("HERMES_HOME", "").strip()
+    if env_home:
+        homes.append(Path(os.path.expandvars(env_home)).expanduser())
+    if sys.platform == "win32":
+        local = os.getenv("LOCALAPPDATA", "").strip()
+        homes.append((Path(local) if local else Path.home() / "AppData" / "Local") / "hermes")
+    homes.append(Path("~/.hermes").expanduser())
+    unique, seen = [], set()
+    for h in homes:
+        key = os.path.normcase(str(h))
+        if key not in seen:
+            seen.add(key)
+            unique.append(h)
+    return unique
+
+
+def _hermes_config_files() -> list:
+    """Every file Hermes reads settings or standing instructions from: each
+    home's .env, .op.env, config.yaml and SOUL.md (same trust class as
+    config.yaml in Hermes), plus the install folder's .env, which Hermes uses to
+    fill keys the home's .env does not set."""
+    files = [h / name for h in _hermes_homes() for name in (".env", ".op.env", "config.yaml", "SOUL.md")]
+    constants = _loaded_hermes_constants()
+    install_file = getattr(constants, "__file__", None) if constants is not None else None
+    if install_file:
+        files.append(Path(install_file).resolve().parent / ".env")
+    return files
+
+
+def _hermes_env_value(name: str) -> Optional[str]:
+    """A setting as Hermes would see it: the process environment, else the first
+    Hermes home `.env` or `.op.env` that sets it (Hermes loads those files at
+    start and expands `$VARS` / `%VARS%`; a seed run from a plain terminal does
+    not). Home `.env` wins over `.op.env` in the same directory, matching
+    Hermes's loader (`.op.env` only fills keys the `.env` does not set)."""
+    value = os.getenv(name)
+    if value:
+        return os.path.expandvars(value)
+    for home in _hermes_homes():
+        for filename in (".env", ".op.env"):
+            env_file = home / filename
+            try:
+                lines = env_file.read_text(encoding="utf-8").splitlines()
+            except OSError:
+                continue
+            for line in lines:
+                line = line.strip()
+                if line.startswith("export "):
+                    line = line[len("export "):].lstrip()
+                key, sep, val = line.partition("=")
+                if sep and key.strip() == name:
+                    val = val.strip()
+                    if len(val) >= 2 and val[0] == val[-1] and val[0] in "'\"":
+                        val = val[1:-1]
+                    if val:
+                        return os.path.expandvars(val)
+    return None
+
+
+def _memory_hash_store_path() -> Path:
+    return Path(
+        _hermes_env_value("ATBASH_MEMORY_HASH_PATH")
+        or str(_default_tool_map_path().parent / "hermes-memory-hashes.json")
+    ).expanduser()
+
+
+def _same_file(a: Path, b: Path) -> bool:
+    """True when two names reach the same file or directory.
+
+    Compares the on-disk identity (device + inode) when both exist, which
+    covers hard links and case-insensitive filesystems (macOS, Windows) where
+    realpath keeps the caller's casing. Falls back to the normalised real path
+    for names that do not exist yet.
+    """
+    try:
+        if a.exists() and b.exists():
+            return os.path.samefile(str(a), str(b))
+    except OSError:
+        pass
+    return os.path.normcase(os.path.realpath(str(a))) == os.path.normcase(os.path.realpath(str(b)))
+
+
+def _guard_state_roots(extra: Iterable[Path] = ()) -> list:
+    roots = [_GUARD_STATE_DIR, *_hermes_config_files(), Path(__file__).resolve().parent]
+    # N-10: the SDK packages the guard itself imports (judge client,
+    # redaction, memory diff) are guard state too — rewriting them backdoors
+    # every check from the next process start.
+    for module_name in ("atbash", "atbash_core"):
+        module = sys.modules.get(module_name)
+        module_file = getattr(module, "__file__", None)
+        if module_file:
+            roots.append(Path(module_file).resolve().parent)
+    return [*roots, *extra]
+
+
+def _expand_env_text(text: str) -> str:
+    """Expand the home spellings shells and tools actually use: %VAR%,
+    $env:VAR (PowerShell), ${VAR}, $VAR, and $HOME when the process has no
+    HOME variable (the usual Windows case). Unknown variables are left
+    untouched — an unexpanded spelling simply cannot be proven safe."""
+    text = re.sub(
+        r"(?i)\$env:([A-Za-z_][A-Za-z0-9_]*)",
+        lambda m: os.environ.get(m.group(1), m.group(0)),
+        text,
+    )
+    text = os.path.expandvars(text)
+    # posixpath.expandvars leaves %VAR% alone; cmd-style spellings must
+    # resolve the same way on every OS.
+    text = re.sub(
+        r"%([A-Za-z_][A-Za-z0-9_]*)%",
+        lambda m: os.environ.get(m.group(1), m.group(0)),
+        text,
+    )
+    if "$" in text:
+        text = re.sub(
+            r"(?i)\$(?:\{home\}|home(?![A-Za-z0-9_]))",
+            lambda m: str(Path.home()),
+            text,
+        )
+    return text
+
+
+def _strip_file_uri(path: str) -> str:
+    """Turn a ``file:`` URI into the filesystem path it names.
+
+    ``file:///home/me/.hermes/.env`` and ``file://localhost/home/me/.hermes/.env``
+    are the same file as ``/home/me/.hermes/.env``. Leaving the scheme in place
+    made identity matching miss, so a write whose only target lived under
+    ``uri`` skipped the guard-state refusal.
+    """
+    text = str(path)
+    if not text.lower().startswith("file:"):
+        return text
+    rest = text[5:]
+    if rest.startswith("//"):
+        rest = rest[2:]
+        if rest.startswith("/"):
+            return _drop_uri_drive_slash(rest)
+        slash = rest.find("/")
+        if slash < 0:
+            return rest
+        host, path_part = rest[:slash], rest[slash:]
+        if host.lower() in ("", "localhost", "127.0.0.1"):
+            return _drop_uri_drive_slash(path_part)
+        return "//" + rest
+    if rest.startswith("/"):
+        return _drop_uri_drive_slash(rest)
+    return text
+
+
+def _drop_uri_drive_slash(p: str) -> str:
+    """``/C:/...`` (the URI spelling of a Windows drive path) -> ``C:/...``.
+
+    ``Path.as_uri()`` spells a drive path ``file:///C:/...``; keeping the
+    leading slash made the canonical key ``c:/c:/...``, which never matches
+    the plain-path key, so the URI alias kept slipping past on Windows.
+    """
+    if len(p) >= 3 and p[0] == "/" and p[2] == ":" and p[1].isalpha():
+        return p[1:]
+    return p
+
+
+def _folds_case(root: Path) -> bool:
+    """Whether names under `root` are opened case-insensitively.
+
+    Windows and macOS default to case-insensitive volumes. Elsewhere, probe
+    the nearest existing component: a case-swapped spelling that reaches the
+    same file means this mount folds case (a Windows/macOS bind mount, WSL
+    drvfs). On a case-sensitive volume `RECIPIENT-ALLOWLIST.JSON` is a
+    different file and must not be refused as guard state.
+    """
+    if os.name == "nt" or sys.platform == "darwin":
+        return True
+    try:
+        p = Path(root).expanduser().resolve()
+        for c in (p, *p.parents):
+            if not c.exists():
+                continue
+            name = c.name
+            if name.swapcase() == name:
+                continue
+            swapped = c.with_name(name.swapcase())
+            return swapped.exists() and os.path.samefile(str(c), str(swapped))
+    except Exception:
+        return True
+    return False
+
+
+def _canonical_path_key(path: str, fold_case: bool = True) -> str:
+    """The identity the OS actually opens for a path spelling.
+
+    Windows opens `name.`, `name...`, `name ` and `name::$DATA` (or any
+    `:stream`) as `name` itself, resolves a dotted directory component
+    (`.hermes.`) to the plain directory, and treats `\\\\localhost\\C$\\...`,
+    `\\\\?\\UNC\\...` and root-relative `\\Users\\...` spellings as the local
+    file they name. String/realpath comparison missed all of those, and the
+    guard-state roots for .env/config.yaml/SOUL.md are the FILES themselves,
+    so each alias walked straight past the refusal (fuzz family b).
+    Environment spellings (%USERPROFILE%, $env:..., $HOME, ~) are expanded
+    first because the executing shell or tool expands them too. ``file:``
+    URIs are reduced to the path they name so ``uri`` aliases cannot skip
+    the same check.
+    """
+    text = _expand_env_text(str(path)).strip().strip('"').strip("'")
+    text = _strip_file_uri(text)
+    if text == "~" or text.startswith(("~/", "~\\")):
+        text = str(Path.home()) + text[1:]
+    text = text.replace("\\", "/")
+    lowered = text.lower()
+    if lowered.startswith("//?/unc/"):
+        text = "//" + text[len("//?/unc/"):]
+    elif lowered.startswith("//?/"):
+        text = text[len("//?/"):]
+    drive = ""
+    rest = text
+    drive_match = re.match(r"^([a-zA-Z]):(.*)$", text)
+    if drive_match:
+        drive, rest = drive_match.group(1).lower() + ":", drive_match.group(2)
+    elif text.startswith("//"):
+        segments = [s for s in text.split("/") if s]
+        if (
+            len(segments) >= 2
+            and segments[0].lower() in ("localhost", "127.0.0.1")
+            and re.fullmatch(r"[a-zA-Z]\$", segments[1])
+        ):
+            # An admin share on this machine IS the local drive.
+            drive, rest = segments[1][0].lower() + ":", "/".join(segments[2:])
+        elif len(segments) >= 2:
+            drive = "//" + segments[0].lower() + "/" + segments[1].lower()
+            rest = "/".join(segments[2:])
+    if not drive:
+        cwd = os.getcwd().replace("\\", "/")
+        cwd_match = re.match(r"^([a-zA-Z]):", cwd)
+        cwd_drive = (cwd_match.group(1).lower() + ":") if cwd_match else ""
+        if rest.startswith("/"):
+            drive = cwd_drive  # root-relative: the current drive
+        else:
+            rest = (cwd[len(cwd_drive):] + "/" + rest) if cwd_drive else (cwd + "/" + rest)
+            drive = cwd_drive
+    parts = []
+    for part in rest.split("/"):
+        if part in ("", "."):
+            continue
+        if part == "..":
+            if parts:
+                parts.pop()
+            continue
+        part = _ZERO_WIDTH_RE.sub("", part).split(":", 1)[0].rstrip(". ")
+        if part:
+            parts.append(part.lower() if fold_case else part)
+    return (drive + "/" + "/".join(parts)) if drive else "/".join(parts)
+
+
+_COMMAND_TOKEN_RE = re.compile(r'"([^"]+)"|\'([^\']+)\'|([^\s;|&<>"]+)')
+
+
+def _command_path_tokens(command: str) -> list:
+    """Path-like tokens named in a shell command (quoted or bare)."""
+    tokens = []
+    for match in _COMMAND_TOKEN_RE.finditer(command):
+        token = next((g for g in match.groups() if g is not None), "")
+        if "/" in token or "\\" in token or ":" in token:
+            tokens.append(token)
+    return tokens
+
+
+def _is_guard_state_path(path: str, extra: Iterable[Path] = ()) -> bool:
+    """True when `path` is, or is inside, anything the guard stands on: its state
+    directory, Hermes's own config, the plugin's install directory, or the extra
+    files (tool map, key, hash baseline) passed in."""
+    try:
+        roots = _guard_state_roots(extra)
+        # First the spelling-true identity: every alias above resolves to
+        # the same canonical key as the protected file or directory.
+        for root in roots:
+            root_text = str(Path(root).expanduser())
+            fold = _folds_case(Path(root_text))
+            key = _canonical_path_key(path, fold_case=fold)
+            root_key = _canonical_path_key(root_text, fold_case=fold)
+            if key == root_key or key.startswith(root_key + "/"):
+                return True
+        p = Path(_strip_file_uri(_expand_env_text(str(path)))).expanduser()
+        if not p.is_absolute():
+            p = Path.cwd() / p
+        # The target and every ancestor that exists: a new file inside a
+        # protected directory is caught through the directory itself.
+        candidates = [p, *p.parents]
+        for root in roots:
+            root = Path(root).expanduser()
+            for c in candidates:
+                if _same_file(c, root):
+                    return True
+            # A hard link elsewhere to a file inside a protected directory is
+            # that file: compare the target against the directory's contents.
+            if p.exists() and p.is_file() and root.is_dir():
+                for i, inner in enumerate(root.rglob("*")):
+                    if i >= 2000:
+                        break
+                    if inner.is_file() and _same_file(p, inner):
+                        return True
+        return False
+    except Exception:
+        # Unresolvable is not "safe": the caller only asks for write-class tools.
+        return True
+
+
+_SEEDER_DIRECT_RE = re.compile(
+    r"atbash[-_]hermes[-_]seed|seed_memory_baselines|hermes-memory-hashes", re.IGNORECASE
+)
+_SEEDER_PLUGIN_RE = re.compile(r"atbash_hermes_plugin", re.IGNORECASE)
+_SEEDER_ACTION_RE = re.compile(r"\bseed\b|\brunpy\b", re.IGNORECASE)
+_B64_TOKEN_RE = re.compile(r"[A-Za-z0-9+/]{16,}={0,2}")
+_PATCH_TARGET_RE = re.compile(
+    r"(?im)(?:\*\*\*\s+(?:Add|Update|Delete|Rename)\s+File:\s+|"
+    r"\*\*\*\s+Move to:\s+|"
+    r"^(?:---|\+\+\+)\s+(?:[ab]/)?)"
+    r"([^\s]+)"
 )
 
 
+def _seeder_text(text: str) -> bool:
+    # Quotes and shell variable tricks only split the words apart; compare
+    # without them, and also inside any base64 token the command decodes.
+    flat = re.sub(r"[\"'`]", "", text)
+    candidates = [flat]
+    for token in _B64_TOKEN_RE.findall(text):
+        # Decode up to two layers, standard and URL-safe alphabets, and
+        # UTF-16LE (powershell -EncodedCommand) — one layer of plain base64
+        # was the only encoding the seeder check could see through (N-11).
+        current = [token]
+        for _ in range(2):
+            decoded_texts = []
+            for candidate_token in current:
+                padded = candidate_token + "=" * (-len(candidate_token) % 4)
+                for decoder in (base64.b64decode, base64.urlsafe_b64decode):
+                    try:
+                        raw = decoder(padded, validate=True)
+                    except Exception:
+                        continue
+                    decoded_texts.append(raw.decode("utf-8", "ignore"))
+                    decoded_texts.append(raw.decode("utf-16-le", "ignore"))
+                    candidates.extend(decoded_texts[-2:])
+            current = _B64_TOKEN_RE.findall(" ".join(decoded_texts))
+            if not current:
+                break
+    for c in candidates:
+        if _SEEDER_DIRECT_RE.search(c):
+            return True
+        if _SEEDER_PLUGIN_RE.search(c) and _SEEDER_ACTION_RE.search(c):
+            return True
+    return False
+
+
+def _invokes_seeder(tool_args: Any) -> bool:
+    """True when any argument runs (or rewrites what) the baseline seeder (writes)
+    - trusting a memory file is a human step, so the agent may never do it for
+    itself. Best effort: a determined shell can still rewrite the plain-JSON
+    baseline file, which the README lists as a known limit."""
+    if isinstance(tool_args, str):
+        return _seeder_text(tool_args)
+    if isinstance(tool_args, dict):
+        return any(_invokes_seeder(v) for v in tool_args.values())
+    if isinstance(tool_args, (list, tuple)):
+        return any(_invokes_seeder(v) for v in tool_args)
+    return False
+
+
+def _paths_named_in(text: str) -> list:
+    """Filenames a patch body or a paths-list argument may name.
+
+    Includes a single-line path as-is (a `paths` entry) and V4A / unified-diff
+    target headers, so a relative `SOUL.md` is checked the same way a `path`
+    argument is.
+    """
+    found = []
+    stripped = text.strip().strip("\"'`")
+    if stripped and "\n" not in stripped:
+        found.append(stripped)
+    for m in _PATCH_TARGET_RE.finditer(text):
+        found.append(m.group(1).strip("\"'`").rstrip(":"))
+    return found
+
+
+def _patch_bodies(value: Any) -> list:
+    """Every argument string that is a V4A / unified-diff body (it carries a
+    target header), at any nesting depth."""
+    if isinstance(value, str):
+        return [value] if _PATCH_TARGET_RE.search(value) else []
+    if isinstance(value, dict):
+        return [b for item in value.values() for b in _patch_bodies(item)]
+    if isinstance(value, (list, tuple)):
+        return [b for item in value for b in _patch_bodies(item)]
+    return []
+
+
+def _patch_header_targets(bodies: Iterable[str]) -> list:
+    """Files the patch headers name. A bare mention elsewhere is not a target:
+    only a header decides where the patch lands."""
+    return [
+        named
+        for body in bodies
+        for m in _PATCH_TARGET_RE.finditer(body)
+        for named in (m.group(1).strip("\"'`").rstrip(":"),)
+        if named and named != "/dev/null"
+    ]
+
+
+def _mentions_guard_state(value: Any, extra: Iterable[Path] = ()) -> bool:
+    """For write tools whose target is not a single path argument (a patch body,
+    a `paths` list), refuse when any string argument names a protected path.
+
+    Relative names such as `SOUL.md` or `.env` are resolved against the process
+    cwd the same way `_is_guard_state_path` does, so a patch applied after `cd`
+    into a Hermes home still cannot rewrite guard files.
+    """
+    needles = {
+        str(Path(r).expanduser()).replace("\\", "/").lower().rstrip("/") for r in _guard_state_roots(extra)
+    }
+    needles |= {".config/atbash", ".hermes/.env", ".hermes/.op.env", ".hermes/config.yaml", ".hermes/soul.md"}
+    # A needle only counts as a whole path component: ".config/atbash-cli" and
+    # ".hermes/.envrc" are other files.
+    patterns = [re.compile(re.escape(n) + r"(?![\w.-])") for n in needles if n]
+
+    def normalise(text: str) -> str:
+        t = _ZERO_WIDTH_RE.sub("", _expand_env_text(text)).replace("\\", "/").lower()
+        t = t.replace("//?/unc/", "//").replace("//?/", "/")
+        # An admin share on this machine names the local drive itself.
+        t = re.sub(r"//(?:localhost|127\.0\.0\.1)/([a-z])\$/", r"\1:/", t)
+        t = re.sub(r"/(?:\./)+", "/", t)  # a/./b -> a/b
+        t = re.sub(r"/{2,}", "/", t)  # a//b -> a/b
+        prev = None
+        while prev != t:  # a/x/../b -> a/b
+            prev = t
+            t = re.sub(r"/(?!\.\.?/)[^/\s\"'`]+/\.\./", "/", t)
+        # Win32 opens `name.`, `name...` and `name::$DATA` as `name` itself;
+        # without this the dotted-directory spelling `.config/atbash./...`
+        # slipped past the needle match (fuzz family b).
+        t = re.sub(r":\$data(?=/|$|[\s\"'\)\];,])", "", t)
+        t = re.sub(r"\.+(?=/|$|[\s\"'\)\];,])", "", t)
+        return t
+
+    def walk(v: Any) -> bool:
+        if isinstance(v, str):
+            t = normalise(v)
+            if any(p.search(t) for p in patterns):
+                return True
+            return any(_is_guard_state_path(p, extra) for p in _paths_named_in(v))
+        if isinstance(v, dict):
+            return any(walk(x) for x in v.values())
+        if isinstance(v, (list, tuple)):
+            return any(walk(x) for x in v)
+        return False
+
+    return walk(value)
+
+
 # Copied verbatim from @atbash/sdk so the judge LLM receives the same
 # memory-scan system prompt as openclaw — the SCORE prefix it returns is
 # required for quality-gated rollback even though we don't do chain commits yet.
@@ -179,15 +801,27 @@ _MEMORY_SCAN_CONTEXT = (
 )
 
 
+def _neutralize_scan_delimiters(text: Any) -> str:
+    """Keep wrapper tokens inside untrusted fields from closing the scan region."""
+    return str(text).replace(
+        "<<<END_UNTRUSTED_MEMORY_CONTENT>>>", "<<<END_UNTRUSTED_MEMORY_CONTENT (in content)>>>"
+    ).replace(
+        "<<<UNTRUSTED_MEMORY_CONTENT>>>", "<<<UNTRUSTED_MEMORY_CONTENT (in content)>>>"
+    )
+
+
 def _format_entry_for_scan(entry: Dict[str, Any]) -> str:
     """Wrap a memory entry in <<<UNTRUSTED_MEMORY_CONTENT>>> delimiters for scanning."""
+    # N-5: untrusted fields must never be able to close the wrapper early —
+    # a literal END delimiter in the value, key, or source would put attacker
+    # text outside the untrusted region for the judge.
     parts = [
         "<<<UNTRUSTED_MEMORY_CONTENT>>>",
-        f"MEMORY KEY: {entry['key']}",
-        f"MEMORY VALUE: {entry['value']}",
+        f"MEMORY KEY: {_neutralize_scan_delimiters(entry['key'])}",
+        f"MEMORY VALUE: {_neutralize_scan_delimiters(entry['value'])}",
     ]
     if entry.get("source"):
-        parts.append(f"SOURCE: {entry['source']}")
+        parts.append(f"SOURCE: {_neutralize_scan_delimiters(entry['source'])}")
     parts.append("<<<END_UNTRUSTED_MEMORY_CONTENT>>>")
     return "\n".join(parts)
 
@@ -196,6 +830,38 @@ def _sha256_hex(content: str) -> str:
     return hashlib.sha256(content.encode("utf-8", errors="replace")).hexdigest()
 
 
+def _memory_key(path: str) -> str:
+    """One key per file, whatever spelling the tool call used (./AGENTS.md,
+    an absolute path, a different case on a case-insensitive filesystem)."""
+    try:
+        return os.path.normcase(os.path.realpath(str(Path(path).expanduser())))
+    except Exception:
+        return path
+
+
+def seed_memory_baselines(paths: Iterable[str], store: "Optional[_MemoryHashStore]" = None) -> list:
+    """Record the current SHA-256 of each file as its trusted baseline.
+
+    The human step behind "no baseline = untrusted": run it yourself (outside
+    the agent) after reviewing the files, e.g.
+        python -m atbash_hermes_plugin seed AGENTS.md memory/notes.md
+    Nothing is sent anywhere; the hashes go to the local baseline file.
+    """
+    # Read every file first: one bad name in the list trusts nothing, rather
+    # than trusting the files before it and then failing.
+    contents = []
+    for raw in paths:
+        p = Path(raw).expanduser()
+        contents.append((p, p.read_text(encoding="utf-8", errors="replace")))
+    if store is None:
+        store = _MemoryHashStore(_memory_hash_store_path())
+    seeded = []
+    for p, content in contents:
+        store.set(str(p), _sha256_hex(content))
+        seeded.append(str(p))
+    return seeded
+
+
 class _MemoryHashStore:
     """Persistent hash store for memory files — survives process restarts.
 
@@ -223,21 +889,31 @@ class _MemoryHashStore:
 
     def get(self, file_path: str) -> Optional[str]:
         self._ensure_loaded()
-        return self._data.get(file_path)
+        # Canonical key first; the raw key keeps baselines written by older
+        # versions (keyed by whatever path string the tool call carried).
+        return self._data.get(_memory_key(file_path), self._data.get(file_path))
 
     def set(self, file_path: str, sha256: str) -> None:
         self._ensure_loaded()
-        self._data[file_path] = sha256
+        self._data[_memory_key(file_path)] = sha256
         self._persist()
 
     def items(self):
         self._ensure_loaded()
         return list(self._data.items())
 
+    def remove(self, file_path: str) -> None:
+        self._ensure_loaded()
+        self._data.pop(_memory_key(file_path), None)
+        self._data.pop(file_path, None)
+        self._persist()
+
     def _persist(self) -> None:
         try:
             self._path.parent.mkdir(parents=True, exist_ok=True)
-            tmp = self._path.with_suffix(self._path.suffix + ".tmp")
+            tmp = self._path.with_suffix(
+                f"{self._path.suffix}.{os.getpid()}.{threading.get_ident()}.tmp"
+            )
             tmp.write_text(
                 json.dumps(dict(sorted(self._data.items())), indent=2) + "\n",
                 encoding="utf-8",
@@ -247,22 +923,134 @@ class _MemoryHashStore:
             logger.warning("Atbash memory hash store write error path=%s err=%s", self._path, e)
 
 
+def _path_parts(path: str) -> list:
+    """Lower-cased path parts, spelled the way the filesystem resolves them.
+
+    On Windows `AGENTS.md.`, `AGENTS.md ` and `AGENTS.md::$DATA` open AGENTS.md
+    itself, so trailing dots and spaces and any `:stream` suffix are dropped
+    from each part. The drive (`c:`, also drive-relative `c:AGENTS.md`, or a UNC
+    share) is split off first so its colon is never read as a stream. `.` parts
+    are dropped and `..` removes the part before it, everywhere."""
+    text = path.replace("\\", "/").lower()
+    drive = ""
+    if os.name == "nt":
+        drive, text = ntpath.splitdrive(text)
+    parts = [drive] if drive else []
+    floor = len(parts)
+    for part in text.split("/"):
+        if part == "..":
+            if len(parts) > floor:
+                parts.pop()
+            continue
+        if os.name == "nt":
+            part = part.split(":", 1)[0].rstrip(". ")
+        if part and part != ".":
+            parts.append(part)
+    return parts
+
+
 def _matches_memory_path(path: str) -> bool:
-    p = path.replace("\\", "/").lower()
-    return any(pat.lower() in p for pat in _MEMORY_PATH_PATTERNS)
+    parts = _path_parts(path)
+    if not parts:
+        return False
+    joined = "/" + "/".join(parts) + "/"
+    if any(marker in joined for marker in _MEMORY_DIR_MARKERS):
+        return True
+    name = parts[-1]
+    if name in _MEMORY_BASENAMES:
+        return True
+    if len(parts) >= 3 and parts[-3:-1] == [".cursor", "rules"] and name.endswith(".mdc"):
+        return True
+    for index, part in enumerate(parts[:-1]):
+        if part not in _MEMORY_DIR_NAMES:
+            continue
+        # Inside Hermes's own memory dirs any state file counts (state.json
+        # is memory too, N-7); a generic project memory/ folder only counts
+        # for document suffixes, so ordinary code there stays unclassified.
+        if ".hermes" in parts[:index] or Path(name).suffix in _MEMORY_DOC_SUFFIXES:
+            return True
+    # N-6: a symlink/junction alias must classify by where it lands.
+    try:
+        resolved = os.path.realpath(str(Path(path).expanduser()))
+    except Exception:
+        return False
+    if resolved and resolved.replace("\\", "/").lower() != path.replace("\\", "/").lower():
+        resolved_parts = _path_parts(resolved)
+        resolved_name = resolved_parts[-1] if resolved_parts else ""
+        if resolved_name in _MEMORY_BASENAMES:
+            return True
+        return any(p in _MEMORY_DIR_NAMES for p in resolved_parts[:-1]) and (
+            ".hermes" in resolved_parts or Path(resolved_name).suffix in _MEMORY_DOC_SUFFIXES
+        )
+    return False
+
+
+def _args_by_norm_key(args: Dict[str, Any]) -> Dict[str, Any]:
+    by_norm: Dict[str, Any] = {}
+    for k, v in args.items():
+        by_norm.setdefault(_norm_key(k), v)
+    return by_norm
+
+
+_PATH_KEY_PRIORITY = (
+    "file_path", "path", "filepath", "filename", "file_name", "pathname",
+    "path_name", "uri", "location", "target", "file", "destination",
+    "dest", "destination_path", "dest_path", "new_path", "to_path",
+)
 
 
 def _pick_path(args: Dict[str, Any]) -> Optional[str]:
-    # Key order matches SDK pickPath / extractPath — includes "filePath", "target", "file"
-    for k in ("file_path", "path", "filePath", "filename", "target", "file"):
-        v = args.get(k)
+    # Key order matches SDK pickPath / extractPath — includes "filePath",
+    # "target", "file". Keys are matched spelling-normalised (`FILE_PATH`,
+    # ` file_path`) and the list covers the aliases real tools use
+    # (filepath, uri, dest, ...): a closed list let the same write slip
+    # past routing under a synonym key (fuzz family d).
+    by_norm = _args_by_norm_key(args)
+    for k in _PATH_KEY_PRIORITY:
+        v = by_norm.get(_norm_key(k))
         if isinstance(v, str) and v.strip():
             return v.strip()
     return None
 
 
+def _pick_destination(args: Dict[str, Any]) -> Optional[str]:
+    by_norm = _args_by_norm_key(args)
+    for k in ("destination", "dest_path", "new_path", "target", "to_path", "dest", "destination_path"):
+        v = by_norm.get(_norm_key(k))
+        if isinstance(v, str) and v.strip():
+            return v.strip()
+    return None
+
+
+_SOURCE_KEY_PRIORITY = (
+    "source", "source_path", "sourcepath", "src", "from", "from_path",
+    "old_path", "oldpath", "origin", "original_path",
+)
+
+
+def _pick_source(args: Dict[str, Any]) -> Optional[str]:
+    """The rename/move source, under its own spellings. _pick_path has no
+    source key (it would return the destination, which it also covers),
+    so either-end checks and rename content reads must ask here. Keys are
+    disjoint from the destination set on purpose: a key already consumed
+    as the destination (`target`) is never re-read as the source."""
+    by_norm = _args_by_norm_key(args)
+    for k in _SOURCE_KEY_PRIORITY:
+        v = by_norm.get(_norm_key(k))
+        if isinstance(v, str) and v.strip():
+            return v.strip()
+    return None
+
+
+_CONTENT_KEY_PRIORITY = (
+    "content", "newText", "new_string", "new_str", "newStr", "replacement",
+    "value", "text", "body", "data", "contents", "payload", "new_content",
+    "input", "delta", "body_text", "text_content",
+)
+
+
 def _pick_write_content(tool_name: str, args: Dict[str, Any]) -> Optional[str]:
-    t = tool_name.lower()
+    t = _normalize_tool_name(tool_name)
     # SDK EDIT_NEW_CONTENT_KEYS order: newText first, then snake_case variants.
     _EDIT_KEYS = ("newText", "new_string", "new_str", "newStr", "replacement")
     # Check edits array first for any tool — SDK checks edits before direct keys.
@@ -271,49 +1059,150 @@ def _pick_write_content(tool_name: str, args: Dict[str, Any]) -> Optional[str]:
         parts: list[str] = []
         for e in edits:
             if isinstance(e, dict):
+                e_by_norm = _args_by_norm_key(e)
                 for k in _EDIT_KEYS:
-                    vv = e.get(k)
+                    vv = e_by_norm.get(_norm_key(k))
                     if isinstance(vv, str) and vv.strip():
                         parts.append(vv)
                         break
         if parts:
             return "\n".join(parts)
-    if t in ("write", "multiedit") and isinstance(args.get("content"), str) and args["content"].strip():
-        return args["content"]
-    if t == "edit":
+    by_norm = _args_by_norm_key(args)
+    if t in _EDIT_TOOL_NAMES_N:
         for k in _EDIT_KEYS:
-            v = args.get(k)
+            v = by_norm.get(_norm_key(k))
             if isinstance(v, str) and v.strip():
                 return v
-    # Fallback mirrors SDK: content, then EDIT_NEW_CONTENT_KEYS, then value/text.
-    for k in ("content", "newText", "new_string", "new_str", "newStr", "replacement", "value", "text", "body"):
-        v = args.get(k)
+    # Fallback mirrors SDK: content, then EDIT_NEW_CONTENT_KEYS, then
+    # value/text — extended with the aliases real tools use (data, payload,
+    # input, ...), which a closed list let slip past the memory scan.
+    for k in _CONTENT_KEY_PRIORITY:
+        v = by_norm.get(_norm_key(k))
         if isinstance(v, str) and v.strip():
             return v
     return None
 
 
+_SEMANTIC_MEMORY_WRITE_TOOLS = frozenset(
+    {"memory_store", "memory_save", "memory_write", "memory_set", "memory_update"}
+)
+
+
 def _classify_memory_write(
     tool_name: str, tool_args: Dict[str, Any]
 ) -> Optional[Dict[str, Any]]:
     """Return {key, value, source} if this writes to a memory-shaped path, else None."""
-    if tool_name.lower() not in _MEMORY_WRITE_TOOL_NAMES:
+    t = _normalize_tool_name(tool_name)
+    # N-2: semantic memory tools name no file at all — their key IS the
+    # memory slot, and the value must be judged/scanned like any write.
+    if t in _SEMANTIC_MEMORY_WRITE_TOOLS_N:
+        by_norm = _args_by_norm_key(tool_args)
+        key = by_norm.get(_norm_key("key"))
+        # The same content aliases file writes use (payload/data/input and
+        # cased spellings), not a narrower second list (reviewer follow-up).
+        value = next(
+            (
+                by_norm[_norm_key(k)]
+                for k in dict.fromkeys(
+                    ("value", "content", "text", "memory", *_CONTENT_KEY_PRIORITY)
+                )
+                if isinstance(by_norm.get(_norm_key(k)), str)
+            ),
+            None,
+        )
+        if isinstance(key, str) and key.strip() and value is not None:
+            return {"key": key.strip(), "value": value, "source": f"plugin:hermes:{tool_name}"}
+        return None
+    if t in _RENAME_TOOL_NAMES_N:
+        # A move lands at its destination: poison does not become clean by
+        # being written elsewhere first and renamed into memory (N-2).
+        destination = _pick_destination(tool_args)
+        # The content read must follow the SOURCE spelling; _pick_path
+        # alone returns the destination for {source, destination} calls
+        # and the wrong file (or nothing) would be scanned.
+        source = _pick_source(tool_args) or _pick_path(tool_args)
+        if not destination or not _matches_memory_path(destination):
+            return None
+        try:
+            value = Path(source).expanduser().read_text(encoding="utf-8", errors="replace") if source else ""
+        except Exception:
+            value = ""
+        return {"key": destination, "value": value, "source": f"plugin:hermes:{tool_name}"}
+    # Fuzz family d: memory routing uses the same write-class surface as
+    # the guard-state refusal (one normalised set plus operation semantics),
+    # not a narrower second list — save_file/apply_patch/fs_write/... were
+    # refused at guard paths but reached MEMORY.md unjudged-by-memory.
+    if t not in _WRITE_TOOL_NAMES_N and not _is_write_operation(tool_args):
         return None
     path = _pick_path(tool_args)
+    is_patch = t in _PATCH_TOOL_NAMES_N
+    bodies = _patch_bodies(tool_args) if is_patch else []
+    targets = _patch_header_targets(bodies)
+    # Patch tools name their real targets in the body headers; a patch of
+    # MEMORY.md with no (or a harmless) path argument must still reach the
+    # memory judge, and one that also lands elsewhere must still reach the
+    # regular judge for the rest.
+    other_targets = [x for x in targets if not _matches_memory_path(x)]
     if not path or not _matches_memory_path(path):
-        return None
+        memory_targets = [x for x in targets if _matches_memory_path(x)]
+        if not memory_targets:
+            return None
+        if path:
+            other_targets.append(path)
+        path = memory_targets[0]
     content = _pick_write_content(tool_name, tool_args)
-    if not content:
-        return None
-    return {"key": path, "value": content, "source": f"plugin:hermes:{tool_name}"}
+    if is_patch and bodies:
+        # The scanned value must include the patch that runs: a `content`
+        # decoy is picked ahead of the `input` body by the alias priority.
+        parts = [content] if content is not None else []
+        parts.extend(b for b in bodies if b not in parts)
+        content = "\n".join(parts)
+    entry_extra = {"judge_rest": True} if other_targets else {}
+    if content is None:
+        # N-7: truncating a memory file with an empty write is still a write.
+        # Honour the same content aliases the picker uses (`payload`, `data`,
+        # `input`, cased/padded names); only the exact `content` key used to
+        # be accepted, so empty alias writes skipped the memory scanner.
+        by_norm = _args_by_norm_key(tool_args)
+        empty = next(
+            (
+                by_norm[_norm_key(k)]
+                for k in _CONTENT_KEY_PRIORITY
+                if isinstance(by_norm.get(_norm_key(k)), str)
+            ),
+            None,
+        )
+        if empty is None:
+            # An edits array whose new text is empty truncates just the
+            # same; _pick_write_content skips empty parts, so look for the
+            # keys directly (reviewer follow-up).
+            edits = tool_args.get("edits")
+            if isinstance(edits, list):
+                parts = []
+                found = False
+                for e in edits:
+                    if isinstance(e, dict):
+                        e_by_norm = _args_by_norm_key(e)
+                        for k in ("newText", "new_string", "new_str", "newStr", "replacement"):
+                            vv = e_by_norm.get(_norm_key(k))
+                            if isinstance(vv, str):
+                                parts.append(vv)
+                                found = True
+                                break
+                if found:
+                    empty = "\n".join(parts)
+        if empty is None:
+            return None
+        content = empty
+    return {"key": path, "value": content, "source": f"plugin:hermes:{tool_name}", **entry_extra}
 
 
 def _classify_memory_read(tool_name: str, tool_args: Dict[str, Any]) -> bool:
     """Return True if this reads from a memory-shaped path."""
-    t = tool_name.lower()
-    if t in _MEMORY_READ_TOOL_NAMES:
+    t = _normalize_tool_name(tool_name)
+    if t in _MEMORY_READ_TOOL_NAMES_N:
         return True
-    if t in _GENERIC_READ_TOOL_NAMES:
+    if t in _GENERIC_READ_TOOL_NAMES_N:
         path = _pick_path(tool_args)
         return bool(path and _matches_memory_path(path))
     return False
@@ -340,11 +1229,87 @@ def _resolve_asset(token: str) -> str:
 _STATEMENT_SEP_RE = re.compile(r"[;&|<>$`\r\n]")
 
 def _flag_values(command: str, name: str) -> list:
+    # CLI spellings vary: case (`--Amount`), a single dash (`-amount`),
+    # `:`/`=` separators, a quote glued to the value, zero-width characters
+    # from pasted text. A flag this parser cannot see is an amount or a
+    # beneficiary the canonicalizer will swear was never given (fuzz c).
+    # Zero-width characters become separators: pasted text carries them
+    # exactly where the eye sees a space (`--amount<ZWSP>100`).
+    text = _ZERO_WIDTH_RE.sub(" ", command)
     return [
         value.strip("'\"")
-        for value in re.findall(rf"--{re.escape(name)}[= ]+(\S+)", command)
+        for value in re.findall(
+            rf"(?<![A-Za-z0-9_\-])--?{re.escape(name)}(?![A-Za-z0-9_\-])[\s=:\"']*([^\s;|&<>]+)",
+            text,
+            re.IGNORECASE,
+        )
     ]
 
+
+# Every flag that names who receives the value. The guard's own code judges
+# --spender as the beneficiary of an approval, so spender — and the other
+# beneficiary aliases real CLIs use — count for ambiguity exactly like
+# --to/--recipient do (fuzz family c).
+_RECIPIENT_FLAG_NAMES = (
+    "to", "recipient", "spender", "destination", "beneficiary", "payee", "target",
+)
+# Every flag that states how much moves, besides --max-usd (kept separate:
+# it caps rather than states the amount).
+_AMOUNT_FLAG_NAMES = (
+    "amount", "value", "quantity", "usd", "amount-usd", "amt", "sum", "total",
+)
+
+
+def _all_flag_values(command: str, names) -> list:
+    return [value for name in names for value in _flag_values(command, name)]
+
+
+def _first_flag_value(command: str, names) -> Optional[str]:
+    for name in names:
+        values = _flag_values(command, name)
+        if values:
+            return values[0]
+    return None
+
+
+def _noncanonical_flag_separator(command: str, names) -> bool:
+    """A financial flag written with a separator a CLI may not read —
+    `--amount:100`, `--amount"100`, `--amount<ZWSP>100`. _flag_values reads
+    the value anyway (so the amount is SEEN), but asserting it would claim
+    the executor read it too; many parsers treat the whole token as an
+    unknown flag instead. The reading is therefore withheld (fuzz c)."""
+    for name in names:
+        for match in re.finditer(
+            rf"(?<![A-Za-z0-9_\-])--?{re.escape(name)}(?![A-Za-z0-9_\-])([\s=:\"'\u200b-\u200d\ufeff]*)",
+            command,
+            re.IGNORECASE,
+        ):
+            if any(c not in " \t=" for c in match.group(1)):
+                return True
+    return False
+
+
+def _positional_amount(command: str) -> Optional[str]:
+    """A bare numeric token left after flags, addresses and separators are
+    removed: `transfer --to 0x... 999999` states an amount positionally,
+    and reporting amount=None next to an allowlisted recipient swears the
+    command named no amount at all (fuzz family c)."""
+    text = _ZERO_WIDTH_RE.sub(" ", command)
+    # Remove each flag together with its value on the RAW text (the value
+    # may be the address _flag_values would read); a value token starting
+    # with `-` is the next flag, never a value. Whatever number survives
+    # was stated positionally.
+    text = re.sub(
+        r"(?<![A-Za-z0-9_\-])--?[A-Za-z][A-Za-z0-9_\-]*(?:[\s=:\"']+[^\s;|&<>\-][^\s;|&<>]*)?",
+        " ",
+        text,
+    )
+    for token in text.split():
+        token = token.strip("'\"(),")
+        if _numeric_amount(token) is not None:
+            return token
+    return None
+
 def _numeric_amount(value: Optional[str]) -> Optional[str]:
     """Return ``value`` only if it is a plain ASCII decimal, else ``None``.
 
@@ -404,7 +1369,7 @@ def _strict_reading(
     True and none of these facts bound what actually runs — which is why they
     are named "…_named" and why nothing here may be read as permission.
     """
-    recipients = _flag_values(command, "to") + _flag_values(command, "recipient")
+    recipients = _all_flag_values(command, _RECIPIENT_FLAG_NAMES)
     lowered_recipients = {r.lower() for r in recipients}
     tokens = _flag_values(command, "token")
     addresses = [
@@ -414,7 +1379,7 @@ def _strict_reading(
     ]
     assets = sorted({_resolve_asset(t) for t in tokens + addresses}) or ["ETH"]
 
-    raw_amounts = _flag_values(command, "amount") + _flag_values(command, "max-usd")
+    raw_amounts = _all_flag_values(command, _AMOUNT_FLAG_NAMES) + _flag_values(command, "max-usd")
     parsed = [_numeric_amount(v) for v in raw_amounts]
     if any(p is None for p in parsed):
         max_amount: Optional[str] = "unparsable"
@@ -438,16 +1403,29 @@ def _assert_sdk_capabilities(
     atbash_class: Any,
     tool_call_input_class: Any,
 ) -> None:
-    guard_api_version = getattr(sdk, "GUARD_API_VERSION", 0)
-    if not isinstance(guard_api_version, int) or guard_api_version < 1:
+    # Real SDK contract (verified against shipped PyPI artifacts: installed
+    # 0.7.1.dev0 and the 0.10.0 wheel export no GUARD_API_VERSION; the
+    # in-repo SDK source tree declares one internally, which is tolerated).
+    # Demanding the export bricked the guard on every shipped install, so
+    # what the guard actually relies on is checked instead: the exact
+    # from_config parameters it passes, audit_tool_call, judge_action, and
+    # ToolCallInput(resolved). A GUARD_API_VERSION that IS present but
+    # below 1 is still refused — an explicit old marker is evidence of an
+    # old SDK, not a missing optional attribute.
+    guard_api_version = getattr(sdk, "GUARD_API_VERSION", None)
+    if guard_api_version is not None and (
+        not isinstance(guard_api_version, int) or guard_api_version < 1
+    ):
         raise RuntimeError(
-            "atbash-sdk does not expose hardened guard API version 1; "
-            "install atbash-sdk==0.2.0"
+            "atbash-sdk exposes a guard API version below 1; "
+            "install atbash-sdk>=0.12.0.dev0,<1.0.0"
         )
     if not callable(getattr(atbash_class, "from_config", None)):
         raise RuntimeError("atbash-sdk is missing Atbash.from_config")
     if not callable(getattr(atbash_class, "audit_tool_call", None)):
         raise RuntimeError("atbash-sdk is missing Atbash.audit_tool_call")
+    if not callable(getattr(atbash_class, "judge_action", None)):
+        raise RuntimeError("atbash-sdk is missing Atbash.judge_action")
     try:
         from_config_parameters = inspect.signature(
             atbash_class.from_config
@@ -455,7 +1433,7 @@ def _assert_sdk_capabilities(
         parameters = inspect.signature(tool_call_input_class).parameters
     except (TypeError, ValueError) as error:
         raise RuntimeError("cannot inspect atbash-sdk guard APIs") from error
-    for required_parameter in ("judge", "org_name", "fail_closed"):
+    for required_parameter in ("judge", "org_name", "fail_closed", "agent_key", "key_path", "timeout"):
         if required_parameter not in from_config_parameters:
             raise RuntimeError(
                 "atbash-sdk Atbash.from_config is missing "
@@ -490,13 +1468,17 @@ def _canonicalize_financial(command: str, recipient_allowlist: set) -> Optional[
     # CLI parsers are last-flag-wins and a shell runs every `;`-separated
     # statement. When the text can mean more than one thing, say so instead of
     # picking a reading and asserting it.
-    repeated_recipient = len(_flag_values(command, "to")) + len(
-        _flag_values(command, "recipient")
-    ) > 1
+    # Fuzz family c: EVERY beneficiary alias counts here, not only
+    # --to/--recipient — `approve --to <allowlisted> --spender <other>`
+    # asserted a clean allowlisted reading while the approval's actual
+    # beneficiary was the second address.
+    recipient_values = _all_flag_values(command, _RECIPIENT_FLAG_NAMES)
+    repeated_recipient = len(recipient_values) > 1
+    amount_values = _all_flag_values(command, _AMOUNT_FLAG_NAMES)
     repeated_flag = any(
         len(_flag_values(command, name)) > 1
-        for name in ("token", "amount", "max-usd")
-    )
+        for name in ("token", "max-usd")
+    ) or len(amount_values) > 1
     multi_statement = bool(_STATEMENT_SEP_RE.search(command))
 
     # "absent" and "present but unparsable" must not collapse to the same
@@ -505,15 +1487,32 @@ def _canonicalize_financial(command: str, recipient_allowlist: set) -> Optional[
     # "allowlisted recipient, no amount stated" for a command that names a very
     # large one — which is exactly what an "allow allowlisted USDT under N"
     # policy would let through.
-    raw_amount = _flag("amount")
+    raw_amount = _first_flag_value(command, _AMOUNT_FLAG_NAMES)
     raw_max_usd = _flag("max-usd")
     amount = _numeric_amount(raw_amount)
     max_usd = _numeric_amount(raw_max_usd)
-    amount_unparsed = (raw_amount is not None and amount is None) or (
+    amount_unparsed = any(_numeric_amount(v) is None for v in amount_values) or (
         raw_max_usd is not None and max_usd is None
     )
+    positional_amount = _positional_amount(command)
+    noncanonical_separator = _noncanonical_flag_separator(
+        command, _RECIPIENT_FLAG_NAMES + _AMOUNT_FLAG_NAMES + ("max-usd", "token")
+    )
+
+    # --spender is the beneficiary of an approval, judged like a recipient;
+    # the beneficiary aliases share one priority order.
+    to = _first_flag_value(command, _RECIPIENT_FLAG_NAMES)
 
-    if repeated_recipient or repeated_flag or multi_statement or amount_unparsed:
+    # N-4: two or more distinct non-recipient addresses with no --token
+    # flag means the asset is whichever the executor picks — not the first.
+    _distinct_candidates = {
+        a.lower()
+        for a in _ERC20_RE.findall(command)
+        if not to or a.lower() != to.lower()
+    }
+    multiple_token_candidates = not _flag("token") and len(_distinct_candidates) > 1
+
+    if repeated_recipient or repeated_flag or multi_statement or amount_unparsed or multiple_token_candidates or positional_amount is not None or noncanonical_separator:
         return {
             "operation": op,
             "asset": "ambiguous",
@@ -527,6 +1526,10 @@ def _canonicalize_financial(command: str, recipient_allowlist: set) -> Optional[
                 if multi_statement
                 else "repeated flag"
                 if (repeated_recipient or repeated_flag)
+                else "amount stated as a bare positional value, not a flag"
+                if positional_amount is not None
+                else "flag written with a separator a CLI may not read"
+                if noncanonical_separator
                 else "amount is not a plain decimal number"
             ),
             # Conservative facts, so an asset-specific rule is still reachable.
@@ -543,7 +1546,6 @@ def _canonicalize_financial(command: str, recipient_allowlist: set) -> Optional[
             ),
         }
 
-    to = _flag("to") or _flag("recipient")
     token = _flag("token")
     if not token:
         # Only an address that is not the recipient can be the token contract.
@@ -581,19 +1583,191 @@ def _canonicalize_financial(command: str, recipient_allowlist: set) -> Optional[
     }
 
 
+def _has_financial_signal(value: Any) -> bool:
+    """Same gate as the command-path canonicalizer: a transfer/send/swap/
+    approve/erc20 word or a 0x address. Beneficiary aliases alone are
+    email/copy/settings fields, not a transfer."""
+    if isinstance(value, str):
+        return bool(_FINANCIAL_OP_RE.search(value) or _ERC20_RE.search(value))
+    if isinstance(value, dict):
+        return any(_has_financial_signal(v) for v in value.values())
+    if isinstance(value, (list, tuple)):
+        return any(_has_financial_signal(v) for v in value)
+    return False
+
+
+def _canonicalize_financial_args(
+    tool_args: Dict[str, Any], recipient_allowlist: set
+) -> Optional[Dict[str, Any]]:
+    """Canonicalize a structured (non-command) financial tool call (N-4):
+    wallet-shaped tools carry to/amount/token as fields, not a command.
+
+    Fuzz family c: picking the FIRST of to/recipient/spender/destination
+    and ignoring the rest asserted allowlisted for whichever beneficiary
+    the executor would pick, and a non-scalar amount (list/dict) was
+    silently dropped into amount=None. Every beneficiary alias is read,
+    distinct values are ambiguous, and an amount that is present but not
+    a plain scalar is unparsed — never absent.
+    """
+    if not isinstance(tool_args, dict):
+        return None
+    # Command-path canonicalization only fires on transfer/send/swap/
+    # approve/erc20 text or a 0x address. Without that gate, a send_email
+    # `to` or a copy `destination` becomes operation: transfer.
+    if not _has_financial_signal(tool_args):
+        return None
+    beneficiaries: list = []
+    amounts: list = []
+    tokens: list = []
+    amount_unparsed = False
+    structure_unparsed = False
+    for k, v in tool_args.items():
+        nk = _norm_key(k)
+        if nk in _BENEFICIARY_ARG_KEYS_N or nk in _TOKEN_ARG_KEYS_N:
+            # A list value names every element (a batch transfer); a
+            # non-scalar the canonicalizer cannot read is unparsed, never
+            # silently absent — the same rule amounts already follow.
+            target = beneficiaries if nk in _BENEFICIARY_ARG_KEYS_N else tokens
+            if isinstance(v, str) and v:
+                target.append(v)
+            elif isinstance(v, (list, tuple)):
+                for item in v:
+                    if isinstance(item, str) and item:
+                        target.append(item)
+                    else:
+                        structure_unparsed = True
+            elif v is not None:
+                structure_unparsed = True
+        elif nk in _AMOUNT_ARG_KEYS_N:
+            if isinstance(v, (str, int, float)) and not isinstance(v, bool):
+                amounts.append(str(v))
+            else:
+                # Present but not a plain scalar (list/dict/bool/None):
+                # an amount the canonicalizer cannot read is unparsed,
+                # never silently absent (fuzz family c).
+                amount_unparsed = True
+    if not beneficiaries and not amounts and not tokens and not amount_unparsed and not structure_unparsed:
+        return None
+    to = beneficiaries[0] if beneficiaries else None
+    token = tokens[0] if tokens else None
+    raw_amount = amounts[0] if amounts else None
+    amount = _numeric_amount(raw_amount) if raw_amount is not None else None
+    if raw_amount is not None and amount is None:
+        amount_unparsed = True
+    ambiguous = (
+        amount_unparsed
+        or structure_unparsed
+        or len({b.lower() for b in beneficiaries}) > 1
+        or len(set(amounts)) > 1
+        or len({t.lower() for t in tokens}) > 1
+    )
+    if ambiguous:
+        # Same rule as the command path: a contested reading must not assert
+        # the first asset/amount. The judge rules on this block, and the SDK
+        # redacts raw addresses, so a leftover USDT amount still looks clean.
+        # strict_reading keeps the conservative facts (every asset named,
+        # the largest amount, whether EVERY beneficiary is allowlisted) so
+        # asset-specific deny rules stay reachable, as on the command path.
+        parsed_amounts = [a for a in amounts if _numeric_amount(a) is not None]
+        return {
+            "operation": "transfer",
+            "asset": "ambiguous",
+            "amount": None,
+            "max_usd": None,
+            "recipient_status": "ambiguous",
+            "ambiguous": True,
+            "amount_unparsed": amount_unparsed,
+            "strict_reading": {
+                "assets_named": sorted({_resolve_asset(t) for t in tokens}),
+                "assets_named_raw": sorted({t for t in tokens}),
+                "max_amount_named": (
+                    max(parsed_amounts, key=lambda v: float(v))
+                    if parsed_amounts
+                    else ("unparsable" if amounts or amount_unparsed else None)
+                ),
+                "recipients_named": len(beneficiaries),
+                "all_named_recipients_allowlisted": bool(beneficiaries)
+                and all(b.lower() in recipient_allowlist for b in beneficiaries),
+                "may_hide_other_actions": False,
+            },
+            "allowlist_scope": "USDT transfers/approvals only; never lifts ETH or ATBASH rules",
+            "note": (
+                "canonicalization withheld: the arguments carry more than one "
+                "beneficiary, amount, or token, or an unreadable amount, so no "
+                "asset/amount/recipient claim here can be trusted"
+            ),
+        }
+    asset = _resolve_asset(token or "")
+    on_allow = bool(to) and to.lower() in recipient_allowlist
+    if asset == "USDT":
+        recipient_status = "allowlisted" if on_allow else ("external-not-allowlisted" if to else "unspecified")
+    else:
+        recipient_status = "external" if to else "unspecified"
+    return {
+        "operation": "transfer",
+        "asset": asset,
+        "amount": amount,
+        "max_usd": None,
+        "recipient_status": recipient_status,
+        "ambiguous": False,
+        "amount_unparsed": amount_unparsed,
+        "allowlist_scope": "USDT transfers/approvals only; never lifts ETH or ATBASH rules",
+        "note": "canonicalized from structured tool arguments",
+    }
+
+
+_BENEFICIARY_ARG_KEYS_N = frozenset(
+    {"to", "recipient", "spender", "destination", "beneficiary", "payee", "target"}
+)
+_AMOUNT_ARG_KEYS_N = frozenset(
+    {"amount", "value", "quantity", "usd", "amountusd", "amt", "sum", "total", "maxusd"}
+)
+_TOKEN_ARG_KEYS_N = frozenset({"token", "asset", "currency"})
+
+
 def _extract_command(tool_name: str, tool_args: Dict[str, Any]) -> str:
     if not isinstance(tool_args, dict):
         return ""
+    by_norm = _args_by_norm_key(tool_args)
     for key in ("command", "cmd", "shell_command", "bash_command", "zsh_command", "script"):
-        v = tool_args.get(key)
+        v = by_norm.get(_norm_key(key))
         if isinstance(v, str) and v.strip():
             return v.strip()
-    # Hermes terminal/shell tools sometimes nest payloads
+        # N-3: an argv list is a command too — joining it is what the
+        # executor effectively runs.
+        if isinstance(v, (list, tuple)) and v and all(isinstance(x, str) for x in v):
+            return " ".join(v)
+    # Hermes terminal/shell tools sometimes nest payloads. Those same keys
+    # are write-content aliases (`payload`/`input` for a file body), so a
+    # write-class tool's document must not be treated as a shell command —
+    # plain writes are judged on their path, and the body may mention guard
+    # files.
+    t = _normalize_tool_name(tool_name)
+    # Name-based only: operation/method/action are attacker-controlled
+    # classification inputs, so a shell tool must not be able to silence
+    # command extraction by claiming operation="write" (its payload is then
+    # judged as a command, as before). Generic operation-tools keep the
+    # fail-closed treatment; the judge still sees their full arguments.
+    write_class = t in _WRITE_TOOL_NAMES_N or t in _RENAME_TOOL_NAMES_N
+    # Structural evidence this really is a file write: a picked target
+    # path. A write-named tool with no target (script-runners, edit-and-run
+    # tools) keeps the fail-closed command treatment for its payload, and
+    # dict-nested bodies follow the same rule as string bodies.
+    skip_body = write_class and bool(
+        _pick_path(tool_args) or _pick_destination(tool_args)
+    )
     for key in ("input", "args", "payload"):
-        v = tool_args.get(key)
+        v = by_norm.get(_norm_key(key))
+        if isinstance(v, str) and v.strip():
+            if skip_body:
+                continue
+            return v.strip()
         if isinstance(v, dict):
-            for k in ("command", "cmd"):
-                vv = v.get(k)
+            if skip_body:
+                continue
+            nested = _args_by_norm_key(v)
+            for k in ("command", "cmd", "script"):
+                vv = nested.get(_norm_key(k))
                 if isinstance(vv, str) and vv.strip():
                     return vv.strip()
     return ""
@@ -689,6 +1863,76 @@ def _extract_allow(raw: Any) -> Optional[bool]:
     return None
 
 
+def _extract_action_type(raw: Any) -> str:
+    """Read the SDK JudgeResult `action_type` (judge_action has no `allow`)."""
+    action_attr = getattr(raw, "action_type", None)
+    if isinstance(action_attr, str):
+        return action_attr.strip().lower()
+    if isinstance(raw, dict):
+        v = raw.get("action_type")
+        if isinstance(v, str):
+            return v.strip().lower()
+    return ""
+
+
+def _prospective_memory_content(
+    tool_name: str, tool_args: Dict[str, Any], path: str, new_content: str
+) -> Optional[str]:
+    """The file's content AFTER this write, if it can be known before it runs.
+
+    A full write's content is the file. An edit's `new_string` is only a
+    fragment (N-HERMES-02): baselining the fragment makes the very next read
+    of the real file look tampered. For a plain old->new replacement the
+    prospective content is computable from the file on disk; anything else
+    returns None and the caller must not advance the baseline at all.
+    """
+    t = _normalize_tool_name(tool_name)
+    if t in _PATCH_TOOL_NAMES_N:
+        # A patch body is not the file's content; what lands on disk cannot
+        # be computed here, so nothing may be baselined (the same rule as
+        # an unresolvable edit fragment, N-HERMES-02).
+        return None
+    if t in _APPEND_TOOL_NAMES_N:
+        try:
+            current = Path(path).expanduser().read_text(encoding="utf-8", errors="replace")
+        except FileNotFoundError:
+            return new_content
+        except Exception:
+            return None
+        return current + new_content
+    if t not in _EDIT_TOOL_NAMES_N:
+        return new_content
+    try:
+        current = Path(path).expanduser().read_text(encoding="utf-8", errors="replace")
+    except Exception:
+        return None
+    pairs = []
+    edits = tool_args.get("edits")
+    if isinstance(edits, list) and edits:
+        for e in edits:
+            if not isinstance(e, dict):
+                return None
+            old = next((e[k] for k in ("old_string", "oldText", "old_text", "old_str") if isinstance(e.get(k), str) and e[k]), None)
+            new = next((e[k] for k in ("new_string", "newText", "new_text", "newStr", "replacement") if isinstance(e.get(k), str)), None)
+            if old is None or new is None:
+                return None
+            pairs.append((old, new))
+    else:
+        old = next((tool_args[k] for k in ("old_string", "oldText", "old_text", "old_str") if isinstance(tool_args.get(k), str) and tool_args[k]), None)
+        if old is None:
+            return None
+        pairs.append((old, new_content))
+    result = current
+    for old, new in pairs:
+        # An old string occurring more than once is ambiguous: real edit
+        # tools may replace every occurrence, so which result lands on disk
+        # cannot be known here (N-9) — baseline nothing rather than guess.
+        if result.count(old) != 1:
+            return None
+        result = result.replace(old, new, 1)
+    return result
+
+
 def _extract_status(raw: Any) -> str:
     """Read the judge's server-reported `status`, lower-cased ("" when absent).
 
@@ -784,6 +2028,10 @@ def _setup_telemetry() -> None:
     exporter issues must never prevent the guard from registering.
     """
     global _TELEMETRY_SHUTDOWN_REGISTERED
+    # C-HERMES-17: telemetry stays on by default but has an explicit opt-out.
+    if not _as_bool(os.getenv("ATBASH_TELEMETRY"), True):
+        logger.debug("Atbash telemetry disabled via ATBASH_TELEMETRY")
+        return
     try:
         from atbash.opentel import setup_telemetry, shutdown_telemetry  # type: ignore
 
@@ -814,15 +2062,12 @@ class AtbashHermesGuard:
         self.tool_map = {**DEFAULT_TOOL_CLASS_MAP, **_load_tool_map(self.tool_map_path)}
         self.recipient_allowlist = _load_recipient_allowlist()
         self._snapshots: Dict[str, str] = {}  # file_path → last-known-good content (in-process)
-        hash_store_path = Path(
-            os.getenv(
-                "ATBASH_MEMORY_HASH_PATH",
-                str(_default_tool_map_path().parent / "hermes-memory-hashes.json"),
-            )
-        ).expanduser()
-        self._hash_store = _MemoryHashStore(hash_store_path)
+        self._hash_store = _MemoryHashStore(_memory_hash_store_path())
 
         self.client = self._build_client()
+        # H-6: the boot probe exists to catch between-session tampering at
+        # startup; it was defined but never called.
+        self._run_boot_probe()
 
     def _action_class(self, tool_name: str) -> str:
         mapped = self.tool_map.get(tool_name)
@@ -830,8 +2075,20 @@ class AtbashHermesGuard:
             return mapped
 
         action_class = _infer_action_class(tool_name)
-        self.tool_map[tool_name or "unknown"] = action_class
-        _save_tool_map(self.tool_map_path, self.tool_map)
+        # C-HERMES-13: serialise the learn+persist side effect and cap the
+        # learned map, so concurrent hook threads cannot corrupt the file
+        # or grow it without bound.
+        with _TOOL_MAP_LOCK:
+            self.tool_map[tool_name or "unknown"] = action_class
+            if len(self.tool_map) > _TOOL_MAP_MAX_ENTRIES + len(DEFAULT_TOOL_CLASS_MAP):
+                learned = [
+                    (k, v) for k, v in self.tool_map.items() if k not in DEFAULT_TOOL_CLASS_MAP
+                ]
+                self.tool_map = {
+                    **DEFAULT_TOOL_CLASS_MAP,
+                    **dict(learned[-_TOOL_MAP_MAX_ENTRIES:]),
+                }
+            _save_tool_map(self.tool_map_path, self.tool_map)
         logger.info(
             "Atbash learned tool mapping tool=%s action_class=%s path=%s",
             tool_name or "unknown",
@@ -842,39 +2099,41 @@ class AtbashHermesGuard:
 
     def _build_client(self):
         try:
+            import atbash as _sdk  # type: ignore
             from atbash import Atbash, ToolCallInput  # type: ignore
         except Exception as e:
             try:
                 from atbash import Atbash  # type: ignore
                 from atbash.types import ToolCallInput  # type: ignore
+
+                import atbash as _sdk  # type: ignore
             except Exception:
-                raise RuntimeError("atbash-sdk is required. Install with: pip install atbash-sdk==0.9.12.dev0") from e
+                raise RuntimeError(
+                    "atbash-sdk is required. Install with: "
+                    "pip install 'atbash-sdk>=0.12.0.dev0,<1.0.0'"
+                ) from e
+
+        # H-5: the capability check was defined but never called, so an SDK
+        # missing the guard surface failed later (or silently) at judge time.
+        _assert_sdk_capabilities(_sdk, Atbash, ToolCallInput)
 
         self.ToolCallInput = ToolCallInput
         judge_cfg = self._judge_config()
 
-        # Prefer explicit key material if provided.
+        # Prefer explicit key material if provided. H-4: no TypeError
+        # fallback — catching TypeError here also caught unrelated SDK
+        # internals and rebuilt the client WITHOUT the judge config
+        # (endpoint policy / verify pubkey), silently changing which judge
+        # was trusted. A construction failure now fails guard init, which
+        # register() turns into a fail-closed hook.
         if self.privkey:
-            try:
-                return Atbash.from_config(
-                    agent_key=self.privkey,
-                    judge=judge_cfg,
-                    org_name=self.org_name,
-                    fail_closed=self.fail_closed,
-                    **({} if self.judge_timeout is None else {"timeout": self.judge_timeout}),
-                )
-            except TypeError:
-                kwargs: Dict[str, Any] = {
-                    "org_name": self.org_name,
-                    "fail_closed": self.fail_closed,
-                }
-                if self.endpoint:
-                    kwargs["endpoint"] = self.endpoint
-                if self.judge_verify_pubkey:
-                    kwargs["verify_pubkey"] = self.judge_verify_pubkey
-                if self.judge_timeout is not None:
-                    kwargs["timeout"] = self.judge_timeout
-                return Atbash(self.privkey, **kwargs)
+            return Atbash.from_config(
+                agent_key=self.privkey,
+                judge=judge_cfg,
+                org_name=self.org_name,
+                fail_closed=self.fail_closed,
+                **({} if self.judge_timeout is None else {"timeout": self.judge_timeout}),
+            )
 
         # Use SDK-native config loader for key file/env/config.
         return Atbash.from_config(
@@ -888,11 +2147,23 @@ class AtbashHermesGuard:
     def _judge_config(self) -> Optional[Dict[str, str]]:
         if not self.endpoint:
             return None
-        if self.judge_endpoint_policy == "self-hosted":
+        # H-7 (SDK semantics, atbash-sdk endpoint.py): verify_pubkey only
+        # has meaning under the self-hosted policy, and setting it selects
+        # that policy. Dropping a configured pubkey, or sending an empty
+        # one, silently changed/disabled response-signature verification.
+        policy = self.judge_endpoint_policy
+        if policy is None and self.judge_verify_pubkey:
+            policy = "self-hosted"
+        if policy == "self-hosted":
+            if not self.judge_verify_pubkey:
+                raise RuntimeError(
+                    "ATBASH_JUDGE_ENDPOINT_POLICY=self-hosted requires "
+                    "ATBASH_JUDGE_VERIFY_PUBKEY (66-hex judge response-signing key)"
+                )
             return {
                 "policy": "self-hosted",
                 "endpoint": self.endpoint,
-                "verify_pubkey": self.judge_verify_pubkey or "",
+                "verify_pubkey": self.judge_verify_pubkey,
             }
         return {
             "policy": "default",
@@ -938,7 +2209,12 @@ class AtbashHermesGuard:
             "args": tool_args or {},
         }
 
+        # N-11: re-read the recipient allowlist per call — a revocation must
+        # not keep canonicalizing as "allowlisted" until the next restart.
+        self.recipient_allowlist = _load_recipient_allowlist()
         resolved = _canonicalize_financial(command, self.recipient_allowlist)
+        if resolved is None:
+            resolved = _canonicalize_financial_args(tool_args, self.recipient_allowlist)
         tci = self.ToolCallInput(
             tool_name=tool_name or "unknown",
             args=action_payload,
@@ -1007,6 +2283,19 @@ class AtbashHermesGuard:
             logger.debug("Atbash memory diff skipped err=%s", e)
         return None
 
+    def _advance_baseline(self, path: str, content: str) -> None:
+        """Record `content` as the trusted baseline under every spelling of
+        the path (raw + canonical), so a respelled read still hits it (H-9)."""
+        self._snapshots[path] = content
+        canonical = _memory_key(path)
+        if canonical != path:
+            self._snapshots[canonical] = content
+        # N-11: the in-process snapshot cache is bounded; oldest entries go
+        # first (the persistent hash baseline still protects those files).
+        while len(self._snapshots) > 512:
+            self._snapshots.pop(next(iter(self._snapshots)))
+        self._hash_store.set(path, _sha256_hex(content))
+
     def _handle_memory_write(
         self,
         tool_name: str,
@@ -1020,9 +2309,21 @@ class AtbashHermesGuard:
         """Gate a memory write: local diff → judge with memory context → update snapshot."""
         path = mem_entry["key"]
         new_content = mem_entry["value"]
+        # What the file will contain after the tool runs (None when an edit
+        # fragment cannot be resolved — then nothing may be baselined).
+        baseline_content = _prospective_memory_content(
+            tool_name, tool_args, path, new_content
+        )
 
-        # Step 1: local anomaly check against cached baseline.
-        anomaly = self._diff_memory(path, self._snapshots.get(path), new_content)
+        # Step 1: local anomaly check against cached baseline. Diff the
+        # prospective full file, not an edit fragment — snapshots hold the
+        # whole file (N-HERMES-02), so comparing them to `new_string` looks
+        # like a wipe on the next allowed edit.
+        cached = self._snapshots.get(_memory_key(path), self._snapshots.get(path))
+        if baseline_content is not None:
+            anomaly = self._diff_memory(path, cached, baseline_content)
+        else:
+            anomaly = None
         if anomaly:
             logger.warning("Atbash memory write anomaly path=%s desc=%s", path, anomaly)
             if self.fail_closed:
@@ -1042,11 +2343,26 @@ class AtbashHermesGuard:
             # Redact embedded secrets before sending to the judge — mirrors SDK's
             # scanMemory → redactSecrets → judgeAction path to prevent secrets inside
             # memory content from being signed and posted to chain.
+            if not _REDACT_AVAILABLE:
+                # N-8: unredacted memory content must never be signed and
+                # posted — a broken/partial SDK is a block, not a silent send.
+                logger.warning("Atbash memory write redaction unavailable")
+                if self.fail_closed:
+                    return {
+                        "action": "block",
+                        "message": "Memory write blocked (secret redaction unavailable).",
+                    }
+                return None
             try:
-                from atbash_core import redact_secrets  # type: ignore
-                formatted = redact_secrets(formatted).redacted
+                formatted = _redact_secrets(formatted).redacted  # type: ignore
             except Exception as _re:
-                logger.debug("Atbash memory write redact skipped err=%s", _re)
+                logger.warning("Atbash memory write redaction failed err=%s", _re)
+                if self.fail_closed:
+                    return {
+                        "action": "block",
+                        "message": "Memory write blocked (secret redaction unavailable).",
+                    }
+                return None
 
             verdict_raw = self.client.judge_action(
                 formatted,
@@ -1056,7 +2372,7 @@ class AtbashHermesGuard:
             )
             verdict = _normalize_verdict(verdict_raw)
             reason = _extract_reason(verdict_raw)
-            _, clean_reason = _parse_score_from_reason(reason)
+            score, clean_reason = _parse_score_from_reason(reason)
 
             if self.debug:
                 logger.info(
@@ -1098,9 +2414,12 @@ class AtbashHermesGuard:
                 # judge is least trustworthy AND make it the new tamper
                 # baseline. Same rule as the SDK's audit_tool_call.
                 status = _extract_status(verdict_raw)
-                if status == "logged":
-                    self._snapshots[path] = new_content
-                    self._hash_store.set(path, _sha256_hex(new_content))
+                if status == "logged" and _as_bool(os.getenv("ATBASH_ALLOW_AUDIT_TIER"), False):
+                    # Monitor-only (audit tier) deployments opt in explicitly;
+                    # otherwise an unjudged "logged" answer neither passes nor
+                    # becomes a trusted baseline (Atbash decision 2026-09-30).
+                    if baseline_content is not None:
+                        self._advance_baseline(path, baseline_content)
                     return None
                 logger.warning(
                     "Atbash memory write no verdict without audit marker path=%s status=%s reason=%s",
@@ -1122,15 +2441,36 @@ class AtbashHermesGuard:
                 if self.fail_closed:
                     return {
                         "action": "block",
-                        "message": f"Memory write blocked (Atbash error): {reason}",
+                        # Judge error bodies are not echoed to the model.
+                        "message": "Memory write blocked (Atbash error).",
                     }
                 # fail-open: allow but do NOT advance baseline — content was not scanned.
                 return None
 
+            # H-10: judge_action returns JudgeResult (no `allow` field; its
+            # vouch is action_type == "allow"); audit-style replies vouch via
+            # allow is True. A bare ALLOW carrying neither is not permission.
+            # N-5: a judge that says ALLOW in one field and "actively
+            # poisonous" (SCORE 1-4) in its own reason contradicts itself —
+            # that reply is not permission and baselines nothing.
+            if verdict == "ALLOW" and score is not None and score <= 4:
+                logger.warning(
+                    "Atbash memory write ALLOW contradicted by score path=%s score=%s", path, score
+                )
+                if self.fail_closed:
+                    return {
+                        "action": "block",
+                        "message": "Memory write blocked (judge verdict contradicted by its score).",
+                    }
+                return None
+
             allow_flag = _extract_allow(verdict_raw)
-            if verdict == "ALLOW" and allow_flag is not False:
-                self._snapshots[path] = new_content
-                self._hash_store.set(path, _sha256_hex(new_content))
+            if verdict == "ALLOW" and (
+                allow_flag is True
+                or (allow_flag is None and _extract_action_type(verdict_raw) == "allow")
+            ):
+                if baseline_content is not None:
+                    self._advance_baseline(path, baseline_content)
                 return None
 
             logger.warning(
@@ -1153,7 +2493,8 @@ class AtbashHermesGuard:
             if self.fail_closed:
                 return {
                     "action": "block",
-                    "message": f"Memory write blocked (Atbash unavailable): {e}",
+                    # Exception text (endpoints, tokens) stays in the log only.
+                    "message": "Memory write blocked (Atbash unavailable).",
                 }
             return None
 
@@ -1173,7 +2514,14 @@ class AtbashHermesGuard:
         except FileNotFoundError:
             return None  # File doesn't exist — allow
         except Exception as e:
-            logger.debug("Atbash memory read file error path=%s err=%s", path, e)
+            # H-8: an unreadable memory path (a directory, a permission
+            # error) is not a clean read. Fail-closed means it does not pass.
+            logger.warning("Atbash memory read file error path=%s err=%s", path, e)
+            if self.fail_closed:
+                return {
+                    "action": "block",
+                    "message": "Memory read blocked (memory path could not be read).",
+                }
             return None
 
         # ── Cross-session integrity check (persistent hash) ───────────────────
@@ -1181,7 +2529,31 @@ class AtbashHermesGuard:
         # cannot detect.  Mirrors the role of openclaw's PointerStore: openclaw
         # catches drift via chain; hermes catches it via a persisted SHA-256.
         stored_hash = self._hash_store.get(path)
-        if stored_hash is not None:
+        if stored_hash is None:
+            # No persisted baseline means the guard has never seen this file.
+            # A memory file dropped between sessions by an attacker is
+            # untrusted, not trusted — in enforce mode it does not reach the
+            # agent; in monitor mode it is logged and the in-process drift
+            # check below still applies.
+            logger.warning(
+                "Atbash memory read has no trusted baseline path=%s — treating as untrusted",
+                path,
+            )
+            if self.fail_closed:
+                # Untrusted until a person trusts it. Nothing is sent to the
+                # judge on a read: that would ship pre-existing private files
+                # off the machine and let a poisoned file be re-read until a
+                # judge said yes. A judged write through the guard, or a human
+                # seed, records the baseline.
+                return {
+                    "action": "block",
+                    "message": (
+                        "Memory read blocked: this file has no trusted baseline. A person must "
+                        "review and trust it outside the agent - see 'Guard Self-Protection And "
+                        "Memory Baselines' in the Atbash Hermes plugin README."
+                    ),
+                }
+        else:
             current_hash = _sha256_hex(current)
             if current_hash != stored_hash:
                 logger.warning(
@@ -1199,7 +2571,7 @@ class AtbashHermesGuard:
                     }
 
         # ── Within-session drift check (in-process snapshot) ──────────────────
-        cached = self._snapshots.get(path)
+        cached = self._snapshots.get(_memory_key(path), self._snapshots.get(path))
         if cached is None:
             return None  # No in-process baseline yet — allow
 
@@ -1213,6 +2585,117 @@ class AtbashHermesGuard:
                 }
         return None
 
+    def _refuse_guard_state_write(
+        self, tool_name: str, tool_args: Dict[str, Any]
+    ) -> Optional[Dict[str, Any]]:
+        """Refuse writes aimed at the guard's own state, before any judging.
+
+        Tool map, recipient allowlist, persisted memory-hash baseline and the
+        agent key are the checks' foundation; letting a tool call rewrite them
+        silently disarms the guard. The refusal is unconditional — it is a
+        policy refusal, not a judge verdict, so monitor mode does not soften it.
+        """
+        t = _normalize_tool_name(tool_name)
+        if _invokes_seeder(tool_args):
+            logger.warning("Atbash refused an agent call to the baseline seeder tool=%s", tool_name)
+            return {
+                "action": "block",
+                "message": (
+                    "Refused: trusting a memory file (seeding its baseline) is a human "
+                    "step - run it yourself, outside the agent"
+                ),
+            }
+        extra = []
+        for attr in ("tool_map_path", "key_path"):
+            v = getattr(self, attr, None)
+            if v:
+                extra.append(Path(str(v)).expanduser())
+        key_path = getattr(self, "key_path", None)
+        if key_path:
+            # The key's directory too, when it is a dedicated Atbash directory
+            # (the README's Docker setup keeps it in /opt/data/atbash). A key
+            # kept in a general directory (the home folder) protects only the
+            # key file itself, or every write there would be refused.
+            key_dir = Path(str(key_path)).expanduser().parent
+            project_markers = (".git", "package.json", "pyproject.toml", "setup.py", "Cargo.toml", "go.mod")
+            is_project = any((key_dir / m).exists() for m in project_markers)
+            if "atbash" in key_dir.name.lower() and not is_project:
+                extra.append(key_dir)
+        store = getattr(self, "_hash_store", None)
+        store_path = getattr(store, "_path", None)
+        if store_path:
+            extra.append(Path(str(store_path)).expanduser())
+
+        def _refusal(hit: str) -> Dict[str, Any]:
+            logger.warning("Atbash refused write to guard state tool=%s path=%s", tool_name, hit)
+            return {
+                "action": "block",
+                "message": (
+                    "Refused: writes to the Atbash guard's own state (configuration, "
+                    "allowlist, hash baseline, agent key, and Hermes's .env, config.yaml "
+                    "and SOUL.md) are not permitted. To change one of these, edit the "
+                    "file yourself, outside the agent"
+                ),
+            }
+
+        # N-1: a shell/terminal command that names guard state is a guard-
+        # state write attempt whatever the tool is called — `terminal` was
+        # mapped to command_execution and skipped this refusal entirely.
+        command = _extract_command(tool_name, tool_args)
+        if command:
+            if _mentions_guard_state({"command": command}, extra):
+                return _refusal("<named in the command>")
+            # Fuzz family b: needle matching alone misses spellings only
+            # the OS resolves (admin shares, \\?\ prefixes, root-relative,
+            # dotted components) — test each path-like token by identity.
+            for token in _command_path_tokens(command):
+                if _is_guard_state_path(token, extra):
+                    return _refusal(token)
+
+        # N-2: classify by what the call DOES, not only its name — an
+        # operation-discriminated tool (operation/method/action = write…)
+        # and rename/move destinations are write-class too. Fuzz family d:
+        # the name is matched spelling-normalised against the same single
+        # write-class surface the memory router uses.
+        is_write_class = (
+            t in _WRITE_TOOL_NAMES_N
+            or t in _RENAME_TOOL_NAMES_N
+            or _is_write_operation(tool_args)
+            or getattr(self, "tool_map", {}).get(tool_name) == "filesystem_write"
+        )
+        if not is_write_class:
+            return None
+        path = _pick_path(tool_args)
+        # A rename/move lands at its destination — but moving a guard file
+        # AWAY disarms the guard at next start exactly as editing it would,
+        # so a true move is refused when either end is guard state. A copy
+        # only writes its destination; its source is a read.
+        if t in _RENAME_TOOL_NAMES_N:
+            destination = _pick_destination(tool_args)
+            if destination:
+                if t in _MOVE_TOOL_NAMES_N:
+                    # The source arrives either as the picked path or under
+                    # a source spelling _pick_path cannot see (it returns
+                    # the destination then); check every candidate that is
+                    # not the destination itself.
+                    for candidate in (_pick_source(tool_args), path):
+                        if (
+                            candidate
+                            and candidate != destination
+                            and _is_guard_state_path(candidate, extra)
+                        ):
+                            return _refusal(candidate)
+                path = destination
+        patch_shaped = t in _PATCH_TOOL_NAMES_N or not path
+        hit_path = bool(path) and _is_guard_state_path(path, extra)
+        # Patch-shaped tools carry their real targets in the body, so a harmless
+        # `path` next to a body that names guard state is still refused. Plain
+        # writes are judged on their path only (their content may mention it).
+        hit_body = patch_shaped and _mentions_guard_state(tool_args, extra)
+        if not (hit_path or hit_body):
+            return None
+        return _refusal(path if hit_path else "<named in the tool arguments>")
+
     def pre_tool_call(
         self,
         *,
@@ -1223,6 +2706,23 @@ class AtbashHermesGuard:
         tool_call_id: str = "",
         **hook_context: Any,
     ):
+        # H-3: normalise the host's call shape BEFORE any classification.
+        # The preamble below (guard-state refusal, memory routing) runs
+        # outside the judged try, so a non-dict `args` or a None/non-string
+        # `tool_name` used to raise AttributeError there — and Hermes
+        # isolates hook exceptions by running the tool unjudged.
+        if not isinstance(tool_name, str):
+            tool_name = ""
+        if args is not None and not isinstance(args, dict):
+            logger.warning(
+                "Atbash pre_tool_call got non-object args type=%s", type(args).__name__
+            )
+            if self.fail_closed:
+                return {
+                    "action": "block",
+                    "message": "Blocked (tool call arguments were not an object).",
+                }
+            return None
         if self.debug:
             logger.info(
                 "Atbash pre_tool_call enter tool=%s session_id=%s task_id=%s tool_call_id=%s extra_keys=%s",
@@ -1234,12 +2734,41 @@ class AtbashHermesGuard:
             )
         tool_args = args or {}
 
+        # N-3: two different destinations in one call means the guard and
+        # the executor can read different files — never guess which. Keys
+        # are matched spelling-normalised over the same alias list the
+        # path picker accepts (fuzz family d). Collect from the raw args:
+        # merging by _norm_key first hid distinct values under two
+        # spellings of the same key (`file_path` vs `FILE_PATH`).
+        _path_keys_n = {_norm_key(k) for k in _PATH_KEY_PRIORITY}
+        _destinations = {
+            v.strip()
+            for k, v in tool_args.items()
+            if _norm_key(k) in _path_keys_n and isinstance(v, str) and v.strip()
+        }
+        if len(_destinations) > 1 and _normalize_tool_name(tool_name) not in _RENAME_TOOL_NAMES_N:
+            logger.warning("Atbash blocked conflicting destination keys tool=%s", tool_name)
+            if self.fail_closed:
+                return {
+                    "action": "block",
+                    "message": "Blocked (conflicting destination paths in one tool call).",
+                }
+            return None
+
+        # ── Guard self-protection ────────────────────────────────────────────
+        # Refuse writes aimed at the guard's own state before any judging or
+        # memory handling — the tool map, allowlist, hash baseline and agent
+        # key are what every other check stands on.
+        refusal = self._refuse_guard_state_write(tool_name, tool_args)
+        if refusal is not None:
+            return refusal
+
         # ── Memory write path ────────────────────────────────────────────────
         # Mirrors openclaw's guard.handleBeforeToolCall: memory writes skip the
         # regular audit and go through the dedicated memory guard (diff → judge).
         mem_entry = _classify_memory_write(tool_name, tool_args)
         if mem_entry is not None:
-            return self._handle_memory_write(
+            mem_result = self._handle_memory_write(
                 tool_name=tool_name,
                 tool_args=tool_args,
                 mem_entry=mem_entry,
@@ -1248,6 +2777,10 @@ class AtbashHermesGuard:
                 tool_call_id=tool_call_id,
                 hook_context=hook_context,
             )
+            # A patch that also lands outside memory is judged on its full
+            # arguments as well; the memory scan alone never clears it.
+            if mem_result is not None or not mem_entry.get("judge_rest"):
+                return mem_result
 
         # ── Memory read path ─────────────────────────────────────────────────
         # Check if local file has drifted from cached snapshot (tampering signal).
@@ -1303,7 +2836,8 @@ class AtbashHermesGuard:
                 if self.fail_closed:
                     return {
                         "action": "block",
-                        "message": f"Blocked (Atbash judge error): {reason}",
+                        # Judge error bodies are not echoed to the model.
+                        "message": "Blocked (Atbash judge error).",
                     }
                 return None
 
@@ -1338,7 +2872,8 @@ class AtbashHermesGuard:
             if self.fail_closed:
                 return {
                     "action": "block",
-                    "message": f"Blocked (Atbash unavailable): {e}",
+                    # Exception text stays in the log only.
+                    "message": "Blocked (Atbash unavailable).",
                 }
             return None
 
@@ -1348,13 +2883,25 @@ def register(ctx):
     state: Dict[str, Any] = {"guard": None, "error": "guard initialization incomplete"}
 
     def fail_closed_pre_tool_call(**kwargs: Any):
+        # The hook must never raise: Hermes isolates hook exceptions by
+        # running the tool unjudged, so any crash here — including a
+        # BaseException from deep in the guard — becomes a decision.
         guard = state["guard"]
         if guard is None:
             return {
                 "action": "block",
-                "message": f"Blocked (Atbash guard unavailable): {state['error']}",
+                "message": "Blocked (Atbash guard unavailable).",
+            }
+        try:
+            return guard.pre_tool_call(**kwargs)
+        except BaseException as error:  # noqa: BLE001 — deliberate, see above
+            logger.error("Atbash pre_tool_call crashed err=%s", error)
+            if not getattr(guard, "fail_closed", True):
+                return None
+            return {
+                "action": "block",
+                "message": "Blocked (Atbash guard error).",
             }
-        return guard.pre_tool_call(**kwargs)
 
     # Hermes isolates plugin-load exceptions and continues startup, so install
     # the blocking hook before any SDK/config initialization can fail.